diff --git a/thys/Jinja/BV/BVExec.thy b/thys/Jinja/BV/BVExec.thy
--- a/thys/Jinja/BV/BVExec.thy
+++ b/thys/Jinja/BV/BVExec.thy
@@ -1,460 +1,460 @@
 (*  Title:      HOL/MicroJava/BV/JVM.thy
 
     Author:     Tobias Nipkow, Gerwin Klein
     Copyright   2000 TUM
 *)
 
 section \<open>Kildall for the JVM \label{sec:JVM}\<close>
 
 theory BVExec
 imports "../DFA/Abstract_BV" TF_JVM "../DFA/Typing_Framework_2"
 begin
 
 definition kiljvm :: "jvm_prog \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> ty \<Rightarrow> 
              instr list \<Rightarrow> ex_table \<Rightarrow> ty\<^sub>i' err list \<Rightarrow> ty\<^sub>i' err list"
 where
   "kiljvm P mxs mxl T\<^sub>r is xt \<equiv>
   kildall (JVM_SemiType.le P mxs mxl) (JVM_SemiType.sup P mxs mxl) 
           (exec P mxs T\<^sub>r xt is)"
 
 definition wt_kildall :: "jvm_prog \<Rightarrow> cname \<Rightarrow> ty list \<Rightarrow> ty \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> 
                  instr list \<Rightarrow> ex_table \<Rightarrow> bool"
 where
   "wt_kildall P C' Ts T\<^sub>r mxs mxl\<^sub>0 is xt \<equiv>
    0 < size is \<and> 
    (let first  = Some ([],[OK (Class C')]@(map OK Ts)@(replicate mxl\<^sub>0 Err));
         start  = OK first#(replicate (size is - 1) (OK None));
         result = kiljvm P mxs (1+size Ts+mxl\<^sub>0) T\<^sub>r is xt  start
     in \<forall>n < size is. result!n \<noteq> Err)"
 
 definition wf_jvm_prog\<^sub>k :: "jvm_prog \<Rightarrow> bool"
 where
   "wf_jvm_prog\<^sub>k P \<equiv>
   wf_prog (\<lambda>P C' (M,Ts,T\<^sub>r,(mxs,mxl\<^sub>0,is,xt)). wt_kildall P C' Ts T\<^sub>r mxs mxl\<^sub>0 is xt) P"
 
 context start_context
 begin
 
 lemma Cons_less_Conss3 [simp]:
   "x#xs [\<sqsubset>\<^bsub>r\<^esub>] y#ys = (x \<sqsubset>\<^bsub>r\<^esub> y \<and> xs [\<sqsubseteq>\<^bsub>r\<^esub>] ys \<or> x = y \<and> xs [\<sqsubset>\<^bsub>r\<^esub>] ys)"
   apply (unfold lesssub_def )
   apply auto
   apply (insert sup_state_opt_err)
   apply (unfold lesssub_def lesub_def sup_state_opt_def sup_state_def sup_ty_opt_def)
   apply (simp only: JVM_le_unfold )
   apply fastforce
   done
 
 lemma acc_le_listI3 [intro!]:
   " acc r \<Longrightarrow> acc (Listn.le r)"
 apply (unfold acc_def)
 apply (subgoal_tac
  "wf(UN n. {(ys,xs). size xs = n \<and> size ys = n \<and> xs <_(Listn.le r) ys})")
    apply (erule wf_subset)
  apply (blast intro: lesssub_lengthD)
 apply (rule wf_UN)
  prefer 2
  apply (rename_tac m n)
  apply (case_tac "m=n")
   apply simp
  apply (fast intro!: equals0I dest: not_sym)
 apply (rename_tac n)
 apply (induct_tac n)
  apply (simp add: lesssub_def cong: conj_cong)
 apply (rename_tac k)
 apply (simp add: wf_eq_minimal del: r_def f_def step_def A_def)
 apply (simp (no_asm) add: length_Suc_conv cong: conj_cong del: r_def f_def step_def A_def)
 apply clarify
 apply (rename_tac M m)
 apply (case_tac "\<exists>x xs. size xs = k \<and> x#xs \<in> M")
  prefer 2
  apply (erule thin_rl)
  apply (erule thin_rl)
  apply blast
 apply (erule_tac x = "{a. \<exists>xs. size xs = k \<and> a#xs:M}" in allE)
 apply (erule impE)
  apply blast
 apply (thin_tac "\<exists>x xs. P x xs" for P)
 apply clarify
 apply (rename_tac maxA xs)
 apply (erule_tac x = "{ys. size ys = size xs \<and> maxA#ys \<in> M}" in allE)
 apply (erule impE)
  apply blast
 apply clarify
 apply (thin_tac "m \<in> M")
 apply (thin_tac "maxA#xs \<in> M")
 apply (rule bexI)
  prefer 2
  apply assumption
 apply clarify
 apply (simp del: r_def f_def step_def A_def)
 apply blast
   done
 
 
 lemma wf_jvm: " wf {(ss', ss). ss [\<sqsubset>\<^bsub>r\<^esub>] ss'}"
   apply (insert acc_le_listI3 acc_JVM [OF wf])
   by (simp add: acc_def r_def) 
 
 lemma iter_properties_bv[rule_format]:
-shows "\<lbrakk> \<forall>p\<in>w0. p < n; ss0 \<in> list n A; \<forall>p<n. p \<notin> w0 \<longrightarrow> stable r step ss0 p \<rbrakk> \<Longrightarrow>
+shows "\<lbrakk> \<forall>p\<in>w0. p < n; ss0 \<in> nlists n A; \<forall>p<n. p \<notin> w0 \<longrightarrow> stable r step ss0 p \<rbrakk> \<Longrightarrow>
          iter f step ss0 w0 = (ss',w') \<longrightarrow>
-         ss' \<in> list n A \<and> stables r step ss' \<and> ss0 [\<sqsubseteq>\<^sub>r] ss' \<and>
-         (\<forall>ts\<in>list n A. ss0 [\<sqsubseteq>\<^sub>r] ts \<and> stables r step ts \<longrightarrow> ss' [\<sqsubseteq>\<^sub>r] ts)"
+         ss' \<in> nlists n A \<and> stables r step ss' \<and> ss0 [\<sqsubseteq>\<^sub>r] ss' \<and>
+         (\<forall>ts\<in>nlists n A. ss0 [\<sqsubseteq>\<^sub>r] ts \<and> stables r step ts \<longrightarrow> ss' [\<sqsubseteq>\<^sub>r] ts)"
 (*<*) (is "PROP ?P")
 
 proof -
   show "PROP ?P"
     apply (insert semi bounded_step exec_pres_type step_mono[OF wf])  
     apply (unfold iter_def stables_def)
 
     apply (rule_tac P = "\<lambda>(ss,w).
-                ss \<in> list n A \<and> (\<forall>p<n. p \<notin> w \<longrightarrow> stable r step ss p) \<and> ss0 [\<sqsubseteq>\<^sub>r] ss \<and>
-   (\<forall>ts\<in>list n A. ss0 [\<sqsubseteq>\<^sub>r] ts \<and> stables r step ts \<longrightarrow> ss [\<sqsubseteq>\<^sub>r] ts) \<and>
+                ss \<in> nlists n A \<and> (\<forall>p<n. p \<notin> w \<longrightarrow> stable r step ss p) \<and> ss0 [\<sqsubseteq>\<^sub>r] ss \<and>
+   (\<forall>ts\<in>nlists n A. ss0 [\<sqsubseteq>\<^sub>r] ts \<and> stables r step ts \<longrightarrow> ss [\<sqsubseteq>\<^sub>r] ts) \<and>
    (\<forall>p\<in>w. p < n)" and
    r = "{(ss',ss) . ss [\<sqsubset>\<^sub>r] ss'} <*lex*> finite_psubset"
          in while_rule)
 
   \<comment> \<open>Invariant holds initially:\<close>  
         apply (simp add:stables_def  semilat_Def   del: n_def A_def r_def f_def step_def)
         apply (blast intro:le_list_refl')     
    
   \<comment> \<open>Invariant is preserved:\<close>
        apply(simp add: stables_def split_paired_all del: A_def r_def f_def step_def n_def)
        apply(rename_tac ss w)
        apply(subgoal_tac "(SOME p. p \<in> w) \<in> w")
         prefer 2 apply (fast intro: someI)
        apply(subgoal_tac "\<forall>(q,t) \<in> set (step (SOME p. p \<in> w) (ss ! (SOME p. p \<in> w))). q < length ss \<and> t \<in> A")
         prefer 2
         apply clarify
         apply (rule conjI)
          apply(clarsimp, blast dest!: boundedD)
         apply (subgoal_tac "(SOME p. p \<in> w) < n")
          apply (subgoal_tac "(ss ! (SOME p. p \<in> w)) \<in> A")
           apply (fastforce simp only:n_def dest:pres_typeD )   
          apply simp
         apply simp
        apply (subst decomp_propa)
         apply blast
        apply (simp del:A_def r_def f_def step_def n_def)
        apply (rule conjI)
         apply (rule Semilat.merges_preserves_type[OF Semilat.intro, OF semi])
          apply blast
         apply clarify
         apply (rule conjI)
          apply(clarsimp, blast dest!: boundedD)
         apply (erule pres_typeD)
           prefer 3
           apply assumption
-         apply (erule listE_nth_in)
+         apply (erule nlistsE_nth_in)
          apply blast
         apply (simp only:n_def)
        apply (rule conjI)
         apply clarify
-        apply (subgoal_tac "ss \<in> list (length is) A" "\<forall>p\<in>w. p <  (length is) " "\<forall>p<(length is). p \<notin> w \<longrightarrow> stable r step ss p "
+        apply (subgoal_tac "ss \<in> nlists (length is) A" "\<forall>p\<in>w. p <  (length is) " "\<forall>p<(length is). p \<notin> w \<longrightarrow> stable r step ss p "
  "p < length is")
             apply (blast   intro!: Semilat.stable_pres_lemma[OF Semilat.intro, OF semi])
            apply (simp only:n_def)
           apply (simp only:n_def)
          apply (simp only:n_def)
         apply (simp only:n_def)
        apply (rule conjI)
-        apply (subgoal_tac "ss \<in> list (length is) A" 
+        apply (subgoal_tac "ss \<in> nlists (length is) A" 
                "\<forall>(q,t)\<in>set (step (SOME p. p \<in> w) (ss ! (SOME p. p \<in> w))). q < length is \<and> t \<in> A"
-               "ss [\<sqsubseteq>\<^bsub>r\<^esub>] merges f (step (SOME p. p \<in> w) (ss ! (SOME p. p \<in> w))) ss" "ss0\<in> list (size is) A"
-               "merges f (step (SOME p. p \<in> w) (ss ! (SOME p. p \<in> w))) ss \<in> list (size is) A" 
-               "ss \<in>list (size is) A" "order r A" "ss0 [\<sqsubseteq>\<^bsub>r\<^esub>] ss ")
+               "ss [\<sqsubseteq>\<^bsub>r\<^esub>] merges f (step (SOME p. p \<in> w) (ss ! (SOME p. p \<in> w))) ss" "ss0\<in> nlists (size is) A"
+               "merges f (step (SOME p. p \<in> w) (ss ! (SOME p. p \<in> w))) ss \<in> nlists (size is) A" 
+               "ss \<in>nlists (size is) A" "order r A" "ss0 [\<sqsubseteq>\<^bsub>r\<^esub>] ss ")
                 apply (blast dest: le_list_trans)
                apply simp
               apply (simp only:semilat_Def)
              apply (simp only:n_def)
             apply (fastforce simp only: n_def dest:Semilat.merges_preserves_type[OF Semilat.intro, OF semi] )
            apply (simp only:n_def)
           apply (blast intro:Semilat.merges_incr[OF Semilat.intro, OF semi])
          apply (subgoal_tac "length ss = n")
           apply (simp only:n_def)
-         apply (subgoal_tac "ss \<in>list n A")
+         apply (subgoal_tac "ss \<in>nlists n A")
           defer
           apply simp
          apply (simp only:n_def)
         prefer 5
-        apply (simp only:listE_length n_def)
+        apply (simp only:nlistsE_length n_def)
        apply(rule conjI)
         apply (clarsimp simp del: A_def r_def f_def step_def)
         apply (blast intro!: Semilat.merges_bounded_lemma[OF Semilat.intro, OF semi])       
        apply (subgoal_tac "bounded step n")
         apply (blast dest!: boundedD)
        apply (simp only:n_def)
 
   \<comment> \<open>Postcondition holds upon termination:\<close>
       apply(clarsimp simp add: stables_def split_paired_all)
   
   \<comment> \<open>Well-foundedness of the termination relation:\<close>    
       apply (rule wf_lex_prod)
      apply (simp only:wf_jvm) 
     apply (rule wf_finite_psubset) 
 
   \<comment> \<open>Loop decreases along termination relation:\<close>
      apply(simp add: stables_def split_paired_all del: A_def r_def f_def step_def)
      apply(rename_tac ss w)
      apply(subgoal_tac "(SOME p. p \<in> w) \<in> w")
       prefer 2 apply (fast intro: someI)
      apply(subgoal_tac "\<forall>(q,t) \<in> set (step (SOME p. p \<in> w) (ss ! (SOME p. p \<in> w))). q < length ss \<and> t \<in> A")
       prefer 2
       apply clarify
       apply (rule conjI)
        apply(clarsimp, blast dest!: boundedD)
       apply (erule pres_typeD)
         prefer 3
         apply assumption
-       apply (erule listE_nth_in)
+       apply (erule nlistsE_nth_in)
        apply blast
       apply blast
      apply (subst decomp_propa)
       apply blast
      apply clarify
-  apply (simp del: listE_length  A_def r_def f_def step_def
+  apply (simp del: nlistsE_length  A_def r_def f_def step_def
       add: lex_prod_def finite_psubset_def 
            bounded_nat_set_is_finite)
      apply (rule termination_lemma)
         apply (insert Semilat.intro)
         apply assumption+
       defer
       apply assumption
      defer
      apply clarsimp   
     done
 qed
 
 (*>*)
 
 
 lemma kildall_properties_bv: 
-shows "\<lbrakk> ss0 \<in> list n A \<rbrakk> \<Longrightarrow>
-  kildall r f step ss0 \<in> list n A \<and>
+shows "\<lbrakk> ss0 \<in> nlists n A \<rbrakk> \<Longrightarrow>
+  kildall r f step ss0 \<in> nlists n A \<and>
   stables r step (kildall r f step ss0) \<and>
   ss0 [\<sqsubseteq>\<^sub>r] kildall r f step ss0 \<and>
-  (\<forall>ts\<in>list n A. ss0 [\<sqsubseteq>\<^sub>r] ts \<and> stables r step ts \<longrightarrow>
+  (\<forall>ts\<in>nlists n A. ss0 [\<sqsubseteq>\<^sub>r] ts \<and> stables r step ts \<longrightarrow>
                  kildall r f step ss0 [\<sqsubseteq>\<^sub>r] ts)"
 (*<*) (is "PROP ?P")
 proof -
   show "PROP ?P"
   apply (unfold kildall_def)
     apply(case_tac "iter f step ss0 (unstables r step ss0)")
     apply (simp del:r_def f_def n_def step_def A_def)
     apply (rule iter_properties_bv)      
      apply (simp_all add: unstables_def stable_def)
     done
 qed
 
 end
 
 lemma (in start_context) is_bcv_kiljvm: 
 shows "is_bcv r Err step (size is) A (kiljvm P mxs mxl T\<^sub>r is xt)" 
   apply (insert wf)
   apply (unfold kiljvm_def)
   apply (fold r_def f_def step_def_exec n_def)
   apply(unfold is_bcv_def wt_step_def)
   apply(insert semi  kildall_properties_bv)
   apply(simp only:stables_def)
   apply clarify
-  apply(subgoal_tac "kildall r f step \<tau>s\<^sub>0 \<in> list n A")
+  apply(subgoal_tac "kildall r f step \<tau>s\<^sub>0 \<in> nlists n A")
    prefer 2
    apply (fastforce intro: kildall_properties_bv)
   apply (rule iffI)
    apply (rule_tac x = "kildall r f step \<tau>s\<^sub>0" in bexI) 
     apply (rule conjI)
      apply (fastforce intro: kildall_properties_bv)
   apply (force intro: kildall_properties_bv)
    apply simp
   apply clarify
   apply(subgoal_tac "kildall r f step \<tau>s\<^sub>0!pa <=_r \<tau>s!pa")
    defer
    apply (blast intro!: le_listD less_lengthI)
   apply (subgoal_tac "\<tau>s!pa \<noteq> Err")
    defer
    apply simp
   apply (rule ccontr)
   apply (simp only:top_def r_def JVM_le_unfold)
   apply fastforce
   done
 
 (* FIXME: move? *)
 lemma subset_replicate [intro?]: "set (replicate n x) \<subseteq> {x}"
   by (induct n) auto
 
 lemma in_set_replicate:
   assumes "x \<in> set (replicate n y)"
   shows "x = y"
 (*<*)
 proof -
   note assms
   also have "set (replicate n y) \<subseteq> {y}" ..
   finally show ?thesis by simp
 qed
 (*>*)
 
 lemma (in start_context) start_in_A [intro?]:
-  "0 < size is \<Longrightarrow> start \<in> list (size is) A"
+  "0 < size is \<Longrightarrow> start \<in> nlists (size is) A"
   using Ts C
 (*<*)
   apply (simp add: JVM_states_unfold) 
-  apply (force intro!: listI list_appendI dest!: in_set_replicate)
+  apply (force intro!: nlistsI nlists_appendI dest!: in_set_replicate)
   done   
 (*>*)
 
 
 theorem (in start_context) wt_kil_correct:
   assumes wtk: "wt_kildall P C Ts T\<^sub>r mxs mxl\<^sub>0 is xt"
   shows "\<exists>\<tau>s. wt_method P C Ts T\<^sub>r mxs mxl\<^sub>0 is xt \<tau>s"
 (*<*)
 proof -
   from wtk obtain res where    
     result:   "res = kiljvm P mxs mxl T\<^sub>r is xt start" and
     success:  "\<forall>n < size is. res!n \<noteq> Err" and
     instrs:   "0 < size is" 
     by (unfold wt_kildall_def) simp
       
   have bcv: "is_bcv r Err step (size is) A (kiljvm P mxs mxl T\<^sub>r is xt)"
     by (rule is_bcv_kiljvm)
     
-  from instrs have "start \<in> list (size is) A" ..
+  from instrs have "start \<in> nlists (size is) A" ..
   with bcv success result have 
-    "\<exists>ts\<in>list (size is) A. start [\<sqsubseteq>\<^sub>r] ts \<and> wt_step r Err step ts"
+    "\<exists>ts\<in>nlists (size is) A. start [\<sqsubseteq>\<^sub>r] ts \<and> wt_step r Err step ts"
     by (unfold is_bcv_def) blast
   then obtain \<tau>s' where
-    in_A: "\<tau>s' \<in> list (size is) A" and
+    in_A: "\<tau>s' \<in> nlists (size is) A" and
     s:    "start [\<sqsubseteq>\<^sub>r] \<tau>s'" and
     w:    "wt_step r Err step \<tau>s'"
     by blast
   hence wt_err_step: "wt_err_step (sup_state_opt P) step \<tau>s'"
     by (simp add: wt_err_step_def JVM_le_Err_conv)
 
   from in_A have l: "size \<tau>s' = size is" by simp  
   moreover {
     from in_A  have "check_types P mxs mxl \<tau>s'" by (simp add: check_types_def)
     also from w have "\<forall>x \<in> set \<tau>s'. x \<noteq> Err" 
       by (auto simp add: wt_step_def all_set_conv_all_nth)
     hence [symmetric]: "map OK (map ok_val \<tau>s') = \<tau>s'" 
       by (auto intro!: map_idI simp add: wt_step_def)
     finally  have "check_types P mxs mxl (map OK (map ok_val \<tau>s'))" .
   } 
   moreover {  
     from s have "start!0 \<sqsubseteq>\<^sub>r \<tau>s'!0" by (rule le_listD) simp
     moreover
     from instrs w l 
     have "\<tau>s'!0 \<noteq> Err" by (unfold wt_step_def) simp
     then obtain \<tau>s0 where "\<tau>s'!0 = OK \<tau>s0" by auto
     ultimately
     have "wt_start P C Ts mxl\<^sub>0 (map ok_val \<tau>s')" using l instrs
       by (unfold wt_start_def) 
          (simp add: lesub_def JVM_le_Err_conv Err.le_def)
   }
   moreover 
   from in_A have "set \<tau>s' \<subseteq> A" by simp  
   with wt_err_step bounded_step
   have "wt_app_eff (sup_state_opt P) app eff (map ok_val \<tau>s')"
     by (auto intro: wt_err_imp_wt_app_eff simp add: l)
   ultimately
   have "wt_method P C Ts T\<^sub>r mxs mxl\<^sub>0 is xt (map ok_val \<tau>s')"
     using instrs by (simp add: wt_method_def2 check_types_def del: map_map)
   thus ?thesis by blast
 qed
 (*>*)
 
 
 theorem (in start_context) wt_kil_complete:
   assumes wtm: "wt_method P C Ts T\<^sub>r mxs mxl\<^sub>0 is xt \<tau>s"
   shows "wt_kildall P C Ts T\<^sub>r mxs mxl\<^sub>0 is xt"
 (*<*)
 proof -
   from wtm obtain
     instrs:   "0 < size is" and
     length:   "length \<tau>s = length is" and 
     ck_type:  "check_types P mxs mxl (map OK \<tau>s)" and
     wt_start: "wt_start P C Ts mxl\<^sub>0 \<tau>s" and
     app_eff:  "wt_app_eff (sup_state_opt P) app eff \<tau>s"
     by (simp add: wt_method_def2 check_types_def)
 
   from ck_type
   have in_A: "set (map OK \<tau>s) \<subseteq> A" 
     by (simp add: check_types_def)  
   with app_eff in_A bounded_step
   have "wt_err_step (sup_state_opt P) (err_step (size \<tau>s) app eff) (map OK \<tau>s)"
     by - (erule wt_app_eff_imp_wt_err,
           auto simp add: exec_def length states_def)
   hence wt_err: "wt_err_step (sup_state_opt P) step (map OK \<tau>s)" 
     by (simp add: length)
   have is_bcv: "is_bcv r Err step (size is) A (kiljvm P mxs mxl T\<^sub>r is xt)"
     by (rule is_bcv_kiljvm)
-  moreover from instrs have "start \<in> list (size is) A" ..
+  moreover from instrs have "start \<in> nlists (size is) A" ..
   moreover
   let ?\<tau>s = "map OK \<tau>s"  
   have less_\<tau>s: "start [\<sqsubseteq>\<^sub>r] ?\<tau>s"
   proof (rule le_listI)
     from length instrs
     show "length start = length (map OK \<tau>s)" by simp
   next
     fix n
     from wt_start have "P \<turnstile> ok_val (start!0) \<le>' \<tau>s!0" 
       by (simp add: wt_start_def)
     moreover from instrs length have "0 < length \<tau>s" by simp
     ultimately have "start!0 \<sqsubseteq>\<^sub>r ?\<tau>s!0" 
       by (simp add: JVM_le_Err_conv lesub_def)
     moreover {
       fix n'
       have "OK None \<sqsubseteq>\<^sub>r ?\<tau>s!n"
         by (auto simp add: JVM_le_Err_conv Err.le_def lesub_def 
                  split: err.splits)
       hence "\<lbrakk>n = Suc n'; n < size start\<rbrakk> \<Longrightarrow> start!n \<sqsubseteq>\<^sub>r ?\<tau>s!n" by simp
     }
     ultimately
     show "n < size start \<Longrightarrow> start!n \<sqsubseteq>\<^sub>r ?\<tau>s!n" by (cases n, blast+)   
   qed
   moreover
   from ck_type length
-  have "?\<tau>s \<in> list (size is) A"
-    by (auto intro!: listI simp add: check_types_def)
+  have "?\<tau>s \<in> nlists (size is) A"
+    by (auto intro!: nlistsI simp add: check_types_def)
   moreover
   from wt_err have "wt_step r Err step ?\<tau>s" 
     by (simp add: wt_err_step_def JVM_le_Err_conv)
   ultimately
   have "\<forall>p. p < size is \<longrightarrow> kiljvm P  mxs mxl T\<^sub>r is xt start ! p \<noteq> Err" 
     by (unfold is_bcv_def) blast
   with instrs 
   show "wt_kildall P C Ts T\<^sub>r mxs mxl\<^sub>0 is xt" by (unfold wt_kildall_def) simp
 qed
 (*>*)
 
 
 theorem jvm_kildall_correct:
   "wf_jvm_prog\<^sub>k P = wf_jvm_prog P"
 (*<*)
 proof 
   let ?\<Phi> = "\<lambda>C M. let (C,Ts,T\<^sub>r,(mxs,mxl\<^sub>0,is,xt)) = method P C M in 
               SOME \<tau>s. wt_method P C Ts T\<^sub>r mxs mxl\<^sub>0 is xt \<tau>s"
 
   \<comment> \<open>soundness\<close>
   assume wt: "wf_jvm_prog\<^sub>k P"
   hence "wf_jvm_prog\<^bsub>?\<Phi>\<^esub> P"
     apply (unfold wf_jvm_prog_phi_def wf_jvm_prog\<^sub>k_def)    
     apply (erule wf_prog_lift)
     apply (auto dest!: start_context.wt_kil_correct [OF start_context.intro] 
                 intro: someI)
     apply (erule sees_method_is_class)
     done
   thus "wf_jvm_prog P" by (unfold wf_jvm_prog_def) fast
 next
   \<comment> \<open>completeness\<close>
   assume wt: "wf_jvm_prog P"
   thus "wf_jvm_prog\<^sub>k P"
     apply (unfold wf_jvm_prog_def wf_jvm_prog_phi_def wf_jvm_prog\<^sub>k_def)
     apply (clarify)
     apply (erule wf_prog_lift)
     apply (auto intro!: start_context.wt_kil_complete start_context.intro)
     apply (erule sees_method_is_class)
     done
 qed
 (*>*)
 
 end
diff --git a/thys/Jinja/BV/JVM_SemiType.thy b/thys/Jinja/BV/JVM_SemiType.thy
--- a/thys/Jinja/BV/JVM_SemiType.thy
+++ b/thys/Jinja/BV/JVM_SemiType.thy
@@ -1,375 +1,375 @@
 (*  Title:      HOL/MicroJava/BV/JVM.thy
 
     Author:     Gerwin Klein
     Copyright   2000 TUM
 
 *)
 
 section \<open>The JVM Type System as Semilattice\<close>
 
 theory JVM_SemiType imports SemiType begin
 
 type_synonym ty\<^sub>l = "ty err list"
 type_synonym ty\<^sub>s = "ty list"
 type_synonym ty\<^sub>i = "ty\<^sub>s \<times> ty\<^sub>l"
 type_synonym ty\<^sub>i' = "ty\<^sub>i option"
 type_synonym ty\<^sub>m = "ty\<^sub>i' list"
 type_synonym ty\<^sub>P = "mname \<Rightarrow> cname \<Rightarrow> ty\<^sub>m"
 
 
 definition stk_esl :: "'c prog \<Rightarrow> nat \<Rightarrow> ty\<^sub>s esl"
 where
   "stk_esl P mxs \<equiv> upto_esl mxs (SemiType.esl P)"
 
 definition loc_sl :: "'c prog \<Rightarrow> nat \<Rightarrow> ty\<^sub>l sl"
 where
   "loc_sl P mxl \<equiv> Listn.sl mxl (Err.sl (SemiType.esl P))"
 
 definition sl :: "'c prog \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> ty\<^sub>i' err sl"
 where
   "sl P mxs mxl \<equiv>
   Err.sl(Opt.esl(Product.esl (stk_esl P mxs) (Err.esl(loc_sl P mxl))))"
 
 
 definition states :: "'c prog \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> ty\<^sub>i' err set"
 where "states P mxs mxl \<equiv> fst(sl P mxs mxl)"
 
 definition le :: "'c prog \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> ty\<^sub>i' err ord"
 where
   "le P mxs mxl \<equiv> fst(snd(sl P mxs mxl))"
 
 definition sup :: "'c prog \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> ty\<^sub>i' err binop"
 where
   "sup P mxs mxl \<equiv> snd(snd(sl P mxs mxl))"
 
 
 definition sup_ty_opt :: "['c prog,ty err,ty err] \<Rightarrow> bool" 
     ("_ \<turnstile> _ \<le>\<^sub>\<top> _" [71,71,71] 70)
 where
   "sup_ty_opt P \<equiv> Err.le (subtype P)"
 
 definition sup_state :: "['c prog,ty\<^sub>i,ty\<^sub>i] \<Rightarrow> bool"   
     ("_ \<turnstile> _ \<le>\<^sub>i _" [71,71,71] 70)
 where
   "sup_state P \<equiv> Product.le (Listn.le (subtype P)) (Listn.le (sup_ty_opt P))"
 
 definition sup_state_opt :: "['c prog,ty\<^sub>i',ty\<^sub>i'] \<Rightarrow> bool" 
     ("_ \<turnstile> _ \<le>'' _" [71,71,71] 70)
 where
   "sup_state_opt P \<equiv> Opt.le (sup_state P)"
 
 abbreviation
   sup_loc :: "['c prog,ty\<^sub>l,ty\<^sub>l] \<Rightarrow> bool"  ("_ \<turnstile> _ [\<le>\<^sub>\<top>] _"  [71,71,71] 70)
   where "P \<turnstile> LT [\<le>\<^sub>\<top>] LT' \<equiv> list_all2 (sup_ty_opt P) LT LT'"
 
 notation (ASCII)
   sup_ty_opt  ("_ |- _ <=T _" [71,71,71] 70) and
   sup_state  ("_ |- _ <=i _"  [71,71,71] 70) and
   sup_state_opt  ("_ |- _ <=' _"  [71,71,71] 70) and
   sup_loc  ("_ |- _ [<=T] _"  [71,71,71] 70)
 
 
 subsection "Unfolding"
 
 lemma JVM_states_unfold: 
-  "states P mxs mxl \<equiv> err(opt((Union {list n (types P) |n. n <= mxs}) \<times>
-                                 list mxl (err(types P))))"
+  "states P mxs mxl \<equiv> err(opt((Union {nlists n (types P) |n. n <= mxs}) \<times>
+                                 nlists mxl (err(types P))))"
 (*<*)
   apply (unfold states_def sl_def Opt.esl_def Err.sl_def
          stk_esl_def loc_sl_def Product.esl_def
          Listn.sl_def upto_esl_def SemiType.esl_def Err.esl_def)
   apply simp
   done
 (*>*)
 
 lemma JVM_le_unfold:
  "le P m n \<equiv> 
   Err.le(Opt.le(Product.le(Listn.le(subtype P))(Listn.le(Err.le(subtype P)))))" 
 (*<*)
   apply (unfold le_def sl_def Opt.esl_def Err.sl_def
          stk_esl_def loc_sl_def Product.esl_def  
          Listn.sl_def upto_esl_def SemiType.esl_def Err.esl_def) 
   apply simp
   done
 (*>*)
     
 lemma sl_def2:
   "JVM_SemiType.sl P mxs mxl \<equiv> 
   (states P mxs mxl, JVM_SemiType.le P mxs mxl, JVM_SemiType.sup P mxs mxl)"
 (*<*) by (unfold JVM_SemiType.sup_def states_def JVM_SemiType.le_def) simp (*>*)
 
 
 lemma JVM_le_conv:
   "le P m n (OK t1) (OK t2) = P \<turnstile> t1 \<le>' t2"
 (*<*) by (simp add: JVM_le_unfold Err.le_def lesub_def sup_state_opt_def  
                 sup_state_def sup_ty_opt_def) (*>*)
 
 lemma JVM_le_Err_conv:
   "le P m n = Err.le (sup_state_opt P)"
 (*<*) by (unfold sup_state_opt_def sup_state_def  
              sup_ty_opt_def JVM_le_unfold) simp (*>*)
 
 lemma err_le_unfold [iff]: 
   "Err.le r (OK a) (OK b) = r a b"
 (*<*) by (simp add: Err.le_def lesub_def) (*>*)
   
 
 subsection \<open>Semilattice\<close>
 lemma order_sup_state_opt' [intro, simp]:
   "wf_prog wf_mb P \<Longrightarrow> 
-      order (sup_state_opt P) (opt ((\<Union> {list n (types P) |n. n \<le> mxs} ) \<times> list (Suc (length Ts + mxl\<^sub>0)) (err (types P))))"   
+      order (sup_state_opt P) (opt ((\<Union> {nlists n (types P) |n. n \<le> mxs} ) \<times> nlists (Suc (length Ts + mxl\<^sub>0)) (err (types P))))"   
 (*<*) 
   apply (unfold sup_state_opt_def sup_state_def sup_ty_opt_def  ) 
   apply (blast intro:order_le_prodI) \<comment>\<open> use Listn.thy.order_listI2  \<close>
   done 
 (*<*) 
 
 
 lemma semilat_JVM [intro?]:
   "wf_prog wf_mb P \<Longrightarrow> semilat (JVM_SemiType.sl P mxs mxl)"
 (*<*)
   apply (unfold JVM_SemiType.sl_def stk_esl_def loc_sl_def)  
   apply (blast intro: err_semilat_Product_esl err_semilat_upto_esl 
                       Listn_sl err_semilat_JType_esl)
   done
 (*>*)
 
 subsection \<open>Widening with \<open>\<top>\<close>\<close>
 
 lemma subtype_refl: "subtype P t t" (*<*) by (simp add: fun_of_def) (*>*)
 
 lemma sup_ty_opt_refl [iff]: "P \<turnstile> T \<le>\<^sub>\<top> T"
 (*<*)
   apply (unfold sup_ty_opt_def)
   apply (fold lesub_def)
   apply (rule le_err_refl)
   apply (simp add: lesub_def)
   done
 (*>*)
 
 lemma Err_any_conv [iff]: "P \<turnstile> Err \<le>\<^sub>\<top> T = (T = Err)"
 (*<*) by (unfold sup_ty_opt_def) (rule Err_le_conv [simplified lesub_def]) (*>*)
 
 lemma any_Err [iff]: "P \<turnstile> T \<le>\<^sub>\<top> Err"
 (*<*) by (unfold sup_ty_opt_def) (rule le_Err [simplified lesub_def]) (*>*)
 
 lemma OK_OK_conv [iff]:
   "P \<turnstile> OK T \<le>\<^sub>\<top> OK T' = P \<turnstile> T \<le> T'"
 (*<*) by (simp add: sup_ty_opt_def fun_of_def) (*>*)
 
 lemma any_OK_conv [iff]:
   "P \<turnstile> X \<le>\<^sub>\<top> OK T' = (\<exists>T. X = OK T \<and> P \<turnstile> T \<le> T')"
 (*<*)
   apply (unfold sup_ty_opt_def) 
   apply (rule le_OK_conv [simplified lesub_def])
   done  
 (*>*)
 
 lemma OK_any_conv:
  "P \<turnstile> OK T \<le>\<^sub>\<top> X = (X = Err \<or> (\<exists>T'. X = OK T' \<and> P \<turnstile> T \<le> T'))"
 (*<*)
   apply (unfold sup_ty_opt_def) 
   apply (rule OK_le_conv [simplified lesub_def])
   done
 (*>*)
 
 lemma sup_ty_opt_trans [intro?, trans]:
   "\<lbrakk>P \<turnstile> a \<le>\<^sub>\<top> b; P \<turnstile> b \<le>\<^sub>\<top> c\<rbrakk> \<Longrightarrow> P \<turnstile> a \<le>\<^sub>\<top> c"
 (*<*) by (auto intro: widen_trans  
            simp add: sup_ty_opt_def Err.le_def lesub_def fun_of_def
            split: err.splits) (*>*)
 
 
 subsection "Stack and Registers"
 
 lemma stk_convert:
   "P \<turnstile> ST [\<le>] ST' = Listn.le (subtype P) ST ST'"
 (*<*) by (simp add: Listn.le_def lesub_def) (*>*)
 
 lemma sup_loc_refl [iff]: "P \<turnstile> LT [\<le>\<^sub>\<top>] LT"
 (*<*) by (rule list_all2_refl) simp (*>*)
 
 lemmas sup_loc_Cons1 [iff] = list_all2_Cons1 [of "sup_ty_opt P"] for P
 
 lemma sup_loc_def:
   "P \<turnstile> LT [\<le>\<^sub>\<top>] LT' \<equiv> Listn.le (sup_ty_opt P) LT LT'"
 (*<*) by (simp add: Listn.le_def lesub_def) (*>*)
 
 lemma sup_loc_widens_conv [iff]:
   "P \<turnstile> map OK Ts [\<le>\<^sub>\<top>] map OK Ts' = P \<turnstile> Ts [\<le>] Ts'"
 (*<*)
   by (simp add: list_all2_map1 list_all2_map2)
 (*>*)
 
 
 lemma sup_loc_trans [intro?, trans]:
   "\<lbrakk>P \<turnstile> a [\<le>\<^sub>\<top>] b; P \<turnstile> b [\<le>\<^sub>\<top>] c\<rbrakk> \<Longrightarrow> P \<turnstile> a [\<le>\<^sub>\<top>] c"
 (*<*) by (rule list_all2_trans, rule sup_ty_opt_trans) (*>*)
 
 
 subsection "State Type"
 
 lemma sup_state_conv [iff]:
   "P \<turnstile> (ST,LT) \<le>\<^sub>i (ST',LT') = (P \<turnstile> ST [\<le>] ST' \<and> P \<turnstile> LT [\<le>\<^sub>\<top>] LT')"
 (*<*) by (auto simp add: sup_state_def stk_convert lesub_def Product.le_def sup_loc_def) (*>*)
   
 lemma sup_state_conv2:
   "P \<turnstile> s1 \<le>\<^sub>i s2 = (P \<turnstile> fst s1 [\<le>] fst s2 \<and> P \<turnstile> snd s1 [\<le>\<^sub>\<top>] snd s2)"
 (*<*) by (cases s1, cases s2) simp (*>*)
 
 lemma sup_state_refl [iff]: "P \<turnstile> s \<le>\<^sub>i s"
 (*<*) by (auto simp add: sup_state_conv2) (*>*)
 
 lemma sup_state_trans [intro?, trans]:
   "\<lbrakk>P \<turnstile> a \<le>\<^sub>i b; P \<turnstile> b \<le>\<^sub>i c\<rbrakk> \<Longrightarrow> P \<turnstile> a \<le>\<^sub>i c"
 (*<*) by (auto intro: sup_loc_trans widens_trans simp add: sup_state_conv2) (*>*)
 
 
 lemma sup_state_opt_None_any [iff]:
   "P \<turnstile> None \<le>' s"
 (*<*) by (simp add: sup_state_opt_def Opt.le_def) (*>*)
 
 lemma sup_state_opt_any_None [iff]:
   "P \<turnstile> s \<le>' None = (s = None)"
 (*<*) by (simp add: sup_state_opt_def Opt.le_def) (*>*)
 
 lemma sup_state_opt_Some_Some [iff]:
   "P \<turnstile> Some a \<le>' Some b = P \<turnstile> a \<le>\<^sub>i b"  
 (*<*) by (simp add: sup_state_opt_def Opt.le_def lesub_def) (*>*)
 
 lemma sup_state_opt_any_Some:
   "P \<turnstile> (Some s) \<le>' X = (\<exists>s'. X = Some s' \<and> P \<turnstile> s \<le>\<^sub>i s')"
 (*<*) by (simp add: sup_state_opt_def Opt.le_def lesub_def) (*>*)
 
 lemma sup_state_opt_refl [iff]: "P \<turnstile> s \<le>' s"
 (*<*) by (simp add: sup_state_opt_def Opt.le_def lesub_def) (*>*)
 
 lemma sup_state_opt_trans [intro?, trans]:
   "\<lbrakk>P \<turnstile> a \<le>' b; P \<turnstile> b \<le>' c\<rbrakk> \<Longrightarrow> P \<turnstile> a \<le>' c"
 (*<*)
   apply (unfold sup_state_opt_def Opt.le_def lesub_def)
   apply (simp del: split_paired_All)
   apply (rule sup_state_trans, assumption+)
   done
 (*>*)
 
 lemma sup_state_opt_err  : "(Err.le (sup_state_opt P)) s s"
   apply (unfold JVM_le_unfold Product.le_def Opt.le_def Err.le_def lesssub_def lesub_def Listn.le_def)
   apply (auto split: err.splits)
   done
 
 lemma Cons_less_Conss1 [simp]:
   "x#xs [\<sqsubset>\<^bsub>subtype P\<^esub>] y#ys = (x \<sqsubset>\<^bsub>subtype P\<^esub> y \<and> xs [\<sqsubseteq>\<^bsub>subtype P\<^esub>] ys \<or> x = y \<and> xs [\<sqsubset>\<^bsub>subtype P\<^esub>] ys)"
   apply (unfold lesssub_def )
   apply auto
   apply (simp add:lesssub_def lesub_def) \<comment>\<open>widen_refl, subtype_refl \<close>
   done
 
 lemma Cons_less_Conss2 [simp]:
   "x#xs [\<sqsubset>\<^bsub>Err.le (subtype P)\<^esub>] y#ys = (x \<sqsubset>\<^bsub>Err.le (subtype P)\<^esub> y \<and> xs [\<sqsubseteq>\<^bsub>Err.le (subtype P)\<^esub>] ys \<or> x = y \<and> xs [\<sqsubset>\<^bsub>Err.le (subtype P)\<^esub>] ys)"
   apply (unfold lesssub_def )
   apply auto
   apply (simp add:lesssub_def lesub_def Err.le_def split: err.splits)
   done
 
 lemma acc_le_listI1 [intro!]:
   " acc (subtype P) \<Longrightarrow> acc (Listn.le (subtype P))"
   (*<*) 
 apply (unfold acc_def)
 apply (subgoal_tac
  "wf(UN n. {(ys,xs). size xs = n \<and> size ys = n \<and> xs <_(Listn.le (subtype P)) ys})")
    apply (erule wf_subset)
 
  apply (blast intro: lesssub_lengthD)
 apply (rule wf_UN)
  prefer 2
  apply (rename_tac m n)
  apply (case_tac "m=n")
   apply simp
  apply (fast intro!: equals0I dest: not_sym)
 apply (rename_tac n)
 apply (induct_tac n)
  apply (simp add: lesssub_def cong: conj_cong)
 apply (rename_tac k)
 apply (simp add: wf_eq_minimal)
 apply (simp (no_asm) add: length_Suc_conv cong: conj_cong)
 apply clarify
 apply (rename_tac M m)
 apply (case_tac "\<exists>x xs. size xs = k \<and> x#xs \<in> M")
  prefer 2
  apply (erule thin_rl)
  apply (erule thin_rl)
  apply blast
 apply (erule_tac x = "{a. \<exists>xs. size xs = k \<and> a#xs:M}" in allE)
 apply (erule impE)
  apply blast
 apply (thin_tac "\<exists>x xs. P x xs" for P)
 apply clarify
 apply (rename_tac maxA xs)
 apply (erule_tac x = "{ys. size ys = size xs \<and> maxA#ys \<in> M}" in allE)
 apply (erule impE)
  apply blast
 apply clarify
 apply (thin_tac "m \<in> M")
 apply (thin_tac "maxA#xs \<in> M")
 apply (rule bexI)
  prefer 2
  apply assumption
 apply clarify
 apply simp
 apply blast
   done
 
 lemma acc_le_listI2 [intro!]:
   " acc (Err.le (subtype P)) \<Longrightarrow> acc (Listn.le (Err.le (subtype P)))"
     (*<*) 
 apply (unfold acc_def)
 apply (subgoal_tac
  "wf(UN n. {(ys,xs). size xs = n \<and> size ys = n \<and> xs <_(Listn.le (Err.le (subtype P))) ys})")
    apply (erule wf_subset)
 
  apply (blast intro: lesssub_lengthD)
 apply (rule wf_UN)
  prefer 2
  apply (rename_tac m n)
  apply (case_tac "m=n")
   apply simp
  apply (fast intro!: equals0I dest: not_sym)
 apply (rename_tac n)
 apply (induct_tac n)
  apply (simp add: lesssub_def cong: conj_cong)
 apply (rename_tac k)
 apply (simp add: wf_eq_minimal)
 apply (simp (no_asm) add: length_Suc_conv cong: conj_cong)
 apply clarify
 apply (rename_tac M m)
 apply (case_tac "\<exists>x xs. size xs = k \<and> x#xs \<in> M")
  prefer 2
  apply (erule thin_rl)
  apply (erule thin_rl)
  apply blast
 apply (erule_tac x = "{a. \<exists>xs. size xs = k \<and> a#xs:M}" in allE)
 apply (erule impE)
  apply blast
 apply (thin_tac "\<exists>x xs. P x xs" for P)
 apply clarify
 apply (rename_tac maxA xs)
 apply (erule_tac x = "{ys. size ys = size xs \<and> maxA#ys \<in> M}" in allE)
 apply (erule impE)
  apply blast
 apply clarify
 apply (thin_tac "m \<in> M")
 apply (thin_tac "maxA#xs \<in> M")
 apply (rule bexI)
  prefer 2
  apply assumption
 apply clarify
 apply simp
 apply blast
   done
 
 lemma acc_JVM [intro]:
   "wf_prog wf_mb P \<Longrightarrow> acc (JVM_SemiType.le P mxs mxl)"
 (*<*) by (unfold JVM_le_unfold) blast (*>*)  \<comment>\<open> use acc_listI1, acc_listI2 \<close>
 
 end
diff --git a/thys/Jinja/BV/LBVJVM.thy b/thys/Jinja/BV/LBVJVM.thy
--- a/thys/Jinja/BV/LBVJVM.thy
+++ b/thys/Jinja/BV/LBVJVM.thy
@@ -1,223 +1,223 @@
 (*  Title:      HOL/MicroJava/BV/JVM.thy
 
     Author:     Tobias Nipkow, Gerwin Klein
     Copyright   2000 TUM
 *)
 
 section \<open>LBV for the JVM \label{sec:JVM}\<close>
 
 theory LBVJVM
 imports "../DFA/Abstract_BV" TF_JVM
 begin
 
 type_synonym prog_cert = "cname \<Rightarrow> mname \<Rightarrow> ty\<^sub>i' err list"
 
 definition check_cert :: "jvm_prog \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> ty\<^sub>i' err list \<Rightarrow> bool"
 where
   "check_cert P mxs mxl n cert \<equiv> check_types P mxs mxl cert \<and> size cert = n+1 \<and>
                                  (\<forall>i<n. cert!i \<noteq> Err) \<and> cert!n = OK None"
 
 definition lbvjvm :: "jvm_prog \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> ty \<Rightarrow> ex_table \<Rightarrow> 
              ty\<^sub>i' err list \<Rightarrow> instr list \<Rightarrow> ty\<^sub>i' err \<Rightarrow> ty\<^sub>i' err"
 where
   "lbvjvm P mxs maxr T\<^sub>r et cert bs \<equiv>
   wtl_inst_list bs cert (JVM_SemiType.sup P mxs maxr) (JVM_SemiType.le P mxs maxr) Err (OK None) (exec P mxs T\<^sub>r et bs) 0"
 
 definition wt_lbv :: "jvm_prog \<Rightarrow> cname \<Rightarrow> ty list \<Rightarrow> ty \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> 
              ex_table \<Rightarrow> ty\<^sub>i' err list \<Rightarrow> instr list \<Rightarrow> bool"
 where
   "wt_lbv P C Ts T\<^sub>r mxs mxl\<^sub>0 et cert ins \<equiv>
    check_cert P mxs (1+size Ts+mxl\<^sub>0) (size ins) cert \<and>
    0 < size ins \<and> 
    (let start  = Some ([],(OK (Class C))#((map OK Ts))@(replicate mxl\<^sub>0 Err));
         result = lbvjvm P mxs (1+size Ts+mxl\<^sub>0) T\<^sub>r et cert ins (OK start)
     in result \<noteq> Err)"
 
 definition wt_jvm_prog_lbv :: "jvm_prog \<Rightarrow> prog_cert \<Rightarrow> bool"
 where
   "wt_jvm_prog_lbv P cert \<equiv>
   wf_prog (\<lambda>P C (mn,Ts,T\<^sub>r,(mxs,mxl\<^sub>0,b,et)). wt_lbv P C Ts T\<^sub>r mxs mxl\<^sub>0 et (cert C mn) b) P"
 
 definition mk_cert :: "jvm_prog \<Rightarrow> nat \<Rightarrow> ty \<Rightarrow> ex_table \<Rightarrow> instr list 
               \<Rightarrow> ty\<^sub>m \<Rightarrow> ty\<^sub>i' err list"
 where
   "mk_cert P mxs T\<^sub>r et bs phi \<equiv> make_cert (exec P mxs T\<^sub>r et bs) (map OK phi) (OK None)"
 
 definition prg_cert :: "jvm_prog \<Rightarrow> ty\<^sub>P \<Rightarrow> prog_cert"
 where
   "prg_cert P phi C mn \<equiv> let (C,Ts,T\<^sub>r,(mxs,mxl\<^sub>0,ins,et)) = method P C mn
                          in  mk_cert P mxs T\<^sub>r et ins (phi C mn)"
    
 lemma check_certD [intro?]:
   "check_cert P mxs mxl n cert \<Longrightarrow> cert_ok cert n Err (OK None) (states P mxs mxl)"
   by (unfold cert_ok_def check_cert_def check_types_def) auto
 
 
 lemma (in start_context) wt_lbv_wt_step:
   assumes lbv: "wt_lbv P C Ts T\<^sub>r mxs mxl\<^sub>0 xt cert is"
-  shows "\<exists>\<tau>s \<in> list (size is) A. wt_step r Err step \<tau>s \<and> OK first \<sqsubseteq>\<^sub>r \<tau>s!0"
+  shows "\<exists>\<tau>s \<in> nlists (size is) A. wt_step r Err step \<tau>s \<and> OK first \<sqsubseteq>\<^sub>r \<tau>s!0"
 (*<*)
 proof -
   from wf have "semilat (JVM_SemiType.sl P mxs mxl)" ..
   hence "semilat (A, r, f)" by (simp add: sl_def2)
   moreover have "top r Err" by (simp add: JVM_le_Err_conv)
   moreover have "Err \<in> A" by (simp add: JVM_states_unfold)
   moreover have "bottom r (OK None)" 
     by (simp add: JVM_le_Err_conv bottom_def lesub_def Err.le_def split: err.split)
   moreover have "OK None \<in> A" by (simp add: JVM_states_unfold)
   moreover note bounded_step
   moreover from lbv have "cert_ok cert (size is) Err (OK None) A"
     by (unfold wt_lbv_def) (auto dest: check_certD)
   moreover note exec_pres_type
   moreover
   from lbv 
   have "wtl_inst_list is cert f r Err (OK None) step 0 (OK first) \<noteq> Err"
     by (simp add: wt_lbv_def lbvjvm_def step_def_exec [symmetric])    
   moreover note first_in_A
   moreover from lbv have "0 < size is" by (simp add: wt_lbv_def)
   ultimately show ?thesis by (rule lbvs.wtl_sound_strong [OF lbvs.intro, OF lbv.intro lbvs_axioms.intro, OF Semilat.intro lbv_axioms.intro])
 qed
 (*>*)
 
 
 lemma (in start_context) wt_lbv_wt_method:
   assumes lbv: "wt_lbv P C Ts T\<^sub>r mxs mxl\<^sub>0 xt cert is"  
   shows "\<exists>\<tau>s. wt_method P C Ts T\<^sub>r mxs mxl\<^sub>0 is xt \<tau>s"
 (*<*)
 proof -
   from lbv have l: "is \<noteq> []" by (simp add: wt_lbv_def)
   moreover
   from wf lbv C Ts obtain \<tau>s where 
-    list:  "\<tau>s \<in> list (size is) A" and
+    list:  "\<tau>s \<in> nlists (size is) A" and
     step:  "wt_step r Err step \<tau>s" and    
     start: "OK first \<sqsubseteq>\<^sub>r \<tau>s!0" 
     by (blast dest: wt_lbv_wt_step)
   from list have [simp]: "size \<tau>s = size is" by simp
   have "size (map ok_val \<tau>s) = size is" by simp  
   moreover from l have 0: "0 < size \<tau>s" by simp
   with step obtain \<tau>s0 where "\<tau>s!0 = OK \<tau>s0"
     by (unfold wt_step_def) blast
   with start 0 have "wt_start P C Ts mxl\<^sub>0 (map ok_val \<tau>s)"
     by (simp add: wt_start_def JVM_le_Err_conv lesub_def Err.le_def)    
   moreover {
     from list have "check_types P mxs mxl \<tau>s" by (simp add: check_types_def)
     also from step  have "\<forall>x \<in> set \<tau>s. x \<noteq> Err" 
       by (auto simp add: all_set_conv_all_nth wt_step_def)    
     hence [symmetric]: "map OK (map ok_val \<tau>s) = \<tau>s"
       by (auto intro!: map_idI)
     finally have "check_types P mxs mxl (map OK (map ok_val \<tau>s))" .
   }
   moreover {  
     note bounded_step
     moreover from list have "set \<tau>s \<subseteq> A" by simp
     moreover from step have "wt_err_step (sup_state_opt P) step \<tau>s"
       by (simp add: wt_err_step_def JVM_le_Err_conv)
     ultimately have "wt_app_eff (sup_state_opt P) app eff (map ok_val \<tau>s)"
       by (auto intro: wt_err_imp_wt_app_eff simp add: exec_def states_def)
   }    
   ultimately have "wt_method P C Ts T\<^sub>r mxs mxl\<^sub>0 is xt (map ok_val \<tau>s)"
     by (simp add: wt_method_def2 check_types_def del: map_map)
   thus ?thesis ..
 qed
 (*>*)
 
   
 lemma (in start_context) wt_method_wt_lbv:
   assumes wt: "wt_method P C Ts T\<^sub>r mxs mxl\<^sub>0 is xt \<tau>s" 
   defines [simp]: "cert \<equiv> mk_cert P mxs T\<^sub>r xt is \<tau>s"
   
   shows "wt_lbv P C Ts T\<^sub>r mxs mxl\<^sub>0 xt cert is" 
 (*<*)
 proof -
   let ?\<tau>s  = "map OK \<tau>s"
   let ?cert = "make_cert step ?\<tau>s (OK None)"
 
   from wt obtain 
     0:        "0 < size is" and
     size:     "size is = size ?\<tau>s" and
     ck_types: "check_types P mxs mxl ?\<tau>s" and
     wt_start: "wt_start P C Ts mxl\<^sub>0 \<tau>s" and
     app_eff:  "wt_app_eff (sup_state_opt P) app eff \<tau>s"
     by (force simp add: wt_method_def2 check_types_def) 
   
   from wf have "semilat (JVM_SemiType.sl P mxs mxl)" ..
   hence "semilat (A, r, f)" by (simp add: sl_def2)
   moreover have "top r Err" by (simp add: JVM_le_Err_conv)
   moreover have "Err \<in> A" by (simp add: JVM_states_unfold)
   moreover have "bottom r (OK None)" 
     by (simp add: JVM_le_Err_conv bottom_def lesub_def Err.le_def split: err.split)
   moreover have "OK None \<in> A" by (simp add: JVM_states_unfold)
   moreover from wf have "mono r step (size is) A" by (rule step_mono)
   hence "mono r step (size ?\<tau>s) A" by (simp add: size)
   moreover from exec_pres_type 
   have "pres_type step (size ?\<tau>s) A" by (simp add: size) 
   moreover
   from ck_types have \<tau>s_in_A: "set ?\<tau>s \<subseteq> A" by (simp add: check_types_def)
   hence "\<forall>pc. pc < size ?\<tau>s \<longrightarrow> ?\<tau>s!pc \<in> A \<and> ?\<tau>s!pc \<noteq> Err" by auto
   moreover from bounded_step 
   have "bounded step (size ?\<tau>s)" by (simp add: size)
   moreover have "OK None \<noteq> Err" by simp
   moreover from bounded_step size \<tau>s_in_A app_eff
   have "wt_err_step (sup_state_opt P) step ?\<tau>s"
     by (auto intro: wt_app_eff_imp_wt_err simp add: exec_def states_def)    
   hence "wt_step r Err step ?\<tau>s"
     by (simp add: wt_err_step_def JVM_le_Err_conv)
   moreover
   from 0 size have "0 < size \<tau>s" by auto
   hence "?\<tau>s!0 = OK (\<tau>s!0)" by simp
   with wt_start have "OK first \<sqsubseteq>\<^sub>r ?\<tau>s!0"
     by (clarsimp simp add: wt_start_def lesub_def Err.le_def JVM_le_Err_conv)
   moreover note first_in_A
   moreover have "OK first \<noteq> Err" by simp
   moreover note size 
   ultimately
   have "wtl_inst_list is ?cert f r Err (OK None) step 0 (OK first) \<noteq> Err"
     by (rule lbvc.wtl_complete [OF lbvc.intro, OF lbv.intro lbvc_axioms.intro, OF Semilat.intro lbv_axioms.intro])
   moreover from 0 size have "\<tau>s \<noteq> []" by auto
   moreover from ck_types have "check_types P mxs mxl ?cert"
     apply (auto simp add: make_cert_def check_types_def JVM_states_unfold)
     apply (subst Ok_in_err [symmetric])
     apply (drule nth_mem)
     apply auto
     done
   moreover note 0 size
   ultimately show ?thesis 
     by (simp add: wt_lbv_def lbvjvm_def mk_cert_def step_def_exec [symmetric]
                   check_cert_def make_cert_def nth_append)
 qed  
 (*>*)
 
 
 theorem jvm_lbv_correct:
   "wt_jvm_prog_lbv P Cert \<Longrightarrow> wf_jvm_prog P"
 (*<*)
 proof -  
   let ?\<Phi> = "\<lambda>C mn. let (C,Ts,T\<^sub>r,(mxs,mxl\<^sub>0,is,xt)) = method P C mn in 
               SOME \<tau>s. wt_method P C Ts T\<^sub>r mxs mxl\<^sub>0 is xt \<tau>s"
     
   assume wt: "wt_jvm_prog_lbv P Cert"
   hence "wf_jvm_prog\<^bsub>?\<Phi>\<^esub> P"
     apply (unfold wf_jvm_prog_phi_def wt_jvm_prog_lbv_def) 
     apply (erule wf_prog_lift)
     apply (auto dest!: start_context.wt_lbv_wt_method [OF start_context.intro] 
                 intro: someI)
     apply (erule sees_method_is_class)
     done
   thus ?thesis by (unfold wf_jvm_prog_def) blast
 qed
 (*>*)
 
 theorem jvm_lbv_complete:
   assumes wt: "wf_jvm_prog\<^bsub>\<Phi>\<^esub> P" 
   shows "wt_jvm_prog_lbv P (prg_cert P \<Phi>)"
 (*<*)
   using wt
   apply (unfold wf_jvm_prog_phi_def wt_jvm_prog_lbv_def)
   apply (erule wf_prog_lift)
   apply (auto simp add: prg_cert_def 
               intro!: start_context.wt_method_wt_lbv start_context.intro)
   apply (erule sees_method_is_class)                                     
   done
 (*>*)
 
 end  
diff --git a/thys/Jinja/BV/TF_JVM.thy b/thys/Jinja/BV/TF_JVM.thy
--- a/thys/Jinja/BV/TF_JVM.thy
+++ b/thys/Jinja/BV/TF_JVM.thy
@@ -1,278 +1,278 @@
 (*  Title:      HOL/MicroJava/BV/JVM.thy
 
     Author:     Tobias Nipkow, Gerwin Klein
     Copyright   2000 TUM
 *)
 
 section \<open>The Typing Framework for the JVM \label{sec:JVM}\<close>
 
 theory TF_JVM
 imports "../DFA/Typing_Framework_err" EffectMono BVSpec
 begin
 
 definition exec :: "jvm_prog \<Rightarrow> nat \<Rightarrow> ty \<Rightarrow> ex_table \<Rightarrow> instr list \<Rightarrow> ty\<^sub>i' err step_type"
 where 
   "exec G maxs rT et bs \<equiv>
   err_step (size bs) (\<lambda>pc. app (bs!pc) G maxs rT pc (size bs) et) 
                      (\<lambda>pc. eff (bs!pc) G pc et)"
 
 locale JVM_sl =
   fixes P :: jvm_prog and mxs and mxl\<^sub>0 and n
   fixes Ts :: "ty list" and "is" and xt and T\<^sub>r
 
   fixes mxl and A and r and f and app and eff and step
   defines [simp]: "mxl \<equiv> 1+size Ts+mxl\<^sub>0"
   defines [simp]: "A   \<equiv> states P mxs mxl"
   defines [simp]: "r   \<equiv> JVM_SemiType.le P mxs mxl"
   defines [simp]: "f   \<equiv> JVM_SemiType.sup P mxs mxl"
 
   defines [simp]: "app \<equiv> \<lambda>pc. Effect.app (is!pc) P mxs T\<^sub>r pc (size is) xt"
   defines [simp]: "eff \<equiv> \<lambda>pc. Effect.eff (is!pc) P pc xt"
   defines [simp]: "step \<equiv> err_step (size is) app eff"
 
   defines [simp]: "n \<equiv> size is"
 
 locale start_context = JVM_sl +
   fixes p and C
   assumes wf: "wf_prog p P"
   assumes C:  "is_class P C"
   assumes Ts: "set Ts \<subseteq> types P"
 
   fixes first :: ty\<^sub>i' and start
   defines [simp]: 
   "first \<equiv> Some ([],OK (Class C) # map OK Ts @ replicate mxl\<^sub>0 Err)"
   defines [simp]:
   "start \<equiv> OK first # replicate (size is - 1) (OK None)"
 
 subsection \<open>Connecting JVM and Framework\<close>
 lemma (in start_context) semi: "semilat (A, r, f)"
   apply (insert semilat_JVM[OF wf])
   apply (unfold A_def r_def f_def JVM_SemiType.le_def JVM_SemiType.sup_def states_def)
   apply auto
   done
 
 lemma (in JVM_sl) step_def_exec: "step \<equiv> exec P mxs T\<^sub>r xt is" 
   by (simp add: exec_def)  
 
 lemma special_ex_swap_lemma [iff]: 
   "(? X. (? n. X = A n & P n) & Q X) = (? n. Q(A n) & P n)"
   by blast
 
-lemma ex_in_list [iff]:
-  "(\<exists>n. ST \<in> list n A \<and> n \<le> mxs) = (set ST \<subseteq> A \<and> size ST \<le> mxs)"
-  by (unfold list_def) auto
+lemma ex_in_nlists [iff]:
+  "(\<exists>n. ST \<in> nlists n A \<and> n \<le> mxs) = (set ST \<subseteq> A \<and> size ST \<le> mxs)"
+  by (unfold nlists_def) auto
 
-lemma singleton_list: 
-  "(\<exists>n. [Class C] \<in> list n (types P) \<and> n \<le> mxs) = (is_class P C \<and> 0 < mxs)"
+lemma singleton_nlists: 
+  "(\<exists>n. [Class C] \<in> nlists n (types P) \<and> n \<le> mxs) = (is_class P C \<and> 0 < mxs)"
   by auto
 
 lemma set_drop_subset:
   "set xs \<subseteq> A \<Longrightarrow> set (drop n xs) \<subseteq> A"
   by (auto dest: in_set_dropD)
 
 lemma Suc_minus_minus_le:
   "n < mxs \<Longrightarrow> Suc (n - (n - b)) \<le> mxs"
   by arith
 
-lemma in_listE:
-  "\<lbrakk> xs \<in> list n A; \<lbrakk>size xs = n; set xs \<subseteq> A\<rbrakk> \<Longrightarrow> P \<rbrakk> \<Longrightarrow> P"
-  by (unfold list_def) blast
+lemma in_nlistsE:
+  "\<lbrakk> xs \<in> nlists n A; \<lbrakk>size xs = n; set xs \<subseteq> A\<rbrakk> \<Longrightarrow> P \<rbrakk> \<Longrightarrow> P"
+  by (unfold nlists_def) blast
 
 declare is_relevant_entry_def [simp]
 declare set_drop_subset [simp]
 
 theorem (in start_context) exec_pres_type:
   "pres_type step (size is) A"
 (*<*)
   apply (insert wf)
   apply simp
   apply (unfold JVM_states_unfold)
   apply (rule pres_type_lift)
   apply clarify
   apply (rename_tac s pc pc' s')
   apply (case_tac s)
    apply simp
    apply (drule effNone)
    apply simp  
   apply (simp add: Effect.app_def xcpt_app_def Effect.eff_def  
                    xcpt_eff_def norm_eff_def relevant_entries_def)
   apply (case_tac "is!pc")
 
   \<comment> \<open>Load\<close>
   apply clarsimp
-  apply (frule listE_nth_in, assumption)
+  apply (frule nlistsE_nth_in, assumption)
   apply fastforce
 
   \<comment> \<open>Store\<close>
   apply fastforce
 
   \<comment> \<open>Push\<close>
   apply (fastforce simp add: typeof_lit_is_type)
 
   \<comment> \<open>New\<close>
   apply clarsimp apply fastforce
 
   \<comment> \<open>Getfield\<close>
   apply clarsimp apply (fastforce dest: sees_field_is_type)
 
   \<comment> \<open>Putfield\<close>
   apply clarsimp apply fastforce
 
   \<comment> \<open>Checkcast\<close>
   apply clarsimp apply fastforce
 
   defer 
   
   \<comment> \<open>Return\<close>
   apply fastforce
 
   \<comment> \<open>Pop\<close>
   apply fastforce
 
   \<comment> \<open>IAdd\<close>
   apply fastforce
   
   \<comment> \<open>Goto\<close>
   apply fastforce
 
   \<comment> \<open>CmpEq\<close>
   apply fastforce
 
   \<comment> \<open>IfFalse\<close>
   apply fastforce
 
   \<comment> \<open>Throw\<close>
  apply clarsimp  apply fastforce
 
   \<comment> \<open>Invoke\<close>
   apply (clarsimp split!: if_splits)
    apply fastforce
   apply (erule disjE)
    prefer 2
    apply fastforce
   apply clarsimp
   apply (rule conjI)
    apply (drule (1) sees_wf_mdecl)
    apply (clarsimp simp add: wf_mdecl_def)
   apply arith
   done
 (*>*)
 
 declare is_relevant_entry_def [simp del]
 declare set_drop_subset [simp del]
 
 lemma lesubstep_type_simple:
   "xs [\<sqsubseteq>\<^bsub>Product.le (=) r\<^esub>] ys \<Longrightarrow> set xs {\<sqsubseteq>\<^bsub>r\<^esub>} set ys"
 (*<*)
   apply (unfold lesubstep_type_def)
   apply clarify
   apply (simp add: set_conv_nth)
   apply clarify
   apply (drule le_listD, assumption)
   apply (clarsimp simp add: lesub_def Product.le_def)
   apply (rule exI)
   apply (rule conjI)
    apply (rule exI)
    apply (rule conjI)
     apply (rule sym)
     apply assumption
    apply assumption
   apply assumption
   done
 (*>*)
 
 declare is_relevant_entry_def [simp del]
 
 
 lemma conjI2: "\<lbrakk> A; A \<Longrightarrow> B \<rbrakk> \<Longrightarrow> A \<and> B" by blast
   
 lemma (in JVM_sl) eff_mono:
   "\<lbrakk>wf_prog p P; pc < length is; s \<sqsubseteq>\<^bsub>sup_state_opt P\<^esub> t; app pc t\<rbrakk>
   \<Longrightarrow> set (eff pc s) {\<sqsubseteq>\<^bsub>sup_state_opt P\<^esub>} set (eff pc t)"
 (*<*)
   apply simp
   apply (unfold Effect.eff_def)  
   apply (cases t)
    apply (simp add: lesub_def)
   apply (rename_tac a)
   apply (cases s)
    apply simp
   apply (rename_tac b)
   apply simp
   apply (rule lesubstep_union)
    prefer 2
    apply (rule lesubstep_type_simple)
    apply (simp add: xcpt_eff_def)
    apply (rule le_listI)
     apply (simp add: split_beta)
    apply (simp add: split_beta)
    apply (simp add: lesub_def fun_of_def)
    apply (case_tac a)
    apply (case_tac b)
    apply simp   
    apply (subgoal_tac "size ab = size aa")
      prefer 2
      apply (clarsimp simp add: list_all2_lengthD)
    apply simp
   apply (clarsimp simp add: norm_eff_def lesubstep_type_def lesub_def iff del: sup_state_conv)
   apply (rule exI)
   apply (rule conjI2)
    apply (rule imageI)
    apply (clarsimp simp add: Effect.app_def iff del: sup_state_conv)
    apply (drule (2) succs_mono)
    apply blast
   apply simp
   apply (erule eff\<^sub>i_mono)
      apply simp
     apply assumption   
    apply clarsimp
   apply clarsimp  
   done
 (*>*)
 
 lemma (in JVM_sl) bounded_step: "bounded step (size is)"
 (*<*)
   apply simp
   apply (unfold bounded_def err_step_def Effect.app_def Effect.eff_def)
   apply (auto simp add: error_def map_snd_def split: err.splits option.splits)
   done
 (*>*)
 
 theorem (in JVM_sl) step_mono:
   "wf_prog wf_mb P \<Longrightarrow> mono r step (size is) A"
 (*<*)
   apply (simp add: JVM_le_Err_conv)  
   apply (insert bounded_step)
   apply (unfold JVM_states_unfold)
   apply (rule mono_lift)
      apply blast   \<comment>\<open> order_sup_state_opt' \<close>
     apply (unfold app_mono_def lesub_def)
     apply clarsimp
     apply (erule (2) app_mono)
    apply simp
   apply clarify
   apply (drule eff_mono)
   apply (auto simp add: lesub_def)
   done
 (*>*)
 
 
 lemma (in start_context) first_in_A [iff]: "OK first \<in> A"
-  using Ts C by (force intro!: list_appendI simp add: JVM_states_unfold)
+  using Ts C by (force intro!: nlists_appendI simp add: JVM_states_unfold)
 
 
 lemma (in JVM_sl) wt_method_def2:
   "wt_method P C' Ts T\<^sub>r mxs mxl\<^sub>0 is xt \<tau>s =
   (is \<noteq> [] \<and> 
    size \<tau>s = size is \<and>
    OK ` set \<tau>s \<subseteq> states P mxs mxl \<and>
    wt_start P C' Ts mxl\<^sub>0 \<tau>s \<and> 
    wt_app_eff (sup_state_opt P) app eff \<tau>s)"
 (*<*)
   apply (unfold wt_method_def wt_app_eff_def wt_instr_def lesub_def check_types_def)
   apply auto
   done
 (*>*)
 
 
 end
diff --git a/thys/Jinja/Compiler/TypeComp.thy b/thys/Jinja/Compiler/TypeComp.thy
--- a/thys/Jinja/Compiler/TypeComp.thy
+++ b/thys/Jinja/Compiler/TypeComp.thy
@@ -1,1489 +1,1489 @@
 (*  Title:      Jinja/Compiler/TypeComp.thy
 
     Author:     Tobias Nipkow
     Copyright   TUM 2003
 *)
 
 section \<open>Preservation of Well-Typedness\<close>
 
 theory TypeComp
 imports Compiler "../BV/BVSpec"
 begin
 
 (*<*)
 declare nth_append[simp]
 (*>*)
 
 locale TC0 =
   fixes P :: "J\<^sub>1_prog" and mxl :: nat
 begin
 
 definition "ty E e = (THE T. P,E \<turnstile>\<^sub>1 e :: T)"
 
 definition "ty\<^sub>l E A' = map (\<lambda>i. if i \<in> A' \<and> i < size E then OK(E!i) else Err) [0..<mxl]"
 
 definition "ty\<^sub>i' ST E A = (case A of None \<Rightarrow> None | \<lfloor>A'\<rfloor> \<Rightarrow> Some(ST, ty\<^sub>l E A'))"
 
 definition "after E A ST e = ty\<^sub>i' (ty E e # ST) E (A \<squnion> \<A> e)"
 
 end
 
 lemma (in TC0) ty_def2 [simp]: "P,E \<turnstile>\<^sub>1 e :: T \<Longrightarrow> ty E e = T"
 (*<*)by(unfold ty_def) (blast intro: the_equality WT\<^sub>1_unique)(*>*)
 
 lemma (in TC0) [simp]: "ty\<^sub>i' ST E None = None"
 (*<*)by (simp add: ty\<^sub>i'_def)(*>*)
 
 lemma (in TC0) ty\<^sub>l_app_diff[simp]:
  "ty\<^sub>l (E@[T]) (A - {size E}) = ty\<^sub>l E A"
 (*<*)by(auto simp add:ty\<^sub>l_def hyperset_defs)(*>*)
 
 
 lemma (in TC0) ty\<^sub>i'_app_diff[simp]:
  "ty\<^sub>i' ST (E @ [T]) (A \<ominus> size E) = ty\<^sub>i' ST E A"
 (*<*)by(auto simp add:ty\<^sub>i'_def hyperset_defs)(*>*)
 
 
 lemma (in TC0) ty\<^sub>l_antimono:
  "A \<subseteq> A' \<Longrightarrow> P \<turnstile> ty\<^sub>l E A' [\<le>\<^sub>\<top>] ty\<^sub>l E A"
 (*<*)by(auto simp:ty\<^sub>l_def list_all2_conv_all_nth)(*>*)
 
 
 lemma (in TC0) ty\<^sub>i'_antimono:
  "A \<subseteq> A' \<Longrightarrow> P \<turnstile> ty\<^sub>i' ST E \<lfloor>A'\<rfloor> \<le>' ty\<^sub>i' ST E \<lfloor>A\<rfloor>"
 (*<*)by(auto simp:ty\<^sub>i'_def ty\<^sub>l_def list_all2_conv_all_nth)(*>*)
 
 
 lemma (in TC0) ty\<^sub>l_env_antimono:
  "P \<turnstile> ty\<^sub>l (E@[T]) A [\<le>\<^sub>\<top>] ty\<^sub>l E A" 
 (*<*)by(auto simp:ty\<^sub>l_def list_all2_conv_all_nth)(*>*)
 
 
 lemma (in TC0) ty\<^sub>i'_env_antimono:
  "P \<turnstile> ty\<^sub>i' ST (E@[T]) A \<le>' ty\<^sub>i' ST E A" 
 (*<*)by(auto simp:ty\<^sub>i'_def ty\<^sub>l_def list_all2_conv_all_nth)(*>*)
 
 
 lemma (in TC0) ty\<^sub>i'_incr:
  "P \<turnstile> ty\<^sub>i' ST (E @ [T]) \<lfloor>insert (size E) A\<rfloor> \<le>' ty\<^sub>i' ST E \<lfloor>A\<rfloor>"
 (*<*)by(auto simp:ty\<^sub>i'_def ty\<^sub>l_def list_all2_conv_all_nth)(*>*)
 
 
 lemma (in TC0) ty\<^sub>l_incr:
  "P \<turnstile> ty\<^sub>l (E @ [T]) (insert (size E) A) [\<le>\<^sub>\<top>] ty\<^sub>l E A"
 (*<*)by(auto simp: hyperset_defs ty\<^sub>l_def list_all2_conv_all_nth)(*>*)
 
 
 lemma (in TC0) ty\<^sub>l_in_types:
- "set E \<subseteq> types P \<Longrightarrow> ty\<^sub>l E A \<in> list mxl (err (types P))"
-(*<*)by(auto simp add:ty\<^sub>l_def intro!:listI dest!: nth_mem)(*>*)
+ "set E \<subseteq> types P \<Longrightarrow> ty\<^sub>l E A \<in> nlists mxl (err (types P))"
+(*<*)by(auto simp add:ty\<^sub>l_def intro!:nlistsI dest!: nth_mem)(*>*)
 
 locale TC1 = TC0
 begin
 
 primrec compT :: "ty list \<Rightarrow> nat hyperset \<Rightarrow> ty list \<Rightarrow> expr\<^sub>1 \<Rightarrow> ty\<^sub>i' list" and
    compTs :: "ty list \<Rightarrow> nat hyperset \<Rightarrow> ty list \<Rightarrow> expr\<^sub>1 list \<Rightarrow> ty\<^sub>i' list" where
 "compT E A ST (new C) = []"
 | "compT E A ST (Cast C e) =  
    compT E A ST e @ [after E A ST e]"
 | "compT E A ST (Val v) = []"
 | "compT E A ST (e\<^sub>1 \<guillemotleft>bop\<guillemotright> e\<^sub>2) =
   (let ST\<^sub>1 = ty E e\<^sub>1#ST; A\<^sub>1 = A \<squnion> \<A> e\<^sub>1 in
    compT E A ST e\<^sub>1 @ [after E A ST e\<^sub>1] @
    compT E A\<^sub>1 ST\<^sub>1 e\<^sub>2 @ [after E A\<^sub>1 ST\<^sub>1 e\<^sub>2])"
 | "compT E A ST (Var i) = []"
 | "compT E A ST (i := e) = compT E A ST e @
    [after E A ST e, ty\<^sub>i' ST E (A \<squnion> \<A> e \<squnion> \<lfloor>{i}\<rfloor>)]"
 | "compT E A ST (e\<bullet>F{D}) = 
    compT E A ST e @ [after E A ST e]"
 | "compT E A ST (e\<^sub>1\<bullet>F{D} := e\<^sub>2) =
   (let ST\<^sub>1 = ty   E e\<^sub>1#ST; A\<^sub>1 = A \<squnion> \<A> e\<^sub>1; A\<^sub>2 = A\<^sub>1 \<squnion> \<A> e\<^sub>2 in
    compT E A ST e\<^sub>1 @ [after E A ST e\<^sub>1] @
    compT E A\<^sub>1 ST\<^sub>1 e\<^sub>2 @ [after E A\<^sub>1 ST\<^sub>1 e\<^sub>2] @
    [ty\<^sub>i' ST E A\<^sub>2])"
 | "compT E A ST {i:T; e} = compT (E@[T]) (A\<ominus>i) ST e"
 | "compT E A ST (e\<^sub>1;;e\<^sub>2) =
   (let A\<^sub>1 = A \<squnion> \<A> e\<^sub>1 in
    compT E A ST e\<^sub>1 @ [after E A ST e\<^sub>1, ty\<^sub>i' ST E A\<^sub>1] @
    compT E A\<^sub>1 ST e\<^sub>2)"
 | "compT E A ST (if (e) e\<^sub>1 else e\<^sub>2) =
    (let A\<^sub>0 = A \<squnion> \<A> e; \<tau> = ty\<^sub>i' ST E A\<^sub>0 in
     compT E A ST e @ [after E A ST e, \<tau>] @
     compT E A\<^sub>0 ST e\<^sub>1 @ [after E A\<^sub>0 ST e\<^sub>1, \<tau>] @
     compT E A\<^sub>0 ST e\<^sub>2)"
 | "compT E A ST (while (e) c) =
    (let A\<^sub>0 = A \<squnion> \<A> e;  A\<^sub>1 = A\<^sub>0 \<squnion> \<A> c; \<tau> = ty\<^sub>i' ST E A\<^sub>0 in
     compT E A ST e @ [after E A ST e, \<tau>] @
     compT E A\<^sub>0 ST c @ [after E A\<^sub>0 ST c, ty\<^sub>i' ST E A\<^sub>1, ty\<^sub>i' ST E A\<^sub>0])"
 | "compT E A ST (throw e) = compT E A ST e @ [after E A ST e]"
 | "compT E A ST (e\<bullet>M(es)) =
    compT E A ST e @ [after E A ST e] @
    compTs E (A \<squnion> \<A> e) (ty   E e # ST) es"
 | "compT E A ST (try e\<^sub>1 catch(C i) e\<^sub>2) =
    compT E A ST e\<^sub>1 @ [after E A ST e\<^sub>1] @
    [ty\<^sub>i' (Class C#ST) E A, ty\<^sub>i' ST (E@[Class C]) (A \<squnion> \<lfloor>{i}\<rfloor>)] @
    compT (E@[Class C]) (A \<squnion> \<lfloor>{i}\<rfloor>) ST e\<^sub>2"
 | "compTs E A ST [] = []"
 | "compTs  E A ST (e#es) = compT E A ST e @ [after E A ST e] @
                             compTs E (A \<squnion> (\<A> e)) (ty E e # ST) es"
 
 definition compT\<^sub>a :: "ty list \<Rightarrow> nat hyperset \<Rightarrow> ty list \<Rightarrow> expr\<^sub>1 \<Rightarrow> ty\<^sub>i' list" where
   "compT\<^sub>a E A ST e = compT E A ST e @ [after E A ST e]"
 
 end
 
 lemma compE\<^sub>2_not_Nil[simp]: "compE\<^sub>2 e \<noteq> []"
 (*<*)by(induct e) auto(*>*)
 
 lemma (in TC1) compT_sizes[simp]:
 shows "\<And>E A ST. size(compT E A ST e) = size(compE\<^sub>2 e) - 1"
 and "\<And>E A ST. size(compTs E A ST es) = size(compEs\<^sub>2 es)"
 (*<*)
 by(induct e and es rule: compE\<^sub>2.induct compEs\<^sub>2.induct)
   (auto split:bop.splits nat_diff_split)
 (*>*)
 
 
 lemma (in TC1) [simp]: "\<And>ST E. \<lfloor>\<tau>\<rfloor> \<notin> set (compT E None ST e)"
 and [simp]: "\<And>ST E. \<lfloor>\<tau>\<rfloor> \<notin> set (compTs E None ST es)"
 (*<*)by(induct e and es rule: compT.induct compTs.induct) (simp_all add:after_def)(*>*)
 
 
 lemma (in TC0) pair_eq_ty\<^sub>i'_conv:
   "(\<lfloor>(ST, LT)\<rfloor> = ty\<^sub>i' ST\<^sub>0 E A) =
   (case A of None \<Rightarrow> False | Some A \<Rightarrow> (ST = ST\<^sub>0 \<and> LT = ty\<^sub>l E A))"
 (*<*)by(simp add:ty\<^sub>i'_def)(*>*)
 
 
 lemma (in TC0) pair_conv_ty\<^sub>i':
   "\<lfloor>(ST, ty\<^sub>l E A)\<rfloor> = ty\<^sub>i' ST E \<lfloor>A\<rfloor>"
 (*<*)by(simp add:ty\<^sub>i'_def)(*>*)
 
 (*<*)
 declare (in TC0)
   ty\<^sub>i'_antimono [intro!] after_def[simp]
   pair_conv_ty\<^sub>i'[simp] pair_eq_ty\<^sub>i'_conv[simp]
 (*>*)
 
 
 lemma (in TC1) compT_LT_prefix:
  "\<And>E A ST\<^sub>0. \<lbrakk> \<lfloor>(ST,LT)\<rfloor> \<in> set(compT E A ST\<^sub>0 e); \<B> e (size E) \<rbrakk>
                \<Longrightarrow> P \<turnstile> \<lfloor>(ST,LT)\<rfloor> \<le>' ty\<^sub>i' ST E A"
 and
  "\<And>E A ST\<^sub>0. \<lbrakk> \<lfloor>(ST,LT)\<rfloor> \<in> set(compTs E A ST\<^sub>0 es); \<B>s es (size E) \<rbrakk>
                \<Longrightarrow> P \<turnstile> \<lfloor>(ST,LT)\<rfloor> \<le>' ty\<^sub>i' ST E A"
 (*<*)
 proof(induct e and es rule: compT.induct compTs.induct)
   case FAss thus ?case by(fastforce simp:hyperset_defs elim!:sup_state_opt_trans)
 next
   case BinOp thus ?case
     by(fastforce simp:hyperset_defs elim!:sup_state_opt_trans split:bop.splits)
 next
   case Seq thus ?case by(fastforce simp:hyperset_defs elim!:sup_state_opt_trans)
 next
   case While thus ?case by(fastforce simp:hyperset_defs elim!:sup_state_opt_trans)
 next
   case Cond thus ?case by(fastforce simp:hyperset_defs elim!:sup_state_opt_trans)
 next
   case Block thus ?case
     by(force simp add:hyperset_defs ty\<^sub>i'_def simp del:pair_conv_ty\<^sub>i'
              elim!:sup_state_opt_trans)
 next
   case Call thus ?case by(fastforce simp:hyperset_defs elim!:sup_state_opt_trans)
 next
   case Cons_exp thus ?case
     by(fastforce simp:hyperset_defs elim!:sup_state_opt_trans)
 next
   case TryCatch thus ?case
     by(fastforce simp:hyperset_defs intro!:(* ty\<^sub>i'_env_antimono *) ty\<^sub>i'_incr
                 elim!:sup_state_opt_trans)
 qed (auto simp:hyperset_defs)
 
 declare (in TC0)
   ty\<^sub>i'_antimono [rule del] after_def[simp del]
   pair_conv_ty\<^sub>i'[simp del] pair_eq_ty\<^sub>i'_conv[simp del]
 (*>*)
 
 
 lemma [iff]: "OK None \<in> states P mxs mxl"
 (*<*)by(simp add: JVM_states_unfold)(*>*)
 
 lemma (in TC0) after_in_states:
 assumes wf: "wf_prog p P" and wt: "P,E \<turnstile>\<^sub>1 e :: T"
   and Etypes: "set E \<subseteq> types P" and STtypes: "set ST \<subseteq> types P"
   and stack: "size ST + max_stack e \<le> mxs"
 shows "OK (after E A ST e) \<in> states P mxs mxl"
 (*<*)
 proof -
   have "size ST + 1 \<le> mxs" using max_stack1[of e] wt stack
     by fastforce
   then show ?thesis using assms
     by(simp add: after_def ty\<^sub>i'_def JVM_states_unfold ty\<^sub>l_in_types)
-      (blast intro!:listI WT\<^sub>1_is_type)
+      (blast intro!:nlistsI WT\<^sub>1_is_type)
 qed
 (*>*)
 
 
 lemma (in TC0) OK_ty\<^sub>i'_in_statesI[simp]:
   "\<lbrakk> set E \<subseteq> types P; set ST \<subseteq> types P; size ST \<le> mxs \<rbrakk>
   \<Longrightarrow> OK (ty\<^sub>i' ST E A) \<in> states P mxs mxl"
 (*<*)
 by(simp add:ty\<^sub>i'_def JVM_states_unfold ty\<^sub>l_in_types)
-  (blast intro!:listI)
+  (blast intro!:nlistsI)
 (*>*)
 
 
 lemma is_class_type_aux: "is_class P C \<Longrightarrow> is_type P (Class C)"
 (*<*)by(simp)(*>*)
 
 (*<*)
 declare is_type_simps[simp del] subsetI[rule del]
 (*>*)
 
 theorem (in TC1) compT_states:
 assumes wf: "wf_prog p P"
 shows "\<And>E T A ST.
   \<lbrakk> P,E \<turnstile>\<^sub>1 e :: T; set E \<subseteq> types P; set ST \<subseteq> types P;
     size ST + max_stack e \<le> mxs; size E + max_vars e \<le> mxl \<rbrakk>
   \<Longrightarrow> OK ` set(compT E A ST e) \<subseteq> states P mxs mxl"
 (*<*)(is "\<And>E T A ST. PROP ?P e E T A ST")(*>*)
 
 and "\<And>E Ts A ST.
   \<lbrakk> P,E \<turnstile>\<^sub>1 es[::]Ts;  set E \<subseteq> types P; set ST \<subseteq> types P;
     size ST + max_stacks es \<le> mxs; size E + max_varss es \<le> mxl \<rbrakk>
   \<Longrightarrow> OK ` set(compTs E A ST es) \<subseteq> states P mxs mxl"
 (*<*)(is "\<And>E Ts A ST. PROP ?Ps es E Ts A ST")
 proof(induct e and es rule: compT.induct compTs.induct)
   case new thus ?case by(simp)
 next
   case (Cast C e) thus ?case by (auto simp:after_in_states[OF wf])
 next
   case Val thus  ?case by(simp)
 next
   case Var thus ?case by(simp)
 next
   case LAss thus ?case  by(auto simp:after_in_states[OF wf])
 next
   case FAcc thus ?case by(auto simp:after_in_states[OF wf])
 next
   case FAss thus ?case
     by(auto simp:image_Un WT\<^sub>1_is_type[OF wf] after_in_states[OF wf])
 next
   case Seq thus ?case
     by(auto simp:image_Un after_in_states[OF wf])
 next
   case BinOp thus ?case
     by(auto simp:image_Un WT\<^sub>1_is_type[OF wf] after_in_states[OF wf])
 next
   case Cond thus ?case
     by(force simp:image_Un WT\<^sub>1_is_type[OF wf] after_in_states[OF wf])
 next
   case While thus ?case
     by(auto simp:image_Un WT\<^sub>1_is_type[OF wf] after_in_states[OF wf])
 next
   case Block thus ?case by(auto)
 next
   case (TryCatch e\<^sub>1 C i e\<^sub>2)
   moreover have "size ST + 1 \<le> mxs" using TryCatch.prems max_stack1[of e\<^sub>1] by auto
   ultimately show ?case  
     by(auto simp:image_Un WT\<^sub>1_is_type[OF wf] after_in_states[OF wf]
                   is_class_type_aux)
 next
   case Nil_exp thus ?case by simp
 next
   case Cons_exp thus ?case
     by(auto simp:image_Un  WT\<^sub>1_is_type[OF wf] after_in_states[OF wf])
 next
   case throw thus ?case
     by(auto simp: WT\<^sub>1_is_type[OF wf] after_in_states[OF wf])
 next
   case Call thus ?case
     by(auto simp:image_Un WT\<^sub>1_is_type[OF wf] after_in_states[OF wf])
 qed
 
 declare is_type_simps[simp] subsetI[intro!]
 (*>*)
 
 
 definition shift :: "nat \<Rightarrow> ex_table \<Rightarrow> ex_table"
 where
   "shift n xt \<equiv> map (\<lambda>(from,to,C,handler,depth). (from+n,to+n,C,handler+n,depth)) xt"
 
 
 lemma [simp]: "shift 0 xt = xt"
 (*<*)by(induct xt)(auto simp:shift_def)(*>*)
 
 lemma [simp]: "shift n [] = []"
 (*<*)by(simp add:shift_def)(*>*)
 
 lemma [simp]: "shift n (xt\<^sub>1 @ xt\<^sub>2) = shift n xt\<^sub>1 @ shift n xt\<^sub>2"
 (*<*)by(simp add:shift_def)(*>*)
 
 lemma [simp]: "shift m (shift n xt) = shift (m+n) xt"
 (*<*)by(induct xt)(auto simp:shift_def)(*>*)
 
 lemma [simp]: "pcs (shift n xt) = {pc+n|pc. pc \<in> pcs xt}"
 (*<*)
 proof -
   { fix x f t C h d
     assume "(f,t,C,h,d) \<in> set xt" and "f + n \<le> x"
       and "x < t + n"
     then have "\<exists>pc. x = pc + n \<and> (\<exists>x\<in>set xt. pc \<in> (case x of (f, t, C, h, d) \<Rightarrow> {f..<t}))"
       by(rule_tac x = "x-n" in exI) (force split:nat_diff_split)
   }
   then show ?thesis by(auto simp:shift_def pcs_def) fast
 qed
 (*>*)
 
 
 lemma shift_compxE\<^sub>2:
 shows "\<And>pc pc' d. shift pc (compxE\<^sub>2 e pc' d) = compxE\<^sub>2 e (pc' + pc) d"
 and  "\<And>pc pc' d. shift pc (compxEs\<^sub>2 es pc' d) = compxEs\<^sub>2 es (pc' + pc) d"
 (*<*)
 by(induct e and es rule: compxE\<^sub>2.induct compxEs\<^sub>2.induct)
   (auto simp:shift_def ac_simps)
 (*>*)
 
 
 lemma compxE\<^sub>2_size_convs[simp]:
 shows "n \<noteq> 0 \<Longrightarrow> compxE\<^sub>2 e n d = shift n (compxE\<^sub>2 e 0 d)"
 and "n \<noteq> 0 \<Longrightarrow> compxEs\<^sub>2 es n d = shift n (compxEs\<^sub>2 es 0 d)"
 (*<*)by(simp_all add:shift_compxE\<^sub>2)(*>*)
 
 locale TC2 = TC1 +
   fixes T\<^sub>r :: ty and mxs :: pc
 begin
 
 definition
   wt_instrs :: "instr list \<Rightarrow> ex_table \<Rightarrow> ty\<^sub>i' list \<Rightarrow> bool"
     ("(\<turnstile> _, _ /[::]/ _)" [0,0,51] 50) where
   "\<turnstile> is,xt [::] \<tau>s \<longleftrightarrow> size is < size \<tau>s \<and> pcs xt \<subseteq> {0..<size is} \<and>
   (\<forall>pc< size is. P,T\<^sub>r,mxs,size \<tau>s,xt \<turnstile> is!pc,pc :: \<tau>s)"
 
 end
 
 notation TC2.wt_instrs ("(_,_,_ \<turnstile>/ _, _ /[::]/ _)" [50,50,50,50,50,51] 50)
 
 (*<*)
 lemmas (in TC2) wt_defs =
   wt_instrs_def wt_instr_def app_def eff_def norm_eff_def
 (*>*)
 
 lemma (in TC2) [simp]: "\<tau>s \<noteq> [] \<Longrightarrow> \<turnstile> [],[] [::] \<tau>s"
 (*<*) by (simp add: wt_defs) (*>*)
 
 lemma [simp]: "eff i P pc et None = []"
 (*<*)by (simp add: Effect.eff_def)(*>*)
 
 (*<*)
 declare split_comp_eq[simp del]
 (*>*)
 
 lemma wt_instr_appR:
  "\<lbrakk> P,T,m,mpc,xt \<turnstile> is!pc,pc :: \<tau>s;
     pc < size is; size is < size \<tau>s; mpc \<le> size \<tau>s; mpc \<le> mpc' \<rbrakk>
   \<Longrightarrow> P,T,m,mpc',xt \<turnstile> is!pc,pc :: \<tau>s@\<tau>s'"
 (*<*)by (fastforce simp:wt_instr_def app_def)(*>*)
 
 
 lemma relevant_entries_shift [simp]:
   "relevant_entries P i (pc+n) (shift n xt) = shift n (relevant_entries P i pc xt)"
 (*<*)
 proof(induct xt)
   case Nil
   then show ?case by (simp add: relevant_entries_def shift_def)
 next
   case (Cons a xt)
   then show ?case 
     by (auto simp add: relevant_entries_def shift_def is_relevant_entry_def)
 qed
 (*>*)
 
 
 lemma [simp]:
   "xcpt_eff i P (pc+n) \<tau> (shift n xt) =
    map (\<lambda>(pc,\<tau>). (pc + n, \<tau>)) (xcpt_eff i P pc \<tau> xt)"
 (*<*)
 proof -
   obtain ST LT where "\<tau> = (ST, LT)" by(cases \<tau>) simp
   then show ?thesis by(simp add: xcpt_eff_def) (auto simp add: shift_def)
 qed
 (*>*)
 
 
 lemma  [simp]:
   "app\<^sub>i (i, P, pc, m, T, \<tau>) \<Longrightarrow>
    eff i P (pc+n) (shift n xt) (Some \<tau>) =
    map (\<lambda>(pc,\<tau>). (pc+n,\<tau>)) (eff i P pc xt (Some \<tau>))"
 (*<*)by(cases "i") (auto simp add:eff_def norm_eff_def)(*>*)
 
 
 lemma [simp]:
   "xcpt_app i P (pc+n) mxs (shift n xt) \<tau> = xcpt_app i P pc mxs xt \<tau>"
 (*<*)by (simp add: xcpt_app_def) (auto simp add: shift_def)(*>*)
 
 
 lemma wt_instr_appL:
 assumes "P,T,m,mpc,xt \<turnstile> i,pc :: \<tau>s" and "pc < size \<tau>s" and "mpc \<le> size \<tau>s"
 shows "P,T,m,mpc + size \<tau>s',shift (size \<tau>s') xt \<turnstile> i,pc+size \<tau>s' :: \<tau>s'@\<tau>s"
 (*<*)
 proof -
   let ?t = "(\<tau>s'@\<tau>s)!(pc+size \<tau>s')"
   show ?thesis
   proof(cases ?t)
     case (Some \<tau>)
     obtain ST LT where [simp]: "\<tau> = (ST, LT)" by(cases \<tau>) simp
     have "app\<^sub>i (i, P, pc + length \<tau>s', m, T, \<tau>)"
       using Some assms by(cases "i") (auto simp:wt_instr_def app_def)
     moreover {
       fix pc' \<tau>' assume "(pc',\<tau>') \<in> set (eff i P pc xt ?t)"
       then have "P \<turnstile> \<tau>' \<le>' \<tau>s!pc'" and "pc' < mpc"
         using Some assms by(auto simp:wt_instr_def app_def)
     }
     ultimately show ?thesis using Some assms
       by(fastforce simp:wt_instr_def app_def)
   qed (auto simp:wt_instr_def app_def)
 qed
 (*>*)
 
 
 lemma wt_instr_Cons:
 assumes wti: "P,T,m,mpc - 1,[] \<turnstile> i,pc - 1 :: \<tau>s"
   and pcl: "0 < pc" and mpcl: "0 < mpc"
   and pcu: "pc < size \<tau>s + 1" and mpcu: "mpc \<le> size \<tau>s + 1"
 shows "P,T,m,mpc,[] \<turnstile> i,pc :: \<tau>#\<tau>s"
 (*<*)
 proof -
   have "pc - 1 < length \<tau>s" using pcl pcu by arith
   moreover have "mpc - 1 \<le> length \<tau>s" using mpcl mpcu by arith
   ultimately have
     "P,T,m,mpc - 1 + length [\<tau>],shift (length [\<tau>]) [] \<turnstile> i,pc - 1 + length [\<tau>] :: [\<tau>] @ \<tau>s"
     by(rule wt_instr_appL[where \<tau>s' = "[\<tau>]", OF wti])
   then show ?thesis using pcl mpcl by (simp split:nat_diff_split_asm)
 qed
 (*>*)
 
 
 lemma wt_instr_append:
 assumes wti: "P,T,m,mpc - size \<tau>s',[] \<turnstile> i,pc - size \<tau>s' :: \<tau>s"
   and pcl: "size \<tau>s' \<le> pc" and mpcl: "size \<tau>s' \<le> mpc"
   and pcu: "pc < size \<tau>s + size \<tau>s'" and mpcu: "mpc \<le> size \<tau>s + size \<tau>s'"
 shows "P,T,m,mpc,[] \<turnstile> i,pc :: \<tau>s'@\<tau>s"
 (*<*)
 proof -
   have "pc - length \<tau>s' < length \<tau>s" using pcl pcu by arith
   moreover have "mpc - length \<tau>s' \<le> length \<tau>s" using mpcl mpcu by arith
 thm wt_instr_appL[where \<tau>s' = "\<tau>s'", OF wti]
   ultimately have "P,T,m,mpc - length \<tau>s' + length \<tau>s',shift (length \<tau>s') []
                      \<turnstile> i,pc - length \<tau>s' + length \<tau>s' :: \<tau>s' @ \<tau>s"
     by(rule wt_instr_appL[where \<tau>s' = "\<tau>s'", OF wti])
   then show ?thesis using pcl mpcl by (simp split:nat_diff_split_asm)
 qed
 (*>*)
 
 
 lemma xcpt_app_pcs:
   "pc \<notin> pcs xt \<Longrightarrow> xcpt_app i P pc mxs xt \<tau>"
 (*<*)
 by (auto simp add: xcpt_app_def relevant_entries_def is_relevant_entry_def pcs_def)
 (*>*)
 
 
 lemma xcpt_eff_pcs:
   "pc \<notin> pcs xt \<Longrightarrow> xcpt_eff i P pc \<tau> xt = []"
 (*<*)
 by (cases \<tau>)
    (auto simp add: is_relevant_entry_def xcpt_eff_def relevant_entries_def pcs_def
            intro!: filter_False)
 (*>*)
 
 
 lemma pcs_shift:
   "pc < n \<Longrightarrow> pc \<notin> pcs (shift n xt)" 
 (*<*)by (auto simp add: shift_def pcs_def)(*>*)
 
 
 lemma wt_instr_appRx:
   "\<lbrakk> P,T,m,mpc,xt \<turnstile> is!pc,pc :: \<tau>s; pc < size is; size is < size \<tau>s; mpc \<le> size \<tau>s \<rbrakk>
   \<Longrightarrow> P,T,m,mpc,xt @ shift (size is) xt' \<turnstile> is!pc,pc :: \<tau>s"
 (*<*)by (auto simp:wt_instr_def eff_def app_def xcpt_app_pcs xcpt_eff_pcs)(*>*)
 
 
 lemma wt_instr_appLx: 
   "\<lbrakk> P,T,m,mpc,xt \<turnstile> i,pc :: \<tau>s; pc \<notin> pcs xt' \<rbrakk>
   \<Longrightarrow> P,T,m,mpc,xt'@xt \<turnstile> i,pc :: \<tau>s"
 (*<*)by (auto simp:wt_instr_def app_def eff_def xcpt_app_pcs xcpt_eff_pcs)(*>*)
 
 
 lemma (in TC2) wt_instrs_extR:
   "\<turnstile> is,xt [::] \<tau>s \<Longrightarrow> \<turnstile> is,xt [::] \<tau>s @ \<tau>s'"
 (*<*)by(auto simp add:wt_instrs_def wt_instr_appR)(*>*)
 
 
 lemma (in TC2) wt_instrs_ext:
 assumes wt\<^sub>1: "\<turnstile> is\<^sub>1,xt\<^sub>1 [::] \<tau>s\<^sub>1@\<tau>s\<^sub>2" and wt\<^sub>2: "\<turnstile> is\<^sub>2,xt\<^sub>2 [::] \<tau>s\<^sub>2"
   and \<tau>s_size: "size \<tau>s\<^sub>1 = size is\<^sub>1"
  shows "\<turnstile> is\<^sub>1@is\<^sub>2, xt\<^sub>1 @ shift (size is\<^sub>1) xt\<^sub>2 [::] \<tau>s\<^sub>1@\<tau>s\<^sub>2"
 (*<*)
 proof -
   let ?is = "is\<^sub>1@is\<^sub>2" and ?xt = "xt\<^sub>1 @ shift (size is\<^sub>1) xt\<^sub>2"
     and ?\<tau>s = "\<tau>s\<^sub>1@\<tau>s\<^sub>2"
   have "size ?is < size ?\<tau>s" using wt\<^sub>2 \<tau>s_size by(fastforce simp:wt_instrs_def)
   moreover have "pcs ?xt \<subseteq> {0..<size ?is}" using wt\<^sub>1 wt\<^sub>2
     by(fastforce simp:wt_instrs_def)
   moreover {
     fix pc assume pc: "pc<size ?is"
     have "P,T\<^sub>r,mxs,size ?\<tau>s,?xt \<turnstile> ?is!pc,pc :: ?\<tau>s"
     proof(cases "pc < length is\<^sub>1")
       case True then show ?thesis using wt\<^sub>1 pc
         by(fastforce simp: wt_instrs_def wt_instr_appRx)
     next
       case False
       then have "pc - length is\<^sub>1 < length is\<^sub>2" using pc by fastforce
       then have "P,T\<^sub>r,mxs,length \<tau>s\<^sub>2,xt\<^sub>2 \<turnstile> is\<^sub>2 ! (pc - length is\<^sub>1),pc - length is\<^sub>1 :: \<tau>s\<^sub>2"
         using wt\<^sub>2 by(clarsimp simp: wt_instrs_def)
       moreover have "pc - length is\<^sub>1 < length \<tau>s\<^sub>2" using pc wt\<^sub>2
         by(clarsimp simp: wt_instrs_def) arith
       moreover have "length \<tau>s\<^sub>2 \<le> length \<tau>s\<^sub>2" by simp
       moreover have "pc - length is\<^sub>1 + length \<tau>s\<^sub>1 \<notin> pcs xt\<^sub>1" using wt\<^sub>1 \<tau>s_size
         by(fastforce simp: wt_instrs_def)
       ultimately have "P,T\<^sub>r,mxs,length \<tau>s\<^sub>2 + length \<tau>s\<^sub>1,xt\<^sub>1 @ shift (length \<tau>s\<^sub>1) xt\<^sub>2
                          \<turnstile> is\<^sub>2 ! (pc - length is\<^sub>1),pc - length is\<^sub>1 + length \<tau>s\<^sub>1 :: \<tau>s\<^sub>1 @ \<tau>s\<^sub>2"
         by(rule wt_instr_appLx[OF wt_instr_appL[where \<tau>s' = "\<tau>s\<^sub>1"]])
       then show ?thesis using False \<tau>s_size by(simp add:add.commute)
     qed
   }
   ultimately show ?thesis by(clarsimp simp:wt_instrs_def)
 qed
 (*>*)
 
 corollary (in TC2) wt_instrs_ext2:
   "\<lbrakk> \<turnstile> is\<^sub>2,xt\<^sub>2 [::] \<tau>s\<^sub>2; \<turnstile> is\<^sub>1,xt\<^sub>1 [::] \<tau>s\<^sub>1@\<tau>s\<^sub>2; size \<tau>s\<^sub>1 = size is\<^sub>1 \<rbrakk>
   \<Longrightarrow> \<turnstile> is\<^sub>1@is\<^sub>2, xt\<^sub>1 @ shift (size is\<^sub>1) xt\<^sub>2 [::] \<tau>s\<^sub>1@\<tau>s\<^sub>2"
 (*<*)by(rule wt_instrs_ext)(*>*)
 
 
 corollary (in TC2) wt_instrs_ext_prefix [trans]:
   "\<lbrakk> \<turnstile> is\<^sub>1,xt\<^sub>1 [::] \<tau>s\<^sub>1@\<tau>s\<^sub>2; \<turnstile> is\<^sub>2,xt\<^sub>2 [::] \<tau>s\<^sub>3;
      size \<tau>s\<^sub>1 = size is\<^sub>1; prefix \<tau>s\<^sub>3 \<tau>s\<^sub>2 \<rbrakk>
   \<Longrightarrow> \<turnstile> is\<^sub>1@is\<^sub>2, xt\<^sub>1 @ shift (size is\<^sub>1) xt\<^sub>2 [::] \<tau>s\<^sub>1@\<tau>s\<^sub>2"
 (*<*)by(bestsimp simp:prefix_def elim: wt_instrs_ext dest:wt_instrs_extR)(*>*)
 
 
 corollary (in TC2) wt_instrs_app:
   assumes is\<^sub>1: "\<turnstile> is\<^sub>1,xt\<^sub>1 [::] \<tau>s\<^sub>1@[\<tau>]"
   assumes is\<^sub>2: "\<turnstile> is\<^sub>2,xt\<^sub>2 [::] \<tau>#\<tau>s\<^sub>2"
   assumes s: "size \<tau>s\<^sub>1 = size is\<^sub>1"
   shows "\<turnstile> is\<^sub>1@is\<^sub>2, xt\<^sub>1@shift (size is\<^sub>1) xt\<^sub>2 [::] \<tau>s\<^sub>1@\<tau>#\<tau>s\<^sub>2"
 (*<*)
 proof -
   from is\<^sub>1 have "\<turnstile> is\<^sub>1,xt\<^sub>1 [::] (\<tau>s\<^sub>1@[\<tau>])@\<tau>s\<^sub>2"
     by (rule wt_instrs_extR)
   hence "\<turnstile> is\<^sub>1,xt\<^sub>1 [::] \<tau>s\<^sub>1@\<tau>#\<tau>s\<^sub>2" by simp
   from this is\<^sub>2 s show ?thesis by (rule wt_instrs_ext) 
 qed
 (*>*)
 
 
 corollary (in TC2) wt_instrs_app_last[trans]:
 assumes "\<turnstile> is\<^sub>2,xt\<^sub>2 [::] \<tau>#\<tau>s\<^sub>2" "\<turnstile> is\<^sub>1,xt\<^sub>1 [::] \<tau>s\<^sub>1"
   "last \<tau>s\<^sub>1 = \<tau>" "size \<tau>s\<^sub>1 = size is\<^sub>1+1"
 shows "\<turnstile> is\<^sub>1@is\<^sub>2, xt\<^sub>1@shift (size is\<^sub>1) xt\<^sub>2 [::] \<tau>s\<^sub>1@\<tau>s\<^sub>2"
 (*<*)
 using assms proof(cases \<tau>s\<^sub>1 rule:rev_cases)
   case (snoc ys y)
   then show ?thesis using assms by(simp add:wt_instrs_app)
 qed simp
 (*>*)
 
 
 corollary (in TC2) wt_instrs_append_last[trans]:
 assumes wtis: "\<turnstile> is,xt [::] \<tau>s" and wti: "P,T\<^sub>r,mxs,mpc,[] \<turnstile> i,pc :: \<tau>s"
   and pc: "pc = size is" and mpc: "mpc = size \<tau>s" and is_\<tau>s: "size is + 1 < size \<tau>s"
 shows "\<turnstile> is@[i],xt [::] \<tau>s"
 (*<*)
 proof -
   have pc_xt: "pc \<notin> pcs xt" using wtis pc by (fastforce simp:wt_instrs_def)
   have "pcs xt \<subseteq> {..<Suc (length is)}" using wtis by (fastforce simp:wt_instrs_def)
   moreover {
     fix pc' assume pc': "\<not> pc' < length is" "pc' < Suc (length is)"
     have "P,T\<^sub>r,mxs,length \<tau>s,xt \<turnstile> i,pc' :: \<tau>s"
       using wt_instr_appLx[where xt = "[]",simplified,OF wti pc_xt]
             less_antisym[OF pc'] pc mpc by simp
   }
   ultimately show ?thesis using wtis is_\<tau>s by(clarsimp simp add:wt_instrs_def)
 qed
 (*>*)
 
 
 corollary (in TC2) wt_instrs_app2:
   "\<lbrakk> \<turnstile> is\<^sub>2,xt\<^sub>2 [::] \<tau>'#\<tau>s\<^sub>2;  \<turnstile> is\<^sub>1,xt\<^sub>1 [::] \<tau>#\<tau>s\<^sub>1@[\<tau>'];
      xt' = xt\<^sub>1 @ shift (size is\<^sub>1) xt\<^sub>2;  size \<tau>s\<^sub>1+1 = size is\<^sub>1 \<rbrakk>
   \<Longrightarrow> \<turnstile> is\<^sub>1@is\<^sub>2,xt' [::] \<tau>#\<tau>s\<^sub>1@\<tau>'#\<tau>s\<^sub>2"
 (*<*)using wt_instrs_app[where ?\<tau>s\<^sub>1.0 = "\<tau> # \<tau>s\<^sub>1"] by simp (*>*)
 
 
 corollary (in TC2) wt_instrs_app2_simp[trans,simp]:
   "\<lbrakk> \<turnstile> is\<^sub>2,xt\<^sub>2 [::] \<tau>'#\<tau>s\<^sub>2;  \<turnstile> is\<^sub>1,xt\<^sub>1 [::] \<tau>#\<tau>s\<^sub>1@[\<tau>']; size \<tau>s\<^sub>1+1 = size is\<^sub>1 \<rbrakk>
   \<Longrightarrow> \<turnstile> is\<^sub>1@is\<^sub>2, xt\<^sub>1@shift (size is\<^sub>1) xt\<^sub>2 [::] \<tau>#\<tau>s\<^sub>1@\<tau>'#\<tau>s\<^sub>2"
 (*<*)using wt_instrs_app[where ?\<tau>s\<^sub>1.0 = "\<tau> # \<tau>s\<^sub>1"] by simp(*>*)
 
 
 corollary (in TC2) wt_instrs_Cons[simp]:
   "\<lbrakk> \<tau>s \<noteq> []; \<turnstile> [i],[] [::] [\<tau>,\<tau>']; \<turnstile> is,xt [::] \<tau>'#\<tau>s \<rbrakk>
   \<Longrightarrow> \<turnstile> i#is,shift 1 xt [::] \<tau>#\<tau>'#\<tau>s"
 (*<*)
 using wt_instrs_app2[where ?is\<^sub>1.0 = "[i]" and ?\<tau>s\<^sub>1.0 = "[]" and ?is\<^sub>2.0 = "is"
                       and ?xt\<^sub>1.0 = "[]"]
 by simp
 
 
 corollary (in TC2) wt_instrs_Cons2[trans]:
   assumes \<tau>s: "\<turnstile> is,xt [::] \<tau>s"
   assumes i: "P,T\<^sub>r,mxs,mpc,[] \<turnstile> i,0 :: \<tau>#\<tau>s"
   assumes mpc: "mpc = size \<tau>s + 1"
   shows "\<turnstile> i#is,shift 1 xt [::] \<tau>#\<tau>s"
 (*<*)
 proof -
   from \<tau>s have "\<tau>s \<noteq> []" by (auto simp: wt_instrs_def)
   with mpc i have "\<turnstile> [i],[] [::] [\<tau>]@\<tau>s" by (simp add: wt_instrs_def)
   with \<tau>s show ?thesis by (fastforce dest: wt_instrs_ext)
 qed
 (*>*)
 
 
 lemma (in TC2) wt_instrs_last_incr[trans]:
 assumes wtis: "\<turnstile> is,xt [::] \<tau>s@[\<tau>]" and ss: "P \<turnstile> \<tau> \<le>' \<tau>'"
 shows "\<turnstile> is,xt [::] \<tau>s@[\<tau>']"
 (*<*)
 proof -
   let ?\<tau>s = "\<tau>s@[\<tau>]" and ?\<tau>s' = "\<tau>s@[\<tau>']"
   { fix pc assume pc: "pc< size is"
     let ?i = "is!pc"
     have app_pc: "app (is ! pc) P mxs T\<^sub>r pc (length ?\<tau>s) xt (\<tau>s ! pc)"
       using wtis pc by(clarsimp simp add:wt_instrs_def wt_instr_def)
     then have Apc\<tau>': "\<And>pc' \<tau>'. (pc',\<tau>') \<in> set (eff ?i P pc xt (?\<tau>s!pc))
      \<Longrightarrow> pc' < length ?\<tau>s"
       using wtis pc by(fastforce simp add:wt_instrs_def app_def)
     have Aepc\<tau>': "\<And>pc' \<tau>'. (pc',\<tau>') \<in> set (eff ?i P pc xt (?\<tau>s!pc))
      \<Longrightarrow> P \<turnstile> \<tau>' \<le>' ?\<tau>s!pc'"
       using wtis pc by(fastforce simp add:wt_instrs_def wt_instr_def)
     { fix pc1 \<tau>1 assume pc\<tau>1: "(pc1,\<tau>1) \<in> set (eff ?i P pc xt (?\<tau>s'!pc))"
       then have epc\<tau>': "(pc1,\<tau>1) \<in> set (eff ?i P pc xt (?\<tau>s!pc))"
           using wtis pc by(simp add:wt_instrs_def)
       have "P \<turnstile> \<tau>1 \<le>' ?\<tau>s'!pc1"
       proof(cases "pc1 < length \<tau>s")
         case True
         then show ?thesis using wtis pc pc\<tau>1
           by(fastforce simp add:wt_instrs_def wt_instr_def)
       next
         case False
         then have "pc1 < length ?\<tau>s" using Apc\<tau>'[OF epc\<tau>'] by simp
         then have [simp]: "pc1 = size \<tau>s" using False by clarsimp
         have "P \<turnstile> \<tau>1 \<le>' \<tau>" using Aepc\<tau>'[OF epc\<tau>'] by simp
         then have "P \<turnstile> \<tau>1 \<le>' \<tau>'" by(rule sup_state_opt_trans[OF _ ss])
         then show ?thesis by simp
       qed
     }
     then have "P,T\<^sub>r,mxs,size ?\<tau>s',xt \<turnstile> is!pc,pc :: ?\<tau>s'" using wtis pc
       by(clarsimp simp add:wt_instrs_def wt_instr_def)
   }
   then show ?thesis using wtis by(simp add:wt_instrs_def)
 qed
 (*>*)
 
 
 lemma [iff]: "xcpt_app i P pc mxs [] \<tau>"
 (*<*)by (simp add: xcpt_app_def relevant_entries_def)(*>*)
 
 
 lemma [simp]: "xcpt_eff i P pc \<tau> [] = []"
 (*<*)by (simp add: xcpt_eff_def relevant_entries_def)(*>*)
 
 
 lemma (in TC2) wt_New:
   "\<lbrakk> is_class P C; size ST < mxs \<rbrakk> \<Longrightarrow>
    \<turnstile> [New C],[] [::] [ty\<^sub>i' ST E A, ty\<^sub>i' (Class C#ST) E A]"
 (*<*)by(simp add:wt_defs ty\<^sub>i'_def)(*>*)
 
 
 lemma (in TC2) wt_Cast:
   "is_class P C \<Longrightarrow>
    \<turnstile> [Checkcast C],[] [::] [ty\<^sub>i' (Class D # ST) E A, ty\<^sub>i' (Class C # ST) E A]"
 (*<*)by(simp add: ty\<^sub>i'_def wt_defs)(*>*)
 
 
 lemma (in TC2) wt_Push:
   "\<lbrakk> size ST < mxs; typeof v = Some T \<rbrakk>
   \<Longrightarrow> \<turnstile> [Push v],[] [::] [ty\<^sub>i' ST E A, ty\<^sub>i' (T#ST) E A]"
 (*<*)by(simp add: ty\<^sub>i'_def wt_defs)(*>*)
 
 
 lemma (in TC2) wt_Pop:
  "\<turnstile> [Pop],[] [::] (ty\<^sub>i' (T#ST) E A # ty\<^sub>i' ST E A # \<tau>s)"
 (*<*)by(simp add: ty\<^sub>i'_def wt_defs)(*>*)
 
 
 lemma (in TC2) wt_CmpEq:
   "\<lbrakk> P \<turnstile> T\<^sub>1 \<le> T\<^sub>2 \<or> P \<turnstile> T\<^sub>2 \<le> T\<^sub>1\<rbrakk>
   \<Longrightarrow> \<turnstile> [CmpEq],[] [::] [ty\<^sub>i' (T\<^sub>2 # T\<^sub>1 # ST) E A, ty\<^sub>i' (Boolean # ST) E A]"
 (*<*) by(auto simp:ty\<^sub>i'_def wt_defs elim!: refTE not_refTE) (*>*)
 
 
 lemma (in TC2) wt_IAdd:
   "\<turnstile> [IAdd],[] [::] [ty\<^sub>i' (Integer#Integer#ST) E A, ty\<^sub>i' (Integer#ST) E A]"
 (*<*)by(simp add:ty\<^sub>i'_def wt_defs)(*>*)
 
 
 lemma (in TC2) wt_Load:
   "\<lbrakk> size ST < mxs; size E \<le> mxl; i \<in>\<in> A; i < size E \<rbrakk>
   \<Longrightarrow> \<turnstile> [Load i],[] [::] [ty\<^sub>i' ST E A, ty\<^sub>i' (E!i # ST) E A]"
 (*<*)by(auto simp add:ty\<^sub>i'_def wt_defs ty\<^sub>l_def hyperset_defs)(*>*)
 
 
 lemma (in TC2) wt_Store:
  "\<lbrakk> P \<turnstile> T \<le> E!i; i < size E; size E \<le> mxl \<rbrakk> \<Longrightarrow>
   \<turnstile> [Store i],[] [::] [ty\<^sub>i' (T#ST) E A, ty\<^sub>i' ST E (\<lfloor>{i}\<rfloor> \<squnion> A)]"
 (*<*)
 by(auto simp:hyperset_defs nth_list_update ty\<^sub>i'_def wt_defs ty\<^sub>l_def
         intro:list_all2_all_nthI)
 (*>*)
 
 
 lemma (in TC2) wt_Get:
  "\<lbrakk> P \<turnstile> C sees F:T in D \<rbrakk> \<Longrightarrow>
   \<turnstile> [Getfield F D],[] [::] [ty\<^sub>i' (Class C # ST) E A, ty\<^sub>i' (T # ST) E A]"
 (*<*)by(auto simp: ty\<^sub>i'_def wt_defs dest: sees_field_idemp sees_field_decl_above)(*>*)
 
 
 lemma (in TC2) wt_Put:
   "\<lbrakk> P \<turnstile> C sees F:T in D; P \<turnstile> T' \<le> T \<rbrakk> \<Longrightarrow>
   \<turnstile> [Putfield F D],[] [::] [ty\<^sub>i' (T' # Class C # ST) E A, ty\<^sub>i' ST E A]"
 (*<*)by(auto intro: sees_field_idemp sees_field_decl_above simp: ty\<^sub>i'_def wt_defs)(*>*)
 
 
 lemma (in TC2) wt_Throw:
   "\<turnstile> [Throw],[] [::] [ty\<^sub>i' (Class C # ST) E A, \<tau>']"
 (*<*)by(auto simp: ty\<^sub>i'_def wt_defs)(*>*)
 
 
 lemma (in TC2) wt_IfFalse:
   "\<lbrakk> 2 \<le> i; nat i < size \<tau>s + 2; P \<turnstile> ty\<^sub>i' ST E A \<le>' \<tau>s ! nat(i - 2) \<rbrakk>
   \<Longrightarrow> \<turnstile> [IfFalse i],[] [::] ty\<^sub>i' (Boolean # ST) E A # ty\<^sub>i' ST E A # \<tau>s"
 (*<*)
 by(simp add: ty\<^sub>i'_def wt_defs eval_nat_numeral nat_diff_distrib)
 (*>*)
 
 
 lemma wt_Goto:
  "\<lbrakk> 0 \<le> int pc + i; nat (int pc + i) < size \<tau>s; size \<tau>s \<le> mpc;
     P \<turnstile> \<tau>s!pc \<le>' \<tau>s ! nat (int pc + i) \<rbrakk>
  \<Longrightarrow> P,T,mxs,mpc,[] \<turnstile> Goto i,pc :: \<tau>s"
 (*<*)by(clarsimp simp add: TC2.wt_defs)(*>*)
 
 
 lemma (in TC2) wt_Invoke:
   "\<lbrakk> size es = size Ts'; P \<turnstile> C sees M: Ts\<rightarrow>T = m in D; P \<turnstile> Ts' [\<le>] Ts \<rbrakk>
   \<Longrightarrow> \<turnstile> [Invoke M (size es)],[] [::] [ty\<^sub>i' (rev Ts' @ Class C # ST) E A, ty\<^sub>i' (T#ST) E A]"
 (*<*)by(fastforce simp add: ty\<^sub>i'_def wt_defs)(*>*)
 
 
 corollary (in TC2) wt_instrs_app3[simp]:
   "\<lbrakk> \<turnstile> is\<^sub>2,[] [::] (\<tau>' # \<tau>s\<^sub>2);  \<turnstile> is\<^sub>1,xt\<^sub>1 [::] \<tau> # \<tau>s\<^sub>1 @ [\<tau>']; size \<tau>s\<^sub>1+1 = size is\<^sub>1\<rbrakk>
   \<Longrightarrow> \<turnstile> (is\<^sub>1 @ is\<^sub>2),xt\<^sub>1 [::] \<tau> # \<tau>s\<^sub>1 @ \<tau>' # \<tau>s\<^sub>2"
 (*<*)using wt_instrs_app2[where ?xt\<^sub>2.0 = "[]"] by (simp add:shift_def)(*>*)
 
 
 corollary (in TC2) wt_instrs_Cons3[simp]:
   "\<lbrakk> \<tau>s \<noteq> []; \<turnstile> [i],[] [::] [\<tau>,\<tau>']; \<turnstile> is,[] [::] \<tau>'#\<tau>s \<rbrakk>
   \<Longrightarrow> \<turnstile> (i # is),[] [::] \<tau> # \<tau>' # \<tau>s"
 (*<*)
 using wt_instrs_Cons[where ?xt = "[]"]
 by (simp add:shift_def)
 
 (*<*)
 declare nth_append[simp del]
 declare [[simproc del: list_to_set_comprehension]]
 (*>*)
 
 lemma (in TC2) wt_instrs_xapp[trans]:
 assumes wtis: "\<turnstile> is\<^sub>1 @ is\<^sub>2, xt [::] \<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2"
   and P_\<tau>s\<^sub>1: "\<forall>\<tau> \<in> set \<tau>s\<^sub>1. \<forall>ST' LT'. \<tau> = Some(ST',LT') \<longrightarrow> 
     size ST \<le> size ST' \<and> P \<turnstile> Some (drop (size ST' - size ST) ST',LT') \<le>' ty\<^sub>i' ST E A"
   and is_\<tau>s: "size is\<^sub>1 = size \<tau>s\<^sub>1" and PC: "is_class P C" and ST_mxs: "size ST < mxs"
 shows "\<turnstile> is\<^sub>1 @ is\<^sub>2, xt @ [(0,size is\<^sub>1 - 1,C,size is\<^sub>1,size ST)] [::] \<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2"
 (*<*)(is "\<turnstile> ?is, xt@[?xte] [::] ?\<tau>s" is "\<turnstile> ?is, ?xt' [::] ?\<tau>s")
 proof -
   let ?is = "is\<^sub>1 @ is\<^sub>2" and ?\<tau>s = "\<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2"
   let ?xte = "(0,size is\<^sub>1 - 1,C,size is\<^sub>1,size ST)"
   let ?xt' = "xt @ [?xte]"
   have P_\<tau>s\<^sub>1': "\<And>\<tau>. \<tau> \<in> set \<tau>s\<^sub>1 \<Longrightarrow> (\<forall>ST' LT'. \<tau> = Some(ST',LT') \<longrightarrow>
      size ST \<le> size ST' \<and> P \<turnstile> Some (drop (size ST' - size ST) ST',LT') \<le>' ty\<^sub>i' ST E A)"
     using P_\<tau>s\<^sub>1 by fast
   have "size ?is < size ?\<tau>s" and "pcs ?xt' \<subseteq> {0..<size ?is}"
     and P_pc: "\<And>pc. pc< size ?is \<Longrightarrow> P,T\<^sub>r,mxs,size ?\<tau>s,xt \<turnstile> ?is!pc,pc :: ?\<tau>s"
     using wtis by(simp_all add:wt_instrs_def)
   moreover {
     fix pc let ?mpc = "size ?\<tau>s" and ?i = "?is!pc" and ?t = "?\<tau>s!pc"
     assume "pc< size ?is"
     then have wti: "P,T\<^sub>r,mxs,?mpc,xt \<turnstile> ?i,pc :: ?\<tau>s" by(rule P_pc)
     then have app: "app ?i P mxs T\<^sub>r pc ?mpc xt ?t"
        and eff_ss: "\<And>pc' \<tau>'. (pc',\<tau>') \<in> set (eff ?i P pc xt (?\<tau>s!pc))
                            \<Longrightarrow> P \<turnstile> \<tau>' \<le>' ?\<tau>s!pc'"
       by(fastforce simp add: wt_instr_def)+
     have "app ?i P mxs T\<^sub>r pc ?mpc ?xt' ?t
              \<and> (\<forall>(pc',\<tau>') \<in> set (eff ?i P pc ?xt' ?t). P \<turnstile> \<tau>' \<le>' ?\<tau>s!pc')"
     proof (cases ?t)
       case (Some \<tau>)
       obtain ST' LT' where \<tau>: "\<tau> = (ST', LT')" by(cases \<tau>) simp
       have app\<^sub>i: "app\<^sub>i (?i,P,pc,mxs,T\<^sub>r,\<tau>)" and xcpt_app: "xcpt_app ?i P pc mxs xt \<tau>"
          and eff_pc: "\<And>pc' \<tau>'. (pc',\<tau>') \<in> set (eff ?i P pc xt ?t) \<Longrightarrow> pc' < ?mpc"
         using Some app by(fastforce simp add: app_def)+
       have "xcpt_app ?i P pc mxs ?xt' \<tau>"
       proof(cases "pc < length \<tau>s\<^sub>1 - 1")
         case False then show ?thesis using Some \<tau> is_\<tau>s xcpt_app
           by (clarsimp simp: xcpt_app_def relevant_entries_def
                              is_relevant_entry_def)
       next
         case True
         then have True': "pc < length \<tau>s\<^sub>1" by simp
         then have "\<tau>s\<^sub>1 ! pc = ?t" by(fastforce simp: nth_append)
         moreover have \<tau>s\<^sub>1_pc: "\<tau>s\<^sub>1 ! pc \<in> set \<tau>s\<^sub>1" by(rule nth_mem[OF True'])
         ultimately show ?thesis
          using Some \<tau> PC ST_mxs xcpt_app P_\<tau>s\<^sub>1'[OF \<tau>s\<^sub>1_pc]
           by (simp add: xcpt_app_def relevant_entries_def)
       qed
       moreover {
         fix pc' \<tau>' assume efft: "(pc',\<tau>') \<in> set (eff ?i P pc ?xt' ?t)"
         have "pc' < ?mpc \<and> P \<turnstile> \<tau>' \<le>' ?\<tau>s!pc'" (is "?P1 \<and> ?P2")
         proof(cases "(pc',\<tau>') \<in> set (eff ?i P pc xt ?t)")
           case True
           have ?P1 using True by(rule eff_pc)
           moreover have ?P2 using True by(rule eff_ss)
           ultimately show ?thesis by simp
         next
           case False
           then have xte: "(pc',\<tau>') \<in> set (xcpt_eff ?i P pc \<tau> [?xte])"
             using efft Some by(clarsimp simp: eff_def)
           then have ?P1 using Some \<tau> is_\<tau>s
             by(clarsimp simp: xcpt_eff_def relevant_entries_def split: if_split_asm)
           moreover have ?P2
           proof(cases "pc < length \<tau>s\<^sub>1 - 1")
             case False': False
             then show ?thesis using False Some \<tau> xte is_\<tau>s
               by(simp add: xcpt_eff_def relevant_entries_def is_relevant_entry_def)
           next
             case True
             then have True': "pc < length \<tau>s\<^sub>1" by simp
             have \<tau>s\<^sub>1_pc: "\<tau>s\<^sub>1 ! pc \<in> set \<tau>s\<^sub>1" by(rule nth_mem[OF True'])
             have "P \<turnstile> \<lfloor>(Class C # drop (length ST' - length ST) ST', LT')\<rfloor>
                          \<le>' ty\<^sub>i' (Class C # ST) E A"
                using True' Some \<tau> P_\<tau>s\<^sub>1'[OF \<tau>s\<^sub>1_pc]
               by (fastforce simp: nth_append ty\<^sub>i'_def)
             then show ?thesis using \<tau> xte is_\<tau>s
               by(simp add: xcpt_eff_def relevant_entries_def split: if_split_asm)
           qed
           ultimately show ?thesis by simp
         qed
       }
       ultimately show ?thesis using Some app\<^sub>i by(fastforce simp add: app_def)
     qed simp
     then have "P,T\<^sub>r,mxs,size ?\<tau>s,?xt' \<turnstile> ?is!pc,pc :: ?\<tau>s"
       by(simp add: wt_instr_def)
   }
   ultimately show ?thesis by(simp add:wt_instrs_def)
 qed
 
 declare [[simproc add: list_to_set_comprehension]]
 declare nth_append[simp]
 (*>*)
 
 lemma drop_Cons_Suc:
   "\<And>xs. drop n xs = y#ys \<Longrightarrow> drop (Suc n) xs = ys"
 proof(induct n)
   case (Suc n) then show ?case by(simp add: drop_Suc)
 qed simp
 
 lemma drop_mess:
 assumes "Suc (length xs\<^sub>0) \<le> length xs"
   and "drop (length xs - Suc (length xs\<^sub>0)) xs = x # xs\<^sub>0"
 shows "drop (length xs - length xs\<^sub>0) xs = xs\<^sub>0"
 using assms proof(cases xs)
   case (Cons a list) then show ?thesis using assms
   proof(cases "length list - length xs\<^sub>0")
     case Suc then show ?thesis using Cons assms
       by (simp add: Suc_diff_le drop_Cons_Suc)
   qed simp
 qed simp
 
 (*<*)
 declare (in TC0)
   after_def[simp] pair_eq_ty\<^sub>i'_conv[simp]
 (*>*)
 
 lemma (in TC1) compT_ST_prefix:
  "\<And>E A ST\<^sub>0. \<lfloor>(ST,LT)\<rfloor> \<in> set(compT E A ST\<^sub>0 e) \<Longrightarrow> 
   size ST\<^sub>0 \<le> size ST \<and> drop (size ST - size ST\<^sub>0) ST = ST\<^sub>0"
 and
  "\<And>E A ST\<^sub>0. \<lfloor>(ST,LT)\<rfloor> \<in> set(compTs E A ST\<^sub>0 es) \<Longrightarrow> 
   size ST\<^sub>0 \<le> size ST \<and> drop (size ST - size ST\<^sub>0) ST = ST\<^sub>0"
 (*<*)
 proof(induct e and es rule: compT.induct compTs.induct)
   case (FAss e\<^sub>1 F D e\<^sub>2)
   moreover {
     let ?ST\<^sub>0 = "ty E e\<^sub>1 # ST\<^sub>0"
     fix A assume "\<lfloor>(ST, LT)\<rfloor> \<in> set (compT E A ?ST\<^sub>0 e\<^sub>2)"
     with FAss
     have "length ?ST\<^sub>0 \<le> length ST \<and> drop (size ST - size ?ST\<^sub>0) ST = ?ST\<^sub>0" by blast
     hence ?case  by (clarsimp simp add: drop_mess)
   }
   ultimately show ?case by auto
 next
   case TryCatch thus ?case by auto
 next
   case Block thus ?case by auto
 next
   case Seq thus ?case by auto
 next
   case While thus ?case by auto
 next
   case Cond thus ?case by auto
 next
   case (Call e M es)
   moreover {
     let ?ST\<^sub>0 = "ty E e # ST\<^sub>0"
     fix A assume "\<lfloor>(ST, LT)\<rfloor> \<in> set (compTs E A ?ST\<^sub>0 es)"
     with Call
     have "length ?ST\<^sub>0 \<le> length ST \<and> drop (size ST - size ?ST\<^sub>0) ST = ?ST\<^sub>0" by blast
     hence ?case  by (clarsimp simp add: drop_mess)
   }
   ultimately show ?case by auto
 next
   case (Cons_exp e es)
   moreover {
     let ?ST\<^sub>0 = "ty E e # ST\<^sub>0"
     fix A assume "\<lfloor>(ST, LT)\<rfloor> \<in> set (compTs E A ?ST\<^sub>0 es)"
     with Cons_exp
     have "length ?ST\<^sub>0 \<le> length ST \<and> drop (size ST - size ?ST\<^sub>0) ST = ?ST\<^sub>0" by blast
     hence ?case  by (clarsimp simp add: drop_mess)
   }
   ultimately show ?case by auto
 next
   case (BinOp e\<^sub>1 bop e\<^sub>2)
   moreover {
     let ?ST\<^sub>0 = "ty E e\<^sub>1 # ST\<^sub>0"
     fix A assume "\<lfloor>(ST, LT)\<rfloor> \<in> set (compT E A ?ST\<^sub>0 e\<^sub>2)"
     with BinOp 
     have "length ?ST\<^sub>0 \<le> length ST \<and> drop (size ST - size ?ST\<^sub>0) ST = ?ST\<^sub>0" by blast
     hence ?case by (clarsimp simp add: drop_mess)
   }
   ultimately show ?case by auto
 next
   case new thus ?case by auto
 next
   case Val thus ?case by auto    
 next
   case Cast thus ?case by auto
 next
   case Var thus ?case by auto
 next
   case LAss thus ?case by auto
 next
   case throw thus ?case by auto
 next
   case FAcc thus ?case by auto
 next
   case Nil_exp thus ?case by auto
 qed 
 
 declare (in TC0) 
   after_def[simp del] pair_eq_ty\<^sub>i'_conv[simp del]
 (*>*)
 
 (* FIXME *)
 lemma fun_of_simp [simp]: "fun_of S x y = ((x,y) \<in> S)" 
 (*<*) by (simp add: fun_of_def)(*>*)
 
 theorem (in TC2) compT_wt_instrs: "\<And>E T A ST.
   \<lbrakk> P,E \<turnstile>\<^sub>1 e :: T; \<D> e A; \<B> e (size E); 
     size ST + max_stack e \<le> mxs; size E + max_vars e \<le> mxl \<rbrakk>
   \<Longrightarrow> \<turnstile> compE\<^sub>2 e, compxE\<^sub>2 e 0 (size ST) [::]
                  ty\<^sub>i' ST E A # compT E A ST e @ [after E A ST e]"
 (*<*)(is "\<And>E T A ST. PROP ?P e E T A ST")(*>*)
 
 and "\<And>E Ts A ST.
   \<lbrakk> P,E \<turnstile>\<^sub>1 es[::]Ts;  \<D>s es A; \<B>s es (size E); 
     size ST + max_stacks es \<le> mxs; size E + max_varss es \<le> mxl \<rbrakk>
   \<Longrightarrow> let \<tau>s = ty\<^sub>i' ST E A # compTs E A ST es in
        \<turnstile> compEs\<^sub>2 es,compxEs\<^sub>2 es 0 (size ST) [::] \<tau>s \<and>
        last \<tau>s = ty\<^sub>i' (rev Ts @ ST) E (A \<squnion> \<A>s es)"
 (*<*)
 (is "\<And>E Ts A ST. PROP ?Ps es E Ts A ST")
 proof(induct e and es rule: compxE\<^sub>2.induct compxEs\<^sub>2.induct)
   case (TryCatch e\<^sub>1 C i e\<^sub>2)
   hence [simp]: "i = size E" by simp
   have wt\<^sub>1: "P,E \<turnstile>\<^sub>1 e\<^sub>1 :: T" and wt\<^sub>2: "P,E@[Class C] \<turnstile>\<^sub>1 e\<^sub>2 :: T"
     and "class": "is_class P C" using TryCatch by auto
   let ?A\<^sub>1 = "A \<squnion> \<A> e\<^sub>1" let ?A\<^sub>i = "A \<squnion> \<lfloor>{i}\<rfloor>" let ?E\<^sub>i = "E @ [Class C]"
   let ?\<tau> = "ty\<^sub>i' ST E A" let ?\<tau>s\<^sub>1 = "compT E A ST e\<^sub>1"
   let ?\<tau>\<^sub>1 = "ty\<^sub>i' (T#ST) E ?A\<^sub>1" let ?\<tau>\<^sub>2 = "ty\<^sub>i' (Class C#ST) E A"
   let ?\<tau>\<^sub>3 = "ty\<^sub>i' ST ?E\<^sub>i ?A\<^sub>i" let ?\<tau>s\<^sub>2 = "compT ?E\<^sub>i ?A\<^sub>i ST e\<^sub>2"
   let ?\<tau>\<^sub>2' = "ty\<^sub>i' (T#ST) ?E\<^sub>i (?A\<^sub>i \<squnion> \<A> e\<^sub>2)"
   let ?\<tau>' = "ty\<^sub>i' (T#ST) E (A \<squnion> \<A> e\<^sub>1 \<sqinter> (\<A> e\<^sub>2 \<ominus> i))"
   let ?go = "Goto (int(size(compE\<^sub>2 e\<^sub>2)) + 2)"
   have "PROP ?P e\<^sub>2 ?E\<^sub>i T ?A\<^sub>i ST" by fact
   hence "\<turnstile> compE\<^sub>2 e\<^sub>2,compxE\<^sub>2 e\<^sub>2 0 (size ST) [::] (?\<tau>\<^sub>3 # ?\<tau>s\<^sub>2) @ [?\<tau>\<^sub>2']"
     using TryCatch.prems by(auto simp:after_def)
   also have "?A\<^sub>i \<squnion> \<A> e\<^sub>2 = (A \<squnion> \<A> e\<^sub>2) \<squnion> \<lfloor>{size E}\<rfloor>"
     by(fastforce simp:hyperset_defs)
   also have "P \<turnstile> ty\<^sub>i' (T#ST) ?E\<^sub>i \<dots> \<le>' ty\<^sub>i' (T#ST) E (A \<squnion> \<A> e\<^sub>2)"
     by(simp add:hyperset_defs ty\<^sub>l_incr ty\<^sub>i'_def)
   also have "P \<turnstile> \<dots> \<le>' ty\<^sub>i' (T#ST) E (A \<squnion> \<A> e\<^sub>1 \<sqinter> (\<A> e\<^sub>2 \<ominus> i))"
     by(auto intro!: ty\<^sub>l_antimono simp:hyperset_defs ty\<^sub>i'_def)
   also have "(?\<tau>\<^sub>3 # ?\<tau>s\<^sub>2) @ [?\<tau>'] = ?\<tau>\<^sub>3 # ?\<tau>s\<^sub>2 @ [?\<tau>']" by simp
   also have "\<turnstile> [Store i],[] [::] ?\<tau>\<^sub>2 # [] @ [?\<tau>\<^sub>3]"
     using TryCatch.prems
     by(auto simp:nth_list_update wt_defs ty\<^sub>i'_def ty\<^sub>l_def
       list_all2_conv_all_nth hyperset_defs)
   also have "[] @ (?\<tau>\<^sub>3 # ?\<tau>s\<^sub>2 @ [?\<tau>']) = (?\<tau>\<^sub>3 # ?\<tau>s\<^sub>2 @ [?\<tau>'])" by simp
   also have "P,T\<^sub>r,mxs,size(compE\<^sub>2 e\<^sub>2)+3,[] \<turnstile> ?go,0 :: ?\<tau>\<^sub>1#?\<tau>\<^sub>2#?\<tau>\<^sub>3#?\<tau>s\<^sub>2 @ [?\<tau>']"
     by (auto simp: hyperset_defs ty\<^sub>i'_def wt_defs nth_Cons nat_add_distrib
       fun_of_def intro: ty\<^sub>l_antimono list_all2_refl split:nat.split)
   also have "\<turnstile> compE\<^sub>2 e\<^sub>1,compxE\<^sub>2 e\<^sub>1 0 (size ST) [::] ?\<tau> # ?\<tau>s\<^sub>1 @ [?\<tau>\<^sub>1]"
     using TryCatch by(auto simp:after_def)
   also have "?\<tau> # ?\<tau>s\<^sub>1 @ ?\<tau>\<^sub>1 # ?\<tau>\<^sub>2 # ?\<tau>\<^sub>3 # ?\<tau>s\<^sub>2 @ [?\<tau>'] =
              (?\<tau> # ?\<tau>s\<^sub>1 @ [?\<tau>\<^sub>1]) @ ?\<tau>\<^sub>2 # ?\<tau>\<^sub>3 # ?\<tau>s\<^sub>2 @ [?\<tau>']" by simp
   also have "compE\<^sub>2 e\<^sub>1 @ ?go  # [Store i] @ compE\<^sub>2 e\<^sub>2 =
              (compE\<^sub>2 e\<^sub>1 @ [?go]) @ (Store i # compE\<^sub>2 e\<^sub>2)" by simp
   also 
   let "?Q \<tau>" = "\<forall>ST' LT'. \<tau> = \<lfloor>(ST', LT')\<rfloor> \<longrightarrow> 
     size ST \<le> size ST' \<and> P \<turnstile> Some (drop (size ST' - size ST) ST',LT') \<le>' ty\<^sub>i' ST E A"
   {
     have "?Q (ty\<^sub>i' ST E A)" by (clarsimp simp add: ty\<^sub>i'_def)
     moreover have "?Q (ty\<^sub>i' (T # ST) E ?A\<^sub>1)" 
       by (fastforce simp add: ty\<^sub>i'_def hyperset_defs intro!: ty\<^sub>l_antimono)
     moreover have "\<And>\<tau>. \<tau> \<in> set (compT E A ST e\<^sub>1) \<Longrightarrow> ?Q \<tau>" using TryCatch.prems
       by clarsimp (frule compT_ST_prefix,
                    fastforce dest!: compT_LT_prefix simp add: ty\<^sub>i'_def)
     ultimately
     have "\<forall>\<tau>\<in>set (ty\<^sub>i' ST E A # compT E A ST e\<^sub>1 @ [ty\<^sub>i' (T # ST) E ?A\<^sub>1]). ?Q \<tau>" 
       by auto
   }
   also from TryCatch.prems max_stack1[of e\<^sub>1] have "size ST + 1 \<le> mxs" by auto
   ultimately show ?case using wt\<^sub>1 wt\<^sub>2 TryCatch.prems "class"
     by (simp add:after_def)
 next
   case new thus ?case by(auto simp add:after_def wt_New)
 next
   case (BinOp e\<^sub>1 bop e\<^sub>2) 
   let ?op = "case bop of Eq \<Rightarrow> [CmpEq] | Add \<Rightarrow> [IAdd]"
   have T: "P,E \<turnstile>\<^sub>1 e\<^sub>1 \<guillemotleft>bop\<guillemotright> e\<^sub>2 :: T" by fact
   then obtain T\<^sub>1 T\<^sub>2 where T\<^sub>1: "P,E \<turnstile>\<^sub>1 e\<^sub>1 :: T\<^sub>1" and T\<^sub>2: "P,E \<turnstile>\<^sub>1 e\<^sub>2 :: T\<^sub>2" and 
     bopT: "case bop of Eq \<Rightarrow> (P \<turnstile> T\<^sub>1 \<le> T\<^sub>2 \<or> P \<turnstile> T\<^sub>2 \<le> T\<^sub>1) \<and> T = Boolean 
                     | Add \<Rightarrow> T\<^sub>1 = Integer \<and> T\<^sub>2 = Integer \<and> T = Integer" by auto
   let ?A\<^sub>1 = "A \<squnion> \<A> e\<^sub>1" let ?A\<^sub>2 = "?A\<^sub>1 \<squnion> \<A> e\<^sub>2"
   let ?\<tau> = "ty\<^sub>i' ST E A" let ?\<tau>s\<^sub>1 = "compT E A ST e\<^sub>1"
   let ?\<tau>\<^sub>1 = "ty\<^sub>i' (T\<^sub>1#ST) E ?A\<^sub>1" let ?\<tau>s\<^sub>2 = "compT E ?A\<^sub>1 (T\<^sub>1#ST) e\<^sub>2"
   let ?\<tau>\<^sub>2 = "ty\<^sub>i' (T\<^sub>2#T\<^sub>1#ST) E ?A\<^sub>2" let ?\<tau>' = "ty\<^sub>i' (T#ST) E ?A\<^sub>2"
   from bopT have "\<turnstile> ?op,[] [::] [?\<tau>\<^sub>2,?\<tau>']" 
     by (cases bop) (auto simp add: wt_CmpEq wt_IAdd)
   also have "PROP ?P e\<^sub>2 E T\<^sub>2 ?A\<^sub>1 (T\<^sub>1#ST)" by fact
   with BinOp.prems T\<^sub>2 
   have "\<turnstile> compE\<^sub>2 e\<^sub>2, compxE\<^sub>2 e\<^sub>2 0 (size (T\<^sub>1#ST)) [::] ?\<tau>\<^sub>1#?\<tau>s\<^sub>2@[?\<tau>\<^sub>2]" 
     by (auto simp: after_def)
   also from BinOp T\<^sub>1 have "\<turnstile> compE\<^sub>2 e\<^sub>1, compxE\<^sub>2 e\<^sub>1 0 (size ST) [::] ?\<tau>#?\<tau>s\<^sub>1@[?\<tau>\<^sub>1]" 
     by (auto simp: after_def)
   finally show ?case using T T\<^sub>1 T\<^sub>2 by (simp add: after_def hyperUn_assoc)
 next
   case (Cons_exp e es)
   have "P,E \<turnstile>\<^sub>1 e # es [::] Ts" by fact
   then obtain T\<^sub>e Ts' where 
     T\<^sub>e: "P,E \<turnstile>\<^sub>1 e :: T\<^sub>e" and Ts': "P,E \<turnstile>\<^sub>1 es [::] Ts'" and
     Ts: "Ts = T\<^sub>e#Ts'" by auto
   let ?A\<^sub>e = "A \<squnion> \<A> e"  
   let ?\<tau> = "ty\<^sub>i' ST E A" let ?\<tau>s\<^sub>e = "compT E A ST e"  
   let ?\<tau>\<^sub>e = "ty\<^sub>i' (T\<^sub>e#ST) E ?A\<^sub>e" let ?\<tau>s' = "compTs E ?A\<^sub>e (T\<^sub>e#ST) es"
   let ?\<tau>s = "?\<tau> # ?\<tau>s\<^sub>e @ (?\<tau>\<^sub>e # ?\<tau>s')"
   have Ps: "PROP ?Ps es E Ts' ?A\<^sub>e (T\<^sub>e#ST)" by fact
   with Cons_exp.prems T\<^sub>e Ts'
   have "\<turnstile> compEs\<^sub>2 es, compxEs\<^sub>2 es 0 (size (T\<^sub>e#ST)) [::] ?\<tau>\<^sub>e#?\<tau>s'" by (simp add: after_def)
   also from Cons_exp T\<^sub>e have "\<turnstile> compE\<^sub>2 e, compxE\<^sub>2 e 0 (size ST) [::] ?\<tau>#?\<tau>s\<^sub>e@[?\<tau>\<^sub>e]" 
     by (auto simp: after_def)
   moreover
   from Ps Cons_exp.prems T\<^sub>e Ts' Ts
   have "last ?\<tau>s = ty\<^sub>i' (rev Ts@ST) E (?A\<^sub>e \<squnion> \<A>s es)" by simp
   ultimately show ?case using T\<^sub>e by (simp add: after_def hyperUn_assoc)
 next
   case (FAss e\<^sub>1 F D e\<^sub>2)
   hence Void: "P,E \<turnstile>\<^sub>1 e\<^sub>1\<bullet>F{D} := e\<^sub>2 :: Void" by auto
   then obtain C T T' where    
     C: "P,E \<turnstile>\<^sub>1 e\<^sub>1 :: Class C" and sees: "P \<turnstile> C sees F:T in D" and
     T': "P,E \<turnstile>\<^sub>1 e\<^sub>2 :: T'" and T'_T: "P \<turnstile> T' \<le> T" by auto
   let ?A\<^sub>1 = "A \<squnion> \<A> e\<^sub>1" let ?A\<^sub>2 = "?A\<^sub>1 \<squnion> \<A> e\<^sub>2"  
   let ?\<tau> = "ty\<^sub>i' ST E A" let ?\<tau>s\<^sub>1 = "compT E A ST e\<^sub>1"
   let ?\<tau>\<^sub>1 = "ty\<^sub>i' (Class C#ST) E ?A\<^sub>1" let ?\<tau>s\<^sub>2 = "compT E ?A\<^sub>1 (Class C#ST) e\<^sub>2"
   let ?\<tau>\<^sub>2 = "ty\<^sub>i' (T'#Class C#ST) E ?A\<^sub>2" let ?\<tau>\<^sub>3 = "ty\<^sub>i' ST E ?A\<^sub>2"
   let ?\<tau>' = "ty\<^sub>i' (Void#ST) E ?A\<^sub>2"
   from FAss.prems sees T'_T 
   have "\<turnstile> [Putfield F D,Push Unit],[] [::] [?\<tau>\<^sub>2,?\<tau>\<^sub>3,?\<tau>']"
     by (fastforce simp add: wt_Push wt_Put)
   also have "PROP ?P e\<^sub>2 E T' ?A\<^sub>1 (Class C#ST)" by fact
   with FAss.prems T' 
   have "\<turnstile> compE\<^sub>2 e\<^sub>2, compxE\<^sub>2 e\<^sub>2 0 (size ST+1) [::] ?\<tau>\<^sub>1#?\<tau>s\<^sub>2@[?\<tau>\<^sub>2]"
     by (auto simp add: after_def hyperUn_assoc) 
   also from FAss C have "\<turnstile> compE\<^sub>2 e\<^sub>1, compxE\<^sub>2 e\<^sub>1 0 (size ST) [::] ?\<tau>#?\<tau>s\<^sub>1@[?\<tau>\<^sub>1]" 
     by (auto simp add: after_def)
   finally show ?case using Void C T' by (simp add: after_def hyperUn_assoc) 
 next
   case Val thus ?case by(auto simp:after_def wt_Push)
 next
   case Cast thus ?case by (auto simp:after_def wt_Cast)
 next
   case (Block i T\<^sub>i e)
   let ?\<tau>s = "ty\<^sub>i' ST E A # compT (E @ [T\<^sub>i]) (A\<ominus>i) ST e"
   have IH: "PROP ?P e (E@[T\<^sub>i]) T (A\<ominus>i) ST" by fact
   hence "\<turnstile> compE\<^sub>2 e, compxE\<^sub>2 e 0 (size ST) [::]
          ?\<tau>s @ [ty\<^sub>i' (T#ST) (E@[T\<^sub>i]) (A\<ominus>(size E) \<squnion> \<A> e)]"
     using Block.prems by (auto simp add: after_def)
   also have "P \<turnstile> ty\<^sub>i' (T # ST) (E@[T\<^sub>i]) (A \<ominus> size E \<squnion> \<A> e) \<le>'
                  ty\<^sub>i' (T # ST) (E@[T\<^sub>i]) ((A \<squnion> \<A> e) \<ominus> size E)"
      by(auto simp add:hyperset_defs intro: ty\<^sub>i'_antimono)
   also have "\<dots> = ty\<^sub>i' (T # ST) E (A \<squnion> \<A> e)" by simp
   also have "P \<turnstile> \<dots> \<le>' ty\<^sub>i' (T # ST) E (A \<squnion> (\<A> e \<ominus> i))"
      by(auto simp add:hyperset_defs intro: ty\<^sub>i'_antimono)
   finally show ?case using Block.prems by(simp add: after_def)
 next
   case Var thus ?case by(auto simp:after_def wt_Load)
 next
   case FAcc thus ?case by(auto simp:after_def wt_Get)
 next
   case (LAss i e) thus ?case using max_stack1[of e]
     by(auto simp: hyper_insert_comm after_def wt_Store wt_Push)
 next
   case Nil_exp thus ?case by auto
 next
   case throw thus ?case by(auto simp add: after_def wt_Throw)
 next
   case (While e c)
   obtain Tc where wte: "P,E \<turnstile>\<^sub>1 e :: Boolean" and wtc: "P,E \<turnstile>\<^sub>1 c :: Tc"
     and [simp]: "T = Void" using While by auto
   have [simp]: "ty E (while (e) c) = Void" using While by simp
   let ?A\<^sub>0 = "A \<squnion> \<A> e" let ?A\<^sub>1 = "?A\<^sub>0 \<squnion> \<A> c"
   let ?\<tau> = "ty\<^sub>i' ST E A" let ?\<tau>s\<^sub>e = "compT E A ST e"
   let ?\<tau>\<^sub>e = "ty\<^sub>i' (Boolean#ST) E ?A\<^sub>0" let ?\<tau>\<^sub>1 = "ty\<^sub>i' ST E ?A\<^sub>0"
   let ?\<tau>s\<^sub>c = "compT E ?A\<^sub>0 ST c" let ?\<tau>\<^sub>c = "ty\<^sub>i' (Tc#ST) E ?A\<^sub>1"
   let ?\<tau>\<^sub>2 = "ty\<^sub>i' ST E ?A\<^sub>1" let ?\<tau>' = "ty\<^sub>i' (Void#ST) E ?A\<^sub>0"
   let ?\<tau>s = "(?\<tau> # ?\<tau>s\<^sub>e @ [?\<tau>\<^sub>e]) @ ?\<tau>\<^sub>1 # ?\<tau>s\<^sub>c @ [?\<tau>\<^sub>c, ?\<tau>\<^sub>2, ?\<tau>\<^sub>1, ?\<tau>']"
   have "\<turnstile> [],[] [::] [] @ ?\<tau>s" by(simp add:wt_instrs_def)
   also
   have "PROP ?P e E Boolean A ST" by fact
   hence "\<turnstile> compE\<^sub>2 e,compxE\<^sub>2 e 0 (size ST) [::] ?\<tau> # ?\<tau>s\<^sub>e @ [?\<tau>\<^sub>e]"
     using While.prems by (auto simp:after_def)
   also
   have "[] @ ?\<tau>s = (?\<tau> # ?\<tau>s\<^sub>e) @ ?\<tau>\<^sub>e # ?\<tau>\<^sub>1 # ?\<tau>s\<^sub>c @ [?\<tau>\<^sub>c,?\<tau>\<^sub>2,?\<tau>\<^sub>1,?\<tau>']" by simp
   also
   let ?n\<^sub>e = "size(compE\<^sub>2 e)"  let ?n\<^sub>c = "size(compE\<^sub>2 c)"
   let ?if = "IfFalse (int ?n\<^sub>c + 3)"
   have "\<turnstile> [?if],[] [::] ?\<tau>\<^sub>e # ?\<tau>\<^sub>1 # ?\<tau>s\<^sub>c @ [?\<tau>\<^sub>c, ?\<tau>\<^sub>2, ?\<tau>\<^sub>1, ?\<tau>']" 
   proof-{
       show ?thesis
         apply (rule wt_IfFalse)
           apply simp
          apply simp
         apply (subgoal_tac "length (compE\<^sub>2 c) = length (compT E (A \<squnion> \<A> e) ST c) + 1" 
                            "nat (int (length (compE\<^sub>2 c)) + 3 - 2) > length (compT E (A \<squnion> \<A> e) ST c)")
           apply simp+
         done
     }
   qed
   also
   have "(?\<tau> # ?\<tau>s\<^sub>e) @ (?\<tau>\<^sub>e # ?\<tau>\<^sub>1 # ?\<tau>s\<^sub>c @ [?\<tau>\<^sub>c, ?\<tau>\<^sub>2, ?\<tau>\<^sub>1, ?\<tau>']) = ?\<tau>s" by simp
   also
   have "PROP ?P c E Tc ?A\<^sub>0 ST" by fact
   hence "\<turnstile> compE\<^sub>2 c,compxE\<^sub>2 c 0 (size ST) [::] ?\<tau>\<^sub>1 # ?\<tau>s\<^sub>c @ [?\<tau>\<^sub>c]"
     using While.prems wtc by (auto simp:after_def)
   also have "?\<tau>s = (?\<tau> # ?\<tau>s\<^sub>e @ [?\<tau>\<^sub>e,?\<tau>\<^sub>1] @ ?\<tau>s\<^sub>c) @ [?\<tau>\<^sub>c,?\<tau>\<^sub>2,?\<tau>\<^sub>1,?\<tau>']" by simp
   also have "\<turnstile> [Pop],[] [::] [?\<tau>\<^sub>c, ?\<tau>\<^sub>2]"  by(simp add:wt_Pop)
   also have "(?\<tau> # ?\<tau>s\<^sub>e @ [?\<tau>\<^sub>e,?\<tau>\<^sub>1] @ ?\<tau>s\<^sub>c) @ [?\<tau>\<^sub>c,?\<tau>\<^sub>2,?\<tau>\<^sub>1,?\<tau>'] = ?\<tau>s" by simp
   also let ?go = "Goto (-int(?n\<^sub>c+?n\<^sub>e+2))"
   have "P \<turnstile> ?\<tau>\<^sub>2 \<le>' ?\<tau>" by(fastforce intro: ty\<^sub>i'_antimono simp: hyperset_defs)
   hence "P,T\<^sub>r,mxs,size ?\<tau>s,[] \<turnstile> ?go,?n\<^sub>e+?n\<^sub>c+2 :: ?\<tau>s" 
   proof-{
       let ?t1 = "ty\<^sub>i' ST E A" let ?t2 = "ty\<^sub>i' (Boolean # ST) E (A \<squnion> \<A> e)" let ?t3 = "ty\<^sub>i' ST E (A \<squnion> \<A> e)"
       let ?t4 = "[ty\<^sub>i' (Tc # ST) E (A \<squnion> \<A> e \<squnion> \<A> c), ty\<^sub>i' ST E (A \<squnion> \<A> e \<squnion> \<A> c), ty\<^sub>i' ST E (A \<squnion> \<A> e), ty\<^sub>i' (Void # ST) E (A \<squnion> \<A> e)]"
       let ?c = " compT E (A \<squnion> \<A> e) ST c" let ?e = "compT E A ST e" 
       assume ass: "P \<turnstile> ty\<^sub>i' ST E (A \<squnion> \<A> e \<squnion> \<A> c) \<le>' ?t1"      
       show ?thesis
         apply (rule wt_Goto)
         apply simp
           apply simp
          apply simp
       proof-{
           let ?s1 = "((?t1 # ?e @ [?t2]) @ ?t3 # ?c)"          
           have "length (compE\<^sub>2 e) + length (compE\<^sub>2 c) + 2 > length ?s1" by auto
           hence "(?s1 @ ?t4) ! (length (compE\<^sub>2 e) + length (compE\<^sub>2 c) + 2) =
                      ?t4 ! (length (compE\<^sub>2 e) + length (compE\<^sub>2 c) + 2 - length ?s1)" 
             by (auto simp only:nth_append split: if_splits)
           hence "(?s1 @ ?t4) ! (length (compE\<^sub>2 e) + length (compE\<^sub>2 c) + 2) = ty\<^sub>i' ST E (A \<squnion> \<A> e \<squnion> \<A> c)" 
             using compT_sizes by auto 
           hence "P \<turnstile> (?s1 @ ?t4) ! (length (compE\<^sub>2 e) + length (compE\<^sub>2 c) + 2) \<le>' ty\<^sub>i' ST E A" 
             using ass by simp
           thus "P \<turnstile> ((?t1 # ?e @ [?t2]) @ ?t3 # ?c @ ?t4) ! (length (compE\<^sub>2 e) + length (compE\<^sub>2 c) + 2) \<le>'
                     ((?t1 # ?e @ [?t2]) @ ?t3 # ?c @ ?t4) ! nat (int (length (compE\<^sub>2 e) + length (compE\<^sub>2 c) + 2) +
                       - int (length (compE\<^sub>2 c) + length (compE\<^sub>2 e) + 2))"
             by simp
         }qed
     }qed
   also have "?\<tau>s = (?\<tau> # ?\<tau>s\<^sub>e @ [?\<tau>\<^sub>e,?\<tau>\<^sub>1] @ ?\<tau>s\<^sub>c @ [?\<tau>\<^sub>c, ?\<tau>\<^sub>2]) @ [?\<tau>\<^sub>1, ?\<tau>']"
     by simp
   also have "\<turnstile> [Push Unit],[] [::] [?\<tau>\<^sub>1,?\<tau>']"
     using While.prems max_stack1[of c] by(auto simp add:wt_Push)
   finally show ?case using wtc wte
     by (simp add:after_def)
 next
   case (Cond e e\<^sub>1 e\<^sub>2)
   obtain T\<^sub>1 T\<^sub>2 where wte: "P,E \<turnstile>\<^sub>1 e :: Boolean"
     and wt\<^sub>1: "P,E \<turnstile>\<^sub>1 e\<^sub>1 :: T\<^sub>1" and wt\<^sub>2: "P,E \<turnstile>\<^sub>1 e\<^sub>2 :: T\<^sub>2"
     and sub\<^sub>1: "P \<turnstile> T\<^sub>1 \<le> T" and sub\<^sub>2: "P \<turnstile> T\<^sub>2 \<le> T"
     using Cond by auto
   have [simp]: "ty E (if (e) e\<^sub>1 else e\<^sub>2) = T" using Cond by simp
   let ?A\<^sub>0 = "A \<squnion> \<A> e" let ?A\<^sub>2 = "?A\<^sub>0 \<squnion> \<A> e\<^sub>2" let ?A\<^sub>1 = "?A\<^sub>0 \<squnion> \<A> e\<^sub>1"
   let ?A' = "?A\<^sub>0 \<squnion> \<A> e\<^sub>1 \<sqinter> \<A> e\<^sub>2"
   let ?\<tau>\<^sub>2 = "ty\<^sub>i' ST E ?A\<^sub>0" let ?\<tau>' = "ty\<^sub>i' (T#ST) E ?A'"
   let ?\<tau>s\<^sub>2 = "compT E ?A\<^sub>0 ST e\<^sub>2"
   have "PROP ?P e\<^sub>2 E T\<^sub>2 ?A\<^sub>0 ST" by fact
   hence "\<turnstile> compE\<^sub>2 e\<^sub>2, compxE\<^sub>2 e\<^sub>2 0 (size ST) [::] (?\<tau>\<^sub>2#?\<tau>s\<^sub>2) @ [ty\<^sub>i' (T\<^sub>2#ST) E ?A\<^sub>2]"
     using Cond.prems wt\<^sub>2 by(auto simp add:after_def)
   also have "P \<turnstile> ty\<^sub>i' (T\<^sub>2#ST) E ?A\<^sub>2 \<le>' ?\<tau>'" using sub\<^sub>2
     by(auto simp add: hyperset_defs ty\<^sub>i'_def intro!: ty\<^sub>l_antimono)
   also
   let ?\<tau>\<^sub>3 = "ty\<^sub>i' (T\<^sub>1 # ST) E ?A\<^sub>1"
   let ?g\<^sub>2 = "Goto(int (size (compE\<^sub>2 e\<^sub>2) + 1))"
   from sub\<^sub>1 have "P,T\<^sub>r,mxs,size(compE\<^sub>2 e\<^sub>2)+2,[] \<turnstile> ?g\<^sub>2,0 :: ?\<tau>\<^sub>3#(?\<tau>\<^sub>2#?\<tau>s\<^sub>2)@[?\<tau>']"
     by(auto simp: hyperset_defs wt_defs nth_Cons ty\<^sub>i'_def
              split:nat.split intro!: ty\<^sub>l_antimono)
   also
   let ?\<tau>s\<^sub>1 = "compT E ?A\<^sub>0 ST e\<^sub>1"
   have "PROP ?P e\<^sub>1 E T\<^sub>1 ?A\<^sub>0 ST" by fact
   hence "\<turnstile> compE\<^sub>2 e\<^sub>1,compxE\<^sub>2 e\<^sub>1 0 (size ST) [::] ?\<tau>\<^sub>2 # ?\<tau>s\<^sub>1 @ [?\<tau>\<^sub>3]"
     using Cond.prems wt\<^sub>1 by(auto simp add:after_def)
   also
   let ?\<tau>s\<^sub>1\<^sub>2 = "?\<tau>\<^sub>2 # ?\<tau>s\<^sub>1 @ ?\<tau>\<^sub>3 # (?\<tau>\<^sub>2 # ?\<tau>s\<^sub>2) @ [?\<tau>']"
   let ?\<tau>\<^sub>1 = "ty\<^sub>i' (Boolean#ST) E ?A\<^sub>0"
   let ?g\<^sub>1 = "IfFalse(int (size (compE\<^sub>2 e\<^sub>1) + 2))"
   let ?code = "compE\<^sub>2 e\<^sub>1 @ ?g\<^sub>2 # compE\<^sub>2 e\<^sub>2"
   have "\<turnstile> [?g\<^sub>1],[] [::] [?\<tau>\<^sub>1] @ ?\<tau>s\<^sub>1\<^sub>2"  
   proof-{
     show ?thesis 
       apply clarsimp
       apply (rule wt_IfFalse)
         apply (simp only:nat_add_distrib)
        apply simp
       apply (auto simp only:nth_append split:if_splits)     
       apply (simp only:compT_sizes)
       apply simp
       done
   }qed
   also (wt_instrs_ext2) have "[?\<tau>\<^sub>1] @ ?\<tau>s\<^sub>1\<^sub>2 = ?\<tau>\<^sub>1 # ?\<tau>s\<^sub>1\<^sub>2" by simp also
   let ?\<tau> = "ty\<^sub>i' ST E A"
   have "PROP ?P e E Boolean A ST" by fact
   hence "\<turnstile> compE\<^sub>2 e, compxE\<^sub>2 e 0 (size ST) [::] ?\<tau> # compT E A ST e @ [?\<tau>\<^sub>1]"
     using Cond.prems wte by(auto simp add:after_def)
   finally show ?case using wte wt\<^sub>1 wt\<^sub>2 by(simp add:after_def hyperUn_assoc)
 next
   case (Call e M es)
   obtain C D Ts m Ts' where C: "P,E \<turnstile>\<^sub>1 e :: Class C"
     and "method": "P \<turnstile> C sees M:Ts \<rightarrow> T = m in D"
     and wtes: "P,E \<turnstile>\<^sub>1 es [::] Ts'" and subs: "P \<turnstile> Ts' [\<le>] Ts"
     using Call.prems by auto
   from wtes have same_size: "size es = size Ts'" by(rule WTs\<^sub>1_same_size)
   let ?A\<^sub>0 = "A \<squnion> \<A> e" let ?A\<^sub>1 = "?A\<^sub>0 \<squnion> \<A>s es"
   let ?\<tau> = "ty\<^sub>i' ST E A" let ?\<tau>s\<^sub>e = "compT E A ST e"
   let ?\<tau>\<^sub>e = "ty\<^sub>i' (Class C # ST) E ?A\<^sub>0"
   let ?\<tau>s\<^sub>e\<^sub>s = "compTs E ?A\<^sub>0 (Class C # ST) es"
   let ?\<tau>\<^sub>1 = "ty\<^sub>i' (rev Ts' @ Class C # ST) E ?A\<^sub>1"
   let ?\<tau>' = "ty\<^sub>i' (T # ST) E ?A\<^sub>1"
   have "\<turnstile> [Invoke M (size es)],[] [::] [?\<tau>\<^sub>1,?\<tau>']"
     by(rule wt_Invoke[OF same_size "method" subs])
   also
   have "PROP ?Ps es E Ts' ?A\<^sub>0 (Class C # ST)" by fact
   hence "\<turnstile> compEs\<^sub>2 es,compxEs\<^sub>2 es 0 (size ST+1) [::] ?\<tau>\<^sub>e # ?\<tau>s\<^sub>e\<^sub>s"
         "last (?\<tau>\<^sub>e # ?\<tau>s\<^sub>e\<^sub>s) = ?\<tau>\<^sub>1"
     using Call.prems wtes by(auto simp add:after_def)
   also have "(?\<tau>\<^sub>e # ?\<tau>s\<^sub>e\<^sub>s) @ [?\<tau>'] = ?\<tau>\<^sub>e # ?\<tau>s\<^sub>e\<^sub>s @ [?\<tau>']" by simp
   also have "\<turnstile> compE\<^sub>2 e,compxE\<^sub>2 e 0 (size ST) [::] ?\<tau> # ?\<tau>s\<^sub>e @ [?\<tau>\<^sub>e]"
     using Call C by(auto simp add:after_def)
   finally show ?case using Call.prems C by(simp add:after_def hyperUn_assoc)
 next
   case Seq thus ?case
     by(auto simp:after_def)
       (fastforce simp:wt_Push wt_Pop hyperUn_assoc
                 intro:wt_instrs_app2 wt_instrs_Cons)
 qed
 (*>*)
 
 
 lemma [simp]: "types (compP f P) = types P"
 (*<*)by auto(*>*)
 
 lemma [simp]: "states (compP f P) mxs mxl = states P mxs mxl"
 (*<*)by (simp add: JVM_states_unfold)(*>*)
 
 lemma [simp]: "app\<^sub>i (i, compP f P, pc, mpc, T, \<tau>) = app\<^sub>i (i, P, pc, mpc, T, \<tau>)"
 (*<*)(is "?A = ?B")
 proof -
   obtain ST LT where \<tau>: "\<tau> = (ST, LT)" by(cases \<tau>) simp
   then show ?thesis proof(cases i)
     case Invoke show ?thesis
     proof(rule iffI)
       assume ?A then show ?B using Invoke \<tau>
         by auto (fastforce dest!: sees_method_compPD)
     next
       assume ?B then show ?A using Invoke \<tau>
         by auto (force dest: sees_method_compP)
     qed
   qed auto
 qed
 (*>*)
   
 lemma [simp]: "is_relevant_entry (compP f P) i = is_relevant_entry P i"
 (*<*)
 proof -
   { fix pc e
     have "is_relevant_entry (compP f P) i pc e = is_relevant_entry P i pc e"
       by(cases i) (auto simp: is_relevant_entry_def)
   }
   then show ?thesis by fast
 qed
 (*>*)
 
 lemma [simp]: "relevant_entries (compP f P) i pc xt = relevant_entries P i pc xt"
 (*<*) by (simp add: relevant_entries_def)(*>*)
 
 lemma [simp]: "app i (compP f P) mpc T pc mxl xt \<tau> = app i P mpc T pc mxl xt \<tau>"
 (*<*)
 by (simp add: app_def xcpt_app_def eff_def xcpt_eff_def norm_eff_def)
    (fastforce simp add: image_def)
 (*>*)
 
 lemma [simp]:
 assumes "app i P mpc T pc mxl xt \<tau>"
 shows "eff i (compP f P) pc xt \<tau> = eff i P pc xt \<tau>"
 (*<*)
 using assms
 proof(clarsimp simp: eff_def norm_eff_def xcpt_eff_def app_def, cases i)
 qed auto
 (*>*)
 
 lemma [simp]: "subtype (compP f P) = subtype P"
 (*<*)by (rule ext)+ simp(*>*)
   
 lemma [simp]: "compP f P \<turnstile> \<tau> \<le>' \<tau>' = P \<turnstile> \<tau> \<le>' \<tau>'"
 (*<*) by (simp add: sup_state_opt_def sup_state_def sup_ty_opt_def)(*>*)
 
 lemma [simp]: "compP f P,T,mpc,mxl,xt \<turnstile> i,pc :: \<tau>s = P,T,mpc,mxl,xt \<turnstile> i,pc :: \<tau>s"
 (*<*)by (simp add: wt_instr_def cong: conj_cong)(*>*)
 
 declare TC1.compT_sizes[simp]  TC0.ty_def2[simp]
 
 context TC2
 begin
 
 lemma compT_method:
   fixes e and A and C and Ts and mxl\<^sub>0
   defines [simp]: "E \<equiv> Class C # Ts"
     and [simp]: "A \<equiv> \<lfloor>{..size Ts}\<rfloor>"
     and [simp]: "A' \<equiv> A \<squnion> \<A> e"
     and [simp]: "mxl\<^sub>0 \<equiv> max_vars e"
   assumes mxs: "max_stack e = mxs"
     and mxl: "Suc (length Ts + max_vars e) = mxl"
   assumes wf: "wf_prog p P" and wte: "P,E \<turnstile>\<^sub>1 e :: T" and \<D>: "\<D> e A"
     and \<B>: "\<B> e (size E)" and E_P: "set E \<subseteq> types P" and wid: "P \<turnstile> T \<le> T\<^sub>r"
   shows "wt_method (compP\<^sub>2 P) C Ts T\<^sub>r mxs mxl\<^sub>0 (compE\<^sub>2 e @ [Return])
     (compxE\<^sub>2 e 0 0) (ty\<^sub>i' [] E A # compT\<^sub>a E A [] e)"
 (*<*)(is "wt_method ?P C Ts T\<^sub>r mxs mxl\<^sub>0 ?is ?xt ?\<tau>s")
 proof -
   let ?n = "length E + mxl\<^sub>0"
   have wt_compE: "P,T\<^sub>r,mxs \<turnstile> compE\<^sub>2 e, compxE\<^sub>2 e 0 (length []) [::]
         TC0.ty\<^sub>i' ?n [] E A # TC1.compT P ?n E A [] e @[TC0.after P ?n E A [] e]"
     using mxs TC2.compT_wt_instrs [OF wte \<D> \<B>, of "[]" mxs ?n T\<^sub>r] by simp
 
   have "OK (ty\<^sub>i' [T] E A') \<in> states P mxs mxl"
     using mxs WT\<^sub>1_is_type[OF wf wte E_P] max_stack1[of e] OK_ty\<^sub>i'_in_statesI[OF E_P]
       by simp
   moreover have "OK ` set (compT E A [] e) \<subseteq> states P mxs mxl"
     using mxs mxl wid compT_states(1)[OF wf wte E_P] by simp
   ultimately have "check_types ?P mxs ?n (map OK ?\<tau>s)"
     using mxl wte E_P by (simp add: compT\<^sub>a_def after_def check_types_def)
   moreover have "wt_start ?P C Ts mxl\<^sub>0 ?\<tau>s" using mxl
     by (auto simp: wt_start_def ty\<^sub>i'_def ty\<^sub>l_def list_all2_conv_all_nth nth_Cons
              split: nat.split)
   moreover {
     fix pc assume pc: "pc < size ?is"
     then have "?P,T\<^sub>r,mxs,size ?is,?xt \<turnstile> ?is!pc,pc :: ?\<tau>s"
     proof(cases "pc < length (compE\<^sub>2 e)")
       case True
       then show ?thesis using mxs wte wt_compE
         by (clarsimp simp: compT\<^sub>a_def mxl after_def wt_instrs_def)
     next
       case False
       have "length (compE\<^sub>2 e) = pc" using less_antisym[OF False] pc by simp
       then show ?thesis using mxl wte E_P wid
         by (clarsimp simp: compT\<^sub>a_def after_def wt_defs xcpt_app_pcs xcpt_eff_pcs ty\<^sub>i'_def)
     qed
   }
   moreover have "0 < size ?is" and "size ?\<tau>s = size ?is"
     using wte by (simp_all add: compT\<^sub>a_def)
   ultimately show ?thesis by(simp add: wt_method_def)
 qed
 (*>*)
 
 end
 
 definition compTP :: "J\<^sub>1_prog \<Rightarrow> ty\<^sub>P" where
   "compTP P C M = (
   let (D,Ts,T,e) = method P C M;
        E = Class C # Ts;
        A = \<lfloor>{..size Ts}\<rfloor>;
        mxl = 1 + size Ts + max_vars e
   in  (TC0.ty\<^sub>i' mxl [] E A # TC1.compT\<^sub>a P mxl E A [] e))"
 
 theorem wt_compP\<^sub>2:
 assumes wf: "wf_J\<^sub>1_prog P" shows "wf_jvm_prog (compP\<^sub>2 P)"
 (*<*)
 proof -
   let ?\<Phi> = "compTP P" and ?f = compMb\<^sub>2
   let ?wf\<^sub>2 = "\<lambda>P C (M, Ts, T\<^sub>r, mxs, mxl\<^sub>0, is, xt).
               wt_method P C Ts T\<^sub>r mxs mxl\<^sub>0 is xt (?\<Phi> C M)"
     and ?P = "compP ?f P"
   { fix C M Ts T m
     assume cM: "P \<turnstile> C sees M :  Ts\<rightarrow>T = m in C"
       and wfm: "wf_mdecl wf_J\<^sub>1_mdecl P C (M,Ts,T,m)"
     then have Ts_types: "\<forall>T'\<in>set Ts. is_type P T'"
      and T_type: "is_type P T" and wfm\<^sub>1: "wf_J\<^sub>1_mdecl P C (M,Ts,T,m)"
       by(simp_all add: wf_mdecl_def)
     then obtain T' where wte: "P,Class C#Ts \<turnstile>\<^sub>1 m :: T'" and wid: "P \<turnstile> T' \<le> T"
        and \<D>: "\<D> m \<lfloor>{..size Ts}\<rfloor>" and \<B>: "\<B> m (Suc (size Ts))"
       by(auto simp: wf_mdecl_def)
     have CTs_P: "is_class P C \<and> set Ts \<subseteq> types P"
       using sees_wf_mdecl[OF wf cM] sees_method_is_class[OF cM]
        by (clarsimp simp: wf_mdecl_def)
 
     have "?wf\<^sub>2 ?P C (M,Ts,T,?f m)"
       using cM TC2.compT_method [simplified, OF _ _ wf wte \<D> \<B> CTs_P wid]
        by(simp add: compTP_def)
     then have "wf_mdecl ?wf\<^sub>2 ?P C (M, Ts, T, ?f m)"
       using Ts_types T_type by(simp add: wf_mdecl_def)
   }
   then have "wf_prog ?wf\<^sub>2 (compP ?f P)" by(rule wf_prog_compPI[OF _ wf])
   then show ?thesis by (simp add: wf_jvm_prog_def wf_jvm_prog_phi_def) fast
 qed
 (*>*)
 
 theorem wt_J2JVM:
   "wf_J_prog P \<Longrightarrow> wf_jvm_prog (J2JVM P)"
 (*<*)
 by(simp only:o_def J2JVM_def)
   (blast intro:wt_compP\<^sub>2 compP\<^sub>1_pres_wf)
 
 end
diff --git a/thys/Jinja/DFA/Kildall_1.thy b/thys/Jinja/DFA/Kildall_1.thy
--- a/thys/Jinja/DFA/Kildall_1.thy
+++ b/thys/Jinja/DFA/Kildall_1.thy
@@ -1,143 +1,116 @@
 (*  Title:      HOL/MicroJava/BV/Kildall.thy
     Author:     Tobias Nipkow, Gerwin Klein
     Copyright   2000 TUM
 
 Kildall's algorithm.
 *)
 
 section \<open>Kildall's Algorithm \label{sec:Kildall}\<close>
 
 theory Kildall_1
 imports SemilatAlg
 begin
 
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
 primrec merges :: "'s binop \<Rightarrow> (nat \<times> 's) list \<Rightarrow> 's list \<Rightarrow> 's list"
 where
   "merges f []      \<tau>s = \<tau>s"
 | "merges f (p'#ps) \<tau>s = (let (p,\<tau>) = p' in merges f ps (\<tau>s[p := \<tau> \<squnion>\<^bsub>f\<^esub> \<tau>s!p]))"
 
 
 lemmas [simp] = Let_def Semilat.le_iff_plus_unchanged [OF Semilat.intro, symmetric]
 
 
 lemma (in Semilat) nth_merges:
- "\<And>ss. \<lbrakk>p < length ss; ss \<in> list n A; \<forall>(p,t)\<in>set ps. p<n \<and> t\<in>A \<rbrakk> \<Longrightarrow>
+ "\<And>ss. \<lbrakk>p < length ss; ss \<in> nlists n A; \<forall>(p,t)\<in>set ps. p<n \<and> t\<in>A \<rbrakk> \<Longrightarrow>
   (merges f ps ss)!p = map snd [(p',t') \<leftarrow> ps. p'=p] \<Squnion>\<^bsub>f\<^esub> ss!p"
   (is "\<And>ss. \<lbrakk>_; _; ?steptype ps\<rbrakk> \<Longrightarrow> ?P ss ps")
 (*<*)
 proof (induct ps)
   show "\<And>ss. ?P ss []" by simp
 
   fix ss p' ps'
-  assume ss: "ss \<in> list n A"
+  assume ss: "ss \<in> nlists n A"
   assume l:  "p < length ss"
   assume "?steptype (p'#ps')"
   then obtain a b where
     p': "p'=(a,b)" and ab: "a<n" "b\<in>A" and ps': "?steptype ps'"
     by (cases p') auto
-  assume "\<And>ss. p< length ss \<Longrightarrow> ss \<in> list n A \<Longrightarrow> ?steptype ps' \<Longrightarrow> ?P ss ps'"
-  hence IH: "\<And>ss. ss \<in> list n A \<Longrightarrow> p < length ss \<Longrightarrow> ?P ss ps'" using ps' by iprover
+  assume "\<And>ss. p< length ss \<Longrightarrow> ss \<in> nlists n A \<Longrightarrow> ?steptype ps' \<Longrightarrow> ?P ss ps'"
+  hence IH: "\<And>ss. ss \<in> nlists n A \<Longrightarrow> p < length ss \<Longrightarrow> ?P ss ps'" using ps' by iprover
 
   from ss ab
-  have "ss[a := b \<squnion>\<^bsub>f\<^esub> ss!a] \<in> list n A" by (simp add: closedD)
+  have "ss[a := b \<squnion>\<^bsub>f\<^esub> ss!a] \<in> nlists n A" by (simp add: closedD)
   moreover
   with l have "p < length (ss[a := b \<squnion>\<^bsub>f\<^esub> ss!a])" by simp
   ultimately
   have "?P (ss[a := b \<squnion>\<^bsub>f\<^esub> ss!a]) ps'" by (rule IH)
   with p' l
   show "?P ss (p'#ps')" by simp
 qed
 (*>*)
 
 
 (** merges **)
 
 lemma length_merges [simp]:
   "\<And>ss. size(merges f ps ss) = size ss"
 (*<*) by (induct ps, auto) (*>*)
 
 lemma (in Semilat) merges_preserves_type_lemma:
-shows "\<forall>xs. xs \<in> list n A \<longrightarrow> (\<forall>(p,x) \<in> set ps. p<n \<and> x\<in>A)
-         \<longrightarrow> merges f ps xs \<in> list n A"
+shows "\<forall>xs. xs \<in> nlists n A \<longrightarrow> (\<forall>(p,x) \<in> set ps. p<n \<and> x\<in>A)
+         \<longrightarrow> merges f ps xs \<in> nlists n A"
 (*<*)
 apply (insert closedI)
 apply (unfold closed_def)
 apply (induct ps)
  apply simp
 apply clarsimp
 done
 (*>*)
 
 lemma (in Semilat) merges_preserves_type [simp]:
- "\<lbrakk> xs \<in> list n A; \<forall>(p,x) \<in> set ps. p<n \<and> x\<in>A \<rbrakk>
-  \<Longrightarrow> merges f ps xs \<in> list n A"
+ "\<lbrakk> xs \<in> nlists n A; \<forall>(p,x) \<in> set ps. p<n \<and> x\<in>A \<rbrakk>
+  \<Longrightarrow> merges f ps xs \<in> nlists n A"
 by (simp add: merges_preserves_type_lemma)
 
 lemma (in Semilat) list_update_le_listI [rule_format]:
   "set xs \<subseteq> A \<longrightarrow> set ys \<subseteq> A \<longrightarrow> xs [\<sqsubseteq>\<^bsub>r\<^esub>] ys \<longrightarrow> p < size xs \<longrightarrow>  
    x \<sqsubseteq>\<^bsub>r\<^esub> ys!p \<longrightarrow> x\<in>A \<longrightarrow> xs[p := x \<squnion>\<^bsub>f\<^esub> xs!p] [\<sqsubseteq>\<^bsub>r\<^esub>] ys"
 (*<*)
   apply (insert semilat)
   apply (simp only: Listn.le_def lesub_def semilat_def)
   apply (simp add: list_all2_conv_all_nth nth_list_update)
   done
 (*>*)
 
 lemma (in Semilat) merges_pres_le_ub:
   assumes "set ts \<subseteq> A"  "set ss \<subseteq> A"
     "\<forall>(p,t)\<in>set ps. t \<sqsubseteq>\<^bsub>r\<^esub> ts!p \<and> t \<in> A \<and> p < size ts"  "ss [\<sqsubseteq>\<^bsub>r\<^esub>] ts"
   shows "merges f ps ss [\<sqsubseteq>\<^bsub>r\<^esub>] ts"
 (*<*)
 proof -
   { fix t ts ps
     have
     "\<And>qs. \<lbrakk>set ts \<subseteq> A; \<forall>(p,t)\<in>set ps. t \<sqsubseteq>\<^bsub>r\<^esub> ts!p \<and> t \<in> A \<and> p< size ts \<rbrakk> \<Longrightarrow>
     set qs \<subseteq> set ps  \<longrightarrow> 
     (\<forall>ss. set ss \<subseteq> A \<longrightarrow> ss [\<sqsubseteq>\<^bsub>r\<^esub>] ts \<longrightarrow> merges f qs ss [\<sqsubseteq>\<^bsub>r\<^esub>] ts)"
     apply (induct_tac qs)
      apply simp
     apply (simp (no_asm_simp))
     apply clarify
     apply simp
     apply (erule allE, erule impE, erule_tac [2] mp)
      apply (drule bspec, assumption)
      apply (simp add: closedD)
     apply (drule bspec, assumption)
     apply (simp add: list_update_le_listI)
     done 
   } note this [dest]  
   from assms show ?thesis by blast
 qed
 (*>*)
 
 
 
 
 end
diff --git a/thys/Jinja/DFA/Kildall_2.thy b/thys/Jinja/DFA/Kildall_2.thy
--- a/thys/Jinja/DFA/Kildall_2.thy
+++ b/thys/Jinja/DFA/Kildall_2.thy
@@ -1,288 +1,288 @@
 (*  Title:      HOL/MicroJava/BV/Kildall.thy
     Author:     Tobias Nipkow, Gerwin Klein
     Copyright   2000 TUM
 
 Kildall's algorithm.
 *)
 
 section \<open>Kildall's Algorithm \label{sec:Kildall}\<close>
 
 theory Kildall_2
 imports SemilatAlg Kildall_1
 begin
 
 
 
 primrec propa :: "'s binop \<Rightarrow> (nat \<times> 's) list \<Rightarrow> 's list \<Rightarrow> nat set \<Rightarrow> 's list * nat set"
 where
   "propa f []      \<tau>s w = (\<tau>s,w)"
 | "propa f (q'#qs) \<tau>s w = (let (q,\<tau>) = q';
                              u = \<tau> \<squnion>\<^bsub>f\<^esub> \<tau>s!q;
                              w' = (if u = \<tau>s!q then w else insert q w)
                          in propa f qs (\<tau>s[q := u]) w')"
 
 definition iter :: "'s binop \<Rightarrow> 's step_type \<Rightarrow>
           's list \<Rightarrow> nat set \<Rightarrow> 's list \<times> nat set"
 where
   "iter f step \<tau>s w =
    while (\<lambda>(\<tau>s,w). w \<noteq> {})
          (\<lambda>(\<tau>s,w). let p = SOME p. p \<in> w
                    in propa f (step p (\<tau>s!p)) \<tau>s (w-{p}))
          (\<tau>s,w)"
 
 definition unstables :: "'s ord \<Rightarrow> 's step_type \<Rightarrow> 's list \<Rightarrow> nat set"
 where
   "unstables r step \<tau>s = {p. p < size \<tau>s \<and> \<not>stable r step \<tau>s p}"
 
 definition kildall :: "'s ord \<Rightarrow> 's binop \<Rightarrow> 's step_type \<Rightarrow> 's list \<Rightarrow> 's list"
 where
   "kildall r f step \<tau>s = fst(iter f step \<tau>s (unstables r step \<tau>s))"
 
 
 (** propa **)
 lemma (in Semilat) merges_incr_lemma:
- "\<forall>xs. xs \<in> list n A \<longrightarrow> (\<forall>(p,x)\<in>set ps. p<size xs \<and> x \<in> A) \<longrightarrow> xs [\<sqsubseteq>\<^bsub>r\<^esub>] merges f ps xs"
+ "\<forall>xs. xs \<in> nlists n A \<longrightarrow> (\<forall>(p,x)\<in>set ps. p<size xs \<and> x \<in> A) \<longrightarrow> xs [\<sqsubseteq>\<^bsub>r\<^esub>] merges f ps xs"
   apply (induct ps)
    apply simp
    apply(insert orderI)
    apply (fastforce intro:le_list_refl')  
   apply simp
   apply clarify
   apply (rule order_trans)
        defer
        apply (erule list_update_incr)
         apply simp+     
   done       
 
 (*>*)
 
 lemma (in Semilat) merges_incr:
- "\<lbrakk> xs \<in> list n A; \<forall>(p,x)\<in>set ps. p<size xs \<and> x \<in> A \<rbrakk> 
+ "\<lbrakk> xs \<in> nlists n A; \<forall>(p,x)\<in>set ps. p<size xs \<and> x \<in> A \<rbrakk> 
   \<Longrightarrow> xs [\<sqsubseteq>\<^bsub>r\<^esub>] merges f ps xs"
   by (simp add: merges_incr_lemma)
 
 
 lemma (in Semilat) merges_same_conv [rule_format]:
- "(\<forall>xs. xs \<in> list n A \<longrightarrow> (\<forall>(p,x)\<in>set ps. p<size xs \<and> x\<in>A) \<longrightarrow> 
+ "(\<forall>xs. xs \<in> nlists n A \<longrightarrow> (\<forall>(p,x)\<in>set ps. p<size xs \<and> x\<in>A) \<longrightarrow> 
      (merges f ps xs = xs) = (\<forall>(p,x)\<in>set ps. x \<sqsubseteq>\<^bsub>r\<^esub> xs!p))"
 (*<*)
   apply (induct_tac ps)
    apply simp
   apply clarsimp
   apply (rename_tac p x ps xs)
   apply (rule iffI)
    apply (rule context_conjI)
     apply (subgoal_tac "xs[p := x \<squnion>\<^bsub>f\<^esub> xs!p] [\<sqsubseteq>\<^bsub>r\<^esub>] xs")
      apply (fastforce dest!: le_listD)  \<comment>\<open>apply (force dest!: le_listD simp add: nth_list_update) \<close>
     apply (erule subst, rule merges_incr)
-       apply (blast intro!: listE_set intro: closedD listE_length [THEN nth_in])
+       apply (blast intro!: nlistsE_set intro: closedD nlistsE_length [THEN nth_in])
       apply clarify
       apply (rule conjI)
        apply simp
        apply (blast dest: boundedD)
       apply blast
    apply clarify
    apply (erule allE)
    apply (erule impE)
     apply assumption
    apply (drule bspec)
     apply assumption
    apply (simp add: le_iff_plus_unchanged [THEN iffD1] list_update_same_conv [THEN iffD2])
    apply blast
   apply clarify 
   apply (simp add: le_iff_plus_unchanged [THEN iffD1] list_update_same_conv [THEN iffD2])
   done
 (*>*)
 
 lemma decomp_propa:
   "\<And>ss w. (\<forall>(q,t)\<in>set qs. q < size ss) \<Longrightarrow> 
    propa f qs ss w = 
    (merges f qs ss, {q. \<exists>t.(q,t)\<in>set qs \<and> t \<squnion>\<^bsub>f\<^esub> ss!q \<noteq> ss!q} \<union> w)"
 (*<*)
   apply (induct qs)
    apply simp   
   apply (simp (no_asm))
   apply clarify  
   apply simp
   apply (rule conjI) 
    apply blast
   apply (simp add: nth_list_update)
   apply blast
   done 
 (*>*)
 
 lemma (in Semilat) stable_pres_lemma:
 shows "\<lbrakk>pres_type step n A; bounded step n; 
-     ss \<in> list n A; p \<in> w; \<forall>q\<in>w. q < n; 
+     ss \<in> nlists n A; p \<in> w; \<forall>q\<in>w. q < n; 
      \<forall>q. q < n \<longrightarrow> q \<notin> w \<longrightarrow> stable r step ss q; q < n; 
      \<forall>s'. (q,s') \<in> set (step p (ss!p)) \<longrightarrow> s' \<squnion>\<^bsub>f\<^esub> ss!q = ss!q; 
      q \<notin> w \<or> q = p \<rbrakk> 
   \<Longrightarrow> stable r step (merges f (step p (ss!p)) ss) q"
 (*<*)
   apply (unfold stable_def)
   apply (subgoal_tac "\<forall>s'. (q,s') \<in> set (step p (ss!p)) \<longrightarrow> s' : A")
    prefer 2
    apply clarify
    apply (erule pres_typeD)
     prefer 3 apply assumption
-    apply (rule listE_nth_in)
+    apply (rule nlistsE_nth_in)
      apply assumption
     apply simp
    apply simp
   apply simp
   apply clarify
   apply (subst nth_merges)
        apply simp
        apply (blast dest: boundedD)
       apply assumption
      apply clarify
      apply (rule conjI)
       apply (blast dest: boundedD)
      apply (erule pres_typeD)
        prefer 3 apply assumption
       apply simp
      apply simp
 apply(subgoal_tac "q < length ss")
 prefer 2 apply simp
   apply (frule nth_merges [of q _ _ "step p (ss!p)"]) (* fixme: why does method subst not work?? *)
 apply assumption
   apply clarify
   apply (rule conjI)
    apply (blast dest: boundedD)
   apply (erule pres_typeD)
      prefer 3 apply assumption
     apply simp
    apply simp
   apply (drule_tac P = "\<lambda>x. (a, b) \<in> set (step q x)" in subst)
    apply assumption
 
  apply (simp add: plusplus_empty)
  apply (cases "q \<in> w")
   apply simp
   apply (rule ub1')
      apply (rule Semilat.intro)
      apply (rule semilat)
     apply clarify
     apply (rule pres_typeD)
        apply assumption
       prefer 3 apply assumption
-     apply (blast intro: listE_nth_in dest: boundedD)
+     apply (blast intro: nlistsE_nth_in dest: boundedD)
     apply (blast intro: pres_typeD dest: boundedD)
-   apply (blast intro: listE_nth_in dest: boundedD)
+   apply (blast intro: nlistsE_nth_in dest: boundedD)
   apply assumption
 
  apply simp
   apply (erule allE, erule impE, assumption, erule impE, assumption) 
   apply (rule order_trans)    
   apply fastforce
        defer     
        apply (rule pp_ub2)
         apply simp        
         apply clarify
         apply simp
         apply (rule pres_typeD)
            apply assumption
           prefer 3 
           apply assumption
-         apply (blast intro: listE_nth_in)
+         apply (blast intro: nlistsE_nth_in)
         apply (blast)
-       apply (blast intro: listE_nth_in dest: boundedD)
+       apply (blast intro: nlistsE_nth_in dest: boundedD)
      prefer 4
   apply fastforce     
-    apply (blast intro: listE_nth_in dest: pres_typeD)
-   apply (blast intro: listE_nth_in dest: boundedD)
+    apply (blast intro: nlistsE_nth_in dest: pres_typeD)
+   apply (blast intro: nlistsE_nth_in dest: boundedD)
   apply(subgoal_tac "\<forall>(q,t) \<in> set (step p (ss!p)). q < n \<and> t \<in> A")
 
-   apply (subgoal_tac "merges f (step p (ss!p)) ss \<in> list n A")
+   apply (subgoal_tac "merges f (step p (ss!p)) ss \<in> nlists n A")
   defer
     apply (blast dest:merges_preserves_type)
    defer
    apply (subgoal_tac "a < n")
   defer
-    apply (blast intro: listE_nth_in  boundedD )
+    apply (blast intro: nlistsE_nth_in  boundedD )
    defer
   apply (subgoal_tac "merges f (step p (ss ! p)) ss ! a = 
       map snd (filter (\<lambda>(p', t'). p' = a) (step p (ss ! p))) \<Squnion>\<^bsub>f\<^esub> ss ! a")
-    apply (fastforce  dest: listE_nth_in ) (* slow *)
+    apply (fastforce  dest: nlistsE_nth_in ) (* slow *)
   apply (subgoal_tac "a < length ss")
     apply (fastforce dest:nth_merges)
    apply simp
   apply (intro strip)
   apply auto
   defer
    apply (auto intro:boundedD)
-  apply (fastforce intro: listE_nth_in dest:pres_typeD)
+  apply (fastforce intro: nlistsE_nth_in dest:pres_typeD)
   done
 (*>*)
 
 
 lemma (in Semilat) merges_bounded_lemma:
  "\<lbrakk> mono r step n A; bounded step n; pres_type step n A; 
-    \<forall>(p',s') \<in> set (step p (ss!p)). s' \<in> A; ss \<in> list n A; ts \<in> list n A; p < n; 
+    \<forall>(p',s') \<in> set (step p (ss!p)). s' \<in> A; ss \<in> nlists n A; ts \<in> nlists n A; p < n; 
     ss [\<sqsubseteq>\<^sub>r] ts; \<forall>p. p < n \<longrightarrow> stable r step ts p \<rbrakk> 
   \<Longrightarrow> merges f (step p (ss!p)) ss [\<sqsubseteq>\<^sub>r] ts" 
 (*<*)
   apply (unfold stable_def)
   apply (rule merges_pres_le_ub)
      apply simp
     apply simp
    prefer 2 apply assumption
 
   apply clarsimp
   apply (drule boundedD, assumption+)
   apply (erule allE, erule impE, assumption)
   apply (drule bspec, assumption)
   apply simp
 
   apply (drule monoD [of _ _ _ _ p "ss!p"  "ts!p"])
      apply assumption
     apply simp
    apply (simp add: le_listD)
   
   apply (drule lesub_step_typeD, assumption) 
   apply clarify
   apply (drule bspec, assumption)
   apply simp
 
   apply (rule order_trans)
        apply fastforce
       apply simp
      apply simp
     apply simp
    apply (auto intro:boundedD)
 
-  apply (blast intro: listE_nth_in dest:pres_typeD)
+  apply (blast intro: nlistsE_nth_in dest:pres_typeD)
   done
 (*>*)
 
 
 
 (** iter **)
 lemma termination_lemma: assumes "Semilat A r f"
-shows "\<lbrakk> ss \<in> list n A; \<forall>(q,t)\<in>set qs. q<n \<and> t\<in>A; p\<in>w \<rbrakk> \<Longrightarrow> 
+shows "\<lbrakk> ss \<in> nlists n A; \<forall>(q,t)\<in>set qs. q<n \<and> t\<in>A; p\<in>w \<rbrakk> \<Longrightarrow> 
       ss [\<sqsubset>\<^sub>r] merges f qs ss \<or> 
   merges f qs ss = ss \<and> {q. \<exists>t. (q,t)\<in>set qs \<and> t \<squnion>\<^bsub>f\<^esub> ss!q \<noteq> ss!q} \<union> (w-{p}) \<subset> w"
 (*<*) (is "PROP ?P")
 proof -
   interpret Semilat A r f by fact
   show "PROP ?P"
   apply(insert semilat)
     apply (unfold lesssub_def)
     apply (simp (no_asm_simp) add: merges_incr)
     apply (rule impI)
     apply (rule merges_same_conv [THEN iffD1, elim_format]) 
     apply assumption+
       defer
       apply (rule sym, assumption)
      defer apply simp
      apply (subgoal_tac "\<forall>q t. \<not>((q, t) \<in> set qs \<and> t \<squnion>\<^bsub>f\<^esub> ss ! q \<noteq> ss ! q)")
      apply (blast intro!: psubsetI elim: equalityE)
      apply clarsimp
      apply (drule bspec, assumption) 
      apply (drule bspec, assumption)
      apply clarsimp
     done 
 qed
 (*>*)
 
 end
diff --git a/thys/Jinja/DFA/LBVCorrect.thy b/thys/Jinja/DFA/LBVCorrect.thy
--- a/thys/Jinja/DFA/LBVCorrect.thy
+++ b/thys/Jinja/DFA/LBVCorrect.thy
@@ -1,221 +1,221 @@
 (*
     Author:     Gerwin Klein
     Copyright   1999 Technische Universitaet Muenchen
 *)
 
 section \<open>Correctness of the LBV\<close>
 
 theory LBVCorrect
 imports LBVSpec Typing_Framework_1
 begin
 
 locale lbvs = lbv +
   fixes s\<^sub>0  :: 'a
   fixes c   :: "'a list"
   fixes ins :: "'b list"
   fixes \<tau>s  :: "'a list"
   defines phi_def:
   "\<tau>s \<equiv> map (\<lambda>pc. if c!pc = \<bottom> then wtl (take pc ins) c 0 s\<^sub>0 else c!pc) 
        [0..<size ins]"
 
   assumes bounded: "bounded step (size ins)"
   assumes cert: "cert_ok c (size ins) \<top> \<bottom> A"
   assumes pres: "pres_type step (size ins) A"
 
 lemma (in lbvs) phi_None [intro?]:
   "\<lbrakk> pc < size ins; c!pc = \<bottom> \<rbrakk> \<Longrightarrow> \<tau>s!pc = wtl (take pc ins) c 0 s\<^sub>0"
 (*<*) by (simp add: phi_def) (*>*)
 
 lemma (in lbvs) phi_Some [intro?]:
   "\<lbrakk> pc < size ins; c!pc \<noteq> \<bottom> \<rbrakk> \<Longrightarrow> \<tau>s!pc = c!pc"
 (*<*) by (simp add: phi_def) (*>*)
 
 lemma (in lbvs) phi_len [simp]: "size \<tau>s = size ins"
 (*<*) by (simp add: phi_def) (*>*)
 
 lemma (in lbvs) wtl_suc_pc:
   assumes all: "wtl ins c 0 s\<^sub>0 \<noteq> \<top>" 
   assumes pc:  "pc+1 < size ins"
   assumes sA: "s\<^sub>0 \<in> A" 
   shows "wtl (take (pc+1) ins) c 0 s\<^sub>0 \<sqsubseteq>\<^sub>r \<tau>s!(pc+1)"
 (*<*)
 proof -
   from all pc
   have "wtc c (pc+1) (wtl (take (pc+1) ins) c 0 s\<^sub>0) \<noteq> T" by (rule wtl_all)
   with pc show ?thesis using sA pres cert all wtl_pres by (simp add: phi_def wtc split: if_split_asm)
 qed
 (*>*)
 
 lemma (in lbvs) wtl_stable:
   assumes wtl: "wtl ins c 0 s\<^sub>0 \<noteq> \<top>" 
   assumes s\<^sub>0:  "s\<^sub>0 \<in> A" and  pc:  "pc < size ins" 
   shows "stable r step \<tau>s pc"
 (*<*)
 proof (unfold stable_def, clarify)
   fix pc' s' assume step: "(pc',s') \<in> set (step pc (\<tau>s ! pc))" 
                       (is "(pc',s') \<in> set (?step pc)")
   
   from bounded pc step have pc': "pc' < size ins" by (rule boundedD)
 
   have tkpc: "wtl (take pc ins) c 0 s\<^sub>0 \<noteq> \<top>" (is "?s\<^sub>1 \<noteq> _") using wtl by (rule wtl_take)
   have s\<^sub>2: "wtl (take (pc+1) ins) c 0 s\<^sub>0 \<noteq> \<top>" (is "?s\<^sub>2 \<noteq> _") using wtl by (rule wtl_take)
   
   from wtl pc have wt_s\<^sub>1: "wtc c pc ?s\<^sub>1 \<noteq> \<top>" by (rule wtl_all)
 
   have c_Some: "\<forall>pc t. pc < size ins \<longrightarrow> c!pc \<noteq> \<bottom> \<longrightarrow> \<tau>s!pc = c!pc" 
     by (simp add: phi_def)
   have c_None: "c!pc = \<bottom> \<Longrightarrow> \<tau>s!pc = ?s\<^sub>1" using pc ..
 
   from wt_s\<^sub>1 pc c_None c_Some
   have inst: "wtc c pc ?s\<^sub>1  = wti c pc (\<tau>s!pc)"
     by (simp add: wtc split: if_split_asm)
 
   have "?s\<^sub>1 \<in> A" using pres cert s\<^sub>0 wtl pc by (rule wtl_pres)
   with pc c_Some cert c_None
   have "\<tau>s!pc \<in> A" by (cases "c!pc = \<bottom>") (auto dest: cert_okD1)
   with pc pres
   have step_in_A: "snd`set (?step pc) \<subseteq> A" by (auto dest: pres_typeD2)
   then have inA1: "s' \<in> A" using step by auto
 
   show "s' \<sqsubseteq>\<^sub>r \<tau>s!pc'" 
   proof (cases "pc' = pc+1")
     case True
     with pc' cert
     have cert_in_A: "c!(pc+1) \<in> A" by (auto dest: cert_okD1)
     from True pc' have pc1: "pc+1 < size ins" by simp
     with pres cert s\<^sub>0 wtl have inA2: "wtl (take (pc + 1) ins) c 0 s\<^sub>0 \<in> A" by (auto dest:wtl_pres)
 
     have c_None': "c!(pc +1)= \<bottom> \<Longrightarrow> \<tau>s!(pc + 1)= ?s\<^sub>2" using pc1 ..
     have "?s\<^sub>2 \<in> A" using pres cert s\<^sub>0 wtl pc1 by (rule wtl_pres)
     with pc1 c_Some cert c_None'
     have inA3: "\<tau>s!(pc+1) \<in> A" by (cases "c!(pc+1) = \<bottom>") (auto dest: cert_okD1)
 
     from pc1 tkpc have "?s\<^sub>2 = wtc c pc ?s\<^sub>1" by - (rule wtl_Suc)
     with inst 
     have merge: "?s\<^sub>2 = merge c pc (?step pc) (c!(pc+1))" by (simp add: wti)
     also from s\<^sub>2 merge have "\<dots> \<noteq> \<top>" (is "?merge \<noteq> _") by simp
     with cert_in_A step_in_A
     have "?merge = (map snd [(p',t') \<leftarrow> ?step pc. p'=pc+1] \<Squnion>\<^bsub>f\<^esub> c!(pc+1))"
       by (rule merge_not_top_s) 
     finally have "s' \<sqsubseteq>\<^sub>r ?s\<^sub>2" using step_in_A cert_in_A True step 
       by (auto intro: pp_ub1')
     also from wtl pc1 have "?s\<^sub>2 \<sqsubseteq>\<^sub>r \<tau>s!(pc+1)" using s\<^sub>0 by (auto dest: wtl_suc_pc)
     also note True [symmetric]
     finally show ?thesis  using inA1 inA2 inA3 by simp    
   next
     case False
     from wt_s\<^sub>1 inst 
     have "merge c pc (?step pc) (c!(pc+1)) \<noteq> \<top>" by (simp add: wti)
     with step_in_A have "\<forall>(pc', s')\<in>set (?step pc). pc'\<noteq>pc+1 \<longrightarrow> s' \<sqsubseteq>\<^sub>r c!pc'"
       by - (rule merge_not_top)
     with step False  have ok: "s' \<sqsubseteq>\<^sub>r c!pc'" by blast
     moreover from ok have "c!pc' = \<bottom> \<Longrightarrow> s' = \<bottom>" using inA1 by simp
     moreover from c_Some pc'  have "c!pc' \<noteq> \<bottom> \<Longrightarrow> \<tau>s!pc' = c!pc'" by auto
     ultimately show ?thesis by (cases "c!pc' = \<bottom>") auto 
   qed
 qed
 (*>*)
   
 lemma (in lbvs) phi_not_top:
   assumes wtl: "wtl ins c 0 s\<^sub>0 \<noteq> \<top>" and pc:  "pc < size ins"
   shows "\<tau>s!pc \<noteq> \<top>"
 (*<*)
 proof (cases "c!pc = \<bottom>")
   case False with pc
   have "\<tau>s!pc = c!pc" ..
   also from cert pc have "\<dots> \<noteq> \<top>" by (rule cert_okD4)
   finally show ?thesis .
 next
   case True with pc
   have "\<tau>s!pc = wtl (take pc ins) c 0 s\<^sub>0" ..
   also from wtl have "\<dots> \<noteq> \<top>" by (rule wtl_take)
   finally show ?thesis .
 qed
 (*>*)
 
 lemma (in lbvs) phi_in_A:
   assumes wtl: "wtl ins c 0 s\<^sub>0 \<noteq> \<top>" and s\<^sub>0: "s\<^sub>0 \<in> A"
-  shows "\<tau>s \<in> list (size ins) A"
+  shows "\<tau>s \<in> nlists (size ins) A"
 (*<*)
 proof -
   { fix x assume "x \<in> set \<tau>s"
     then obtain xs ys where "\<tau>s = xs @ x # ys" 
       by (auto simp add: in_set_conv_decomp)
     then obtain pc where pc: "pc < size \<tau>s" and x: "\<tau>s!pc = x"
       by (simp add: that [of "size xs"] nth_append)
     
     from pres cert wtl s\<^sub>0 pc 
     have "wtl (take pc ins) c 0 s\<^sub>0 \<in> A" by (auto intro!: wtl_pres)
     moreover
     from pc have "pc < size ins" by simp
     with cert have "c!pc \<in> A" ..
     ultimately
     have "\<tau>s!pc \<in> A" using pc by (simp add: phi_def)
     hence "x \<in> A" using x by simp
   } 
   hence "set \<tau>s \<subseteq> A" ..
-  thus ?thesis by (unfold list_def) simp
+  thus ?thesis by (unfold nlists_def) simp
 qed
 (*>*)
 
 lemma (in lbvs) phi0:
   assumes wtl: "wtl ins c 0 s\<^sub>0 \<noteq> \<top>" and 0: "0 < size ins" and s\<^sub>0: "s\<^sub>0 \<in> A" 
   shows "s\<^sub>0 \<sqsubseteq>\<^sub>r \<tau>s!0"
 (*<*)
 proof (cases "c!0 = \<bottom>")
   case True
   with 0 have "\<tau>s!0 = wtl (take 0 ins) c 0 s\<^sub>0" ..
   moreover have "wtl (take 0 ins) c 0 s\<^sub>0 = s\<^sub>0" by simp
   ultimately have "\<tau>s!0 = s\<^sub>0" by simp
   thus ?thesis using s\<^sub>0 by simp
 next
   case False
   with 0 have "\<tau>s!0 = c!0" ..
   moreover 
   have "wtl (take 1 ins) c 0 s\<^sub>0 \<noteq> \<top>" using wtl by (rule wtl_take)
   with 0 False 
   have "s\<^sub>0 \<sqsubseteq>\<^sub>r c!0" by (auto simp add: neq_Nil_conv wtc split: if_split_asm)
   ultimately
   show ?thesis by simp
 qed
 (*>*)
 
 
 theorem (in lbvs) wtl_sound:
   assumes wtl: "wtl ins c 0 s\<^sub>0 \<noteq> \<top>" and s\<^sub>0: "s\<^sub>0 \<in> A" 
   shows "\<exists>\<tau>s. wt_step r \<top> step \<tau>s"
 (*<*)
 proof -
   have "wt_step r \<top> step \<tau>s"
   proof (unfold wt_step_def, intro strip conjI)
     fix pc assume "pc < size \<tau>s"
     then obtain pc: "pc < size ins" by simp
     with wtl show "\<tau>s!pc \<noteq> \<top>" by (rule phi_not_top)
     from wtl s\<^sub>0 pc show "stable r step \<tau>s pc" by (rule wtl_stable)
   qed
   thus ?thesis ..
 qed
 (*>*)
 
 
 theorem (in lbvs) wtl_sound_strong:
   assumes wtl: "wtl ins c 0 s\<^sub>0 \<noteq> \<top>" 
   assumes s\<^sub>0: "s\<^sub>0 \<in> A" and ins: "0 < size ins"
-  shows "\<exists>\<tau>s \<in> list (size ins) A. wt_step r \<top> step \<tau>s \<and> s\<^sub>0 \<sqsubseteq>\<^sub>r \<tau>s!0"
+  shows "\<exists>\<tau>s \<in> nlists (size ins) A. wt_step r \<top> step \<tau>s \<and> s\<^sub>0 \<sqsubseteq>\<^sub>r \<tau>s!0"
 (*<*)
 proof -
-  have "\<tau>s \<in> list (size ins) A" using wtl s\<^sub>0 by (rule phi_in_A)
+  have "\<tau>s \<in> nlists (size ins) A" using wtl s\<^sub>0 by (rule phi_in_A)
   moreover
   have "wt_step r \<top> step \<tau>s"
   proof (unfold wt_step_def, intro strip conjI)
     fix pc assume "pc < size \<tau>s"
     then obtain pc: "pc < size ins" by simp
     with wtl show "\<tau>s!pc \<noteq> \<top>" by (rule phi_not_top)
     from wtl s\<^sub>0 and pc show "stable r step \<tau>s pc" by (rule wtl_stable)
   qed
   moreover from wtl ins have "s\<^sub>0 \<sqsubseteq>\<^sub>r \<tau>s!0" using s\<^sub>0  by (rule phi0)
   ultimately show ?thesis by fast
 qed
 (*>*)
 
 end
diff --git a/thys/Jinja/DFA/Listn.thy b/thys/Jinja/DFA/Listn.thy
--- a/thys/Jinja/DFA/Listn.thy
+++ b/thys/Jinja/DFA/Listn.thy
@@ -1,710 +1,584 @@
 (*  Title:      HOL/MicroJava/BV/Listn.thy
     Author:     Tobias Nipkow
     Copyright   2000 TUM
 
 Lists of a fixed length.
 *)
 
 section \<open>Fixed Length Lists\<close>
 
 theory Listn
-imports Err
+imports Err "HOL-Library.NList"
 begin
 
-definition list :: "nat \<Rightarrow> 'a set \<Rightarrow> 'a list set"
-where
-  "list n A = {xs. size xs = n \<and> set xs \<subseteq> A}"
-
 definition le :: "'a ord \<Rightarrow> ('a list)ord"
 where
   "le r = list_all2 (\<lambda>x y. x \<sqsubseteq>\<^sub>r y)"
 
 abbreviation
   lesublist :: "'a list \<Rightarrow> 'a ord \<Rightarrow> 'a list \<Rightarrow> bool"  ("(_ /[\<sqsubseteq>\<^bsub>_\<^esub>] _)" [50, 0, 51] 50) where
   "x [\<sqsubseteq>\<^bsub>r\<^esub>] y == x <=_(Listn.le r) y"
 
 abbreviation
   lesssublist :: "'a list \<Rightarrow> 'a ord \<Rightarrow> 'a list \<Rightarrow> bool"  ("(_ /[\<sqsubset>\<^bsub>_\<^esub>] _)" [50, 0, 51] 50) where
   "x [\<sqsubset>\<^bsub>r\<^esub>] y == x <_(Listn.le r) y"
 
 (*<*)
 notation (ASCII)
   lesublist  ("(_ /[<=_] _)" [50, 0, 51] 50) and
   lesssublist  ("(_ /[<_] _)" [50, 0, 51] 50)
 
 abbreviation (input)
   lesublist2 :: "'a list \<Rightarrow> 'a ord \<Rightarrow> 'a list \<Rightarrow> bool"  ("(_ /[\<sqsubseteq>\<^sub>_] _)" [50, 0, 51] 50) where
   "x [\<sqsubseteq>\<^sub>r] y == x [\<sqsubseteq>\<^bsub>r\<^esub>] y"
 
 abbreviation (input)
   lesssublist2 :: "'a list \<Rightarrow> 'a ord \<Rightarrow> 'a list \<Rightarrow> bool"  ("(_ /[\<sqsubset>\<^sub>_] _)" [50, 0, 51] 50) where
   "x [\<sqsubset>\<^sub>r] y == x [\<sqsubset>\<^bsub>r\<^esub>] y"
 (*>*)
 
 abbreviation
   plussublist :: "'a list \<Rightarrow> ('a \<Rightarrow> 'b \<Rightarrow> 'c) \<Rightarrow> 'b list \<Rightarrow> 'c list"
     ("(_ /[\<squnion>\<^bsub>_\<^esub>] _)" [65, 0, 66] 65) where
   "x [\<squnion>\<^bsub>f\<^esub>] y == x \<squnion>\<^bsub>map2 f\<^esub> y"
 
 (*<*)
 notation (ASCII)
   plussublist  ("(_ /[+_] _)" [65, 0, 66] 65)
 
 abbreviation (input)
   plussublist2 :: "'a list \<Rightarrow> ('a \<Rightarrow> 'b \<Rightarrow> 'c) \<Rightarrow> 'b list \<Rightarrow> 'c list"
     ("(_ /[\<squnion>\<^sub>_] _)" [65, 0, 66] 65) where
   "x [\<squnion>\<^sub>f] y == x [\<squnion>\<^bsub>f\<^esub>] y"
 (*>*)
 
 
 primrec coalesce :: "'a err list \<Rightarrow> 'a list err"
 where
   "coalesce [] = OK[]"
 | "coalesce (ex#exs) = Err.sup (#) ex (coalesce exs)"
 
 definition sl :: "nat \<Rightarrow> 'a sl \<Rightarrow> 'a list sl"
 where
-  "sl n = (\<lambda>(A,r,f). (list n A, le r, map2 f))"
+  "sl n = (\<lambda>(A,r,f). (nlists n A, le r, map2 f))"
 
 definition sup :: "('a \<Rightarrow> 'b \<Rightarrow> 'c err) \<Rightarrow> 'a list \<Rightarrow> 'b list \<Rightarrow> 'c list err"
 where
   "sup f = (\<lambda>xs ys. if size xs = size ys then coalesce(xs [\<squnion>\<^bsub>f\<^esub>] ys) else Err)"
 
 definition upto_esl :: "nat \<Rightarrow> 'a esl \<Rightarrow> 'a list esl"
 where
-  "upto_esl m = (\<lambda>(A,r,f). (Union{list n A |n. n \<le> m}, le r, sup f))"
+  "upto_esl m = (\<lambda>(A,r,f). (Union{nlists n A |n. n \<le> m}, le r, sup f))"
 
 
 lemmas [simp] = set_update_subsetI
 
 lemma unfold_lesub_list: "xs [\<sqsubseteq>\<^bsub>r\<^esub>] ys = Listn.le r xs ys"
 (*<*) by (simp add: lesub_def) (*>*)
 
 lemma Nil_le_conv [iff]: "([] [\<sqsubseteq>\<^bsub>r\<^esub>] ys) = (ys = [])"
 (*<*)
 apply (unfold lesub_def Listn.le_def)
 apply simp
 done
 (*>*)
 
 lemma Cons_notle_Nil [iff]: "\<not> x#xs [\<sqsubseteq>\<^bsub>r\<^esub>] []"
 (*<*)
 apply (unfold lesub_def Listn.le_def)
 apply simp
 done
 (*>*)
 
 lemma Cons_le_Cons [iff]: "x#xs [\<sqsubseteq>\<^bsub>r\<^esub>] y#ys = (x \<sqsubseteq>\<^sub>r y \<and> xs [\<sqsubseteq>\<^bsub>r\<^esub>] ys)"
 (*<*)
 by (simp add: lesub_def Listn.le_def)
 (*>*)
 
-
-
-
-
-
-
-
-
 lemma list_update_le_cong:
   "\<lbrakk> i<size xs; xs [\<sqsubseteq>\<^bsub>r\<^esub>] ys; x \<sqsubseteq>\<^sub>r y \<rbrakk> \<Longrightarrow> xs[i:=x] [\<sqsubseteq>\<^bsub>r\<^esub>] ys[i:=y]"
 (*<*)
 apply (unfold unfold_lesub_list)
 apply (unfold Listn.le_def)
 apply (simp add: list_all2_update_cong)
 done
 (*>*)
 
 
 lemma le_listD: "\<lbrakk> xs [\<sqsubseteq>\<^bsub>r\<^esub>] ys; p < size xs \<rbrakk> \<Longrightarrow> xs!p \<sqsubseteq>\<^sub>r ys!p"
 (*<*)
 by (simp add: Listn.le_def lesub_def list_all2_nthD)
 (*>*)
 
 lemma le_list_refl: "\<forall>x. x \<sqsubseteq>\<^sub>r x \<Longrightarrow> xs [\<sqsubseteq>\<^bsub>r\<^esub>] xs"
 (*<*)
 apply (simp add: unfold_lesub_list lesub_def Listn.le_def list_all2_refl)
 done
 (*>*)
 
 
 lemma le_list_trans: 
   assumes ord: "order r A"
-      and xs:  "xs \<in> list n A" and ys: "ys \<in> list n A" and zs: "zs \<in> list n A"
+      and xs:  "xs \<in> nlists n A" and ys: "ys \<in> nlists n A" and zs: "zs \<in> nlists n A"
       and      "xs [\<sqsubseteq>\<^bsub>r\<^esub>] ys" and "ys [\<sqsubseteq>\<^bsub>r\<^esub>] zs"
     shows      "xs [\<sqsubseteq>\<^bsub>r\<^esub>] zs"
 (*<*)
   using assms
 proof (unfold le_def lesssub_def lesub_def)
   assume "list_all2 r xs ys" and "list_all2 r ys zs"
   hence xs_ys_zs:  "\<forall>i < length xs. r (xs!i) (ys!i) \<and> r (ys!i) (zs!i)" 
         and len_xs_zs: "length xs = length zs" by (auto simp add: list_all2_conv_all_nth)
-  from xs ys zs have inA: "\<forall>i<length xs. xs!i \<in> A \<and> ys!i \<in> A \<and> zs!i \<in> A" by (unfold list_def) auto
+  from xs ys zs have inA: "\<forall>i<length xs. xs!i \<in> A \<and> ys!i \<in> A \<and> zs!i \<in> A" by (unfold nlists_def) auto
   
   from ord have "\<forall>x\<in>A. \<forall>y\<in>A. \<forall>z\<in>A. x \<sqsubseteq>\<^sub>r y \<and> y \<sqsubseteq>\<^sub>r z \<longrightarrow> x \<sqsubseteq>\<^sub>r z" by (unfold order_def) blast
   hence "\<forall>x\<in>A. \<forall>y\<in>A. \<forall>z\<in>A. r x y \<and> r y z \<longrightarrow> r x z" by (unfold lesssub_def lesub_def)
   with xs_ys_zs inA have "\<forall>i<length xs. r (xs!i) (zs!i)" by blast
   with len_xs_zs show "list_all2 r xs zs" by (simp add:list_all2_conv_all_nth)
 qed
 (*
   apply (unfold lesssub_def lesub_def)
   apply (unfold Listn.le_def)  
   apply (frule list_all2_trans)
     apply simp
   apply blast
   apply (simp add:list_all2_conv_all_nth)
   apply (intro strip)
   apply (erule order_trans) 
   apply (unfold list_def)
   apply (auto)
 *)
 
 lemma le_list_antisym: 
   assumes ord: "order r A"
-      and xs:  "xs \<in> list n A" and ys: "ys \<in> list n A"
+      and xs:  "xs \<in> nlists n A" and ys: "ys \<in> nlists n A"
       and      "xs [\<sqsubseteq>\<^bsub>r\<^esub>] ys" and "ys [\<sqsubseteq>\<^bsub>r\<^esub>] xs"
     shows      "xs = ys"
 (*<*)
   using assms
 proof (simp add: le_def lesssub_def lesub_def)
   assume "list_all2 r xs ys" and "list_all2 r ys xs"
   hence xs_ys:  "\<forall>i < length xs. r (xs!i) (ys!i) \<and> r (ys!i) (xs!i)" 
         and len_xs_ys: "length xs = length ys" by (auto simp add: list_all2_conv_all_nth)
-  from xs ys have inA: "\<forall>i<length xs. xs!i \<in> A \<and> ys!i \<in> A" by (unfold list_def) auto
+  from xs ys have inA: "\<forall>i<length xs. xs!i \<in> A \<and> ys!i \<in> A" by (unfold nlists_def) auto
   
   from ord have "\<forall>x\<in>A. \<forall>y\<in>A. x \<sqsubseteq>\<^sub>r y \<and> y \<sqsubseteq>\<^sub>r x \<longrightarrow> x = y" by (unfold order_def) blast
   hence "\<forall>x\<in>A. \<forall>y\<in>A. r x y \<and> r y x \<longrightarrow> x = y" by (unfold lesssub_def lesub_def)
   with xs_ys inA have "\<forall>i<length xs. xs!i = ys!i" by blast
   with len_xs_ys show "xs = ys" by (simp add:list_eq_iff_nth_eq)
 qed
 (*
 apply (unfold unfold_lesub_list)
   apply (unfold Listn.le_def)
   apply (auto simp add: list_eq_iff_nth_eq list_def list_all2_conv_all_nth)
   apply (rule order_antisym)     
  apply (auto simp add: list_def)
 done
 *)
 (*>*)
 
-lemma listE_set [simp]: "xs \<in> list n A \<Longrightarrow> set xs \<subseteq> A"
-(*<*)
-apply (unfold list_def)
-apply blast
-done
-(*>*)
-
-
 lemma nth_in [rule_format, simp]:
   "\<forall>i n. size xs = n \<longrightarrow> set xs \<subseteq> A \<longrightarrow> i < n \<longrightarrow> (xs!i) \<in> A"
 (*<*)
 apply (induct "xs")
  apply simp
 apply (simp add: nth_Cons split: nat.split)
 done
 (*>*)
 
-(* FIXME: remove simp *)
-lemma listE_length [simp]: "xs \<in> list n A \<Longrightarrow> size xs = n"
-(*<*)
-apply (unfold list_def)
-apply blast
-done
-(*>*)
-
-lemma listE_nth_in: "\<lbrakk> xs \<in> list n A; i < n \<rbrakk> \<Longrightarrow> xs!i \<in> A"
-(*<*) by auto (*>*)
-
-
-lemma le_list_refl': "order r A \<Longrightarrow> xs \<in> list n A \<Longrightarrow> xs \<sqsubseteq>\<^bsub>Listn.le r\<^esub> xs"  
+lemma le_list_refl': "order r A \<Longrightarrow> xs \<in> nlists n A \<Longrightarrow> xs \<sqsubseteq>\<^bsub>Listn.le r\<^esub> xs"  
   apply (unfold le_def lesssub_def lesub_def list_all2_conv_all_nth)
   apply auto  
   apply (subgoal_tac "xs ! i \<in> A")  
    apply (subgoal_tac "(xs ! i) \<sqsubseteq>\<^sub>r (xs ! i)")
     apply (simp only: lesssub_def lesub_def)
-   apply (fastforce dest: listE_nth_in)
+   apply (fastforce dest: nlistsE_nth_in)
    apply (fastforce dest: order_refl)
   done
 
-lemma order_listI [simp, intro!]: "order r A \<Longrightarrow> order(Listn.le r) (list n A)"  
+lemma order_listI [simp, intro!]: "order r A \<Longrightarrow> order(Listn.le r) (nlists n A)"  
 (*<*)
 proof-
   assume ord: "order r A"
   let ?r = "Listn.le r"
-  let ?A = "list n A" 
+  let ?A = "nlists n A" 
   have "\<forall>x\<in>?A. x \<sqsubseteq>\<^bsub>?r\<^esub> x" using ord le_list_refl' by auto
   moreover have "\<forall>x\<in>?A. \<forall>y\<in>?A. x \<sqsubseteq>\<^bsub>?r\<^esub> y \<and> y \<sqsubseteq>\<^bsub>?r\<^esub>  x \<longrightarrow> x=y" using ord le_list_antisym by auto
   moreover have "\<forall>x\<in>?A. \<forall>y\<in>?A. \<forall>z\<in>?A. x \<sqsubseteq>\<^bsub>?r\<^esub>y \<and> y \<sqsubseteq>\<^bsub>?r\<^esub> z \<longrightarrow> x \<sqsubseteq>\<^bsub>?r\<^esub> z" using ord le_list_trans by auto
   ultimately show ?thesis by (auto simp only: order_def)
 qed
 (*>*)
 
-lemma le_list_refl2': "order r A \<Longrightarrow> xs \<in> (\<Union>{list n A |n. n \<le> mxs})\<Longrightarrow> xs \<sqsubseteq>\<^bsub>Listn.le r\<^esub> xs"  
+lemma le_list_refl2': "order r A \<Longrightarrow> xs \<in> (\<Union>{nlists n A |n. n \<le> mxs})\<Longrightarrow> xs \<sqsubseteq>\<^bsub>Listn.le r\<^esub> xs"  
   by (auto simp add:le_list_refl')
 lemma le_list_trans2: 
   assumes "order r A"
-      and "xs \<in> (\<Union>{list n A |n. n \<le> mxs})" and "ys \<in>(\<Union>{list n A |n. n \<le> mxs})" and "zs \<in>(\<Union>{list n A |n. n \<le> mxs})"
+      and "xs \<in> (\<Union>{nlists n A |n. n \<le> mxs})" and "ys \<in>(\<Union>{nlists n A |n. n \<le> mxs})" and "zs \<in>(\<Union>{nlists n A |n. n \<le> mxs})"
       and "xs [\<sqsubseteq>\<^bsub>r\<^esub>] ys" and "ys [\<sqsubseteq>\<^bsub>r\<^esub>] zs"
     shows "xs [\<sqsubseteq>\<^bsub>r\<^esub>] zs"
 (*<*)using assms
-proof(auto simp only:list_def le_def lesssub_def lesub_def)
+proof(auto simp only:nlists_def le_def lesssub_def lesub_def)
   assume xA: "set xs \<subseteq> A" and "length xs \<le> mxs " and " length ys \<le> mxs "
      and yA: "set ys \<subseteq> A" and len_zs: "length zs \<le> mxs" 
      and zA: "set zs \<subseteq> A" and xy: "list_all2 r xs ys" and yz: "list_all2 r ys zs"
      and ord: "order r A" 
   from xy yz have xs_ys: "length xs = length ys" and ys_zs: "length ys = length zs" by (auto simp add:list_all2_conv_all_nth)
   from ord have "\<forall>x\<in>A.  \<forall>y\<in>A. \<forall>z\<in>A. x \<sqsubseteq>\<^sub>r y \<and> y \<sqsubseteq>\<^sub>r z \<longrightarrow> x \<sqsubseteq>\<^sub>r z" by (unfold order_def) blast
   hence trans: "\<forall>x\<in>A. \<forall>y\<in>A. \<forall>z\<in>A. r x y \<and> r y z \<longrightarrow> r x z" by (simp only:lesssub_def lesub_def)
 
   from xA yA zA have x_inA: "\<forall>i<length xs. xs!i \<in> A"
                  and y_inA: "\<forall>i<length xs. ys!i \<in> A" 
                  and z_inA: "\<forall>i<length xs. zs!i \<in> A"  using xs_ys ys_zs  by auto
   
   from xy yz have "\<forall>i < length xs. r (xs!i) (ys!i)" 
               and "\<forall>i < length ys. r (ys!i) (zs!i)" by (auto simp add:list_all2_conv_all_nth)
   hence "\<forall>i < length xs. r (xs!i) (ys!i) \<and> r (ys!i) (zs!i)" using xs_ys ys_zs by auto
 
   with x_inA y_inA z_inA
   have "\<forall>i<length xs. r (xs!i)  (zs!i)" using trans  xs_ys ys_zs by blast
   thus "list_all2 r xs zs" using xs_ys ys_zs by (simp add:list_all2_conv_all_nth)
 qed
 
 
 lemma le_list_antisym2: 
   assumes "order r A"
-      and "xs \<in>(\<Union>{list n A |n. n \<le> mxs})" and "ys \<in>(\<Union>{list n A |n. n \<le> mxs})" 
+      and "xs \<in>(\<Union>{nlists n A |n. n \<le> mxs})" and "ys \<in>(\<Union>{nlists n A |n. n \<le> mxs})" 
       and "xs [\<sqsubseteq>\<^bsub>r\<^esub>] ys" and "ys [\<sqsubseteq>\<^bsub>r\<^esub>] xs"
     shows " xs = ys"
 (*<*)
   using assms
-proof(auto simp only:list_def le_def lesssub_def lesub_def)
+proof(auto simp only:nlists_def le_def lesssub_def lesub_def)
   assume xA: "set xs \<subseteq> A" and len_ys: "length ys \<le> mxs" and len_xs: "length xs \<le> mxs" 
      and yA: "set ys \<subseteq> A" and xy: "list_all2 r xs ys" and yx: "list_all2 r ys xs" 
      and ord: "order r A"
   from xy have len_eq_xs_ys: "length xs = length ys" by (simp add:list_all2_conv_all_nth)
   
   from ord have antisymm:"\<forall>x\<in>A. \<forall>y\<in>A. r x y \<and> r y x\<longrightarrow> x=y " by (auto simp only:lesssub_def lesub_def order_def)
   from xA yA have x_inA: "\<forall>i<length xs. xs!i \<in> A" and y_inA: "\<forall>i<length ys. ys!i \<in> A" by auto
   from xy yx have "\<forall>i < length xs. r (xs!i) (ys!i)" and "\<forall>i < length ys. r (ys!i) (xs!i)" by (auto simp add:list_all2_conv_all_nth)
   with x_inA y_inA
   have "\<forall>i<length xs. xs!i = ys!i" using antisymm len_eq_xs_ys by auto
   then show "xs = ys" using len_eq_xs_ys by (simp add:list_eq_iff_nth_eq)
 qed
 (*<*)
 
 
-lemma order_listI2[intro!] : "order r A \<Longrightarrow> order(Listn.le r) (\<Union>{list n A |n. n \<le> mxs})"
+lemma order_listI2[intro!] : "order r A \<Longrightarrow> order(Listn.le r) (\<Union>{nlists n A |n. n \<le> mxs})"
 (*<*)
 proof-
   assume ord: "order r A"  
   let ?r = "Listn.le r"
-  let ?A = "(\<Union>{list n A |n. n \<le> mxs})" 
+  let ?A = "(\<Union>{nlists n A |n. n \<le> mxs})" 
   have "\<forall>x\<in>?A. x \<sqsubseteq>\<^bsub>?r\<^esub> x" using ord le_list_refl2' by auto  \<comment>\<open> use order_listI \<close>
   moreover have "\<forall>x\<in>?A. \<forall>y\<in>?A. x \<sqsubseteq>\<^bsub>?r\<^esub> y \<and> y \<sqsubseteq>\<^bsub>?r\<^esub>  x \<longrightarrow> x=y" using ord le_list_antisym2 by blast
   moreover have "\<forall>x\<in>?A.  \<forall>y\<in>?A. \<forall>z\<in>?A. x \<sqsubseteq>\<^bsub>?r\<^esub>y \<and> y \<sqsubseteq>\<^bsub>?r\<^esub> z \<longrightarrow> x \<sqsubseteq>\<^bsub>?r\<^esub> z" using ord le_list_trans2 by blast
   ultimately show ?thesis by (auto simp only: order_def)
 qed
 
 
 lemma lesub_list_impl_same_size [simp]: "xs [\<sqsubseteq>\<^bsub>r\<^esub>] ys \<Longrightarrow> size ys = size xs"
 (*<*)
 apply (unfold Listn.le_def lesub_def)
 apply (simp add: list_all2_lengthD)
 done
 (*>*)
 
 lemma lesssub_lengthD: "xs [\<sqsubset>\<^sub>r] ys \<Longrightarrow> size ys = size xs"
 (*<*)
 apply (unfold lesssub_def)
 apply auto
 done
 (*>*)
 
 
 lemma le_list_appendI: "a [\<sqsubseteq>\<^bsub>r\<^esub>] b \<Longrightarrow> c [\<sqsubseteq>\<^bsub>r\<^esub>] d \<Longrightarrow> a@c [\<sqsubseteq>\<^bsub>r\<^esub>] b@d"
 (*<*)
 apply (unfold Listn.le_def lesub_def)
 apply (rule list_all2_appendI, assumption+)
 done
 (*>*)
 
 lemma le_listI:
   assumes "length a = length b"
   assumes "\<And>n. n < length a \<Longrightarrow> a!n \<sqsubseteq>\<^sub>r b!n"
   shows "a [\<sqsubseteq>\<^bsub>r\<^esub>] b"
 (*<*)
 proof -
   from assms have "list_all2 r a b"
     by (simp add: list_all2_all_nthI lesub_def)
   then show ?thesis by (simp add: Listn.le_def lesub_def)
 qed
 (*>*)
 
-lemma listI: "\<lbrakk> size xs = n; set xs \<subseteq> A \<rbrakk> \<Longrightarrow> xs \<in> list n A"
-(*<*)
-apply (unfold list_def)
-apply blast
-done
-(*>*)
-
-lemma less_lengthI: "\<lbrakk> xs \<in> list n A; p < n \<rbrakk> \<Longrightarrow> p < size xs"
-(*<*) by simp (*>*)
-
-lemma list_0 [simp]: "list 0 A = {[]}"
-(*<*)
-apply (unfold list_def)
-apply auto
-done
-(*>*)
-
-lemma in_list_Suc_iff:
-  "(xs \<in> list (Suc n) A) = (\<exists>y\<in>A. \<exists>ys \<in> list n A. xs = y#ys)"
-(*<*)
-apply (unfold list_def)
-apply (case_tac "xs")
-apply auto
-done
-(*>*)
-
-
-lemma Cons_in_list_Suc [iff]:
-  "(x#xs \<in> list (Suc n) A) = (x\<in>A \<and> xs \<in> list n A)"
-(*<*)
-apply (simp add: in_list_Suc_iff)
-done
-(*>*)
-
-lemma list_not_empty:
-  "\<exists>a. a\<in>A \<Longrightarrow> \<exists>xs. xs \<in> list n A"
-(*<*)
-apply (induct "n")
- apply simp
-apply (simp add: in_list_Suc_iff)
-apply blast
-done
-(*>*)
-
-lemma listn_Cons_Suc [elim!]:
-  "l#xs \<in> list n A \<Longrightarrow> (\<And>n'. n = Suc n' \<Longrightarrow> l \<in> A \<Longrightarrow> xs \<in> list n' A \<Longrightarrow> P) \<Longrightarrow> P"
-(*<*) by (cases n) auto (*>*)
-
-lemma listn_appendE [elim!]:
-  "a@b \<in> list n A \<Longrightarrow> (\<And>n1 n2. n=n1+n2 \<Longrightarrow> a \<in> list n1 A \<Longrightarrow> b \<in> list n2 A \<Longrightarrow> P) \<Longrightarrow> P"
-(*<*)
-proof -
-  have "\<And>n. a@b \<in> list n A \<Longrightarrow> \<exists>n1 n2. n=n1+n2 \<and> a \<in> list n1 A \<and> b \<in> list n2 A"
-    (is "\<And>n. ?list a n \<Longrightarrow> \<exists>n1 n2. ?P a n n1 n2")
-  proof (induct a)
-    fix n assume "?list [] n"
-    hence "?P [] n 0 n" by simp
-    thus "\<exists>n1 n2. ?P [] n n1 n2" by fast
-  next
-    fix n l ls
-    assume "?list (l#ls) n"
-    then obtain n' where n: "n = Suc n'" "l \<in> A" and n': "ls@b \<in> list n' A" by fastforce
-    assume "\<And>n. ls @ b \<in> list n A \<Longrightarrow> \<exists>n1 n2. n = n1 + n2 \<and> ls \<in> list n1 A \<and> b \<in> list n2 A"
-    from this and n' have "\<exists>n1 n2. n' = n1 + n2 \<and> ls \<in> list n1 A \<and> b \<in> list n2 A" .
-    then obtain n1 n2 where "n' = n1 + n2" "ls \<in> list n1 A" "b \<in> list n2 A" by fast
-    with n have "?P (l#ls) n (n1+1) n2" by simp
-    thus "\<exists>n1 n2. ?P (l#ls) n n1 n2" by fastforce
-  qed
-  moreover
-  assume "a@b \<in> list n A" "\<And>n1 n2. n=n1+n2 \<Longrightarrow> a \<in> list n1 A \<Longrightarrow> b \<in> list n2 A \<Longrightarrow> P"
-  ultimately
-  show ?thesis by blast
-qed
-(*>*)
-
-
-lemma listt_update_in_list [simp, intro!]:
-  "\<lbrakk> xs \<in> list n A; x\<in>A \<rbrakk> \<Longrightarrow> xs[i := x] \<in> list n A"
-(*<*)
-apply (unfold list_def)
-apply simp
-done
-(*>*)
-
-lemma list_appendI [intro?]:
-  "\<lbrakk> a \<in> list n A; b \<in> list m A \<rbrakk> \<Longrightarrow> a @ b \<in> list (n+m) A"
-(*<*) by (unfold list_def) auto (*>*)
-
-lemma list_map [simp]: "(map f xs \<in> list (size xs) A) = (f ` set xs \<subseteq> A)"
-(*<*) by (unfold list_def) simp (*>*)
-
-lemma list_replicateI [intro]: "x \<in> A \<Longrightarrow> replicate n x \<in> list n A"
-(*<*) by (induct n) auto (*>*)
-
 lemma plus_list_Nil [simp]: "[] [\<squnion>\<^bsub>f\<^esub>] xs = []"
 (*<*)
 apply (unfold plussub_def)
 apply simp
 done
 (*>*)
 
 lemma plus_list_Cons [simp]:
   "(x#xs) [\<squnion>\<^bsub>f\<^esub>] ys = (case ys of [] \<Rightarrow> [] | y#ys \<Rightarrow> (x \<squnion>\<^sub>f y)#(xs [\<squnion>\<^bsub>f\<^esub>] ys))"
 (*<*) by (simp add: plussub_def split: list.split) (*>*)
 
 lemma length_plus_list [rule_format, simp]:
   "\<forall>ys. size(xs [\<squnion>\<^bsub>f\<^esub>] ys) = min(size xs) (size ys)"
 (*<*)
 apply (induct xs)
  apply simp
 apply clarify
 apply (simp (no_asm_simp) split: list.split)
 done
 (*>*)
 
 lemma nth_plus_list [rule_format, simp]:
   "\<forall>xs ys i. size xs = n \<longrightarrow> size ys = n \<longrightarrow> i<n \<longrightarrow> (xs [\<squnion>\<^bsub>f\<^esub>] ys)!i = (xs!i) \<squnion>\<^sub>f (ys!i)"
 (*<*)
 apply (induct n)
  apply simp
 apply clarify
 apply (case_tac xs)
  apply simp
 apply (force simp add: nth_Cons split: list.split nat.split)
 done
 (*>*)
 
 
 lemma (in Semilat) plus_list_ub1 [rule_format]:
  "\<lbrakk> set xs \<subseteq> A; set ys \<subseteq> A; size xs = size ys \<rbrakk>
   \<Longrightarrow> xs [\<sqsubseteq>\<^bsub>r\<^esub>] xs [\<squnion>\<^bsub>f\<^esub>] ys"
 (*<*)
 apply (unfold unfold_lesub_list)
 apply (simp add: Listn.le_def list_all2_conv_all_nth)
 done
 (*>*)
 
 lemma (in Semilat) plus_list_ub2:
  "\<lbrakk>set xs \<subseteq> A; set ys \<subseteq> A; size xs = size ys \<rbrakk> \<Longrightarrow> ys [\<sqsubseteq>\<^bsub>r\<^esub>] xs [\<squnion>\<^bsub>f\<^esub>] ys"
 (*<*)
 apply (unfold unfold_lesub_list)
 apply (simp add: Listn.le_def list_all2_conv_all_nth)
 done
 (*>*)
 
 lemma (in Semilat) plus_list_lub [rule_format]:
 shows "\<forall>xs ys zs. set xs \<subseteq> A \<longrightarrow> set ys \<subseteq> A \<longrightarrow> set zs \<subseteq> A
   \<longrightarrow> size xs = n \<and> size ys = n \<longrightarrow>
   xs [\<sqsubseteq>\<^bsub>r\<^esub>] zs \<and> ys [\<sqsubseteq>\<^bsub>r\<^esub>] zs \<longrightarrow> xs [\<squnion>\<^bsub>f\<^esub>] ys [\<sqsubseteq>\<^bsub>r\<^esub>] zs"
 (*<*)
 apply (unfold unfold_lesub_list)
 apply (simp add: Listn.le_def list_all2_conv_all_nth)
 done
 (*>*)
 
 lemma (in Semilat) list_update_incr [rule_format]:
  "x\<in>A \<Longrightarrow> set xs \<subseteq> A \<longrightarrow>
   (\<forall>i. i<size xs \<longrightarrow> xs [\<sqsubseteq>\<^bsub>r\<^esub>] xs[i := x \<squnion>\<^sub>f xs!i])"
 (*<*)
 apply (unfold unfold_lesub_list)
 apply (simp add: Listn.le_def list_all2_conv_all_nth)
 apply (induct xs)
  apply simp
-apply (simp add: in_list_Suc_iff)
+apply (simp add: in_nlists_Suc_iff)
 apply clarify
 apply (simp add: nth_Cons split: nat.split)
 done
 (*>*)
 
 
-lemma closed_listI:
-  "closed S f \<Longrightarrow> closed (list n S) (map2 f)"
+lemma closed_nlistsI:
+  "closed S f \<Longrightarrow> closed (nlists n S) (map2 f)"
 (*<*)
 apply (unfold closed_def)
 apply (induct n)
  apply simp
 apply clarify
-apply (simp add: in_list_Suc_iff)
+apply (simp add: in_nlists_Suc_iff)
 apply clarify
 apply simp
 done
 (*>*)
 
 
 lemma Listn_sl_aux:
 assumes "Semilat A r f" shows "semilat (Listn.sl n (A,r,f))"
 (*<*)
 proof -
   interpret Semilat A r f by fact
   show ?thesis
   apply (unfold Listn.sl_def)
   apply (simp (no_asm) only: semilat_Def split_conv)
   apply (rule conjI)
    apply simp
   apply (rule conjI)
-   apply (simp only: closedI closed_listI)
-  apply (simp (no_asm) only: list_def)
+   apply (simp only: closedI closed_nlistsI)
+  apply (simp (no_asm) only: nlists_def)
   apply (simp (no_asm_simp) add: plus_list_ub1 plus_list_ub2 plus_list_lub)
   done
 qed
 (*>*)
 
 lemma Listn_sl: "semilat L \<Longrightarrow> semilat (Listn.sl n L)"
 (*<*) apply (cases L) apply simp
 apply (drule Semilat.intro)
 by (simp add: Listn_sl_aux split_tupled_all) (*>*)
 
 lemma coalesce_in_err_list [rule_format]:
-  "\<forall>xes. xes \<in> list n (err A) \<longrightarrow> coalesce xes \<in> err(list n A)"
+  "\<forall>xes. xes \<in> nlists n (err A) \<longrightarrow> coalesce xes \<in> err(nlists n A)"
 (*<*)
 apply (induct n)
  apply simp
 apply clarify
-apply (simp add: in_list_Suc_iff)
+apply (simp add: in_nlists_Suc_iff)
 apply clarify
 apply (simp (no_asm) add: plussub_def Err.sup_def lift2_def split: err.split)
 apply force
 done
 (*>*)
 
 lemma lem: "\<And>x xs. x \<squnion>\<^bsub>(#)\<^esub> xs = x#xs"
 (*<*) by (simp add: plussub_def) (*>*)
 
 lemma coalesce_eq_OK1_D [rule_format]:
   "semilat(err A, Err.le r, lift2 f) \<Longrightarrow>
-  \<forall>xs. xs \<in> list n A \<longrightarrow> (\<forall>ys. ys \<in> list n A \<longrightarrow>
+  \<forall>xs. xs \<in> nlists n A \<longrightarrow> (\<forall>ys. ys \<in> nlists n A \<longrightarrow>
   (\<forall>zs. coalesce (xs [\<squnion>\<^bsub>f\<^esub>] ys) = OK zs \<longrightarrow> xs [\<sqsubseteq>\<^bsub>r\<^esub>] zs))"
 (*<*)
 apply (induct n)
   apply simp
 apply clarify
-apply (simp add: in_list_Suc_iff)
+apply (simp add: in_nlists_Suc_iff)
 apply clarify
 apply (simp split: err.split_asm add: lem Err.sup_def lift2_def)
 apply (force simp add: semilat_le_err_OK1)
 done
 (*>*)
 
 lemma coalesce_eq_OK2_D [rule_format]:
   "semilat(err A, Err.le r, lift2 f) \<Longrightarrow>
-  \<forall>xs. xs \<in> list n A \<longrightarrow> (\<forall>ys. ys \<in> list n A \<longrightarrow>
+  \<forall>xs. xs \<in> nlists n A \<longrightarrow> (\<forall>ys. ys \<in> nlists n A \<longrightarrow>
   (\<forall>zs. coalesce (xs [\<squnion>\<^bsub>f\<^esub>] ys) = OK zs \<longrightarrow> ys [\<sqsubseteq>\<^bsub>r\<^esub>] zs))"
 (*<*)
 apply (induct n)
  apply simp
 apply clarify
-apply (simp add: in_list_Suc_iff)
+apply (simp add: in_nlists_Suc_iff)
 apply clarify
 apply (simp split: err.split_asm add: lem Err.sup_def lift2_def)
 apply (force simp add: semilat_le_err_OK2)
 done
 (*>*)
 
 lemma lift2_le_ub:
   "\<lbrakk> semilat(err A, Err.le r, lift2 f); x\<in>A; y\<in>A; x \<squnion>\<^sub>f y = OK z;
       u\<in>A; x \<sqsubseteq>\<^sub>r u; y \<sqsubseteq>\<^sub>r u \<rbrakk> \<Longrightarrow> z \<sqsubseteq>\<^sub>r u"
 (*<*)
 apply (unfold semilat_Def plussub_def err_def')
 apply (simp add: lift2_def)
 apply clarify
 apply (rotate_tac -3)
 apply (erule thin_rl)
 apply (erule thin_rl)
 apply force
 done
 (*>*)
 
 lemma coalesce_eq_OK_ub_D [rule_format]:
   "semilat(err A, Err.le r, lift2 f) \<Longrightarrow>
-  \<forall>xs. xs \<in> list n A \<longrightarrow> (\<forall>ys. ys \<in> list n A \<longrightarrow>
+  \<forall>xs. xs \<in> nlists n A \<longrightarrow> (\<forall>ys. ys \<in> nlists n A \<longrightarrow>
   (\<forall>zs us. coalesce (xs [\<squnion>\<^bsub>f\<^esub>] ys) = OK zs \<and> xs [\<sqsubseteq>\<^bsub>r\<^esub>] us \<and> ys [\<sqsubseteq>\<^bsub>r\<^esub>] us
-           \<and> us \<in> list n A \<longrightarrow> zs [\<sqsubseteq>\<^bsub>r\<^esub>] us))"
+           \<and> us \<in> nlists n A \<longrightarrow> zs [\<sqsubseteq>\<^bsub>r\<^esub>] us))"
 (*<*)
 apply (induct n)
  apply simp
 apply clarify
-apply (simp add: in_list_Suc_iff)
+apply (simp add: in_nlists_Suc_iff)
 apply clarify
 apply (simp (no_asm_use) split: err.split_asm add: lem Err.sup_def lift2_def)
 apply clarify
 apply (rule conjI)
  apply (blast intro: lift2_le_ub)
 apply blast
 done
 (*>*)
 
 lemma lift2_eq_ErrD:
   "\<lbrakk> x \<squnion>\<^sub>f y = Err; semilat(err A, Err.le r, lift2 f); x\<in>A; y\<in>A \<rbrakk>
   \<Longrightarrow> \<not>(\<exists>u\<in>A. x \<sqsubseteq>\<^sub>r u \<and> y \<sqsubseteq>\<^sub>r u)"
 (*<*) by (simp add: OK_plus_OK_eq_Err_conv [THEN iffD1]) (*>*)
 
 
 lemma coalesce_eq_Err_D [rule_format]:
   "\<lbrakk> semilat(err A, Err.le r, lift2 f) \<rbrakk>
-  \<Longrightarrow> \<forall>xs. xs \<in> list n A \<longrightarrow> (\<forall>ys. ys \<in> list n A \<longrightarrow>
+  \<Longrightarrow> \<forall>xs. xs \<in> nlists n A \<longrightarrow> (\<forall>ys. ys \<in> nlists n A \<longrightarrow>
       coalesce (xs [\<squnion>\<^bsub>f\<^esub>] ys) = Err \<longrightarrow>
-      \<not>(\<exists>zs \<in> list n A. xs [\<sqsubseteq>\<^bsub>r\<^esub>] zs \<and> ys [\<sqsubseteq>\<^bsub>r\<^esub>] zs))"
+      \<not>(\<exists>zs \<in> nlists n A. xs [\<sqsubseteq>\<^bsub>r\<^esub>] zs \<and> ys [\<sqsubseteq>\<^bsub>r\<^esub>] zs))"
 (*<*)
 apply (induct n)
  apply simp
 apply clarify
-apply (simp add: in_list_Suc_iff)
+apply (simp add: in_nlists_Suc_iff)
 apply clarify
 apply (simp split: err.split_asm add: lem Err.sup_def lift2_def)
  apply (blast dest: lift2_eq_ErrD)
 done
 (*>*)
 
 lemma closed_err_lift2_conv:
   "closed (err A) (lift2 f) = (\<forall>x\<in>A. \<forall>y\<in>A. x \<squnion>\<^sub>f y \<in> err A)"
 (*<*)
 apply (unfold closed_def)
 apply (simp add: err_def')
 done
 (*>*)
 
 lemma closed_map2_list [rule_format]:
   "closed (err A) (lift2 f) \<Longrightarrow>
-  \<forall>xs. xs \<in> list n A \<longrightarrow> (\<forall>ys. ys \<in> list n A \<longrightarrow>
-  map2 f xs ys \<in> list n (err A))"
+  \<forall>xs. xs \<in> nlists n A \<longrightarrow> (\<forall>ys. ys \<in> nlists n A \<longrightarrow>
+  map2 f xs ys \<in> nlists n (err A))"
 (*<*)
 apply (induct n)
  apply simp
 apply clarify
-apply (simp add: in_list_Suc_iff)
+apply (simp add: in_nlists_Suc_iff)
 apply clarify
 apply (simp add: plussub_def closed_err_lift2_conv)
 done
 (*>*)
 
 lemma closed_lift2_sup:
   "closed (err A) (lift2 f) \<Longrightarrow>
-  closed (err (list n A)) (lift2 (sup f))"
+  closed (err (nlists n A)) (lift2 (sup f))"
 (*<*) by (fastforce  simp add: closed_def plussub_def sup_def lift2_def
                           coalesce_in_err_list closed_map2_list
                 split: err.split) (*>*)
 
 lemma err_semilat_sup:
   "err_semilat (A,r,f) \<Longrightarrow>
-  err_semilat (list n A, Listn.le r, sup f)"
+  err_semilat (nlists n A, Listn.le r, sup f)"
 (*<*)
 apply (unfold Err.sl_def)
 apply (simp only: split_conv)
 apply (simp (no_asm) only: semilat_Def plussub_def)
 apply (simp (no_asm_simp) only: Semilat.closedI [OF Semilat.intro] closed_lift2_sup)
 apply (rule conjI)
  apply (drule Semilat.orderI [OF Semilat.intro])
  apply simp
 apply (simp (no_asm) only: unfold_lesub_err Err.le_def err_def' sup_def lift2_def)
 apply (simp (no_asm_simp) add: coalesce_eq_OK1_D coalesce_eq_OK2_D split: err.split)
 apply (blast intro: coalesce_eq_OK_ub_D dest: coalesce_eq_Err_D)
 done
 (*>*)
 
 lemma err_semilat_upto_esl:
   "\<And>L. err_semilat L \<Longrightarrow> err_semilat(upto_esl m L)"
 (*<*)
 apply (unfold Listn.upto_esl_def)
 apply (simp (no_asm_simp) only: split_tupled_all)
 apply simp
 apply (fastforce intro!: err_semilat_UnionI err_semilat_sup
                 dest: lesub_list_impl_same_size
                 simp add: plussub_def Listn.sup_def)
 done
 (*>*)
 
 end
diff --git a/thys/Jinja/DFA/Typing_Framework_2.thy b/thys/Jinja/DFA/Typing_Framework_2.thy
--- a/thys/Jinja/DFA/Typing_Framework_2.thy
+++ b/thys/Jinja/DFA/Typing_Framework_2.thy
@@ -1,19 +1,19 @@
 (*  Title:      HOL/MicroJava/BV/Typing_Framework.thy
     Author:     Tobias Nipkow
     Copyright   2000 TUM
 *)
 
 section \<open>Typing and Dataflow Analysis Framework\<close>
 
 theory Typing_Framework_2 imports Typing_Framework_1 begin
 
 text \<open>
   The relationship between dataflow analysis and a welltyped-instruction predicate. 
 \<close>
 
 definition is_bcv :: "'s ord \<Rightarrow> 's \<Rightarrow> 's step_type \<Rightarrow> nat \<Rightarrow> 's set \<Rightarrow> ('s list \<Rightarrow> 's list) \<Rightarrow> bool"
 where
-  "is_bcv r T step n A bcv \<longleftrightarrow> (\<forall>\<tau>s\<^sub>0 \<in> list n A.
-  (\<forall>p<n. (bcv \<tau>s\<^sub>0)!p \<noteq> T) = (\<exists>\<tau>s \<in> list n A. \<tau>s\<^sub>0 [\<sqsubseteq>\<^sub>r] \<tau>s \<and> wt_step r T step \<tau>s))"
+  "is_bcv r T step n A bcv \<longleftrightarrow> (\<forall>\<tau>s\<^sub>0 \<in> nlists n A.
+  (\<forall>p<n. (bcv \<tau>s\<^sub>0)!p \<noteq> T) = (\<exists>\<tau>s \<in> nlists n A. \<tau>s\<^sub>0 [\<sqsubseteq>\<^sub>r] \<tau>s \<and> wt_step r T step \<tau>s))"
 
 end
diff --git a/thys/JinjaDCI/BV/BVExec.thy b/thys/JinjaDCI/BV/BVExec.thy
--- a/thys/JinjaDCI/BV/BVExec.thy
+++ b/thys/JinjaDCI/BV/BVExec.thy
@@ -1,506 +1,506 @@
 (*  Title:      JinjaDCI/BV/BVExec.thy
 
     Author:     Tobias Nipkow, Gerwin Klein, Susannah Mansky
     Copyright   2000 TUM, 2020 UIUC
 
     Based on the Jinja theory BV/BVExec.thy by Tobias Nipkow and Gerwin Klein
 *)
 
 section \<open> Kildall for the JVM \label{sec:JVM} \<close>
 
 theory BVExec
 imports Jinja.Abstract_BV TF_JVM Jinja.Typing_Framework_2
 begin
 
 definition kiljvm :: "jvm_prog \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> ty \<Rightarrow> 
              instr list \<Rightarrow> ex_table \<Rightarrow> ty\<^sub>i' err list \<Rightarrow> ty\<^sub>i' err list"
 where
   "kiljvm P mxs mxl T\<^sub>r is xt \<equiv>
   kildall (JVM_SemiType.le P mxs mxl) (JVM_SemiType.sup P mxs mxl) 
           (exec P mxs T\<^sub>r xt is)"
 
 definition wt_kildall :: "jvm_prog \<Rightarrow> cname \<Rightarrow> staticb \<Rightarrow> ty list \<Rightarrow> ty \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> 
                  instr list \<Rightarrow> ex_table \<Rightarrow> bool"
 where
   "wt_kildall P C' b Ts T\<^sub>r mxs mxl\<^sub>0 is xt \<equiv> (b = Static \<or> b = NonStatic) \<and>
    0 < size is \<and>  
    (let first  = Some ([],(case b of Static \<Rightarrow> [] | NonStatic \<Rightarrow> [OK (Class C')])
                             @(map OK Ts)@(replicate mxl\<^sub>0 Err));
         start  = (OK first)#(replicate (size is - 1) (OK None));
         result = kiljvm P mxs
                    ((case b of Static \<Rightarrow> 0 | NonStatic \<Rightarrow> 1)+size Ts+mxl\<^sub>0)
                      T\<^sub>r is xt start
     in \<forall>n < size is. result!n \<noteq> Err)"
 
 definition wf_jvm_prog\<^sub>k :: "jvm_prog \<Rightarrow> bool"
 where
   "wf_jvm_prog\<^sub>k P \<equiv>
   wf_prog (\<lambda>P C' (M,b,Ts,T\<^sub>r,(mxs,mxl\<^sub>0,is,xt)). wt_kildall P C' b Ts T\<^sub>r mxs mxl\<^sub>0 is xt) P"
 
 
 context start_context
 begin
 
 lemma Cons_less_Conss3 [simp]:
   "x#xs [\<sqsubset>\<^bsub>r\<^esub>] y#ys = (x \<sqsubset>\<^bsub>r\<^esub> y \<and> xs [\<sqsubseteq>\<^bsub>r\<^esub>] ys \<or> x = y \<and> xs [\<sqsubset>\<^bsub>r\<^esub>] ys)"
   apply (unfold lesssub_def )
   apply auto
   apply (insert sup_state_opt_err)
   apply (unfold lesssub_def lesub_def sup_state_opt_def sup_state_def sup_ty_opt_def)
   apply (simp only: JVM_le_unfold )
   apply fastforce
   done
 
 lemma acc_le_listI3 [intro!]:
   " acc r \<Longrightarrow> acc (Listn.le r)"
 apply (unfold acc_def)
 apply (subgoal_tac
  "wf(UN n. {(ys,xs). size xs = n \<and> size ys = n \<and> xs <_(Listn.le r) ys})")
    apply (erule wf_subset)
  apply (blast intro: lesssub_lengthD)
 apply (rule wf_UN)
  prefer 2
  apply (rename_tac m n)
  apply (case_tac "m=n")
   apply simp
  apply (fast intro!: equals0I dest: not_sym)
 apply (rename_tac n)
 apply (induct_tac n)
  apply (simp add: lesssub_def cong: conj_cong)
 apply (rename_tac k)
 apply (simp add: wf_eq_minimal del: r_def f_def step_def A_def)
 apply (simp (no_asm) add: length_Suc_conv cong: conj_cong del: r_def f_def step_def A_def)
 apply clarify
 apply (rename_tac M m)
 apply (case_tac "\<exists>x xs. size xs = k \<and> x#xs \<in> M")
  prefer 2
  apply (erule thin_rl)
  apply (erule thin_rl)
  apply blast
 apply (erule_tac x = "{a. \<exists>xs. size xs = k \<and> a#xs:M}" in allE)
 apply (erule impE)
  apply blast
 apply (thin_tac "\<exists>x xs. P x xs" for P)
 apply clarify
 apply (rename_tac maxA xs)
 apply (erule_tac x = "{ys. size ys = size xs \<and> maxA#ys \<in> M}" in allE)
 apply (erule impE)
  apply blast
 apply clarify
 apply (thin_tac "m \<in> M")
 apply (thin_tac "maxA#xs \<in> M")
 apply (rule bexI)
  prefer 2
  apply assumption
 apply clarify
 apply (simp del: r_def f_def step_def A_def)
 apply blast
   done
 
 
 lemma wf_jvm: " wf {(ss', ss). ss [\<sqsubset>\<^bsub>r\<^esub>] ss'}"
   apply (insert acc_le_listI3 acc_JVM [OF wf])
   by (simp add: acc_def r_def) 
 
 lemma iter_properties_bv[rule_format]:
-shows "\<lbrakk> \<forall>p\<in>w0. p < n; ss0 \<in> list n A; \<forall>p<n. p \<notin> w0 \<longrightarrow> stable r step ss0 p \<rbrakk> \<Longrightarrow>
+shows "\<lbrakk> \<forall>p\<in>w0. p < n; ss0 \<in> nlists n A; \<forall>p<n. p \<notin> w0 \<longrightarrow> stable r step ss0 p \<rbrakk> \<Longrightarrow>
          iter f step ss0 w0 = (ss',w') \<longrightarrow>
-         ss' \<in> list n A \<and> stables r step ss' \<and> ss0 [\<sqsubseteq>\<^sub>r] ss' \<and>
-         (\<forall>ts\<in>list n A. ss0 [\<sqsubseteq>\<^sub>r] ts \<and> stables r step ts \<longrightarrow> ss' [\<sqsubseteq>\<^sub>r] ts)"
+         ss' \<in> nlists n A \<and> stables r step ss' \<and> ss0 [\<sqsubseteq>\<^sub>r] ss' \<and>
+         (\<forall>ts\<in>nlists n A. ss0 [\<sqsubseteq>\<^sub>r] ts \<and> stables r step ts \<longrightarrow> ss' [\<sqsubseteq>\<^sub>r] ts)"
 (*<*) (is "PROP ?P")
 
 proof -
   show "PROP ?P"
     apply (insert semi bounded_step exec_pres_type step_mono[OF wf])  
     apply (unfold iter_def stables_def)
 
     apply (rule_tac P = "\<lambda>(ss,w).
-                ss \<in> list n A \<and> (\<forall>p<n. p \<notin> w \<longrightarrow> stable r step ss p) \<and> ss0 [\<sqsubseteq>\<^sub>r] ss \<and>
-   (\<forall>ts\<in>list n A. ss0 [\<sqsubseteq>\<^sub>r] ts \<and> stables r step ts \<longrightarrow> ss [\<sqsubseteq>\<^sub>r] ts) \<and>
+                ss \<in> nlists n A \<and> (\<forall>p<n. p \<notin> w \<longrightarrow> stable r step ss p) \<and> ss0 [\<sqsubseteq>\<^sub>r] ss \<and>
+   (\<forall>ts\<in>nlists n A. ss0 [\<sqsubseteq>\<^sub>r] ts \<and> stables r step ts \<longrightarrow> ss [\<sqsubseteq>\<^sub>r] ts) \<and>
    (\<forall>p\<in>w. p < n)" and
    r = "{(ss',ss) . ss [\<sqsubset>\<^sub>r] ss'} <*lex*> finite_psubset"
          in while_rule)
 
   \<comment> \<open>Invariant holds initially:\<close>  
         apply (simp add:stables_def  semilat_Def   del: n_def A_def r_def f_def step_def)
         apply (blast intro:le_list_refl')     
    
   \<comment> \<open>Invariant is preserved:\<close>
        apply(simp add: stables_def split_paired_all del: A_def r_def f_def step_def n_def)
        apply(rename_tac ss w)
        apply(subgoal_tac "(SOME p. p \<in> w) \<in> w")
         prefer 2 apply (fast intro: someI)
        apply(subgoal_tac "\<forall>(q,t) \<in> set (step (SOME p. p \<in> w) (ss ! (SOME p. p \<in> w))). q < length ss \<and> t \<in> A")
         prefer 2
         apply clarify
         apply (rule conjI)
          apply(clarsimp, blast dest!: boundedD)
         apply (subgoal_tac "(SOME p. p \<in> w) < n")
          apply (subgoal_tac "(ss ! (SOME p. p \<in> w)) \<in> A")
           apply (fastforce simp only:n_def dest:pres_typeD )   
          apply simp
         apply simp
        apply (subst decomp_propa)
         apply blast
        apply (simp del:A_def r_def f_def step_def n_def)
        apply (rule conjI)
         apply (rule Semilat.merges_preserves_type[OF Semilat.intro, OF semi])
          apply blast
         apply clarify
         apply (rule conjI)
          apply(clarsimp, blast dest!: boundedD)
         apply (erule pres_typeD)
           prefer 3
           apply assumption
-         apply (erule listE_nth_in)
+         apply (erule nlistsE_nth_in)
          apply blast
         apply (simp only:n_def)
        apply (rule conjI)
         apply clarify
-        apply (subgoal_tac "ss \<in> list (length is) A" "\<forall>p\<in>w. p <  (length is) " "\<forall>p<(length is). p \<notin> w \<longrightarrow> stable r step ss p "
+        apply (subgoal_tac "ss \<in> nlists (length is) A" "\<forall>p\<in>w. p <  (length is) " "\<forall>p<(length is). p \<notin> w \<longrightarrow> stable r step ss p "
  "p < length is")
             apply (blast   intro!: Semilat.stable_pres_lemma[OF Semilat.intro, OF semi])
            apply (simp only:n_def)
           apply (simp only:n_def)
          apply (simp only:n_def)
         apply (simp only:n_def)
        apply (rule conjI)
-        apply (subgoal_tac "ss \<in> list (length is) A" 
+        apply (subgoal_tac "ss \<in> nlists (length is) A" 
                "\<forall>(q,t)\<in>set (step (SOME p. p \<in> w) (ss ! (SOME p. p \<in> w))). q < length is \<and> t \<in> A"
-               "ss [\<sqsubseteq>\<^bsub>r\<^esub>] merges f (step (SOME p. p \<in> w) (ss ! (SOME p. p \<in> w))) ss" "ss0\<in> list (size is) A"
-               "merges f (step (SOME p. p \<in> w) (ss ! (SOME p. p \<in> w))) ss \<in> list (size is) A" 
-               "ss \<in>list (size is) A" "order r A" "ss0 [\<sqsubseteq>\<^bsub>r\<^esub>] ss ")
+               "ss [\<sqsubseteq>\<^bsub>r\<^esub>] merges f (step (SOME p. p \<in> w) (ss ! (SOME p. p \<in> w))) ss" "ss0\<in> nlists (size is) A"
+               "merges f (step (SOME p. p \<in> w) (ss ! (SOME p. p \<in> w))) ss \<in> nlists (size is) A" 
+               "ss \<in>nlists (size is) A" "order r A" "ss0 [\<sqsubseteq>\<^bsub>r\<^esub>] ss ")
                 apply (blast dest: le_list_trans)
                apply simp
               apply (simp only:semilat_Def)
              apply (simp only:n_def)
             apply (fastforce simp only: n_def dest:Semilat.merges_preserves_type[OF Semilat.intro, OF semi] )
            apply (simp only:n_def)
           apply (blast intro:Semilat.merges_incr[OF Semilat.intro, OF semi])
          apply (subgoal_tac "length ss = n")
           apply (simp only:n_def)
-         apply (subgoal_tac "ss \<in>list n A")
+         apply (subgoal_tac "ss \<in>nlists n A")
           defer
           apply simp
          apply (simp only:n_def)
         prefer 5
-        apply (simp only:listE_length n_def)
+        apply (simp only:nlistsE_length n_def)
        apply(rule conjI)
         apply (clarsimp simp del: A_def r_def f_def step_def)
         apply (blast intro!: Semilat.merges_bounded_lemma[OF Semilat.intro, OF semi])       
        apply (subgoal_tac "bounded step n")
         apply (blast dest!: boundedD)
        apply (simp only:n_def)
 
   \<comment> \<open>Postcondition holds upon termination:\<close>
       apply(clarsimp simp add: stables_def split_paired_all)
   
   \<comment> \<open>Well-foundedness of the termination relation:\<close>    
       apply (rule wf_lex_prod)
      apply (simp only:wf_jvm) 
     apply (rule wf_finite_psubset) 
 
   \<comment> \<open>Loop decreases along termination relation:\<close>
      apply(simp add: stables_def split_paired_all del: A_def r_def f_def step_def)
      apply(rename_tac ss w)
      apply(subgoal_tac "(SOME p. p \<in> w) \<in> w")
       prefer 2 apply (fast intro: someI)
      apply(subgoal_tac "\<forall>(q,t) \<in> set (step (SOME p. p \<in> w) (ss ! (SOME p. p \<in> w))). q < length ss \<and> t \<in> A")
       prefer 2
       apply clarify
       apply (rule conjI)
        apply(clarsimp, blast dest!: boundedD)
       apply (erule pres_typeD)
         prefer 3
         apply assumption
-       apply (erule listE_nth_in)
+       apply (erule nlistsE_nth_in)
        apply blast
       apply blast
      apply (subst decomp_propa)
       apply blast
      apply clarify
-  apply (simp del: listE_length  A_def r_def f_def step_def
+  apply (simp del: nlistsE_length  A_def r_def f_def step_def
       add: lex_prod_def finite_psubset_def 
            bounded_nat_set_is_finite)
      apply (rule termination_lemma)
         apply (insert Semilat.intro)
         apply assumption+
       defer
       apply assumption
      defer
      apply clarsimp   
     done
 qed
 
 (*>*)
 
 
 lemma kildall_properties_bv: 
-shows "\<lbrakk> ss0 \<in> list n A \<rbrakk> \<Longrightarrow>
-  kildall r f step ss0 \<in> list n A \<and>
+shows "\<lbrakk> ss0 \<in> nlists n A \<rbrakk> \<Longrightarrow>
+  kildall r f step ss0 \<in> nlists n A \<and>
   stables r step (kildall r f step ss0) \<and>
   ss0 [\<sqsubseteq>\<^sub>r] kildall r f step ss0 \<and>
-  (\<forall>ts\<in>list n A. ss0 [\<sqsubseteq>\<^sub>r] ts \<and> stables r step ts \<longrightarrow>
+  (\<forall>ts\<in>nlists n A. ss0 [\<sqsubseteq>\<^sub>r] ts \<and> stables r step ts \<longrightarrow>
                  kildall r f step ss0 [\<sqsubseteq>\<^sub>r] ts)"
 (*<*) (is "PROP ?P")
 proof -
   show "PROP ?P"
   apply (unfold kildall_def)
     apply(case_tac "iter f step ss0 (unstables r step ss0)")
     apply (simp del:r_def f_def n_def step_def A_def)
     apply (rule iter_properties_bv)      
      apply (simp_all add: unstables_def stable_def)
     done
 qed
 
 end
 
 theorem (in start_context) is_bcv_kiljvm:
   "is_bcv r Err step (size is) A (kiljvm P mxs mxl T\<^sub>r is xt)"
 (*<*)
   apply (insert wf)
   apply (unfold kiljvm_def)
   apply (fold r_def f_def step_def_exec n_def)
   apply(unfold is_bcv_def wt_step_def)
   apply(insert semi  kildall_properties_bv)
   apply(simp only:stables_def)
   apply clarify
-  apply(subgoal_tac "kildall r f step \<tau>s\<^sub>0 \<in> list n A")
+  apply(subgoal_tac "kildall r f step \<tau>s\<^sub>0 \<in> nlists n A")
    prefer 2
    apply (fastforce intro: kildall_properties_bv)
   apply (rule iffI)
    apply (rule_tac x = "kildall r f step \<tau>s\<^sub>0" in bexI) 
     apply (rule conjI)
      apply (fastforce intro: kildall_properties_bv)
   apply (force intro: kildall_properties_bv)
    apply simp
   apply clarify
   apply(subgoal_tac "kildall r f step \<tau>s\<^sub>0!pa <=_r \<tau>s!pa")
    defer
    apply (blast intro!: le_listD less_lengthI)
   apply (subgoal_tac "\<tau>s!pa \<noteq> Err")
    defer
    apply simp
   apply (rule ccontr)
   apply (simp only:top_def r_def JVM_le_unfold)
   apply fastforce
   done
 (*
 proof -
   let ?n = "length is"
   have "Semilat A r f" using semilat_JVM[OF wf]
     by (simp add: Semilat.intro sl_def2)
   moreover have "acc r" using wf by simp blast
   moreover have "top r Err" by (simp add: JVM_le_unfold)
   moreover have "pres_type step ?n A" by (rule exec_pres_type)
   moreover have "bounded step ?n" by (rule bounded_step)
   moreover have "mono r step ?n A" using step_mono[OF wf] by simp
   ultimately have "is_bcv r Err step ?n A (kildall r f step)"
     by(rule is_bcv_kildall)
   moreover have kileq: "kiljvm P mxs mxl T\<^sub>r is xt = kildall r f step"
     using f_def kiljvm_def r_def step_def_exec by blast
   ultimately show ?thesis by simp
 qed
 *)
 (*>*)
 
 (* FIXME: move? *)
 lemma subset_replicate [intro?]: "set (replicate n x) \<subseteq> {x}"
   by (induct n) auto
 
 lemma in_set_replicate:
   assumes "x \<in> set (replicate n y)"
   shows "x = y"
 (*<*)
 proof -
   note assms
   also have "set (replicate n y) \<subseteq> {y}" ..
   finally show ?thesis by simp
 qed
 (*>*)
 
 lemma (in start_context) start_in_A [intro?]:
-  "0 < size is \<Longrightarrow> start \<in> list (size is) A"
+  "0 < size is \<Longrightarrow> start \<in> nlists (size is) A"
   using Ts C
 (*<*)
 proof(cases b)
-qed (force simp: JVM_states_unfold intro!: listI list_appendI
+qed (force simp: JVM_states_unfold intro!: nlistsI nlists_appendI
            dest!: in_set_replicate)+
 (*>*)
 
 
 theorem (in start_context) wt_kil_correct:
   assumes wtk: "wt_kildall P C b Ts T\<^sub>r mxs mxl\<^sub>0 is xt"
   shows "\<exists>\<tau>s. wt_method P C b Ts T\<^sub>r mxs mxl\<^sub>0 is xt \<tau>s"
 (*<*)
 proof -
   from wtk obtain res where    
     result:   "res = kiljvm P mxs mxl T\<^sub>r is xt start" and
     success:  "\<forall>n < size is. res!n \<noteq> Err" and
     instrs:   "0 < size is" and
     stab:     "b = Static \<or> b = NonStatic" 
     by (unfold wt_kildall_def) simp
       
   have bcv: "is_bcv r Err step (size is) A (kiljvm P mxs mxl T\<^sub>r is xt)"
     by (rule is_bcv_kiljvm)
     
-  from instrs have "start \<in> list (size is) A" ..
+  from instrs have "start \<in> nlists (size is) A" ..
   with bcv success result have 
-    "\<exists>ts\<in>list (size is) A. start [\<sqsubseteq>\<^sub>r] ts \<and> wt_step r Err step ts"
+    "\<exists>ts\<in>nlists (size is) A. start [\<sqsubseteq>\<^sub>r] ts \<and> wt_step r Err step ts"
     by (unfold is_bcv_def) blast
   then obtain \<tau>s' where
-    in_A: "\<tau>s' \<in> list (size is) A" and
+    in_A: "\<tau>s' \<in> nlists (size is) A" and
     s:    "start [\<sqsubseteq>\<^sub>r] \<tau>s'" and
     w:    "wt_step r Err step \<tau>s'"
     by blast
   hence wt_err_step: "wt_err_step (sup_state_opt P) step \<tau>s'"
     by (simp add: wt_err_step_def JVM_le_Err_conv)
 
   from in_A have l: "size \<tau>s' = size is" by simp  
   moreover {
     from in_A  have "check_types P mxs mxl \<tau>s'" by (simp add: check_types_def)
     also from w have "\<forall>x \<in> set \<tau>s'. x \<noteq> Err" 
       by (auto simp add: wt_step_def all_set_conv_all_nth)
     hence [symmetric]: "map OK (map ok_val \<tau>s') = \<tau>s'" 
       by (auto intro!: map_idI simp add: wt_step_def)
     finally  have "check_types P mxs mxl (map OK (map ok_val \<tau>s'))" .
   } 
   moreover {  
     from s have "start!0 \<sqsubseteq>\<^sub>r \<tau>s'!0" by (rule le_listD) simp
     moreover
     from instrs w l 
     have "\<tau>s'!0 \<noteq> Err" by (unfold wt_step_def) simp
     then obtain \<tau>s0 where "\<tau>s'!0 = OK \<tau>s0" by auto
     ultimately
     have "wt_start P C b Ts mxl\<^sub>0 (map ok_val \<tau>s')" using l instrs
       by (unfold wt_start_def) 
          (cases b; simp add: lesub_def JVM_le_Err_conv Err.le_def)
   }
   moreover 
   from in_A have "set \<tau>s' \<subseteq> A" by simp  
   with wt_err_step bounded_step
   have "wt_app_eff (sup_state_opt P) app eff (map ok_val \<tau>s')"
     by (auto intro: wt_err_imp_wt_app_eff simp add: l)
   ultimately
   have "wt_method P C b Ts T\<^sub>r mxs mxl\<^sub>0 is xt (map ok_val \<tau>s')"
     using instrs stab by (simp add: wt_method_def2 check_types_def del: map_map)
   thus ?thesis by blast
 qed
 (*>*)
 
 
 theorem (in start_context) wt_kil_complete:
   assumes wtm: "wt_method P C b Ts T\<^sub>r mxs mxl\<^sub>0 is xt \<tau>s"
   shows "wt_kildall P C b Ts T\<^sub>r mxs mxl\<^sub>0 is xt"
 (*<*)
 proof -
   from wtm obtain
     instrs:   "0 < size is" and
     length:   "length \<tau>s = length is" and 
     ck_type:  "check_types P mxs mxl (map OK \<tau>s)" and
     wt_start: "wt_start P C b Ts mxl\<^sub>0 \<tau>s" and
     app_eff:  "wt_app_eff (sup_state_opt P) app eff \<tau>s"  and
     stab: "b = Static \<or> b = NonStatic" 
     by (simp add: wt_method_def2 check_types_def )
 
   from ck_type
   have in_A: "set (map OK \<tau>s) \<subseteq> A" 
     by (simp add: check_types_def)  
   with app_eff in_A bounded_step
   have "wt_err_step (sup_state_opt P) (err_step (size \<tau>s) app eff) (map OK \<tau>s)"
     by - (erule wt_app_eff_imp_wt_err,
           auto simp add: exec_def length states_def)
   hence wt_err: "wt_err_step (sup_state_opt P) step (map OK \<tau>s)" 
     by (simp add: length)
   have is_bcv: "is_bcv r Err step (size is) A (kiljvm P mxs mxl T\<^sub>r is xt)"
     by (rule is_bcv_kiljvm)
-  moreover from instrs have "start \<in> list (size is) A" ..
+  moreover from instrs have "start \<in> nlists (size is) A" ..
   moreover
   let ?\<tau>s = "map OK \<tau>s"  
   have less_\<tau>s: "start [\<sqsubseteq>\<^sub>r] ?\<tau>s"
   proof (rule le_listI)
     from length instrs
     show "length start = length (map OK \<tau>s)" by simp
   next
     fix n
     from wt_start have "P \<turnstile> ok_val (start!0) \<le>' \<tau>s!0" 
       by (cases b; simp add: wt_start_def)
     moreover from instrs length have "0 < length \<tau>s" by simp
     ultimately have "start!0 \<sqsubseteq>\<^sub>r ?\<tau>s!0" 
       by (simp add: JVM_le_Err_conv lesub_def)
     moreover {
       fix n'
       have "OK None \<sqsubseteq>\<^sub>r ?\<tau>s!n"
         by (auto simp add: JVM_le_Err_conv Err.le_def lesub_def 
                  split: err.splits)
       hence "\<lbrakk>n = Suc n'; n < size start\<rbrakk> \<Longrightarrow> start!n \<sqsubseteq>\<^sub>r ?\<tau>s!n" by simp
     }
     ultimately
     show "n < size start \<Longrightarrow> start!n \<sqsubseteq>\<^sub>r ?\<tau>s!n" by (cases n, blast+)   
   qed
   moreover
   from ck_type length
-  have "?\<tau>s \<in> list (size is) A"
-    by (auto intro!: listI simp add: check_types_def)
+  have "?\<tau>s \<in> nlists (size is) A"
+    by (auto intro!: nlistsI simp add: check_types_def)
   moreover
   from wt_err have "wt_step r Err step ?\<tau>s" 
     by (simp add: wt_err_step_def JVM_le_Err_conv)
   ultimately
   have "\<forall>p. p < size is \<longrightarrow> kiljvm P  mxs mxl T\<^sub>r is xt start ! p \<noteq> Err" 
     by (unfold is_bcv_def) blast
   with instrs 
   show "wt_kildall P C b Ts T\<^sub>r mxs mxl\<^sub>0 is xt" 
     using start_context_intro_auxi[OF staticb] using stab by (unfold wt_kildall_def) simp
 qed
 (*>*)
 
 
 theorem jvm_kildall_correct:
   "wf_jvm_prog\<^sub>k P = wf_jvm_prog P"
 (*<*)
 proof -
   let ?\<Phi> = "\<lambda>C M. let (C,b,Ts,T\<^sub>r,(mxs,mxl\<^sub>0,is,xt)) = method P C M in 
               SOME \<tau>s. wt_method P C b Ts T\<^sub>r mxs mxl\<^sub>0 is xt \<tau>s"
   let ?A = "\<lambda>P C' (M, b, Ts, T\<^sub>r, mxs, mxl\<^sub>0, is, xt). wt_kildall P C' b Ts T\<^sub>r mxs mxl\<^sub>0 is xt"
   let ?B\<^sub>\<Phi> = "\<lambda>\<Phi>. (\<lambda>P C (M,b,Ts,T\<^sub>r,(mxs,mxl\<^sub>0,is,xt)). 
                 wt_method P C b Ts T\<^sub>r mxs mxl\<^sub>0 is xt (\<Phi> C M))"
 
   show ?thesis proof(rule iffI)
     \<comment> \<open>soundness\<close>
     assume wt: "wf_jvm_prog\<^sub>k P"
     then have wt': "wf_prog ?A P" by(simp add: wf_jvm_prog\<^sub>k_def)
     moreover {
       fix wf_md C M b Ts Ca T m bd
 
       assume ass1: "wf_prog wf_md P" and sees: "P \<turnstile> Ca sees M, b :  Ts\<rightarrow>T = m in Ca" and
              ass2: "set Ts \<subseteq> types P" and ass3: "bd = (M, b, Ts, T, m)" and
              ass4: "?A P Ca bd" 
       from ass3 ass4 have stab: "b = Static \<or> b = NonStatic" by (simp add:wt_kildall_def)
       from ass1 sees ass2 ass3 ass4 have "(?B\<^sub>\<Phi> ?\<Phi>) P Ca bd" using sees_method_is_class[OF sees]
         by (auto dest!: start_context.wt_kil_correct[OF start_context_intro_auxi[OF stab]]
                  intro: someI)
     }
     ultimately have "wf_prog (?B\<^sub>\<Phi> ?\<Phi>) P" by(rule wf_prog_lift)
     then have "wf_jvm_prog\<^bsub>?\<Phi>\<^esub> P" by (simp add: wf_jvm_prog_phi_def)
     thus "wf_jvm_prog P" by (unfold wf_jvm_prog_def) fast
   next  
     \<comment> \<open>completeness\<close>
     
     assume wt: "wf_jvm_prog P" 
     then obtain \<Phi> where "wf_prog (?B\<^sub>\<Phi> \<Phi>) P" by(clarsimp simp: wf_jvm_prog_def wf_jvm_prog_phi_def)
     moreover {
       fix wf_md C M b Ts Ca T m bd
       assume ass1: "wf_prog wf_md P" and sees: "P \<turnstile> Ca sees M, b :  Ts\<rightarrow>T = m in Ca" and
              ass2: "set Ts \<subseteq> types P" and ass3: "bd = (M, b, Ts, T, m)" and
              ass4: "(?B\<^sub>\<Phi> \<Phi>) P Ca bd"
       from ass3 ass4 have stab: "b = Static \<or> b = NonStatic"  by (simp add:wt_method_def)
       from ass1 sees ass2 ass3 ass4 have "?A P Ca bd" using sees_method_is_class[OF sees] using JVM_sl.staticb
         by (auto intro!: start_context.wt_kil_complete start_context_intro_auxi[OF stab])
     }
     ultimately have "wf_prog ?A P" by(rule wf_prog_lift)
     thus "wf_jvm_prog\<^sub>k P" by (simp add: wf_jvm_prog\<^sub>k_def)
   qed
 qed
 (*>*)
 
 end
diff --git a/thys/JinjaDCI/BV/ClassAdd.thy b/thys/JinjaDCI/BV/ClassAdd.thy
--- a/thys/JinjaDCI/BV/ClassAdd.thy
+++ b/thys/JinjaDCI/BV/ClassAdd.thy
@@ -1,685 +1,676 @@
 (*  Title: JinjaDCI/BV/ClassAdd.thy
     Author:     Susannah Mansky
     2019-20, UIUC
 *)
 
 section \<open> Property preservation under @{text "class_add"} \<close>
 
 theory ClassAdd
 imports BVConform
 begin
 
 
 lemma err_mono: "A \<subseteq> B \<Longrightarrow> err A \<subseteq> err B"
  by(unfold err_def) auto
 
 lemma opt_mono: "A \<subseteq> B \<Longrightarrow> opt A \<subseteq> opt B"
  by(unfold opt_def) auto
 
-lemma list_mono:
-assumes "A \<subseteq> B" shows "list n A \<subseteq> list n B"
-proof(rule)
-  fix xs assume "xs \<in> list n A"
-  then obtain size: "size xs = n" and inA: "set xs \<subseteq> A" by simp
-  with assms have "set xs \<subseteq> B" by simp
-  with size show "xs \<in> list n B" by(clarsimp intro!: listI)
-qed
-
 (****************************************************************)
 
 \<comment> \<open> adding a class in the simplest way \<close>
 abbreviation class_add :: "jvm_prog \<Rightarrow> jvm_method cdecl \<Rightarrow> jvm_prog" where
 "class_add P cd \<equiv> cd#P"
 
 
 subsection "Fields"
 
 lemma class_add_has_fields:
 assumes fs: "P \<turnstile> D has_fields FDTs" and nc: "\<not>is_class P C"
 shows "class_add P (C, cdec) \<turnstile> D has_fields FDTs"
 using assms
 proof(induct rule: Fields.induct)
   case (has_fields_Object D fs ms FDTs)
   from has_fields_is_class_Object[OF fs] nc have "C \<noteq> Object" by fast
   with has_fields_Object show ?case
    by(auto simp: class_def fun_upd_apply intro!: TypeRel.has_fields_Object)
 next
   case rec: (has_fields_rec C1 D fs ms FDTs FDTs')
   with has_fields_is_class have [simp]: "D \<noteq> C" by auto
   with rec have "C1 \<noteq> C" by(clarsimp simp: is_class_def)
   with rec show ?case
    by(auto simp: class_def fun_upd_apply intro: TypeRel.has_fields_rec)
 qed
 
 lemma class_add_has_fields_rev:
  "\<lbrakk> class_add P (C, cdec) \<turnstile> D has_fields FDTs; \<not>P \<turnstile> D \<preceq>\<^sup>* C \<rbrakk>
  \<Longrightarrow> P \<turnstile> D has_fields FDTs"
 proof(induct rule: Fields.induct)
   case (has_fields_Object D fs ms FDTs)
   then show ?case by(auto simp: class_def fun_upd_apply intro!: TypeRel.has_fields_Object)
 next
   case rec: (has_fields_rec C1 D fs ms FDTs FDTs')
   then have sub1: "P \<turnstile> C1 \<prec>\<^sup>1 D"
    by(auto simp: class_def fun_upd_apply intro!: subcls1I split: if_split_asm)
   with rec.prems have cls: "\<not> P \<turnstile> D \<preceq>\<^sup>* C" by (meson converse_rtrancl_into_rtrancl)
   with cls rec show ?case
    by(auto simp: class_def fun_upd_apply
            intro: TypeRel.has_fields_rec split: if_split_asm)
 qed
 
 lemma class_add_has_field:
 assumes "P \<turnstile> C\<^sub>0 has F,b:T in D" and "\<not> is_class P C"
 shows "class_add P (C, cdec) \<turnstile> C\<^sub>0 has F,b:T in D"
 using assms by(auto simp: has_field_def dest!: class_add_has_fields[of P C\<^sub>0])
 
 lemma class_add_has_field_rev:
 assumes has: "class_add P (C, cdec) \<turnstile> C\<^sub>0 has F,b:T in D"
  and ncp: "\<And>D'. P \<turnstile> C\<^sub>0 \<preceq>\<^sup>* D' \<Longrightarrow> D' \<noteq> C"
 shows "P \<turnstile> C\<^sub>0 has F,b:T in D"
 using assms by(auto simp: has_field_def dest!: class_add_has_fields_rev)
 
 lemma class_add_sees_field:
 assumes "P \<turnstile> C\<^sub>0 sees F,b:T in D" and "\<not> is_class P C"
 shows "class_add P (C, cdec) \<turnstile> C\<^sub>0 sees F,b:T in D"
 using assms by(auto simp: sees_field_def dest!: class_add_has_fields[of P C\<^sub>0])
 
 lemma class_add_sees_field_rev:
 assumes has: "class_add P (C, cdec) \<turnstile> C\<^sub>0 sees F,b:T in D"
  and ncp: "\<And>D'. P \<turnstile> C\<^sub>0 \<preceq>\<^sup>* D' \<Longrightarrow> D' \<noteq> C"
 shows "P \<turnstile> C\<^sub>0 sees F,b:T in D"
 using assms by(auto simp: sees_field_def dest!: class_add_has_fields_rev)
 
 lemma class_add_field:
 assumes fd: "P \<turnstile> C\<^sub>0 sees F,b:T in D" and "\<not> is_class P C"
 shows "field P C\<^sub>0 F = field (class_add P (C, cdec)) C\<^sub>0 F"
 using class_add_sees_field[OF assms, of cdec] fd by simp
 
 subsection "Methods"
 
 lemma class_add_sees_methods:
 assumes ms: "P \<turnstile> D sees_methods Mm" and nc: "\<not>is_class P C"
 shows "class_add P (C, cdec) \<turnstile> D sees_methods Mm"
 using assms
 proof(induct rule: Methods.induct)
   case (sees_methods_Object D fs ms Mm)
   from sees_methods_is_class_Object[OF ms] nc have "C \<noteq> Object" by fast
   with sees_methods_Object show ?case
    by(auto simp: class_def fun_upd_apply intro!: TypeRel.sees_methods_Object)
 next
   case rec: (sees_methods_rec C1 D fs ms Mm Mm')
   with sees_methods_is_class have [simp]: "D \<noteq> C" by auto
   with rec have "C1 \<noteq> C" by(clarsimp simp: is_class_def)
   with rec show ?case
    by(auto simp: class_def fun_upd_apply intro: TypeRel.sees_methods_rec)
 qed
 
 lemma class_add_sees_methods_rev:
  "\<lbrakk> class_add P (C, cdec) \<turnstile> D sees_methods Mm;
     \<And>D'. P \<turnstile> D \<preceq>\<^sup>* D' \<Longrightarrow> D' \<noteq> C \<rbrakk>
  \<Longrightarrow> P \<turnstile> D sees_methods Mm"
 proof(induct rule: Methods.induct)
   case (sees_methods_Object D fs ms Mm)
   then show ?case
    by(auto simp: class_def fun_upd_apply intro!: TypeRel.sees_methods_Object)
 next
   case rec: (sees_methods_rec C1 D fs ms Mm Mm')
   then have sub1: "P \<turnstile> C1 \<prec>\<^sup>1 D"
    by(auto simp: class_def fun_upd_apply intro!: subcls1I)
   have cls: "\<And>D'. P \<turnstile> D \<preceq>\<^sup>* D' \<Longrightarrow> D' \<noteq> C"
   proof -
     fix D' assume "P \<turnstile> D \<preceq>\<^sup>* D'"
     with sub1 have "P \<turnstile> C1 \<preceq>\<^sup>* D'" by simp
     with rec.prems show "D' \<noteq> C" by simp
   qed
   with cls rec show ?case
    by(auto simp: class_def fun_upd_apply intro: TypeRel.sees_methods_rec)
 qed
 
 lemma class_add_sees_methods_Obj:
 assumes "P \<turnstile> Object sees_methods Mm" and nObj: "C \<noteq> Object"
 shows "class_add P (C, cdec) \<turnstile> Object sees_methods Mm"
 proof -
   from assms obtain C' fs ms where cls: "class P Object = Some(C',fs,ms)"
      by(auto elim!: Methods.cases)
   with nObj have cls': "class (class_add P (C, cdec)) Object = Some(C',fs,ms)"
      by(simp add: class_def fun_upd_apply)
   from assms cls have "Mm = map_option (\<lambda>m. (m, Object)) \<circ> map_of ms" by(auto elim!: Methods.cases)
   with assms cls' show ?thesis
    by(auto simp: is_class_def fun_upd_apply intro!: sees_methods_Object)
 qed
 
 lemma class_add_sees_methods_rev_Obj:
 assumes "class_add P (C, cdec) \<turnstile> Object sees_methods Mm" and nObj: "C \<noteq> Object"
 shows "P \<turnstile> Object sees_methods Mm"
 proof -
   from assms obtain C' fs ms where cls: "class (class_add P (C, cdec)) Object = Some(C',fs,ms)"
      by(auto elim!: Methods.cases)
   with nObj have cls': "class P Object = Some(C',fs,ms)"
      by(simp add: class_def fun_upd_apply)
   from assms cls have "Mm = map_option (\<lambda>m. (m, Object)) \<circ> map_of ms" by(auto elim!: Methods.cases)
   with assms cls' show ?thesis
    by(auto simp: is_class_def fun_upd_apply intro!: sees_methods_Object)
 qed
 
 lemma class_add_sees_method:
 assumes "P \<turnstile> C\<^sub>0 sees M\<^sub>0, b : Ts\<rightarrow>T = m in D" and "\<not> is_class P C"
 shows "class_add P (C, cdec) \<turnstile> C\<^sub>0 sees M\<^sub>0, b : Ts\<rightarrow>T = m in D"
 using assms by(auto simp: Method_def dest!: class_add_sees_methods[of P C\<^sub>0])
 
 lemma class_add_method:
 assumes md: "P \<turnstile> C\<^sub>0 sees M\<^sub>0, b : Ts\<rightarrow>T = m in D" and "\<not> is_class P C"
 shows "method P C\<^sub>0 M\<^sub>0 = method (class_add P (C, cdec)) C\<^sub>0 M\<^sub>0"
 using class_add_sees_method[OF assms, of cdec] md by simp
 
 lemma class_add_sees_method_rev:
  "\<lbrakk> class_add P (C, cdec) \<turnstile> C\<^sub>0 sees M\<^sub>0, b : Ts\<rightarrow>T = m in D;
     \<not> P \<turnstile> C\<^sub>0 \<preceq>\<^sup>* C \<rbrakk>
   \<Longrightarrow> P \<turnstile> C\<^sub>0 sees M\<^sub>0, b : Ts\<rightarrow>T = m in D"
  by(auto simp: Method_def dest!: class_add_sees_methods_rev)
 
 lemma class_add_sees_method_Obj:
  "\<lbrakk> P \<turnstile> Object sees M\<^sub>0, b : Ts\<rightarrow>T = m in D; C \<noteq> Object \<rbrakk>
   \<Longrightarrow> class_add P (C, cdec) \<turnstile> Object sees M\<^sub>0, b : Ts\<rightarrow>T = m in D"
  by(auto simp: Method_def dest!: class_add_sees_methods_Obj[where P=P])
 
 lemma class_add_sees_method_rev_Obj:
  "\<lbrakk> class_add P (C, cdec) \<turnstile> Object sees M\<^sub>0, b : Ts\<rightarrow>T = m in D; C \<noteq> Object \<rbrakk>
   \<Longrightarrow> P \<turnstile> Object sees M\<^sub>0, b : Ts\<rightarrow>T = m in D"
  by(auto simp: Method_def dest!: class_add_sees_methods_rev_Obj[where P=P])
 
 subsection "Types and states"
 
 lemma class_add_is_type:
  "is_type P T \<Longrightarrow> is_type (class_add P (C, cdec)) T"
  by(cases cdec, simp add: is_type_def is_class_def class_def fun_upd_apply split: ty.splits)
 
 lemma class_add_types:
  "types P \<subseteq> types (class_add P (C, cdec))"
 using class_add_is_type by(cases cdec, clarsimp)
 
 lemma class_add_states:
  "states P mxs mxl \<subseteq> states (class_add P (C, cdec)) mxs mxl"
 proof -
   let ?A = "types P" and ?B = "types (class_add P (C, cdec))"
   have ab: "?A \<subseteq> ?B" by(rule class_add_types)
-  moreover have "\<And>n. list n ?A \<subseteq> list n ?B" using ab by(rule list_mono)
-  moreover have "list mxl (err ?A) \<subseteq> list mxl (err ?B)" using err_mono[OF ab] by(rule list_mono)
+  moreover have "\<And>n. nlists n ?A \<subseteq> nlists n ?B" using ab by(rule nlists_mono)
+  moreover have "nlists mxl (err ?A) \<subseteq> nlists mxl (err ?B)" using err_mono[OF ab] by(rule nlists_mono)
   ultimately show ?thesis by(auto simp: JVM_states_unfold intro!: err_mono opt_mono)
 qed
 
 lemma class_add_check_types:
  "check_types P mxs mxl \<tau>s \<Longrightarrow> check_types (class_add P (C, cdec)) mxs mxl \<tau>s"
 using class_add_states by(fastforce simp: check_types_def)
 
 subsection "Subclasses and subtypes"
 
 lemma class_add_subcls:
  "\<lbrakk> P \<turnstile> D \<preceq>\<^sup>* D'; \<not> is_class P C \<rbrakk>
  \<Longrightarrow> class_add P (C, cdec) \<turnstile> D \<preceq>\<^sup>* D'"
 proof(induct rule: rtrancl.induct)
   case (rtrancl_into_rtrancl a b c)
   then have "b \<noteq> C" by(clarsimp simp: is_class_def dest!: subcls1D)
   with rtrancl_into_rtrancl show ?case
    by(fastforce dest!: subcls1D simp: class_def fun_upd_apply
                 intro!: rtrancl_trans[of a b] subcls1I)
 qed(simp)
 
 lemma class_add_subcls_rev:
  "\<lbrakk> class_add P (C, cdec) \<turnstile> D \<preceq>\<^sup>* D'; \<not>P \<turnstile> D \<preceq>\<^sup>* C \<rbrakk>
  \<Longrightarrow> P \<turnstile> D \<preceq>\<^sup>* D'"
 proof(induct rule: rtrancl.induct)
   case (rtrancl_into_rtrancl a b c)
   then have "b \<noteq> C" by(clarsimp simp: is_class_def dest!: subcls1D)
   with rtrancl_into_rtrancl show ?case
    by(fastforce dest!: subcls1D simp: class_def fun_upd_apply
                 intro!: rtrancl_trans[of a b] subcls1I)
 qed(simp)
 
 lemma class_add_subtype:
  "\<lbrakk> subtype P x y; \<not> is_class P C \<rbrakk>
  \<Longrightarrow> subtype (class_add P (C, cdec)) x y"
 proof(induct rule: widen.induct)
   case (widen_subcls C D)
   then show ?case using class_add_subcls by simp
 qed(simp+)
 
 lemma class_add_widens:
  "\<lbrakk> P \<turnstile> Ts [\<le>] Ts'; \<not> is_class P C \<rbrakk>
  \<Longrightarrow> (class_add P (C, cdec)) \<turnstile> Ts [\<le>] Ts'"
 using class_add_subtype by (metis (no_types) list_all2_mono)
 
 lemma class_add_sup_ty_opt:
  "\<lbrakk> P \<turnstile> l1 \<le>\<^sub>\<top> l2; \<not> is_class P C \<rbrakk>
   \<Longrightarrow> class_add P (C, cdec) \<turnstile> l1 \<le>\<^sub>\<top> l2"
 using class_add_subtype by(auto simp: sup_ty_opt_def Err.le_def lesub_def split: err.splits)
 
 lemma class_add_sup_loc:
 "\<lbrakk> P \<turnstile> LT [\<le>\<^sub>\<top>] LT'; \<not> is_class P C \<rbrakk>
  \<Longrightarrow> class_add P (C, cdec) \<turnstile> LT [\<le>\<^sub>\<top>] LT'"
 using class_add_sup_ty_opt[where P=P and C=C] by (simp add: list.rel_mono_strong)
 
 lemma class_add_sup_state:
  "\<lbrakk> P \<turnstile> \<tau> \<le>\<^sub>i \<tau>'; \<not> is_class P C \<rbrakk>
   \<Longrightarrow> class_add P (C, cdec) \<turnstile> \<tau> \<le>\<^sub>i \<tau>'"
 using class_add_subtype class_add_sup_ty_opt
  by(auto simp: sup_state_def Listn.le_def Product.le_def lesub_def class_add_widens
                class_add_sup_ty_opt list_all2_mono)
 
 lemma class_add_sup_state_opt:
  "\<lbrakk> P \<turnstile> \<tau> \<le>' \<tau>'; \<not> is_class P C \<rbrakk>
  \<Longrightarrow> class_add P (C, cdec) \<turnstile> \<tau> \<le>' \<tau>'"
  by(auto simp: sup_state_opt_def Opt.le_def lesub_def class_add_widens
                class_add_sup_ty_opt list_all2_mono)
 
 subsection "Effect"
 
 lemma class_add_is_relevant_class:
  "\<lbrakk> is_relevant_class i P C\<^sub>0; \<not> is_class P C \<rbrakk>
   \<Longrightarrow> is_relevant_class i (class_add P (C, cdec)) C\<^sub>0"
   by(cases i, auto simp: class_add_subcls)
 
 lemma class_add_is_relevant_class_rev:
 assumes irc: "is_relevant_class i (class_add P (C, cdec)) C\<^sub>0"
   and ncp: "\<And>cd D'. cd \<in> set P \<Longrightarrow> \<not>P \<turnstile> fst cd \<preceq>\<^sup>* C"
   and wfxp: "wf_syscls P"
 shows "is_relevant_class i P C\<^sub>0"
 using assms
 proof(cases i)
   case (Getfield F D) with assms
   show ?thesis by(fastforce simp: wf_syscls_def sys_xcpts_def dest!: class_add_subcls_rev)
 next
   case (Putfield F D) with assms
   show ?thesis by(fastforce simp: wf_syscls_def sys_xcpts_def dest!: class_add_subcls_rev)
 next
   case (Checkcast D) with assms
   show ?thesis by(fastforce simp: wf_syscls_def sys_xcpts_def dest!: class_add_subcls_rev)
 qed(simp_all)
 
 lemma class_add_is_relevant_entry:
  "\<lbrakk> is_relevant_entry P i pc e; \<not> is_class P C \<rbrakk>
   \<Longrightarrow> is_relevant_entry (class_add P (C, cdec)) i pc e"
  by(clarsimp simp: is_relevant_entry_def class_add_is_relevant_class)
 
 lemma class_add_is_relevant_entry_rev:
  "\<lbrakk> is_relevant_entry (class_add P (C, cdec)) i pc e; 
     \<And>cd D'. cd \<in> set P \<Longrightarrow> \<not>P \<turnstile> fst cd \<preceq>\<^sup>* C;
     wf_syscls P \<rbrakk>
   \<Longrightarrow> is_relevant_entry P i pc e"
  by(auto simp: is_relevant_entry_def dest!: class_add_is_relevant_class_rev)
 
 lemma class_add_relevant_entries:
  "\<not> is_class P C
   \<Longrightarrow> set (relevant_entries P i pc xt) \<subseteq> set (relevant_entries (class_add P (C, cdec)) i pc xt)"
  by(clarsimp simp: relevant_entries_def class_add_is_relevant_entry)
 
 lemma class_add_relevant_entries_eq:
 assumes wf: "wf_prog wf_md P" and nclass: "\<not> is_class P C"
 shows "relevant_entries P i pc xt = relevant_entries (class_add P (C, cdec)) i pc xt"
 proof -
   have ncp: "\<And>cd D'. cd \<in> set P \<Longrightarrow> \<not>P \<turnstile> fst cd \<preceq>\<^sup>* C"
    by(rule wf_subcls_nCls'[OF assms])
   moreover from wf have wfsys: "wf_syscls P" by(simp add: wf_prog_def)
   moreover
   note class_add_is_relevant_entry[OF _ nclass, of i pc _ cdec]
        class_add_is_relevant_entry_rev[OF _ ncp wfsys, of cdec i pc]
   ultimately show ?thesis by (metis filter_cong relevant_entries_def)
 qed
 
 lemma class_add_norm_eff_pc:
 assumes ne: "\<forall>(pc',\<tau>') \<in> set (norm_eff i P pc \<tau>). pc' < mpc"
 shows "\<forall>(pc',\<tau>') \<in> set (norm_eff i (class_add P (C, cdec)) pc \<tau>). pc' < mpc"
 using assms by(cases i, auto simp: norm_eff_def)
 
 lemma class_add_norm_eff_sup_state_opt:
 assumes ne: "\<forall>(pc',\<tau>') \<in> set (norm_eff i P pc \<tau>). P \<turnstile> \<tau>' \<le>' \<tau>s!pc'"
    and nclass: "\<not> is_class P C" and app: "app\<^sub>i (i, P, pc, mxs, T, \<tau>)"
 shows "\<forall>(pc',\<tau>') \<in> set (norm_eff i (class_add P (C, cdec)) pc \<tau>). (class_add P (C, cdec)) \<turnstile> \<tau>' \<le>' \<tau>s!pc'"
 proof -
   obtain ST LT where "\<tau> = (ST,LT)" by(cases \<tau>)
   with assms show ?thesis proof(cases i)
   qed(fastforce simp: norm_eff_def
                 dest!: class_add_field[where cdec=cdec] class_add_method[where cdec=cdec]
                        class_add_sup_loc[OF _ nclass] class_add_subtype[OF _ nclass]
                        class_add_widens[OF _ nclass] class_add_sup_state_opt[OF _ nclass])+
 qed
 
 lemma class_add_xcpt_eff_eq:
 assumes wf: "wf_prog wf_md P" and nclass: "\<not> is_class P C"
 shows "xcpt_eff i P pc \<tau> xt = xcpt_eff i (class_add P (C, cdec)) pc \<tau> xt"
 using class_add_relevant_entries_eq[OF assms, of i pc xt cdec] by(cases \<tau>, simp add: xcpt_eff_def)
 
 lemma class_add_eff_pc:
 assumes eff: "\<forall>(pc',\<tau>') \<in> set (eff i P pc xt (Some \<tau>)). pc' < mpc"
   and wf: "wf_prog wf_md P" and nclass: "\<not> is_class P C"
 shows "\<forall>(pc',\<tau>') \<in> set (eff i (class_add P (C, cdec)) pc xt (Some \<tau>)). pc' < mpc"
 using eff class_add_norm_eff_pc class_add_xcpt_eff_eq[OF wf nclass]
   by(auto simp: norm_eff_def eff_def)
 
 lemma class_add_eff_sup_state_opt:
 assumes eff: "\<forall>(pc',\<tau>') \<in> set (eff i P pc xt (Some \<tau>)). P \<turnstile> \<tau>' \<le>' \<tau>s!pc'"
   and wf: "wf_prog wf_md P"and nclass: "\<not> is_class P C"
   and app: "app\<^sub>i (i, P, pc, mxs, T, \<tau>)"
 shows "\<forall>(pc',\<tau>') \<in> set (eff i (class_add P (C, cdec)) pc xt (Some \<tau>)).
          (class_add P (C, cdec)) \<turnstile> \<tau>' \<le>' \<tau>s!pc'"
 proof -
   from eff have ne: "\<forall>(pc', \<tau>')\<in>set (norm_eff i P pc \<tau>). P \<turnstile> \<tau>' \<le>' \<tau>s ! pc'"
    by(simp add: norm_eff_def eff_def)
   from eff have "\<forall>(pc', \<tau>')\<in>set (xcpt_eff i P pc \<tau> xt). P \<turnstile> \<tau>' \<le>' \<tau>s ! pc'"
    by(simp add: xcpt_eff_def eff_def)
   with class_add_norm_eff_sup_state_opt[OF ne nclass app]
        class_add_xcpt_eff_eq[OF wf nclass]class_add_sup_state_opt[OF _ nclass]
     show ?thesis by(cases cdec, auto simp: eff_def norm_eff_def xcpt_app_def)
 qed
 
 
 lemma class_add_app\<^sub>i:
 assumes "app\<^sub>i (i, P, pc, mxs, T\<^sub>r, ST, LT)" and "\<not> is_class P C"
 shows "app\<^sub>i (i, class_add P (C, cdec), pc, mxs, T\<^sub>r, ST, LT)"
 using assms
 proof(cases i)
   case New then show ?thesis using assms by(fastforce simp: is_class_def class_def fun_upd_apply)
 next
   case Getfield then show ?thesis using assms
    by(auto simp: class_add_subtype dest!: class_add_sees_field[where P=P])
 next
   case Getstatic then show ?thesis using assms by(auto dest!: class_add_sees_field[where P=P])
 next
   case Putfield then show ?thesis using assms
    by(auto dest!: class_add_subtype[where P=P] class_add_sees_field[where P=P])
 next
   case Putstatic then show ?thesis using assms
    by(auto dest!: class_add_subtype[where P=P] class_add_sees_field[where P=P])
 next
   case Checkcast then show ?thesis using assms
    by(clarsimp simp: is_class_def class_def fun_upd_apply)
 next
   case Invoke then show ?thesis using assms
     by(fastforce dest!: class_add_widens[where P=P] class_add_sees_method[where P=P])
 next
   case Invokestatic then show ?thesis using assms
     by(fastforce dest!: class_add_widens[where P=P] class_add_sees_method[where P=P])
 next
   case Return then show ?thesis using assms by(clarsimp simp: class_add_subtype)
 qed(simp+)
 
 lemma class_add_xcpt_app:
 assumes xa: "xcpt_app i P pc mxs xt \<tau>"
  and wf: "wf_prog wf_md P" and nclass: "\<not> is_class P C"
 shows "xcpt_app i (class_add P (C, cdec)) pc mxs xt \<tau>"
 using xa class_add_relevant_entries_eq[OF wf nclass] nclass
  by(auto simp: xcpt_app_def is_class_def class_def fun_upd_apply) auto
 
 lemma class_add_app:
 assumes app: "app i P mxs T pc mpc xt t"
  and wf: "wf_prog wf_md P" and nclass: "\<not> is_class P C"
 shows "app i (class_add P (C, cdec)) mxs T pc mpc xt t"
 proof(cases t)
   case (Some \<tau>)
   let ?P = "class_add P (C, cdec)"
   from assms Some have eff: "\<forall>(pc', \<tau>')\<in>set (eff i P pc xt \<lfloor>\<tau>\<rfloor>). pc' < mpc" by(simp add: app_def)
   from assms Some have app\<^sub>i: "app\<^sub>i (i,P,pc,mxs,T,\<tau>)" by(simp add: app_def)
   with class_add_app\<^sub>i[OF _ nclass] Some have "app\<^sub>i (i,?P,pc,mxs,T,\<tau>)" by(cases \<tau>,simp)
   moreover
   from app class_add_xcpt_app[OF _ wf nclass] Some
   have "xcpt_app i ?P pc mxs xt \<tau>" by(simp add: app_def del: xcpt_app_def)
   moreover
   from app class_add_eff_pc[OF eff wf nclass] Some
   have "\<forall>(pc',\<tau>') \<in> set (eff i ?P pc xt t). pc' < mpc" by auto
   moreover note app Some
   ultimately show ?thesis by(simp add: app_def)
 qed(simp)
 
 subsection "Well-formedness and well-typedness"
 
 lemma class_add_wf_mdecl:
   "\<lbrakk> wf_mdecl wf_md P C\<^sub>0 md;
      \<And>C\<^sub>0 md. wf_md P C\<^sub>0 md \<Longrightarrow> wf_md (class_add P (C, cdec)) C\<^sub>0 md \<rbrakk>
   \<Longrightarrow> wf_mdecl wf_md (class_add P (C, cdec)) C\<^sub>0 md"
  by(clarsimp simp: wf_mdecl_def class_add_is_type)
 
 lemma class_add_wf_mdecl':
 assumes wfd: "wf_mdecl wf_md P C\<^sub>0 md"
   and ms: "(C\<^sub>0,S,fs,ms) \<in> set P" and md: "md \<in> set ms"
   and wf_md': "\<And>C\<^sub>0 S fs ms m.\<lbrakk>(C\<^sub>0,S,fs,ms) \<in> set P; m \<in> set ms\<rbrakk> \<Longrightarrow> wf_md' (class_add P (C, cdec)) C\<^sub>0 m"
 shows "wf_mdecl wf_md' (class_add P (C, cdec)) C\<^sub>0 md"
 using assms by(clarsimp simp: wf_mdecl_def class_add_is_type)
 
 lemma class_add_wf_cdecl:
 assumes wfcd: "wf_cdecl wf_md P cd" and cdP: "cd \<in> set P"
  and ncp: "\<not> P \<turnstile> fst cd \<preceq>\<^sup>* C" and dist: "distinct_fst P"
  and wfmd: "\<And>C\<^sub>0 md. wf_md P C\<^sub>0 md \<Longrightarrow> wf_md (class_add P (C, cdec)) C\<^sub>0 md"
  and nclass: "\<not> is_class P C"
 shows "wf_cdecl wf_md (class_add P (C, cdec)) cd"
 proof -
   let ?P = "class_add P (C, cdec)"
   obtain C1 D fs ms where [simp]: "cd = (C1,(D,fs,ms))" by(cases cd)
   from wfcd
   have "\<forall>f\<in>set fs. wf_fdecl ?P f" by(auto simp: wf_cdecl_def wf_fdecl_def class_add_is_type)
   moreover
   from wfcd wfmd class_add_wf_mdecl
   have "\<forall>m\<in>set ms. wf_mdecl wf_md ?P C1 m" by(auto simp: wf_cdecl_def)
   moreover
   have "C1 \<noteq> Object \<Longrightarrow> is_class ?P D \<and> \<not> ?P \<turnstile> D \<preceq>\<^sup>* C1
     \<and> (\<forall>(M,b,Ts,T,m)\<in>set ms.
         \<forall>D' b' Ts' T' m'. ?P \<turnstile> D sees M,b':Ts' \<rightarrow> T' = m' in D' \<longrightarrow>
                        b = b' \<and> ?P \<turnstile> Ts' [\<le>] Ts \<and> ?P \<turnstile> T \<le> T')"
   proof -
     assume nObj[simp]: "C1 \<noteq> Object"
     with cdP dist have sub1: "P \<turnstile> C1 \<prec>\<^sup>1 D" by(auto simp: class_def intro!: subcls1I map_of_SomeI)
     with ncp have ncp': "\<not> P \<turnstile> D \<preceq>\<^sup>* C" by(auto simp: converse_rtrancl_into_rtrancl)
     with wfcd
     have clsD: "is_class ?P D"
      by(auto simp: wf_cdecl_def is_class_def class_def fun_upd_apply)
     moreover
     from wfcd sub1
     have "\<not> ?P \<turnstile> D \<preceq>\<^sup>* C1" by(auto simp: wf_cdecl_def dest!: class_add_subcls_rev[OF _ ncp'])
     moreover
     have "\<And>M b Ts T m D' b' Ts' T' m'. (M,b,Ts,T,m) \<in> set ms
             \<Longrightarrow> ?P \<turnstile> D sees M,b':Ts' \<rightarrow> T' = m' in D'
             \<Longrightarrow> b = b' \<and> ?P \<turnstile> Ts' [\<le>] Ts \<and> ?P \<turnstile> T \<le> T'"
     proof -
       fix M b Ts T m D' b' Ts' T' m'
       assume ms: "(M,b,Ts,T,m) \<in> set ms" and meth': "?P \<turnstile> D sees M,b':Ts' \<rightarrow> T' = m' in D'"
       with sub1
       have "P \<turnstile> D sees M,b':Ts' \<rightarrow> T' = m' in D'"
        by(fastforce dest!: class_add_sees_method_rev[OF _ ncp'])
       moreover
       with wfcd ms meth'
       have "b = b' \<and> P \<turnstile> Ts' [\<le>] Ts \<and> P \<turnstile> T \<le> T'"
        by(cases m', fastforce simp: wf_cdecl_def elim!: ballE[where x="(M,b,Ts,T,m)"])
       ultimately show "b = b' \<and> ?P \<turnstile> Ts' [\<le>] Ts \<and> ?P \<turnstile> T \<le> T'"
        by(auto dest!: class_add_subtype[OF _ nclass] class_add_widens[OF _ nclass])
     qed
     ultimately show ?thesis by clarsimp
   qed
   moreover note wfcd
   ultimately show ?thesis by(simp add: wf_cdecl_def)
 qed
 
 lemma class_add_wf_cdecl':
 assumes wfcd: "wf_cdecl wf_md P cd" and cdP: "cd \<in> set P"
  and ncp: "\<not>P \<turnstile> fst cd \<preceq>\<^sup>* C" and dist: "distinct_fst P"
  and wfmd: "\<And>C\<^sub>0 S fs ms m.\<lbrakk>(C\<^sub>0,S,fs,ms) \<in> set P; m \<in> set ms\<rbrakk> \<Longrightarrow> wf_md' (class_add P (C, cdec)) C\<^sub>0 m"
  and nclass: "\<not> is_class P C"
 shows "wf_cdecl wf_md' (class_add P (C, cdec)) cd"
 proof -
   let ?P = "class_add P (C, cdec)"
   obtain C1 D fs ms where [simp]: "cd = (C1,(D,fs,ms))" by(cases cd)
   from wfcd
   have "\<forall>f\<in>set fs. wf_fdecl ?P f" by(auto simp: wf_cdecl_def wf_fdecl_def class_add_is_type)
   moreover
   from cdP wfcd wfmd
   have "\<forall>m\<in>set ms. wf_mdecl wf_md' ?P C1 m"
     by(auto simp: wf_cdecl_def wf_mdecl_def class_add_is_type)
   moreover
   have "C1 \<noteq> Object \<Longrightarrow> is_class ?P D \<and> \<not> ?P \<turnstile> D \<preceq>\<^sup>* C1
     \<and> (\<forall>(M,b,Ts,T,m)\<in>set ms.
         \<forall>D' b' Ts' T' m'. ?P \<turnstile> D sees M,b':Ts' \<rightarrow> T' = m' in D' \<longrightarrow>
                        b = b' \<and> ?P \<turnstile> Ts' [\<le>] Ts \<and> ?P \<turnstile> T \<le> T')"
   proof -
     assume nObj[simp]: "C1 \<noteq> Object"
     with cdP dist have sub1: "P \<turnstile> C1 \<prec>\<^sup>1 D" by(auto simp: class_def intro!: subcls1I map_of_SomeI)
     with ncp have ncp': "\<not> P \<turnstile> D \<preceq>\<^sup>* C" by(auto simp: converse_rtrancl_into_rtrancl)
     with wfcd
     have clsD: "is_class ?P D"
      by(auto simp: wf_cdecl_def is_class_def class_def fun_upd_apply)
     moreover
     from wfcd sub1
     have "\<not> ?P \<turnstile> D \<preceq>\<^sup>* C1" by(auto simp: wf_cdecl_def dest!: class_add_subcls_rev[OF _ ncp'])
     moreover
     have "\<And>M b Ts T m D' b' Ts' T' m'. (M,b,Ts,T,m) \<in> set ms
             \<Longrightarrow> ?P \<turnstile> D sees M,b':Ts' \<rightarrow> T' = m' in D'
             \<Longrightarrow> b = b' \<and> ?P \<turnstile> Ts' [\<le>] Ts \<and> ?P \<turnstile> T \<le> T'"
     proof -
       fix M b Ts T m D' b' Ts' T' m'
       assume ms: "(M,b,Ts,T,m) \<in> set ms" and meth': "?P \<turnstile> D sees M,b':Ts' \<rightarrow> T' = m' in D'"
       with sub1
       have "P \<turnstile> D sees M,b':Ts' \<rightarrow> T' = m' in D'"
        by(fastforce dest!: class_add_sees_method_rev[OF _ ncp'])
       moreover
       with wfcd ms meth'
       have "b = b' \<and> P \<turnstile> Ts' [\<le>] Ts \<and> P \<turnstile> T \<le> T'"
        by(cases m', fastforce simp: wf_cdecl_def elim!: ballE[where x="(M,b,Ts,T,m)"])
       ultimately show "b = b' \<and> ?P \<turnstile> Ts' [\<le>] Ts \<and> ?P \<turnstile> T \<le> T'"
        by(auto dest!: class_add_subtype[OF _ nclass] class_add_widens[OF _ nclass])
     qed
     ultimately show ?thesis by clarsimp
   qed
   moreover note wfcd
   ultimately show ?thesis by(simp add: wf_cdecl_def)
 qed
 
 lemma class_add_wt_start:
  "\<lbrakk> wt_start P C\<^sub>0 b Ts mxl \<tau>s; \<not> is_class P C \<rbrakk>
  \<Longrightarrow> wt_start (class_add P (C, cdec)) C\<^sub>0 b Ts mxl \<tau>s"
 using class_add_sup_state_opt by(clarsimp simp: wt_start_def split: staticb.splits)
 
 lemma class_add_wt_instr:
 assumes wti: "P,T,mxs,mpc,xt \<turnstile> i,pc :: \<tau>s"
  and wf: "wf_prog wf_md P" and nclass: "\<not> is_class P C"
 shows "class_add P (C, cdec),T,mxs,mpc,xt \<turnstile> i,pc :: \<tau>s"
 proof -
   let ?P = "class_add P (C, cdec)"
   from wti have eff: "\<forall>(pc', \<tau>')\<in>set (eff i P pc xt (\<tau>s ! pc)). P \<turnstile> \<tau>' \<le>' \<tau>s ! pc'"
    by(simp add: wt_instr_def)
   from wti have app\<^sub>i: "\<tau>s!pc \<noteq> None \<Longrightarrow> app\<^sub>i (i,P,pc,mxs,T,the (\<tau>s!pc))"
    by(simp add: wt_instr_def app_def)
   from wti class_add_app[OF _ wf nclass]
   have "app i ?P mxs T pc mpc xt (\<tau>s!pc)" by(simp add: wt_instr_def)
   moreover
   have "\<forall>(pc',\<tau>') \<in> set (eff i ?P pc xt (\<tau>s!pc)). ?P \<turnstile> \<tau>' \<le>' \<tau>s!pc'"
   proof(cases "\<tau>s!pc")
     case Some with eff class_add_eff_sup_state_opt[OF _ wf nclass app\<^sub>i] show ?thesis by auto
   qed(simp add: eff_def)
   moreover note wti
   ultimately show ?thesis by(clarsimp simp: wt_instr_def)
 qed
 
 lemma class_add_wt_method:
 assumes wtm: "wt_method P C\<^sub>0 b Ts T\<^sub>r mxs mxl\<^sub>0 is xt (\<Phi> C\<^sub>0 M\<^sub>0)"
  and wf: "wf_prog wf_md P" and nclass: "\<not> is_class P C"
 shows "wt_method (class_add P (C, cdec)) C\<^sub>0 b Ts T\<^sub>r mxs mxl\<^sub>0 is xt (\<Phi> C\<^sub>0 M\<^sub>0)"
 proof -
   let ?P = "class_add P (C, cdec)"
   let ?\<tau>s = "\<Phi> C\<^sub>0 M\<^sub>0"
   from wtm class_add_check_types
   have "check_types ?P mxs ((case b of Static \<Rightarrow> 0 | NonStatic \<Rightarrow> 1)+size Ts+mxl\<^sub>0) (map OK ?\<tau>s)"
    by(simp add: wt_method_def)
   moreover
   from wtm class_add_wt_start nclass
   have "wt_start ?P C\<^sub>0 b Ts mxl\<^sub>0 ?\<tau>s" by(simp add: wt_method_def)
   moreover
   from wtm class_add_wt_instr[OF _ wf nclass]
   have "\<forall>pc < size is. ?P,T\<^sub>r,mxs,size is,xt \<turnstile> is!pc,pc :: ?\<tau>s" by(clarsimp simp: wt_method_def)
   moreover note wtm
   ultimately
   show ?thesis by(clarsimp simp: wt_method_def)
 qed
 
 lemma class_add_wt_method':
  "\<lbrakk> (\<lambda>P C (M,b,Ts,T\<^sub>r,(mxs,mxl\<^sub>0,is,xt)). wt_method P C b Ts T\<^sub>r mxs mxl\<^sub>0 is xt (\<Phi> C M)) P C\<^sub>0 md;
     wf_prog wf_md P; \<not> is_class P C \<rbrakk>
     \<Longrightarrow> (\<lambda>P C (M,b,Ts,T\<^sub>r,(mxs,mxl\<^sub>0,is,xt)). wt_method P C b Ts T\<^sub>r mxs mxl\<^sub>0 is xt (\<Phi> C M))
             (class_add P (C, cdec)) C\<^sub>0 md"
  by(clarsimp simp: class_add_wt_method)
 
 subsection \<open> @{text "distinct_fst"} \<close>
 
 lemma class_add_distinct_fst:
 "\<lbrakk> distinct_fst P; \<not> is_class P C \<rbrakk>
   \<Longrightarrow> distinct_fst (class_add P (C, cdec))"
  by(clarsimp simp: distinct_fst_def is_class_def class_def)
 
 subsection "Conformance"
 
 lemma class_add_conf:
  "\<lbrakk> P,h \<turnstile> v :\<le> T; \<not> is_class P C \<rbrakk>
  \<Longrightarrow> class_add P (C, cdec),h \<turnstile> v :\<le> T"
  by(clarsimp simp: conf_def class_add_subtype)
 
 lemma class_add_oconf:
 fixes obj::obj
 assumes oc: "P,h \<turnstile> obj \<surd>" and ns: "\<not> is_class P C"
   and ncp: "\<And>D'. P \<turnstile> fst(obj) \<preceq>\<^sup>* D' \<Longrightarrow> D' \<noteq> C"
 shows "(class_add P (C, cdec)),h \<turnstile> obj \<surd>"
 proof -
   obtain C\<^sub>0 fs where [simp]: "obj=(C\<^sub>0,fs)" by(cases obj)
   from oc have
     oc': "\<And>F D T. P \<turnstile> C\<^sub>0 has F,NonStatic:T in D \<Longrightarrow> (\<exists>v. fs (F, D) = \<lfloor>v\<rfloor> \<and> P,h \<turnstile> v :\<le> T)"
     by(simp add: oconf_def)
   have "\<And>F D T. class_add P (C, cdec) \<turnstile> C\<^sub>0 has F,NonStatic:T in D
                        \<Longrightarrow> \<exists>v. fs(F,D) = Some v \<and> class_add P (C, cdec),h \<turnstile> v :\<le> T"
   proof -
     fix F D T assume "class_add P (C, cdec) \<turnstile> C\<^sub>0 has F,NonStatic:T in D"
     with class_add_has_field_rev[OF _ ncp] have meth: "P \<turnstile> C\<^sub>0 has F,NonStatic:T in D" by simp
     then show "\<exists>v. fs(F,D) = Some v \<and> class_add P (C, cdec),h \<turnstile> v :\<le> T"
     using oc'[OF meth] class_add_conf[OF _ ns] by(fastforce simp: oconf_def)
   qed
   then show ?thesis by(simp add: oconf_def)
 qed
 
 lemma class_add_soconf:
 assumes soc: "P,h,C\<^sub>0 \<turnstile>\<^sub>s sfs \<surd>" and ns: "\<not> is_class P C"
   and ncp: "\<And>D'. P \<turnstile> C\<^sub>0 \<preceq>\<^sup>* D' \<Longrightarrow> D' \<noteq> C"
 shows "(class_add P (C, cdec)),h,C\<^sub>0 \<turnstile>\<^sub>s sfs \<surd>"
 proof -
   from soc have
     oc': "\<And>F T. P \<turnstile> C\<^sub>0 has F,Static:T in C\<^sub>0 \<Longrightarrow> (\<exists>v. sfs F = \<lfloor>v\<rfloor> \<and> P,h \<turnstile> v :\<le> T)"
     by(simp add: soconf_def)
   have "\<And>F T. class_add P (C, cdec) \<turnstile> C\<^sub>0 has F,Static:T in C\<^sub>0
                        \<Longrightarrow> \<exists>v. sfs F = Some v \<and> class_add P (C, cdec),h \<turnstile> v :\<le> T"
   proof -
     fix F T assume "class_add P (C, cdec) \<turnstile> C\<^sub>0 has F,Static:T in C\<^sub>0"
     with class_add_has_field_rev[OF _ ncp] have meth: "P \<turnstile> C\<^sub>0 has F,Static:T in C\<^sub>0" by simp
     then show "\<exists>v. sfs F = Some v \<and> class_add P (C, cdec),h \<turnstile> v :\<le> T"
     using oc'[OF meth] class_add_conf[OF _ ns] by(fastforce simp: soconf_def)
   qed
   then show ?thesis by(simp add: soconf_def)
 qed
 
 lemma class_add_hconf:
 assumes "P \<turnstile> h \<surd>" and "\<not> is_class P C"
  and "\<And>a obj D'. h a = Some obj \<Longrightarrow> P \<turnstile> fst(obj) \<preceq>\<^sup>* D' \<Longrightarrow> D' \<noteq> C"
 shows "class_add P (C, cdec) \<turnstile> h \<surd>"
 using assms by(auto simp: hconf_def intro!: class_add_oconf)
 
 lemma class_add_hconf_wf:
 assumes wf: "wf_prog wf_md P" and "P \<turnstile> h \<surd>" and "\<not> is_class P C"
  and "\<And>a obj. h a = Some obj \<Longrightarrow> fst(obj) \<noteq> C"
 shows "class_add P (C, cdec) \<turnstile> h \<surd>"
 using wf_subcls_nCls[OF wf] assms by(fastforce simp: hconf_def intro!: class_add_oconf)
 
 lemma class_add_shconf:
 assumes "P,h \<turnstile>\<^sub>s sh \<surd>" and ns: "\<not> is_class P C"
  and "\<And>C sobj D'. sh C = Some sobj \<Longrightarrow> P \<turnstile> C \<preceq>\<^sup>* D' \<Longrightarrow> D' \<noteq> C"
 shows "class_add P (C, cdec),h \<turnstile>\<^sub>s sh \<surd>"
 using assms by(fastforce simp: shconf_def)
 
 lemma class_add_shconf_wf:
 assumes wf: "wf_prog wf_md P" and "P,h \<turnstile>\<^sub>s sh \<surd>" and "\<not> is_class P C"
  and "\<And>C sobj. sh C = Some sobj \<Longrightarrow> C \<noteq> C"
 shows "class_add P (C, cdec),h \<turnstile>\<^sub>s sh \<surd>"
 using wf_subcls_nCls[OF wf] assms by(fastforce simp: shconf_def)
 
 
 end
\ No newline at end of file
diff --git a/thys/JinjaDCI/BV/JVM_SemiType.thy b/thys/JinjaDCI/BV/JVM_SemiType.thy
--- a/thys/JinjaDCI/BV/JVM_SemiType.thy
+++ b/thys/JinjaDCI/BV/JVM_SemiType.thy
@@ -1,388 +1,388 @@
 (*  Title:      HOL/MicroJava/BV/JVM.thy
 
     Author:     Gerwin Klein
     Copyright   2000 TUM
 
 *)
 
 section \<open> The JVM Type System as Semilattice \<close>
 
 theory JVM_SemiType imports SemiType begin
 
 type_synonym ty\<^sub>l = "ty err list"
 type_synonym ty\<^sub>s = "ty list"
 type_synonym ty\<^sub>i = "ty\<^sub>s \<times> ty\<^sub>l"
 type_synonym ty\<^sub>i' = "ty\<^sub>i option"
 type_synonym ty\<^sub>m = "ty\<^sub>i' list"
 type_synonym ty\<^sub>P = "mname \<Rightarrow> cname \<Rightarrow> ty\<^sub>m"
 
 
 definition stk_esl :: "'c prog \<Rightarrow> nat \<Rightarrow> ty\<^sub>s esl"
 where
   "stk_esl P mxs \<equiv> upto_esl mxs (SemiType.esl P)"
 
 definition loc_sl :: "'c prog \<Rightarrow> nat \<Rightarrow> ty\<^sub>l sl"
 where
   "loc_sl P mxl \<equiv> Listn.sl mxl (Err.sl (SemiType.esl P))"
 
 definition sl :: "'c prog \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> ty\<^sub>i' err sl"
 where
   "sl P mxs mxl \<equiv>
   Err.sl(Opt.esl(Product.esl (stk_esl P mxs) (Err.esl(loc_sl P mxl))))"
 
 
 definition states :: "'c prog \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> ty\<^sub>i' err set"
 where "states P mxs mxl \<equiv> fst(sl P mxs mxl)"
 
 definition le :: "'c prog \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> ty\<^sub>i' err ord"
 where
   "le P mxs mxl \<equiv> fst(snd(sl P mxs mxl))"
 
 definition sup :: "'c prog \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> ty\<^sub>i' err binop"
 where
   "sup P mxs mxl \<equiv> snd(snd(sl P mxs mxl))"
 
 
 definition sup_ty_opt :: "['c prog,ty err,ty err] \<Rightarrow> bool" 
     ("_ \<turnstile> _ \<le>\<^sub>\<top> _" [71,71,71] 70)
 where
   "sup_ty_opt P \<equiv> Err.le (subtype P)"
 
 definition sup_state :: "['c prog,ty\<^sub>i,ty\<^sub>i] \<Rightarrow> bool"   
     ("_ \<turnstile> _ \<le>\<^sub>i _" [71,71,71] 70)
 where
   "sup_state P \<equiv> Product.le (Listn.le (subtype P)) (Listn.le (sup_ty_opt P))"
 
 definition sup_state_opt :: "['c prog,ty\<^sub>i',ty\<^sub>i'] \<Rightarrow> bool" 
     ("_ \<turnstile> _ \<le>'' _" [71,71,71] 70)
 where
   "sup_state_opt P \<equiv> Opt.le (sup_state P)"
 
 abbreviation
   sup_loc :: "['c prog,ty\<^sub>l,ty\<^sub>l] \<Rightarrow> bool"  ("_ \<turnstile> _ [\<le>\<^sub>\<top>] _"  [71,71,71] 70)
   where "P \<turnstile> LT [\<le>\<^sub>\<top>] LT' \<equiv> list_all2 (sup_ty_opt P) LT LT'"
 
 notation (ASCII)
   sup_ty_opt  ("_ |- _ <=T _" [71,71,71] 70) and
   sup_state  ("_ |- _ <=i _"  [71,71,71] 70) and
   sup_state_opt  ("_ |- _ <=' _"  [71,71,71] 70) and
   sup_loc  ("_ |- _ [<=T] _"  [71,71,71] 70)
 
 
 subsection "Unfolding"
 
 lemma JVM_states_unfold: 
-  "states P mxs mxl \<equiv> err(opt((Union {list n (types P) |n. n <= mxs}) \<times>
-                                 list mxl (err(types P))))"
+  "states P mxs mxl \<equiv> err(opt((Union {nlists n (types P) |n. n <= mxs}) \<times>
+                                 nlists mxl (err(types P))))"
 (*<*)
   apply (unfold states_def sl_def Opt.esl_def Err.sl_def
          stk_esl_def loc_sl_def Product.esl_def
          Listn.sl_def upto_esl_def SemiType.esl_def Err.esl_def)
   apply simp
   done
 (*>*)
 
 lemma JVM_le_unfold:
  "le P m n \<equiv> 
   Err.le(Opt.le(Product.le(Listn.le(subtype P))(Listn.le(Err.le(subtype P)))))" 
 (*<*)
   apply (unfold le_def sl_def Opt.esl_def Err.sl_def
          stk_esl_def loc_sl_def Product.esl_def  
          Listn.sl_def upto_esl_def SemiType.esl_def Err.esl_def) 
   apply simp
   done
 (*>*)
     
 lemma sl_def2:
   "JVM_SemiType.sl P mxs mxl \<equiv> 
   (states P mxs mxl, JVM_SemiType.le P mxs mxl, JVM_SemiType.sup P mxs mxl)"
 (*<*) by (unfold JVM_SemiType.sup_def states_def JVM_SemiType.le_def) simp (*>*)
 
 
 lemma JVM_le_conv:
   "le P m n (OK t1) (OK t2) = P \<turnstile> t1 \<le>' t2"
 (*<*) by (simp add: JVM_le_unfold Err.le_def lesub_def sup_state_opt_def  
                 sup_state_def sup_ty_opt_def) (*>*)
 
 lemma JVM_le_Err_conv:
   "le P m n = Err.le (sup_state_opt P)"
 (*<*) by (unfold sup_state_opt_def sup_state_def  
              sup_ty_opt_def JVM_le_unfold) simp (*>*)
 
 lemma err_le_unfold [iff]: 
   "Err.le r (OK a) (OK b) = r a b"
 (*<*) by (simp add: Err.le_def lesub_def) (*>*)
   
 
 subsection \<open> Semilattice \<close>
 lemma order_sup_state_opt' [intro, simp]:
   "wf_prog wf_mb P \<Longrightarrow> 
-      order (sup_state_opt P) (opt ((\<Union> {list n (types P) |n. n \<le> mxs} ) \<times> list (Suc (length Ts + mxl\<^sub>0)) (err (types P))))"   
+      order (sup_state_opt P) (opt ((\<Union> {nlists n (types P) |n. n \<le> mxs} ) \<times> nlists (Suc (length Ts + mxl\<^sub>0)) (err (types P))))"   
 (*<*) 
   apply (unfold sup_state_opt_def sup_state_def sup_ty_opt_def  ) 
   apply (blast intro:order_le_prodI) \<comment>\<open> use Listn.thy.order_listI2  \<close>
   done 
 (*<*) 
 lemma order_sup_state_opt'' [intro, simp]:
   "wf_prog wf_mb P \<Longrightarrow> 
-      order (sup_state_opt P) (opt ((\<Union> {list n (types P) |n. n \<le> mxs} ) \<times> list ((length Ts + mxl\<^sub>0)) (err (types P))))"   
+      order (sup_state_opt P) (opt ((\<Union> {nlists n (types P) |n. n \<le> mxs} ) \<times> nlists ((length Ts + mxl\<^sub>0)) (err (types P))))"   
 (*<*) 
   apply (unfold sup_state_opt_def sup_state_def sup_ty_opt_def  ) 
   apply (blast intro:order_le_prodI) \<comment>\<open> use Listn.thy.order_listI2  \<close>
   done 
 (*<*)
 (*
 lemma order_sup_state_opt [intro, simp]: 
   "wf_prog wf_mb P \<Longrightarrow> order (sup_state_opt P)"   
 (*<*) by (unfold sup_state_opt_def sup_state_def sup_ty_opt_def) blast (*>*)
 *)
 
 lemma semilat_JVM [intro?]:
   "wf_prog wf_mb P \<Longrightarrow> semilat (JVM_SemiType.sl P mxs mxl)"
 (*<*)
   apply (unfold JVM_SemiType.sl_def stk_esl_def loc_sl_def)  
   apply (blast intro: err_semilat_Product_esl err_semilat_upto_esl 
                       Listn_sl err_semilat_JType_esl)
   done
 (*>*)
 
 subsection \<open> Widening with @{text "\<top>"} \<close>
 
 lemma subtype_refl[iff]: "subtype P t t" (*<*) by (simp add: fun_of_def) (*>*)
 
 lemma sup_ty_opt_refl [iff]: "P \<turnstile> T \<le>\<^sub>\<top> T"
 (*<*)
   apply (unfold sup_ty_opt_def)
   apply (fold lesub_def)
   apply (rule le_err_refl)
   apply (simp add: lesub_def)
   done
 (*>*)
 
 lemma Err_any_conv [iff]: "P \<turnstile> Err \<le>\<^sub>\<top> T = (T = Err)"
 (*<*) by (unfold sup_ty_opt_def) (rule Err_le_conv [simplified lesub_def]) (*>*)
 
 lemma any_Err [iff]: "P \<turnstile> T \<le>\<^sub>\<top> Err"
 (*<*) by (unfold sup_ty_opt_def) (rule le_Err [simplified lesub_def]) (*>*)
 
 lemma OK_OK_conv [iff]:
   "P \<turnstile> OK T \<le>\<^sub>\<top> OK T' = P \<turnstile> T \<le> T'"
 (*<*) by (simp add: sup_ty_opt_def fun_of_def) (*>*)
 
 lemma any_OK_conv [iff]:
   "P \<turnstile> X \<le>\<^sub>\<top> OK T' = (\<exists>T. X = OK T \<and> P \<turnstile> T \<le> T')"
 (*<*)
   apply (unfold sup_ty_opt_def) 
   apply (rule le_OK_conv [simplified lesub_def])
   done  
 (*>*)
 
 lemma OK_any_conv:
  "P \<turnstile> OK T \<le>\<^sub>\<top> X = (X = Err \<or> (\<exists>T'. X = OK T' \<and> P \<turnstile> T \<le> T'))"
 (*<*)
   apply (unfold sup_ty_opt_def) 
   apply (rule OK_le_conv [simplified lesub_def])
   done
 (*>*)
 
 lemma sup_ty_opt_trans [intro?, trans]:
   "\<lbrakk>P \<turnstile> a \<le>\<^sub>\<top> b; P \<turnstile> b \<le>\<^sub>\<top> c\<rbrakk> \<Longrightarrow> P \<turnstile> a \<le>\<^sub>\<top> c"
 (*<*) by (auto intro: widen_trans  
            simp add: sup_ty_opt_def Err.le_def lesub_def fun_of_def
            split: err.splits) (*>*)
 
 
 subsection "Stack and Registers"
 
 lemma stk_convert:
   "P \<turnstile> ST [\<le>] ST' = Listn.le (subtype P) ST ST'"
 (*<*) by (simp add: Listn.le_def lesub_def) (*>*)
 
 lemma sup_loc_refl [iff]: "P \<turnstile> LT [\<le>\<^sub>\<top>] LT"
 (*<*) by (rule list_all2_refl) simp (*>*)
 
 lemmas sup_loc_Cons1 [iff] = list_all2_Cons1 [of "sup_ty_opt P"] for P
 
 lemma sup_loc_def:
   "P \<turnstile> LT [\<le>\<^sub>\<top>] LT' \<equiv> Listn.le (sup_ty_opt P) LT LT'"
 (*<*) by (simp add: Listn.le_def lesub_def) (*>*)
 
 lemma sup_loc_widens_conv [iff]:
   "P \<turnstile> map OK Ts [\<le>\<^sub>\<top>] map OK Ts' = P \<turnstile> Ts [\<le>] Ts'"
 (*<*)
   by (simp add: list_all2_map1 list_all2_map2)
 (*>*)
 
 
 lemma sup_loc_trans [intro?, trans]:
   "\<lbrakk>P \<turnstile> a [\<le>\<^sub>\<top>] b; P \<turnstile> b [\<le>\<^sub>\<top>] c\<rbrakk> \<Longrightarrow> P \<turnstile> a [\<le>\<^sub>\<top>] c"
 (*<*) by (rule list_all2_trans, rule sup_ty_opt_trans) (*>*)
 
 
 subsection "State Type"
 
 lemma sup_state_conv [iff]:
   "P \<turnstile> (ST,LT) \<le>\<^sub>i (ST',LT') = (P \<turnstile> ST [\<le>] ST' \<and> P \<turnstile> LT [\<le>\<^sub>\<top>] LT')"
 (*<*) by (auto simp add: sup_state_def stk_convert lesub_def Product.le_def sup_loc_def) (*>*)
   
 lemma sup_state_conv2:
   "P \<turnstile> s1 \<le>\<^sub>i s2 = (P \<turnstile> fst s1 [\<le>] fst s2 \<and> P \<turnstile> snd s1 [\<le>\<^sub>\<top>] snd s2)"
 (*<*) by (cases s1, cases s2) simp (*>*)
 
 lemma sup_state_refl [iff]: "P \<turnstile> s \<le>\<^sub>i s"
 (*<*) by (auto simp add: sup_state_conv2) (*>*)
 
 lemma sup_state_trans [intro?, trans]:
   "\<lbrakk>P \<turnstile> a \<le>\<^sub>i b; P \<turnstile> b \<le>\<^sub>i c\<rbrakk> \<Longrightarrow> P \<turnstile> a \<le>\<^sub>i c"
 (*<*) by (auto intro: sup_loc_trans widens_trans simp add: sup_state_conv2) (*>*)
 
 
 lemma sup_state_opt_None_any [iff]:
   "P \<turnstile> None \<le>' s"
 (*<*) by (simp add: sup_state_opt_def Opt.le_def) (*>*)
 
 lemma sup_state_opt_any_None [iff]:
   "P \<turnstile> s \<le>' None = (s = None)"
 (*<*) by (simp add: sup_state_opt_def Opt.le_def) (*>*)
 
 lemma sup_state_opt_Some_Some [iff]:
   "P \<turnstile> Some a \<le>' Some b = P \<turnstile> a \<le>\<^sub>i b"  
 (*<*) by (simp add: sup_state_opt_def Opt.le_def lesub_def) (*>*)
 
 lemma sup_state_opt_any_Some:
   "P \<turnstile> (Some s) \<le>' X = (\<exists>s'. X = Some s' \<and> P \<turnstile> s \<le>\<^sub>i s')"
 (*<*) by (simp add: sup_state_opt_def Opt.le_def lesub_def) (*>*)
 
 lemma sup_state_opt_refl [iff]: "P \<turnstile> s \<le>' s"
 (*<*) by (simp add: sup_state_opt_def Opt.le_def lesub_def) (*>*)
 
 lemma sup_state_opt_trans [intro?, trans]:
   "\<lbrakk>P \<turnstile> a \<le>' b; P \<turnstile> b \<le>' c\<rbrakk> \<Longrightarrow> P \<turnstile> a \<le>' c"
 (*<*)
   apply (unfold sup_state_opt_def Opt.le_def lesub_def)
   apply (simp del: split_paired_All)
   apply (rule sup_state_trans, assumption+)
   done
 (*>*)
 
 
 lemma sup_state_opt_err  : "(Err.le (sup_state_opt P)) s s"
   apply (unfold JVM_le_unfold Product.le_def Opt.le_def Err.le_def lesssub_def lesub_def Listn.le_def)
   apply (auto split: err.splits)
   done
 
 lemma Cons_less_Conss1 [simp]:
   "x#xs [\<sqsubset>\<^bsub>subtype P\<^esub>] y#ys = (x \<sqsubset>\<^bsub>subtype P\<^esub> y \<and> xs [\<sqsubseteq>\<^bsub>subtype P\<^esub>] ys \<or> x = y \<and> xs [\<sqsubset>\<^bsub>subtype P\<^esub>] ys)"
   apply (unfold lesssub_def )
   apply auto
   apply (simp add:lesssub_def lesub_def) \<comment>\<open>widen_refl, subtype_refl \<close>
   done
 
 lemma Cons_less_Conss2 [simp]:
   "x#xs [\<sqsubset>\<^bsub>Err.le (subtype P)\<^esub>] y#ys = (x \<sqsubset>\<^bsub>Err.le (subtype P)\<^esub> y \<and> xs [\<sqsubseteq>\<^bsub>Err.le (subtype P)\<^esub>] ys \<or> x = y \<and> xs [\<sqsubset>\<^bsub>Err.le (subtype P)\<^esub>] ys)"
   apply (unfold lesssub_def )
   apply auto
   apply (simp add:lesssub_def lesub_def Err.le_def split: err.splits)
   done
 
 lemma acc_le_listI1 [intro!]:
   " acc (subtype P) \<Longrightarrow> acc (Listn.le (subtype P))"
   (*<*) 
 apply (unfold acc_def)
 apply (subgoal_tac
  "wf(UN n. {(ys,xs). size xs = n \<and> size ys = n \<and> xs <_(Listn.le (subtype P)) ys})")
    apply (erule wf_subset)
 
  apply (blast intro: lesssub_lengthD)
 apply (rule wf_UN)
  prefer 2
  apply (rename_tac m n)
  apply (case_tac "m=n")
   apply simp
  apply (fast intro!: equals0I dest: not_sym)
 apply (rename_tac n)
 apply (induct_tac n)
  apply (simp add: lesssub_def cong: conj_cong)
 apply (rename_tac k)
 apply (simp add: wf_eq_minimal)
 apply (simp (no_asm) add: length_Suc_conv cong: conj_cong)
 apply clarify
 apply (rename_tac M m)
 apply (case_tac "\<exists>x xs. size xs = k \<and> x#xs \<in> M")
  prefer 2
  apply (erule thin_rl)
  apply (erule thin_rl)
  apply blast
 apply (erule_tac x = "{a. \<exists>xs. size xs = k \<and> a#xs:M}" in allE)
 apply (erule impE)
  apply blast
 apply (thin_tac "\<exists>x xs. P x xs" for P)
 apply clarify
 apply (rename_tac maxA xs)
 apply (erule_tac x = "{ys. size ys = size xs \<and> maxA#ys \<in> M}" in allE)
 apply (erule impE)
  apply blast
 apply clarify
 apply (thin_tac "m \<in> M")
 apply (thin_tac "maxA#xs \<in> M")
 apply (rule bexI)
  prefer 2
  apply assumption
 apply clarify
 apply simp
 apply blast
   done
 
 lemma acc_le_listI2 [intro!]:
   " acc (Err.le (subtype P)) \<Longrightarrow> acc (Listn.le (Err.le (subtype P)))"
     (*<*) 
 apply (unfold acc_def)
 apply (subgoal_tac
  "wf(UN n. {(ys,xs). size xs = n \<and> size ys = n \<and> xs <_(Listn.le (Err.le (subtype P))) ys})")
    apply (erule wf_subset)
 
  apply (blast intro: lesssub_lengthD)
 apply (rule wf_UN)
  prefer 2
  apply (rename_tac m n)
  apply (case_tac "m=n")
   apply simp
  apply (fast intro!: equals0I dest: not_sym)
 apply (rename_tac n)
 apply (induct_tac n)
  apply (simp add: lesssub_def cong: conj_cong)
 apply (rename_tac k)
 apply (simp add: wf_eq_minimal)
 apply (simp (no_asm) add: length_Suc_conv cong: conj_cong)
 apply clarify
 apply (rename_tac M m)
 apply (case_tac "\<exists>x xs. size xs = k \<and> x#xs \<in> M")
  prefer 2
  apply (erule thin_rl)
  apply (erule thin_rl)
  apply blast
 apply (erule_tac x = "{a. \<exists>xs. size xs = k \<and> a#xs:M}" in allE)
 apply (erule impE)
  apply blast
 apply (thin_tac "\<exists>x xs. P x xs" for P)
 apply clarify
 apply (rename_tac maxA xs)
 apply (erule_tac x = "{ys. size ys = size xs \<and> maxA#ys \<in> M}" in allE)
 apply (erule impE)
  apply blast
 apply clarify
 apply (thin_tac "m \<in> M")
 apply (thin_tac "maxA#xs \<in> M")
 apply (rule bexI)
  prefer 2
  apply assumption
 apply clarify
 apply simp
 apply blast
   done
 
 lemma acc_JVM [intro]:
   "wf_prog wf_mb P \<Longrightarrow> acc (JVM_SemiType.le P mxs mxl)"
 (*<*) by (unfold JVM_le_unfold) blast (*>*)  \<comment>\<open> use acc_listI1, acc_listI2 \<close>
 
 end
diff --git a/thys/JinjaDCI/BV/LBVJVM.thy b/thys/JinjaDCI/BV/LBVJVM.thy
--- a/thys/JinjaDCI/BV/LBVJVM.thy
+++ b/thys/JinjaDCI/BV/LBVJVM.thy
@@ -1,250 +1,250 @@
 (*  Title:      JinjaDCI/BV/LBVJVM.thy
 
     Author:     Tobias Nipkow, Gerwin Klein, Susannah Mansky
     Copyright   2000 TUM, 2020 UIUC
 
     Based on the Jinja theory BV/LBVJVM.thy by Tobias Nipkow and Gerwin Klein
 *)
 
 section \<open> LBV for the JVM \label{sec:JVM} \<close>
 
 theory LBVJVM
 imports Jinja.Abstract_BV TF_JVM
 begin
 
 type_synonym prog_cert = "cname \<Rightarrow> mname \<Rightarrow> ty\<^sub>i' err list"
 
 definition check_cert :: "jvm_prog \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> ty\<^sub>i' err list \<Rightarrow> bool"
 where
   "check_cert P mxs mxl n cert \<equiv> check_types P mxs mxl cert \<and> size cert = n+1 \<and>
                                  (\<forall>i<n. cert!i \<noteq> Err) \<and> cert!n = OK None"
 
 definition lbvjvm :: "jvm_prog \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> ty \<Rightarrow> ex_table \<Rightarrow> 
              ty\<^sub>i' err list \<Rightarrow> instr list \<Rightarrow> ty\<^sub>i' err \<Rightarrow> ty\<^sub>i' err"
 where
   "lbvjvm P mxs maxr T\<^sub>r et cert bs \<equiv>
   wtl_inst_list bs cert (JVM_SemiType.sup P mxs maxr) (JVM_SemiType.le P mxs maxr) Err (OK None) (exec P mxs T\<^sub>r et bs) 0"
 
 definition wt_lbv :: "jvm_prog \<Rightarrow> cname \<Rightarrow> staticb \<Rightarrow> ty list \<Rightarrow> ty \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> 
              ex_table \<Rightarrow> ty\<^sub>i' err list \<Rightarrow> instr list \<Rightarrow> bool"
 where
   "wt_lbv P C b Ts T\<^sub>r mxs mxl\<^sub>0 et cert ins \<equiv> (b = Static \<or> b = NonStatic) \<and>
    check_cert P mxs ((case b of Static \<Rightarrow> 0 | NonStatic \<Rightarrow> 1)+size Ts+mxl\<^sub>0) (size ins) cert \<and>
    0 < size ins \<and> 
    (let start  = Some ([],(case b of Static \<Rightarrow> [] | NonStatic \<Rightarrow> [OK (Class C)])
                             @((map OK Ts))@(replicate mxl\<^sub>0 Err));
         result = lbvjvm P mxs ((case b of Static \<Rightarrow> 0 | NonStatic \<Rightarrow> 1)+size Ts+mxl\<^sub>0) T\<^sub>r et cert ins (OK start)
     in result \<noteq> Err)"
 
 definition wt_jvm_prog_lbv :: "jvm_prog \<Rightarrow> prog_cert \<Rightarrow> bool"
 where
   "wt_jvm_prog_lbv P cert \<equiv>
   wf_prog (\<lambda>P C (mn,b,Ts,T\<^sub>r,(mxs,mxl\<^sub>0,ins,et)). wt_lbv P C b Ts T\<^sub>r mxs mxl\<^sub>0 et (cert C mn) ins) P"
 
 definition mk_cert :: "jvm_prog \<Rightarrow> nat \<Rightarrow> ty \<Rightarrow> ex_table \<Rightarrow> instr list 
               \<Rightarrow> ty\<^sub>m \<Rightarrow> ty\<^sub>i' err list"
 where
   "mk_cert P mxs T\<^sub>r et bs phi \<equiv> make_cert (exec P mxs T\<^sub>r et bs) (map OK phi) (OK None)"
 
 definition prg_cert :: "jvm_prog \<Rightarrow> ty\<^sub>P \<Rightarrow> prog_cert"
 where
   "prg_cert P phi C mn \<equiv> let (C,b,Ts,T\<^sub>r,(mxs,mxl\<^sub>0,ins,et)) = method P C mn
                          in  mk_cert P mxs T\<^sub>r et ins (phi C mn)"
    
 lemma check_certD [intro?]:
   "check_cert P mxs mxl n cert \<Longrightarrow> cert_ok cert n Err (OK None) (states P mxs mxl)"
   by (unfold cert_ok_def check_cert_def check_types_def) auto
 
 
 lemma (in start_context) wt_lbv_wt_step:
   assumes lbv: "wt_lbv P C b Ts T\<^sub>r mxs mxl\<^sub>0 xt cert is"
-  shows "\<exists>\<tau>s \<in> list (size is) A. wt_step r Err step \<tau>s \<and> OK first \<sqsubseteq>\<^sub>r \<tau>s!0"
+  shows "\<exists>\<tau>s \<in> nlists (size is) A. wt_step r Err step \<tau>s \<and> OK first \<sqsubseteq>\<^sub>r \<tau>s!0"
 (*<*)
 proof -
   from wf have "semilat (JVM_SemiType.sl P mxs mxl)" ..
   hence "semilat (A, r, f)" by (simp add: sl_def2)
   moreover have "top r Err" by (simp add: JVM_le_Err_conv)
   moreover have "Err \<in> A" by (simp add: JVM_states_unfold)
   moreover have "bottom r (OK None)" 
     by (simp add: JVM_le_Err_conv bottom_def lesub_def Err.le_def split: err.split)
   moreover have "OK None \<in> A" by (simp add: JVM_states_unfold)
   moreover note bounded_step
   moreover from lbv have "cert_ok cert (size is) Err (OK None) A"
     by (unfold wt_lbv_def) (auto dest: check_certD)
   moreover note exec_pres_type
   moreover
   from lbv 
   have "wtl_inst_list is cert f r Err (OK None) step 0 (OK first) \<noteq> Err"
     by (cases b; simp add: wt_lbv_def lbvjvm_def step_def_exec [symmetric])
   moreover note first_in_A
   moreover from lbv have "0 < size is" by (simp add: wt_lbv_def)
   ultimately show ?thesis by (rule lbvs.wtl_sound_strong [OF lbvs.intro, OF lbv.intro lbvs_axioms.intro, OF Semilat.intro lbv_axioms.intro])
 qed
 (*>*)
 
 
 lemma (in start_context) wt_lbv_wt_method:
   assumes lbv: "wt_lbv P C b Ts T\<^sub>r mxs mxl\<^sub>0 xt cert is"  
   shows "\<exists>\<tau>s. wt_method P C b Ts T\<^sub>r mxs mxl\<^sub>0 is xt \<tau>s"
 (*<*)
 proof -
   from lbv have l: "is \<noteq> []" and  
              stab: "b = Static \<or> b = NonStatic" by (auto simp add: wt_lbv_def)
   moreover
   from wf lbv C Ts obtain \<tau>s where 
-    list:  "\<tau>s \<in> list (size is) A" and
+    list:  "\<tau>s \<in> nlists (size is) A" and
     step:  "wt_step r Err step \<tau>s" and    
     start: "OK first \<sqsubseteq>\<^sub>r \<tau>s!0" 
     by (blast dest: wt_lbv_wt_step)
   from list have [simp]: "size \<tau>s = size is" by simp
   have "size (map ok_val \<tau>s) = size is" by simp  
   moreover from l have 0: "0 < size \<tau>s" by simp
   with step obtain \<tau>s0 where "\<tau>s!0 = OK \<tau>s0"
     by (unfold wt_step_def) blast
   with start 0 have "wt_start P C b Ts mxl\<^sub>0 (map ok_val \<tau>s)"
     by (cases b; simp add: wt_start_def JVM_le_Err_conv lesub_def Err.le_def)    
   moreover {
     from list have "check_types P mxs mxl \<tau>s" by (simp add: check_types_def)
     also from step  have "\<forall>x \<in> set \<tau>s. x \<noteq> Err" 
       by (auto simp add: all_set_conv_all_nth wt_step_def)    
     hence [symmetric]: "map OK (map ok_val \<tau>s) = \<tau>s"
       by (auto intro!: map_idI)
     finally have "check_types P mxs mxl (map OK (map ok_val \<tau>s))" .
   }
   moreover {  
     note bounded_step
     moreover from list have "set \<tau>s \<subseteq> A" by simp
     moreover from step have "wt_err_step (sup_state_opt P) step \<tau>s"
       by (simp add: wt_err_step_def JVM_le_Err_conv)
     ultimately have "wt_app_eff (sup_state_opt P) app eff (map ok_val \<tau>s)"
       by (auto intro: wt_err_imp_wt_app_eff simp add: exec_def states_def)
   }    
   ultimately have "wt_method P C b Ts T\<^sub>r mxs mxl\<^sub>0 is xt (map ok_val \<tau>s)"
     by (simp add: wt_method_def2 check_types_def del: map_map)
   thus ?thesis ..
 qed
 (*>*)
 
   
 lemma (in start_context) wt_method_wt_lbv:
   assumes wt: "wt_method P C b Ts T\<^sub>r mxs mxl\<^sub>0 is xt \<tau>s" 
   defines [simp]: "cert \<equiv> mk_cert P mxs T\<^sub>r xt is \<tau>s"
   
   shows "wt_lbv P C b Ts T\<^sub>r mxs mxl\<^sub>0 xt cert is" 
 (*<*)
 proof -
   let ?\<tau>s  = "map OK \<tau>s"
   let ?cert = "make_cert step ?\<tau>s (OK None)"
 
   from wt obtain 
     0:        "0 < size is" and
     size:     "size is = size ?\<tau>s" and
     ck_types: "check_types P mxs mxl ?\<tau>s" and
     wt_start: "wt_start P C b Ts mxl\<^sub>0 \<tau>s" and
     app_eff:  "wt_app_eff (sup_state_opt P) app eff \<tau>s"
     by (force simp add: wt_method_def2 check_types_def) 
   
   from wf have "semilat (JVM_SemiType.sl P mxs mxl)" ..
   hence "semilat (A, r, f)" by (simp add: sl_def2)
   moreover have "top r Err" by (simp add: JVM_le_Err_conv)
   moreover have "Err \<in> A" by (simp add: JVM_states_unfold)
   moreover have "bottom r (OK None)" 
     by (simp add: JVM_le_Err_conv bottom_def lesub_def Err.le_def split: err.split)
   moreover have "OK None \<in> A" by (simp add: JVM_states_unfold)
   moreover from wf have "mono r step (size is) A" by (rule step_mono)
   hence "mono r step (size ?\<tau>s) A" by (simp add: size)
   moreover from exec_pres_type 
   have "pres_type step (size ?\<tau>s) A" by (simp add: size) 
   moreover
   from ck_types have \<tau>s_in_A: "set ?\<tau>s \<subseteq> A" by (simp add: check_types_def)
   hence "\<forall>pc. pc < size ?\<tau>s \<longrightarrow> ?\<tau>s!pc \<in> A \<and> ?\<tau>s!pc \<noteq> Err" by auto
   moreover from bounded_step 
   have "bounded step (size ?\<tau>s)" by (simp add: size)
   moreover have "OK None \<noteq> Err" by simp
   moreover from bounded_step size \<tau>s_in_A app_eff
   have "wt_err_step (sup_state_opt P) step ?\<tau>s"
     by (auto intro: wt_app_eff_imp_wt_err simp add: exec_def states_def)    
   hence "wt_step r Err step ?\<tau>s"
     by (simp add: wt_err_step_def JVM_le_Err_conv)
   moreover
   from 0 size have "0 < size \<tau>s" by auto
   hence "?\<tau>s!0 = OK (\<tau>s!0)" by simp
   with wt_start have "OK first \<sqsubseteq>\<^sub>r ?\<tau>s!0"
     by (cases b; clarsimp simp add: wt_start_def lesub_def Err.le_def JVM_le_Err_conv)
   moreover note first_in_A
   moreover have "OK first \<noteq> Err" by simp
   moreover note size 
   ultimately
   have "wtl_inst_list is ?cert f r Err (OK None) step 0 (OK first) \<noteq> Err"
     by (rule lbvc.wtl_complete [OF lbvc.intro, OF lbv.intro lbvc_axioms.intro, OF Semilat.intro lbv_axioms.intro])
   moreover from 0 size have "\<tau>s \<noteq> []" by auto
   moreover from ck_types have "check_types P mxs mxl ?cert"
     by (fastforce simp: make_cert_def check_types_def JVM_states_unfold
                   dest!: nth_mem)
   moreover note 0 size
   ultimately show ?thesis using staticb
     by (simp add: wt_lbv_def lbvjvm_def mk_cert_def step_def_exec [symmetric]
                   check_cert_def make_cert_def nth_append)
 qed  
 (*>*)
 
 
 
 theorem jvm_lbv_correct:
   "wt_jvm_prog_lbv P Cert \<Longrightarrow> wf_jvm_prog P"
 (*<*)
 proof -  
   let ?\<Phi> = "\<lambda>C mn. let (C,b,Ts,T\<^sub>r,(mxs,mxl\<^sub>0,is,xt)) = method P C mn in 
               SOME \<tau>s. wt_method P C b Ts T\<^sub>r mxs mxl\<^sub>0 is xt \<tau>s"
   
   let ?A = "\<lambda>P C (mn,b,Ts,T\<^sub>r,(mxs,mxl\<^sub>0,ins,et)). wt_lbv P C b Ts T\<^sub>r mxs mxl\<^sub>0 et (Cert C mn) ins"
   let ?B = "\<lambda>P C (M,b,Ts,T\<^sub>r,(mxs,mxl\<^sub>0,is,xt)). 
                 wt_method P C b Ts T\<^sub>r mxs mxl\<^sub>0 is xt (?\<Phi> C M)"
 
   assume wt: "wt_jvm_prog_lbv P Cert"
   then have "wf_prog ?A P" by(simp add: wt_jvm_prog_lbv_def)
   moreover {
     fix wf_md C M b Ts Ca T m bd
     
     assume ass1: "wf_prog wf_md P" and sees: "P \<turnstile> Ca sees M, b :  Ts\<rightarrow>T = m in Ca" and
            ass2: "set Ts \<subseteq> types P" and ass3: "bd = (M, b, Ts, T, m)" and
            ass4: "?A P Ca bd"
     from ass3 ass4 have stab: "b = Static \<or> b = NonStatic" by (simp add:wt_lbv_def)        
     from ass1 sees ass2 ass3 ass4 have "?B P Ca bd" using sees_method_is_class[OF sees] 
       by (auto  dest!: start_context.wt_lbv_wt_method [OF start_context_intro_auxi[OF stab]]
                intro: someI)  
   }
   ultimately have "wf_prog ?B P" by(rule wf_prog_lift)
   hence "wf_jvm_prog\<^bsub>?\<Phi>\<^esub> P" by (simp add: wf_jvm_prog_phi_def)
   thus ?thesis by (unfold wf_jvm_prog_def) blast
 qed
 (*>*)
 
 theorem jvm_lbv_complete:
   assumes wt: "wf_jvm_prog\<^bsub>\<Phi>\<^esub> P" 
   shows "wt_jvm_prog_lbv P (prg_cert P \<Phi>)"
 (*<*)
 proof -
   let ?cert = "prg_cert P \<Phi>"
   let ?A = "\<lambda>P C (M,b,Ts,T\<^sub>r,(mxs,mxl\<^sub>0,is,xt)). 
                 wt_method P C b Ts T\<^sub>r mxs mxl\<^sub>0 is xt (\<Phi> C M)"
   let ?B = "\<lambda>P C (mn,b,Ts,T\<^sub>r,(mxs,mxl\<^sub>0,ins,et)).
                 wt_lbv P C b Ts T\<^sub>r mxs mxl\<^sub>0 et (?cert C mn) ins"
 
   from wt have "wf_prog ?A P" by(clarsimp simp: wf_jvm_prog_def wf_jvm_prog_phi_def)
   moreover {
     fix wf_md C M b Ts Ca T m bd
     assume ass1: "wf_prog wf_md P" and sees: "P \<turnstile> Ca sees M, b :  Ts\<rightarrow>T = m in Ca" and
            ass2: "set Ts \<subseteq> types P" and ass3: "bd = (M, b, Ts, T, m)" and
            ass4: "?A P Ca bd"
     from ass3 ass4 have stab: "b = Static \<or> b = NonStatic" by (simp add:wt_method_def)
     from ass1 sees ass2 ass3 ass4 have "?B P Ca bd" using sees_method_is_class[OF sees]  
       by (auto simp add: prg_cert_def 
                intro!: start_context.wt_method_wt_lbv start_context_intro_auxi[OF stab])
   }
   ultimately have "wf_prog ?B P" by(rule wf_prog_lift)
   thus "wt_jvm_prog_lbv P (prg_cert P \<Phi>)" by (simp add: wt_jvm_prog_lbv_def)
 qed
 (*>*)
 
 end
diff --git a/thys/JinjaDCI/BV/TF_JVM.thy b/thys/JinjaDCI/BV/TF_JVM.thy
--- a/thys/JinjaDCI/BV/TF_JVM.thy
+++ b/thys/JinjaDCI/BV/TF_JVM.thy
@@ -1,355 +1,355 @@
 (*  Title:      JinjaDCI/BV/TF_JVM.thy
 
     Author:     Tobias Nipkow, Gerwin Klein, Susannah Mansky
     Copyright   2000 TUM, 2019-20 UIUC
 
     Based on the Jinja theory BV/TF_JVM.thy by Tobias Nipkow and Gerwin Klein
 *)
 
 section \<open> The Typing Framework for the JVM \label{sec:JVM} \<close>
 
 theory TF_JVM
 imports Jinja.Typing_Framework_err EffectMono BVSpec
 begin
 
 definition exec :: "jvm_prog \<Rightarrow> nat \<Rightarrow> ty \<Rightarrow> ex_table \<Rightarrow> instr list \<Rightarrow> ty\<^sub>i' err step_type"
 where 
   "exec G maxs rT et bs \<equiv>
   err_step (size bs) (\<lambda>pc. app (bs!pc) G maxs rT pc (size bs) et) 
                      (\<lambda>pc. eff (bs!pc) G pc et)"
 
 locale JVM_sl =
   fixes P :: jvm_prog and mxs and mxl\<^sub>0 and n
   fixes b and Ts :: "ty list" and "is" and xt and T\<^sub>r
 
   fixes mxl and A and r and f and app and eff and step
   defines [simp]: "mxl \<equiv> (case b of Static \<Rightarrow> 0 | NonStatic \<Rightarrow> 1)+size Ts+mxl\<^sub>0"
   defines [simp]: "A   \<equiv> states P mxs mxl"
   defines [simp]: "r   \<equiv> JVM_SemiType.le P mxs mxl"
   defines [simp]: "f   \<equiv> JVM_SemiType.sup P mxs mxl"
 
   defines [simp]: "app \<equiv> \<lambda>pc. Effect.app (is!pc) P mxs T\<^sub>r pc (size is) xt"
   defines [simp]: "eff \<equiv> \<lambda>pc. Effect.eff (is!pc) P pc xt"
   defines [simp]: "step \<equiv> err_step (size is) app eff"
 
   defines [simp]: "n \<equiv> size is"
   assumes staticb: "b = Static \<or> b = NonStatic" 
 
 locale start_context = JVM_sl +
   fixes p and C
 
   assumes wf: "wf_prog p P"
   assumes C:  "is_class P C"
   assumes Ts: "set Ts \<subseteq> types P"
 
  
   fixes first :: ty\<^sub>i' and start
   defines [simp]: 
   "first \<equiv> Some ([],(case b of Static \<Rightarrow> [] | NonStatic \<Rightarrow> [OK (Class C)]) @ map OK Ts @ replicate mxl\<^sub>0 Err)"
   defines [simp]:
   "start \<equiv> (OK first) #  replicate (size is - 1) (OK None)"
 thm start_context.intro
 
 lemma start_context_intro_auxi: 
   fixes  P b Ts p C
   assumes "b = Static \<or> b = NonStatic " 
       and "wf_prog p P"
       and "is_class P C"
       and "set Ts \<subseteq> types P"
     shows " start_context P b Ts p C"
   using start_context.intro[OF JVM_sl.intro] start_context_axioms_def assms  by auto
 
 subsection \<open> Connecting JVM and Framework \<close>
 
 lemma (in start_context) semi: "semilat (A, r, f)"
   apply (insert semilat_JVM[OF wf])
   apply (unfold A_def r_def f_def JVM_SemiType.le_def JVM_SemiType.sup_def states_def)
   apply auto
   done
 
 
 lemma (in JVM_sl) step_def_exec: "step \<equiv> exec P mxs T\<^sub>r xt is" 
   by (simp add: exec_def)  
 
 lemma special_ex_swap_lemma [iff]: 
   "(? X. (? n. X = A n & P n) & Q X) = (? n. Q(A n) & P n)"
   by blast
 
 lemma ex_in_list [iff]:
-  "(\<exists>n. ST \<in> list n A \<and> n \<le> mxs) = (set ST \<subseteq> A \<and> size ST \<le> mxs)"
-  by (unfold list_def) auto
+  "(\<exists>n. ST \<in> nlists n A \<and> n \<le> mxs) = (set ST \<subseteq> A \<and> size ST \<le> mxs)"
+  by (unfold nlists_def) auto
 
-lemma singleton_list: 
-  "(\<exists>n. [Class C] \<in> list n (types P) \<and> n \<le> mxs) = (is_class P C \<and> 0 < mxs)"
+lemma singleton_nlists: 
+  "(\<exists>n. [Class C] \<in> nlists n (types P) \<and> n \<le> mxs) = (is_class P C \<and> 0 < mxs)"
   by auto
 
 lemma set_drop_subset:
   "set xs \<subseteq> A \<Longrightarrow> set (drop n xs) \<subseteq> A"
   by (auto dest: in_set_dropD)
 
 lemma Suc_minus_minus_le:
   "n < mxs \<Longrightarrow> Suc (n - (n - b)) \<le> mxs"
   by arith
 
-lemma in_listE:
-  "\<lbrakk> xs \<in> list n A; \<lbrakk>size xs = n; set xs \<subseteq> A\<rbrakk> \<Longrightarrow> P \<rbrakk> \<Longrightarrow> P"
-  by (unfold list_def) blast
+lemma in_nlistsE:
+  "\<lbrakk> xs \<in> nlists n A; \<lbrakk>size xs = n; set xs \<subseteq> A\<rbrakk> \<Longrightarrow> P \<rbrakk> \<Longrightarrow> P"
+  by (unfold nlists_def) blast
 
 declare is_relevant_entry_def [simp]
 declare set_drop_subset [simp]
 
 theorem (in start_context) exec_pres_type:
   "pres_type step (size is) A"
 (*<*)
 proof -
   let ?n = "size is" and ?app = app and ?step = eff
   let ?mxl = "(case b of Static \<Rightarrow> 0 | NonStatic \<Rightarrow> 1) + length Ts + mxl\<^sub>0"
-  let ?A = "opt((Union {list n (types P) |n. n <= mxs}) \<times>
-                                 list ?mxl (err(types P)))"
+  let ?A = "opt((Union {nlists n (types P) |n. n <= mxs}) \<times>
+                                 nlists ?mxl (err(types P)))"
   have "pres_type (err_step ?n ?app ?step) ?n (err ?A)"
   proof(rule pres_type_lift)
     have "\<And>s pc pc' s'. s\<in>?A \<Longrightarrow> pc < ?n \<Longrightarrow> ?app pc s
              \<Longrightarrow> (pc', s')\<in>set (?step pc s) \<Longrightarrow> s' \<in> ?A"
     proof -
       fix s pc pc' s'
       assume asms: "s\<in>?A" "pc < ?n" "?app pc s" "(pc', s')\<in>set (?step pc s)"
       show "s' \<in> ?A"
       proof(cases s)
         case None
         then show ?thesis using asms by (fastforce dest: effNone)
       next
         case (Some ab)
         then show ?thesis using asms proof(cases "is!pc")
           case Load
           then show ?thesis using asms
             by (fastforce simp: Effect.app_def xcpt_app_def Effect.eff_def  
                                 xcpt_eff_def norm_eff_def
-                          dest: listE_nth_in)
+                          dest: nlistsE_nth_in)
         next
           case Push
           then show ?thesis using asms Some
             by (fastforce simp: Effect.app_def xcpt_app_def Effect.eff_def
                                 xcpt_eff_def norm_eff_def typeof_lit_is_type)
         next
           case Getfield
           then show ?thesis using asms wf
             by (fastforce simp: Effect.app_def xcpt_app_def Effect.eff_def
                                 xcpt_eff_def norm_eff_def
                           dest: sees_field_is_type)
         next
           case Getstatic
           then show ?thesis using asms wf
             by (fastforce simp: Effect.app_def xcpt_app_def Effect.eff_def
                                 xcpt_eff_def norm_eff_def
                           dest: sees_field_is_type)
         next
           case (Invoke M n)
           obtain a b where [simp]: "s = \<lfloor>(a,b)\<rfloor>" using Some asms(1) by blast
           show ?thesis
           proof(cases "a!n = NT")
             case True
             then show ?thesis using Invoke asms wf
               by (fastforce simp: Effect.app_def xcpt_app_def Effect.eff_def  
                                   xcpt_eff_def norm_eff_def)
           next
             case False
             have "(pc', s') \<in> set (norm_eff (Invoke M n) P pc (a, b)) \<or>
               (pc', s') \<in> set (xcpt_eff (Invoke M n) P pc (a, b) xt)"
               using Invoke asms(4) by (simp add: Effect.eff_def)
             then show ?thesis proof(rule disjE)
               assume "(pc', s') \<in> set (xcpt_eff (Invoke M n) P pc (a, b) xt)"
               then show ?thesis using Invoke asms(1-3)
                 by (fastforce simp: Effect.app_def xcpt_app_def xcpt_eff_def)
             next
               assume norm: "(pc', s') \<in> set (norm_eff (Invoke M n) P pc (a, b))"
               also have "Suc (length a - Suc n) \<le> mxs" using Invoke asms(1,3)
                 by (simp add: Effect.app_def xcpt_app_def) arith
               ultimately show ?thesis using False Invoke asms(1-3) wf
                 by (auto simp: Effect.app_def xcpt_app_def norm_eff_def wf_mdecl_def
                          dest!: sees_wf_mdecl)
             qed
           qed
         next
           case (Invokestatic C M n)
           obtain a b where [simp]: "s = \<lfloor>(a,b)\<rfloor>" using Some asms(1) by blast
           have "(pc', s') \<in> set (norm_eff (Invokestatic C M n) P pc (a, b)) \<or>
             (pc', s') \<in> set (xcpt_eff (Invokestatic C M n) P pc (a, b) xt)"
             using Invokestatic asms(4) by (simp add: Effect.eff_def)
           then show ?thesis proof(rule disjE)
             assume "(pc', s') \<in> set (xcpt_eff (Invokestatic C M n) P pc (a, b) xt)"
             then show ?thesis using Invokestatic asms(1-3)
               by (fastforce simp: Effect.app_def xcpt_app_def xcpt_eff_def)
           next
             assume norm: "(pc', s') \<in> set (norm_eff (Invokestatic C M n) P pc (a, b))"
             also have "Suc (length a - Suc n) \<le> mxs" using Invokestatic asms(1,3)
               by (simp add: Effect.app_def xcpt_app_def) arith
             ultimately show ?thesis using Invokestatic asms(1-3) wf
               by (auto simp: Effect.app_def xcpt_app_def norm_eff_def wf_mdecl_def
                        dest!: sees_wf_mdecl)
           qed
         qed (fastforce simp: Effect.app_def xcpt_app_def Effect.eff_def  
                              xcpt_eff_def norm_eff_def)+
       qed
     qed
     then show "\<forall>s\<in>?A. \<forall>p. p < ?n \<longrightarrow> ?app p s \<longrightarrow> (\<forall>(q, s')\<in>set (?step p s). s' \<in> ?A)"
       by clarsimp
   qed
   then show ?thesis by (simp add: JVM_states_unfold)
 qed
 (*>*)
 
 declare is_relevant_entry_def [simp del]
 declare set_drop_subset [simp del]
 
 lemma lesubstep_type_simple:
   "xs [\<sqsubseteq>\<^bsub>Product.le (=) r\<^esub>] ys \<Longrightarrow> set xs {\<sqsubseteq>\<^bsub>r\<^esub>} set ys"
 (*<*)
 proof -
   assume assm: "xs [\<sqsubseteq>\<^bsub>Product.le (=) r\<^esub>] ys"
   have "\<And>a b i y. (a, b) = xs ! i \<Longrightarrow> i < length xs
      \<Longrightarrow> \<exists>\<tau>'. (\<exists>i. (a, \<tau>') = ys ! i \<and> i < length xs) \<and> b \<sqsubseteq>\<^bsub>r\<^esub> \<tau>'"
   proof -
     fix a b i assume ith: "(a, b) = xs ! i" and len: "i < length xs"
     obtain \<tau> where "ys ! i = (a, \<tau>) \<and> r b \<tau>"
       using le_listD[OF assm len] ith
       by (clarsimp simp: lesub_def Product.le_def)
     then have "(a, \<tau>) = ys ! i \<and> b \<sqsubseteq>\<^bsub>r\<^esub> \<tau>"
       by (clarsimp simp: lesub_def)
     with len show "\<exists>\<tau>'. (\<exists>i. (a, \<tau>') = ys ! i \<and> i < length xs) \<and> b \<sqsubseteq>\<^bsub>r\<^esub> \<tau>'"
       by fastforce
   qed
   then show "set xs {\<sqsubseteq>\<^bsub>r\<^esub>} set ys" using assm
     by (clarsimp simp: lesubstep_type_def set_conv_nth)
 qed
 (*>*)
 
 declare is_relevant_entry_def [simp del]
 
 
 lemma conjI2: "\<lbrakk> A; A \<Longrightarrow> B \<rbrakk> \<Longrightarrow> A \<and> B" by blast
   
 lemma (in JVM_sl) eff_mono:
 assumes wf: "wf_prog p P" and "pc < length is" and
   lesub: "s \<sqsubseteq>\<^bsub>sup_state_opt P\<^esub> t" and app: "app pc t"
 shows "set (eff pc s) {\<sqsubseteq>\<^bsub>sup_state_opt P\<^esub>} set (eff pc t)"
 (*<*)
 proof(cases t)
   case None then show ?thesis using lesub
    by (simp add: Effect.eff_def lesub_def)
 next
   case tSome: (Some a)
   show ?thesis proof(cases s)
     case None then show ?thesis using lesub
      by (simp add: Effect.eff_def lesub_def)
   next
     case (Some b)
     let ?norm = "\<lambda>x. norm_eff (is ! pc) P pc x"
     let ?xcpt = "\<lambda>x. xcpt_eff (is ! pc) P pc x xt"
     let ?r = "Product.le (=) (sup_state_opt P)"
     let ?\<tau>' = "\<lfloor>eff\<^sub>i (is ! pc, P, a)\<rfloor>"
     {
       fix x assume xb: "x \<in> set (succs (is ! pc) b pc)"
       then have appi: "app\<^sub>i (is ! pc, P, pc, mxs, T\<^sub>r, a)" and
                 bia: "P \<turnstile> b \<le>\<^sub>i a" and appa: "app pc \<lfloor>a\<rfloor>"
         using lesub app tSome Some by (auto simp add: lesub_def Effect.app_def)
       have xa: "x \<in> set (succs (is ! pc) a pc)"
         using xb succs_mono[OF wf appi bia] by auto
       then have "(x, ?\<tau>') \<in> (\<lambda>pc'. (pc', ?\<tau>')) ` set (succs (is ! pc) a pc)"
         by (rule imageI)
       moreover have "P \<turnstile> \<lfloor>eff\<^sub>i (is ! pc, P, b)\<rfloor> \<le>' ?\<tau>'"
         using xb xa eff\<^sub>i_mono[OF wf bia] appa by fastforce
       ultimately have "\<exists>\<tau>'. (x, \<tau>') \<in> (\<lambda>pc'. (pc', \<lfloor>eff\<^sub>i (is ! pc, P, a)\<rfloor>)) ` set (succs (is ! pc) a pc) \<and>
               P \<turnstile> \<lfloor>eff\<^sub>i (is ! pc, P, b)\<rfloor> \<le>' \<tau>'" by blast
     }
     then have norm: "set (?norm b) {\<sqsubseteq>\<^bsub>sup_state_opt P\<^esub>} set (?norm a)"
       using tSome Some by (clarsimp simp: norm_eff_def lesubstep_type_def lesub_def)
     obtain a1 b1 a2 b2 where a: "a = (a1, b1)" and b: "b = (a2, b2)"
       using tSome Some by fastforce
     then have a12: "size a2 = size a1" using lesub tSome Some
       by (clarsimp simp: lesub_def list_all2_lengthD)
     have "length (?xcpt b) = length (?xcpt a)"
       by (simp add: xcpt_eff_def split_beta)
     moreover have "\<And>n. n < length (?xcpt b) \<Longrightarrow> (?xcpt b) ! n \<sqsubseteq>\<^bsub>?r\<^esub> (?xcpt a) ! n"
       using lesub tSome Some a b a12
       by (simp add: xcpt_eff_def split_beta fun_of_def) (simp add: lesub_def)
     ultimately have "?xcpt b [\<sqsubseteq>\<^bsub>?r\<^esub>] ?xcpt a"
       by(rule le_listI)
     then have "set (?xcpt b) {\<sqsubseteq>\<^bsub>sup_state_opt P\<^esub>} set (?xcpt a)"
       by (rule lesubstep_type_simple)
     moreover note norm
     ultimately have
      "set (?norm b) \<union> set (?xcpt b) {\<sqsubseteq>\<^bsub>sup_state_opt P\<^esub>} set (?norm a) \<union> set (?xcpt a)"
       by(intro lesubstep_union)
     then show ?thesis using tSome Some by(simp add: Effect.eff_def)
   qed
 qed
 (*>*)
 
 lemma (in JVM_sl) bounded_step: "bounded step (size is)"
 (*<*)
   by (auto simp: bounded_def err_step_def Effect.app_def Effect.eff_def
                  error_def map_snd_def
           split: err.splits option.splits)
 (*>*)
 
 theorem (in JVM_sl) step_mono:
   "wf_prog wf_mb P \<Longrightarrow> mono r step (size is) A"
 (*<*)
  apply (simp add: JVM_le_Err_conv)  
   apply (insert bounded_step)
   apply (unfold JVM_states_unfold)
   apply (rule mono_lift)    
   apply (subgoal_tac "b = Static \<or> b = NonStatic") 
       apply (fastforce split:if_splits)\<comment>\<open> order_sup_state_opt' order_sup_state_opt'' \<close>
      apply (simp only:staticb)
      apply (unfold app_mono_def lesub_def)
     apply clarsimp
     apply (erule (2) app_mono)
    apply simp
   apply clarify
   apply (drule eff_mono)
       apply (auto simp add: lesub_def)
   done
 (*
 proof -
   assume wf: "wf_prog wf_mb P"
   let ?r = "sup_state_opt P" and ?n = "length is" and ?app = app and ?step = eff
   let ?A = "opt (\<Union> {list n (types P) |n. n \<le> mxs} \<times>
                 list ((case b of Static \<Rightarrow> 0 | NonStatic \<Rightarrow> 1) + length Ts + mxl\<^sub>0)
                  (err (types P)))"
   have "order ?r ?A" using wf by simp
   moreover have "app_mono ?r ?app ?n ?A" using app_mono[OF wf]
     by (clarsimp simp: app_mono_def lesub_def)
   moreover have "bounded (err_step ?n ?app ?step) ?n" using bounded_step
     by simp
   moreover have "\<forall>s p t. s \<in> ?A \<and> p < ?n \<and> s \<sqsubseteq>\<^bsub>?r\<^esub> t \<longrightarrow>
    ?app p t \<longrightarrow> set (?step p s) {\<sqsubseteq>\<^bsub>?r\<^esub>} set (?step p t)"
      using eff_mono[OF wf] by simp
   ultimately have "mono (Err.le ?r) (err_step ?n ?app ?step) ?n (err ?A)"
     by(rule mono_lift)
   then show "mono r step (size is) A" using bounded_step
     by (simp add: JVM_le_Err_conv JVM_states_unfold)
 qed
 *)
 (*>*)
 
 
 lemma (in start_context) first_in_A [iff]: "OK first \<in> A"
-  using Ts C by (cases b; force intro!: list_appendI simp add: JVM_states_unfold)
+  using Ts C by (cases b; force intro!: nlists_appendI simp add: JVM_states_unfold)
 
 
 lemma (in JVM_sl) wt_method_def2:
   "wt_method P C' b Ts T\<^sub>r mxs mxl\<^sub>0 is xt \<tau>s =
   (is \<noteq> [] \<and> 
    (b = Static \<or> b = NonStatic) \<and>
    size \<tau>s = size is \<and>
    OK ` set \<tau>s \<subseteq> states P mxs mxl \<and>
    wt_start P C' b Ts mxl\<^sub>0 \<tau>s \<and> 
    wt_app_eff (sup_state_opt P) app eff \<tau>s)"
 (*<*)using staticb
   by (unfold wt_method_def wt_app_eff_def wt_instr_def lesub_def
              check_types_def) auto
 (*>*)
 
 
 end
diff --git a/thys/JinjaDCI/Compiler/TypeComp.thy b/thys/JinjaDCI/Compiler/TypeComp.thy
--- a/thys/JinjaDCI/Compiler/TypeComp.thy
+++ b/thys/JinjaDCI/Compiler/TypeComp.thy
@@ -1,1686 +1,1686 @@
 (*  Title:      JinjaDCI/Compiler/TypeComp.thy
 
     Author:     Tobias Nipkow, Susannah Mansky
     Copyright   TUM 2003, UIUC 2019-20
 
     Based on the Jinja theory Compiler/TypeComp.thy by Tobias Nipkow
 *)
 
 section \<open> Preservation of Well-Typedness \<close>
 
 theory TypeComp
 imports Compiler "../BV/BVSpec"
 begin
 
 (*<*)
 declare nth_append[simp]
 (*>*)
 
 lemma max_stack1: "P,E \<turnstile>\<^sub>1 e :: T \<Longrightarrow> 1 \<le> max_stack e"
 (*<*)using max_stack1'[OF WT\<^sub>1_nsub_RI] by simp(*>*)
 
 locale TC0 =
   fixes P :: "J\<^sub>1_prog" and mxl :: nat
 begin
 
 definition "ty E e = (THE T. P,E \<turnstile>\<^sub>1 e :: T)"
 
 definition "ty\<^sub>l E A' = map (\<lambda>i. if i \<in> A' \<and> i < size E then OK(E!i) else Err) [0..<mxl]"
 
 definition "ty\<^sub>i' ST E A = (case A of None \<Rightarrow> None | \<lfloor>A'\<rfloor> \<Rightarrow> Some(ST, ty\<^sub>l E A'))"
 
 definition "after E A ST e = ty\<^sub>i' (ty E e # ST) E (A \<squnion> \<A> e)"
 
 end
 
 lemma (in TC0) ty_def2 [simp]: "P,E \<turnstile>\<^sub>1 e :: T \<Longrightarrow> ty E e = T"
 (*<*)by(unfold ty_def) (blast intro: the_equality WT\<^sub>1_unique)(*>*)
 
 lemma (in TC0) [simp]: "ty\<^sub>i' ST E None = None"
 (*<*)by (simp add: ty\<^sub>i'_def)(*>*)
 
 lemma (in TC0) ty\<^sub>l_app_diff[simp]:
  "ty\<^sub>l (E@[T]) (A - {size E}) = ty\<^sub>l E A"
 (*<*)by(auto simp add:ty\<^sub>l_def hyperset_defs)(*>*)
 
 
 lemma (in TC0) ty\<^sub>i'_app_diff[simp]:
  "ty\<^sub>i' ST (E @ [T]) (A \<ominus> size E) = ty\<^sub>i' ST E A"
 (*<*)by(auto simp add:ty\<^sub>i'_def hyperset_defs)(*>*)
 
 
 lemma (in TC0) ty\<^sub>l_antimono:
  "A \<subseteq> A' \<Longrightarrow> P \<turnstile> ty\<^sub>l E A' [\<le>\<^sub>\<top>] ty\<^sub>l E A"
 (*<*)by(auto simp:ty\<^sub>l_def list_all2_conv_all_nth)(*>*)
 
 
 lemma (in TC0) ty\<^sub>i'_antimono:
  "A \<subseteq> A' \<Longrightarrow> P \<turnstile> ty\<^sub>i' ST E \<lfloor>A'\<rfloor> \<le>' ty\<^sub>i' ST E \<lfloor>A\<rfloor>"
 (*<*)by(auto simp:ty\<^sub>i'_def ty\<^sub>l_def list_all2_conv_all_nth)(*>*)
 
 
 lemma (in TC0) ty\<^sub>l_env_antimono:
  "P \<turnstile> ty\<^sub>l (E@[T]) A [\<le>\<^sub>\<top>] ty\<^sub>l E A" 
 (*<*)by(auto simp:ty\<^sub>l_def list_all2_conv_all_nth)(*>*)
 
 
 lemma (in TC0) ty\<^sub>i'_env_antimono:
  "P \<turnstile> ty\<^sub>i' ST (E@[T]) A \<le>' ty\<^sub>i' ST E A" 
 (*<*)by(auto simp:ty\<^sub>i'_def ty\<^sub>l_def list_all2_conv_all_nth)(*>*)
 
 
 lemma (in TC0) ty\<^sub>i'_incr:
  "P \<turnstile> ty\<^sub>i' ST (E @ [T]) \<lfloor>insert (size E) A\<rfloor> \<le>' ty\<^sub>i' ST E \<lfloor>A\<rfloor>"
 (*<*)by(auto simp:ty\<^sub>i'_def ty\<^sub>l_def list_all2_conv_all_nth)(*>*)
 
 
 lemma (in TC0) ty\<^sub>l_incr:
  "P \<turnstile> ty\<^sub>l (E @ [T]) (insert (size E) A) [\<le>\<^sub>\<top>] ty\<^sub>l E A"
 (*<*)by(auto simp: hyperset_defs ty\<^sub>l_def list_all2_conv_all_nth)(*>*)
 
 
 lemma (in TC0) ty\<^sub>l_in_types:
- "set E \<subseteq> types P \<Longrightarrow> ty\<^sub>l E A \<in> list mxl (err (types P))"
-(*<*)by(auto simp add:ty\<^sub>l_def intro!:listI dest!: nth_mem)(*>*)
+ "set E \<subseteq> types P \<Longrightarrow> ty\<^sub>l E A \<in> nlists mxl (err (types P))"
+(*<*)by(auto simp add:ty\<^sub>l_def intro!:nlistsI dest!: nth_mem)(*>*)
 
 locale TC1 = TC0
 begin
 
 primrec compT :: "ty list \<Rightarrow> nat hyperset \<Rightarrow> ty list \<Rightarrow> expr\<^sub>1 \<Rightarrow> ty\<^sub>i' list" and
    compTs :: "ty list \<Rightarrow> nat hyperset \<Rightarrow> ty list \<Rightarrow> expr\<^sub>1 list \<Rightarrow> ty\<^sub>i' list" where
 "compT E A ST (new C) = []"
 | "compT E A ST (Cast C e) =  
    compT E A ST e @ [after E A ST e]"
 | "compT E A ST (Val v) = []"
 | "compT E A ST (e\<^sub>1 \<guillemotleft>bop\<guillemotright> e\<^sub>2) =
   (let ST\<^sub>1 = ty E e\<^sub>1#ST; A\<^sub>1 = A \<squnion> \<A> e\<^sub>1 in
    compT E A ST e\<^sub>1 @ [after E A ST e\<^sub>1] @
    compT E A\<^sub>1 ST\<^sub>1 e\<^sub>2 @ [after E A\<^sub>1 ST\<^sub>1 e\<^sub>2])"
 | "compT E A ST (Var i) = []"
 | "compT E A ST (i := e) = compT E A ST e @
    [after E A ST e, ty\<^sub>i' ST E (A \<squnion> \<A> e \<squnion> \<lfloor>{i}\<rfloor>)]"
 | "compT E A ST (e\<bullet>F{D}) = 
    compT E A ST e @ [after E A ST e]"
 | "compT E A ST (C\<bullet>\<^sub>sF{D}) = []"
 | "compT E A ST (e\<^sub>1\<bullet>F{D} := e\<^sub>2) =
   (let ST\<^sub>1 = ty   E e\<^sub>1#ST; A\<^sub>1 = A \<squnion> \<A> e\<^sub>1; A\<^sub>2 = A\<^sub>1 \<squnion> \<A> e\<^sub>2 in
    compT E A ST e\<^sub>1 @ [after E A ST e\<^sub>1] @
    compT E A\<^sub>1 ST\<^sub>1 e\<^sub>2 @ [after E A\<^sub>1 ST\<^sub>1 e\<^sub>2] @
    [ty\<^sub>i' ST E A\<^sub>2])"
 | "compT E A ST (C\<bullet>\<^sub>sF{D} := e\<^sub>2) = compT E A ST e\<^sub>2 @ [after E A ST e\<^sub>2] @ [ty\<^sub>i' ST E (A \<squnion> \<A> e\<^sub>2)]"
 | "compT E A ST {i:T; e} = compT (E@[T]) (A\<ominus>i) ST e"
 | "compT E A ST (e\<^sub>1;;e\<^sub>2) =
   (let A\<^sub>1 = A \<squnion> \<A> e\<^sub>1 in
    compT E A ST e\<^sub>1 @ [after E A ST e\<^sub>1, ty\<^sub>i' ST E A\<^sub>1] @
    compT E A\<^sub>1 ST e\<^sub>2)"
 | "compT E A ST (if (e) e\<^sub>1 else e\<^sub>2) =
    (let A\<^sub>0 = A \<squnion> \<A> e; \<tau> = ty\<^sub>i' ST E A\<^sub>0 in
     compT E A ST e @ [after E A ST e, \<tau>] @
     compT E A\<^sub>0 ST e\<^sub>1 @ [after E A\<^sub>0 ST e\<^sub>1, \<tau>] @
     compT E A\<^sub>0 ST e\<^sub>2)"
 | "compT E A ST (while (e) c) =
    (let A\<^sub>0 = A \<squnion> \<A> e;  A\<^sub>1 = A\<^sub>0 \<squnion> \<A> c; \<tau> = ty\<^sub>i' ST E A\<^sub>0 in
     compT E A ST e @ [after E A ST e, \<tau>] @
     compT E A\<^sub>0 ST c @ [after E A\<^sub>0 ST c, ty\<^sub>i' ST E A\<^sub>1, ty\<^sub>i' ST E A\<^sub>0])"
 | "compT E A ST (throw e) = compT E A ST e @ [after E A ST e]"
 | "compT E A ST (e\<bullet>M(es)) =
    compT E A ST e @ [after E A ST e] @
    compTs E (A \<squnion> \<A> e) (ty   E e # ST) es"
 | "compT E A ST (C\<bullet>\<^sub>sM(es)) = compTs E A ST es"
 | "compT E A ST (try e\<^sub>1 catch(C i) e\<^sub>2) =
    compT E A ST e\<^sub>1 @ [after E A ST e\<^sub>1] @
    [ty\<^sub>i' (Class C#ST) E A, ty\<^sub>i' ST (E@[Class C]) (A \<squnion> \<lfloor>{i}\<rfloor>)] @
    compT (E@[Class C]) (A \<squnion> \<lfloor>{i}\<rfloor>) ST e\<^sub>2"
 | "compT E A ST (INIT C (Cs,b) \<leftarrow> e) = []"
 | "compT E A ST (RI(C,e');Cs \<leftarrow> e) = []"
 | "compTs E A ST [] = []"
 | "compTs  E A ST (e#es) = compT E A ST e @ [after E A ST e] @
                             compTs E (A \<squnion> (\<A> e)) (ty E e # ST) es"
 
 definition compT\<^sub>a :: "ty list \<Rightarrow> nat hyperset \<Rightarrow> ty list \<Rightarrow> expr\<^sub>1 \<Rightarrow> ty\<^sub>i' list" where
   "compT\<^sub>a E A ST e = compT E A ST e @ [after E A ST e]"
 
 end
 
 lemma compE\<^sub>2_not_Nil[simp]: "P,E \<turnstile>\<^sub>1 e :: T \<Longrightarrow> compE\<^sub>2 e \<noteq> []"
 (*<*)by(simp add: compE\<^sub>2_not_Nil' WT\<^sub>1_nsub_RI)(*>*)
 
 lemma (in TC1) compT_sizes':
 shows "\<And>E A ST. \<not>sub_RI e \<Longrightarrow> size(compT E A ST e) = size(compE\<^sub>2 e) - 1"
 and "\<And>E A ST. \<not>sub_RIs es \<Longrightarrow> size(compTs E A ST es) = size(compEs\<^sub>2 es)"
 (*<*)
 by(induct e and es rule: compE\<^sub>2.induct compEs\<^sub>2.induct)
   (auto split:bop.splits nat_diff_split simp: compE\<^sub>2_not_Nil')
 (*>*)
 
 lemma (in TC1) compT_sizes[simp]:
 shows "\<And>E A ST. P,E \<turnstile>\<^sub>1 e :: T \<Longrightarrow> size(compT E A ST e) = size(compE\<^sub>2 e) - 1"
 and "\<And>E A ST. P,E \<turnstile>\<^sub>1 es [::] Ts \<Longrightarrow> size(compTs E A ST es) = size(compEs\<^sub>2 es)"
 (*<*)using compT_sizes' WT\<^sub>1_nsub_RI WTs\<^sub>1_nsub_RIs by auto(*>*)
 
 
 lemma (in TC1) [simp]: "\<And>ST E. \<lfloor>\<tau>\<rfloor> \<notin> set (compT E None ST e)"
 and [simp]: "\<And>ST E. \<lfloor>\<tau>\<rfloor> \<notin> set (compTs E None ST es)"
 (*<*)by(induct e and es rule: compT.induct compTs.induct) (simp_all add:after_def)(*>*)
 
 
 lemma (in TC0) pair_eq_ty\<^sub>i'_conv:
   "(\<lfloor>(ST, LT)\<rfloor> = ty\<^sub>i' ST\<^sub>0 E A) =
   (case A of None \<Rightarrow> False | Some A \<Rightarrow> (ST = ST\<^sub>0 \<and> LT = ty\<^sub>l E A))"
 (*<*)by(simp add:ty\<^sub>i'_def)(*>*)
 
 
 lemma (in TC0) pair_conv_ty\<^sub>i':
   "\<lfloor>(ST, ty\<^sub>l E A)\<rfloor> = ty\<^sub>i' ST E \<lfloor>A\<rfloor>"
 (*<*)by(simp add:ty\<^sub>i'_def)(*>*)
 
 (*<*)
 declare (in TC0)
   ty\<^sub>i'_antimono [intro!] after_def[simp]
   pair_conv_ty\<^sub>i'[simp] pair_eq_ty\<^sub>i'_conv[simp]
 (*>*)
 
 
 lemma (in TC1) compT_LT_prefix:
  "\<And>E A ST\<^sub>0. \<lbrakk> \<lfloor>(ST,LT)\<rfloor> \<in> set(compT E A ST\<^sub>0 e); \<B> e (size E) \<rbrakk>
                \<Longrightarrow> P \<turnstile> \<lfloor>(ST,LT)\<rfloor> \<le>' ty\<^sub>i' ST E A"
 and
  "\<And>E A ST\<^sub>0. \<lbrakk> \<lfloor>(ST,LT)\<rfloor> \<in> set(compTs E A ST\<^sub>0 es); \<B>s es (size E) \<rbrakk>
                \<Longrightarrow> P \<turnstile> \<lfloor>(ST,LT)\<rfloor> \<le>' ty\<^sub>i' ST E A"
 (*<*)
 proof(induct e and es rule: compT.induct compTs.induct)
   case FAss thus ?case by(fastforce simp:hyperset_defs elim!:sup_state_opt_trans)
 next
   case BinOp thus ?case
     by(fastforce simp:hyperset_defs elim!:sup_state_opt_trans split:bop.splits)
 next
   case Seq thus ?case by(fastforce simp:hyperset_defs elim!:sup_state_opt_trans)
 next
   case While thus ?case by(fastforce simp:hyperset_defs elim!:sup_state_opt_trans)
 next
   case Cond thus ?case by(fastforce simp:hyperset_defs elim!:sup_state_opt_trans)
 next
   case Block thus ?case
     by(force simp add:hyperset_defs ty\<^sub>i'_def simp del:pair_conv_ty\<^sub>i'
              elim!:sup_state_opt_trans)
 next
   case Call thus ?case by(fastforce simp:hyperset_defs elim!:sup_state_opt_trans)
 next
   case Cons_exp thus ?case
     by(fastforce simp:hyperset_defs elim!:sup_state_opt_trans)
 next
   case TryCatch thus ?case
     by(fastforce simp:hyperset_defs intro!: ty\<^sub>i'_incr
                 elim!:sup_state_opt_trans)
 qed (auto simp:hyperset_defs)
 
 declare (in TC0)
   ty\<^sub>i'_antimono [rule del] after_def[simp del]
   pair_conv_ty\<^sub>i'[simp del] pair_eq_ty\<^sub>i'_conv[simp del]
 (*>*)
 
 
 lemma [iff]: "OK None \<in> states P mxs mxl"
 (*<*)by(simp add: JVM_states_unfold)(*>*)
 
 lemma (in TC0) after_in_states:
 assumes wf: "wf_prog p P" and wt: "P,E \<turnstile>\<^sub>1 e :: T"
   and Etypes: "set E \<subseteq> types P" and STtypes: "set ST \<subseteq> types P"
   and stack: "size ST + max_stack e \<le> mxs"
 shows "OK (after E A ST e) \<in> states P mxs mxl"
 (*<*)
 proof -
   have "size ST + 1 \<le> mxs" using max_stack1[where e=e] wt stack
     by fastforce
   then show ?thesis using assms
     by(simp add: after_def ty\<^sub>i'_def JVM_states_unfold ty\<^sub>l_in_types)
-      (blast intro!:listI WT\<^sub>1_is_type)
+      (blast intro!:nlistsI WT\<^sub>1_is_type)
 qed
 (*>*)
 
 
 lemma (in TC0) OK_ty\<^sub>i'_in_statesI[simp]:
   "\<lbrakk> set E \<subseteq> types P; set ST \<subseteq> types P; size ST \<le> mxs \<rbrakk>
   \<Longrightarrow> OK (ty\<^sub>i' ST E A) \<in> states P mxs mxl"
 (*<*)
 by(simp add:ty\<^sub>i'_def JVM_states_unfold ty\<^sub>l_in_types)
-  (blast intro!:listI)
+  (blast intro!:nlistsI)
 (*>*)
 
 
 lemma is_class_type_aux: "is_class P C \<Longrightarrow> is_type P (Class C)"
 (*<*)by(simp)(*>*)
 
 (*<*)
 declare is_type_simps[simp del] subsetI[rule del]
 (*>*)
 
 theorem (in TC1) compT_states:
 assumes wf: "wf_prog p P"
 shows "\<And>E T A ST.
   \<lbrakk> P,E \<turnstile>\<^sub>1 e :: T; set E \<subseteq> types P; set ST \<subseteq> types P;
     size ST + max_stack e \<le> mxs; size E + max_vars e \<le> mxl \<rbrakk>
   \<Longrightarrow> OK ` set(compT E A ST e) \<subseteq> states P mxs mxl"
 (*<*)(is "\<And>E T A ST. PROP ?P e E T A ST")(*>*)
 
 and "\<And>E Ts A ST.
   \<lbrakk> P,E \<turnstile>\<^sub>1 es[::]Ts;  set E \<subseteq> types P; set ST \<subseteq> types P;
     size ST + max_stacks es \<le> mxs; size E + max_varss es \<le> mxl \<rbrakk>
   \<Longrightarrow> OK ` set(compTs E A ST es) \<subseteq> states P mxs mxl"
 (*<*)(is "\<And>E Ts A ST. PROP ?Ps es E Ts A ST")
 proof(induct e and es rule: compT.induct compTs.induct)
   case new thus ?case by(simp)
 next
   case (Cast C e) thus ?case by (auto simp:after_in_states[OF wf])
 next
   case Val thus  ?case by(simp)
 next
   case Var thus ?case by(simp)
 next
   case LAss thus ?case  by(auto simp:after_in_states[OF wf])
 next
   case FAcc thus ?case by(auto simp:after_in_states[OF wf])
 next
   case SFAcc thus ?case by(auto simp:after_in_states[OF wf])
 next
   case FAss thus ?case
     by(auto simp:image_Un WT\<^sub>1_is_type[OF wf] after_in_states[OF wf])
 next
   case SFAss thus ?case
     by(auto simp:image_Un WT\<^sub>1_is_type[OF wf] after_in_states[OF wf])
 next
   case Seq thus ?case
     by(auto simp:image_Un after_in_states[OF wf])
 next
   case BinOp thus ?case
     by(auto simp:image_Un WT\<^sub>1_is_type[OF wf] after_in_states[OF wf])
 next
   case Cond thus ?case
     by(force simp:image_Un WT\<^sub>1_is_type[OF wf] after_in_states[OF wf])
 next
   case While thus ?case
     by(auto simp:image_Un WT\<^sub>1_is_type[OF wf] after_in_states[OF wf])
 next
   case Block thus ?case by(auto)
 next
   case (TryCatch e\<^sub>1 C i e\<^sub>2)
   moreover have "size ST + 1 \<le> mxs"
    using TryCatch.prems max_stack1[where e=e\<^sub>1] by fastforce
   ultimately show ?case  
     by(auto simp:image_Un WT\<^sub>1_is_type[OF wf] after_in_states[OF wf]
                   is_class_type_aux)
 next
   case Nil_exp thus ?case by simp
 next
   case Cons_exp thus ?case
     by(auto simp:image_Un  WT\<^sub>1_is_type[OF wf] after_in_states[OF wf])
 next
   case throw thus ?case
     by(auto simp: WT\<^sub>1_is_type[OF wf] after_in_states[OF wf])
 next
   case Call thus ?case
     by(auto simp:image_Un WT\<^sub>1_is_type[OF wf] after_in_states[OF wf])
 next
   case SCall thus ?case
     by(auto simp:image_Un WT\<^sub>1_is_type[OF wf] after_in_states[OF wf])
 next
   case INIT thus ?case by simp
 next
   case RI thus ?case by simp
 qed
 
 declare is_type_simps[simp] subsetI[intro!]
 (*>*)
 
 
 definition shift :: "nat \<Rightarrow> ex_table \<Rightarrow> ex_table"
 where
   "shift n xt \<equiv> map (\<lambda>(from,to,C,handler,depth). (from+n,to+n,C,handler+n,depth)) xt"
 
 
 lemma [simp]: "shift 0 xt = xt"
 (*<*)by(induct xt)(auto simp:shift_def)(*>*)
 
 lemma [simp]: "shift n [] = []"
 (*<*)by(simp add:shift_def)(*>*)
 
 lemma [simp]: "shift n (xt\<^sub>1 @ xt\<^sub>2) = shift n xt\<^sub>1 @ shift n xt\<^sub>2"
 (*<*)by(simp add:shift_def)(*>*)
 
 lemma [simp]: "shift m (shift n xt) = shift (m+n) xt"
 (*<*)by(induct xt)(auto simp:shift_def)(*>*)
 
 lemma [simp]: "pcs (shift n xt) = {pc+n|pc. pc \<in> pcs xt}"
 (*<*)
 proof -
   { fix x f t C h d
     assume "(f,t,C,h,d) \<in> set xt" and "f + n \<le> x"
       and "x < t + n"
     then have "\<exists>pc. x = pc + n \<and> (\<exists>x\<in>set xt. pc \<in> (case x of (f, t, C, h, d) \<Rightarrow> {f..<t}))"
       by(rule_tac x = "x-n" in exI) (force split:nat_diff_split)
   }
   then show ?thesis by(auto simp:shift_def pcs_def) fast
 qed
 (*>*)
 
 
 lemma shift_compxE\<^sub>2:
 shows "\<And>pc pc' d. shift pc (compxE\<^sub>2 e pc' d) = compxE\<^sub>2 e (pc' + pc) d"
 and  "\<And>pc pc' d. shift pc (compxEs\<^sub>2 es pc' d) = compxEs\<^sub>2 es (pc' + pc) d"
 (*<*)
 by(induct e and es rule: compxE\<^sub>2.induct compxEs\<^sub>2.induct)
   (auto simp:shift_def ac_simps)
 (*>*)
 
 
 lemma compxE\<^sub>2_size_convs[simp]:
 shows "n \<noteq> 0 \<Longrightarrow> compxE\<^sub>2 e n d = shift n (compxE\<^sub>2 e 0 d)"
 and "n \<noteq> 0 \<Longrightarrow> compxEs\<^sub>2 es n d = shift n (compxEs\<^sub>2 es 0 d)"
 (*<*)by(simp_all add:shift_compxE\<^sub>2)(*>*)
 
 locale TC2 = TC1 +
   fixes T\<^sub>r :: ty and mxs :: pc
 begin
 
 definition
   wt_instrs :: "instr list \<Rightarrow> ex_table \<Rightarrow> ty\<^sub>i' list \<Rightarrow> bool"
     ("(\<turnstile> _, _ /[::]/ _)" [0,0,51] 50) where
   "\<turnstile> is,xt [::] \<tau>s \<longleftrightarrow> size is < size \<tau>s \<and> pcs xt \<subseteq> {0..<size is} \<and>
   (\<forall>pc< size is. P,T\<^sub>r,mxs,size \<tau>s,xt \<turnstile> is!pc,pc :: \<tau>s)"
 
 end
 
 notation TC2.wt_instrs ("(_,_,_ \<turnstile>/ _, _ /[::]/ _)" [50,50,50,50,50,51] 50)
 
 (*<*)
 lemmas (in TC2) wt_defs =
   wt_instrs_def wt_instr_def app_def eff_def norm_eff_def
 (*>*)
 
 lemma (in TC2) [simp]: "\<tau>s \<noteq> [] \<Longrightarrow> \<turnstile> [],[] [::] \<tau>s"
 (*<*) by (simp add: wt_defs) (*>*)
 
 lemma [simp]: "eff i P pc et None = []"
 (*<*)by (simp add: Effect.eff_def)(*>*)
 
 (*<*)
 declare split_comp_eq[simp del]
 (*>*)
 
 lemma wt_instr_appR:
  "\<lbrakk> P,T,m,mpc,xt \<turnstile> is!pc,pc :: \<tau>s;
     pc < size is; size is < size \<tau>s; mpc \<le> size \<tau>s; mpc \<le> mpc' \<rbrakk>
   \<Longrightarrow> P,T,m,mpc',xt \<turnstile> is!pc,pc :: \<tau>s@\<tau>s'"
 (*<*)by (fastforce simp:wt_instr_def app_def)(*>*)
 
 
 lemma relevant_entries_shift [simp]:
   "relevant_entries P i (pc+n) (shift n xt) = shift n (relevant_entries P i pc xt)"
 (*<*)
 proof(induct xt)
   case Nil
   then show ?case by (simp add: relevant_entries_def shift_def)
 next
   case (Cons a xt)
   then show ?case 
     by (auto simp add: relevant_entries_def shift_def is_relevant_entry_def)
 qed
 (*>*)
 
 
 lemma [simp]:
   "xcpt_eff i P (pc+n) \<tau> (shift n xt) =
    map (\<lambda>(pc,\<tau>). (pc + n, \<tau>)) (xcpt_eff i P pc \<tau> xt)"
 (*<*)
 proof -
   obtain ST LT where "\<tau> = (ST, LT)" by(cases \<tau>) simp
   then show ?thesis by(simp add: xcpt_eff_def) (auto simp add: shift_def)
 qed
 (*>*)
 
 
 lemma  [simp]:
   "app\<^sub>i (i, P, pc, m, T, \<tau>) \<Longrightarrow>
    eff i P (pc+n) (shift n xt) (Some \<tau>) =
    map (\<lambda>(pc,\<tau>). (pc+n,\<tau>)) (eff i P pc xt (Some \<tau>))"
 (*<*)by(cases "i") (auto simp add:eff_def norm_eff_def)(*>*)
 
 
 lemma [simp]:
   "xcpt_app i P (pc+n) mxs (shift n xt) \<tau> = xcpt_app i P pc mxs xt \<tau>"
 (*<*)by (simp add: xcpt_app_def) (auto simp add: shift_def)(*>*)
 
 
 lemma wt_instr_appL:
 assumes "P,T,m,mpc,xt \<turnstile> i,pc :: \<tau>s" and "pc < size \<tau>s" and "mpc \<le> size \<tau>s"
 shows "P,T,m,mpc + size \<tau>s',shift (size \<tau>s') xt \<turnstile> i,pc+size \<tau>s' :: \<tau>s'@\<tau>s"
 (*<*)
 proof -
   let ?t = "(\<tau>s'@\<tau>s)!(pc+size \<tau>s')"
   show ?thesis
   proof(cases ?t)
     case (Some \<tau>)
     obtain ST LT where [simp]: "\<tau> = (ST, LT)" by(cases \<tau>) simp
     have "app\<^sub>i (i, P, pc + length \<tau>s', m, T, \<tau>)"
       using Some assms by(cases "i") (auto simp:wt_instr_def app_def)
     moreover {
       fix pc' \<tau>' assume "(pc',\<tau>') \<in> set (eff i P pc xt ?t)"
       then have "P \<turnstile> \<tau>' \<le>' \<tau>s!pc'" and "pc' < mpc"
         using Some assms by(auto simp:wt_instr_def app_def)
     }
     ultimately show ?thesis using Some assms
       by(fastforce simp:wt_instr_def app_def)
   qed (auto simp:wt_instr_def app_def)
 qed
 (*>*)
 
 
 lemma wt_instr_Cons:
 assumes wti: "P,T,m,mpc - 1,[] \<turnstile> i,pc - 1 :: \<tau>s"
   and pcl: "0 < pc" and mpcl: "0 < mpc"
   and pcu: "pc < size \<tau>s + 1" and mpcu: "mpc \<le> size \<tau>s + 1"
 shows "P,T,m,mpc,[] \<turnstile> i,pc :: \<tau>#\<tau>s"
 (*<*)
 proof -
   have "pc - 1 < length \<tau>s" using pcl pcu by arith
   moreover have "mpc - 1 \<le> length \<tau>s" using mpcl mpcu by arith
   ultimately have
     "P,T,m,mpc - 1 + length [\<tau>],shift (length [\<tau>]) [] \<turnstile> i,pc - 1 + length [\<tau>] :: [\<tau>] @ \<tau>s"
     by(rule wt_instr_appL[where \<tau>s' = "[\<tau>]", OF wti])
   then show ?thesis using pcl mpcl by (simp split:nat_diff_split_asm)
 qed
 (*>*)
 
 
 lemma wt_instr_append:
 assumes wti: "P,T,m,mpc - size \<tau>s',[] \<turnstile> i,pc - size \<tau>s' :: \<tau>s"
   and pcl: "size \<tau>s' \<le> pc" and mpcl: "size \<tau>s' \<le> mpc"
   and pcu: "pc < size \<tau>s + size \<tau>s'" and mpcu: "mpc \<le> size \<tau>s + size \<tau>s'"
 shows "P,T,m,mpc,[] \<turnstile> i,pc :: \<tau>s'@\<tau>s"
 (*<*)
 proof -
   have "pc - length \<tau>s' < length \<tau>s" using pcl pcu by arith
   moreover have "mpc - length \<tau>s' \<le> length \<tau>s" using mpcl mpcu by arith
 thm wt_instr_appL[where \<tau>s' = "\<tau>s'", OF wti]
   ultimately have "P,T,m,mpc - length \<tau>s' + length \<tau>s',shift (length \<tau>s') []
                      \<turnstile> i,pc - length \<tau>s' + length \<tau>s' :: \<tau>s' @ \<tau>s"
     by(rule wt_instr_appL[where \<tau>s' = "\<tau>s'", OF wti])
   then show ?thesis using pcl mpcl by (simp split:nat_diff_split_asm)
 qed
 (*>*)
 
 
 lemma xcpt_app_pcs:
   "pc \<notin> pcs xt \<Longrightarrow> xcpt_app i P pc mxs xt \<tau>"
 (*<*)
 by (auto simp add: xcpt_app_def relevant_entries_def is_relevant_entry_def pcs_def)
 (*>*)
 
 
 lemma xcpt_eff_pcs:
   "pc \<notin> pcs xt \<Longrightarrow> xcpt_eff i P pc \<tau> xt = []"
 (*<*)
 by (cases \<tau>)
    (auto simp add: is_relevant_entry_def xcpt_eff_def relevant_entries_def pcs_def
            intro!: filter_False)
 (*>*)
 
 
 lemma pcs_shift:
   "pc < n \<Longrightarrow> pc \<notin> pcs (shift n xt)" 
 (*<*)by (auto simp add: shift_def pcs_def)(*>*)
 
 
 lemma wt_instr_appRx:
   "\<lbrakk> P,T,m,mpc,xt \<turnstile> is!pc,pc :: \<tau>s; pc < size is; size is < size \<tau>s; mpc \<le> size \<tau>s \<rbrakk>
   \<Longrightarrow> P,T,m,mpc,xt @ shift (size is) xt' \<turnstile> is!pc,pc :: \<tau>s"
 (*<*)by (auto simp:wt_instr_def eff_def app_def xcpt_app_pcs xcpt_eff_pcs)(*>*)
 
 
 lemma wt_instr_appLx: 
   "\<lbrakk> P,T,m,mpc,xt \<turnstile> i,pc :: \<tau>s; pc \<notin> pcs xt' \<rbrakk>
   \<Longrightarrow> P,T,m,mpc,xt'@xt \<turnstile> i,pc :: \<tau>s"
 (*<*)by (auto simp:wt_instr_def app_def eff_def xcpt_app_pcs xcpt_eff_pcs)(*>*)
 
 
 lemma (in TC2) wt_instrs_extR:
   "\<turnstile> is,xt [::] \<tau>s \<Longrightarrow> \<turnstile> is,xt [::] \<tau>s @ \<tau>s'"
 (*<*)by(auto simp add:wt_instrs_def wt_instr_appR)(*>*)
 
 
 lemma (in TC2) wt_instrs_ext:
 assumes wt\<^sub>1: "\<turnstile> is\<^sub>1,xt\<^sub>1 [::] \<tau>s\<^sub>1@\<tau>s\<^sub>2" and wt\<^sub>2: "\<turnstile> is\<^sub>2,xt\<^sub>2 [::] \<tau>s\<^sub>2"
   and \<tau>s_size: "size \<tau>s\<^sub>1 = size is\<^sub>1"
  shows "\<turnstile> is\<^sub>1@is\<^sub>2, xt\<^sub>1 @ shift (size is\<^sub>1) xt\<^sub>2 [::] \<tau>s\<^sub>1@\<tau>s\<^sub>2"
 (*<*)
 proof -
   let ?is = "is\<^sub>1@is\<^sub>2" and ?xt = "xt\<^sub>1 @ shift (size is\<^sub>1) xt\<^sub>2"
     and ?\<tau>s = "\<tau>s\<^sub>1@\<tau>s\<^sub>2"
   have "size ?is < size ?\<tau>s" using wt\<^sub>2 \<tau>s_size by(fastforce simp:wt_instrs_def)
   moreover have "pcs ?xt \<subseteq> {0..<size ?is}" using wt\<^sub>1 wt\<^sub>2
     by(fastforce simp:wt_instrs_def)
   moreover {
     fix pc assume pc: "pc<size ?is"
     have "P,T\<^sub>r,mxs,size ?\<tau>s,?xt \<turnstile> ?is!pc,pc :: ?\<tau>s"
     proof(cases "pc < length is\<^sub>1")
       case True then show ?thesis using wt\<^sub>1 pc
         by(fastforce simp: wt_instrs_def wt_instr_appRx)
     next
       case False
       then have "pc - length is\<^sub>1 < length is\<^sub>2" using pc by fastforce
       then have "P,T\<^sub>r,mxs,length \<tau>s\<^sub>2,xt\<^sub>2 \<turnstile> is\<^sub>2 ! (pc - length is\<^sub>1),pc - length is\<^sub>1 :: \<tau>s\<^sub>2"
         using wt\<^sub>2 by(clarsimp simp: wt_instrs_def)
       moreover have "pc - length is\<^sub>1 < length \<tau>s\<^sub>2" using pc wt\<^sub>2
         by(clarsimp simp: wt_instrs_def) arith
       moreover have "length \<tau>s\<^sub>2 \<le> length \<tau>s\<^sub>2" by simp
       moreover have "pc - length is\<^sub>1 + length \<tau>s\<^sub>1 \<notin> pcs xt\<^sub>1" using wt\<^sub>1 \<tau>s_size
         by(fastforce simp: wt_instrs_def)
       ultimately have "P,T\<^sub>r,mxs,length \<tau>s\<^sub>2 + length \<tau>s\<^sub>1,xt\<^sub>1 @ shift (length \<tau>s\<^sub>1) xt\<^sub>2
                          \<turnstile> is\<^sub>2 ! (pc - length is\<^sub>1),pc - length is\<^sub>1 + length \<tau>s\<^sub>1 :: \<tau>s\<^sub>1 @ \<tau>s\<^sub>2"
         by(rule wt_instr_appLx[OF wt_instr_appL[where \<tau>s' = "\<tau>s\<^sub>1"]])
       then show ?thesis using False \<tau>s_size by(simp add:add.commute)
     qed
   }
   ultimately show ?thesis by(clarsimp simp:wt_instrs_def)
 qed
 (*>*)
 
 corollary (in TC2) wt_instrs_ext2:
   "\<lbrakk> \<turnstile> is\<^sub>2,xt\<^sub>2 [::] \<tau>s\<^sub>2; \<turnstile> is\<^sub>1,xt\<^sub>1 [::] \<tau>s\<^sub>1@\<tau>s\<^sub>2; size \<tau>s\<^sub>1 = size is\<^sub>1 \<rbrakk>
   \<Longrightarrow> \<turnstile> is\<^sub>1@is\<^sub>2, xt\<^sub>1 @ shift (size is\<^sub>1) xt\<^sub>2 [::] \<tau>s\<^sub>1@\<tau>s\<^sub>2"
 (*<*)by(rule wt_instrs_ext)(*>*)
 
 
 corollary (in TC2) wt_instrs_ext_prefix [trans]:
   "\<lbrakk> \<turnstile> is\<^sub>1,xt\<^sub>1 [::] \<tau>s\<^sub>1@\<tau>s\<^sub>2; \<turnstile> is\<^sub>2,xt\<^sub>2 [::] \<tau>s\<^sub>3;
      size \<tau>s\<^sub>1 = size is\<^sub>1; prefix \<tau>s\<^sub>3 \<tau>s\<^sub>2 \<rbrakk>
   \<Longrightarrow> \<turnstile> is\<^sub>1@is\<^sub>2, xt\<^sub>1 @ shift (size is\<^sub>1) xt\<^sub>2 [::] \<tau>s\<^sub>1@\<tau>s\<^sub>2"
 (*<*)by(bestsimp simp:prefix_def elim: wt_instrs_ext dest:wt_instrs_extR)(*>*)
 
 
 corollary (in TC2) wt_instrs_app:
   assumes is\<^sub>1: "\<turnstile> is\<^sub>1,xt\<^sub>1 [::] \<tau>s\<^sub>1@[\<tau>]"
   assumes is\<^sub>2: "\<turnstile> is\<^sub>2,xt\<^sub>2 [::] \<tau>#\<tau>s\<^sub>2"
   assumes s: "size \<tau>s\<^sub>1 = size is\<^sub>1"
   shows "\<turnstile> is\<^sub>1@is\<^sub>2, xt\<^sub>1@shift (size is\<^sub>1) xt\<^sub>2 [::] \<tau>s\<^sub>1@\<tau>#\<tau>s\<^sub>2"
 (*<*)
 proof -
   from is\<^sub>1 have "\<turnstile> is\<^sub>1,xt\<^sub>1 [::] (\<tau>s\<^sub>1@[\<tau>])@\<tau>s\<^sub>2"
     by (rule wt_instrs_extR)
   hence "\<turnstile> is\<^sub>1,xt\<^sub>1 [::] \<tau>s\<^sub>1@\<tau>#\<tau>s\<^sub>2" by simp
   from this is\<^sub>2 s show ?thesis by (rule wt_instrs_ext) 
 qed
 (*>*)
 
 
 corollary (in TC2) wt_instrs_app_last[trans]:
 assumes "\<turnstile> is\<^sub>2,xt\<^sub>2 [::] \<tau>#\<tau>s\<^sub>2" "\<turnstile> is\<^sub>1,xt\<^sub>1 [::] \<tau>s\<^sub>1"
   "last \<tau>s\<^sub>1 = \<tau>" "size \<tau>s\<^sub>1 = size is\<^sub>1+1"
 shows "\<turnstile> is\<^sub>1@is\<^sub>2, xt\<^sub>1@shift (size is\<^sub>1) xt\<^sub>2 [::] \<tau>s\<^sub>1@\<tau>s\<^sub>2"
 (*<*)
 using assms proof(cases \<tau>s\<^sub>1 rule:rev_cases)
   case (snoc ys y)
   then show ?thesis using assms by(simp add:wt_instrs_app)
 qed simp
 (*>*)
 
 
 corollary (in TC2) wt_instrs_append_last[trans]:
 assumes wtis: "\<turnstile> is,xt [::] \<tau>s" and wti: "P,T\<^sub>r,mxs,mpc,[] \<turnstile> i,pc :: \<tau>s"
   and pc: "pc = size is" and mpc: "mpc = size \<tau>s" and is_\<tau>s: "size is + 1 < size \<tau>s"
 shows "\<turnstile> is@[i],xt [::] \<tau>s"
 (*<*)
 proof -
   have pc_xt: "pc \<notin> pcs xt" using wtis pc by (fastforce simp:wt_instrs_def)
   have "pcs xt \<subseteq> {..<Suc (length is)}" using wtis by (fastforce simp:wt_instrs_def)
   moreover {
     fix pc' assume pc': "\<not> pc' < length is" "pc' < Suc (length is)"
     have "P,T\<^sub>r,mxs,length \<tau>s,xt \<turnstile> i,pc' :: \<tau>s"
       using wt_instr_appLx[where xt = "[]",simplified,OF wti pc_xt]
             less_antisym[OF pc'] pc mpc by simp
   }
   ultimately show ?thesis using wtis is_\<tau>s by(clarsimp simp add:wt_instrs_def)
 qed
 (*>*)
 
 
 corollary (in TC2) wt_instrs_app2:
   "\<lbrakk> \<turnstile> is\<^sub>2,xt\<^sub>2 [::] \<tau>'#\<tau>s\<^sub>2;  \<turnstile> is\<^sub>1,xt\<^sub>1 [::] \<tau>#\<tau>s\<^sub>1@[\<tau>'];
      xt' = xt\<^sub>1 @ shift (size is\<^sub>1) xt\<^sub>2;  size \<tau>s\<^sub>1+1 = size is\<^sub>1 \<rbrakk>
   \<Longrightarrow> \<turnstile> is\<^sub>1@is\<^sub>2,xt' [::] \<tau>#\<tau>s\<^sub>1@\<tau>'#\<tau>s\<^sub>2"
 (*<*)using wt_instrs_app[where ?\<tau>s\<^sub>1.0 = "\<tau> # \<tau>s\<^sub>1"] by simp (*>*)
 
 
 corollary (in TC2) wt_instrs_app2_simp[trans,simp]:
   "\<lbrakk> \<turnstile> is\<^sub>2,xt\<^sub>2 [::] \<tau>'#\<tau>s\<^sub>2;  \<turnstile> is\<^sub>1,xt\<^sub>1 [::] \<tau>#\<tau>s\<^sub>1@[\<tau>']; size \<tau>s\<^sub>1+1 = size is\<^sub>1 \<rbrakk>
   \<Longrightarrow> \<turnstile> is\<^sub>1@is\<^sub>2, xt\<^sub>1@shift (size is\<^sub>1) xt\<^sub>2 [::] \<tau>#\<tau>s\<^sub>1@\<tau>'#\<tau>s\<^sub>2"
 (*<*)using wt_instrs_app[where ?\<tau>s\<^sub>1.0 = "\<tau> # \<tau>s\<^sub>1"] by simp(*>*)
 
 
 corollary (in TC2) wt_instrs_Cons[simp]:
   "\<lbrakk> \<tau>s \<noteq> []; \<turnstile> [i],[] [::] [\<tau>,\<tau>']; \<turnstile> is,xt [::] \<tau>'#\<tau>s \<rbrakk>
   \<Longrightarrow> \<turnstile> i#is,shift 1 xt [::] \<tau>#\<tau>'#\<tau>s"
 (*<*)
 using wt_instrs_app2[where ?is\<^sub>1.0 = "[i]" and ?\<tau>s\<^sub>1.0 = "[]" and ?is\<^sub>2.0 = "is"
                       and ?xt\<^sub>1.0 = "[]"]
 by simp
 
 
 corollary (in TC2) wt_instrs_Cons2[trans]:
   assumes \<tau>s: "\<turnstile> is,xt [::] \<tau>s"
   assumes i: "P,T\<^sub>r,mxs,mpc,[] \<turnstile> i,0 :: \<tau>#\<tau>s"
   assumes mpc: "mpc = size \<tau>s + 1"
   shows "\<turnstile> i#is,shift 1 xt [::] \<tau>#\<tau>s"
 (*<*)
 proof -
   from \<tau>s have "\<tau>s \<noteq> []" by (auto simp: wt_instrs_def)
   with mpc i have "\<turnstile> [i],[] [::] [\<tau>]@\<tau>s" by (simp add: wt_instrs_def)
   with \<tau>s show ?thesis by (fastforce dest: wt_instrs_ext)
 qed
 (*>*)
 
 
 lemma (in TC2) wt_instrs_last_incr[trans]:
 assumes wtis: "\<turnstile> is,xt [::] \<tau>s@[\<tau>]" and ss: "P \<turnstile> \<tau> \<le>' \<tau>'"
 shows "\<turnstile> is,xt [::] \<tau>s@[\<tau>']"
 (*<*)
 proof -
   let ?\<tau>s = "\<tau>s@[\<tau>]" and ?\<tau>s' = "\<tau>s@[\<tau>']"
   { fix pc assume pc: "pc< size is"
     let ?i = "is!pc"
     have app_pc: "app (is ! pc) P mxs T\<^sub>r pc (length ?\<tau>s) xt (\<tau>s ! pc)"
       using wtis pc by(clarsimp simp add:wt_instrs_def wt_instr_def)
     then have Apc\<tau>': "\<And>pc' \<tau>'. (pc',\<tau>') \<in> set (eff ?i P pc xt (?\<tau>s!pc))
      \<Longrightarrow> pc' < length ?\<tau>s"
       using wtis pc by(fastforce simp add:wt_instrs_def app_def)
     have Aepc\<tau>': "\<And>pc' \<tau>'. (pc',\<tau>') \<in> set (eff ?i P pc xt (?\<tau>s!pc))
      \<Longrightarrow> P \<turnstile> \<tau>' \<le>' ?\<tau>s!pc'"
       using wtis pc by(fastforce simp add:wt_instrs_def wt_instr_def)
     { fix pc1 \<tau>1 assume pc\<tau>1: "(pc1,\<tau>1) \<in> set (eff ?i P pc xt (?\<tau>s'!pc))"
       then have epc\<tau>': "(pc1,\<tau>1) \<in> set (eff ?i P pc xt (?\<tau>s!pc))"
           using wtis pc by(simp add:wt_instrs_def)
       have "P \<turnstile> \<tau>1 \<le>' ?\<tau>s'!pc1"
       proof(cases "pc1 < length \<tau>s")
         case True
         then show ?thesis using wtis pc pc\<tau>1
           by(fastforce simp add:wt_instrs_def wt_instr_def)
       next
         case False
         then have "pc1 < length ?\<tau>s" using Apc\<tau>'[OF epc\<tau>'] by simp
         then have [simp]: "pc1 = size \<tau>s" using False by clarsimp
         have "P \<turnstile> \<tau>1 \<le>' \<tau>" using Aepc\<tau>'[OF epc\<tau>'] by simp
         then have "P \<turnstile> \<tau>1 \<le>' \<tau>'" by(rule sup_state_opt_trans[OF _ ss])
         then show ?thesis by simp
       qed
     }
     then have "P,T\<^sub>r,mxs,size ?\<tau>s',xt \<turnstile> is!pc,pc :: ?\<tau>s'" using wtis pc
       by(clarsimp simp add:wt_instrs_def wt_instr_def)
   }
   then show ?thesis using wtis by(simp add:wt_instrs_def)
 qed
 (*>*)
 
 
 lemma [iff]: "xcpt_app i P pc mxs [] \<tau>"
 (*<*)by (simp add: xcpt_app_def relevant_entries_def)(*>*)
 
 
 lemma [simp]: "xcpt_eff i P pc \<tau> [] = []"
 (*<*)by (simp add: xcpt_eff_def relevant_entries_def)(*>*)
 
 
 lemma (in TC2) wt_New:
   "\<lbrakk> is_class P C; size ST < mxs \<rbrakk> \<Longrightarrow>
    \<turnstile> [New C],[] [::] [ty\<^sub>i' ST E A, ty\<^sub>i' (Class C#ST) E A]"
 (*<*)by(simp add:wt_defs ty\<^sub>i'_def)(*>*)
 
 
 lemma (in TC2) wt_Cast:
   "is_class P C \<Longrightarrow>
    \<turnstile> [Checkcast C],[] [::] [ty\<^sub>i' (Class D # ST) E A, ty\<^sub>i' (Class C # ST) E A]"
 (*<*)by(simp add: ty\<^sub>i'_def wt_defs)(*>*)
 
 
 lemma (in TC2) wt_Push:
   "\<lbrakk> size ST < mxs; typeof v = Some T \<rbrakk>
   \<Longrightarrow> \<turnstile> [Push v],[] [::] [ty\<^sub>i' ST E A, ty\<^sub>i' (T#ST) E A]"
 (*<*)by(simp add: ty\<^sub>i'_def wt_defs)(*>*)
 
 
 lemma (in TC2) wt_Pop:
  "\<turnstile> [Pop],[] [::] (ty\<^sub>i' (T#ST) E A # ty\<^sub>i' ST E A # \<tau>s)"
 (*<*)by(simp add: ty\<^sub>i'_def wt_defs)(*>*)
 
 
 lemma (in TC2) wt_CmpEq:
   "\<lbrakk> P \<turnstile> T\<^sub>1 \<le> T\<^sub>2 \<or> P \<turnstile> T\<^sub>2 \<le> T\<^sub>1\<rbrakk>
   \<Longrightarrow> \<turnstile> [CmpEq],[] [::] [ty\<^sub>i' (T\<^sub>2 # T\<^sub>1 # ST) E A, ty\<^sub>i' (Boolean # ST) E A]"
 (*<*) by(auto simp:ty\<^sub>i'_def wt_defs elim!: refTE not_refTE) (*>*)
 
 
 lemma (in TC2) wt_IAdd:
   "\<turnstile> [IAdd],[] [::] [ty\<^sub>i' (Integer#Integer#ST) E A, ty\<^sub>i' (Integer#ST) E A]"
 (*<*)by(simp add:ty\<^sub>i'_def wt_defs)(*>*)
 
 
 lemma (in TC2) wt_Load:
   "\<lbrakk> size ST < mxs; size E \<le> mxl; i \<in>\<in> A; i < size E \<rbrakk>
   \<Longrightarrow> \<turnstile> [Load i],[] [::] [ty\<^sub>i' ST E A, ty\<^sub>i' (E!i # ST) E A]"
 (*<*)by(auto simp add:ty\<^sub>i'_def wt_defs ty\<^sub>l_def hyperset_defs)(*>*)
 
 
 lemma (in TC2) wt_Store:
  "\<lbrakk> P \<turnstile> T \<le> E!i; i < size E; size E \<le> mxl \<rbrakk> \<Longrightarrow>
   \<turnstile> [Store i],[] [::] [ty\<^sub>i' (T#ST) E A, ty\<^sub>i' ST E (\<lfloor>{i}\<rfloor> \<squnion> A)]"
 (*<*)
 by(auto simp:hyperset_defs nth_list_update ty\<^sub>i'_def wt_defs ty\<^sub>l_def
         intro:list_all2_all_nthI)
 (*>*)
 
 
 lemma (in TC2) wt_Get:
  "\<lbrakk> P \<turnstile> C sees F,NonStatic:T in D \<rbrakk> \<Longrightarrow>
   \<turnstile> [Getfield F D],[] [::] [ty\<^sub>i' (Class C # ST) E A, ty\<^sub>i' (T # ST) E A]"
 (*<*)by(auto simp: ty\<^sub>i'_def wt_defs dest: sees_field_idemp sees_field_decl_above)(*>*)
 
 lemma (in TC2) wt_GetS:
  "\<lbrakk> size ST < mxs; P \<turnstile> C sees F,Static:T in D \<rbrakk> \<Longrightarrow>
   \<turnstile> [Getstatic C F D],[] [::] [ty\<^sub>i' ST E A, ty\<^sub>i' (T # ST) E A]"
 (*<*)by(auto simp: ty\<^sub>i'_def wt_defs dest: sees_field_idemp sees_field_decl_above)(*>*)
 
 lemma (in TC2) wt_Put:
   "\<lbrakk> P \<turnstile> C sees F,NonStatic:T in D; P \<turnstile> T' \<le> T \<rbrakk> \<Longrightarrow>
   \<turnstile> [Putfield F D],[] [::] [ty\<^sub>i' (T' # Class C # ST) E A, ty\<^sub>i' ST E A]"
 (*<*)by(auto intro: sees_field_idemp sees_field_decl_above simp: ty\<^sub>i'_def wt_defs)(*>*)
 
 lemma (in TC2) wt_PutS:
   "\<lbrakk> P \<turnstile> C sees F,Static:T in D; P \<turnstile> T' \<le> T \<rbrakk> \<Longrightarrow>
   \<turnstile> [Putstatic C F D],[] [::] [ty\<^sub>i' (T' # ST) E A, ty\<^sub>i' ST E A]"
 (*<*)by(auto intro: sees_field_idemp sees_field_decl_above simp: ty\<^sub>i'_def wt_defs)(*>*)
 
 
 lemma (in TC2) wt_Throw:
   "\<turnstile> [Throw],[] [::] [ty\<^sub>i' (Class C # ST) E A, \<tau>']"
 (*<*)by(auto simp: ty\<^sub>i'_def wt_defs)(*>*)
 
 
 lemma (in TC2) wt_IfFalse:
   "\<lbrakk> 2 \<le> i; nat i < size \<tau>s + 2; P \<turnstile> ty\<^sub>i' ST E A \<le>' \<tau>s ! nat(i - 2) \<rbrakk>
   \<Longrightarrow> \<turnstile> [IfFalse i],[] [::] ty\<^sub>i' (Boolean # ST) E A # ty\<^sub>i' ST E A # \<tau>s"
 (*<*)
 by(simp add: ty\<^sub>i'_def wt_defs eval_nat_numeral nat_diff_distrib)
 (*>*)
 
 
 lemma wt_Goto:
  "\<lbrakk> 0 \<le> int pc + i; nat (int pc + i) < size \<tau>s; size \<tau>s \<le> mpc;
     P \<turnstile> \<tau>s!pc \<le>' \<tau>s ! nat (int pc + i) \<rbrakk>
  \<Longrightarrow> P,T,mxs,mpc,[] \<turnstile> Goto i,pc :: \<tau>s"
 (*<*)by(clarsimp simp add: TC2.wt_defs)(*>*)
 
 
 lemma (in TC2) wt_Invoke:
   "\<lbrakk> size es = size Ts'; P \<turnstile> C sees M,NonStatic: Ts\<rightarrow>T = m in D; P \<turnstile> Ts' [\<le>] Ts \<rbrakk>
   \<Longrightarrow> \<turnstile> [Invoke M (size es)],[] [::] [ty\<^sub>i' (rev Ts' @ Class C # ST) E A, ty\<^sub>i' (T#ST) E A]"
 (*<*)by(fastforce simp add: ty\<^sub>i'_def wt_defs)(*>*)
 
 lemma (in TC2) wt_Invokestatic:
   "\<lbrakk> size ST < mxs; size es = size Ts'; M \<noteq> clinit;
      P \<turnstile> C sees M,Static: Ts\<rightarrow>T = m in D; P \<turnstile> Ts' [\<le>] Ts \<rbrakk>
   \<Longrightarrow> \<turnstile> [Invokestatic C M (size es)],[] [::] [ty\<^sub>i' (rev Ts' @ ST) E A, ty\<^sub>i' (T#ST) E A]"
 (*<*)by(fastforce simp add: ty\<^sub>i'_def wt_defs)(*>*)
 
 
 corollary (in TC2) wt_instrs_app3[simp]:
   "\<lbrakk> \<turnstile> is\<^sub>2,[] [::] (\<tau>' # \<tau>s\<^sub>2);  \<turnstile> is\<^sub>1,xt\<^sub>1 [::] \<tau> # \<tau>s\<^sub>1 @ [\<tau>']; size \<tau>s\<^sub>1+1 = size is\<^sub>1\<rbrakk>
   \<Longrightarrow> \<turnstile> (is\<^sub>1 @ is\<^sub>2),xt\<^sub>1 [::] \<tau> # \<tau>s\<^sub>1 @ \<tau>' # \<tau>s\<^sub>2"
 (*<*)using wt_instrs_app2[where ?xt\<^sub>2.0 = "[]"] by (simp add:shift_def)(*>*)
 
 
 corollary (in TC2) wt_instrs_Cons3[simp]:
   "\<lbrakk> \<tau>s \<noteq> []; \<turnstile> [i],[] [::] [\<tau>,\<tau>']; \<turnstile> is,[] [::] \<tau>'#\<tau>s \<rbrakk>
   \<Longrightarrow> \<turnstile> (i # is),[] [::] \<tau> # \<tau>' # \<tau>s"
 (*<*)
 using wt_instrs_Cons[where ?xt = "[]"]
 by (simp add:shift_def)
 
 (*<*)
 declare nth_append[simp del]
 declare [[simproc del: list_to_set_comprehension]]
 (*>*)
 
 lemma (in TC2) wt_instrs_xapp[trans]:
 assumes wtis: "\<turnstile> is\<^sub>1 @ is\<^sub>2, xt [::] \<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2"
   and P_\<tau>s\<^sub>1: "\<forall>\<tau> \<in> set \<tau>s\<^sub>1. \<forall>ST' LT'. \<tau> = Some(ST',LT') \<longrightarrow> 
     size ST \<le> size ST' \<and> P \<turnstile> Some (drop (size ST' - size ST) ST',LT') \<le>' ty\<^sub>i' ST E A"
   and is_\<tau>s: "size is\<^sub>1 = size \<tau>s\<^sub>1" and PC: "is_class P C" and ST_mxs: "size ST < mxs"
 shows "\<turnstile> is\<^sub>1 @ is\<^sub>2, xt @ [(0,size is\<^sub>1 - 1,C,size is\<^sub>1,size ST)] [::] \<tau>s\<^sub>1 @ ty\<^sub>i' (Class C # ST) E A # \<tau>s\<^sub>2"
 (*<*)(is "\<turnstile> ?is, xt@[?xte] [::] ?\<tau>s" is "\<turnstile> ?is, ?xt' [::] ?\<tau>s")
 proof -
   have P_\<tau>s\<^sub>1': "\<And>\<tau>. \<tau> \<in> set \<tau>s\<^sub>1 \<Longrightarrow> (\<forall>ST' LT'. \<tau> = Some(ST',LT') \<longrightarrow>
      size ST \<le> size ST' \<and> P \<turnstile> Some (drop (size ST' - size ST) ST',LT') \<le>' ty\<^sub>i' ST E A)"
     using P_\<tau>s\<^sub>1 by fast
   have "size ?is < size ?\<tau>s" and "pcs ?xt' \<subseteq> {0..<size ?is}"
     and P_pc: "\<And>pc. pc< size ?is \<Longrightarrow> P,T\<^sub>r,mxs,size ?\<tau>s,xt \<turnstile> ?is!pc,pc :: ?\<tau>s"
     using wtis by(simp_all add:wt_instrs_def)
   moreover {
     fix pc let ?mpc = "size ?\<tau>s" and ?i = "?is!pc" and ?t = "?\<tau>s!pc"
     assume "pc< size ?is"
     then have wti: "P,T\<^sub>r,mxs,?mpc,xt \<turnstile> ?i,pc :: ?\<tau>s" by(rule P_pc)
     then have app: "app ?i P mxs T\<^sub>r pc ?mpc xt ?t"
        and eff_ss: "\<And>pc' \<tau>'. (pc',\<tau>') \<in> set (eff ?i P pc xt (?\<tau>s!pc))
                            \<Longrightarrow> P \<turnstile> \<tau>' \<le>' ?\<tau>s!pc'"
       by(fastforce simp add: wt_instr_def)+
     have "app ?i P mxs T\<^sub>r pc ?mpc ?xt' ?t
              \<and> (\<forall>(pc',\<tau>') \<in> set (eff ?i P pc ?xt' ?t). P \<turnstile> \<tau>' \<le>' ?\<tau>s!pc')"
     proof (cases ?t)
       case (Some \<tau>)
       obtain ST' LT' where \<tau>: "\<tau> = (ST', LT')" by(cases \<tau>) simp
       have app\<^sub>i: "app\<^sub>i (?i,P,pc,mxs,T\<^sub>r,\<tau>)" and xcpt_app: "xcpt_app ?i P pc mxs xt \<tau>"
          and eff_pc: "\<And>pc' \<tau>'. (pc',\<tau>') \<in> set (eff ?i P pc xt ?t) \<Longrightarrow> pc' < ?mpc"
         using Some app by(fastforce simp add: app_def)+
       have "xcpt_app ?i P pc mxs ?xt' \<tau>"
       proof(cases "pc < length \<tau>s\<^sub>1 - 1")
         case False then show ?thesis using Some \<tau> is_\<tau>s xcpt_app
           by (clarsimp simp: xcpt_app_def relevant_entries_def
                              is_relevant_entry_def)
       next
         case True
         then have True': "pc < length \<tau>s\<^sub>1" by simp
         then have "\<tau>s\<^sub>1 ! pc = ?t" by(fastforce simp: nth_append)
         moreover have \<tau>s\<^sub>1_pc: "\<tau>s\<^sub>1 ! pc \<in> set \<tau>s\<^sub>1" by(rule nth_mem[OF True'])
         ultimately show ?thesis
          using Some \<tau> PC ST_mxs xcpt_app P_\<tau>s\<^sub>1'[OF \<tau>s\<^sub>1_pc]
           by (simp add: xcpt_app_def relevant_entries_def)
       qed
       moreover {
         fix pc' \<tau>' assume efft: "(pc',\<tau>') \<in> set (eff ?i P pc ?xt' ?t)"
         have "pc' < ?mpc \<and> P \<turnstile> \<tau>' \<le>' ?\<tau>s!pc'" (is "?P1 \<and> ?P2")
         proof(cases "(pc',\<tau>') \<in> set (eff ?i P pc xt ?t)")
           case True
           have ?P1 using True by(rule eff_pc)
           moreover have ?P2 using True by(rule eff_ss)
           ultimately show ?thesis by simp
         next
           case False
           then have xte: "(pc',\<tau>') \<in> set (xcpt_eff ?i P pc \<tau> [?xte])"
             using efft Some by(clarsimp simp: eff_def)
           then have ?P1 using Some \<tau> is_\<tau>s
             by(clarsimp simp: xcpt_eff_def relevant_entries_def split: if_split_asm)
           moreover have ?P2
           proof(cases "pc < length \<tau>s\<^sub>1 - 1")
             case False': False
             then show ?thesis using False Some \<tau> xte is_\<tau>s
               by(simp add: xcpt_eff_def relevant_entries_def is_relevant_entry_def)
           next
             case True
             then have True': "pc < length \<tau>s\<^sub>1" by simp
             have \<tau>s\<^sub>1_pc: "\<tau>s\<^sub>1 ! pc \<in> set \<tau>s\<^sub>1" by(rule nth_mem[OF True'])
             have "P \<turnstile> \<lfloor>(Class C # drop (length ST' - length ST) ST', LT')\<rfloor>
                          \<le>' ty\<^sub>i' (Class C # ST) E A"
                using True' Some \<tau> P_\<tau>s\<^sub>1'[OF \<tau>s\<^sub>1_pc]
               by (fastforce simp: nth_append ty\<^sub>i'_def)
             then show ?thesis using \<tau> xte is_\<tau>s
               by(simp add: xcpt_eff_def relevant_entries_def split: if_split_asm)
           qed
           ultimately show ?thesis by simp
         qed
       }
       ultimately show ?thesis using Some app\<^sub>i by(fastforce simp add: app_def)
     qed simp
     then have "P,T\<^sub>r,mxs,size ?\<tau>s,?xt' \<turnstile> ?is!pc,pc :: ?\<tau>s"
       by(simp add: wt_instr_def)
   }
   ultimately show ?thesis by(simp add:wt_instrs_def)
 qed
 
 declare [[simproc add: list_to_set_comprehension]]
 declare nth_append[simp]
 (*>*)
 
 lemma drop_Cons_Suc:
   "\<And>xs. drop n xs = y#ys \<Longrightarrow> drop (Suc n) xs = ys"
 proof(induct n)
   case (Suc n) then show ?case by(simp add: drop_Suc)
 qed simp
 
 lemma drop_mess:
 assumes "Suc (length xs\<^sub>0) \<le> length xs"
   and "drop (length xs - Suc (length xs\<^sub>0)) xs = x # xs\<^sub>0"
 shows "drop (length xs - length xs\<^sub>0) xs = xs\<^sub>0"
 using assms proof(cases xs)
   case (Cons a list) then show ?thesis using assms
   proof(cases "length list - length xs\<^sub>0")
     case Suc then show ?thesis using Cons assms
       by (simp add: Suc_diff_le drop_Cons_Suc)
   qed simp
 qed simp
 
 (*<*)
 declare (in TC0)
   after_def[simp] pair_eq_ty\<^sub>i'_conv[simp]
 (*>*)
 
 lemma (in TC1) compT_ST_prefix:
  "\<And>E A ST\<^sub>0. \<lfloor>(ST,LT)\<rfloor> \<in> set(compT E A ST\<^sub>0 e) \<Longrightarrow> 
   size ST\<^sub>0 \<le> size ST \<and> drop (size ST - size ST\<^sub>0) ST = ST\<^sub>0"
 and
  "\<And>E A ST\<^sub>0. \<lfloor>(ST,LT)\<rfloor> \<in> set(compTs E A ST\<^sub>0 es) \<Longrightarrow> 
   size ST\<^sub>0 \<le> size ST \<and> drop (size ST - size ST\<^sub>0) ST = ST\<^sub>0"
 (*<*)
 proof(induct e and es rule: compT.induct compTs.induct)
   case (FAss e\<^sub>1 F D e\<^sub>2)
   moreover {
     let ?ST\<^sub>0 = "ty E e\<^sub>1 # ST\<^sub>0"
     fix A assume "\<lfloor>(ST, LT)\<rfloor> \<in> set (compT E A ?ST\<^sub>0 e\<^sub>2)"
     with FAss
     have "length ?ST\<^sub>0 \<le> length ST \<and> drop (size ST - size ?ST\<^sub>0) ST = ?ST\<^sub>0" by blast
     hence ?case  by (clarsimp simp add: drop_mess)
   }
   ultimately show ?case by auto
 next
   case TryCatch thus ?case by auto
 next
   case Block thus ?case by auto
 next
   case Seq thus ?case by auto
 next
   case While thus ?case by auto
 next
   case Cond thus ?case by auto
 next
   case (Call e M es)
   moreover {
     let ?ST\<^sub>0 = "ty E e # ST\<^sub>0"
     fix A assume "\<lfloor>(ST, LT)\<rfloor> \<in> set (compTs E A ?ST\<^sub>0 es)"
     with Call
     have "length ?ST\<^sub>0 \<le> length ST \<and> drop (size ST - size ?ST\<^sub>0) ST = ?ST\<^sub>0" by blast
     hence ?case  by (clarsimp simp add: drop_mess)
   }
   ultimately show ?case by auto
 next
   case (Cons_exp e es)
   moreover {
     let ?ST\<^sub>0 = "ty E e # ST\<^sub>0"
     fix A assume "\<lfloor>(ST, LT)\<rfloor> \<in> set (compTs E A ?ST\<^sub>0 es)"
     with Cons_exp
     have "length ?ST\<^sub>0 \<le> length ST \<and> drop (size ST - size ?ST\<^sub>0) ST = ?ST\<^sub>0" by blast
     hence ?case  by (clarsimp simp add: drop_mess)
   }
   ultimately show ?case by auto
 next
   case (BinOp e\<^sub>1 bop e\<^sub>2)
   moreover {
     let ?ST\<^sub>0 = "ty E e\<^sub>1 # ST\<^sub>0"
     fix A assume "\<lfloor>(ST, LT)\<rfloor> \<in> set (compT E A ?ST\<^sub>0 e\<^sub>2)"
     with BinOp 
     have "length ?ST\<^sub>0 \<le> length ST \<and> drop (size ST - size ?ST\<^sub>0) ST = ?ST\<^sub>0" by blast
     hence ?case by (clarsimp simp add: drop_mess)
   }
   ultimately show ?case by auto
 next
   case new thus ?case by auto
 next
   case Val thus ?case by auto    
 next
   case Cast thus ?case by auto
 next
   case Var thus ?case by auto
 next
   case LAss thus ?case by auto
 next
   case throw thus ?case by auto
 next
   case FAcc thus ?case by auto
 next
   case SFAcc thus ?case by auto
 next
   case SFAss thus ?case by auto
 next
   case (SCall C M es) thus ?case by auto
 next
   case INIT thus ?case by auto
 next
   case RI thus ?case by auto
 next
   case Nil_exp thus ?case by auto
 qed 
 
 declare (in TC0) 
   after_def[simp del] pair_eq_ty\<^sub>i'_conv[simp del]
 (*>*)
 
 (* FIXME *)
 lemma fun_of_simp [simp]: "fun_of S x y = ((x,y) \<in> S)" 
 (*<*) by (simp add: fun_of_def)(*>*)
 
 theorem (in TC2) compT_wt_instrs: "\<And>E T A ST.
   \<lbrakk> P,E \<turnstile>\<^sub>1 e :: T; \<D> e A; \<B> e (size E); 
     size ST + max_stack e \<le> mxs; size E + max_vars e \<le> mxl \<rbrakk>
   \<Longrightarrow> \<turnstile> compE\<^sub>2 e, compxE\<^sub>2 e 0 (size ST) [::]
                  ty\<^sub>i' ST E A # compT E A ST e @ [after E A ST e]"
 (*<*)(is "\<And>E T A ST. PROP ?P e E T A ST")(*>*)
 
 and "\<And>E Ts A ST.
   \<lbrakk> P,E \<turnstile>\<^sub>1 es[::]Ts;  \<D>s es A; \<B>s es (size E); 
     size ST + max_stacks es \<le> mxs; size E + max_varss es \<le> mxl \<rbrakk>
   \<Longrightarrow> let \<tau>s = ty\<^sub>i' ST E A # compTs E A ST es in
        \<turnstile> compEs\<^sub>2 es,compxEs\<^sub>2 es 0 (size ST) [::] \<tau>s \<and>
        last \<tau>s = ty\<^sub>i' (rev Ts @ ST) E (A \<squnion> \<A>s es)"
 (*<*)
 (is "\<And>E Ts A ST. PROP ?Ps es E Ts A ST")
 proof(induct e and es rule: compxE\<^sub>2.induct compxEs\<^sub>2.induct)
   case (TryCatch e\<^sub>1 C i e\<^sub>2)
   hence [simp]: "i = size E" by simp
   have wt\<^sub>1: "P,E \<turnstile>\<^sub>1 e\<^sub>1 :: T" and wt\<^sub>2: "P,E@[Class C] \<turnstile>\<^sub>1 e\<^sub>2 :: T"
     and "class": "is_class P C" using TryCatch by auto
   let ?A\<^sub>1 = "A \<squnion> \<A> e\<^sub>1" let ?A\<^sub>i = "A \<squnion> \<lfloor>{i}\<rfloor>" let ?E\<^sub>i = "E @ [Class C]"
   let ?\<tau> = "ty\<^sub>i' ST E A" let ?\<tau>s\<^sub>1 = "compT E A ST e\<^sub>1"
   let ?\<tau>\<^sub>1 = "ty\<^sub>i' (T#ST) E ?A\<^sub>1" let ?\<tau>\<^sub>2 = "ty\<^sub>i' (Class C#ST) E A"
   let ?\<tau>\<^sub>3 = "ty\<^sub>i' ST ?E\<^sub>i ?A\<^sub>i" let ?\<tau>s\<^sub>2 = "compT ?E\<^sub>i ?A\<^sub>i ST e\<^sub>2"
   let ?\<tau>\<^sub>2' = "ty\<^sub>i' (T#ST) ?E\<^sub>i (?A\<^sub>i \<squnion> \<A> e\<^sub>2)"
   let ?\<tau>' = "ty\<^sub>i' (T#ST) E (A \<squnion> \<A> e\<^sub>1 \<sqinter> (\<A> e\<^sub>2 \<ominus> i))"
   let ?go = "Goto (int(size(compE\<^sub>2 e\<^sub>2)) + 2)"
   have "PROP ?P e\<^sub>2 ?E\<^sub>i T ?A\<^sub>i ST" by fact
   hence "\<turnstile> compE\<^sub>2 e\<^sub>2,compxE\<^sub>2 e\<^sub>2 0 (size ST) [::] (?\<tau>\<^sub>3 # ?\<tau>s\<^sub>2) @ [?\<tau>\<^sub>2']"
     using TryCatch.prems by(auto simp:after_def)
   also have "?A\<^sub>i \<squnion> \<A> e\<^sub>2 = (A \<squnion> \<A> e\<^sub>2) \<squnion> \<lfloor>{size E}\<rfloor>"
     by(fastforce simp:hyperset_defs)
   also have "P \<turnstile> ty\<^sub>i' (T#ST) ?E\<^sub>i \<dots> \<le>' ty\<^sub>i' (T#ST) E (A \<squnion> \<A> e\<^sub>2)"
     by(simp add:hyperset_defs ty\<^sub>l_incr ty\<^sub>i'_def)
   also have "P \<turnstile> \<dots> \<le>' ty\<^sub>i' (T#ST) E (A \<squnion> \<A> e\<^sub>1 \<sqinter> (\<A> e\<^sub>2 \<ominus> i))"
     by(auto intro!: ty\<^sub>l_antimono simp:hyperset_defs ty\<^sub>i'_def)
   also have "(?\<tau>\<^sub>3 # ?\<tau>s\<^sub>2) @ [?\<tau>'] = ?\<tau>\<^sub>3 # ?\<tau>s\<^sub>2 @ [?\<tau>']" by simp
   also have "\<turnstile> [Store i],[] [::] ?\<tau>\<^sub>2 # [] @ [?\<tau>\<^sub>3]"
     using TryCatch.prems
     by(auto simp:nth_list_update wt_defs ty\<^sub>i'_def ty\<^sub>l_def
       list_all2_conv_all_nth hyperset_defs)
   also have "[] @ (?\<tau>\<^sub>3 # ?\<tau>s\<^sub>2 @ [?\<tau>']) = (?\<tau>\<^sub>3 # ?\<tau>s\<^sub>2 @ [?\<tau>'])" by simp
   also have "P,T\<^sub>r,mxs,size(compE\<^sub>2 e\<^sub>2)+3,[] \<turnstile> ?go,0 :: ?\<tau>\<^sub>1#?\<tau>\<^sub>2#?\<tau>\<^sub>3#?\<tau>s\<^sub>2 @ [?\<tau>']" using wt\<^sub>2
     by (auto simp: hyperset_defs ty\<^sub>i'_def wt_defs nth_Cons nat_add_distrib
       fun_of_def intro: ty\<^sub>l_antimono list_all2_refl split:nat.split)
   also have "\<turnstile> compE\<^sub>2 e\<^sub>1,compxE\<^sub>2 e\<^sub>1 0 (size ST) [::] ?\<tau> # ?\<tau>s\<^sub>1 @ [?\<tau>\<^sub>1]"
     using TryCatch by(auto simp:after_def)
   also have "?\<tau> # ?\<tau>s\<^sub>1 @ ?\<tau>\<^sub>1 # ?\<tau>\<^sub>2 # ?\<tau>\<^sub>3 # ?\<tau>s\<^sub>2 @ [?\<tau>'] =
              (?\<tau> # ?\<tau>s\<^sub>1 @ [?\<tau>\<^sub>1]) @ ?\<tau>\<^sub>2 # ?\<tau>\<^sub>3 # ?\<tau>s\<^sub>2 @ [?\<tau>']" by simp
   also have "compE\<^sub>2 e\<^sub>1 @ ?go  # [Store i] @ compE\<^sub>2 e\<^sub>2 =
              (compE\<^sub>2 e\<^sub>1 @ [?go]) @ (Store i # compE\<^sub>2 e\<^sub>2)" by simp
   also 
   let "?Q \<tau>" = "\<forall>ST' LT'. \<tau> = \<lfloor>(ST', LT')\<rfloor> \<longrightarrow> 
     size ST \<le> size ST' \<and> P \<turnstile> Some (drop (size ST' - size ST) ST',LT') \<le>' ty\<^sub>i' ST E A"
   {
     have "?Q (ty\<^sub>i' ST E A)" by (clarsimp simp add: ty\<^sub>i'_def)
     moreover have "?Q (ty\<^sub>i' (T # ST) E ?A\<^sub>1)" 
       by (fastforce simp add: ty\<^sub>i'_def hyperset_defs intro!: ty\<^sub>l_antimono)
     moreover have "\<And>\<tau>. \<tau> \<in> set (compT E A ST e\<^sub>1) \<Longrightarrow> ?Q \<tau>" using TryCatch.prems
       by clarsimp (frule compT_ST_prefix,
                    fastforce dest!: compT_LT_prefix simp add: ty\<^sub>i'_def)
     ultimately
     have "\<forall>\<tau>\<in>set (ty\<^sub>i' ST E A # compT E A ST e\<^sub>1 @ [ty\<^sub>i' (T # ST) E ?A\<^sub>1]). ?Q \<tau>" 
       by auto
   }
   also from TryCatch.prems max_stack1[OF wt\<^sub>1] have "size ST + 1 \<le> mxs" by auto
   ultimately show ?case using wt\<^sub>1 wt\<^sub>2 TryCatch.prems "class"
     by (simp add:after_def)
 next
   case new thus ?case by(auto simp add:after_def wt_New)
 next
   case (BinOp e\<^sub>1 bop e\<^sub>2) 
   let ?op = "case bop of Eq \<Rightarrow> [CmpEq] | Add \<Rightarrow> [IAdd]"
   have T: "P,E \<turnstile>\<^sub>1 e\<^sub>1 \<guillemotleft>bop\<guillemotright> e\<^sub>2 :: T" by fact
   then obtain T\<^sub>1 T\<^sub>2 where T\<^sub>1: "P,E \<turnstile>\<^sub>1 e\<^sub>1 :: T\<^sub>1" and T\<^sub>2: "P,E \<turnstile>\<^sub>1 e\<^sub>2 :: T\<^sub>2" and 
     bopT: "case bop of Eq \<Rightarrow> (P \<turnstile> T\<^sub>1 \<le> T\<^sub>2 \<or> P \<turnstile> T\<^sub>2 \<le> T\<^sub>1) \<and> T = Boolean 
                     | Add \<Rightarrow> T\<^sub>1 = Integer \<and> T\<^sub>2 = Integer \<and> T = Integer" by auto
   let ?A\<^sub>1 = "A \<squnion> \<A> e\<^sub>1" let ?A\<^sub>2 = "?A\<^sub>1 \<squnion> \<A> e\<^sub>2"
   let ?\<tau> = "ty\<^sub>i' ST E A" let ?\<tau>s\<^sub>1 = "compT E A ST e\<^sub>1"
   let ?\<tau>\<^sub>1 = "ty\<^sub>i' (T\<^sub>1#ST) E ?A\<^sub>1" let ?\<tau>s\<^sub>2 = "compT E ?A\<^sub>1 (T\<^sub>1#ST) e\<^sub>2"
   let ?\<tau>\<^sub>2 = "ty\<^sub>i' (T\<^sub>2#T\<^sub>1#ST) E ?A\<^sub>2" let ?\<tau>' = "ty\<^sub>i' (T#ST) E ?A\<^sub>2"
   from bopT have "\<turnstile> ?op,[] [::] [?\<tau>\<^sub>2,?\<tau>']" 
     by (cases bop) (auto simp add: wt_CmpEq wt_IAdd)
   also have "PROP ?P e\<^sub>2 E T\<^sub>2 ?A\<^sub>1 (T\<^sub>1#ST)" by fact
   with BinOp.prems T\<^sub>2 
   have "\<turnstile> compE\<^sub>2 e\<^sub>2, compxE\<^sub>2 e\<^sub>2 0 (size (T\<^sub>1#ST)) [::] ?\<tau>\<^sub>1#?\<tau>s\<^sub>2@[?\<tau>\<^sub>2]" 
     by (auto simp: after_def)
   also from BinOp T\<^sub>1 have "\<turnstile> compE\<^sub>2 e\<^sub>1, compxE\<^sub>2 e\<^sub>1 0 (size ST) [::] ?\<tau>#?\<tau>s\<^sub>1@[?\<tau>\<^sub>1]" 
     by (auto simp: after_def)
   finally show ?case using T T\<^sub>1 T\<^sub>2 by (simp add: after_def hyperUn_assoc)
 next
   case (Cons_exp e es)
   have "P,E \<turnstile>\<^sub>1 e # es [::] Ts" by fact
   then obtain T\<^sub>e Ts' where 
     T\<^sub>e: "P,E \<turnstile>\<^sub>1 e :: T\<^sub>e" and Ts': "P,E \<turnstile>\<^sub>1 es [::] Ts'" and
     Ts: "Ts = T\<^sub>e#Ts'" by auto
   let ?A\<^sub>e = "A \<squnion> \<A> e"  
   let ?\<tau> = "ty\<^sub>i' ST E A" let ?\<tau>s\<^sub>e = "compT E A ST e"  
   let ?\<tau>\<^sub>e = "ty\<^sub>i' (T\<^sub>e#ST) E ?A\<^sub>e" let ?\<tau>s' = "compTs E ?A\<^sub>e (T\<^sub>e#ST) es"
   let ?\<tau>s = "?\<tau> # ?\<tau>s\<^sub>e @ (?\<tau>\<^sub>e # ?\<tau>s')"
   have Ps: "PROP ?Ps es E Ts' ?A\<^sub>e (T\<^sub>e#ST)" by fact
   with Cons_exp.prems T\<^sub>e Ts'
   have "\<turnstile> compEs\<^sub>2 es, compxEs\<^sub>2 es 0 (size (T\<^sub>e#ST)) [::] ?\<tau>\<^sub>e#?\<tau>s'" by (simp add: after_def)
   also from Cons_exp T\<^sub>e have "\<turnstile> compE\<^sub>2 e, compxE\<^sub>2 e 0 (size ST) [::] ?\<tau>#?\<tau>s\<^sub>e@[?\<tau>\<^sub>e]" 
     by (auto simp: after_def)
   moreover
   from Ps Cons_exp.prems T\<^sub>e Ts' Ts
   have "last ?\<tau>s = ty\<^sub>i' (rev Ts@ST) E (?A\<^sub>e \<squnion> \<A>s es)" by simp
   ultimately show ?case using T\<^sub>e by (simp add: after_def hyperUn_assoc)
 next
   case (FAss e\<^sub>1 F D e\<^sub>2)
   hence Void: "P,E \<turnstile>\<^sub>1 e\<^sub>1\<bullet>F{D} := e\<^sub>2 :: Void" by auto
   then obtain C T T' where    
     C: "P,E \<turnstile>\<^sub>1 e\<^sub>1 :: Class C" and sees: "P \<turnstile> C sees F,NonStatic:T in D" and
     T': "P,E \<turnstile>\<^sub>1 e\<^sub>2 :: T'" and T'_T: "P \<turnstile> T' \<le> T" by auto
   let ?A\<^sub>1 = "A \<squnion> \<A> e\<^sub>1" let ?A\<^sub>2 = "?A\<^sub>1 \<squnion> \<A> e\<^sub>2"  
   let ?\<tau> = "ty\<^sub>i' ST E A" let ?\<tau>s\<^sub>1 = "compT E A ST e\<^sub>1"
   let ?\<tau>\<^sub>1 = "ty\<^sub>i' (Class C#ST) E ?A\<^sub>1" let ?\<tau>s\<^sub>2 = "compT E ?A\<^sub>1 (Class C#ST) e\<^sub>2"
   let ?\<tau>\<^sub>2 = "ty\<^sub>i' (T'#Class C#ST) E ?A\<^sub>2" let ?\<tau>\<^sub>3 = "ty\<^sub>i' ST E ?A\<^sub>2"
   let ?\<tau>' = "ty\<^sub>i' (Void#ST) E ?A\<^sub>2"
   from FAss.prems sees T'_T 
   have "\<turnstile> [Putfield F D,Push Unit],[] [::] [?\<tau>\<^sub>2,?\<tau>\<^sub>3,?\<tau>']"
     by (fastforce simp add: wt_Push wt_Put)
   also have "PROP ?P e\<^sub>2 E T' ?A\<^sub>1 (Class C#ST)" by fact
   with FAss.prems T' 
   have "\<turnstile> compE\<^sub>2 e\<^sub>2, compxE\<^sub>2 e\<^sub>2 0 (size ST+1) [::] ?\<tau>\<^sub>1#?\<tau>s\<^sub>2@[?\<tau>\<^sub>2]"
     by (auto simp add: after_def hyperUn_assoc) 
   also from FAss C have "\<turnstile> compE\<^sub>2 e\<^sub>1, compxE\<^sub>2 e\<^sub>1 0 (size ST) [::] ?\<tau>#?\<tau>s\<^sub>1@[?\<tau>\<^sub>1]" 
     by (auto simp add: after_def)
   finally show ?case using Void C T' by (simp add: after_def hyperUn_assoc) 
 next
   case (SFAss C F D e\<^sub>2)
   hence Void: "P,E \<turnstile>\<^sub>1 C\<bullet>\<^sub>sF{D} := e\<^sub>2 :: Void" by auto
   then obtain T T' where    
     sees: "P \<turnstile> C sees F,Static:T in D" and
     T': "P,E \<turnstile>\<^sub>1 e\<^sub>2 :: T'" and T'_T: "P \<turnstile> T' \<le> T" by auto
   let ?A\<^sub>2 = "A \<squnion> \<A> e\<^sub>2"  
   let ?\<tau> = "ty\<^sub>i' ST E A" let ?\<tau>s\<^sub>2 = "compT E A ST e\<^sub>2"
   let ?\<tau>\<^sub>2 = "ty\<^sub>i' (T'#ST) E ?A\<^sub>2" let ?\<tau>\<^sub>3 = "ty\<^sub>i' ST E ?A\<^sub>2"
   let ?\<tau>' = "ty\<^sub>i' (Void#ST) E ?A\<^sub>2"
   from SFAss.prems sees T'_T max_stack1[OF T']
   have "\<turnstile> [Putstatic C F D,Push Unit],[] [::] [?\<tau>\<^sub>2,?\<tau>\<^sub>3,?\<tau>']"
     by (fastforce simp add: wt_Push wt_PutS)
   also have "PROP ?P e\<^sub>2 E T' A ST" by fact
   with SFAss.prems T' 
   have "\<turnstile> compE\<^sub>2 e\<^sub>2, compxE\<^sub>2 e\<^sub>2 0 (size ST) [::] ?\<tau>#?\<tau>s\<^sub>2@[?\<tau>\<^sub>2]"
     by (auto simp add: after_def hyperUn_assoc)
   finally show ?case using Void T' by (simp add: after_def hyperUn_assoc) 
 next
   case Val thus ?case by(auto simp:after_def wt_Push)
 next
   case Cast thus ?case by (auto simp:after_def wt_Cast)
 next
   case (Block i T\<^sub>i e)
   let ?\<tau>s = "ty\<^sub>i' ST E A # compT (E @ [T\<^sub>i]) (A\<ominus>i) ST e"
   have IH: "PROP ?P e (E@[T\<^sub>i]) T (A\<ominus>i) ST" by fact
   hence "\<turnstile> compE\<^sub>2 e, compxE\<^sub>2 e 0 (size ST) [::]
          ?\<tau>s @ [ty\<^sub>i' (T#ST) (E@[T\<^sub>i]) (A\<ominus>(size E) \<squnion> \<A> e)]"
     using Block.prems by (auto simp add: after_def)
   also have "P \<turnstile> ty\<^sub>i' (T # ST) (E@[T\<^sub>i]) (A \<ominus> size E \<squnion> \<A> e) \<le>'
                  ty\<^sub>i' (T # ST) (E@[T\<^sub>i]) ((A \<squnion> \<A> e) \<ominus> size E)"
      by(auto simp add:hyperset_defs intro: ty\<^sub>i'_antimono)
   also have "\<dots> = ty\<^sub>i' (T # ST) E (A \<squnion> \<A> e)" by simp
   also have "P \<turnstile> \<dots> \<le>' ty\<^sub>i' (T # ST) E (A \<squnion> (\<A> e \<ominus> i))"
      by(auto simp add:hyperset_defs intro: ty\<^sub>i'_antimono)
   finally show ?case using Block.prems by(simp add: after_def)
 next
   case Var thus ?case by(auto simp:after_def wt_Load)
 next
   case FAcc thus ?case by(auto simp:after_def wt_Get)
 next
   case SFAcc thus ?case by(auto simp: after_def wt_GetS)
 next
   case (LAss i e)
   then obtain T' where wt: "P,E \<turnstile>\<^sub>1 e :: T'" by auto
   show ?case using max_stack1[OF wt] LAss
     by(auto simp: hyper_insert_comm after_def wt_Store wt_Push)
 next
   case Nil_exp thus ?case by auto
 next
   case throw thus ?case by(auto simp add: after_def wt_Throw)
 next
   case (While e c)
   obtain Tc where wte: "P,E \<turnstile>\<^sub>1 e :: Boolean" and wtc: "P,E \<turnstile>\<^sub>1 c :: Tc"
     and [simp]: "T = Void" using While by auto
   have [simp]: "ty E (while (e) c) = Void" using While by simp
   let ?A\<^sub>0 = "A \<squnion> \<A> e" let ?A\<^sub>1 = "?A\<^sub>0 \<squnion> \<A> c"
   let ?\<tau> = "ty\<^sub>i' ST E A" let ?\<tau>s\<^sub>e = "compT E A ST e"
   let ?\<tau>\<^sub>e = "ty\<^sub>i' (Boolean#ST) E ?A\<^sub>0" let ?\<tau>\<^sub>1 = "ty\<^sub>i' ST E ?A\<^sub>0"
   let ?\<tau>s\<^sub>c = "compT E ?A\<^sub>0 ST c" let ?\<tau>\<^sub>c = "ty\<^sub>i' (Tc#ST) E ?A\<^sub>1"
   let ?\<tau>\<^sub>2 = "ty\<^sub>i' ST E ?A\<^sub>1" let ?\<tau>' = "ty\<^sub>i' (Void#ST) E ?A\<^sub>0"
   let ?\<tau>s = "(?\<tau> # ?\<tau>s\<^sub>e @ [?\<tau>\<^sub>e]) @ ?\<tau>\<^sub>1 # ?\<tau>s\<^sub>c @ [?\<tau>\<^sub>c, ?\<tau>\<^sub>2, ?\<tau>\<^sub>1, ?\<tau>']"
   have "\<turnstile> [],[] [::] [] @ ?\<tau>s" by(simp add:wt_instrs_def)
   also
   have "PROP ?P e E Boolean A ST" by fact
   hence "\<turnstile> compE\<^sub>2 e,compxE\<^sub>2 e 0 (size ST) [::] ?\<tau> # ?\<tau>s\<^sub>e @ [?\<tau>\<^sub>e]"
     using While.prems by (auto simp:after_def)
   also
   have "[] @ ?\<tau>s = (?\<tau> # ?\<tau>s\<^sub>e) @ ?\<tau>\<^sub>e # ?\<tau>\<^sub>1 # ?\<tau>s\<^sub>c @ [?\<tau>\<^sub>c,?\<tau>\<^sub>2,?\<tau>\<^sub>1,?\<tau>']" by simp
   also
   let ?n\<^sub>e = "size(compE\<^sub>2 e)"  let ?n\<^sub>c = "size(compE\<^sub>2 c)"
   thm compT_sizes(1)
   let ?if = "IfFalse (int ?n\<^sub>c + 3)"
   from wtc wte have "compE\<^sub>2 c \<noteq> []" and "compE\<^sub>2 e \<noteq> []" using WT\<^sub>1_nsub_RI by auto
   then have compe2c: "length (compE\<^sub>2 c) > 0" and compe2e: "length (compE\<^sub>2 e) > 0" by auto 
   have Suc_pred'_auxi: "\<And>n. 0 < n \<Longrightarrow> n = Suc (n - Suc 0)" using Suc_pred'[OF compe2c] by auto
   have "\<turnstile> [?if],[] [::] ?\<tau>\<^sub>e # ?\<tau>\<^sub>1 # ?\<tau>s\<^sub>c @ [?\<tau>\<^sub>c, ?\<tau>\<^sub>2, ?\<tau>\<^sub>1, ?\<tau>']" 
    proof-{
       show ?thesis
         apply (rule wt_IfFalse)
           apply simp
          apply simp
         apply (subgoal_tac "length (compE\<^sub>2 c) = length (compT E (A \<squnion> \<A> e) ST c) + 1" 
                            "nat (int (length (compE\<^sub>2 c)) + 3 - 2) > length (compT E (A \<squnion> \<A> e) ST c)")
            apply (insert Suc_pred'_auxi[OF compe2c])
            apply (simp add:compT_sizes(1)[OF wtc] )+          
         done
     }
   qed
   also
   have "(?\<tau> # ?\<tau>s\<^sub>e) @ (?\<tau>\<^sub>e # ?\<tau>\<^sub>1 # ?\<tau>s\<^sub>c @ [?\<tau>\<^sub>c, ?\<tau>\<^sub>2, ?\<tau>\<^sub>1, ?\<tau>']) = ?\<tau>s" by simp
   also
   have "PROP ?P c E Tc ?A\<^sub>0 ST" by fact
   hence "\<turnstile> compE\<^sub>2 c,compxE\<^sub>2 c 0 (size ST) [::] ?\<tau>\<^sub>1 # ?\<tau>s\<^sub>c @ [?\<tau>\<^sub>c]"
     using While.prems wtc by (auto simp:after_def)
   also have "?\<tau>s = (?\<tau> # ?\<tau>s\<^sub>e @ [?\<tau>\<^sub>e,?\<tau>\<^sub>1] @ ?\<tau>s\<^sub>c) @ [?\<tau>\<^sub>c,?\<tau>\<^sub>2,?\<tau>\<^sub>1,?\<tau>']" by simp
   also have "\<turnstile> [Pop],[] [::] [?\<tau>\<^sub>c, ?\<tau>\<^sub>2]"  by(simp add:wt_Pop)
   also have "(?\<tau> # ?\<tau>s\<^sub>e @ [?\<tau>\<^sub>e,?\<tau>\<^sub>1] @ ?\<tau>s\<^sub>c) @ [?\<tau>\<^sub>c,?\<tau>\<^sub>2,?\<tau>\<^sub>1,?\<tau>'] = ?\<tau>s" by simp
   also let ?go = "Goto (-int(?n\<^sub>c+?n\<^sub>e+2))"
   have "P \<turnstile> ?\<tau>\<^sub>2 \<le>' ?\<tau>" by(fastforce intro: ty\<^sub>i'_antimono simp: hyperset_defs)
   hence "P,T\<^sub>r,mxs,size ?\<tau>s,[] \<turnstile> ?go,?n\<^sub>e+?n\<^sub>c+2 :: ?\<tau>s" using wte wtc
     proof-{
       let ?t1 = "ty\<^sub>i' ST E A" let ?t2 = "ty\<^sub>i' (Boolean # ST) E (A \<squnion> \<A> e)" let ?t3 = "ty\<^sub>i' ST E (A \<squnion> \<A> e)"
       let ?t4 = "[ty\<^sub>i' (Tc # ST) E (A \<squnion> \<A> e \<squnion> \<A> c), ty\<^sub>i' ST E (A \<squnion> \<A> e \<squnion> \<A> c), ty\<^sub>i' ST E (A \<squnion> \<A> e), ty\<^sub>i' (Void # ST) E (A \<squnion> \<A> e)]"
       let ?c = " compT E (A \<squnion> \<A> e) ST c" let ?e = "compT E A ST e"     
       
       assume ass: "P \<turnstile> ty\<^sub>i' ST E (A \<squnion> \<A> e \<squnion> \<A> c) \<le>' ?t1"      
       show ?thesis
         apply (rule wt_Goto)
         apply simp
           apply simp
          apply simp
       proof-{
           let ?s1 = "((?t1 # ?e @ [?t2]) @ ?t3 # ?c)"  
           have len1: "length ?c = length (compE\<^sub>2 c) - 1" using compT_sizes(1)[OF wtc] by simp 
           have len2: "length ?e = length (compE\<^sub>2 e) - 1" using compT_sizes(1)[OF wte] by simp 
           hence "length (compE\<^sub>2 e) + length (compE\<^sub>2 c) + 2 > length ?s1" 
             using len1 compe2c compe2e by auto
           hence "(?s1 @ ?t4) ! (length (compE\<^sub>2 e) + length (compE\<^sub>2 c) + 2) =
                      ?t4 ! (length (compE\<^sub>2 e) + length (compE\<^sub>2 c) + 2 - length ?s1)" 
             by (auto simp only:nth_append split: if_splits)
           hence "(?s1 @ ?t4) ! (length (compE\<^sub>2 e) + length (compE\<^sub>2 c) + 2) = ty\<^sub>i' ST E (A \<squnion> \<A> e \<squnion> \<A> c)" 
             using len1 len2 compe2c compe2e by auto 
           hence "P \<turnstile> (?s1 @ ?t4) ! (length (compE\<^sub>2 e) + length (compE\<^sub>2 c) + 2) \<le>' ty\<^sub>i' ST E A" 
             using ass by simp
           thus "P \<turnstile> ((?t1 # ?e @ [?t2]) @ ?t3 # ?c @ ?t4) ! (length (compE\<^sub>2 e) + length (compE\<^sub>2 c) + 2) \<le>'
                     ((?t1 # ?e @ [?t2]) @ ?t3 # ?c @ ?t4) ! nat (int (length (compE\<^sub>2 e) + length (compE\<^sub>2 c) + 2) +
                       - int (length (compE\<^sub>2 c) + length (compE\<^sub>2 e) + 2))"
             by simp
         }qed
     }qed
   also have "?\<tau>s = (?\<tau> # ?\<tau>s\<^sub>e @ [?\<tau>\<^sub>e,?\<tau>\<^sub>1] @ ?\<tau>s\<^sub>c @ [?\<tau>\<^sub>c, ?\<tau>\<^sub>2]) @ [?\<tau>\<^sub>1, ?\<tau>']"
     by simp
   also have "\<turnstile> [Push Unit],[] [::] [?\<tau>\<^sub>1,?\<tau>']"
     using While.prems max_stack1[OF wtc] by(auto simp add:wt_Push)
   finally show ?case using wtc wte
     by (simp add:after_def)
 next
   case (Cond e e\<^sub>1 e\<^sub>2)
   obtain T\<^sub>1 T\<^sub>2 where wte: "P,E \<turnstile>\<^sub>1 e :: Boolean"
     and wt\<^sub>1: "P,E \<turnstile>\<^sub>1 e\<^sub>1 :: T\<^sub>1" and wt\<^sub>2: "P,E \<turnstile>\<^sub>1 e\<^sub>2 :: T\<^sub>2"
     and sub\<^sub>1: "P \<turnstile> T\<^sub>1 \<le> T" and sub\<^sub>2: "P \<turnstile> T\<^sub>2 \<le> T"
     using Cond by auto
   from wte wt\<^sub>1  wt\<^sub>2 have "compE\<^sub>2 e\<^sub>1 \<noteq> []" and "compE\<^sub>2 e\<^sub>2 \<noteq> []" and "compE\<^sub>2 e \<noteq> []" using WT\<^sub>1_nsub_RI by auto
   then have compe: "length (compE\<^sub>2 e) > 0"  
         and compe1: "length (compE\<^sub>2 e\<^sub>1) > 0" 
         and compe2: "length (compE\<^sub>2 e\<^sub>2) > 0" by auto 
 
 
   have [simp]: "ty E (if (e) e\<^sub>1 else e\<^sub>2) = T" using Cond by simp
   let ?A\<^sub>0 = "A \<squnion> \<A> e" let ?A\<^sub>2 = "?A\<^sub>0 \<squnion> \<A> e\<^sub>2" let ?A\<^sub>1 = "?A\<^sub>0 \<squnion> \<A> e\<^sub>1"
   let ?A' = "?A\<^sub>0 \<squnion> \<A> e\<^sub>1 \<sqinter> \<A> e\<^sub>2"
   let ?\<tau>\<^sub>2 = "ty\<^sub>i' ST E ?A\<^sub>0" let ?\<tau>' = "ty\<^sub>i' (T#ST) E ?A'"
   let ?\<tau>s\<^sub>2 = "compT E ?A\<^sub>0 ST e\<^sub>2"
   have "PROP ?P e\<^sub>2 E T\<^sub>2 ?A\<^sub>0 ST" by fact
   hence "\<turnstile> compE\<^sub>2 e\<^sub>2, compxE\<^sub>2 e\<^sub>2 0 (size ST) [::] (?\<tau>\<^sub>2#?\<tau>s\<^sub>2) @ [ty\<^sub>i' (T\<^sub>2#ST) E ?A\<^sub>2]"
     using Cond.prems wt\<^sub>2 by(auto simp add:after_def)
   also have "P \<turnstile> ty\<^sub>i' (T\<^sub>2#ST) E ?A\<^sub>2 \<le>' ?\<tau>'" using sub\<^sub>2
     by(auto simp add: hyperset_defs ty\<^sub>i'_def intro!: ty\<^sub>l_antimono)
   also
   let ?\<tau>\<^sub>3 = "ty\<^sub>i' (T\<^sub>1 # ST) E ?A\<^sub>1"
   let ?g\<^sub>2 = "Goto(int (size (compE\<^sub>2 e\<^sub>2) + 1))"
   from sub\<^sub>1 have "P,T\<^sub>r,mxs,size(compE\<^sub>2 e\<^sub>2)+2,[] \<turnstile> ?g\<^sub>2,0 :: ?\<tau>\<^sub>3#(?\<tau>\<^sub>2#?\<tau>s\<^sub>2)@[?\<tau>']" using wt\<^sub>2
     by(auto simp: hyperset_defs wt_defs nth_Cons ty\<^sub>i'_def
              split:nat.split intro!: ty\<^sub>l_antimono)
   also
   let ?\<tau>s\<^sub>1 = "compT E ?A\<^sub>0 ST e\<^sub>1"
   have "PROP ?P e\<^sub>1 E T\<^sub>1 ?A\<^sub>0 ST" by fact
   hence "\<turnstile> compE\<^sub>2 e\<^sub>1,compxE\<^sub>2 e\<^sub>1 0 (size ST) [::] ?\<tau>\<^sub>2 # ?\<tau>s\<^sub>1 @ [?\<tau>\<^sub>3]"
     using Cond.prems wt\<^sub>1 by(auto simp add:after_def)
   also
   let ?\<tau>s\<^sub>1\<^sub>2 = "?\<tau>\<^sub>2 # ?\<tau>s\<^sub>1 @ ?\<tau>\<^sub>3 # (?\<tau>\<^sub>2 # ?\<tau>s\<^sub>2) @ [?\<tau>']"
   let ?\<tau>\<^sub>1 = "ty\<^sub>i' (Boolean#ST) E ?A\<^sub>0"
   let ?g\<^sub>1 = "IfFalse(int (size (compE\<^sub>2 e\<^sub>1) + 2))"
   let ?code = "compE\<^sub>2 e\<^sub>1 @ ?g\<^sub>2 # compE\<^sub>2 e\<^sub>2"
 
   have len1: "length ?\<tau>s\<^sub>1 = length (compE\<^sub>2 e\<^sub>1) - 1" using compT_sizes(1)[OF wt\<^sub>1] by simp 
   have len2: "length ?\<tau>s\<^sub>2 = length (compE\<^sub>2 e\<^sub>2) - 1" using compT_sizes(1)[OF wt\<^sub>2] by simp 
   have len_auxi: "length (compE\<^sub>2 e\<^sub>1) - (length (compE\<^sub>2 e\<^sub>1) - Suc 0) = Suc 0" using compe1 
     by (simp add:diff_Suc split:nat.split)
   have "\<turnstile> [?g\<^sub>1],[] [::] [?\<tau>\<^sub>1] @ ?\<tau>s\<^sub>1\<^sub>2" 
     proof-{
     show ?thesis 
       apply clarsimp
       apply (rule wt_IfFalse)
         apply (simp only:nat_add_distrib)
        apply simp
       apply (auto simp only:nth_append split:if_splits)     
         apply (simp add:len1)
        apply (simp only: len1 compe1)
       apply (simp add:len1 len2 compe1 compe2 )
       apply (insert len_auxi)
       apply simp
       done
   }qed
   also (wt_instrs_ext2) have "[?\<tau>\<^sub>1] @ ?\<tau>s\<^sub>1\<^sub>2 = ?\<tau>\<^sub>1 # ?\<tau>s\<^sub>1\<^sub>2" by simp also
   let ?\<tau> = "ty\<^sub>i' ST E A"
   have "PROP ?P e E Boolean A ST" by fact
   hence "\<turnstile> compE\<^sub>2 e, compxE\<^sub>2 e 0 (size ST) [::] ?\<tau> # compT E A ST e @ [?\<tau>\<^sub>1]"
     using Cond.prems wte by(auto simp add:after_def)
   finally show ?case using wte wt\<^sub>1 wt\<^sub>2 by(simp add:after_def hyperUn_assoc)
 next
   case (Call e M es)
   obtain C D Ts m Ts' where C: "P,E \<turnstile>\<^sub>1 e :: Class C"
     and "method": "P \<turnstile> C sees M,NonStatic:Ts \<rightarrow> T = m in D"
     and wtes: "P,E \<turnstile>\<^sub>1 es [::] Ts'" and subs: "P \<turnstile> Ts' [\<le>] Ts"
     using Call.prems by auto
   from wtes have same_size: "size es = size Ts'" by(rule WTs\<^sub>1_same_size)
   let ?A\<^sub>0 = "A \<squnion> \<A> e" let ?A\<^sub>1 = "?A\<^sub>0 \<squnion> \<A>s es"
   let ?\<tau> = "ty\<^sub>i' ST E A" let ?\<tau>s\<^sub>e = "compT E A ST e"
   let ?\<tau>\<^sub>e = "ty\<^sub>i' (Class C # ST) E ?A\<^sub>0"
   let ?\<tau>s\<^sub>e\<^sub>s = "compTs E ?A\<^sub>0 (Class C # ST) es"
   let ?\<tau>\<^sub>1 = "ty\<^sub>i' (rev Ts' @ Class C # ST) E ?A\<^sub>1"
   let ?\<tau>' = "ty\<^sub>i' (T # ST) E ?A\<^sub>1"
   have "\<turnstile> [Invoke M (size es)],[] [::] [?\<tau>\<^sub>1,?\<tau>']"
     by(rule wt_Invoke[OF same_size "method" subs])
   also
   have "PROP ?Ps es E Ts' ?A\<^sub>0 (Class C # ST)" by fact
   hence "\<turnstile> compEs\<^sub>2 es,compxEs\<^sub>2 es 0 (size ST+1) [::] ?\<tau>\<^sub>e # ?\<tau>s\<^sub>e\<^sub>s"
         "last (?\<tau>\<^sub>e # ?\<tau>s\<^sub>e\<^sub>s) = ?\<tau>\<^sub>1"
     using Call.prems wtes by(auto simp add:after_def)
   also have "(?\<tau>\<^sub>e # ?\<tau>s\<^sub>e\<^sub>s) @ [?\<tau>'] = ?\<tau>\<^sub>e # ?\<tau>s\<^sub>e\<^sub>s @ [?\<tau>']" by simp
   also have "\<turnstile> compE\<^sub>2 e,compxE\<^sub>2 e 0 (size ST) [::] ?\<tau> # ?\<tau>s\<^sub>e @ [?\<tau>\<^sub>e]"
     using Call C by(auto simp add:after_def)
   finally show ?case using Call.prems C wtes by(simp add:after_def hyperUn_assoc)
 next
   case (SCall C M es)
   obtain D Ts m Ts' where "method": "P \<turnstile> C sees M,Static:Ts \<rightarrow> T = m in D"
     and wtes: "P,E \<turnstile>\<^sub>1 es [::] Ts'" and subs: "P \<turnstile> Ts' [\<le>] Ts"
     using SCall.prems by auto
   from SCall.prems(1) have nclinit: "M \<noteq> clinit" by auto
   from wtes have same_size: "size es = size Ts'" by(rule WTs\<^sub>1_same_size)
   have mxs: "length ST < mxs" using WT\<^sub>1_nsub_RI[OF SCall.prems(1)] SCall.prems(4) by simp
   let ?A\<^sub>1 = "A \<squnion> \<A>s es"
   let ?\<tau> = "ty\<^sub>i' ST E A"
   let ?\<tau>s\<^sub>e\<^sub>s = "compTs E A ST es"
   let ?\<tau>\<^sub>1 = "ty\<^sub>i' (rev Ts' @ ST) E ?A\<^sub>1"
   let ?\<tau>' = "ty\<^sub>i' (T # ST) E ?A\<^sub>1"
   have "\<turnstile> [Invokestatic C M (size es)],[] [::] [?\<tau>\<^sub>1,?\<tau>']"
     by(rule wt_Invokestatic[OF mxs same_size nclinit "method" subs])
   also
   have "PROP ?Ps es E Ts' A ST" by fact
   hence "\<turnstile> compEs\<^sub>2 es,compxEs\<^sub>2 es 0 (size ST) [::] ?\<tau> # ?\<tau>s\<^sub>e\<^sub>s"
         "last (?\<tau> # ?\<tau>s\<^sub>e\<^sub>s) = ?\<tau>\<^sub>1"
     using SCall.prems wtes by(auto simp add:after_def)
   also have "(?\<tau> # ?\<tau>s\<^sub>e\<^sub>s) @ [?\<tau>'] = ?\<tau> # ?\<tau>s\<^sub>e\<^sub>s @ [?\<tau>']" by simp
   finally show ?case using SCall.prems wtes by(simp add:after_def hyperUn_assoc)
 next
   case Seq thus ?case
     by(auto simp:after_def)
       (fastforce simp:wt_Push wt_Pop hyperUn_assoc
                 intro:wt_instrs_app2 wt_instrs_Cons)
 next
   case (INIT C Cs b e)
   have "P,E \<turnstile>\<^sub>1 INIT C (Cs,b) \<leftarrow> e :: T" by fact
   thus ?case using WT\<^sub>1_nsub_RI by simp
 next
   case (RI C e' Cs e)
   have "P,E \<turnstile>\<^sub>1 RI (C,e') ; Cs \<leftarrow> e :: T" by fact
   thus ?case using WT\<^sub>1_nsub_RI by simp
 qed
 (*>*)
 
 
 lemma [simp]: "types (compP f P) = types P"
 (*<*)by auto(*>*)
 
 lemma [simp]: "states (compP f P) mxs mxl = states P mxs mxl"
 (*<*)by (simp add: JVM_states_unfold)(*>*)
 
 lemma [simp]: "app\<^sub>i (i, compP f P, pc, mpc, T, \<tau>) = app\<^sub>i (i, P, pc, mpc, T, \<tau>)"
 (*<*)(is "?A = ?B")
 proof -
   obtain ST LT where \<tau>: "\<tau> = (ST, LT)" by(cases \<tau>) simp
   then show ?thesis proof(cases i)
     case Invoke show ?thesis
     proof(rule iffI)
       assume ?A then show ?B using Invoke \<tau>
         by auto (fastforce dest!: sees_method_compPD)
     next
       assume ?B then show ?A using Invoke \<tau>
         by auto (force dest: sees_method_compP)
     qed
   next
     case (Invokestatic x111 x112 x113) show ?thesis
     proof(rule iffI)
       assume ?A then show ?B using Invokestatic \<tau>
         by auto (fastforce dest!: sees_method_compPD)
     next
       assume ?B then show ?A using Invokestatic \<tau>
         by auto (force dest: sees_method_compP)
     qed
   qed auto
 qed
 (*>*)
   
 lemma [simp]: "is_relevant_entry (compP f P) i = is_relevant_entry P i"
 (*<*)
 proof -
   { fix pc e
     have "is_relevant_entry (compP f P) i pc e = is_relevant_entry P i pc e"
       by(cases i) (auto simp: is_relevant_entry_def)
   }
   then show ?thesis by fast
 qed
 (*>*)
 
 lemma [simp]: "relevant_entries (compP f P) i pc xt = relevant_entries P i pc xt"
 (*<*) by (simp add: relevant_entries_def)(*>*)
 
 lemma [simp]: "app i (compP f P) mpc T pc mxl xt \<tau> = app i P mpc T pc mxl xt \<tau>"
 (*<*)
 by (simp add: app_def xcpt_app_def eff_def xcpt_eff_def norm_eff_def)
    (fastforce simp add: image_def)
 (*>*)
 
 lemma [simp]:
 assumes "app i P mpc T pc mxl xt \<tau>"
 shows "eff i (compP f P) pc xt \<tau> = eff i P pc xt \<tau>"
 (*<*)
 using assms
 proof(clarsimp simp: eff_def norm_eff_def xcpt_eff_def app_def, cases i)
 qed auto
 (*>*)
 
 lemma [simp]: "subtype (compP f P) = subtype P"
 (*<*)by (rule ext)+ simp(*>*)
   
 lemma [simp]: "compP f P \<turnstile> \<tau> \<le>' \<tau>' = P \<turnstile> \<tau> \<le>' \<tau>'"
 (*<*) by (simp add: sup_state_opt_def sup_state_def sup_ty_opt_def)(*>*)
 
 lemma [simp]: "compP f P,T,mpc,mxl,xt \<turnstile> i,pc :: \<tau>s = P,T,mpc,mxl,xt \<turnstile> i,pc :: \<tau>s"
 (*<*)by (simp add: wt_instr_def cong: conj_cong)(*>*)
 
 declare TC1.compT_sizes[simp]  TC0.ty_def2[simp]
 
 context TC2
 begin
 
 lemma compT_method_NonStatic:
   fixes e and A and C and Ts and mxl\<^sub>0
   defines [simp]: "E \<equiv> Class C # Ts"
     and [simp]: "A \<equiv> \<lfloor>{..size Ts}\<rfloor>"
     and [simp]: "A' \<equiv> A \<squnion> \<A> e"
     and [simp]: "mxl\<^sub>0 \<equiv> max_vars e"
   assumes mxs: "max_stack e = mxs"
     and mxl: "Suc (length Ts + max_vars e) = mxl"
   assumes wf: "wf_prog p P" and wte: "P,E \<turnstile>\<^sub>1 e :: T" and \<D>: "\<D> e A"
     and \<B>: "\<B> e (size E)" and E_P: "set E \<subseteq> types P" and wid: "P \<turnstile> T \<le> T\<^sub>r"
   shows "wt_method (compP\<^sub>2 P) C NonStatic Ts T\<^sub>r mxs mxl\<^sub>0 (compE\<^sub>2 e @ [Return])
     (compxE\<^sub>2 e 0 0) (ty\<^sub>i' [] E A # compT\<^sub>a E A [] e)"
 (*<*)(is "wt_method ?P C ?b Ts T\<^sub>r mxs mxl\<^sub>0 ?is ?xt ?\<tau>s")
 proof -
   let ?n = "length E + mxl\<^sub>0"
   have wt_compE: "P,T\<^sub>r,mxs \<turnstile> compE\<^sub>2 e, compxE\<^sub>2 e 0 (length []) [::]
         TC0.ty\<^sub>i' ?n [] E A # TC1.compT P ?n E A [] e @[TC0.after P ?n E A [] e]"
     using mxs TC2.compT_wt_instrs [OF wte \<D> \<B>, of "[]" mxs ?n T\<^sub>r] by simp
 
   have "OK (ty\<^sub>i' [T] E A') \<in> states P mxs mxl"
     using mxs WT\<^sub>1_is_type[OF wf wte E_P] max_stack1[OF wte] OK_ty\<^sub>i'_in_statesI[OF E_P]
       by simp
   moreover have "OK ` set (compT E A [] e) \<subseteq> states P mxs mxl"
     using mxs mxl wid compT_states(1)[OF wf wte E_P] by simp
   ultimately have "check_types ?P mxs ?n (map OK ?\<tau>s)"
     using mxl wte E_P by (simp add: compT\<^sub>a_def after_def check_types_def)
   moreover have "wt_start ?P C ?b Ts mxl\<^sub>0 ?\<tau>s" using mxl
     by (auto simp: wt_start_def ty\<^sub>i'_def ty\<^sub>l_def list_all2_conv_all_nth nth_Cons
              split: nat.split)
   moreover {
     fix pc assume pc: "pc < size ?is"
     then have "?P,T\<^sub>r,mxs,size ?is,?xt \<turnstile> ?is!pc,pc :: ?\<tau>s"
     proof(cases "pc < length (compE\<^sub>2 e)")
       case True
       then show ?thesis using mxs wte wt_compE
         by (clarsimp simp: compT\<^sub>a_def mxl after_def wt_instrs_def)
     next
       case False
       have "length (compE\<^sub>2 e) = pc" using less_antisym[OF False] pc by simp
       then show ?thesis using mxl wte E_P wid
         by (clarsimp simp: compT\<^sub>a_def after_def wt_defs xcpt_app_pcs xcpt_eff_pcs ty\<^sub>i'_def)
     qed
   }
   moreover have "0 < size ?is" and "size ?\<tau>s = size ?is"
     using wte by (simp_all add: compT\<^sub>a_def)
   ultimately show ?thesis by(simp add: wt_method_def)
 qed
 (*>*)
 
 lemma compT_method_Static:
   fixes e and A and C and Ts and mxl\<^sub>0
   defines [simp]: "E \<equiv> Ts"
     and [simp]: "A \<equiv> \<lfloor>{..<size Ts}\<rfloor>"
     and [simp]: "A' \<equiv> A \<squnion> \<A> e"
     and [simp]: "mxl\<^sub>0 \<equiv> max_vars e"
   assumes mxs: "max_stack e = mxs"
     and mxl: "length Ts + max_vars e = mxl"
   assumes wf: "wf_prog p P" and wte: "P,E \<turnstile>\<^sub>1 e :: T" and \<D>: "\<D> e A"
     and \<B>: "\<B> e (size E)" and E_P: "set E \<subseteq> types P" and wid: "P \<turnstile> T \<le> T\<^sub>r"
   shows "wt_method (compP\<^sub>2 P) C Static Ts T\<^sub>r mxs mxl\<^sub>0 (compE\<^sub>2 e @ [Return])
     (compxE\<^sub>2 e 0 0) (ty\<^sub>i' [] E A # compT\<^sub>a E A [] e)"
 (*<*)(is "wt_method ?P C ?b Ts T\<^sub>r mxs mxl\<^sub>0 ?is ?xt ?\<tau>s")
 proof -
   let ?n = "length E + mxl\<^sub>0"
   have wt_compE: "P,T\<^sub>r,mxs \<turnstile> compE\<^sub>2 e, compxE\<^sub>2 e 0 (length []) [::]
         TC0.ty\<^sub>i' ?n [] E A # TC1.compT P ?n E A [] e @[TC0.after P ?n E A [] e]"
     using mxs TC2.compT_wt_instrs [OF wte \<D> \<B>, of "[]" mxs ?n T\<^sub>r] by simp
 
   have "OK (ty\<^sub>i' [T] E A') \<in> states P mxs mxl"
     using mxs WT\<^sub>1_is_type[OF wf wte E_P] max_stack1[OF wte] OK_ty\<^sub>i'_in_statesI[OF E_P]
       by simp
   moreover have "OK ` set (compT E A [] e) \<subseteq> states P mxs mxl"
     using mxs mxl wid compT_states(1)[OF wf wte E_P] by simp
   ultimately have "check_types ?P mxs ?n (map OK ?\<tau>s)"
     using mxl wte E_P by (simp add: compT\<^sub>a_def after_def check_types_def)
   moreover have "wt_start ?P C ?b Ts mxl\<^sub>0 ?\<tau>s" using mxl
     by (auto simp: wt_start_def ty\<^sub>i'_def ty\<^sub>l_def list_all2_conv_all_nth nth_Cons
              split: nat.split)
   moreover {
     fix pc assume pc: "pc < size ?is"
     then have "?P,T\<^sub>r,mxs,size ?is,?xt \<turnstile> ?is!pc,pc :: ?\<tau>s"
     proof(cases "pc < length (compE\<^sub>2 e)")
       case True
       then show ?thesis using mxs wte wt_compE
         by (clarsimp simp: compT\<^sub>a_def mxl after_def wt_instrs_def)
     next
       case False
       have "length (compE\<^sub>2 e) = pc" using less_antisym[OF False] pc by simp
       then show ?thesis using mxl wte E_P wid
         by (clarsimp simp: compT\<^sub>a_def after_def wt_defs xcpt_app_pcs xcpt_eff_pcs ty\<^sub>i'_def)
     qed
   }
   moreover have "0 < size ?is" and "size ?\<tau>s = size ?is"
     using wte by (simp_all add: compT\<^sub>a_def)
   ultimately show ?thesis by(simp add: wt_method_def)
 qed
 (*>*)
 
 end
 
 definition compTP :: "J\<^sub>1_prog \<Rightarrow> ty\<^sub>P" where
   "compTP P C M = (
   let (D,b,Ts,T,e) = method P C M;
        E = case b of Static \<Rightarrow> Ts | NonStatic \<Rightarrow> Class C # Ts;
        A = case b of Static \<Rightarrow> \<lfloor>{..<size Ts}\<rfloor> | NonStatic \<Rightarrow> \<lfloor>{..size Ts}\<rfloor>;
        mxl = (case b of Static \<Rightarrow> 0 | NonStatic \<Rightarrow> 1) + size Ts + max_vars e
   in  (TC0.ty\<^sub>i' mxl [] E A # TC1.compT\<^sub>a P mxl E A [] e))"
 
 theorem wt_compP\<^sub>2:
 assumes wf: "wf_J\<^sub>1_prog P" shows "wf_jvm_prog (compP\<^sub>2 P)"
 (*<*)
 proof -
   let ?\<Phi> = "compTP P" and ?f = compMb\<^sub>2
   let ?wf\<^sub>2 = "\<lambda>P C (M, b, Ts, T\<^sub>r, mxs, mxl\<^sub>0, is, xt).
               wt_method P C b Ts T\<^sub>r mxs mxl\<^sub>0 is xt (?\<Phi> C M)"
     and ?P = "compP ?f P"
   { fix C M b Ts T m let ?md = "(M,b,Ts,T,m)::expr\<^sub>1 mdecl"
     assume cM: "P \<turnstile> C sees M, b :  Ts\<rightarrow>T = m in C"
       and wfm: "wf_mdecl wf_J\<^sub>1_mdecl P C ?md"
     then have Ts_types: "\<forall>T'\<in>set Ts. is_type P T'"
      and T_type: "is_type P T" and wfm\<^sub>1: "wf_J\<^sub>1_mdecl P C ?md"
       by(simp_all add: wf_mdecl_def)
     have Ts_P: "set Ts \<subseteq> types P"  using sees_wf_mdecl[OF wf cM]
       by (clarsimp simp: wf_mdecl_def)
     then have CTs_P: "is_class P C \<and> set Ts \<subseteq> types P"
       using sees_method_is_class[OF cM] by simp
 
     have "?wf\<^sub>2 ?P C (M,b,Ts,T,?f b m)"
     proof(cases b)
       case Static
       then obtain T' where wte: "P,Ts \<turnstile>\<^sub>1 m :: T'" and wid: "P \<turnstile> T' \<le> T"
          and \<D>: "\<D> m \<lfloor>{..<size Ts}\<rfloor>" and \<B>: "\<B> m (size Ts)"
         using wfm\<^sub>1 by(auto simp: wf_mdecl_def)
       show ?thesis using Static cM TC2.compT_method_Static [OF _ _ wf wte \<D> \<B> Ts_P wid]
         by(simp add: compTP_def)
     next
       case NonStatic
       then obtain T' where wte: "P,Class C#Ts \<turnstile>\<^sub>1 m :: T'" and wid: "P \<turnstile> T' \<le> T"
          and \<D>: "\<D> m \<lfloor>{..size Ts}\<rfloor>" and \<B>: "\<B> m (Suc (size Ts))"
         using wfm\<^sub>1 by(auto simp: wf_mdecl_def)
       have Ts_P: "set Ts \<subseteq> types P"  using sees_wf_mdecl[OF wf cM]
         by (fastforce simp: wf_mdecl_def intro: sees_method_is_class)
       show ?thesis using NonStatic cM
           TC2.compT_method_NonStatic [simplified, OF _ _ wf wte \<D> \<B> CTs_P wid]
         by(simp add: compTP_def)
     qed
     then have "wf_mdecl ?wf\<^sub>2 ?P C (M, b, Ts, T, ?f b m)"
       using Ts_types T_type by(simp add: wf_mdecl_def)
   }
   then have "wf_prog ?wf\<^sub>2 (compP ?f P)" by(rule wf_prog_compPI[OF _ wf])
   then show ?thesis by (simp add: wf_jvm_prog_def wf_jvm_prog_phi_def) fast
 qed
 (*>*)
 
 theorem wt_J2JVM:
   "wf_J_prog P \<Longrightarrow> wf_jvm_prog (J2JVM P)"
 (*<*)
 by(simp only:o_def J2JVM_def)
   (blast intro:wt_compP\<^sub>2 compP\<^sub>1_pres_wf)
 
 end