diff --git a/thys/MFOTL_Checker/Checker.thy b/thys/MFOTL_Checker/Checker.thy
new file mode 100644
--- /dev/null
+++ b/thys/MFOTL_Checker/Checker.thy
@@ -0,0 +1,3320 @@
+(*<*)
+theory Checker
+  imports Prelim Proof_System Proof_Object "HOL-Library.Simps_Case_Conv"
+begin
+(*>*)
+
+section \<open>Proof Checker\<close>
+
+unbundle MFOTL_notation
+
+context fixes \<sigma> :: "('n, 'd :: {default, linorder}) trace"
+
+begin
+
+fun s_check :: "('n, 'd) env \<Rightarrow> ('n, 'd) formula \<Rightarrow> ('n, 'd) sproof \<Rightarrow> bool"
+and v_check :: "('n, 'd) env \<Rightarrow> ('n, 'd) formula \<Rightarrow> ('n, 'd) vproof \<Rightarrow> bool" where
+  "s_check v f p = (case (f, p) of
+    (\<top>, STT i) \<Rightarrow> True
+  | (r \<dagger> ts, SPred i s ts') \<Rightarrow>
+    (r = s \<and> ts = ts' \<and> (r, v\<^bold>\<lbrakk>ts\<^bold>\<rbrakk>) \<in> \<Gamma> \<sigma> i)
+  | (x \<^bold>\<approx> c, SEq_Const i x' c') \<Rightarrow>
+    (c = c' \<and> x = x' \<and> v x = c)
+  | (\<not>\<^sub>F \<phi>, SNeg vp) \<Rightarrow> v_check v \<phi> vp
+  | (\<phi> \<or>\<^sub>F \<psi>, SOrL sp1) \<Rightarrow> s_check v \<phi> sp1
+  | (\<phi> \<or>\<^sub>F \<psi>, SOrR sp2) \<Rightarrow> s_check v \<psi> sp2
+  | (\<phi> \<and>\<^sub>F \<psi>, SAnd sp1 sp2) \<Rightarrow> s_check v \<phi> sp1 \<and> s_check v \<psi> sp2 \<and> s_at sp1 = s_at sp2
+  | (\<phi> \<longrightarrow>\<^sub>F \<psi>, SImpL vp1) \<Rightarrow> v_check v \<phi> vp1
+  | (\<phi> \<longrightarrow>\<^sub>F \<psi>, SImpR sp2) \<Rightarrow> s_check v \<psi> sp2
+  | (\<phi> \<longleftrightarrow>\<^sub>F \<psi>, SIffSS sp1 sp2) \<Rightarrow> s_check v \<phi> sp1 \<and> s_check v \<psi> sp2 \<and> s_at sp1 = s_at sp2
+  | (\<phi> \<longleftrightarrow>\<^sub>F \<psi>, SIffVV vp1 vp2) \<Rightarrow> v_check v \<phi> vp1 \<and> v_check v \<psi> vp2 \<and> v_at vp1 = v_at vp2
+  | (\<exists>\<^sub>Fx.  \<phi>, SExists y val sp) \<Rightarrow> (x = y \<and> s_check (v (x := val)) \<phi> sp)
+  | (\<forall>\<^sub>Fx.  \<phi>, SForall y sp_part) \<Rightarrow> (let i = s_at (part_hd sp_part)
+      in x = y \<and> (\<forall>(sub, sp) \<in> SubsVals sp_part. s_at sp = i \<and> (\<forall>z \<in> sub. s_check (v (x := z)) \<phi> sp)))
+  | (\<^bold>Y I \<phi>, SPrev sp) \<Rightarrow>
+    (let j = s_at sp; i = s_at (SPrev sp) in
+    i = j+1 \<and> mem (\<Delta> \<sigma> i) I \<and> s_check v \<phi> sp)
+  | (\<^bold>X I \<phi>, SNext sp) \<Rightarrow>
+    (let j = s_at sp; i = s_at (SNext sp) in
+    j = i+1 \<and> mem (\<Delta> \<sigma> j) I \<and> s_check v \<phi> sp)
+  | (\<^bold>P I \<phi>, SOnce i sp) \<Rightarrow>
+    (let j = s_at sp in
+    j \<le> i \<and> mem (\<tau> \<sigma> i - \<tau> \<sigma> j) I \<and> s_check v \<phi> sp)
+  | (\<^bold>F I \<phi>, SEventually i sp) \<Rightarrow>
+    (let j = s_at sp in
+    j \<ge> i \<and> mem (\<tau> \<sigma> j - \<tau> \<sigma> i) I \<and> s_check v \<phi> sp)
+  | (\<^bold>H I \<phi>, SHistoricallyOut i) \<Rightarrow>
+    \<tau> \<sigma> i < \<tau> \<sigma> 0 + left I
+  | (\<^bold>H I \<phi>, SHistorically i li sps) \<Rightarrow>
+    (li = (case right I of \<infinity> \<Rightarrow> 0 | enat b \<Rightarrow> ETP \<sigma> (\<tau> \<sigma> i - b))
+    \<and> \<tau> \<sigma> 0 + left I \<le> \<tau> \<sigma> i
+    \<and> map s_at sps = [li ..< (LTP_p \<sigma> i I) + 1]
+    \<and> (\<forall>sp \<in> set sps. s_check v \<phi> sp))
+  | (\<^bold>G I \<phi>, SAlways i hi sps) \<Rightarrow>
+    (hi = (case right I of enat b \<Rightarrow> LTP_f \<sigma> i b)
+    \<and> right I \<noteq> \<infinity>
+    \<and> map s_at sps = [(ETP_f \<sigma> i I) ..< hi + 1]
+    \<and> (\<forall>sp \<in> set sps. s_check v \<phi> sp))
+  | (\<phi> \<^bold>S I \<psi>, SSince sp2 sp1s) \<Rightarrow>
+    (let i = s_at (SSince sp2 sp1s); j = s_at sp2 in
+    j \<le> i \<and> mem (\<tau> \<sigma> i - \<tau> \<sigma> j) I
+    \<and> map s_at sp1s = [j+1 ..< i+1]
+    \<and> s_check v \<psi> sp2
+    \<and> (\<forall>sp1 \<in> set sp1s. s_check v \<phi> sp1))
+  | (\<phi> \<^bold>U I \<psi>, SUntil sp1s sp2) \<Rightarrow>
+    (let i = s_at (SUntil sp1s sp2); j = s_at sp2 in
+    j \<ge> i \<and> mem (\<tau> \<sigma> j - \<tau> \<sigma> i) I
+    \<and> map s_at sp1s = [i ..< j] \<and> s_check v \<psi> sp2
+    \<and> (\<forall>sp1 \<in> set sp1s. s_check v \<phi> sp1))
+  | ( _ , _) \<Rightarrow> False)"
+| "v_check v f p = (case (f, p) of
+    (\<bottom>, VFF i) \<Rightarrow> True
+  | (r \<dagger> ts, VPred i pred ts') \<Rightarrow>
+    (r = pred \<and> ts = ts' \<and> (r, v\<^bold>\<lbrakk>ts\<^bold>\<rbrakk>) \<notin> \<Gamma> \<sigma> i)
+  | (x \<^bold>\<approx> c, VEq_Const i x' c') \<Rightarrow>
+    (c = c' \<and> x = x' \<and> v x \<noteq> c)
+  | (\<not>\<^sub>F \<phi>, VNeg sp) \<Rightarrow> s_check v \<phi> sp
+  | (\<phi> \<or>\<^sub>F \<psi>, VOr vp1 vp2) \<Rightarrow> v_check v \<phi> vp1 \<and> v_check v \<psi> vp2 \<and> v_at vp1 = v_at vp2
+  | (\<phi> \<and>\<^sub>F \<psi>, VAndL vp1) \<Rightarrow> v_check v \<phi> vp1
+  | (\<phi> \<and>\<^sub>F \<psi>, VAndR vp2) \<Rightarrow> v_check v \<psi> vp2
+  | (\<phi> \<longrightarrow>\<^sub>F \<psi>, VImp sp1 vp2) \<Rightarrow> s_check v \<phi> sp1 \<and> v_check v \<psi> vp2 \<and> s_at sp1 = v_at vp2
+  | (\<phi> \<longleftrightarrow>\<^sub>F \<psi>, VIffSV sp1 vp2) \<Rightarrow> s_check v \<phi> sp1 \<and> v_check v \<psi> vp2 \<and> s_at sp1 = v_at vp2
+  | (\<phi> \<longleftrightarrow>\<^sub>F \<psi>, VIffVS vp1 sp2) \<Rightarrow> v_check v \<phi> vp1 \<and> s_check v \<psi> sp2 \<and> v_at vp1 = s_at sp2
+  | (\<exists>\<^sub>Fx.  \<phi>, VExists y vp_part) \<Rightarrow> (let i = v_at (part_hd vp_part)
+      in x = y \<and> (\<forall>(sub, vp) \<in> SubsVals vp_part. v_at vp = i \<and> (\<forall>z \<in> sub. v_check (v (x := z)) \<phi> vp)))
+  | (\<forall>\<^sub>Fx.  \<phi>, VForall y val vp) \<Rightarrow> (x = y \<and> v_check (v (x := val)) \<phi> vp)
+  | (\<^bold>Y I \<phi>, VPrev vp) \<Rightarrow>
+    (let j = v_at vp; i = v_at (VPrev vp) in
+    i = j+1 \<and> v_check v \<phi> vp)
+  | (\<^bold>Y I \<phi>, VPrevZ) \<Rightarrow> True
+  | (\<^bold>Y I \<phi>, VPrevOutL i) \<Rightarrow>
+    i > 0 \<and> \<Delta> \<sigma> i < left I
+  | (\<^bold>Y I \<phi>, VPrevOutR i) \<Rightarrow>
+    i > 0 \<and> enat (\<Delta> \<sigma> i) > right I
+  | (\<^bold>X I \<phi>, VNext vp) \<Rightarrow>
+    (let j = v_at vp; i = v_at (VNext vp) in
+    j = i+1 \<and> v_check v \<phi> vp)
+  | (\<^bold>X I \<phi>, VNextOutL i) \<Rightarrow>
+    \<Delta> \<sigma> (i+1) < left I
+  | (\<^bold>X I \<phi>, VNextOutR i) \<Rightarrow>
+    enat (\<Delta> \<sigma> (i+1)) > right I
+  | (\<^bold>P I \<phi>, VOnceOut i) \<Rightarrow>
+    \<tau> \<sigma> i < \<tau> \<sigma> 0 + left I
+  | (\<^bold>P I \<phi>, VOnce i li vps) \<Rightarrow>
+    (li = (case right I of \<infinity> \<Rightarrow> 0 | enat b \<Rightarrow> ETP_p \<sigma> i b)
+    \<and> \<tau> \<sigma> 0 + left I \<le> \<tau> \<sigma> i
+    \<and> map v_at vps = [li ..< (LTP_p \<sigma> i I) + 1]
+    \<and> (\<forall>vp \<in> set vps. v_check v \<phi> vp))
+  | (\<^bold>F I \<phi>, VEventually i hi vps) \<Rightarrow>
+    (hi = (case right I of enat b \<Rightarrow> LTP_f \<sigma> i b) \<and> right I \<noteq> \<infinity>
+    \<and> map v_at vps = [(ETP_f \<sigma> i I) ..< hi + 1]
+    \<and> (\<forall>vp \<in> set vps. v_check v \<phi> vp))
+  | (\<^bold>H I \<phi>, VHistorically i vp) \<Rightarrow>
+    (let j = v_at vp in
+    j \<le> i \<and> mem (\<tau> \<sigma> i - \<tau> \<sigma> j) I \<and> v_check v \<phi> vp)
+  | (\<^bold>G I \<phi>, VAlways i vp) \<Rightarrow>
+    (let j = v_at vp
+    in j \<ge> i \<and> mem (\<tau> \<sigma> j - \<tau> \<sigma> i) I \<and> v_check v \<phi> vp)
+  | (\<phi> \<^bold>S I \<psi>, VSinceOut i) \<Rightarrow>
+    \<tau> \<sigma> i < \<tau> \<sigma> 0 + left I
+  | (\<phi> \<^bold>S I \<psi>, VSince i vp1 vp2s) \<Rightarrow>
+    (let j = v_at vp1 in
+    (case right I of \<infinity> \<Rightarrow> True | enat b \<Rightarrow> ETP_p \<sigma> i b \<le> j) \<and> j \<le> i
+    \<and> \<tau> \<sigma> 0 + left I \<le> \<tau> \<sigma> i
+    \<and> map v_at vp2s = [j ..< (LTP_p \<sigma> i I) + 1] \<and> v_check v \<phi> vp1
+    \<and> (\<forall>vp2 \<in> set vp2s. v_check v \<psi> vp2))
+  | (\<phi> \<^bold>S I \<psi>, VSinceInf i li vp2s) \<Rightarrow>
+    (li = (case right I of \<infinity> \<Rightarrow> 0 | enat b \<Rightarrow> ETP_p \<sigma> i b)
+    \<and> \<tau> \<sigma> 0 + left I \<le> \<tau> \<sigma> i
+    \<and> map v_at vp2s = [li ..< (LTP_p \<sigma> i I) + 1]
+    \<and> (\<forall>vp2 \<in> set vp2s. v_check v \<psi> vp2))
+  | (\<phi> \<^bold>U I \<psi>, VUntil i vp2s vp1) \<Rightarrow>
+    (let j = v_at vp1 in
+    (case right I of \<infinity> \<Rightarrow> True | enat b \<Rightarrow> j < LTP_f \<sigma> i b) \<and> i \<le> j
+    \<and> map v_at vp2s = [ETP_f \<sigma> i I ..< j + 1] \<and> v_check v \<phi> vp1
+    \<and> (\<forall>vp2 \<in> set vp2s. v_check v \<psi> vp2))
+  | (\<phi> \<^bold>U I \<psi>, VUntilInf i hi vp2s) \<Rightarrow>
+    (hi = (case right I of enat b \<Rightarrow> LTP_f \<sigma> i b) \<and> right I \<noteq> \<infinity>
+    \<and> map v_at vp2s = [ETP_f \<sigma> i I ..< hi + 1]
+    \<and> (\<forall>vp2 \<in> set vp2s. v_check v \<psi> vp2))
+  | ( _ , _) \<Rightarrow> False)"
+
+declare s_check.simps[simp del] v_check.simps[simp del]
+simps_of_case s_check_simps[simp]: s_check.simps[unfolded prod.case] (splits: formula.split sproof.split)
+simps_of_case v_check_simps[simp]: v_check.simps[unfolded prod.case] (splits: formula.split vproof.split)
+
+subsection \<open>Checker Soundness\<close>
+
+lemma check_soundness:
+  "s_check v \<phi> sp \<Longrightarrow> SAT \<sigma> v (s_at sp) \<phi>"
+  "v_check v \<phi> vp \<Longrightarrow> VIO \<sigma> v (v_at vp) \<phi>"
+proof (induction sp and vp arbitrary: v \<phi> and v \<phi>)
+  case STT
+  then show ?case by (cases \<phi>) (auto intro: SAT_VIO.STT)
+next
+  case SPred
+  then show ?case by (cases \<phi>) (auto intro: SAT_VIO.SPred)
+next
+  case SEq_Const
+  then show ?case by (cases \<phi>) (auto intro: SAT_VIO.SEq_Const)
+next
+  case SNeg
+  then show ?case by (cases \<phi>) (auto intro: SAT_VIO.SNeg)
+next
+  case SAnd
+  then show ?case by (cases \<phi>) (auto intro: SAT_VIO.SAnd)
+next
+  case SOrL
+  then show ?case by (cases \<phi>) (auto intro: SAT_VIO.SOrL)
+next
+  case SOrR
+  then show ?case by (cases \<phi>) (auto intro: SAT_VIO.SOrR)
+next
+  case SImpR
+  then show ?case by (cases \<phi>) (auto intro: SAT_VIO.SImpR)
+next
+  case SImpL
+  then show ?case by (cases \<phi>) (auto intro: SAT_VIO.SImpL)
+next
+  case SIffSS
+  then show ?case by (cases \<phi>) (auto intro: SAT_VIO.SIffSS)
+next
+  case SIffVV
+  then show ?case by (cases \<phi>) (auto intro: SAT_VIO.SIffVV)
+next
+  case (SExists x z sp)
+  with SExists(1)[of "v(x := z)"] show ?case
+    by (cases \<phi>) (auto intro: SAT_VIO.SExists)
+next
+  case (SForall x part)
+  then show ?case
+  proof (cases \<phi>)
+    case (Forall y \<psi>)
+    show ?thesis unfolding Forall
+    proof (intro SAT_VIO.SForall allI)
+      fix z
+      let ?sp = "lookup_part part z"
+      from lookup_part_SubsVals[of z part] obtain D where "z \<in> D" "(D, ?sp) \<in> SubsVals part"
+        by blast
+      with SForall(2-) Forall have "s_check (v(y := z)) \<psi> ?sp" "s_at ?sp = s_at (SForall x part)"
+        by auto
+      then show "SAT \<sigma> (v(y := z)) (s_at (SForall x part)) \<psi>"
+        by (auto simp del: fun_upd_apply dest!: SForall(1)[rotated])
+    qed
+  qed auto
+next
+  case (SSince spsi sps)
+  then show ?case
+  proof (cases \<phi>)
+    case (Since \<phi> I \<psi>)
+    show ?thesis
+      using SSince(3)
+      unfolding Since
+    proof (intro SAT_VIO.SSince[of "s_at spsi"], goal_cases le mem SAT\<psi> SAT\<phi>)
+      case (SAT\<phi> k)
+      then show ?case
+        by (cases "k \<le> s_at (hd sps)")
+          (auto 0 3 simp: Let_def elim: map_setE[of _ _ _ k] intro: SSince(2) dest!: sym[of "s_at _" "Suc (s_at _)"])
+    qed (auto simp: Let_def intro: SSince(1))
+  qed auto
+next
+  case (SOnce i sp)
+  then show ?case
+  proof (cases \<phi>)
+    case (Once I \<phi>)
+    show ?thesis
+      using SOnce
+      unfolding Once
+      by (intro SAT_VIO.SOnce[of "s_at sp"]) (auto simp: Let_def)
+  qed auto
+next
+  case (SEventually i sp)
+  then show ?case
+  proof (cases \<phi>)
+    case (Eventually I \<phi>)
+    show ?thesis
+      using SEventually
+      unfolding Eventually
+      by (intro SAT_VIO.SEventually[of _ "s_at sp"]) (auto simp: Let_def)
+  qed auto
+next
+  case SHistoricallyOut
+  then show ?case by (cases \<phi>) (auto intro: SAT_VIO.SHistoricallyOut)
+next
+  case (SHistorically i li sps)
+  then show ?case
+  proof (cases \<phi>)
+    case (Historically I \<phi>)
+    {fix k
+      define j where j_def: "j \<equiv> case right I of \<infinity> \<Rightarrow> 0 | enat n \<Rightarrow> ETP \<sigma> (\<tau>  \<sigma> i - n)"
+      assume k_def: "k \<ge> j \<and> k \<le> i \<and> k \<le> LTP \<sigma> (\<tau> \<sigma> i - left I)"
+      from SHistorically Historically j_def have map: "set (map s_at sps) = set [j ..< Suc (LTP_p \<sigma> i I)]"
+        by (auto simp: Let_def)
+      then have kset: "k \<in> set ([j ..< Suc (LTP_p \<sigma> i I)])" using j_def k_def by auto
+      then obtain x where x: "x \<in> set sps"  "s_at x = k" using k_def map
+        unfolding set_map set_eq_iff image_iff
+        by metis
+      then have "SAT \<sigma> v k \<phi>" using SHistorically unfolding Historically
+        by (auto simp: Let_def)
+    } note * = this
+    show ?thesis
+      using SHistorically *
+      unfolding Historically
+      by (auto simp: Let_def intro!: SAT_VIO.SHistorically)
+  qed (auto intro: SAT_VIO.intros)
+next
+  case (SAlways i hi sps)
+  then show ?case
+  proof (cases \<phi>)
+    case (Always I \<phi>)
+    obtain n where n_def: "right I = enat n"
+      using SAlways
+      by (auto simp: Always split: enat.splits)
+    {fix k
+      define j where j_def: "j \<equiv> LTP \<sigma> (\<tau> \<sigma> i + n)"
+      assume k_def: "k \<le> j \<and> k \<ge> i \<and> k \<ge> ETP \<sigma> (\<tau> \<sigma> i + left I)"
+      from SAlways Always j_def have map: "set (map s_at sps) = set [(ETP_f \<sigma> i I) ..< Suc j]"
+        by (auto simp: Let_def n_def)
+      then have kset: "k \<in> set ([(ETP_f \<sigma> i I) ..< Suc j])" using k_def j_def by auto
+      then obtain x where x: "x \<in> set sps" "s_at x = k" using k_def map
+        unfolding set_map set_eq_iff image_iff
+        by metis
+      then have "SAT \<sigma> v k \<phi>" using SAlways unfolding Always
+        by (auto simp: Let_def n_def)
+    } note * = this
+    then show ?thesis
+      using SAlways
+      unfolding Always
+      by (auto simp: Let_def n_def intro: SAT_VIO.SAlways split: if_splits enat.splits)
+  qed(auto intro: SAT_VIO.intros)
+next
+  case (SUntil sps spsi)
+  then show ?case
+  proof (cases \<phi>)
+    case (Until \<phi> I \<psi>)
+    show ?thesis
+      using SUntil(3)
+      unfolding Until
+    proof (intro SAT_VIO.SUntil[of _ "s_at spsi"], goal_cases le mem SAT\<psi> SAT\<phi>)
+      case (SAT\<phi> k)
+      then show ?case
+        by (cases "k \<le> s_at (hd sps)")
+          (auto 0 3 simp: Let_def elim: map_setE[of _ _ _ k] intro: SUntil(1))
+    qed (auto simp: Let_def intro: SUntil(2))
+  qed auto
+next
+  case (SNext sp)
+  then show ?case by (cases \<phi>) (auto simp add: Let_def SAT_VIO.SNext)
+next
+  case (SPrev sp)
+  then show ?case by (cases \<phi>) (auto simp add: Let_def SAT_VIO.SPrev)
+next
+  case VFF
+  then show ?case by (cases \<phi>) (auto intro: SAT_VIO.VFF)
+next
+  case VPred
+  then show ?case by (cases \<phi>) (auto intro: SAT_VIO.VPred)
+next
+  case VEq_Const
+  then show ?case by (cases \<phi>) (auto intro: SAT_VIO.VEq_Const)
+next
+  case VNeg
+  then show ?case by (cases \<phi>) (auto intro: SAT_VIO.VNeg)
+next
+  case VOr
+  then show ?case by (cases \<phi>) (auto intro: SAT_VIO.VOr)
+next
+  case VAndL
+  then show ?case by (cases \<phi>) (auto intro: SAT_VIO.VAndL)
+next
+  case VAndR
+  then show ?case by (cases \<phi>) (auto intro: SAT_VIO.VAndR)
+next
+  case VImp
+  then show ?case by (cases \<phi>) (auto intro: SAT_VIO.VImp)
+next
+  case VIffSV
+  then show ?case by (cases \<phi>) (auto intro: SAT_VIO.VIffSV)
+next
+  case VIffVS
+  then show ?case by (cases \<phi>) (auto intro: SAT_VIO.VIffVS)
+next
+  case (VExists x part)
+  then show ?case
+  proof (cases \<phi>)
+    case (Exists y \<psi>)
+    show ?thesis unfolding Exists
+    proof (intro SAT_VIO.VExists allI)
+      fix z
+      let ?vp = "lookup_part part z"
+      from lookup_part_SubsVals[of z part] obtain D where "z \<in> D" "(D, ?vp) \<in> SubsVals part"
+        by blast
+      with VExists(2-) Exists have "v_check (v(y := z)) \<psi> ?vp" "v_at ?vp = v_at (VExists x part)"
+        by auto
+      then show "VIO \<sigma> (v(y := z)) (v_at (VExists x part)) \<psi>"
+        by (auto simp del: fun_upd_apply dest!: VExists(1)[rotated])
+    qed
+  qed auto
+next
+  case (VForall x z vp)
+  with VForall(1)[of "v(x := z)"] show ?case
+    by (cases \<phi>) (auto intro: SAT_VIO.VForall)
+next
+  case VOnceOut
+  then show ?case by (cases \<phi>) (auto intro: SAT_VIO.VOnceOut)
+next
+  case (VOnce i li vps)
+  then show ?case
+  proof (cases \<phi>)
+    case (Once I \<phi>)
+    {fix k
+      define j where j_def: "j \<equiv> case right I of \<infinity> \<Rightarrow> 0 | enat n \<Rightarrow> ETP \<sigma> (\<tau> \<sigma> i - n)"
+      assume k_def: "k \<ge> j \<and> k \<le> i \<and> k \<le> LTP \<sigma> (\<tau> \<sigma> i - left I)"
+      from VOnce Once j_def have map: "set (map v_at vps) = set [j ..< Suc (LTP_p \<sigma> i I)]"
+        by (auto simp: Let_def)
+      then have kset: "k \<in> set ([j ..< Suc (LTP_p \<sigma> i I)])" using j_def k_def by auto
+      then obtain x where x: "x \<in> set vps"  "v_at x = k" using k_def map
+        unfolding set_map set_eq_iff image_iff
+        by metis
+      then have "VIO \<sigma> v k \<phi>" using VOnce unfolding Once
+        by (auto simp: Let_def)
+    } note * = this
+    show ?thesis
+      using VOnce *
+      unfolding Once
+      by (auto simp: Let_def intro!: SAT_VIO.VOnce)
+  qed (auto intro: SAT_VIO.intros)
+next
+  case (VEventually i hi vps)
+  then show ?case
+  proof (cases \<phi>)
+    case (Eventually I \<phi>)
+    obtain n where n_def: "right I = enat n"
+      using VEventually
+      by (auto simp: Eventually split: enat.splits)
+    {fix k
+      define j where j_def: "j \<equiv> LTP \<sigma> (\<tau> \<sigma> i + n)"
+      assume k_def: "k \<le> j \<and> k \<ge> i \<and> k \<ge> ETP \<sigma> (\<tau> \<sigma> i + left I)"
+      from VEventually Eventually j_def have map: "set (map v_at vps) = set [(ETP_f \<sigma> i I) ..< Suc j]"
+        by (auto simp: Let_def n_def)
+      then have kset: "k \<in> set ([(ETP_f \<sigma> i I) ..< Suc j])" using k_def j_def by auto
+      then obtain x where x: "x \<in> set vps" "v_at x = k" using k_def map
+        unfolding set_map set_eq_iff image_iff
+        by metis
+      then have "VIO \<sigma> v k \<phi>" using VEventually unfolding Eventually
+        by (auto simp: Let_def n_def)
+    } note * = this
+    then show ?thesis
+      using VEventually
+      unfolding Eventually
+      by (auto simp: Let_def n_def intro: SAT_VIO.VEventually split: if_splits enat.splits)
+  qed(auto intro: SAT_VIO.intros)
+next
+  case (VHistorically i vp)
+  then show ?case
+  proof (cases \<phi>)
+    case (Historically I \<phi>)
+    show ?thesis
+      using VHistorically
+      unfolding Historically
+      by (intro SAT_VIO.VHistorically[of "v_at vp"]) (auto simp: Let_def)
+  qed auto
+next
+  case (VAlways i vp)
+  then show ?case
+  proof (cases \<phi>)
+    case (Always I \<phi>)
+    show ?thesis
+      using VAlways
+      unfolding Always
+      by (intro SAT_VIO.VAlways[of _ "v_at vp"]) (auto simp: Let_def)
+  qed auto
+next
+  case VNext
+  then show ?case by (cases \<phi>) (auto intro: SAT_VIO.VNext)
+next
+  case VNextOutR
+  then show ?case by (cases \<phi>) (auto intro: SAT_VIO.VNextOutR)
+next
+  case VNextOutL
+  then show ?case by (cases \<phi>) (auto intro: SAT_VIO.VNextOutL)
+next
+  case VPrev
+  then show ?case by (cases \<phi>) (auto intro: SAT_VIO.VPrev)
+next
+  case VPrevOutR
+  then show ?case by (cases \<phi>) (auto intro: SAT_VIO.VPrevOutR)
+next
+  case VPrevOutL
+  then show ?case by (cases \<phi>) (auto intro: SAT_VIO.VPrevOutL)
+next
+  case VPrevZ
+  then show ?case by (cases \<phi>) (auto intro: SAT_VIO.VPrevZ)
+next
+  case VSinceOut
+  then show ?case by (cases \<phi>) (auto intro: SAT_VIO.VSinceOut)
+next
+  case (VSince i vp vps)
+  then show ?case
+  proof (cases \<phi>)
+    case (Since \<phi> I \<psi>)
+    {fix k
+      assume k_def: "k \<ge> v_at vp \<and> k \<le> i \<and> k \<le> LTP \<sigma> (\<tau> \<sigma> i - left I)"
+      from VSince Since have map: "set (map v_at vps) = set ([(v_at vp) ..< Suc (LTP_p \<sigma> i I)])"
+        by (auto simp: Let_def)
+      then have kset: "k \<in> set ([(v_at vp) ..< Suc (LTP_p \<sigma> i I)])" using k_def by auto
+      then obtain x where x: "x \<in> set vps" "v_at x = k" using k_def map kset
+        unfolding set_map set_eq_iff image_iff
+        by metis
+      then have "VIO \<sigma> v k \<psi>" using VSince unfolding Since
+        by (auto simp: Let_def)
+    } note * = this
+    show ?thesis
+      using VSince *
+      unfolding Since
+      by (auto simp: Let_def split: enat.splits if_splits
+          intro!: SAT_VIO.VSince[of _ i "v_at vp"])
+  qed (auto intro: SAT_VIO.intros)
+next
+  case (VUntil i vps vp)
+  then show ?case
+  proof (cases \<phi>)
+    case (Until \<phi> I \<psi>)
+    {fix k
+      assume k_def: "k \<le> v_at vp \<and> k \<ge> i \<and> k \<ge> ETP \<sigma> (\<tau> \<sigma> i + left I)"
+      from VUntil Until have map: "set (map v_at vps) = set [(ETP_f \<sigma> i I) ..< Suc (v_at vp)]"
+        by (auto simp: Let_def)
+      then have kset: "k \<in> set ([(ETP_f \<sigma> i I) ..< Suc (v_at vp)])" using k_def by auto
+      then obtain x where x: "x \<in> set vps" "v_at x = k" using k_def map kset
+        unfolding set_map set_eq_iff image_iff
+        by metis
+      then have "VIO \<sigma> v k \<psi>" using VUntil unfolding Until
+        by (auto simp: Let_def)
+    } note * = this
+    then show ?thesis
+      using VUntil
+      unfolding Until
+      by (auto simp: Let_def split: enat.splits if_splits
+          intro!: SAT_VIO.VUntil)
+  qed(auto intro: SAT_VIO.intros)
+next
+  case (VSinceInf i li vps)
+  then show ?case
+  proof (cases \<phi>)
+    case (Since \<phi> I \<psi>)
+    {fix k
+      define j where j_def: "j \<equiv> case right I of \<infinity> \<Rightarrow> 0 | enat n \<Rightarrow> ETP \<sigma> (\<tau> \<sigma> i - n)"
+      assume k_def: "k \<ge> j \<and> k \<le> i \<and> k \<le> LTP \<sigma> (\<tau> \<sigma> i - left I)"
+      from VSinceInf Since j_def have map: "set (map v_at vps) = set [j ..< Suc (LTP_p \<sigma> i I)]"
+        by (auto simp: Let_def)
+      then have kset: "k \<in> set ([j ..< Suc (LTP_p \<sigma> i I)])" using j_def k_def by auto
+      then obtain x where x: "x \<in> set vps"  "v_at x = k" using k_def map
+        unfolding set_map set_eq_iff image_iff
+        by metis
+      then have "VIO \<sigma> v k \<psi>" using VSinceInf unfolding Since
+        by (auto simp: Let_def)
+    } note * = this
+    show ?thesis
+      using VSinceInf *
+      unfolding Since
+      by (auto simp: Let_def intro!: SAT_VIO.VSinceInf)
+  qed (auto intro: SAT_VIO.intros)
+next
+  case (VUntilInf i hi vps)
+  then show ?case
+  proof (cases \<phi>)
+    case (Until \<phi> I \<psi>)
+    obtain n where n_def: "right I = enat n"
+      using VUntilInf
+      by (auto simp: Until split: enat.splits)
+    {fix k
+      define j where j_def: "j \<equiv> LTP \<sigma> (\<tau> \<sigma> i + n)"
+      assume k_def: "k \<le> j \<and> k \<ge> i \<and> k \<ge> ETP \<sigma> (\<tau> \<sigma> i + left I)"
+      from VUntilInf Until j_def have map: "set (map v_at vps) = set [(ETP_f \<sigma> i I) ..< Suc j]"
+        by (auto simp: Let_def n_def)
+      then have kset: "k \<in> set ([(ETP_f \<sigma> i I) ..< Suc j])" using k_def j_def by auto
+      then obtain x where x: "x \<in> set vps" "v_at x = k" using k_def map
+        unfolding set_map set_eq_iff image_iff
+        by metis
+      then have "VIO \<sigma> v k \<psi>" using VUntilInf unfolding Until
+        by (auto simp: Let_def n_def)
+    } note * = this
+    then show ?thesis
+      using VUntilInf
+      unfolding Until
+      by (auto simp: Let_def n_def intro: SAT_VIO.VUntilInf split: if_splits enat.splits)
+  qed(auto intro: SAT_VIO.intros)
+qed
+
+definition "compatible X vs v \<longleftrightarrow> (\<forall>x\<in>X. v x \<in> vs x)"
+
+definition "compatible_vals X vs = {v. \<forall>x \<in> X. v x \<in> vs x}"
+
+lemma compatible_alt:
+  "compatible X vs v \<longleftrightarrow> v \<in> compatible_vals X vs"
+  by (auto simp: compatible_def compatible_vals_def)
+
+lemma compatible_empty_iff: "compatible {} vs v \<longleftrightarrow> True"
+  by (auto simp: compatible_def)
+
+lemma compatible_vals_empty_eq: "compatible_vals {} vs = UNIV"
+  by (auto simp: compatible_vals_def)
+
+lemma compatible_union_iff:
+  "compatible (X \<union> Y) vs v \<longleftrightarrow> compatible X vs v \<and> compatible Y vs v"
+  by (auto simp: compatible_def)
+
+lemma compatible_vals_union_eq:
+  "compatible_vals (X \<union> Y) vs = compatible_vals X vs \<inter> compatible_vals Y vs"
+  by (auto simp: compatible_vals_def)
+
+lemma compatible_antimono:
+  "compatible X vs v \<Longrightarrow> Y \<subseteq> X \<Longrightarrow> compatible Y vs v"
+  by (auto simp: compatible_def)
+
+lemma compatible_vals_antimono:
+  "Y \<subseteq> X \<Longrightarrow> compatible_vals X vs \<subseteq> compatible_vals Y vs"
+  by (auto simp: compatible_vals_def)
+
+lemma compatible_extensible:
+  "(\<forall>x. vs x \<noteq> {}) \<Longrightarrow> compatible X vs v \<Longrightarrow> X \<subseteq> Y \<Longrightarrow> \<exists>v'. compatible Y vs v' \<and> (\<forall>x\<in>X. v x = v' x)"
+  using some_in_eq[of "vs _"] by (auto simp: override_on_def compatible_def
+      intro: exI[where x="override_on v (\<lambda>x. SOME y. y \<in> vs x) (Y-X)"])
+
+lemmas compatible_vals_extensible = compatible_extensible[unfolded compatible_alt]
+
+primrec mk_values :: "(('n, 'd) trm \<times> 'a set) list \<Rightarrow> 'a list set"
+  where "mk_values [] = {[]}"
+  | "mk_values (T # Ts) = (case T of
+      (\<^bold>v x, X) \<Rightarrow>
+        let terms = map fst Ts in
+        if \<^bold>v x \<in> set terms then
+          let fst_pos = hd (positions terms (\<^bold>v x)) in (\<lambda>xs. (xs ! fst_pos) # xs) ` (mk_values Ts)
+        else set_Cons X (mk_values Ts)
+    | (\<^bold>c a, X) \<Rightarrow> set_Cons X (mk_values Ts))"
+
+lemma mk_values_nempty:
+  "{} \<notin> set (map snd tXs) \<Longrightarrow> mk_values tXs \<noteq> {}"
+  by (induct tXs)
+    (auto simp: set_Cons_def image_iff split: trm.splits if_splits)
+
+lemma mk_values_not_Nil:
+  "{} \<notin> set (map snd tXs) \<Longrightarrow> tXs \<noteq> [] \<Longrightarrow> vs \<in> mk_values tXs \<Longrightarrow> vs \<noteq> []"
+  by (induct tXs)
+    (auto simp: set_Cons_def image_iff split: trm.splits if_splits)
+
+lemma mk_values_nth_cong: "\<^bold>v x \<in> set (map fst tXs) \<Longrightarrow>
+  n \<in> set (positions (map fst tXs) (\<^bold>v x)) \<Longrightarrow>
+  m \<in> set (positions (map fst tXs) (\<^bold>v x)) \<Longrightarrow>
+  vs \<in> mk_values tXs \<Longrightarrow>
+  vs ! n = vs ! m"
+proof (induct tXs arbitrary: n m vs x)
+  case (Cons tX tXs)
+  show ?case
+  proof (cases n)
+    case 0
+    then show ?thesis
+    proof (cases m)
+      case (Suc m')
+      with 0 show ?thesis
+        using Cons(2-) Cons.hyps(1)[of x m' _ "tl vs"] positions_eq_nil_iff[of "map fst tXs" "trm.Var x"]
+        by (fastforce split: if_splits simp: in_set_conv_nth
+            Let_def nth_Cons' gr0_conv_Suc neq_Nil_conv)
+    qed simp
+  next
+    case n: (Suc n')
+    then show ?thesis
+    proof (cases m)
+      case 0
+      with n show ?thesis
+        using Cons(2-) Cons.hyps(1)[of x _ n' "tl vs"] positions_eq_nil_iff[of "map fst tXs" "trm.Var x"]
+        by (fastforce split: if_splits simp: in_set_conv_nth
+            Let_def nth_Cons' gr0_conv_Suc neq_Nil_conv)
+    next
+      case (Suc m')
+      with n show ?thesis
+        using Cons(1)[of x n' m' "tl vs"] Cons(2-)
+        by (fastforce simp: set_Cons_def set_positions_eq split: trm.splits if_splits)
+    qed
+  qed
+qed simp
+
+definition "mk_values_subset p tXs X
+  \<longleftrightarrow> (let (fintXs, inftXs) = partition (\<lambda>tX. finite (snd tX)) tXs in
+  if inftXs = [] then {p} \<times> mk_values tXs \<subseteq> X
+  else let inf_dups = filter (\<lambda>tX. (fst tX) \<in> set (map fst fintXs)) inftXs in
+    if inf_dups = [] then (if finite X then False else Code.abort STR ''subset on infinite subset'' (\<lambda>_. {p} \<times> mk_values tXs \<subseteq> X))
+    else if list_all (\<lambda>tX. Max (set (positions tXs tX)) < Max (set (positions (map fst tXs) (fst tX)))) inf_dups
+      then {p} \<times> mk_values tXs \<subseteq> X
+      else (if finite X then False else Code.abort STR ''subset on infinite subset'' (\<lambda>_. {p} \<times> mk_values tXs \<subseteq> X)))"
+
+lemma mk_values_nemptyI: "\<forall>tX \<in> set tXs. snd tX \<noteq> {} \<Longrightarrow> mk_values tXs \<noteq> {}"
+  by (induct tXs)
+    (auto simp: Let_def set_Cons_eq split: prod.splits trm.splits)
+
+lemma infinite_mk_values1: "\<forall>tX \<in> set tXs. snd tX \<noteq> {} \<Longrightarrow> tY \<in> set tXs \<Longrightarrow>
+  \<forall>Y. (fst tY, Y) \<in> set tXs \<longrightarrow> infinite Y \<Longrightarrow> infinite (mk_values tXs)"
+proof (induct tXs arbitrary: tY)
+  case (Cons tX tXs)
+  show ?case
+    unfolding Let_def image_iff mk_values.simps split_beta
+      trm.split[of infinite] if_split[of infinite]
+  proof (safe, goal_cases var_in var_out const)
+    case (var_in x)
+    hence "\<forall>tX\<in>set tXs. snd tX \<noteq> {}"
+      by (simp add: Cons.prems(1))
+    moreover have "\<forall>Z. (trm.Var x, Z) \<in> set tXs \<longrightarrow> infinite Z"
+      using Cons.prems(2,3) var_in
+      by (cases "tY \<in> set tXs"; clarsimp)
+        (metis (no_types, lifting) Cons.hyps Cons.prems(1)
+          finite_imageD inj_on_def list.inject list.set_intros(2))
+    ultimately have "infinite (mk_values tXs)"
+      using Cons.hyps var_in
+      by auto
+    moreover have "inj (\<lambda>xs. xs ! hd (positions (map fst tXs) (trm.Var x)) # xs)"
+      by (clarsimp simp: inj_on_def)
+    ultimately show ?case
+      using var_in(3) finite_imageD inj_on_subset
+      by fastforce
+  next
+    case (var_out x)
+    hence "infinite (snd tX)"
+      using Cons
+      by (metis infinite_set_ConsI(2) insert_iff list.simps(15) prod.collapse)
+    moreover have "mk_values tXs \<noteq> {}"
+      using Cons.prems
+      by (auto intro!: mk_values_nemptyI)
+    then show ?case
+      using Cons var_out infinite_set_ConsI(1)[OF \<open>mk_values tXs \<noteq> {}\<close> \<open>infinite (snd tX)\<close>]
+      by auto
+  next
+    case (const c)
+    hence "infinite (snd tX)"
+      using Cons
+      by (metis infinite_set_ConsI(2) insert_iff list.simps(15) prod.collapse)
+    moreover have "mk_values tXs \<noteq> {}"
+      using Cons.prems
+      by (auto intro!: mk_values_nemptyI)
+    then show ?case
+      using Cons const infinite_set_ConsI(1)[OF \<open>mk_values tXs \<noteq> {}\<close> \<open>infinite (snd tX)\<close>]
+      by auto
+  qed
+qed simp
+
+lemma infinite_mk_values2: "\<forall>tX\<in>set tXs. snd tX \<noteq> {} \<Longrightarrow>
+  tY \<in> set tXs \<Longrightarrow> infinite (snd tY) \<Longrightarrow>
+  Max (set (positions tXs tY)) \<ge> Max (set (positions (map fst tXs) (fst tY))) \<Longrightarrow>
+  infinite (mk_values tXs)"
+proof (induct tXs arbitrary: tY)
+  case (Cons tX tXs)
+  hence obs1: "\<forall>tX\<in>set tXs. snd tX \<noteq> {}"
+    by (simp add: Cons.prems(1))
+  note IH = Cons.hyps[OF obs1 _ \<open>infinite (snd tY)\<close>]
+  have obs2: "tY \<in> set tXs \<Longrightarrow>
+    Max (set (positions (map fst tXs) (fst tY))) \<le> Max (set (positions tXs tY))"
+    using Cons.prems(4) unfolding list.map
+    by (metis Max_set_positions_Cons_tl Suc_le_mono positions_eq_nil_iff set_empty2 subset_empty subset_positions_map_fst)
+  show ?case
+    unfolding Let_def image_iff mk_values.simps split_beta
+      trm.split[of infinite] if_split[of infinite]
+  proof (safe, goal_cases var_in var_out const)
+    case (var_in x)
+    then show ?case
+    proof (cases "tY \<in> set tXs")
+      case True
+      hence "infinite ((\<lambda>Xs. Xs ! hd (positions (map fst tXs) (trm.Var x)) # Xs) ` mk_values tXs)"
+        using IH[OF True obs2[OF True]] finite_imageD inj_on_def by blast
+      then show "False"
+        using var_in by blast
+    next
+      case False
+      have "Max (set (positions (map fst (tX # tXs)) (fst tY)))
+      = Suc (Max (set (positions (map fst tXs) (fst tY))))"
+        using Cons.prems var_in
+        by (simp only: list.map(2))
+          (subst Max_set_positions_Cons_tl; force simp: image_iff)
+      moreover have "tY \<notin> set tXs \<Longrightarrow> Max (set (positions (tX # tXs) tY)) = (0::nat)"
+        using Cons.prems Max_set_positions_Cons_hd by fastforce
+      ultimately show "False"
+        using Cons.prems(4) False
+        by linarith
+    qed
+  next
+    case (var_out x)
+    then show ?case
+    proof (cases "tY \<in> set tXs")
+      case True
+      hence "infinite (mk_values tXs)"
+        using IH obs2 by blast
+      hence "infinite (set_Cons (snd tX) (mk_values tXs))"
+        by (metis Cons.prems(1) infinite_set_ConsI(2) list.set_intros(1))
+      then show "False"
+        using var_out by blast
+    next
+      case False
+      hence "snd tY = snd tX" and "infinite (snd tX)"
+        using var_out Cons.prems
+        by auto
+      hence "infinite (set_Cons (snd tX) (mk_values tXs))"
+        by (simp add: infinite_set_ConsI(1) mk_values_nemptyI obs1)
+      then show "False"
+        using var_out by blast
+    qed
+  next
+    case (const c)
+    then show ?case
+    proof (cases "tY \<in> set tXs")
+      case True
+      hence "infinite (mk_values tXs)"
+        using IH obs2 by blast
+      hence "infinite (set_Cons (snd tX) (mk_values tXs))"
+        by (metis Cons.prems(1) infinite_set_ConsI(2) list.set_intros(1))
+      then show "False"
+        using const by blast
+    next
+      case False
+      hence "infinite (set_Cons (snd tX) (mk_values tXs))"
+        using const Cons.prems
+        by (simp add: infinite_set_ConsI(1) mk_values_nemptyI obs1)
+      then show "False"
+        using const by blast
+    qed
+  qed
+qed simp
+
+lemma mk_values_subset_iff: "\<forall>tX \<in> set tXs. snd tX \<noteq> {} \<Longrightarrow>
+   mk_values_subset p tXs X \<longleftrightarrow> {p} \<times> mk_values tXs \<subseteq> X"
+  unfolding mk_values_subset_def image_iff Let_def comp_def split_beta if_split_eq1
+    partition_filter1 partition_filter2 o_def set_map set_filter filter_filter bex_simps
+proof safe
+  assume "\<forall>tX\<in>set tXs. snd tX \<noteq> {}" and "finite X"
+    and filter1: "filter (\<lambda>xy. infinite (snd xy) \<and> (\<exists>ab. (ab \<in> set tXs \<and> finite (snd ab)) \<and> fst xy = fst ab)) tXs = []"
+    and filter2: "filter (\<lambda>x. infinite (snd x)) tXs \<noteq> []"
+  then obtain tY where "tY \<in> set tXs" and "infinite (snd tY)"
+    by (meson filter_False)
+  moreover have "\<forall>Y. (fst tY, Y) \<in> set tXs \<longrightarrow> infinite Y"
+    using filter1 calculation
+    by (auto simp: filter_empty_conv)
+  ultimately have "infinite (mk_values tXs)"
+    using infinite_mk_values1[OF \<open>\<forall>tX\<in>set tXs. snd tX \<noteq> {}\<close>]
+    by auto
+  hence "infinite ({p} \<times> mk_values tXs)"
+    using finite_cartesian_productD2 by auto
+  thus "{p} \<times> mk_values tXs \<subseteq> X \<Longrightarrow> False"
+    using \<open>finite X\<close>
+    by (simp add: finite_subset)
+next
+  assume "\<forall>tX\<in>set tXs. snd tX \<noteq> {}"
+    and "finite X"
+    and ex_dupl_inf: "\<not> list_all (\<lambda>tX. Max (set (positions tXs tX))
+    < Max (set (positions (map fst tXs) (fst tX))))
+        (filter (\<lambda>xy. infinite (snd xy) \<and> (\<exists>ab. (ab \<in> set tXs \<and> finite (snd ab)) \<and> fst xy = fst ab)) tXs)"
+    and filter: "filter (\<lambda>x. infinite (snd x)) tXs \<noteq> []"
+  then obtain tY and Z where "tY \<in> set tXs"
+    and "infinite (snd tY)"
+    and "(fst tY, Z) \<in> set tXs"
+    and "finite Z"
+    and "Max (set (positions tXs tY)) \<ge> Max (set (positions (map fst tXs) (fst tY)))"
+    by (auto simp: list_all_iff)
+  hence "infinite (mk_values tXs)"
+    using infinite_mk_values2[OF \<open>\<forall>tX\<in>set tXs. snd tX \<noteq> {}\<close> \<open>tY \<in> set tXs\<close>]
+    by auto
+  hence "infinite ({p} \<times> mk_values tXs)"
+    using finite_cartesian_productD2 by auto
+  thus "{p} \<times> mk_values tXs \<subseteq> X \<Longrightarrow> False"
+    using \<open>finite X\<close>
+    by (simp add: finite_subset)
+qed auto
+
+lemma mk_values_sound: "cs \<in> mk_values (vs\<^bold>\<lbrace>ts\<^bold>\<rbrace>) \<Longrightarrow>
+  \<exists>v\<in>compatible_vals (fv (r \<dagger> ts)) vs. cs = v\<^bold>\<lbrakk>ts\<^bold>\<rbrakk>"
+proof (induct ts arbitrary: cs vs)
+  case (Cons t ts)
+  show ?case
+  proof(cases t)
+    case (Var x)
+    let ?Ts = "vs\<^bold>\<lbrace>ts\<^bold>\<rbrace>"
+    have "vs\<^bold>\<lbrace>(t # ts)\<^bold>\<rbrace> = (\<^bold>v x, vs x) # ?Ts"
+      using Var by (simp add: eval_trms_set_def)
+    show ?thesis
+    proof (cases "\<^bold>v x \<in> set ts")
+      case True
+      then obtain n where n_in: "n \<in> set (positions ts (\<^bold>v x))"
+        and nth_n: "ts ! n = \<^bold>v x"
+        by (meson fst_pos_in_positions nth_fst_pos)
+      hence n_in': "n \<in> set (positions (map fst ?Ts) (\<^bold>v x))"
+        by (induct ts arbitrary: n)
+          (auto simp: eval_trms_set_def split: if_splits)
+      have key: "\<^bold>v x \<in> set (map fst ?Ts)"
+        using True by (induct ts)
+          (auto simp: eval_trms_set_def)
+      then obtain a as
+        where as_head: "as ! (hd (positions (map fst ?Ts) (\<^bold>v x))) = a"
+          and as_tail: "as \<in> mk_values ?Ts"
+          and as_shape: "cs = a # as"
+        using Cons(2)
+        by (clarsimp simp add: eval_trms_set_def Var image_iff)
+      obtain v where v_hyps: "v \<in> compatible_vals (fv (r \<dagger> ts)) vs"
+        "as = v\<^bold>\<lbrakk>ts\<^bold>\<rbrakk>"
+        using Cons(1)[OF as_tail] by blast
+      hence as'_nth: "as ! n = v x"
+        using nth_n positions_length[OF n_in]
+        by (simp add: eval_trms_def)
+      have evals_neq_Nil: "?Ts \<noteq> []"
+        using key by auto
+      moreover have "positions (map fst ?Ts) (\<^bold>v x) \<noteq> []"
+        using positions_eq_nil_iff[of "map fst ?Ts" "\<^bold>v x"] key
+        by fastforce
+      ultimately have as_hyp: "a = as ! n"
+        using mk_values_nth_cong[OF key hd_in_set n_in' as_tail] as_head  by blast
+      thus ?thesis
+        using Var as_shape True v_hyps as'_nth
+        by (auto simp: compatible_vals_def eval_trms_def intro!: exI[of _ v])
+    next
+      case False
+      hence *: "\<^bold>v x \<notin> set (map fst ?Ts)"
+      proof (induct ts arbitrary: x)
+        case (Cons a ts)
+        then show ?case
+          by (cases a) (auto simp: eval_trms_set_def)
+      qed (simp add: eval_trms_set_def)
+      from Cons(2) False show ?thesis
+        unfolding set_Cons_def eval_trms_set_def Let_def list.simps Var
+          *[THEN eq_False[THEN iffD2], unfolded eval_trms_set_def] if_False
+          mk_values.simps eval_trm_set.simps prod.case trm.case mem_Collect_eq
+      proof (elim exE conjE, goal_cases)
+        case (1 a as)
+        with Cons(1)[of as vs] obtain v where "v \<in> compatible_vals (fv (r \<dagger> ts)) vs" "as = v\<^bold>\<lbrakk>ts\<^bold>\<rbrakk>"
+          by (auto simp: eval_trms_set_def)
+        with 1 show ?case
+          by (auto simp: eval_trms_set_def eval_trms_def compatible_vals_def in_fv_trm_conv
+            intro!: exI[of _ "v(x := a)"] eval_trm_fv_cong)
+      qed
+    qed
+  next
+    case (Const c)
+    then show ?thesis
+      using Cons(1)[of _ vs] Cons(2)
+      by (auto simp: eval_trms_set_def set_Cons_def
+          eval_trms_def compatible_def)
+  qed
+qed (simp add: eval_trms_set_def eval_trms_def compatible_vals_def)
+
+lemma fst_eval_trm_set[simp]:
+  "fst (vs\<lbrace>t\<rbrace>) = t"
+  by (cases t; clarsimp)
+
+lemma mk_values_complete: "cs = v\<^bold>\<lbrakk>ts\<^bold>\<rbrakk> \<Longrightarrow>
+  v \<in> compatible_vals (fv (r \<dagger> ts)) vs \<Longrightarrow>
+  cs \<in> mk_values (vs\<^bold>\<lbrace>ts\<^bold>\<rbrace>)"
+proof (induct ts arbitrary: v cs vs)
+  case (Cons t ts)
+  then obtain a as
+    where a_def: "a = v\<lbrakk>t\<rbrakk>"
+      and as_def: "as = v\<^bold>\<lbrakk>ts\<^bold>\<rbrakk>"
+      and cs_cons: "cs = a # as"
+    by (auto simp: eval_trms_def)
+  have compat_v_vs: "v \<in> compatible_vals (fv (r \<dagger> ts)) vs"
+    using Cons.prems
+    by (auto simp: compatible_vals_def)
+  hence mk_values_ts: "as \<in> mk_values (vs\<^bold>\<lbrace>ts\<^bold>\<rbrace>)"
+    using Cons.hyps[OF as_def]
+    unfolding eval_trms_set_def by blast
+  show ?case
+  proof (cases "t")
+    case (Var x)
+    then show ?thesis
+    proof (cases "\<^bold>v x \<in> set ts")
+      case True
+      then obtain n
+        where n_head: "n = hd (positions ts (\<^bold>v x))"
+          and n_in: "n \<in> set (positions ts (\<^bold>v x))"
+          and nth_n: "ts ! n = \<^bold>v x"
+        by (simp_all add: hd_positions_eq_fst_pos nth_fst_pos fst_pos_in_positions)
+      hence n_in': "n = hd (positions (map fst (vs\<^bold>\<lbrace>ts\<^bold>\<rbrace>)) (\<^bold>v x))"
+        by (clarsimp simp: eval_trms_set_def o_def)
+      moreover have "as ! n = a"
+        using a_def as_def nth_n Var n_in True positions_length
+        by (fastforce simp: eval_trms_def)
+      moreover have "\<^bold>v x \<in> set (map fst (vs\<^bold>\<lbrace>ts\<^bold>\<rbrace>))"
+        using True by (induct ts)
+          (auto simp: eval_trms_set_def)
+      ultimately show ?thesis
+        using mk_values_ts cs_cons
+        by (clarsimp simp: eval_trms_set_def Var image_iff)
+    next
+      case False
+      then show ?thesis
+        using Var cs_cons mk_values_ts Cons.prems a_def
+        by (clarsimp simp: eval_trms_set_def image_iff
+            set_Cons_def compatible_vals_def split: trm.splits)
+    qed
+  next
+    case (Const a)
+    then show ?thesis
+      using cs_cons mk_values_ts Cons.prems a_def
+      by (clarsimp simp: eval_trms_set_def image_iff
+          set_Cons_def compatible_vals_def split: trm.splits)
+  qed
+qed (simp add: compatible_vals_def
+    eval_trms_set_def eval_trms_def)
+
+definition "mk_values_subset_Compl r vs ts i = ({r} \<times> mk_values (vs\<^bold>\<lbrace>ts\<^bold>\<rbrace>) \<subseteq> - \<Gamma> \<sigma> i)"
+
+fun check_values where
+  "check_values _ _ _ None = None"
+| "check_values vs (\<^bold>c c # ts) (u # us) f = (if c = u then check_values vs ts us f else None)"
+| "check_values vs (\<^bold>v x # ts) (u # us) (Some v) = (if u \<in> vs x \<and> (v x = Some u \<or> v x = None) then check_values vs ts us (Some (v(x \<mapsto> u))) else None)"
+| "check_values vs [] [] f = f"
+| "check_values _ _ _ _ = None"
+
+lemma mk_values_alt:
+  "mk_values (vs\<^bold>\<lbrace>ts\<^bold>\<rbrace>) =
+   {cs. \<exists>v\<in>compatible_vals (\<Union>(fv_trm ` set ts)) vs. cs = v\<^bold>\<lbrakk>ts\<^bold>\<rbrakk>}"
+  by (auto dest!: mk_values_sound intro: mk_values_complete)
+
+lemma check_values_neq_NoneI:
+  assumes "v \<in> compatible_vals (\<Union> (fv_trm ` set ts) - dom f) vs" "\<And>x y. f x = Some y \<Longrightarrow> y \<in> vs x"
+  shows "check_values vs ts ((\<lambda>x. case f x of None \<Rightarrow> v x | Some y \<Rightarrow> y)\<^bold>\<lbrakk>ts\<^bold>\<rbrakk>) (Some f) \<noteq> None"
+  using assms
+proof (induct ts arbitrary: f)
+  case (Cons t ts)
+  then show ?case
+  proof (cases t)
+    case (Var x)
+    show ?thesis
+    proof (cases "f x")
+      case None
+      with Cons(2) Var have v_in[simp]: "v x \<in> vs x"
+        by (auto simp: compatible_vals_def)
+      from Cons(2) have "v \<in> compatible_vals (\<Union> (fv_trm ` set ts) - dom (f(x \<mapsto> v x))) vs"
+        by (auto simp: compatible_vals_def)
+      then have "check_values vs ts
+        ((\<lambda>z. case (f(x \<mapsto> v x)) z of None \<Rightarrow> v z | Some y \<Rightarrow> y)\<^bold>\<lbrakk>ts\<^bold>\<rbrakk>)
+        (Some (f(x \<mapsto> v x))) \<noteq> None"
+        using Cons(3) None Var
+        by (intro Cons(1)) (auto simp: compatible_vals_def split: if_splits)
+      then show ?thesis
+        by (elim eq_neq_eq_imp_neq[OF _ _ refl, rotated])
+          (auto simp add: eval_trms_def compatible_vals_def Var None split: if_splits option.splits
+            intro!: arg_cong2[of _ _ _ _ "check_values vs ts"] eval_trm_fv_cong)
+    next
+      case (Some y)
+      with Cons(1)[of f] Cons(2-) Var fun_upd_triv[of f x] show ?thesis
+        by (auto simp: domI eval_trms_def compatible_vals_def split: option.splits)
+    qed
+  next
+    case (Const c)
+    with Cons show ?thesis
+      by (auto simp: eval_trms_def compatible_vals_def split: option.splits)
+  qed
+qed (simp add: eval_trms_def)
+
+lemma check_values_eq_NoneI:
+  "\<forall>v\<in>compatible_vals (\<Union> (fv_trm ` set ts) - dom f) vs. us \<noteq> (\<lambda>x. case f x of None \<Rightarrow> v x | Some y \<Rightarrow> y)\<^bold>\<lbrakk>ts\<^bold>\<rbrakk> \<Longrightarrow>
+  check_values vs ts us (Some f) = None"
+proof (induct vs ts us "Some f" arbitrary: f rule: check_values.induct)
+  case (3 vs x ts u us v)
+  show ?case
+    unfolding check_values.simps if_split_eq1 simp_thms
+  proof (intro impI 3(1), safe, goal_cases)
+    case (1 v')
+    with 3(2) show ?case
+      by (auto simp: insert_dom domI eval_trms_def intro!: eval_trm_fv_cong split: if_splits dest!: bspec[of _ _ "v'"])
+  next
+    case (2 v')
+    with 3(2) show ?case
+      by (auto simp: insert_dom domI compatible_vals_def eval_trms_def intro!: eval_trm_fv_cong split: if_splits option.splits dest!: spec[of _ "v'(x := u)"])
+  qed
+qed (auto simp: compatible_vals_def eval_trms_def)
+
+lemma mk_values_subset_Compl_code[code]:
+  "mk_values_subset_Compl r vs ts i = (\<forall>(q, us) \<in> \<Gamma> \<sigma> i. q \<noteq> r \<or> check_values vs ts us (Some Map.empty) = None)"
+  unfolding mk_values_subset_Compl_def eval_trms_set_def[symmetric] mk_values_alt
+proof (safe, goal_cases)
+  case (1 _ us y)
+  then show ?case
+    by (auto simp: subset_eq check_values_eq_NoneI[where f=Map.empty, simplified] dest!: spec[of _ us])
+qed (auto simp: subset_eq  dest!: check_values_neq_NoneI[where f=Map.empty, simplified])
+
+subsection \<open>Executable Variant of the Checker\<close>
+
+fun s_check_exec :: "('n, 'd) envset \<Rightarrow> ('n, 'd) formula \<Rightarrow> ('n, 'd) sproof \<Rightarrow> bool"
+and v_check_exec :: "('n, 'd) envset \<Rightarrow> ('n, 'd) formula \<Rightarrow> ('n, 'd) vproof \<Rightarrow> bool" where
+  "s_check_exec vs f p = (case (f, p) of
+    (\<top>, STT i) \<Rightarrow> True
+  | (r \<dagger> ts, SPred i s ts') \<Rightarrow>
+    (r = s \<and> ts = ts' \<and> mk_values_subset r (vs\<^bold>\<lbrace>ts\<^bold>\<rbrace>) (\<Gamma> \<sigma> i))
+  | (x \<^bold>\<approx> c, SEq_Const i x' c') \<Rightarrow>
+    (c = c' \<and> x = x' \<and> vs x = {c})
+  | (\<not>\<^sub>F \<phi>, SNeg vp) \<Rightarrow> v_check_exec vs \<phi> vp
+  | (\<phi> \<or>\<^sub>F \<psi>, SOrL sp1) \<Rightarrow> s_check_exec vs \<phi> sp1
+  | (\<phi> \<or>\<^sub>F \<psi>, SOrR sp2) \<Rightarrow> s_check_exec vs \<psi> sp2
+  | (\<phi> \<and>\<^sub>F \<psi>, SAnd sp1 sp2) \<Rightarrow> s_check_exec vs \<phi> sp1 \<and> s_check_exec vs \<psi> sp2 \<and> s_at sp1 = s_at sp2
+  | (\<phi> \<longrightarrow>\<^sub>F \<psi>, SImpL vp1) \<Rightarrow> v_check_exec vs \<phi> vp1
+  | (\<phi> \<longrightarrow>\<^sub>F \<psi>, SImpR sp2) \<Rightarrow> s_check_exec vs \<psi> sp2
+  | (\<phi> \<longleftrightarrow>\<^sub>F \<psi>, SIffSS sp1 sp2) \<Rightarrow> s_check_exec vs \<phi> sp1 \<and> s_check_exec vs \<psi> sp2 \<and> s_at sp1 = s_at sp2
+  | (\<phi> \<longleftrightarrow>\<^sub>F \<psi>, SIffVV vp1 vp2) \<Rightarrow> v_check_exec vs \<phi> vp1 \<and> v_check_exec vs \<psi> vp2 \<and> v_at vp1 = v_at vp2
+  | (\<exists>\<^sub>Fx.  \<phi>, SExists y val sp) \<Rightarrow> (x = y \<and> s_check_exec (vs (x := {val})) \<phi> sp)
+  | (\<forall>\<^sub>Fx.  \<phi>, SForall y sp_part) \<Rightarrow> (let i = s_at (part_hd sp_part)
+      in x = y \<and> (\<forall>(sub, sp) \<in> SubsVals sp_part. s_at sp = i \<and> s_check_exec (vs (x := sub)) \<phi> sp))
+  | (\<^bold>Y I \<phi>, SPrev sp) \<Rightarrow>
+    (let j = s_at sp; i = s_at (SPrev sp) in
+    i = j+1 \<and> mem (\<Delta> \<sigma> i) I \<and> s_check_exec vs \<phi> sp)
+  | (\<^bold>X I \<phi>, SNext sp) \<Rightarrow>
+    (let j = s_at sp; i = s_at (SNext sp) in
+    j = i+1 \<and> mem (\<Delta> \<sigma> j) I \<and> s_check_exec vs \<phi> sp)
+  | (\<^bold>P I \<phi>, SOnce i sp) \<Rightarrow>
+    (let j = s_at sp in
+    j \<le> i \<and> mem (\<tau> \<sigma> i - \<tau> \<sigma> j) I \<and> s_check_exec vs \<phi> sp)
+  | (\<^bold>F I \<phi>, SEventually i sp) \<Rightarrow>
+    (let j = s_at sp in
+    j \<ge> i \<and> mem (\<tau> \<sigma> j - \<tau> \<sigma> i) I \<and> s_check_exec vs \<phi> sp)
+  | (\<^bold>H I \<phi>, SHistoricallyOut i) \<Rightarrow>
+    \<tau> \<sigma> i < \<tau> \<sigma> 0 + left I
+  | (\<^bold>H I \<phi>, SHistorically i li sps) \<Rightarrow>
+    (li = (case right I of \<infinity> \<Rightarrow> 0 | enat b \<Rightarrow> ETP \<sigma> (\<tau> \<sigma> i - b))
+    \<and> \<tau> \<sigma> 0 + left I \<le> \<tau> \<sigma> i
+    \<and> map s_at sps = [li ..< (LTP_p \<sigma> i I) + 1]
+    \<and> (\<forall>sp \<in> set sps. s_check_exec vs \<phi> sp))
+  | (\<^bold>G I \<phi>, SAlways i hi sps) \<Rightarrow>
+    (hi = (case right I of enat b \<Rightarrow> LTP_f \<sigma> i b)
+    \<and> right I \<noteq> \<infinity>
+    \<and> map s_at sps = [(ETP_f \<sigma> i I) ..< hi + 1]
+    \<and> (\<forall>sp \<in> set sps. s_check_exec vs \<phi> sp))
+  | (\<phi> \<^bold>S I \<psi>, SSince sp2 sp1s) \<Rightarrow>
+    (let i = s_at (SSince sp2 sp1s); j = s_at sp2 in
+    j \<le> i \<and> mem (\<tau> \<sigma> i - \<tau> \<sigma> j) I
+    \<and> map s_at sp1s = [j+1 ..< i+1]
+    \<and> s_check_exec vs \<psi> sp2
+    \<and> (\<forall>sp1 \<in> set sp1s. s_check_exec vs \<phi> sp1))
+  | (\<phi> \<^bold>U I \<psi>, SUntil sp1s sp2) \<Rightarrow>
+    (let i = s_at (SUntil sp1s sp2); j = s_at sp2 in
+    j \<ge> i \<and> mem (\<tau> \<sigma> j - \<tau> \<sigma> i) I
+    \<and> map s_at sp1s = [i ..< j] \<and> s_check_exec vs \<psi> sp2
+    \<and> (\<forall>sp1 \<in> set sp1s. s_check_exec vs \<phi> sp1))
+  | ( _ , _) \<Rightarrow> False)"
+| "v_check_exec vs f p = (case (f, p) of
+    (\<bottom>, VFF i) \<Rightarrow> True
+  | (r \<dagger> ts, VPred i pred ts') \<Rightarrow>
+    (r = pred \<and> ts = ts' \<and> mk_values_subset_Compl r vs ts i)
+  | (x \<^bold>\<approx> c, VEq_Const i x' c') \<Rightarrow>
+    (c = c' \<and> x = x' \<and> c \<notin> vs x)
+  | (\<not>\<^sub>F \<phi>, VNeg sp) \<Rightarrow> s_check_exec vs \<phi> sp
+  | (\<phi> \<or>\<^sub>F \<psi>, VOr vp1 vp2) \<Rightarrow> v_check_exec vs \<phi> vp1 \<and> v_check_exec vs \<psi> vp2 \<and> v_at vp1 = v_at vp2
+  | (\<phi> \<and>\<^sub>F \<psi>, VAndL vp1) \<Rightarrow> v_check_exec vs \<phi> vp1
+  | (\<phi> \<and>\<^sub>F \<psi>, VAndR vp2) \<Rightarrow> v_check_exec vs \<psi> vp2
+  | (\<phi> \<longrightarrow>\<^sub>F \<psi>, VImp sp1 vp2) \<Rightarrow> s_check_exec vs \<phi> sp1 \<and> v_check_exec vs \<psi> vp2 \<and> s_at sp1 = v_at vp2
+  | (\<phi> \<longleftrightarrow>\<^sub>F \<psi>, VIffSV sp1 vp2) \<Rightarrow> s_check_exec vs \<phi> sp1 \<and> v_check_exec vs \<psi> vp2 \<and> s_at sp1 = v_at vp2
+  | (\<phi> \<longleftrightarrow>\<^sub>F \<psi>, VIffVS vp1 sp2) \<Rightarrow> v_check_exec vs \<phi> vp1 \<and> s_check_exec vs \<psi> sp2 \<and> v_at vp1 = s_at sp2
+  | (\<exists>\<^sub>Fx.  \<phi>, VExists y vp_part) \<Rightarrow> (let i = v_at (part_hd vp_part)
+      in x = y \<and> (\<forall>(sub, vp) \<in> SubsVals vp_part. v_at vp = i \<and> v_check_exec (vs (x := sub)) \<phi> vp))
+  | (\<forall>\<^sub>Fx.  \<phi>, VForall y val vp) \<Rightarrow> (x = y \<and> v_check_exec (vs (x := {val})) \<phi> vp)
+  | (\<^bold>Y I \<phi>, VPrev vp) \<Rightarrow>
+    (let j = v_at vp; i = v_at (VPrev vp) in
+    i = j+1 \<and> v_check_exec vs \<phi> vp)
+  | (\<^bold>Y I \<phi>, VPrevZ) \<Rightarrow> True
+  | (\<^bold>Y I \<phi>, VPrevOutL i) \<Rightarrow>
+    i > 0 \<and> \<Delta> \<sigma> i < left I
+  | (\<^bold>Y I \<phi>, VPrevOutR i) \<Rightarrow>
+    i > 0 \<and> enat (\<Delta> \<sigma> i) > right I
+  | (\<^bold>X I \<phi>, VNext vp) \<Rightarrow>
+    (let j = v_at vp; i = v_at (VNext vp) in
+    j = i+1 \<and> v_check_exec vs \<phi> vp)
+  | (\<^bold>X I \<phi>, VNextOutL i) \<Rightarrow>
+    \<Delta> \<sigma> (i+1) < left I
+  | (\<^bold>X I \<phi>, VNextOutR i) \<Rightarrow>
+    enat (\<Delta> \<sigma> (i+1)) > right I
+  | (\<^bold>P I \<phi>, VOnceOut i) \<Rightarrow>
+    \<tau> \<sigma> i < \<tau> \<sigma> 0 + left I
+  | (\<^bold>P I \<phi>, VOnce i li vps) \<Rightarrow>
+    (li = (case right I of \<infinity> \<Rightarrow> 0 | enat b \<Rightarrow> ETP_p \<sigma> i b)
+    \<and> \<tau> \<sigma> 0 + left I \<le> \<tau> \<sigma> i
+    \<and> map v_at vps = [li ..< (LTP_p \<sigma> i I) + 1]
+    \<and> (\<forall>vp \<in> set vps. v_check_exec vs \<phi> vp))
+  | (\<^bold>F I \<phi>, VEventually i hi vps) \<Rightarrow>
+    (hi = (case right I of enat b \<Rightarrow> LTP_f \<sigma> i b) \<and> right I \<noteq> \<infinity>
+    \<and> map v_at vps = [(ETP_f \<sigma> i I) ..< hi + 1]
+    \<and> (\<forall>vp \<in> set vps. v_check_exec vs \<phi> vp))
+  | (\<^bold>H I \<phi>, VHistorically i vp) \<Rightarrow>
+    (let j = v_at vp in
+    j \<le> i \<and> mem (\<tau> \<sigma> i - \<tau> \<sigma> j) I \<and> v_check_exec vs \<phi> vp)
+  | (\<^bold>G I \<phi>, VAlways i vp) \<Rightarrow>
+    (let j = v_at vp
+    in j \<ge> i \<and> mem (\<tau> \<sigma> j - \<tau> \<sigma> i) I \<and> v_check_exec vs \<phi> vp)
+  | (\<phi> \<^bold>S I \<psi>, VSinceOut i) \<Rightarrow>
+    \<tau> \<sigma> i < \<tau> \<sigma> 0 + left I
+  | (\<phi> \<^bold>S I \<psi>, VSince i vp1 vp2s) \<Rightarrow>
+    (let j = v_at vp1 in
+    (case right I of \<infinity> \<Rightarrow> True | enat b \<Rightarrow> ETP_p \<sigma> i b \<le> j) \<and> j \<le> i
+    \<and> \<tau> \<sigma> 0 + left I \<le> \<tau> \<sigma> i
+    \<and> map v_at vp2s = [j ..< (LTP_p \<sigma> i I) + 1] \<and> v_check_exec vs \<phi> vp1
+    \<and> (\<forall>vp2 \<in> set vp2s. v_check_exec vs \<psi> vp2))
+  | (\<phi> \<^bold>S I \<psi>, VSinceInf i li vp2s) \<Rightarrow>
+    (li = (case right I of \<infinity> \<Rightarrow> 0 | enat b \<Rightarrow> ETP_p \<sigma> i b)
+    \<and> \<tau> \<sigma> 0 + left I \<le> \<tau> \<sigma> i
+    \<and> map v_at vp2s = [li ..< (LTP_p \<sigma> i I) + 1]
+    \<and> (\<forall>vp2 \<in> set vp2s. v_check_exec vs \<psi> vp2))
+  | (\<phi> \<^bold>U I \<psi>, VUntil i vp2s vp1) \<Rightarrow>
+    (let j = v_at vp1 in
+    (case right I of \<infinity> \<Rightarrow> True | enat b \<Rightarrow> j < LTP_f \<sigma> i b) \<and> i \<le> j
+    \<and> map v_at vp2s = [ETP_f \<sigma> i I ..< j + 1] \<and> v_check_exec vs \<phi> vp1
+    \<and> (\<forall>vp2 \<in> set vp2s. v_check_exec vs \<psi> vp2))
+  | (\<phi> \<^bold>U I \<psi>, VUntilInf i hi vp2s) \<Rightarrow>
+    (hi = (case right I of enat b \<Rightarrow> LTP_f \<sigma> i b) \<and> right I \<noteq> \<infinity>
+    \<and> map v_at vp2s = [ETP_f \<sigma> i I ..< hi + 1]
+    \<and> (\<forall>vp2 \<in> set vp2s. v_check_exec vs \<psi> vp2))
+  | ( _ , _) \<Rightarrow> False)"
+
+declare s_check_exec.simps[simp del] v_check_exec.simps[simp del]
+simps_of_case s_check_exec_simps[simp, code]: s_check_exec.simps[unfolded prod.case] (splits: formula.split sproof.split)
+simps_of_case v_check_exec_simps[simp, code]: v_check_exec.simps[unfolded prod.case] (splits: formula.split vproof.split)
+
+
+lemma check_fv_cong:
+  assumes "\<forall>x \<in> fv \<phi>. v x = v' x"
+  shows "s_check v \<phi> sp \<longleftrightarrow> s_check v' \<phi> sp" "v_check v \<phi> vp \<longleftrightarrow> v_check v' \<phi> vp"
+  using assms
+proof (induct \<phi> arbitrary: v v' sp vp)
+  case TT
+  {
+    case 1
+    then show ?case
+      by (cases sp) auto
+  next
+    case 2
+    then show ?case
+      by (cases vp) auto
+  }
+next
+  case FF
+  {
+    case 1
+    then show ?case
+      by (cases sp) auto
+  next
+    case 2
+    then show ?case
+      by (cases vp) auto
+  }
+next
+  case (Pred p ts)
+  {
+    case 1
+    with Pred show ?case using eval_trms_fv_cong[of ts v v']
+      by (cases sp) auto
+  next
+    case 2
+    with Pred show ?case using eval_trms_fv_cong[of ts v v']
+      by (cases vp) auto
+  }
+  case (Eq_Const x c)
+  {
+    case 1
+    then show ?case
+      by (cases sp) auto
+  next
+    case 2
+    then show ?case
+      by (cases vp) auto
+  }
+next
+  case (Neg \<phi>)
+  {
+    case 1
+    with Neg[of v v'] show ?case
+      by (cases sp) auto
+  next
+    case 2
+    with Neg[of v v'] show ?case
+      by (cases vp) auto
+  }
+next
+  case (Or \<phi>1 \<phi>2)
+  {
+    case 1
+    with Or[of v v'] show ?case
+      by (cases sp) auto
+  next
+    case 2
+    with Or[of v v'] show ?case
+      by (cases vp) auto
+  }
+next
+  case (And \<phi>1 \<phi>2)
+  {
+    case 1
+    with And[of v v'] show ?case
+      by (cases sp) auto
+  next
+    case 2
+    with And[of v v'] show ?case
+      by (cases vp) auto
+  }
+next
+  case (Imp \<phi>1 \<phi>2)
+  {
+    case 1
+    with Imp[of v v'] show ?case
+      by (cases sp) auto
+  next
+    case 2
+    with Imp[of v v'] show ?case
+      by (cases vp) auto
+  }
+next
+  case (Iff \<phi>1 \<phi>2)
+  {
+    case 1
+    with Iff[of v v'] show ?case
+      by (cases sp) auto
+  next
+    case 2
+    with Iff[of v v'] show ?case
+      by (cases vp) auto
+  }
+next
+  case (Exists x \<phi>)
+  {
+    case 1
+    with Exists[of "v(x := z)" "v'(x := z)" for z] show ?case
+      by (cases sp) (auto simp: fun_upd_def)
+  next
+    case 2
+    with Exists[of "v(x := z)" "v'(x := z)" for z] show ?case
+      by (cases vp) (auto simp: fun_upd_def)
+  }
+next
+  case (Forall x \<phi>)
+  {
+    case 1
+    with Forall[of "v(x := z)" "v'(x := z)" for z] show ?case
+      by (cases sp) (auto simp: fun_upd_def)
+  next
+    case 2
+    with Forall[of "v(x := z)" "v'(x := z)" for z] show ?case
+      by (cases vp) (auto simp: fun_upd_def)
+  }
+next
+  case (Prev I \<phi>)
+  {
+    case 1
+    with Prev[of v v'] show ?case
+      by (cases sp) auto
+  next
+    case 2
+    with Prev[of v v'] show ?case
+      by (cases vp) auto
+  }
+next
+  case (Next I \<phi>)
+  {
+    case 1
+    with Next[of v v'] show ?case
+      by (cases sp) auto
+  next
+    case 2
+    with Next[of v v'] show ?case
+      by (cases vp) auto
+  }
+next
+  case (Once I \<phi>)
+  {
+    case 1
+    with Once[of v v'] show ?case
+      by (cases sp) auto
+  next
+    case 2
+    with Once[of v v'] show ?case
+      by (cases vp) auto
+  }
+next
+  case (Historically I \<phi>)
+  {
+    case 1
+    with Historically[of v v'] show ?case
+      by (cases sp) auto
+  next
+    case 2
+    with Historically[of v v'] show ?case
+      by (cases vp) auto
+  }
+next
+  case (Eventually I \<phi>)
+  {
+    case 1
+    with Eventually[of v v'] show ?case
+      by (cases sp) auto
+  next
+    case 2
+    with Eventually[of v v'] show ?case
+      by (cases vp) auto
+  }
+next
+  case (Always I \<phi>)
+  {
+    case 1
+    with Always[of v v'] show ?case
+      by (cases sp) auto
+  next
+    case 2
+    with Always[of v v'] show ?case
+      by (cases vp) auto
+  }
+next
+  case (Since \<phi>1 I \<phi>2)
+  {
+    case 1
+    with Since[of v v'] show ?case
+      by (cases sp) auto
+  next
+    case 2
+    with Since[of v v'] show ?case
+      by (cases vp) auto
+  }
+next
+  case (Until \<phi>1 I \<phi>2)
+  {
+    case 1
+    with Until[of v v'] show ?case
+      by (cases sp) auto
+  next
+    case 2
+    with Until[of v v'] show ?case
+      by (cases vp) auto
+  }
+qed
+
+lemma s_check_fun_upd_notin[simp]:
+  "x \<notin> fv \<phi> \<Longrightarrow> s_check (v(x := t)) \<phi> sp = s_check v \<phi> sp"
+  by (rule check_fv_cong) auto
+lemma v_check_fun_upd_notin[simp]:
+  "x \<notin> fv \<phi> \<Longrightarrow> v_check (v(x := t)) \<phi> sp = v_check v \<phi> sp"
+  by (rule check_fv_cong) auto
+
+lemma SubsVals_nonempty: "(X, t) \<in> SubsVals part \<Longrightarrow> X \<noteq> {}"
+  by transfer (auto simp: partition_on_def image_iff)
+
+lemma compatible_vals_nonemptyI: "\<forall>x. vs x \<noteq> {} \<Longrightarrow> compatible_vals A vs \<noteq> {}"
+  by (auto simp: compatible_vals_def intro!: bchoice)
+
+lemma compatible_vals_fun_upd: "compatible_vals A (vs(x := X)) =
+  (if x \<in> A then {v \<in> compatible_vals (A - {x}) vs. v x \<in> X} else compatible_vals A vs)"
+  unfolding compatible_vals_def
+  by auto
+
+lemma fun_upd_in_compatible_vals: "v \<in> compatible_vals (A - {x}) vs \<Longrightarrow> v(x := t) \<in> compatible_vals (A - {x}) vs"
+  unfolding compatible_vals_def
+  by auto
+
+lemma fun_upd_in_compatible_vals_in: "v \<in> compatible_vals (A - {x}) vs \<Longrightarrow> t \<in> vs x \<Longrightarrow> v(x := t) \<in> compatible_vals A vs"
+  unfolding compatible_vals_def
+  by auto
+
+lemma fun_upd_in_compatible_vals_notin: "x \<notin> A \<Longrightarrow> v \<in> compatible_vals A vs \<Longrightarrow> v(x := t) \<in> compatible_vals A vs"
+  unfolding compatible_vals_def
+  by auto
+
+lemma check_exec_check:
+  assumes "\<forall>x. vs x \<noteq> {}"
+  shows "s_check_exec vs \<phi> sp \<longleftrightarrow> (\<forall>v \<in> compatible_vals (fv \<phi>) vs. s_check v \<phi> sp)"
+    and "v_check_exec vs \<phi> vp \<longleftrightarrow> (\<forall>v \<in> compatible_vals (fv \<phi>) vs. v_check v \<phi> vp)"
+  using assms
+proof (induct \<phi> arbitrary: vs sp vp)
+  case TT
+  {
+    case 1
+    then show ?case using compatible_vals_nonemptyI
+      by (cases sp)
+        auto
+  next
+    case 2
+    then show ?case using compatible_vals_nonemptyI
+      by auto
+  }
+next
+  case FF
+  {
+    case 1
+    then show ?case using compatible_vals_nonemptyI
+      by (cases sp)
+        auto
+  next
+    case 2
+    then show ?case using compatible_vals_nonemptyI
+      by (cases vp)
+        auto
+  }
+next
+  case (Pred p ts)
+  {
+    case 1
+    have obs: "\<forall>tX\<in>set (vs\<^bold>\<lbrace>ts\<^bold>\<rbrace>). snd tX \<noteq> {}"
+      using \<open>\<forall>x. vs x \<noteq> {}\<close>
+    proof (induct ts)
+      case (Cons a ts)
+      then show ?case
+        by (cases a) (auto simp: eval_trms_set_def)
+    qed (auto simp: eval_trms_set_def)
+    show ?case
+      using 1 compatible_vals_nonemptyI[OF 1]
+        mk_values_complete[OF refl, of _ p ts vs] mk_values_sound[of _ vs ts p]
+      by (cases sp)
+        (auto 6 0 simp: mk_values_subset_iff[OF obs] simp del: fv.simps)
+  next
+    case 2
+    then show ?case using compatible_vals_nonemptyI[OF 2]
+        mk_values_complete[OF refl, of _ p ts vs] mk_values_sound[of _ vs ts p]
+      by (cases vp)
+        (auto 6 0 simp: mk_values_subset_Compl_def eval_trms_set_def simp del: fv.simps)
+  }
+next
+  case (Eq_Const x c)
+  {
+    case 1
+    then show ?case
+      by (cases sp) (auto simp: compatible_vals_def)
+  next
+    case 2
+    then show ?case
+      by (cases vp) (auto simp: compatible_vals_def)
+  }
+next
+  case (Neg \<phi>)
+  {
+    case 1
+    then show ?case
+      using Neg.hyps(2) compatible_vals_nonemptyI[OF 1]
+      by (cases sp) auto
+  next
+    case 2
+    then show ?case
+      using Neg.hyps(1) compatible_vals_nonemptyI[OF 2]
+      by (cases vp) auto
+  }
+next
+  case (Or \<phi>1 \<phi>2)
+  {
+    case 1
+    with compatible_vals_nonemptyI[OF 1, of "fv \<phi>1 \<union> fv \<phi>2"] show ?case
+    proof (cases sp)
+      case (SOrL sp')
+      from check_fv_cong(1)[of \<phi>1 _ _ sp'] show ?thesis
+        unfolding SOrL s_check_exec_simps s_check_simps fv.simps Or(1)[OF 1, of sp']
+        by (metis (mono_tags, lifting) 1 IntE Un_upper1 compatible_vals_extensible compatible_vals_union_eq)
+    next
+      case (SOrR sp')
+      from check_fv_cong(1)[of \<phi>2 _ _ sp'] show ?thesis
+        unfolding SOrR s_check_exec_simps s_check_simps fv.simps Or(3)[OF 1, of sp']
+        by (metis (mono_tags, lifting) 1 IntE Un_upper2 compatible_vals_extensible compatible_vals_union_eq)
+    qed (auto simp: compatible_vals_union_eq)
+  next
+    case 2
+    with compatible_vals_nonemptyI[OF 2, of "fv \<phi>1 \<union> fv \<phi>2"] show ?case
+    proof (cases vp)
+      case (VOr vp1 vp2)
+      from check_fv_cong(2)[of \<phi>1 _ _ vp1] check_fv_cong(2)[of \<phi>2 _ _ vp2] show ?thesis
+        unfolding VOr v_check_exec_simps v_check_simps fv.simps ball_conj_distrib
+          Or(2)[OF 2, of vp1]  Or(4)[OF 2, of vp2]
+          ball_triv_nonempty[OF compatible_vals_nonemptyI[OF 2, of "fv \<phi>1 \<union> fv \<phi>2"]]
+      proof (intro arg_cong2[of _ _ _ _ "(\<and>)"] refl, goal_cases \<phi>1 \<phi>2)
+        case \<phi>1
+        then show ?case
+          by (metis (mono_tags, lifting) 2 IntE Un_upper1 compatible_vals_extensible compatible_vals_union_eq)
+      next
+        case \<phi>2
+        then show ?case
+          by (metis (mono_tags, lifting) 2 IntE Un_upper2 compatible_vals_extensible compatible_vals_union_eq)
+      qed
+    qed (auto simp: compatible_vals_union_eq)
+  }
+next
+  case (And \<phi>1 \<phi>2)
+  {
+    case 1
+    with compatible_vals_nonemptyI[OF 1, of "fv \<phi>1 \<union> fv \<phi>2"] show ?case
+    proof (cases sp)
+      case (SAnd sp1 sp2)
+      from check_fv_cong(1)[of \<phi>1 _ _ sp1] check_fv_cong(1)[of \<phi>2 _ _ sp2] show ?thesis
+        unfolding SAnd s_check_exec_simps s_check_simps fv.simps ball_conj_distrib
+          And(1)[OF 1, of sp1] And(3)[OF 1, of sp2]
+          ball_triv_nonempty[OF compatible_vals_nonemptyI[OF 1, of "fv \<phi>1 \<union> fv \<phi>2"]]
+      proof (intro arg_cong2[of _ _ _ _ "(\<and>)"] refl, goal_cases \<phi>1 \<phi>2)
+        case \<phi>1
+        then show ?case
+          by (metis (mono_tags, lifting) 1 IntE Un_upper1 compatible_vals_extensible compatible_vals_union_eq)
+      next
+        case \<phi>2
+        then show ?case
+          by (metis (mono_tags, lifting) 1 IntE Un_upper2 compatible_vals_extensible compatible_vals_union_eq)
+      qed
+    qed (auto simp: compatible_vals_union_eq)
+  next
+    case 2
+    with compatible_vals_nonemptyI[OF 2, of "fv \<phi>1 \<union> fv \<phi>2"] show ?case
+    proof (cases vp)
+      case (VAndL vp')
+      from check_fv_cong(2)[of \<phi>1 _ _ vp'] show ?thesis
+        unfolding VAndL v_check_exec_simps v_check_simps fv.simps And(2)[OF 2, of vp']
+        by (metis (mono_tags, lifting) 2 IntE Un_upper1 compatible_vals_extensible compatible_vals_union_eq)
+    next
+      case (VAndR vp')
+      from check_fv_cong(2)[of \<phi>2 _ _ vp'] show ?thesis
+        unfolding VAndR v_check_exec_simps v_check_simps fv.simps And(4)[OF 2, of vp']
+        by (metis (mono_tags, lifting) 2 IntE Un_upper2 compatible_vals_extensible compatible_vals_union_eq)
+    qed (auto simp: compatible_vals_union_eq)
+  }
+next
+  case (Imp \<phi>1 \<phi>2)
+  {
+    case 1
+    with compatible_vals_nonemptyI[OF 1, of "fv \<phi>1 \<union> fv \<phi>2"] show ?case
+    proof (cases sp)
+      case (SImpL vp')
+      from check_fv_cong(2)[of \<phi>1 _ _ vp'] show ?thesis
+        unfolding SImpL s_check_exec_simps s_check_simps fv.simps Imp(2)[OF 1, of vp']
+        by (metis (mono_tags, lifting) 1 IntE Un_upper1 compatible_vals_extensible compatible_vals_union_eq)
+    next
+      case (SImpR sp')
+      from check_fv_cong(1)[of \<phi>2 _ _ sp'] show ?thesis
+        unfolding SImpR s_check_exec_simps s_check_simps fv.simps Imp(3)[OF 1, of sp']
+        by (metis (mono_tags, lifting) 1 IntE Un_upper2 compatible_vals_extensible compatible_vals_union_eq)
+    qed (auto simp: compatible_vals_union_eq)
+  next
+    case 2
+    with compatible_vals_nonemptyI[OF 2, of "fv \<phi>1 \<union> fv \<phi>2"] show ?case
+    proof (cases vp)
+      case (VImp sp1 vp2)
+      from check_fv_cong(1)[of \<phi>1 _ _ sp1] check_fv_cong(2)[of \<phi>2 _ _ vp2] show ?thesis
+        unfolding VImp v_check_exec_simps v_check_simps fv.simps ball_conj_distrib
+          Imp(1)[OF 2, of sp1] Imp(4)[OF 2, of vp2]
+          ball_triv_nonempty[OF compatible_vals_nonemptyI[OF 2, of "fv \<phi>1 \<union> fv \<phi>2"]]
+      proof (intro arg_cong2[of _ _ _ _ "(\<and>)"] refl, goal_cases \<phi>1 \<phi>2)
+        case \<phi>1
+        then show ?case
+          by (metis (mono_tags, lifting) 2 IntE Un_upper1 compatible_vals_extensible compatible_vals_union_eq)
+      next
+        case \<phi>2
+        then show ?case
+          by (metis (mono_tags, lifting) 2 IntE Un_upper2 compatible_vals_extensible compatible_vals_union_eq)
+      qed
+    qed (auto simp: compatible_vals_union_eq)
+  }
+next
+  case (Iff \<phi>1 \<phi>2)
+  {
+    case 1
+    with compatible_vals_nonemptyI[OF 1, of "fv \<phi>1 \<union> fv \<phi>2"] show ?case
+    proof (cases sp)
+      case (SIffSS sp1 sp2)
+      from check_fv_cong(1)[of \<phi>1 _ _ sp1] check_fv_cong(1)[of \<phi>2 _ _ sp2] show ?thesis
+        unfolding SIffSS s_check_exec_simps s_check_simps fv.simps ball_conj_distrib
+          Iff(1)[OF 1, of sp1] Iff(3)[OF 1, of sp2]
+          ball_triv_nonempty[OF compatible_vals_nonemptyI[OF 1, of "fv \<phi>1 \<union> fv \<phi>2"]]
+      proof (intro arg_cong2[of _ _ _ _ "(\<and>)"] refl, goal_cases \<phi>1 \<phi>2)
+        case \<phi>1
+        then show ?case
+          by (metis (mono_tags, lifting) 1 IntE Un_upper1 compatible_vals_extensible compatible_vals_union_eq)
+      next
+        case \<phi>2
+        then show ?case
+          by (metis (mono_tags, lifting) 1 IntE Un_upper2 compatible_vals_extensible compatible_vals_union_eq)
+      qed
+    next
+      case (SIffVV vp1 vp2)
+      from check_fv_cong(2)[of \<phi>1 _ _ vp1] check_fv_cong(2)[of \<phi>2 _ _ vp2] show ?thesis
+        unfolding SIffVV s_check_exec_simps s_check_simps fv.simps ball_conj_distrib
+          Iff(2)[OF 1, of vp1] Iff(4)[OF 1, of vp2]
+          ball_triv_nonempty[OF compatible_vals_nonemptyI[OF 1, of "fv \<phi>1 \<union> fv \<phi>2"]]
+      proof (intro arg_cong2[of _ _ _ _ "(\<and>)"] refl, goal_cases \<phi>1 \<phi>2)
+        case \<phi>1
+        then show ?case
+          by (metis (mono_tags, lifting) 1 IntE Un_upper1 compatible_vals_extensible compatible_vals_union_eq)
+      next
+        case \<phi>2
+        then show ?case
+          by (metis (mono_tags, lifting) 1 IntE Un_upper2 compatible_vals_extensible compatible_vals_union_eq)
+      qed
+    qed (auto simp: compatible_vals_union_eq)
+  next
+    case 2
+    with compatible_vals_nonemptyI[OF 2, of "fv \<phi>1 \<union> fv \<phi>2"] show ?case
+    proof (cases vp)
+      case (VIffSV sp1 vp2)
+      from check_fv_cong(1)[of \<phi>1 _ _ sp1] check_fv_cong(2)[of \<phi>2 _ _ vp2] show ?thesis
+        unfolding VIffSV v_check_exec_simps v_check_simps fv.simps ball_conj_distrib
+          Iff(1)[OF 2, of sp1] Iff(4)[OF 2, of vp2]
+          ball_triv_nonempty[OF compatible_vals_nonemptyI[OF 2, of "fv \<phi>1 \<union> fv \<phi>2"]]
+      proof (intro arg_cong2[of _ _ _ _ "(\<and>)"] refl, goal_cases \<phi>1 \<phi>2)
+        case \<phi>1
+        then show ?case
+          by (metis (mono_tags, lifting) 2 IntE Un_upper1 compatible_vals_extensible compatible_vals_union_eq)
+      next
+        case \<phi>2
+        then show ?case
+          by (metis (mono_tags, lifting) 2 IntE Un_upper2 compatible_vals_extensible compatible_vals_union_eq)
+      qed
+    next
+      case (VIffVS vp1 sp2)
+      from check_fv_cong(2)[of \<phi>1 _ _ vp1] check_fv_cong(1)[of \<phi>2 _ _ sp2] show ?thesis
+        unfolding VIffVS v_check_exec_simps v_check_simps fv.simps ball_conj_distrib
+          Iff(2)[OF 2, of vp1] Iff(3)[OF 2, of sp2]
+          ball_triv_nonempty[OF compatible_vals_nonemptyI[OF 2, of "fv \<phi>1 \<union> fv \<phi>2"]]
+      proof (intro arg_cong2[of _ _ _ _ "(\<and>)"] refl, goal_cases \<phi>1 \<phi>2)
+        case \<phi>1
+        then show ?case
+          by (metis (mono_tags, lifting) 2 IntE Un_upper1 compatible_vals_extensible compatible_vals_union_eq)
+      next
+        case \<phi>2
+        then show ?case
+          by (metis (mono_tags, lifting) 2 IntE Un_upper2 compatible_vals_extensible compatible_vals_union_eq)
+      qed
+    qed (auto simp: compatible_vals_union_eq)
+  }
+next
+  case (Exists x \<phi>)
+  {
+    case 1
+    then have "(vs(x := Z)) y \<noteq> {}" if "Z \<noteq> {}" for Z y
+      using that by auto
+    with 1 have IH:
+      "s_check_exec (vs(x := {z})) \<phi> sp = (\<forall>v\<in>compatible_vals (fv \<phi>) (vs(x := {z})). s_check v \<phi> sp)"
+      for z sp
+      by (intro Exists;
+          auto simp: compatible_vals_fun_upd fun_upd_same
+          simp del: fun_upd_apply intro: fun_upd_in_compatible_vals)
+    from 1 show ?case
+      using compatible_vals_nonemptyI[OF 1, of "fv \<phi> - {x}"]
+      by (cases sp) (auto simp: SubsVals_nonempty IH fun_upd_in_compatible_vals_notin compatible_vals_fun_upd)
+  next
+    case 2
+    then have "(vs(x := Z)) y \<noteq> {}" if "Z \<noteq> {}" for Z y
+      using that by auto
+    with 2 have IH:
+      "Z \<noteq> {} \<Longrightarrow> v_check_exec (vs(x := Z)) \<phi> vp = (\<forall>v\<in>compatible_vals (fv \<phi>) (vs(x := Z)). v_check v \<phi> vp)"
+      for Z vp
+      by (intro Exists;
+          auto simp: compatible_vals_fun_upd fun_upd_same
+          simp del: fun_upd_apply intro: fun_upd_in_compatible_vals)
+    show ?case
+      using compatible_vals_nonemptyI[OF 2, of "fv \<phi> - {x}"]
+      by (cases vp)
+        (auto simp: SubsVals_nonempty IH[OF SubsVals_nonempty]
+          fun_upd_in_compatible_vals fun_upd_in_compatible_vals_notin compatible_vals_fun_upd
+          ball_conj_distrib 2[simplified] split: prod.splits if_splits |
+          drule bspec, assumption)+
+  }
+next
+  case (Forall x \<phi>)
+  {
+    case 1
+    then have "(vs(x := Z)) y \<noteq> {}" if "Z \<noteq> {}" for Z y
+      using that by auto
+    with 1 have IH:
+      "Z \<noteq> {} \<Longrightarrow> s_check_exec (vs(x := Z)) \<phi> sp = (\<forall>v\<in>compatible_vals (fv \<phi>) (vs(x := Z)). s_check v \<phi> sp)"
+      for Z sp
+      by (intro Forall;
+          auto simp: compatible_vals_fun_upd fun_upd_same
+          simp del: fun_upd_apply intro: fun_upd_in_compatible_vals)
+    show ?case
+      using compatible_vals_nonemptyI[OF 1, of "fv \<phi> - {x}"]
+      by (cases sp)
+        (auto simp: SubsVals_nonempty IH[OF SubsVals_nonempty]
+          fun_upd_in_compatible_vals fun_upd_in_compatible_vals_notin compatible_vals_fun_upd
+          ball_conj_distrib 1[simplified] split: prod.splits if_splits |
+          drule bspec, assumption)+
+  next
+    case 2
+    then have "(vs(x := Z)) y \<noteq> {}" if "Z \<noteq> {}" for Z y
+      using that by auto
+    with 2 have IH:
+      "v_check_exec (vs(x := {z})) \<phi> vp = (\<forall>v\<in>compatible_vals (fv \<phi>) (vs(x := {z})). v_check v \<phi> vp)"
+      for z vp
+      by (intro Forall;
+          auto simp: compatible_vals_fun_upd fun_upd_same
+          simp del: fun_upd_apply intro: fun_upd_in_compatible_vals)
+    from 2 show ?case
+      using compatible_vals_nonemptyI[OF 2, of "fv \<phi> - {x}"]
+      by (cases vp) (auto simp: SubsVals_nonempty IH fun_upd_in_compatible_vals_notin compatible_vals_fun_upd)
+  }
+next
+  case (Prev I \<phi>)
+  {
+    case 1
+    with Prev[of vs] show ?case
+      using compatible_vals_nonemptyI[OF 1, of "fv \<phi>"]
+      by (cases sp) auto
+  next
+    case 2
+    with Prev[of vs] show ?case
+      using compatible_vals_nonemptyI[OF 2, of "fv \<phi>"]
+      by (cases vp) auto
+  }
+next
+  case (Next I \<phi>)
+  {
+    case 1
+    with Next[of vs] show ?case
+      using compatible_vals_nonemptyI[OF 1, of "fv \<phi>"]
+      by (cases sp) (auto simp: Let_def)
+  next
+    case 2
+    with Next[of vs] show ?case
+      using compatible_vals_nonemptyI[OF 2, of "fv \<phi>"]
+      by (cases vp) auto
+  }
+next
+  case (Once I \<phi>)
+  {
+    case 1
+    with Once[of vs] show ?case
+      using compatible_vals_nonemptyI[OF 1, of "fv \<phi>"]
+      by (cases sp) (auto simp: Let_def)
+  next
+    case 2
+    with Once[of vs] show ?case
+      using compatible_vals_nonemptyI[OF 2, of "fv \<phi>"]
+      by (cases vp) auto
+  }
+next
+  case (Historically I \<phi>)
+  {
+    case 1
+    with Historically[of vs] show ?case
+      using compatible_vals_nonemptyI[OF 1, of "fv \<phi>"]
+      by (cases sp) auto
+  next
+    case 2
+    with Historically[of vs] show ?case
+      using compatible_vals_nonemptyI[OF 2, of "fv \<phi>"]
+      by (cases vp) (auto simp: Let_def)
+  }
+next
+  case (Eventually I \<phi>)
+  {
+    case 1
+    with Eventually[of vs] show ?case
+      using compatible_vals_nonemptyI[OF 1, of "fv \<phi>"]
+      by (cases sp) (auto simp: Let_def)
+  next
+    case 2
+    with Eventually[of vs] show ?case
+      using compatible_vals_nonemptyI[OF 2, of "fv \<phi>"]
+      by (cases vp) auto
+  }
+next
+  case (Always I \<phi>)
+  {
+    case 1
+    with Always[of vs] show ?case
+      using compatible_vals_nonemptyI[OF 1, of "fv \<phi>"]
+      by (cases sp) auto
+  next
+    case 2
+    with Always[of vs] show ?case
+      using compatible_vals_nonemptyI[OF 2, of "fv \<phi>"]
+      by (cases vp) (auto simp: Let_def)
+  }
+next
+  case (Since \<phi>1 I \<phi>2)
+  {
+    case 1
+    with compatible_vals_nonemptyI[OF 1, of "fv \<phi>1 \<union> fv \<phi>2"] show ?case
+    proof (cases sp)
+      case (SSince sp' sps)
+      from check_fv_cong(1)[of \<phi>2 _ _ sp'] show ?thesis
+        unfolding SSince s_check_exec_simps s_check_simps fv.simps ball_conj_distrib ball_swap[of _ "set sps"]
+          Since(1)[OF 1] Since(3)[OF 1, of sp'] Let_def
+          ball_triv_nonempty[OF compatible_vals_nonemptyI[OF 1, of "fv \<phi>1 \<union> fv \<phi>2"]]
+      proof (intro arg_cong2[of _ _ _ _ "(\<and>)"] ball_cong[of "set sps", OF refl] refl, goal_cases \<phi>2 \<phi>1)
+        case \<phi>2
+        then show ?case
+          by (metis (mono_tags, lifting) 1 IntE Un_upper2 compatible_vals_extensible compatible_vals_union_eq)
+      next
+        case (\<phi>1 sp)
+        then show ?case using check_fv_cong(1)[of \<phi>1 _ _ sp]
+          by (metis (mono_tags, lifting) 1 IntE Un_upper1 compatible_vals_extensible compatible_vals_union_eq)
+      qed
+    qed (auto simp: compatible_vals_union_eq)
+  next
+    case 2
+    with compatible_vals_nonemptyI[OF 2, of "fv \<phi>1 \<union> fv \<phi>2"] show ?case
+    proof (cases vp)
+      case (VSince i vp' vps)
+      from check_fv_cong(2)[of \<phi>1 _ _ vp'] show ?thesis
+        unfolding VSince v_check_exec_simps v_check_simps fv.simps ball_conj_distrib ball_swap[of _ "set vps"]
+          Since(2)[OF 2, of vp'] Since(4)[OF 2] Let_def
+          ball_triv_nonempty[OF compatible_vals_nonemptyI[OF 2, of "fv \<phi>1 \<union> fv \<phi>2"]]
+      proof (intro arg_cong2[of _ _ _ _ "(\<and>)"] ball_cong[of "set vps", OF refl] refl, goal_cases \<phi>1 \<phi>2)
+        case \<phi>1
+        then show ?case
+          by (metis (mono_tags, lifting) 2 IntE Un_upper2 compatible_vals_extensible compatible_vals_union_eq)
+      next
+        case (\<phi>2 vp)
+        then show ?case using check_fv_cong(2)[of \<phi>2 _ _ vp]
+          by (metis (mono_tags, lifting) 2 IntE Un_upper1 compatible_vals_extensible compatible_vals_union_eq)
+      qed
+    next
+      case (VSinceInf i j vps)
+      show ?thesis
+        unfolding VSinceInf v_check_exec_simps v_check_simps fv.simps ball_conj_distrib ball_swap[of _ "set vps"]
+          Since(4)[OF 2] Let_def
+          ball_triv_nonempty[OF compatible_vals_nonemptyI[OF 2, of "fv \<phi>1 \<union> fv \<phi>2"]]
+      proof (intro arg_cong2[of _ _ _ _ "(\<and>)"] ball_cong[of "set vps", OF refl] refl, goal_cases \<phi>2)
+        case (\<phi>2 vp)
+        then show ?case using check_fv_cong(2)[of \<phi>2 _ _ vp]
+          by (metis (mono_tags, lifting) 2 IntE Un_upper1 compatible_vals_extensible compatible_vals_union_eq)
+      qed
+    qed (auto simp: compatible_vals_union_eq)
+  }
+next
+  case (Until \<phi>1 I \<phi>2)
+  {
+    case 1
+    with compatible_vals_nonemptyI[OF 1, of "fv \<phi>1 \<union> fv \<phi>2"] show ?case
+    proof (cases sp)
+      case (SUntil sps sp')
+      from check_fv_cong(1)[of \<phi>2 _ _ sp'] show ?thesis
+        unfolding SUntil s_check_exec_simps s_check_simps fv.simps ball_conj_distrib ball_swap[of _ "set sps"]
+          Until(1)[OF 1] Until(3)[OF 1, of sp'] Let_def
+          ball_triv_nonempty[OF compatible_vals_nonemptyI[OF 1, of "fv \<phi>1 \<union> fv \<phi>2"]]
+      proof (intro arg_cong2[of _ _ _ _ "(\<and>)"] ball_cong[of "set sps", OF refl] refl, goal_cases \<phi>2 \<phi>1)
+        case \<phi>2
+        then show ?case
+          by (metis (mono_tags, lifting) 1 IntE Un_upper2 compatible_vals_extensible compatible_vals_union_eq)
+      next
+        case (\<phi>1 sp)
+        then show ?case using check_fv_cong(1)[of \<phi>1 _ _ sp]
+          by (metis (mono_tags, lifting) 1 IntE Un_upper1 compatible_vals_extensible compatible_vals_union_eq)
+      qed
+    qed (auto simp: compatible_vals_union_eq)
+  next
+    case 2
+    with compatible_vals_nonemptyI[OF 2, of "fv \<phi>1 \<union> fv \<phi>2"] show ?case
+    proof (cases vp)
+      case (VUntil i vps vp')
+      from check_fv_cong(2)[of \<phi>1 _ _ vp'] show ?thesis
+        unfolding VUntil v_check_exec_simps v_check_simps fv.simps ball_conj_distrib ball_swap[of _ "set vps"]
+          Until(2)[OF 2, of vp'] Until(4)[OF 2] Let_def
+          ball_triv_nonempty[OF compatible_vals_nonemptyI[OF 2, of "fv \<phi>1 \<union> fv \<phi>2"]]
+      proof (intro arg_cong2[of _ _ _ _ "(\<and>)"] ball_cong[of "set vps", OF refl] refl, goal_cases \<phi>1 \<phi>2)
+        case \<phi>1
+        then show ?case
+          by (metis (mono_tags, lifting) 2 IntE Un_upper2 compatible_vals_extensible compatible_vals_union_eq)
+      next
+        case (\<phi>2 vp)
+        then show ?case using check_fv_cong(2)[of \<phi>2 _ _ vp]
+          by (metis (mono_tags, lifting) 2 IntE Un_upper1 compatible_vals_extensible compatible_vals_union_eq)
+      qed
+    next
+      case (VUntilInf i j vps)
+      show ?thesis
+        unfolding VUntilInf v_check_exec_simps v_check_simps fv.simps ball_conj_distrib ball_swap[of _ "set vps"]
+          Until(4)[OF 2] Let_def
+          ball_triv_nonempty[OF compatible_vals_nonemptyI[OF 2, of "fv \<phi>1 \<union> fv \<phi>2"]]
+      proof (intro arg_cong2[of _ _ _ _ "(\<and>)"] ball_cong[of "set vps", OF refl] refl, goal_cases \<phi>2)
+        case (\<phi>2 vp)
+        then show ?case using check_fv_cong(2)[of \<phi>2 _ _ vp]
+          by (metis (mono_tags, lifting) 2 IntE Un_upper1 compatible_vals_extensible compatible_vals_union_eq)
+      qed
+    qed (auto simp: compatible_vals_union_eq)
+  }
+qed
+
+lemma s_check_code[code]: "s_check v \<phi> sp = s_check_exec (\<lambda>x. {v x}) \<phi> sp"
+  by (subst check_exec_check)
+    (auto simp: compatible_vals_def elim: check_fv_cong[THEN iffD2, rotated])
+
+lemma v_check_code[code]: "v_check v \<phi> vp = v_check_exec (\<lambda>x. {v x}) \<phi> vp"
+  by (subst check_exec_check)
+    (auto simp: compatible_vals_def elim: check_fv_cong[THEN iffD2, rotated])
+
+subsection \<open>Latest Relevant Time-Point\<close>
+
+fun LRTP :: "('n, 'd) formula \<Rightarrow> nat \<Rightarrow> nat option" where
+  "LRTP \<top> i = Some i"
+| "LRTP \<bottom> i = Some i"
+| "LRTP (_ \<dagger> _) i = Some i"
+| "LRTP (_ \<^bold>\<approx> _) i = Some i"
+| "LRTP (\<not>\<^sub>F \<phi>) i = LRTP \<phi> i"
+| "LRTP (\<phi> \<or>\<^sub>F \<psi>) i = max_opt (LRTP \<phi> i) (LRTP \<psi> i)"
+| "LRTP (\<phi> \<and>\<^sub>F \<psi>) i = max_opt (LRTP \<phi> i) (LRTP \<psi> i)"
+| "LRTP (\<phi> \<longrightarrow>\<^sub>F \<psi>) i = max_opt (LRTP \<phi> i) (LRTP \<psi> i)"
+| "LRTP (\<phi> \<longleftrightarrow>\<^sub>F \<psi>) i = max_opt (LRTP \<phi> i) (LRTP \<psi> i)"
+| "LRTP (\<exists>\<^sub>F_. \<phi>) i = LRTP \<phi> i"
+| "LRTP (\<forall>\<^sub>F_. \<phi>) i = LRTP \<phi> i"
+| "LRTP (\<^bold>Y I \<phi>) i = LRTP \<phi> (i-1)"
+| "LRTP (\<^bold>X I \<phi>) i = LRTP \<phi> (i+1)"
+| "LRTP (\<^bold>P I \<phi>) i = LRTP \<phi> (LTP_p_safe \<sigma> i I)"
+| "LRTP (\<^bold>H I \<phi>) i = LRTP \<phi> (LTP_p_safe \<sigma> i I)"
+| "LRTP (\<^bold>F I \<phi>) i = (case right I of \<infinity> \<Rightarrow> None | enat b \<Rightarrow> LRTP \<phi> (LTP_f \<sigma> i b))"
+| "LRTP (\<^bold>G I \<phi>) i = (case right I of \<infinity> \<Rightarrow> None | enat b \<Rightarrow> LRTP \<phi> (LTP_f \<sigma> i b))" 
+| "LRTP (\<phi> \<^bold>S I \<psi>) i = max_opt (LRTP \<phi> i) (LRTP \<psi> (LTP_p_safe \<sigma> i I))"
+| "LRTP (\<phi> \<^bold>U I \<psi>) i = (case right I of \<infinity> \<Rightarrow> None | enat b \<Rightarrow> max_opt (LRTP \<phi> ((LTP_f \<sigma> i b)-1)) (LRTP \<psi> (LTP_f \<sigma> i b)))"
+
+lemma fb_LRTP: 
+  assumes "future_bounded \<phi>"
+  shows "\<not> Option.is_none (LRTP \<phi> i)"
+  using assms
+  by (induction \<phi> i rule: LRTP.induct) 
+    (auto simp add: max_opt_def Option.is_none_def)
+
+lemma not_none_fb_LRTP:
+  assumes "future_bounded \<phi>"
+  shows "LRTP \<phi> i \<noteq> None"
+  using assms fb_LRTP by (auto simp add: Option.is_none_def)
+
+lemma is_some_fb_LRTP:
+  assumes "future_bounded \<phi>"
+  shows "\<exists>j. LRTP \<phi> i = Some j"
+  using assms fb_LRTP by (auto simp add: Option.is_none_def)
+
+lemma enat_trans[simp]: "enat i \<le> enat j \<and> enat j \<le> enat k \<Longrightarrow> enat i \<le> enat k"
+  by auto
+
+subsection \<open>Active Domain\<close>
+
+definition AD :: "('n, 'd) formula \<Rightarrow> nat \<Rightarrow> 'd set"
+  where "AD \<phi> i = consts \<phi> \<union> (\<Union> k \<le> the (LRTP \<phi> i). \<Union> (set ` snd ` \<Gamma> \<sigma> k))"
+
+lemma val_in_AD_iff:
+  "x \<in> fv \<phi> \<Longrightarrow> v x \<in> AD \<phi> i \<longleftrightarrow> v x \<in> consts \<phi> \<or>
+  (\<exists>r ts k. k \<le> the (LRTP \<phi> i) \<and> (r, v\<^bold>\<lbrakk>ts\<^bold>\<rbrakk>) \<in> \<Gamma> \<sigma> k \<and> x \<in> \<Union> (set (map fv_trm ts)))"
+  unfolding AD_def Un_iff UN_iff Bex_def atMost_iff set_map
+    ex_comm[of "P :: _ \<Rightarrow> nat \<Rightarrow> _" for P] ex_simps image_iff
+proof (safe intro!: arg_cong[of _ _ "\<lambda>x. _ \<or> x"] ex_cong, unfold snd_conv, goal_cases LR RL)
+  case (LR i _ r ds)
+  then show ?case
+    by (intro exI[of _ r] conjI
+        exI[of _ "map (\<lambda>d. if v x = d then (\<^bold>v x) else \<^bold>c d) ds"])
+      (auto simp: eval_trms_def o_def map_idI)
+next
+  case (RL i r ts t)
+  then show ?case
+    by (intro exI[of _ "v\<^bold>\<lbrakk>ts\<^bold>\<rbrakk>"] conjI)
+      (auto simp: eval_trms_def image_iff in_fv_trm_conv intro!: bexI[of _ t])
+qed
+
+lemma val_notin_AD_iff:
+  "x \<in> fv \<phi> \<Longrightarrow> v x \<notin> AD \<phi> i \<longleftrightarrow> v x \<notin> consts \<phi> \<and>
+    (\<forall>r ts k. k \<le> the (LRTP \<phi> i) \<and> x \<in> \<Union> (set (map fv_trm ts)) \<longrightarrow> (r, v\<^bold>\<lbrakk>ts\<^bold>\<rbrakk>) \<notin> \<Gamma> \<sigma> k)"
+  using val_in_AD_iff by blast
+
+lemma finite_values: "finite (\<Union> (set ` snd ` \<Gamma> \<sigma> k))"
+  by (transfer, auto simp add: sfinite_def)
+
+lemma finite_tps: "future_bounded \<phi> \<Longrightarrow> finite (\<Union> k < the (LRTP \<phi> i). {k})"
+  using fb_LRTP[of \<phi>] finite_enat_bounded
+  by simp
+
+lemma finite_AD [simp]: "future_bounded \<phi> \<Longrightarrow> finite (AD \<phi> i)"
+  using finite_tps finite_values
+  by (simp add: AD_def enat_def)
+
+lemma finite_AD_UNIV:
+  assumes "future_bounded \<phi>" and "AD \<phi> i = (UNIV:: 'd set)"
+  shows "finite (UNIV::'d set)"
+proof -
+  have "finite (AD \<phi> i)"
+    using finite_AD[of \<phi> i, OF assms(1)] by simp
+  then show ?thesis
+    using assms(2) by simp
+qed
+
+subsection \<open>Congruence Modulo Active Domain\<close>
+
+lemma AD_simps[simp]:
+  "AD (\<not>\<^sub>F \<phi>) i = AD \<phi> i"
+  "future_bounded (\<phi> \<or>\<^sub>F \<psi>) \<Longrightarrow> AD (\<phi> \<or>\<^sub>F \<psi>) i = AD \<phi> i \<union> AD \<psi> i"
+  "future_bounded (\<phi> \<and>\<^sub>F \<psi>) \<Longrightarrow> AD (\<phi> \<and>\<^sub>F \<psi>) i = AD \<phi> i \<union> AD \<psi> i"
+  "future_bounded (\<phi> \<longrightarrow>\<^sub>F \<psi>) \<Longrightarrow> AD (\<phi> \<longrightarrow>\<^sub>F \<psi>) i = AD \<phi> i \<union> AD \<psi> i"
+  "future_bounded (\<phi> \<longleftrightarrow>\<^sub>F \<psi>) \<Longrightarrow> AD (\<phi> \<longleftrightarrow>\<^sub>F \<psi>) i = AD \<phi> i \<union> AD \<psi> i"
+  "AD (\<exists>\<^sub>Fx.  \<phi>) i = AD \<phi> i"
+  "AD (\<forall>\<^sub>Fx.  \<phi>) i = AD \<phi> i"
+  "AD (\<^bold>Y I \<phi>) i = AD \<phi> (i - 1)"
+  "AD (\<^bold>X I \<phi>) i = AD \<phi> (i + 1)"
+  "future_bounded (\<^bold>F I \<phi>) \<Longrightarrow> AD (\<^bold>F I \<phi>) i = AD \<phi> (LTP_f \<sigma> i (the_enat (right I)))"
+  "future_bounded (\<^bold>G I \<phi>) \<Longrightarrow> AD (\<^bold>G I \<phi>) i = AD \<phi> (LTP_f \<sigma> i (the_enat (right I)))"
+  "AD (\<^bold>P I \<phi>) i = AD \<phi> (LTP_p_safe \<sigma> i I)"
+  "AD (\<^bold>H I \<phi>) i = AD \<phi> (LTP_p_safe \<sigma> i I)"
+  "future_bounded (\<phi> \<^bold>S I \<psi>) \<Longrightarrow> AD (\<phi> \<^bold>S I \<psi>) i = AD \<phi> i \<union> AD \<psi> (LTP_p_safe \<sigma> i I)"
+  "future_bounded (\<phi> \<^bold>U I \<psi>) \<Longrightarrow> AD (\<phi> \<^bold>U I \<psi>) i = AD \<phi> (LTP_f \<sigma> i (the_enat (right I)) - 1) \<union> AD \<psi> (LTP_f \<sigma> i (the_enat (right I)))"
+  by (auto 0 3 simp: AD_def max_opt_def not_none_fb_LRTP le_max_iff_disj Bex_def split: option.splits)
+
+
+lemma LTP_p_mono: "i \<le> j \<Longrightarrow> LTP_p_safe \<sigma> i I \<le> LTP_p_safe \<sigma> j I"
+  unfolding LTP_p_safe_def
+  by (smt (verit, ccfv_threshold) \<tau>_mono bot_nat_0.extremum diff_le_mono order.trans i_LTP_tau le_cases3 min.bounded_iff)
+
+lemma LTP_f_mono:
+  assumes "i \<le> j"
+  shows"LTP_f \<sigma> i b \<le> LTP_f \<sigma> j b"
+  unfolding LTP_def
+proof (rule Max_mono)
+  show "finite {i. \<tau> \<sigma> i \<le> \<tau> \<sigma> j + b}"
+    unfolding finite_nat_set_iff_bounded_le
+    by (metis i_le_LTPi_add le_Suc_ex mem_Collect_eq)
+qed (auto simp: assms intro!: exI[of _ i] elim: order_trans)
+
+lemma LRTP_mono: "future_bounded \<phi> \<Longrightarrow> i \<le> j \<Longrightarrow> the (LRTP \<phi> i) \<le> the (LRTP \<phi> j)"
+proof (induct \<phi> arbitrary: i j)
+  case (Or \<phi>1 \<phi>2)
+  from Or(1,2)[of i j] Or(3-) show ?case
+    by (auto simp: max_opt_def not_none_fb_LRTP split: option.splits)
+next
+  case (And \<phi>1 \<phi>2)
+  from And(1,2)[of i j] And(3-) show ?case
+    by (auto simp: max_opt_def not_none_fb_LRTP split: option.splits)
+next
+  case (Imp \<phi>1 \<phi>2)
+  from Imp(1,2)[of i j] Imp(3-) show ?case
+    by (auto simp: max_opt_def not_none_fb_LRTP split: option.splits)
+next
+  case (Iff \<phi>1 \<phi>2)
+  from Iff(1,2)[of i j] Iff(3-) show ?case
+    by (auto simp: max_opt_def not_none_fb_LRTP split: option.splits)
+next
+  case (Since \<phi>1 I \<phi>2)
+  from Since(1)[OF _ Since(4)] Since(2)[of "LTP_p_safe \<sigma> i I" "LTP_p_safe \<sigma> j I"] Since(3-)
+  show ?case
+    by (auto simp: max_opt_def not_none_fb_LRTP LTP_p_mono split: option.splits)
+next
+  case (Until \<phi>1 I \<phi>2)
+  from Until(1)[of "LTP_f \<sigma> i (the_enat (right I)) - 1" "LTP_f \<sigma> j (the_enat (right I)) - 1"]
+    Until(2)[of "LTP_f \<sigma> i (the_enat (right I))" "LTP_f \<sigma> j (the_enat (right I))"] Until(3-)
+  show ?case
+    by (auto simp: max_opt_def not_none_fb_LRTP LTP_f_mono diff_le_mono split: option.splits)
+qed (auto simp: LTP_p_mono LTP_f_mono)
+
+lemma AD_mono: "future_bounded \<phi> \<Longrightarrow> i \<le> j \<Longrightarrow> AD \<phi> i \<subseteq> AD \<phi> j"
+  by (auto 0 3 simp: AD_def Bex_def intro: LRTP_mono elim!: order_trans)
+
+lemma LTP_p_safe_le[simp]: "LTP_p_safe \<sigma> i I \<le> i"
+  by (auto simp: LTP_p_safe_def)
+
+lemma check_AD_cong:
+  assumes "future_bounded \<phi>"
+    and "(\<forall>x \<in> fv \<phi>. v x = v' x \<or> (v x \<notin> AD \<phi> i \<and> v' x \<notin> AD \<phi> i))"
+  shows "(s_at sp = i \<Longrightarrow> s_check v \<phi> sp \<longleftrightarrow> s_check v' \<phi> sp)"
+    "(v_at vp = i \<Longrightarrow> v_check v \<phi> vp \<longleftrightarrow> v_check v' \<phi> vp)"
+  using assms
+proof (induction v \<phi> sp and v \<phi> vp arbitrary: i v' and i v' rule: s_check_v_check.induct)
+  case (1 v f sp)
+  note IH = 1(1-23)[OF refl] and hyps = 1(24-26)
+  show ?case
+  proof (cases sp)
+    case (SPred j r ts)
+    then show ?thesis
+    proof (cases f)
+      case (Pred q us)
+      with SPred hyps show ?thesis
+        using eval_trms_fv_cong[of ts v v']
+        by (force simp: val_notin_AD_iff dest!: spec[of _ i] spec[of _ r] spec[of _ ts])
+    qed auto
+  next
+    case (SEq_Const j r ts)
+    with hyps show ?thesis
+      by (cases f) (auto simp: val_notin_AD_iff)
+  next
+    case (SNeg vp')
+    then show ?thesis
+      using IH(1)[of _ _ _ v'] hyps
+      by (cases f) auto
+  next
+    case (SOrL sp')
+    then show ?thesis
+      using IH(2)[of _ _ _ _ v'] hyps
+      by (cases f) auto
+  next
+    case (SOrR sp')
+    then show ?thesis
+      using IH(3)[of _ _ _ _ v'] hyps
+      by (cases f) auto
+  next
+    case (SAnd sp1 sp2)
+    then show ?thesis
+      using IH(4,5)[of _ _ _ _ _ v'] hyps
+      by (cases f) (auto 7 0)+
+  next
+    case (SImpL vp')
+    then show ?thesis
+      using IH(6)[of _ _ _ _ v'] hyps
+      by (cases f) auto
+  next
+    case (SImpR sp')
+    then show ?thesis
+      using IH(7)[of _ _ _ _ v'] hyps
+      by (cases f) auto
+  next
+    case (SIffSS sp1 sp2)
+    then show ?thesis
+      using IH(8,9)[of _ _ _ _ _ v'] hyps
+      by (cases f) (auto 7 0)+
+  next
+    case (SIffVV vp1 vp2)
+    then show ?thesis
+      using IH(10,11)[of _ _ _ _ _ v'] hyps
+      by (cases f) (auto 7 0)+
+  next
+    case (SExists x z sp')
+    then show ?thesis
+      using IH(12)[of x _ x z sp' i "v'(x := z)"] hyps
+      by (cases f) (auto simp add: fun_upd_def)
+  next
+    case (SForall x part)
+    then show ?thesis
+      using IH(13)[of x _ x part _ _ D _ z _ "v'(x := z)" for D z, OF _ _ _ _  refl _ refl] hyps
+      by (cases f) (auto simp add: fun_upd_def)
+  next
+    case (SPrev sp')
+    then show ?thesis
+      using IH(14)[of _ _ _ _ _ _ v'] hyps
+      by (cases f) auto
+  next
+    case (SNext sp')
+    then show ?thesis
+      using IH(15)[of _ _ _ _ _ _ v'] hyps
+      by (cases f) (auto simp add: Let_def)
+  next
+    case (SOnce j sp')
+    then show ?thesis
+    proof (cases f)
+      case (Once I \<phi>)
+      { fix k
+        assume k: "k \<le> i" "\<tau> \<sigma> i - left I \<ge> \<tau> \<sigma> k"
+        then have "\<tau> \<sigma> i - left I \<ge> \<tau> \<sigma> 0"
+          by (meson \<tau>_mono le0 order_trans)
+        with k have "k \<le> LTP_p_safe \<sigma> i I"
+          unfolding LTP_p_safe_def by (auto simp: i_LTP_tau)
+        with Once hyps(2,3) have "\<forall>x\<in>fv \<phi>. v x = v' x \<or> v x \<notin> AD \<phi> k \<and> v' x \<notin> AD \<phi> k"
+          by (auto dest!: bspec dest: AD_mono[THEN set_mp, rotated -1])
+      }
+      with Once SOnce show ?thesis
+        using IH(16)[OF Once SOnce refl refl, of v'] hyps(1,2)
+        by (auto simp: Let_def le_diff_conv2)
+    qed auto
+  next
+    case (SHistorically j k sps)
+    then show ?thesis
+    proof (cases f)
+      case (Historically I \<phi>)
+      { fix sp :: "('n, 'd) sproof"
+        define l and u where "l = s_at sp" and "u = LTP_p \<sigma> i I"
+        assume *: "sp \<in> set sps" "\<tau> \<sigma> 0 + left I \<le> \<tau> \<sigma> i"
+        then have u_def: "u = LTP_p_safe \<sigma> i I"
+          by (auto simp: LTP_p_safe_def u_def)
+        from *(1) obtain j where j: "sp = sps ! j" "j < length sps"
+          unfolding in_set_conv_nth by auto
+        moreover
+        assume eq: "map s_at sps = [k ..< Suc u]"
+        then have len: "length sps = Suc u - k"
+          by (auto dest!: arg_cong[where f=length])
+        moreover
+        have "s_at (sps ! j) = k + j"
+          using arg_cong[where f="\<lambda>xs. nth xs j", OF eq] j len *(2)
+          by (auto simp: nth_append)
+        ultimately have "l \<le> u"
+          unfolding l_def by auto
+        with Historically hyps(2,3) have "\<forall>x\<in>fv \<phi>. v x = v' x \<or> v x \<notin> AD \<phi> l \<and> v' x \<notin> AD \<phi> l"
+          by (auto simp: u_def dest!: bspec dest: AD_mono[THEN set_mp, rotated -1])
+      }
+      with Historically SHistorically show ?thesis
+        using IH(17)[OF Historically SHistorically _ refl, of _ v'] hyps(1,2)
+        by auto
+    qed auto
+  next
+    case (SEventually j sp')
+    then show ?thesis
+    proof (cases f)
+      case (Eventually I \<phi>)
+      { fix k
+        assume "\<tau> \<sigma> k \<le> the_enat (right I) + \<tau> \<sigma> i"
+        then have "k \<le> LTP_f \<sigma> i (the_enat (right I))"
+          by (metis add.commute i_le_LTPi_add le_add_diff_inverse)
+        with Eventually hyps(2,3) have "\<forall>x\<in>fv \<phi>. v x = v' x \<or> v x \<notin> AD \<phi> k \<and> v' x \<notin> AD \<phi> k"
+          by (auto dest!: bspec dest: AD_mono[THEN set_mp, rotated -1])
+      }
+      with Eventually SEventually show ?thesis
+        using IH(18)[OF Eventually SEventually refl refl, of v'] hyps(1,2)
+        by (auto simp: Let_def)
+    qed auto
+  next
+    case (SAlways j k sps)
+    then show ?thesis
+    proof (cases f)
+      case (Always I \<phi>)
+      { fix sp :: "('n, 'd) sproof"
+        define l and u where "l = s_at sp" and "u = LTP_f \<sigma> i (the_enat (right I))"
+        assume *: "sp \<in> set sps"
+        then obtain j where j: "sp = sps ! j" "j < length sps"
+          unfolding in_set_conv_nth by auto
+        assume eq: "map s_at sps = [ETP_f \<sigma> i I ..< Suc u]"
+        then have "length sps = Suc u - ETP_f \<sigma> i I"
+          by (auto dest!: arg_cong[where f=length])
+        with j eq have "l \<le> LTP_f \<sigma> i (the_enat (right I))"
+          by (auto simp: l_def u_def dest!: arg_cong[where f="\<lambda>xs. nth xs j"]
+              simp del: upt.simps split: if_splits)
+        with Always hyps(2,3) have "\<forall>x\<in>fv \<phi>. v x = v' x \<or> v x \<notin> AD \<phi> l \<and> v' x \<notin> AD \<phi> l"
+          by (auto dest!: bspec dest: AD_mono[THEN set_mp, rotated -1])
+      }
+      with Always SAlways show ?thesis
+        using IH(19)[OF Always SAlways _ refl, of _ v'] hyps(1,2)
+        by auto
+    qed auto
+  next
+    case (SSince sp' sps)
+    then show ?thesis
+    proof (cases f)
+      case (Since \<phi> I \<psi>)
+      { fix sp :: "('n, 'd) sproof"
+        define l where "l = s_at sp"
+        assume *: "sp \<in> set sps"
+        from *(1) obtain j where j: "sp = sps ! j" "j < length sps"
+          unfolding in_set_conv_nth by auto
+        moreover
+        assume eq: "map s_at sps = [Suc (s_at sp')  ..< Suc i]"
+        then have len: "length sps = i - s_at sp'"
+          by (auto dest!: arg_cong[where f=length])
+        moreover
+        have "s_at (sps ! j) = Suc (s_at sp') + j"
+          using arg_cong[where f="\<lambda>xs. nth xs j", OF eq] j len
+          by (auto simp: nth_append)
+        ultimately have "l \<le> i"
+          unfolding l_def by auto
+        with Since hyps(2,3) have "\<forall>x\<in>fv \<phi>. v x = v' x \<or> v x \<notin> AD \<phi> l \<and> v' x \<notin> AD \<phi> l"
+          by (auto simp: dest!: bspec dest: AD_mono[THEN set_mp, rotated -1])
+      }
+      moreover
+      { fix k
+        assume k: "k \<le> i" "\<tau> \<sigma> i - left I \<ge> \<tau> \<sigma> k"
+        then have "\<tau> \<sigma> i - left I \<ge> \<tau> \<sigma> 0"
+          by (meson \<tau>_mono le0 order_trans)
+        with k have "k \<le> LTP_p_safe \<sigma> i I"
+          unfolding LTP_p_safe_def by (auto simp: i_LTP_tau)
+        with Since hyps(2,3) have "\<forall>x\<in>fv \<psi>. v x = v' x \<or> v x \<notin> AD \<psi> k \<and> v' x \<notin> AD \<psi> k"
+          by (auto dest!: bspec dest: AD_mono[THEN set_mp, rotated -1])
+      }
+      ultimately show ?thesis
+        using Since SSince IH(20)[OF Since SSince refl refl refl, of v'] IH(21)[OF Since SSince refl refl _ refl, of _ v'] hyps(1,2)
+        by (auto simp: Let_def le_diff_conv2 simp del: upt.simps)
+    qed auto
+  next
+    case (SUntil sps sp')
+    then show ?thesis
+    proof (cases f)
+      case (Until \<phi> I \<psi>)
+      { fix sp :: "('n, 'd) sproof"
+        define l where "l = s_at sp"
+        assume *: "sp \<in> set sps"
+        from *(1) obtain j where j: "sp = sps ! j" "j < length sps"
+          unfolding in_set_conv_nth by auto
+        moreover
+        assume "\<delta> \<sigma> (s_at sp') i \<le> the_enat (right I)"
+        then have "s_at sp' \<le> LTP_f \<sigma> i (the_enat (right I))"
+          by (metis add.commute i_le_LTPi_add le_add_diff_inverse le_diff_conv)
+        moreover
+        assume eq: "map s_at sps = [i ..< s_at sp']"
+        then have len: "length sps = s_at sp' - i"
+          by (auto dest!: arg_cong[where f=length])
+        moreover
+        have "s_at (sps ! j) = i + j"
+          using arg_cong[where f="\<lambda>xs. nth xs j", OF eq] j len
+          by (auto simp: nth_append)
+        ultimately have "l \<le> LTP_f \<sigma> i (the_enat (right I)) - 1"
+          unfolding l_def by auto
+        with Until hyps(2,3) have "\<forall>x\<in>fv \<phi>. v x = v' x \<or> v x \<notin> AD \<phi> l \<and> v' x \<notin> AD \<phi> l"
+          by (auto simp: dest!: bspec dest: AD_mono[THEN set_mp, rotated -1])
+      }
+      moreover
+      { fix k
+        assume "\<tau> \<sigma> k \<le> the_enat (right I) + \<tau> \<sigma> i"
+        then have "k \<le> LTP_f \<sigma> i (the_enat (right I))"
+          by (metis add.commute i_le_LTPi_add le_add_diff_inverse)
+        with Until hyps(2,3) have "\<forall>x\<in>fv \<psi>. v x = v' x \<or> v x \<notin> AD \<psi> k \<and> v' x \<notin> AD \<psi> k"
+          by (auto dest!: bspec dest: AD_mono[THEN set_mp, rotated -1])
+      }
+      ultimately show ?thesis
+        using Until SUntil IH(22)[OF Until SUntil refl refl refl, of v'] IH(23)[OF Until SUntil refl refl _ refl, of _ v'] hyps(1,2)
+        by (auto simp: Let_def le_diff_conv2 simp del: upt.simps)
+    qed auto
+  qed (cases f; simp_all)+
+next
+  case (2 v f vp)
+  note IH = 2(1-25)[OF refl] and hyps = 2(26-28)
+  show ?case
+  proof (cases vp)
+    case (VPred j r ts)
+    then show ?thesis
+    proof (cases f)
+      case (Pred q us)
+      with VPred hyps show ?thesis
+        using eval_trms_fv_cong[of ts v v']
+        by (force simp: val_notin_AD_iff dest!: spec[of _ i] spec[of _ r] spec[of _ ts])
+    qed auto
+  next
+    case (VEq_Const j r ts)
+    with hyps show ?thesis
+      by (cases f) (auto simp: val_notin_AD_iff)
+  next
+    case (VNeg sp')
+    then show ?thesis
+      using IH(1)[of _ _ _ v'] hyps
+      by (cases f) auto
+  next
+    case (VOr vp1 vp2)
+    then show ?thesis
+      using IH(2,3)[of _ _ _ _ _ v'] hyps
+      by (cases f) (auto 7 0)+
+  next
+    case (VAndL vp')
+    then show ?thesis
+      using IH(4)[of _ _ _ _ v'] hyps
+      by (cases f) auto
+  next
+    case (VAndR vp')
+    then show ?thesis
+      using IH(5)[of _ _ _ _ v'] hyps
+      by (cases f) auto
+  next
+    case (VImp sp1 vp2)
+    then show ?thesis
+      using IH(6,7)[of _ _ _ _ _ v'] hyps
+      by (cases f) (auto 7 0)+
+  next
+    case (VIffSV sp1 vp2)
+    then show ?thesis
+      using IH(8,9)[of _ _ _ _ _ v'] hyps
+      by (cases f) (auto 7 0)+
+  next
+    case (VIffVS vp1 sp2)
+    then show ?thesis
+      using IH(10,11)[of _ _ _ _ _ v'] hyps
+      by (cases f) (auto 7 0)+
+  next
+    case (VExists x part)
+    then show ?thesis
+      using IH(12)[of x _ x part _ _ D _ z _ "v'(x := z)" for D z, OF _ _ _ _  refl _ refl] hyps
+      by (cases f) (auto simp add: fun_upd_def)
+  next
+    case (VForall x z vp')
+    then show ?thesis
+      using IH(13)[of x _ x z vp' i "v'(x := z)"] hyps
+      by (cases f) (auto simp add: fun_upd_def)
+  next
+    case (VPrev vp')
+    then show ?thesis
+      using IH(14)[of _ _ _ _ _ _ v'] hyps
+      by (cases f) auto
+  next
+    case (VNext vp')
+    then show ?thesis
+      using IH(15)[of _ _ _ _ _ _ v'] hyps
+      by (cases f) auto
+  next
+    case (VOnce j k vps)
+    then show ?thesis
+    proof (cases f)
+      case (Once I \<phi>)
+      { fix vp :: "('n, 'd) vproof"
+        define l and u where "l = v_at vp" and "u = LTP_p \<sigma> i I"
+        assume *: "vp \<in> set vps" "\<tau> \<sigma> 0 + left I \<le> \<tau> \<sigma> i"
+        then have u_def: "u = LTP_p_safe \<sigma> i I"
+          by (auto simp: LTP_p_safe_def u_def)
+        from *(1) obtain j where j: "vp = vps ! j" "j < length vps"
+          unfolding in_set_conv_nth by auto
+        moreover
+        assume eq: "map v_at vps = [k ..< Suc u]"
+        then have len: "length vps = Suc u - k"
+          by (auto dest!: arg_cong[where f=length])
+        moreover
+        have "v_at (vps ! j) = k + j"
+          using arg_cong[where f="\<lambda>xs. nth xs j", OF eq] j len *(2)
+          by (auto simp: nth_append)
+        ultimately have "l \<le> u"
+          unfolding l_def by auto
+        with Once hyps(2,3) have "\<forall>x\<in>fv \<phi>. v x = v' x \<or> v x \<notin> AD \<phi> l \<and> v' x \<notin> AD \<phi> l"
+          by (auto simp: u_def dest!: bspec dest: AD_mono[THEN set_mp, rotated -1])
+      }
+      with Once VOnce show ?thesis
+        using IH(16)[OF Once VOnce _ refl, of _ v'] hyps(1,2)
+        by auto
+    qed auto
+  next
+    case (VHistorically j vp')
+    then show ?thesis
+    proof (cases f)
+      case (Historically I \<phi>)
+      { fix k
+        assume k: "k \<le> i" "\<tau> \<sigma> i - left I \<ge> \<tau> \<sigma> k"
+        then have "\<tau> \<sigma> i - left I \<ge> \<tau> \<sigma> 0"
+          by (meson \<tau>_mono le0 order_trans)
+        with k have "k \<le> LTP_p_safe \<sigma> i I"
+          unfolding LTP_p_safe_def by (auto simp: i_LTP_tau)
+        with Historically hyps(2,3) have "\<forall>x\<in>fv \<phi>. v x = v' x \<or> v x \<notin> AD \<phi> k \<and> v' x \<notin> AD \<phi> k"
+          by (auto dest!: bspec dest: AD_mono[THEN set_mp, rotated -1])
+      }
+      with Historically VHistorically show ?thesis
+        using IH(17)[OF Historically VHistorically refl refl, of v'] hyps(1,2)
+        by (auto simp: Let_def le_diff_conv2)
+    qed auto
+  next
+    case (VEventually j k vps)
+    then show ?thesis
+    proof (cases f)
+      case (Eventually I \<phi>)
+      { fix vp :: "('n, 'd) vproof"
+        define l and u where "l = v_at vp" and "u = LTP_f \<sigma> i (the_enat (right I))"
+        assume *: "vp \<in> set vps"
+        then obtain j where j: "vp = vps ! j" "j < length vps"
+          unfolding in_set_conv_nth by auto
+        assume eq: "map v_at vps = [ETP_f \<sigma> i I ..< Suc u]"
+        then have "length vps = Suc u - ETP_f \<sigma> i I"
+          by (auto dest!: arg_cong[where f=length])
+        with j eq have "l \<le> LTP_f \<sigma> i (the_enat (right I))"
+          by (auto simp: l_def u_def dest!: arg_cong[where f="\<lambda>xs. nth xs j"]
+              simp del: upt.simps split: if_splits)
+        with Eventually hyps(2,3) have "\<forall>x\<in>fv \<phi>. v x = v' x \<or> v x \<notin> AD \<phi> l \<and> v' x \<notin> AD \<phi> l"
+          by (auto dest!: bspec dest: AD_mono[THEN set_mp, rotated -1])
+      }
+      with Eventually VEventually show ?thesis
+        using IH(18)[OF Eventually VEventually _ refl, of _ v'] hyps(1,2)
+        by auto
+    qed auto
+  next
+    case (VAlways j vp')
+    then show ?thesis
+    proof (cases f)
+      case (Always I \<phi>)
+      { fix k
+        assume "\<tau> \<sigma> k \<le> the_enat (right I) + \<tau> \<sigma> i"
+        then have "k \<le> LTP_f \<sigma> i (the_enat (right I))"
+          by (metis add.commute i_le_LTPi_add le_add_diff_inverse)
+        with Always hyps(2,3) have "\<forall>x\<in>fv \<phi>. v x = v' x \<or> v x \<notin> AD \<phi> k \<and> v' x \<notin> AD \<phi> k"
+          by (auto dest!: bspec dest: AD_mono[THEN set_mp, rotated -1])
+      }
+      with Always VAlways show ?thesis
+        using IH(19)[OF Always VAlways refl refl, of v'] hyps(1,2)
+        by (auto simp: Let_def)
+    qed auto
+  next
+    case (VSince j vp' vps)
+    then show ?thesis
+    proof (cases f)
+      case (Since \<phi> I \<psi>)
+      { fix sp :: "('n, 'd) vproof"
+        define l and u where "l = v_at sp" and "u = LTP_p \<sigma> i I"
+        assume *: "sp \<in> set vps" "\<tau> \<sigma> 0 + left I \<le> \<tau> \<sigma> i"
+        then have u_def: "u = LTP_p_safe \<sigma> i I"
+          by (auto simp: LTP_p_safe_def u_def)
+        from *(1) obtain j where j: "sp = vps ! j" "j < length vps"
+          unfolding in_set_conv_nth by auto
+        moreover
+        assume eq: "map v_at vps = [v_at vp'  ..< Suc u]"
+        then have len: "length vps = Suc u - v_at vp'"
+          by (auto dest!: arg_cong[where f=length])
+        moreover
+        have "v_at (vps ! j) = v_at vp' + j"
+          using arg_cong[where f="\<lambda>xs. nth xs j", OF eq] j len
+          by (auto simp: nth_append)
+        ultimately have "l \<le> u"
+          unfolding l_def by auto
+        with Since hyps(2,3) have "\<forall>x\<in>fv \<psi>. v x = v' x \<or> v x \<notin> AD \<psi> l \<and> v' x \<notin> AD \<psi> l"
+          by (auto simp: u_def dest!: bspec dest: AD_mono[THEN set_mp, rotated -1])
+      }
+      moreover
+      { fix k
+        assume k: "k \<le> i"
+        with Since hyps(2,3) have "\<forall>x\<in>fv \<phi>. v x = v' x \<or> v x \<notin> AD \<phi> k \<and> v' x \<notin> AD \<phi> k"
+          by (auto dest!: bspec dest: AD_mono[THEN set_mp, rotated -1])
+      }
+      ultimately show ?thesis
+        using Since VSince IH(20)[OF Since VSince refl refl, of v'] IH(21)[OF Since VSince refl _ refl, of _ v'] hyps(1,2)
+        by (auto simp: Let_def le_diff_conv2 simp del: upt.simps)
+    qed auto
+  next
+    case (VSinceInf j k vps)
+    then show ?thesis
+    proof (cases f)
+      case (Since \<phi> I \<psi>)
+      { fix vp :: "('n, 'd) vproof"
+        define l and u where "l = v_at vp" and "u = LTP_p \<sigma> i I"
+        assume *: "vp \<in> set vps" "\<tau> \<sigma> 0 + left I \<le> \<tau> \<sigma> i"
+        then have u_def: "u = LTP_p_safe \<sigma> i I"
+          by (auto simp: LTP_p_safe_def u_def)
+        from *(1) obtain j where j: "vp = vps ! j" "j < length vps"
+          unfolding in_set_conv_nth by auto
+        moreover
+        assume eq: "map v_at vps = [k ..< Suc u]"
+        then have len: "length vps = Suc u - k"
+          by (auto dest!: arg_cong[where f=length])
+        moreover
+        have "v_at (vps ! j) = k + j"
+          using arg_cong[where f="\<lambda>xs. nth xs j", OF eq] j len *(2)
+          by (auto simp: nth_append)
+        ultimately have "l \<le> u"
+          unfolding l_def by auto
+        with Since hyps(2,3) have "\<forall>x\<in>fv \<psi>. v x = v' x \<or> v x \<notin> AD \<psi> l \<and> v' x \<notin> AD \<psi> l"
+          by (auto simp: u_def dest!: bspec dest: AD_mono[THEN set_mp, rotated -1])
+      }
+      with Since VSinceInf show ?thesis
+        using IH(22)[OF Since VSinceInf _ refl, of _ v'] hyps(1,2)
+        by auto
+    qed auto
+  next
+    case (VUntil j vps vp')
+    then show ?thesis
+    proof (cases f)
+      case (Until \<phi> I \<psi>)
+      { fix sp :: "('n, 'd) vproof"
+        define l and u where "l = v_at sp" and "u = v_at vp'"
+        assume *: "sp \<in> set vps" "v_at vp' \<le> LTP_f \<sigma> i (the_enat (right I))"
+        from *(1) obtain j where j: "sp = vps ! j" "j < length vps"
+          unfolding in_set_conv_nth by auto
+        moreover
+        assume eq: "map v_at vps = [ETP_f \<sigma> i I ..< Suc u]"
+        then have "length vps = Suc u - ETP_f \<sigma> i I"
+          by (auto dest!: arg_cong[where f=length])
+        with j eq *(2) have "l \<le> LTP_f \<sigma> i (the_enat (right I))"
+          by (auto simp: l_def u_def dest!: arg_cong[where f="\<lambda>xs. nth xs j"]
+              simp del: upt.simps split: if_splits)
+        with Until hyps(2,3) have "\<forall>x\<in>fv \<psi>. v x = v' x \<or> v x \<notin> AD \<psi> l \<and> v' x \<notin> AD \<psi> l"
+          by (auto dest!: bspec dest: AD_mono[THEN set_mp, rotated -1])
+      }
+      moreover
+      { fix k
+        assume "k < LTP_f \<sigma> i (the_enat (right I))"
+        then have "k \<le> LTP_f \<sigma> i (the_enat (right I)) - 1"
+          by linarith
+        with Until hyps(2,3) have "\<forall>x\<in>fv \<phi>. v x = v' x \<or> v x \<notin> AD \<phi> k \<and> v' x \<notin> AD \<phi> k"
+          by (auto dest!: bspec dest: AD_mono[THEN set_mp, rotated -1])
+      }
+      ultimately show ?thesis
+        using Until VUntil IH(23)[OF Until VUntil refl refl, of v'] IH(24)[OF Until VUntil refl _ refl, of _ v'] hyps(1,2)
+        by (auto simp: Let_def le_diff_conv2 simp del: upt.simps)
+    qed auto
+  next
+    case (VUntilInf j k vps)
+    then show ?thesis
+    proof (cases f)
+      case (Until \<phi> I \<psi>)
+      { fix vp :: "('n, 'd) vproof"
+        define l and u where "l = v_at vp" and "u = LTP_f \<sigma> i (the_enat (right I))"
+        assume *: "vp \<in> set vps"
+        then obtain j where j: "vp = vps ! j" "j < length vps"
+          unfolding in_set_conv_nth by auto
+        assume eq: "map v_at vps = [ETP_f \<sigma> i I ..< Suc u]"
+        then have "length vps = Suc u - ETP_f \<sigma> i I"
+          by (auto dest!: arg_cong[where f=length])
+        with j eq have "l \<le> LTP_f \<sigma> i (the_enat (right I))"
+          by (auto simp: l_def u_def dest!: arg_cong[where f="\<lambda>xs. nth xs j"]
+              simp del: upt.simps split: if_splits)
+        with Until hyps(2,3) have "\<forall>x\<in>fv \<psi>. v x = v' x \<or> v x \<notin> AD \<psi> l \<and> v' x \<notin> AD \<psi> l"
+          by (auto dest!: bspec dest: AD_mono[THEN set_mp, rotated -1])
+      }
+      with Until VUntilInf show ?thesis
+        using IH(25)[OF Until VUntilInf _ refl, of _ v'] hyps(1,2)
+        by auto
+    qed auto
+  qed (cases f; simp_all)+
+qed
+
+subsection \<open>Checker Completeness\<close>
+
+lemma part_hd_tabulate: "distinct xs \<Longrightarrow> part_hd (tabulate xs f z) = (case xs of [] \<Rightarrow> z | (x # _) \<Rightarrow> (if set xs = UNIV then f x else z))"
+  by (transfer, auto split: list.splits)
+
+lemma s_at_tabulate:
+  assumes "\<forall>z. s_at (mypick z) = i"
+    and "mypart = tabulate (sorted_list_of_set (AD \<phi> i)) mypick (mypick (SOME z. z \<notin> AD \<phi> i))"
+  shows "\<forall>(sub, vp) \<in> SubsVals mypart. s_at vp = i"
+  using assms by (transfer, auto)
+
+lemma v_at_tabulate:
+  assumes "\<forall>z. v_at (mypick z) = i"
+    and "mypart = tabulate (sorted_list_of_set (AD \<phi> i)) mypick (mypick (SOME z. z \<notin> AD \<phi> i))"
+  shows "\<forall>(sub, vp) \<in> SubsVals mypart. v_at vp = i"
+  using assms by (transfer, auto)
+
+lemma s_check_tabulate:
+  assumes "future_bounded \<phi>"
+    and "\<forall>z. s_at (mypick z) = i"
+    and "\<forall>z. s_check (v(x:=z)) \<phi> (mypick z)"
+    and "mypart = tabulate (sorted_list_of_set (AD \<phi> i)) mypick (mypick (SOME z. z \<notin> AD \<phi> i))"
+  shows "\<forall>(sub, vp) \<in> SubsVals mypart. \<forall>z \<in> sub. s_check (v(x := z)) \<phi> vp"
+  using assms
+proof (transfer fixing: \<sigma> \<phi> mypick i v x, goal_cases 1)
+  case (1 mypart)
+  { fix z
+    assume s_at_assm: "\<forall>z. s_at (mypick z) = i"
+      and s_check_assm: "\<forall>z. s_check (v(x := z)) \<phi> (mypick z)"
+      and fb_assm: "future_bounded \<phi>"
+      and z_notin_AD: "z \<notin> (AD \<phi> i)"
+    have s_at_mypick: "s_at (mypick (SOME z. z \<notin> local.AD \<phi> i)) = i"
+      using s_at_assm by simp
+    have s_check_mypick: "Checker.s_check \<sigma> (v(x := SOME z. z \<notin> AD \<phi> i)) \<phi> (mypick (SOME z. z \<notin> AD \<phi> i))"
+      using s_check_assm by simp
+    have "s_check (v(x := z)) \<phi> (mypick (SOME z. z \<notin> AD \<phi> i))"
+      using z_notin_AD
+      by (subst check_AD_cong(1)[of \<phi> "v(x := z)" "v(x := (SOME z. z \<notin> Checker.AD \<sigma> \<phi> i))" i "mypick (SOME z. z \<notin> AD \<phi> i)", OF fb_assm _ s_at_mypick])
+        (auto simp add: someI[of "\<lambda>z. z \<notin> AD \<phi> i" z] s_check_mypick fb_assm split: if_splits)
+  }
+  with 1 show ?case
+    by auto
+qed
+
+lemma v_check_tabulate:
+  assumes "future_bounded \<phi>"
+    and "\<forall>z. v_at (mypick z) = i"
+    and "\<forall>z. v_check (v(x:=z)) \<phi> (mypick z)"
+    and "mypart = tabulate (sorted_list_of_set (AD \<phi> i)) mypick (mypick (SOME z. z \<notin> AD \<phi> i))"
+  shows "\<forall>(sub, vp) \<in> SubsVals mypart. \<forall>z \<in> sub. v_check (v(x := z)) \<phi> vp"
+  using assms
+proof (transfer fixing: \<sigma> \<phi> mypick i v x, goal_cases 1)
+  case (1 mypart)
+  { fix z
+    assume v_at_assm: "\<forall>z. v_at (mypick z) = i"
+      and v_check_assm: "\<forall>z. v_check (v(x := z)) \<phi> (mypick z)"
+      and fb_assm: "future_bounded \<phi>"
+      and z_notin_AD: "z \<notin> (AD \<phi> i)"
+    have v_at_mypick: "v_at (mypick (SOME z. z \<notin> local.AD \<phi> i)) = i"
+      using v_at_assm by simp
+    have v_check_mypick: "Checker.v_check \<sigma> (v(x := SOME z. z \<notin> AD \<phi> i)) \<phi> (mypick (SOME z. z \<notin> AD \<phi> i))"
+      using v_check_assm by simp
+    have "v_check (v(x := z)) \<phi> (mypick (SOME z. z \<notin> AD \<phi> i))"
+      using z_notin_AD
+      by (subst check_AD_cong(2)[of \<phi> "v(x := z)" "v(x := (SOME z. z \<notin> Checker.AD \<sigma> \<phi> i))" i "mypick (SOME z. z \<notin> AD \<phi> i)", OF fb_assm _ v_at_mypick])
+        (auto simp add: someI[of "\<lambda>z. z \<notin> AD \<phi> i" z] v_check_mypick fb_assm split: if_splits)
+  }
+  with 1 show ?case
+    by auto
+qed
+
+lemma s_at_part_hd_tabulate:
+  assumes "future_bounded \<phi>"
+    and "\<forall>z. s_at (f z) = i"
+    and "mypart = tabulate (sorted_list_of_set (AD \<phi> i)) f (f (SOME z. z \<notin> AD \<phi> i))"
+  shows "s_at (part_hd mypart) = i"
+  using assms by (simp add: part_hd_tabulate split: list.splits)
+
+lemma v_at_part_hd_tabulate:
+  assumes "future_bounded \<phi>"
+    and "\<forall>z. v_at (f z) = i"
+    and "mypart = tabulate (sorted_list_of_set (AD \<phi> i)) f (f (SOME z. z \<notin> AD \<phi> i))"
+  shows "v_at (part_hd mypart) = i"
+  using assms by (simp add: part_hd_tabulate split: list.splits)
+
+lemma check_completeness_aux:
+  "(SAT \<sigma> v i \<phi> \<longrightarrow> future_bounded \<phi> \<longrightarrow> (\<exists>sp. s_at sp = i \<and> s_check v \<phi> sp)) \<and>
+   (VIO \<sigma> v i \<phi> \<longrightarrow> future_bounded \<phi> \<longrightarrow> (\<exists>vp. v_at vp = i \<and> v_check v \<phi> vp))"
+proof (induct v i \<phi> rule: SAT_VIO.induct)
+  case (STT v i)
+  then show ?case
+    by (auto intro!: exI[of _ "STT i"])
+next
+  case (VFF v i)
+  then show ?case
+    by (auto intro!: exI[of _ "VFF i"])
+next
+  case (SPred r v ts i)
+  then show ?case
+    by (auto intro!: exI[of _ "SPred i r ts"])
+next
+  case (VPred r v ts i)
+  then show ?case
+    by (auto intro!: exI[of _ "VPred i r ts"])
+next
+  case (SEq_Const v x c i)
+  then show ?case
+    by (auto intro!: exI[of _ "SEq_Const i x c"])
+next
+  case (VEq_Const v x c i)
+  then show ?case
+    by (auto intro!: exI[of _ "VEq_Const i x c"])
+next
+  case (SNeg v i \<phi>)
+  then show ?case
+    by (auto intro: exI[of _ "SNeg _"])
+next
+  case (VNeg v i \<phi>)
+  then show ?case
+    by (auto intro: exI[of _ "VNeg _"])
+next
+  case (SOrL v i \<phi> \<psi>)
+  then show ?case
+    by (auto intro: exI[of _ "SOrL _"])
+next
+  case (SOrR v i \<psi> \<phi>)
+  then show ?case
+    by (auto intro: exI[of _ "SOrR _"])
+next
+  case (VOr v i \<phi> \<psi>)
+  then show ?case
+    by (auto 0 3 intro: exI[of _ "VOr _ _"])
+next
+  case (SAnd v i \<phi> \<psi>)
+  then show ?case
+    by (auto 0 3 intro: exI[of _ "SAnd _ _"])
+next
+  case (VAndL v i \<phi> \<psi>)
+  then show ?case
+    by (auto intro: exI[of _ "VAndL _"])
+next
+  case (VAndR v i \<psi> \<phi>)
+  then show ?case
+    by (auto intro: exI[of _ "VAndR _"])
+next
+  case (SImpL v i \<phi> \<psi>)
+  then show ?case
+    by (auto intro: exI[of _ "SImpL _"])
+next
+  case (SImpR v i \<psi> \<phi>)
+  then show ?case
+    by (auto intro: exI[of _ "SImpR _"])
+next
+  case (VImp v i \<phi> \<psi>)
+  then show ?case
+    by (auto 0 3 intro: exI[of _ "VImp _ _"])
+next
+  case (SIffSS v i \<phi> \<psi>)
+  then show ?case
+    by (auto 0 3 intro: exI[of _ "SIffSS _ _"])
+next
+  case (SIffVV v i \<phi> \<psi>)
+  then show ?case
+    by (auto 0 3 intro: exI[of _ "SIffVV _ _"])
+next
+  case (VIffSV v i \<phi> \<psi>)
+  then show ?case
+    by (auto 0 3 intro: exI[of _ "VIffSV _ _"])
+next
+  case (VIffVS v i \<phi> \<psi>)
+  then show ?case
+    by (auto 0 3 intro: exI[of _ "VIffVS _ _"])
+next
+  case (SExists v x i \<phi>)
+  then show ?case
+    by (auto 0 3 simp: fun_upd_def intro: exI[of _ "SExists x _ _"])
+next
+  case (VExists v x i \<phi>)
+  show ?case
+  proof
+    assume "future_bounded (\<exists>\<^sub>Fx.  \<phi>)"
+    then have fb: "future_bounded \<phi>"
+      by simp
+    obtain mypick where mypick_def: "v_at (mypick z) = i \<and> v_check (v(x:=z)) \<phi> (mypick z)" for z
+      using VExists fb by metis
+    define mypart where "mypart = tabulate (sorted_list_of_set (AD \<phi> i)) mypick (mypick (SOME z. z \<notin> (AD \<phi> i)))"
+    have mypick_at: "\<forall>z. v_at (mypick z) = i"
+      by (simp add: mypick_def)
+    have mypick_v_check: "\<forall>z. v_check (v(x:=z)) \<phi> (mypick z)"
+      by (simp add: mypick_def)
+    have mypick_v_check2: "\<forall>z. v_check (v(x := (SOME z. z \<notin> AD \<phi> i))) \<phi> (mypick (SOME z. z \<notin> AD \<phi> i))"
+      by (simp add: mypick_def)
+    have v_at_myp: "v_at (VExists x mypart) = i"
+      using v_at_part_hd_tabulate[OF fb, of mypick i]
+      by (simp add: mypart_def mypick_def)
+    have v_check_myp: "v_check v (\<exists>\<^sub>Fx.  \<phi>) (VExists x mypart)"
+      using v_at_tabulate[of mypick i _ \<phi>, OF mypick_at]
+        v_check_tabulate[OF fb mypick_at mypick_v_check]
+      by (auto simp add: mypart_def v_at_part_hd_tabulate[OF fb mypick_at])
+    show "\<exists>vp. v_at vp = i \<and> v_check v (\<exists>\<^sub>Fx.  \<phi>) vp"
+      using v_at_myp v_check_myp by blast
+  qed
+next
+  case (SForall v x i \<phi>)
+  show ?case
+  proof
+    assume "future_bounded (\<forall>\<^sub>Fx.  \<phi>)"
+    then have fb: "future_bounded \<phi>"
+      by simp
+    obtain mypick where mypick_def: "s_at (mypick z) = i \<and> s_check (v(x:=z)) \<phi> (mypick z)" for z
+      using SForall fb by metis
+    define mypart where "mypart = tabulate (sorted_list_of_set (AD \<phi> i)) mypick (mypick (SOME z. z \<notin> (AD \<phi> i)))"
+    have mypick_at: "\<forall>z. s_at (mypick z) = i"
+      by (simp add: mypick_def)
+    have mypick_s_check: "\<forall>z. s_check (v(x:=z)) \<phi> (mypick z)"
+      by (simp add: mypick_def)
+    have mypick_s_check2: "\<forall>z. s_check (v(x := (SOME z. z \<notin> AD \<phi> i))) \<phi> (mypick (SOME z. z \<notin> AD \<phi> i))"
+      by (simp add: mypick_def)
+    have s_at_myp: "s_at (SForall x mypart) = i"
+      using s_at_part_hd_tabulate[OF fb, of mypick i]
+      by (simp add: mypart_def mypick_def)
+    have s_check_myp: "s_check v (\<forall>\<^sub>Fx.  \<phi>) (SForall x mypart)"
+      using s_at_tabulate[of mypick i _ \<phi>, OF mypick_at]
+        s_check_tabulate[OF fb mypick_at mypick_s_check]
+      by (auto simp add: mypart_def s_at_part_hd_tabulate[OF fb mypick_at])
+    show "\<exists>sp. s_at sp = i \<and> s_check v (\<forall>\<^sub>Fx.  \<phi>) sp"
+      using s_at_myp s_check_myp by blast
+  qed
+next
+  case (VForall v x i \<phi>)
+  then show ?case
+    by (auto 0 3 simp: fun_upd_def intro: exI[of _ "VForall x _ _"])
+next
+  case (SPrev i I v \<phi>)
+  then show ?case
+    by (force intro: exI[of _ "SPrev _"])
+next
+  case (VPrev i v \<phi> I)
+  then show ?case
+    by (force intro: exI[of _ "VPrev _"])
+next
+  case (VPrevZ i v I \<phi>)
+  then show ?case
+    by (auto intro!: exI[of _ "VPrevZ"])
+next
+  case (VPrevOutL i I v \<phi>)
+  then show ?case
+    by (auto intro!: exI[of _ "VPrevOutL i"])
+next
+  case (VPrevOutR i I v \<phi>)
+  then show ?case
+    by (auto intro!: exI[of _ "VPrevOutR i"])
+next
+  case (SNext i I v \<phi>)
+  then show ?case
+    by (force simp: Let_def intro: exI[of _ "SNext _"])
+next
+  case (VNext v i \<phi> I)
+  then show ?case
+    by (force simp: Let_def intro: exI[of _ "VNext _"])
+next
+  case (VNextOutL i I v \<phi>)
+  then show ?case
+    by (auto intro!: exI[of _ "VNextOutL i"])
+next
+  case (VNextOutR i I v \<phi>)
+  then show ?case
+    by (auto intro!: exI[of _ "VNextOutR i"])
+next
+  case (SOnce j i I v \<phi>)
+  then show ?case
+    by (auto simp: Let_def intro: exI[of _ "SOnce i _"])
+next
+  case (VOnceOut i I v \<phi>)
+  then show ?case
+    by (auto intro!: exI[of _ "VOnceOut i"])
+next
+  case (VOnce j I i v \<phi>)
+  show ?case
+  proof
+    assume "future_bounded (\<^bold>P I \<phi>)"
+    then have fb: "future_bounded \<phi>"
+      by simp
+    obtain mypick where mypick_def: "\<forall>k \<in> {j .. LTP_p \<sigma> i I}. v_at (mypick k) = k \<and> v_check v \<phi> (mypick k)"
+      using VOnce fb by metis
+    then obtain vps where vps_def: "map (v_at) vps = [j ..< Suc (LTP_p \<sigma> i I)] \<and> (\<forall>vp \<in> set vps. v_check v \<phi> vp)"
+      by atomize_elim (auto intro!: trans[OF list.map_cong list.map_id] exI[of _ "map mypick ([j ..< Suc (LTP_p \<sigma> i I)])"])
+    then have "v_at (VOnce i j vps) = i \<and> v_check v (\<^bold>P I \<phi>) (VOnce i j vps)"
+      using VOnce by auto
+    then show "\<exists>vp. v_at vp = i \<and> v_check v (\<^bold>P I \<phi>) vp"
+      by blast
+  qed
+next
+  case (SEventually j i I v \<phi>)
+  then show ?case
+    by (auto simp: Let_def intro: exI[of _ "SEventually i _"])
+next
+  case (VEventually I i v \<phi>)
+  show ?case
+  proof
+    assume fb_eventually: "future_bounded (\<^bold>F I \<phi>)"
+    then have fb: "future_bounded \<phi>"
+      by simp
+    obtain b where b_def: "right I = enat b"
+      using fb_eventually by (atomize_elim, cases "right I") auto
+    define j where j_def: "j = LTP \<sigma> (\<tau> \<sigma> i + b)"
+    obtain mypick where mypick_def: "\<forall>k \<in> {ETP_f \<sigma> i I .. j}. v_at (mypick k) = k \<and> v_check v \<phi> (mypick k)"
+      using VEventually fb_eventually unfolding b_def j_def enat.simps
+      by atomize_elim (rule bchoice, simp)
+    then obtain vps where vps_def: "map (v_at) vps = [ETP_f \<sigma> i I ..< Suc j] \<and> (\<forall>vp \<in> set vps. v_check v \<phi> vp)"
+      by atomize_elim (auto intro!: trans[OF list.map_cong list.map_id] exI[of _ "map mypick ([ETP_f \<sigma> i I ..< Suc j])"])
+    then have "v_at (VEventually i j vps) = i \<and> v_check v (\<^bold>F I \<phi>) (VEventually i j vps)"
+      using VEventually b_def j_def by simp
+    then show "\<exists>vp. v_at vp = i \<and> v_check v (\<^bold>F I \<phi>) vp"
+      by blast
+  qed
+next
+  case (SHistorically j I i v \<phi>)
+  show ?case
+  proof
+    assume fb_historically: "future_bounded (\<^bold>H I \<phi>)"
+    then have fb: "future_bounded \<phi>"
+      by simp
+    obtain mypick where mypick_def: "\<forall>k \<in> {j .. LTP_p \<sigma> i I}. s_at (mypick k) = k \<and> s_check v \<phi> (mypick k)"
+      using SHistorically fb by metis
+    then obtain sps where sps_def: "map (s_at) sps = [j ..< Suc (LTP_p \<sigma> i I)] \<and> (\<forall>sp \<in> set sps. s_check v \<phi> sp)"
+      by atomize_elim (auto intro!: trans[OF list.map_cong list.map_id] exI[of _ "map mypick ([j ..< Suc (LTP_p \<sigma> i I)])"])
+    then have "s_at (SHistorically i j sps) = i \<and> s_check v (\<^bold>H I \<phi>) (SHistorically i j sps)"
+      using SHistorically by auto
+    then show "\<exists>sp. s_at sp = i \<and> s_check v (\<^bold>H I \<phi>) sp"
+      by blast
+  qed
+next
+  case (SHistoricallyOut i I v \<phi>)
+  then show ?case
+    by (auto intro!: exI[of _ "SHistoricallyOut i"])
+next
+  case (VHistorically j i I v \<phi>)
+  then show ?case
+    by (auto simp: Let_def intro: exI[of _ "VHistorically i _"])
+next
+  case (SAlways I i v \<phi>)
+  show ?case
+  proof
+    assume fb_always: "future_bounded (\<^bold>G I \<phi>)"
+    then have fb: "future_bounded \<phi>"
+      by simp
+    obtain b where b_def: "right I = enat b"
+      using fb_always by (atomize_elim, cases "right I") auto
+    define j where j_def: "j = LTP \<sigma> (\<tau> \<sigma> i + b)"
+    obtain mypick where mypick_def: "\<forall>k \<in> {ETP_f \<sigma> i I .. j}. s_at (mypick k) = k \<and> s_check v \<phi> (mypick k)"
+      using SAlways fb_always unfolding b_def j_def enat.simps
+      by atomize_elim (rule bchoice, simp)
+    then obtain sps where sps_def: "map (s_at) sps = [ETP_f \<sigma> i I ..< Suc j] \<and> (\<forall>sp \<in> set sps. s_check v \<phi> sp)"
+      by atomize_elim (auto intro!: trans[OF list.map_cong list.map_id] exI[of _ "map mypick ([ETP_f \<sigma> i I ..< Suc j])"])
+    then have "s_at (SAlways i j sps) = i \<and> s_check v (\<^bold>G I \<phi>) (SAlways i j sps)"
+      using SAlways b_def j_def by simp
+    then show "\<exists>sp. s_at sp = i \<and> s_check v (\<^bold>G I \<phi>) sp"
+      by blast
+  qed
+next
+  case (VAlways j i I v \<phi>)
+  then show ?case
+    by (auto simp: Let_def intro: exI[of _ "VAlways i _"])
+next
+  case (SSince j i I v \<psi> \<phi>)
+  show ?case
+  proof
+    assume fb_since: "future_bounded (\<phi> \<^bold>S I \<psi>)"
+    then have fb: "future_bounded \<phi>" "future_bounded \<psi>"
+      by simp_all
+    obtain sp2 where sp2_def: "s_at sp2 = j \<and> s_check v \<psi> sp2"
+      using SSince fb_since by auto
+    {
+      assume "Suc j > i"
+      then have "s_at (SSince sp2 []) = i \<and> s_check v (\<phi> \<^bold>S I \<psi>) (SSince sp2 [])"
+        using sp2_def SSince by auto
+      then have "\<exists>sp. s_at sp = i \<and> s_check v (\<phi> \<^bold>S I \<psi>) sp"
+        by blast
+    }
+    moreover
+    {
+      assume sucj_leq_i: "Suc j \<le> i"
+      obtain mypick where mypick_def: "\<forall>k \<in> {Suc j ..< Suc i}. s_at (mypick k) = k \<and> s_check v \<phi> (mypick k)"
+        using SSince fb_since by atomize_elim (rule bchoice, simp)
+      then obtain sp1s where sp1s_def: "map (s_at) sp1s = [Suc j ..< Suc i] \<and> (\<forall>sp \<in> set sp1s. s_check v \<phi> sp)"
+        by atomize_elim (auto intro!: trans[OF list.map_cong list.map_id] exI[of _ "map mypick ([Suc j ..< Suc i])"])
+      then have "sp1s \<noteq> []"
+        using sucj_leq_i by auto
+      then have "s_at (SSince sp2 sp1s) = i \<and> s_check v (\<phi> \<^bold>S I \<psi>) (SSince sp2 sp1s)"
+        using SSince sucj_leq_i fb sp2_def sp1s_def
+        by (clarsimp simp add:
+          Cons_eq_upt_conv append_eq_Cons_conv map_eq_append_conv
+          split: list.splits) auto
+      then have "\<exists>sp. s_at sp = i \<and> s_check v (\<phi> \<^bold>S I \<psi>) sp"
+        by blast
+    }
+    ultimately show "\<exists>sp. s_at sp = i \<and> s_check v (\<phi> \<^bold>S I \<psi>) sp"
+      using not_less by blast
+  qed
+next
+  case (VSinceOut i I v \<phi> \<psi>)
+  then show ?case
+    by (auto intro!: exI[of _ "VSinceOut i"])
+next
+  case (VSince I i j v \<phi> \<psi>)
+  show ?case
+  proof
+    assume fb_since: "future_bounded (\<phi> \<^bold>S I \<psi>)"
+    then have fb: "future_bounded \<phi>" "future_bounded \<psi>"
+      by simp_all
+    obtain vp1 where vp1_def: "v_at vp1 = j \<and> v_check v \<phi> vp1"
+      using fb_since VSince by auto
+    obtain mypick where mypick_def: "\<forall>k \<in> {j .. LTP_p \<sigma> i I}. v_at (mypick k) = k \<and> v_check v \<psi> (mypick k)"
+      using VSince fb_since by atomize_elim (rule bchoice, simp)
+    then obtain vp2s where vp2s_def: "map (v_at) vp2s = [j ..< Suc (LTP_p \<sigma> i I)] \<and> (\<forall>vp \<in> set vp2s. v_check v \<psi> vp)"
+      by atomize_elim (auto intro!: trans[OF list.map_cong list.map_id] exI[of _ "map mypick ([j ..< Suc (LTP_p \<sigma> i I)])"])
+    then have "v_at (VSince i vp1 vp2s) = i \<and> v_check v (\<phi> \<^bold>S I \<psi>) (VSince i vp1 vp2s)"
+      using vp1_def VSince by auto
+    then show "\<exists>vp. v_at vp = i \<and> v_check v (\<phi> \<^bold>S I \<psi>) vp"
+      by blast
+  qed
+next
+  case (VSinceInf j I i v \<psi> \<phi>)
+  show ?case
+  proof
+    assume fb_since: "future_bounded (\<phi> \<^bold>S I \<psi>)"
+    then have fb: "future_bounded \<phi>" "future_bounded \<psi>"
+      by simp_all
+    obtain mypick where mypick_def: "\<forall>k \<in> {j .. LTP_p \<sigma> i I}. v_at (mypick k) = k \<and> v_check v \<psi> (mypick k)"
+      using VSinceInf fb_since by atomize_elim (rule bchoice, simp)
+    then obtain vp2s where vp2s_def: "map (v_at) vp2s = [j ..< Suc (LTP_p \<sigma> i I)] \<and> (\<forall>vp \<in> set vp2s. v_check v \<psi> vp)"
+      by atomize_elim (auto intro!: trans[OF list.map_cong list.map_id] exI[of _ "map mypick ([j ..< Suc (LTP_p \<sigma> i I)])"])
+    then have "v_at (VSinceInf i j vp2s) = i \<and> v_check v (\<phi> \<^bold>S I \<psi>) (VSinceInf i j vp2s)"
+      using VSinceInf by auto
+    then show "\<exists>vp. v_at vp = i \<and> v_check v (\<phi> \<^bold>S I \<psi>) vp"
+      by blast
+  qed
+next
+  case (SUntil j i I v \<psi> \<phi>)
+  show ?case
+  proof
+    assume fb_until: "future_bounded (\<phi> \<^bold>U I \<psi>)"
+    then have fb: "future_bounded \<phi>" "future_bounded \<psi>"
+      by simp_all
+    obtain sp2 where sp2_def: "s_at sp2 = j \<and> s_check v \<psi> sp2"
+      using fb SUntil by blast
+    {
+      assume "i \<ge> j"
+      then have "s_at (SUntil [] sp2) = i \<and> s_check v (\<phi> \<^bold>U I \<psi>) (SUntil [] sp2)"
+        using sp2_def SUntil by auto
+      then have "\<exists>sp. s_at sp = i \<and> s_check v (\<phi> \<^bold>U I \<psi>) sp"
+        by blast
+    }
+    moreover
+    {
+      assume i_l_j: "i < j"
+      obtain mypick where mypick_def: "\<forall>k \<in> {i ..< j}. s_at (mypick k) = k \<and> s_check v \<phi> (mypick k)"
+        using SUntil fb_until by atomize_elim (rule bchoice, simp)
+      then obtain sp1s where sp1s_def: "map (s_at) sp1s = [i ..< j] \<and> (\<forall>sp \<in> set sp1s. s_check v \<phi> sp)"
+        by atomize_elim (auto intro!: trans[OF list.map_cong list.map_id] exI[of _ "map mypick ([i ..< j])"])
+      then have "s_at (SUntil sp1s sp2) = i \<and> s_check v (\<phi> \<^bold>U I \<psi>) (SUntil sp1s sp2)"
+        using SUntil fb_until sp2_def sp1s_def i_l_j
+        by (clarsimp simp add: append_eq_Cons_conv map_eq_append_conv split: list.splits)
+          (auto simp: Cons_eq_upt_conv dest!: upt_eq_Nil_conv[THEN iffD1, OF sym])
+      then have "\<exists>sp. s_at sp = i \<and> s_check v (\<phi> \<^bold>U I \<psi>) sp"
+        by blast
+    }
+    ultimately show "\<exists>sp. s_at sp = i \<and> s_check v (\<phi> \<^bold>U I \<psi>) sp"
+      using not_less by blast
+  qed
+next
+  case (VUntil I j i v \<phi> \<psi>)
+  show ?case
+  proof
+    assume fb_until: "future_bounded (\<phi> \<^bold>U I \<psi>)"
+    then have fb: "future_bounded \<phi>" "future_bounded \<psi>"
+      by simp_all
+    obtain vp1 where vp1_def: "v_at vp1 = j \<and> v_check v \<phi> vp1"
+      using VUntil fb_until by auto
+    obtain mypick where mypick_def: "\<forall>k \<in> {ETP_f \<sigma> i I .. j}. v_at (mypick k) = k \<and> v_check v \<psi> (mypick k)"
+      using VUntil fb_until by atomize_elim (rule bchoice, simp)
+    then obtain vp2s where vp2s_def: "map (v_at) vp2s = [ETP_f \<sigma> i I ..< Suc j] \<and> (\<forall>vp \<in> set vp2s. v_check v \<psi> vp)"
+      by atomize_elim (auto intro!: trans[OF list.map_cong list.map_id] exI[of _ "map mypick ([ETP_f \<sigma> i I ..< Suc j])"])
+    then have "v_at (VUntil i vp2s vp1) = i \<and> v_check v (\<phi> \<^bold>U I \<psi>) (VUntil i vp2s vp1)"
+      using VUntil fb_until vp1_def by simp
+    then show "\<exists>vp. v_at vp = i \<and> v_check v (\<phi> \<^bold>U I \<psi>) vp"
+      by blast
+  qed
+next
+  case (VUntilInf I i v \<psi> \<phi>)
+  show ?case
+  proof
+    assume fb_until: "future_bounded (\<phi> \<^bold>U I \<psi>)"
+    then have fb: "future_bounded \<phi>" "future_bounded \<psi>"
+      by simp_all
+    obtain b where b_def: "right I = enat b"
+      using fb_until by (atomize_elim, cases "right I") auto
+    define j where j_def: "j = LTP \<sigma> (\<tau> \<sigma> i + b)"
+    obtain mypick where mypick_def: "\<forall>k \<in> {ETP_f \<sigma> i I .. j}. v_at (mypick k) = k \<and> v_check v \<psi> (mypick k)"
+      using VUntilInf fb_until unfolding b_def j_def by atomize_elim (rule bchoice, simp)
+    then obtain vp2s where vp2s_def: "map (v_at) vp2s = [ETP_f \<sigma> i I ..< Suc j] \<and> (\<forall>vp \<in> set vp2s. v_check v \<psi> vp)"
+      by atomize_elim (auto intro!: trans[OF list.map_cong list.map_id] exI[of _ "map mypick ([ETP_f \<sigma> i I ..< Suc j])"])
+    then have "v_at (VUntilInf i j vp2s) = i \<and> v_check v (\<phi> \<^bold>U I \<psi>) (VUntilInf i j vp2s)"
+      using VUntilInf b_def j_def by simp
+    then show "\<exists>vp. v_at vp = i \<and> v_check v (\<phi> \<^bold>U I \<psi>) vp"
+      by blast
+  qed
+qed
+
+lemmas check_completeness =
+  conjunct1[OF check_completeness_aux, rule_format]
+  conjunct2[OF check_completeness_aux, rule_format]
+
+definition "p_check v \<phi> p = (case p of Inl sp \<Rightarrow> s_check v \<phi> sp | Inr vp \<Rightarrow> v_check v \<phi> vp)"
+definition "p_check_exec vs \<phi> p = (case p of Inl sp \<Rightarrow> s_check_exec vs \<phi> sp | Inr vp \<Rightarrow> v_check_exec vs \<phi> vp)"
+
+definition valid :: "('n, 'd) envset \<Rightarrow> nat \<Rightarrow> ('n, 'd) formula \<Rightarrow> ('n, 'd) proof \<Rightarrow> bool" where
+  "valid vs i \<phi> p =
+    (case p of
+      Inl p \<Rightarrow> s_check_exec vs \<phi> p \<and> s_at p = i
+    | Inr p \<Rightarrow> v_check_exec vs \<phi> p \<and> v_at p = i)"
+
+end
+
+subsection \<open>Lifting the Checker to PDTs\<close>
+
+fun check_one where
+  "check_one \<sigma> v \<phi> (Leaf p) = p_check \<sigma> v \<phi> p"
+| "check_one \<sigma> v \<phi> (Node x part) = check_one \<sigma> v \<phi> (lookup_part part (v x))"
+
+fun check_all_aux where
+  "check_all_aux \<sigma> vs \<phi> (Leaf p) = p_check_exec \<sigma> vs \<phi> p"
+| "check_all_aux \<sigma> vs \<phi> (Node x part) = (\<forall>(D, e) \<in> set (subsvals part). check_all_aux \<sigma> (vs(x := D)) \<phi> e)"
+
+fun collect_paths_aux where
+  "collect_paths_aux DS \<sigma> vs \<phi> (Leaf p) = (if p_check_exec \<sigma> vs \<phi> p then {} else rev ` DS)"
+| "collect_paths_aux DS \<sigma> vs \<phi> (Node x part) = (\<Union>(D, e) \<in> set (subsvals part). collect_paths_aux (Cons D ` DS) \<sigma> (vs(x := D)) \<phi> e)"
+
+lemma check_one_cong: "\<forall>x\<in>fv \<phi> \<union> vars e. v x = v' x \<Longrightarrow> check_one \<sigma> v \<phi> e = check_one \<sigma> v' \<phi> e"
+proof (induct e arbitrary: v v')
+  case (Leaf x)
+  then show ?case
+    by (auto simp: p_check_def check_fv_cong split: sum.splits)
+next
+  case (Node x part)
+  from Node(2) have *: "v x = v' x"
+    by simp
+  from Node(2) show ?case
+    unfolding check_one.simps *
+    by (intro Node(1)) auto
+qed
+
+lemma check_all_aux_check_one: "\<forall>x. vs x \<noteq> {} \<Longrightarrow> distinct_paths e \<Longrightarrow> (\<forall>x \<in> vars e. vs x = UNIV) \<Longrightarrow>
+  check_all_aux \<sigma> vs \<phi> e \<longleftrightarrow> (\<forall>v \<in> compatible_vals (fv \<phi>) vs. check_one \<sigma> v \<phi> e)"
+proof (induct e arbitrary: vs)
+  case (Node x part)
+  show ?case
+    unfolding check_all_aux.simps check_one.simps split_beta
+  proof (safe, unfold fst_conv snd_conv, goal_cases LR RL)
+    case (LR v)
+    from Node(2-) fst_lookup[of "v x" part] LR(1)[rule_format, OF lookup_subsvals[of _ "v x"]] LR(2) show ?case
+      by (subst (asm) Node(1))
+         (auto 0 3 simp: compatible_vals_fun_upd dest!: bspec[of _ _ v]
+            elim!: compatible_vals_antimono[THEN set_mp, rotated])
+  next
+    case (RL D e)
+    from RL(2) obtain d where "d \<in> D"
+      by transfer (force simp: partition_on_def image_iff)
+    with RL show ?case
+      using Node(2-) lookup_subsvals[of part d] lookup_part_Vals[of part d]
+        lookup_part_from_subvals[of D e part d]
+    proof (intro Node(1)[THEN iffD2, OF _ _ _ _ ballI], goal_cases _ _ _ _ compatible)
+      case (compatible v)
+      from compatible(2-) compatible(1)[THEN bspec, of "v(x := d)"] compatible(1)[THEN bspec, of v]
+      show ?case
+        using lookup_part_from_subvals[of D e part "v x"]
+          fun_upd_in_compatible_vals_in[of v "fv \<phi>" x vs "v x"]
+          check_one_cong[THEN iffD1, rotated -1, of \<sigma> "v(x := d)" \<phi> e v, simplified]
+        by (auto simp: compatible_vals_fun_upd fun_upd_apply[of _ _ _ x]
+          fun_upd_in_compatible_vals_notin split: if_splits
+          simp del: fun_upd_apply)
+    qed auto
+  qed
+qed (auto simp: p_check_exec_def p_check_def check_exec_check split: sum.splits)
+
+definition check_all :: "('n, 'd :: {default, linorder}) trace \<Rightarrow> ('n, 'd) formula \<Rightarrow> ('n, 'd) expl \<Rightarrow> bool" where
+  "check_all \<sigma> \<phi> e = (distinct_paths e \<and> check_all_aux \<sigma> (\<lambda>_. UNIV) \<phi> e)"
+
+lemma check_one_alt: "check_one \<sigma> v \<phi> e = p_check \<sigma> v \<phi> (eval_pdt v e)"
+  by (induct e) auto
+
+lemma check_all_alt: "check_all \<sigma> \<phi> e = (distinct_paths e \<and> (\<forall>v. p_check \<sigma> v \<phi> (eval_pdt v e)))"
+  unfolding check_all_def
+  by (rule conj_cong[OF refl], subst check_all_aux_check_one)
+    (auto simp: compatible_vals_def check_one_alt)
+
+fun pdt_at where
+  "pdt_at i (Leaf l) = (p_at l = i)"
+| "pdt_at i (Node x part) = (\<forall>pdt \<in> Vals part. pdt_at i pdt)"
+
+lemma pdt_at_p_at_eval_pdt: "pdt_at i e \<Longrightarrow> p_at (eval_pdt v e) = i"
+  by (induct e) auto
+
+lemma check_all_completeness_aux:
+  fixes \<phi> :: "('n, 'd :: {default, linorder}) formula"
+  shows "set vs \<subseteq> fv \<phi> \<Longrightarrow> future_bounded \<phi> \<Longrightarrow> distinct vs \<Longrightarrow>
+  \<exists>e. pdt_at i e \<and> vars_order vs e \<and> (\<forall>v. (\<forall>x. x \<notin> set vs \<longrightarrow> v x = w x) \<longrightarrow> p_check \<sigma> v \<phi> (eval_pdt v e))"
+proof (induct vs arbitrary: w)
+  case Nil
+  then show ?case
+  proof (cases "sat \<sigma> w i \<phi>")
+    case True
+    then have "SAT \<sigma> w i \<phi>" by (rule completeness)
+    with Nil obtain sp where "s_at sp = i" "s_check \<sigma> w \<phi> sp" by (blast dest: check_completeness)
+    then show ?thesis
+      by (intro exI[of _ "Leaf (Inl sp)"]) (auto simp: vars_order.intros p_check_def p_at_def)
+  next
+    case False
+    then have "VIO \<sigma> w i \<phi>" by (rule completeness)
+    with Nil obtain vp where "v_at vp = i" "v_check \<sigma> w \<phi> vp" by (blast dest: check_completeness)
+    then show ?thesis
+      by (intro exI[of _ "Leaf (Inr vp)"]) (auto simp: vars_order.intros p_check_def p_at_def)
+  qed
+next
+  case (Cons x vs)
+  define eq :: "('n \<Rightarrow> 'd) \<Rightarrow> ('n \<Rightarrow> 'd) \<Rightarrow> bool" where "eq = rel_fun (eq_onp (\<lambda>x. x \<notin> set vs)) (=)"
+  from Cons have "\<forall>w. \<exists>e. pdt_at i e \<and> vars_order vs e \<and>
+    (\<forall>v. (\<forall>x. x \<notin> set vs \<longrightarrow> v x = w x) \<longrightarrow> p_check \<sigma> v \<phi> (eval_pdt v e))" by simp
+  then obtain pick :: "'d \<Rightarrow> ('n, 'd) expl" where pick: "pdt_at i (pick a)" "vars_order vs (pick a)" and
+    eq_pick: "\<And>v. eq v (w(x := a)) \<Longrightarrow> p_check \<sigma> v \<phi> (eval_pdt v (pick a))" for a
+    unfolding eq_def rel_fun_def eq_onp_def choice_iff
+  proof (atomize_elim, elim exE, goal_cases pick_val)
+    case (pick_val f)
+    then show ?case
+      by (auto intro!: exI[of _ "\<lambda>a. f (w(x := a))"])
+  qed
+  let ?a = "SOME z. z \<notin> AD \<sigma> \<phi> i"
+  let ?AD = "sorted_list_of_set (AD \<sigma> \<phi> i)"
+  show ?case
+  proof (intro exI[of _ "Node x (tabulate ?AD pick (pick ?a))"] conjI allI impI,
+    goal_cases pdt_at vars_order p_check)
+    case (p_check w')
+    have "w' x \<notin> AD \<sigma> \<phi> i \<Longrightarrow> ?a \<notin> AD \<sigma> \<phi> i"
+      by (metis some_eq_imp)
+    moreover have "eq (w'(x := ?a)) (w(x := ?a))"
+      using p_check by (auto simp: eq_def rel_fun_def eq_onp_def)
+    moreover have "eq w' (w(x := w' x))"
+      using p_check by (auto simp: eq_def rel_fun_def eq_onp_def)
+    ultimately show ?case
+      using pick Cons(2-) eq_pick[of w' "w' x"] eq_pick[of "w'(x := ?a)" ?a]
+        pdt_at_p_at_eval_pdt[of "i" "pick ?a" w'] eval_pdt_fun_upd[of vs "pick ?a" x w' ?a]
+      by (auto simp: p_check_def p_at_def
+        elim!: check_AD_cong[THEN iffD1, rotated -1, of _ _ _ _ _ i]
+        split: if_splits sum.splits sum.splits)
+  qed (use Cons(2-) pick in \<open>simp_all add: vars_order.intros\<close>)
+qed
+
+lemma check_all_completeness:
+  fixes \<phi> :: "('n, 'd :: {default, linorder}) formula"
+  assumes "future_bounded \<phi>"
+  shows "\<exists>e. pdt_at i e \<and> check_all \<sigma> \<phi> e"
+proof -
+  obtain vs where vs[simp]: "distinct vs" "set vs = fv \<phi>"
+    by (meson finite_distinct_list finite_fv)
+  have s: "s_check \<sigma> v \<phi> sp"
+    if "vars_order vs e"
+    and "\<forall>v. (\<forall>sp. eval_pdt v e = Inl sp \<longrightarrow> (\<exists>x. x \<notin> fv \<phi> \<and> v x \<noteq> undefined) \<or> s_check \<sigma> v \<phi> sp) \<and>
+             (\<forall>vp. eval_pdt v e = Inr vp \<longrightarrow> (\<exists>x. x \<notin> fv \<phi> \<and> v x \<noteq> undefined) \<or> v_check \<sigma> v \<phi> vp)"
+    and "eval_pdt v e = Inl sp" for e v sp
+    using that eval_pdt_cong[of e v "\<lambda>x. if x \<in> fv \<phi> then v x else undefined"]
+      check_fv_cong[of \<phi> v "\<lambda>x. if x \<in> fv \<phi> then v x else undefined"]
+    by (auto dest!: spec[of _ sp] vars_order_vars simp: subset_eq)
+  have v: "v_check \<sigma> v \<phi> vp"
+    if "vars_order vs e"
+    and "\<forall>v. (\<forall>sp. eval_pdt v e = Inl sp \<longrightarrow> (\<exists>x. x \<notin> fv \<phi> \<and> v x \<noteq> undefined) \<or> s_check \<sigma> v \<phi> sp) \<and>
+             (\<forall>vp. eval_pdt v e = Inr vp \<longrightarrow> (\<exists>x. x \<notin> fv \<phi> \<and> v x \<noteq> undefined) \<or> v_check \<sigma> v \<phi> vp)"
+    and "eval_pdt v e = Inr vp" for e v vp
+    using that eval_pdt_cong[of e v "\<lambda>x. if x \<in> fv \<phi> then v x else undefined"]
+      check_fv_cong[of \<phi> v "\<lambda>x. if x \<in> fv \<phi> then v x else undefined"]
+    by (auto dest!: spec[of _ vp] vars_order_vars simp: subset_eq)
+  show ?thesis
+    using check_all_completeness_aux[of vs \<phi> i "\<lambda>_. undefined" \<sigma>] assms
+    unfolding check_all_alt p_check_def
+    by (auto elim!: exI [where P = "\<lambda>x. _ x \<and> _ x" , OF conjI] simp: vars_order_distinct_paths split: sum.splits intro: s v)
+qed
+
+lemma check_all_soundness_aux: "check_all \<sigma> \<phi> e \<Longrightarrow> p = eval_pdt v e \<Longrightarrow> isl p \<longleftrightarrow> sat \<sigma> v (p_at p) \<phi>"
+  unfolding check_all_alt
+  by (auto simp: isl_def p_check_def p_at_def dest!: spec[of _ v]
+    dest: check_soundness soundness split: sum.splits)
+
+lemma check_all_soundness: "check_all \<sigma> \<phi> e \<Longrightarrow> pdt_at i e \<Longrightarrow> isl (eval_pdt v e) \<longleftrightarrow> sat \<sigma> v i \<phi>"
+  by (drule check_all_soundness_aux[OF _ refl, of _ _ _ v]) (auto simp: pdt_at_p_at_eval_pdt)
+
+unbundle MFOTL_no_notation \<comment> \<open> disable notation \<close>
+
+(*<*)
+end
+(*>*)
\ No newline at end of file
diff --git a/thys/MFOTL_Checker/Checker_Code.thy b/thys/MFOTL_Checker/Checker_Code.thy
new file mode 100644
--- /dev/null
+++ b/thys/MFOTL_Checker/Checker_Code.thy
@@ -0,0 +1,868 @@
+(*<*)
+theory Checker_Code
+  imports 
+    Checker Event_Data 
+    "HOL-Library.Code_Target_Nat" 
+    "HOL.String"
+    "HOL-Library.List_Lexorder" 
+    "HOL-Library.AList_Mapping"
+    "HOL-Library.Cardinality"
+begin
+(*>*)
+
+section \<open>Code Generation\<close>
+
+subsection \<open>Type Class Instances\<close>
+
+class universe =
+  fixes universe :: "'a list option"
+  assumes infinite: "universe = None \<Longrightarrow> infinite (UNIV :: 'a set)"
+  and finite: "universe = Some xs \<Longrightarrow> distinct xs \<and> set xs = UNIV"
+begin
+
+lemma finite_coset: "finite (List.coset (xs :: 'a list)) = (case universe of None \<Rightarrow> False | _ \<Rightarrow> True)"
+  using infinite finite
+  by (auto split: option.splits dest!: equalityD2 elim!: finite_subset)
+
+end
+
+declare [[code drop: finite]]
+declare finite_set[THEN eqTrueI, code] finite_coset[code]
+
+instantiation bool :: universe begin
+definition universe_bool :: "bool list option" where "universe_bool = Some [True, False]"
+instance by standard (auto simp: universe_bool_def)
+end
+instantiation char :: universe begin
+definition universe_char :: "char list option" where "universe_char = Some (map char_of [0::nat..<256])"
+instance by standard (use UNIV_char_of_nat in \<open>auto simp: universe_char_def distinct_map\<close>)
+end
+instantiation nat :: universe begin
+definition universe_nat :: "nat list option" where "universe_nat = None"
+instance by standard (auto simp: universe_nat_def)
+end
+instantiation list :: (type) universe begin
+definition universe_list :: "'a list list option" where "universe_list = None"
+instance by standard (auto simp: universe_list_def infinite_UNIV_listI)
+end
+instantiation String.literal :: universe begin
+definition universe_literal :: "String.literal list option" where "universe_literal = None"
+instance by standard (auto simp: universe_literal_def infinite_literal)
+end
+instantiation string8 :: universe begin
+definition universe_string8 :: "string8 list option" where "universe_string8 = None"
+lemma UNIV_string8: "UNIV = Abs_string8 ` UNIV"
+  by (auto simp: image_iff intro: Abs_string8_cases)
+instance by standard
+  (auto simp: universe_string8_def UNIV_string8 finite_image_iff Abs_string8_inject inj_on_def infinite_UNIV_listI)
+end
+instantiation prod :: (universe, universe) universe begin
+definition universe_prod :: "('a \<times> 'b) list option" where "universe_prod =
+  (case (universe, universe) of (Some xs, Some ys) \<Rightarrow> Some (List.product xs ys) | _ \<Rightarrow> None)"
+instance by standard
+  (auto simp: universe_prod_def finite_prod distinct_product infinite finite split: option.splits)
+end
+instantiation sum :: (universe, universe) universe begin
+definition universe_sum :: "('a + 'b) list option" where "universe_sum =
+  (case (universe, universe) of (Some xs, Some ys) \<Rightarrow> Some (map Inl xs @ map Inr ys) | _ \<Rightarrow> None)"
+instance by standard
+  (use UNIV_sum in \<open>auto simp: universe_sum_def distinct_map infinite finite split: option.splits\<close>)
+end
+instantiation option :: (universe) universe begin
+definition "universe_option = (case universe of Some xs \<Rightarrow> Some (None # map Some xs) | _ \<Rightarrow> None)"
+instance by standard (auto simp: universe_option_def distinct_map finite infinite image_iff split: option.splits)
+end
+instantiation "fun" :: (universe, universe) universe begin
+definition universe_fun :: "('a \<Rightarrow> 'b) list option" where "universe_fun = 
+  (case (universe, universe) of
+    (Some xs, Some ys) \<Rightarrow> Some (map (\<lambda>zs. the \<circ> map_of (zip xs zs)) (List.n_lists (length xs) ys))
+  | (_, Some [x]) \<Rightarrow> Some [\<lambda>_. x]
+  | _ \<Rightarrow> None)"
+instance
+proof -
+  have 1: False if "infinite (UNIV::'a set)" "CARD('b) = Suc 0" "a \<noteq> b" for a b :: 'b
+    using that by (metis (full_types) UNIV_I card_1_singleton_iff singletonD)
+  have 2: "ys = zs"
+    if "distinct (xs::'a list)" and "length ys = length xs" and "length zs = length xs"
+    and "\<forall>a. the (map_of (zip xs ys) a) = the (map_of (zip xs zs) a)"
+    for xs :: "'a list" and ys zs :: "'b list"
+    using that by (metis map_fst_zip map_of_eqI map_of_zip_inject map_of_zip_is_None option.expand)
+  have 3: "\<exists>zs. length zs = length xs \<and> set zs \<subseteq> set ys \<and> (\<forall>x. f x = the (map_of (zip xs zs) x))"
+    if "\<forall>x. x \<in> set xs" "\<forall>x. x \<in> set ys"
+    for xs ys and f :: "'a \<Rightarrow> 'b"
+    using that by (metis length_map map_of_zip_map option.sel subsetI)
+  show "OFCLASS('a \<Rightarrow> 'b, universe_class)"
+    by standard
+      (auto 0 3 simp: universe_fun_def set_eq_iff fun_eq_iff image_iff set_n_lists distinct_map
+        inj_on_def distinct_n_lists finite_UNIV_fun dest!: infinite finite
+        split: option.splits list.splits intro: 1 2 3)
+qed
+end
+instantiation event_data :: universe begin
+definition universe_event_data :: "event_data list option" where "universe_event_data = None"  
+instance by standard (simp_all add: infinite_UNIV_event_data universe_event_data_def)
+end
+
+instantiation nat :: default begin
+definition default_nat :: nat where "default_nat = 0"
+instance proof qed
+end
+
+instantiation list :: (type) default begin
+definition default_list :: "'a list" where "default_list = []"
+instance proof qed
+end
+
+instance event_data :: equal by standard
+
+instantiation String.literal :: default begin
+definition default_literal :: String.literal where "default_literal = 0"
+instance proof qed
+end
+
+instantiation event_data :: card_UNIV begin
+definition "finite_UNIV = Phantom(event_data) False"
+definition "card_UNIV = Phantom(event_data) 0"
+instance by intro_classes (simp_all add: finite_UNIV_event_data_def card_UNIV_event_data_def infinite_UNIV_event_data)
+end
+
+subsection \<open>Progress\<close>
+
+primrec progress :: "('n, 'd) trace \<Rightarrow> ('n, 'd) Formula.formula \<Rightarrow> nat \<Rightarrow> nat" where
+  "progress \<sigma> Formula.TT j = j"
+| "progress \<sigma> Formula.FF j = j"
+| "progress \<sigma> (Formula.Eq_Const _ _) j = j"
+| "progress \<sigma> (Formula.Pred _ _) j = j"
+| "progress \<sigma> (Formula.Neg \<phi>) j = progress \<sigma> \<phi> j"
+| "progress \<sigma> (Formula.Or \<phi> \<psi>) j = min (progress \<sigma> \<phi> j) (progress \<sigma> \<psi> j)"
+| "progress \<sigma> (Formula.And \<phi> \<psi>) j = min (progress \<sigma> \<phi> j) (progress \<sigma> \<psi> j)"
+| "progress \<sigma> (Formula.Imp \<phi> \<psi>) j = min (progress \<sigma> \<phi> j) (progress \<sigma> \<psi> j)"
+| "progress \<sigma> (Formula.Iff \<phi> \<psi>) j = min (progress \<sigma> \<phi> j) (progress \<sigma> \<psi> j)"
+| "progress \<sigma> (Formula.Exists _ \<phi>) j = progress \<sigma> \<phi> j"
+| "progress \<sigma> (Formula.Forall _ \<phi>) j = progress \<sigma> \<phi> j"
+| "progress \<sigma> (Formula.Prev I \<phi>) j = (if j = 0 then 0 else min (Suc (progress \<sigma> \<phi> j)) j)"
+| "progress \<sigma> (Formula.Next I \<phi>) j = progress \<sigma> \<phi> j - 1"
+| "progress \<sigma> (Formula.Once I \<phi>) j = progress \<sigma> \<phi> j"
+| "progress \<sigma> (Formula.Historically I \<phi>) j = progress \<sigma> \<phi> j"
+| "progress \<sigma> (Formula.Eventually I \<phi>) j =
+    Inf {i. \<forall>k. k < j \<and> k \<le> (progress \<sigma> \<phi> j) \<longrightarrow> (\<tau> \<sigma> k - \<tau> \<sigma> i) \<le> right I}"
+| "progress \<sigma> (Formula.Always I \<phi>) j =
+    Inf {i. \<forall>k. k < j \<and> k \<le> (progress \<sigma> \<phi> j) \<longrightarrow> (\<tau> \<sigma> k - \<tau> \<sigma> i) \<le> right I}"
+| "progress \<sigma> (Formula.Since \<phi> I \<psi>) j = min (progress \<sigma> \<phi> j) (progress \<sigma> \<psi> j)"
+| "progress \<sigma> (Formula.Until \<phi> I \<psi>) j =
+    Inf {i. \<forall>k. k < j \<and> k \<le> min (progress \<sigma> \<phi> j) (progress \<sigma> \<psi> j) \<longrightarrow> (\<tau> \<sigma> k - \<tau> \<sigma> i) \<le> right I}"
+
+lemma Inf_Min:
+  fixes P :: "nat \<Rightarrow> bool"
+  assumes "P j"
+  shows "Inf (Collect P) = Min (Set.filter P {..j})"
+  using Min_in[where ?A="Set.filter P {..j}"] assms
+  by (auto simp: Set.filter_def intro: cInf_lower intro!: antisym[OF _ Min_le])
+    (metis Inf_nat_def1 empty_iff mem_Collect_eq)
+
+lemma progress_Eventually_code: "progress \<sigma> (Formula.Eventually I \<phi>) j =
+  (let m = min j (Suc (progress \<sigma> \<phi> j)) - 1 in Min (Set.filter (\<lambda>i. enat (\<delta> \<sigma> m i) \<le> right I) {..j}))"
+proof -
+  define P where "P \<equiv> (\<lambda>i. \<forall>k. k < j \<and> k \<le> (progress \<sigma> \<phi> j) \<longrightarrow> enat (\<delta> \<sigma> k i) \<le> right I)"
+  have P_j: "P j"
+    by (auto simp: P_def enat_0)
+  have all_wit: "(\<forall>k \<in> {..<m}. enat (\<delta> \<sigma> k i) \<le> right I) \<longleftrightarrow> (enat (\<delta> \<sigma> (m - 1) i) \<le> right I)" for i m
+  proof (cases m)
+    case (Suc ma)
+    have "k < Suc ma \<Longrightarrow> \<delta> \<sigma> k i \<le> \<delta> \<sigma> ma i" for k
+      using \<tau>_mono
+      unfolding less_Suc_eq_le
+      by (rule diff_le_mono)
+    then show ?thesis
+      by (auto simp: Suc) (meson order.trans enat_ord_simps(1))
+  qed (auto simp: enat_0)
+  show ?thesis
+    unfolding progress.simps Let_def P_def[symmetric] Inf_Min[where ?P=P, OF P_j] all_wit[symmetric]
+    by (fastforce simp: P_def intro: arg_cong[where ?f=Min])
+qed
+
+lemma progress_Always_code: "progress \<sigma> (Formula.Always I \<phi>) j =
+  (let m = min j (Suc (progress \<sigma> \<phi> j)) - 1 in Min (Set.filter (\<lambda>i. enat (\<delta> \<sigma> m i) \<le> right I) {..j}))"
+proof -
+  define P where "P \<equiv> (\<lambda>i. \<forall>k. k < j \<and> k \<le> (progress \<sigma> \<phi> j) \<longrightarrow> enat (\<delta> \<sigma> k i) \<le> right I)"
+  have P_j: "P j"
+    by (auto simp: P_def enat_0)
+  have all_wit: "(\<forall>k \<in> {..<m}. enat (\<delta> \<sigma> k i) \<le> right I) \<longleftrightarrow> (enat (\<delta> \<sigma> (m - 1) i) \<le> right I)" for i m
+  proof (cases m)
+    case (Suc ma)
+    have "k < Suc ma \<Longrightarrow> \<delta> \<sigma> k i \<le> \<delta> \<sigma> ma i" for k
+      using \<tau>_mono
+      unfolding less_Suc_eq_le
+      by (rule diff_le_mono)
+    then show ?thesis
+      by (auto simp: Suc) (meson order.trans enat_ord_simps(1))
+  qed (auto simp: enat_0)
+  show ?thesis
+    unfolding progress.simps Let_def P_def[symmetric] Inf_Min[where ?P=P, OF P_j] all_wit[symmetric]
+    by (fastforce simp: P_def intro: arg_cong[where ?f=Min])
+qed
+
+lemma progress_Until_code: "progress \<sigma> (Formula.Until \<phi> I \<psi>) j =
+  (let m = min j (Suc (min (progress \<sigma> \<phi> j) (progress \<sigma> \<psi> j))) - 1 in Min (Set.filter (\<lambda>i. enat (\<delta> \<sigma> m i) \<le> right I) {..j}))"
+proof -
+  define P where "P \<equiv> (\<lambda>i. \<forall>k. k < j \<and> k \<le> min (progress \<sigma> \<phi> j) (progress \<sigma> \<psi> j) \<longrightarrow> enat (\<delta> \<sigma> k i) \<le> right I)"
+  have P_j: "P j"
+    by (auto simp: P_def enat_0)
+  have all_wit: "(\<forall>k \<in> {..<m}. enat (\<delta> \<sigma> k i) \<le> right I) \<longleftrightarrow> (enat (\<delta> \<sigma> (m - 1) i) \<le> right I)" for i m
+  proof (cases m)
+    case (Suc ma)
+    have "k < Suc ma \<Longrightarrow> \<delta> \<sigma> k i \<le> \<delta> \<sigma> ma i" for k
+      using \<tau>_mono
+      unfolding less_Suc_eq_le
+      by (rule diff_le_mono)
+    then show ?thesis
+      by (auto simp: Suc) (meson order.trans enat_ord_simps(1))
+  qed (auto simp: enat_0)
+  show ?thesis
+    unfolding progress.simps Let_def P_def[symmetric] Inf_Min[where ?P=P, OF P_j] all_wit[symmetric]
+    by (fastforce simp: P_def intro: arg_cong[where ?f=Min])
+qed
+
+lemmas progress_code[code] = progress.simps(1-15) progress_Eventually_code progress_Always_code progress.simps(18) progress_Until_code
+
+subsection \<open>Trace\<close>
+
+lemma snth_Stream_eq: "(x ## s) !! n = (case n of 0 \<Rightarrow> x | Suc m \<Rightarrow> s !! m)"
+  by (cases n) auto
+
+lemma extend_is_stream: 
+  assumes "sorted (map snd list)"
+  and "\<And>x. x \<in> set list \<Longrightarrow> snd x \<le> m"
+  and "\<And>x. x \<in> set list \<Longrightarrow> finite (fst x)"
+  shows "ssorted (smap snd (list @- smap (\<lambda>n. ({}, n + m)) nats)) \<and>
+    sincreasing (smap snd (list @- smap (\<lambda>n. ({}, n + m)) nats)) \<and>
+    sfinite (smap fst (list @- smap (\<lambda>n. ({}, n + m)) nats))"
+proof -
+  have A: "\<forall>x\<in>set list. n \<le> snd x \<Longrightarrow> n \<le> m \<Longrightarrow>
+    n \<le> (map snd list @- smap (\<lambda>x. x + m) nats) !! i" for n i 
+    and list :: "('a set \<times> nat) list"
+  proof (induction i arbitrary: n)
+    case (Suc i)
+    then show ?case
+      by (auto simp: shift_snth nth_tl)
+  qed (auto simp add: list.map_sel(1))
+  then have "ssorted (smap snd (list @- smap (\<lambda>n. ({}, n + m)) nats))"
+    using assms
+      by (induction list) (auto simp: stream.map_comp o_def ssorted_iff_mono snth_Stream_eq
+        split: nat.splits)
+  moreover have "sincreasing (smap snd (list @- smap (\<lambda>n. ({}, n + m)) nats))"
+    using assms
+  proof (induction list)
+    case Nil
+    then show ?case
+      by (simp add: sincreasing_def) presburger
+  next
+    case (Cons a as)
+    have IH: "\<And>x. \<exists>i. x < smap snd (as @- smap (\<lambda>n. ({}, n + m)) nats) !! i"
+      using Cons
+      by (simp add: sincreasing_def)
+    show ?case
+      using IH
+      by (simp add: sincreasing_def) 
+        (metis snth_Stream)
+  qed
+  moreover have "sfinite (smap fst (list @- smap (\<lambda>n. ({}, n + m)) nats))"
+    using assms(3)
+  proof (induction list)
+    case Nil
+    then show ?case by (simp add: sfinite_def)
+  next
+    case (Cons a as)
+    then have fin: "finite (fst a)"
+      by simp
+    show ?case
+      using Cons 
+      by (auto simp add: sfinite_def snth_Stream_eq split: nat.splits)
+  qed
+  ultimately show ?thesis
+    by simp
+qed
+
+typedef 'a trace_mapping = "{(n, m, t) :: (nat \<times> nat \<times> (nat, 'a set \<times> nat) mapping) |
+  n m t. Mapping.keys t = {..<n} \<and>
+  sorted (map (snd \<circ> (the \<circ> Mapping.lookup t)) [0..<n]) \<and>
+  (case n of 0 \<Rightarrow> True | Suc n' \<Rightarrow> (case Mapping.lookup t n' of Some (X', t') \<Rightarrow> t' \<le> m | None \<Rightarrow> False)) \<and> 
+  (\<forall>n' < n. case Mapping.lookup t n' of Some (X', t') \<Rightarrow> finite X' | None \<Rightarrow> False)}"
+  by (rule exI[of _ "(0, 0, Mapping.empty)"]) auto
+
+setup_lifting type_definition_trace_mapping
+
+lemma lookup_bulkload_Some: "i < length list \<Longrightarrow>
+  Mapping.lookup (Mapping.bulkload list) i = Some (list ! i)"
+  by transfer auto
+
+lift_definition trace_mapping_of_list :: "('a set \<times> nat) list \<Rightarrow> 'a trace_mapping" is
+  "\<lambda>xs. if sorted (map snd xs) \<and> (\<forall>x \<in> set xs. finite (fst x)) then (if xs = [] then (0, 0, Mapping.empty)
+  else (length xs, snd (last xs), Mapping.bulkload xs))
+  else (0, 0, Mapping.empty)"
+  by (auto simp: lookup_bulkload_Some sorted_iff_nth_Suc last_conv_nth
+    list_all_iff in_set_conv_nth Ball_def Bex_def image_iff split: nat.splits)
+
+lift_definition trace_mapping_nth :: "'a trace_mapping \<Rightarrow> nat \<Rightarrow> ('a set \<times> nat)" is
+  "\<lambda>(n, m, t) i. if i < n then the (Mapping.lookup t i) else ({}, (i - n) + m)" .
+
+lift_definition Trace_Mapping :: "'a trace_mapping \<Rightarrow> 'a Trace.trace" is
+  "\<lambda>(n, m, t). map (the \<circ> Mapping.lookup t) [0..<n] @- smap (\<lambda>n. ({} :: 'a set, n + m)) nats"
+proof (goal_cases)
+  case (1 prod)
+  obtain n m t where prod_def: "prod = (n, m, t)"
+    by (cases prod) auto
+  have props: "Mapping.keys t = {..<n}"
+    "sorted (map (snd \<circ> (the \<circ> Mapping.lookup t)) [0..<n])"
+    "(case n of 0 \<Rightarrow> True | Suc n' \<Rightarrow> (case Mapping.lookup t n' of Some (X', t') \<Rightarrow> t' \<le> m | None \<Rightarrow> False))"
+    "(\<forall>n' < n. case Mapping.lookup t n' of Some (X', t') \<Rightarrow> finite X' | None \<Rightarrow> False)"
+    using 1 by (auto simp add: prod_def)
+  have aux: "x \<in> set (map (the \<circ> Mapping.lookup t) [0..<n]) \<Longrightarrow> snd x \<le> m" for x
+    using props(2,3) less_Suc_eq_le
+    by (fastforce simp: sorted_iff_nth_mono split: nat.splits option.splits)
+  have aux2: "x \<in> set (map (the \<circ> Mapping.lookup t) [0..<n]) \<Longrightarrow> finite (fst x)" for x
+    using props(1,4)
+    by (auto split: nat.splits option.splits)
+  show ?case
+    unfolding prod_def prod.case
+    by (rule extend_is_stream[where ?m=m]) (use props aux aux2 in \<open>auto simp: prod_def\<close>)
+qed
+
+code_datatype Trace_Mapping
+
+definition "trace_of_list xs = Trace_Mapping (trace_mapping_of_list xs)"
+
+lemma \<Gamma>_rbt_code[code]: "\<Gamma> (Trace_Mapping t) i = fst (trace_mapping_nth t i)"
+  by transfer (auto split: prod.splits)
+
+lemma \<tau>_rbt_code[code]: "\<tau> (Trace_Mapping t) i = snd (trace_mapping_nth t i)"
+  by transfer (auto split: prod.splits)
+                                       
+lemma trace_mapping_of_list_sound: "sorted (map snd xs) \<and> (\<forall>x \<in> set xs. finite (fst x)) \<Longrightarrow> i < length xs \<Longrightarrow>
+  xs ! i = (\<Gamma> (trace_of_list xs) i, \<tau> (trace_of_list xs) i)"
+  unfolding trace_of_list_def
+  by transfer (auto simp: lookup_bulkload_Some)
+
+subsection \<open>Auxiliary results\<close>
+
+definition "sum_proofs f xs = sum_list (map f xs)"
+
+lemma sum_proofs_empty[simp]: "sum_proofs f [] = 0"
+  by (auto simp: sum_proofs_def)
+
+lemma sum_proofs_fundef_cong[fundef_cong]: "(\<And>x. x \<in> set xs \<Longrightarrow> f x = f' x) \<Longrightarrow>
+  sum_proofs f xs = sum_proofs f' xs"
+  by (induction xs) (auto simp: sum_proofs_def)
+
+lemma sum_proofs_Cons:
+  fixes f :: "'a \<Rightarrow> nat"
+  shows "sum_proofs f (p # qs) = f p + sum_proofs f qs"
+  by (auto simp: sum_proofs_def split: list.splits)
+
+lemma sum_proofs_app:
+  fixes f :: "'a \<Rightarrow> nat"
+  shows "sum_proofs f (qs @ [p]) = f p + sum_proofs f qs"
+  by (auto simp: sum_proofs_def split: list.splits)
+
+context
+  fixes w :: "'n \<Rightarrow> nat"
+begin
+
+function (sequential) s_pred :: "('n, 'd) sproof \<Rightarrow> nat" 
+  and v_pred :: "('n, 'd) vproof \<Rightarrow> nat" where
+  "s_pred (STT _) = 1"
+| "s_pred (SEq_Const _ _ _) = 1"
+| "s_pred (SPred _ r _) = w r"
+| "s_pred (SNeg vp) = (v_pred vp) + 1"
+| "s_pred (SOrL sp1) = (s_pred sp1) + 1"
+| "s_pred (SOrR sp2) = (s_pred sp2) + 1"
+| "s_pred (SAnd sp1 sp2) = (s_pred sp1) + (s_pred sp2) + 1"
+| "s_pred (SImpL vp1) = (v_pred vp1) + 1"
+| "s_pred (SImpR sp2) = (s_pred sp2) + 1"
+| "s_pred (SIffSS sp1 sp2) = (s_pred sp1) + (s_pred sp2) + 1"
+| "s_pred (SIffVV vp1 vp2) = (v_pred vp1) + (v_pred vp2) + 1"
+| "s_pred (SExists _ _ sp) = (s_pred sp) + 1"
+| "s_pred (SForall _ part) = (sum_proofs s_pred (vals part)) + 1"
+| "s_pred (SPrev sp) = (s_pred sp) + 1"
+| "s_pred (SNext sp) = (s_pred sp) + 1"
+| "s_pred (SOnce _ sp) = (s_pred sp) + 1"
+| "s_pred (SEventually _ sp) = (s_pred sp) + 1"
+| "s_pred (SHistorically _ _ sps) = (sum_proofs s_pred sps) + 1"
+| "s_pred (SHistoricallyOut _) = 1"
+| "s_pred (SAlways _ _ sps) = (sum_proofs s_pred sps) + 1"
+| "s_pred (SSince sp2 sp1s) = (sum_proofs s_pred (sp2 # sp1s)) + 1"
+| "s_pred (SUntil sp1s sp2) = (sum_proofs s_pred (sp1s @ [sp2])) + 1"
+| "v_pred (VFF _ ) = 1"
+| "v_pred (VEq_Const _ _ _) = 1"
+| "v_pred (VPred _ r _) = w r"
+| "v_pred (VNeg sp) = (s_pred sp) + 1"
+| "v_pred (VOr vp1 vp2) = ((v_pred vp1) + (v_pred vp2)) + 1"
+| "v_pred (VAndL vp1) = (v_pred vp1) + 1"
+| "v_pred (VAndR vp2) = (v_pred vp2) + 1"
+| "v_pred (VImp sp1 vp2) = ((s_pred sp1) + (v_pred vp2)) + 1"
+| "v_pred (VIffSV sp1 vp2) = ((s_pred sp1) + (v_pred vp2)) + 1"
+| "v_pred (VIffVS vp1 sp2) = ((v_pred vp1) + (s_pred sp2)) + 1"
+| "v_pred (VExists _ part) = (sum_proofs v_pred (vals part)) + 1"
+| "v_pred (VForall _ _ vp) = (v_pred vp) + 1"
+| "v_pred (VPrev vp) = (v_pred vp) + 1"
+| "v_pred (VPrevZ) = 1"
+| "v_pred (VPrevOutL _) = 1"
+| "v_pred (VPrevOutR _) = 1"
+| "v_pred (VNext vp) = (v_pred vp) + 1"
+| "v_pred (VNextOutL _) = 1"
+| "v_pred (VNextOutR _) = 1"
+| "v_pred (VOnceOut _) = 1"
+| "v_pred (VOnce _ _ vps) = (sum_proofs v_pred vps) + 1"
+| "v_pred (VEventually _ _ vps) = (sum_proofs v_pred vps) + 1"
+| "v_pred (VHistorically _ vp) = (v_pred vp) + 1"
+| "v_pred (VAlways _ vp) = (v_pred vp) + 1"
+| "v_pred (VSinceOut _) = 1"
+| "v_pred (VSince _ vp1 vp2s) = (sum_proofs v_pred (vp1 # vp2s)) + 1"
+| "v_pred (VSinceInf _ _ vp2s) = (sum_proofs v_pred vp2s) + 1"
+| "v_pred (VUntil _ vp2s vp1) = (sum_proofs v_pred (vp2s @ [vp1])) + 1"
+| "v_pred (VUntilInf _ _ vp2s) = (sum_proofs v_pred vp2s) + 1"
+  by pat_completeness auto
+termination
+  by (relation "measure (case_sum size size)")
+    (auto simp add: termination_simp)
+
+definition p_pred :: "('n, 'd) proof \<Rightarrow> nat" where
+  "p_pred = case_sum s_pred v_pred"
+
+end
+
+subsection \<open>\<^const>\<open>v_check_exec\<close> setup\<close>
+
+lemma ETP_minus_le_iff: "ETP \<sigma> (\<tau> \<sigma> i - n) \<le> j \<longleftrightarrow> \<delta> \<sigma> i j \<le> n"
+  by (simp add: add.commute i_ETP_tau le_diff_conv)
+
+lemma ETP_minus_gt_iff: "j < ETP \<sigma> (\<tau> \<sigma> i - n) \<longleftrightarrow> \<delta> \<sigma> i j > n"
+  by (meson ETP_minus_le_iff leD le_less_linear)
+
+lemma nat_le_iff_less:
+  fixes n :: nat
+  shows "(j \<le> n) \<longleftrightarrow> (j = 0 \<or> j - 1 < n)"
+  by auto
+
+lemma ETP_minus_eq_iff: "j = ETP \<sigma> (\<tau> \<sigma> i - n) \<longleftrightarrow> ((j = 0 \<or> n < \<delta> \<sigma> i (j - 1)) \<and> \<delta> \<sigma> i j \<le> n)"
+  unfolding eq_iff[of j "ETP \<sigma> (\<tau> \<sigma> i - n)"] nat_le_iff_less[of j] ETP_minus_le_iff ETP_minus_gt_iff
+  by auto
+
+lemma LTP_minus_ge_iff: "\<tau> \<sigma> 0 + n \<le> \<tau> \<sigma> i \<Longrightarrow> j \<le> LTP \<sigma> (\<tau> \<sigma> i - n) \<longleftrightarrow>
+  (case n of 0 \<Rightarrow> \<delta> \<sigma> j i = 0 | _ \<Rightarrow> j \<le> i \<and> \<delta> \<sigma> i j \<ge> n)"
+  using \<tau>_mono[of i j \<sigma>]
+  by (fastforce simp add: i_LTP_tau le_diff_conv2 Suc_le_eq split: nat.splits)
+
+lemma LTP_plus_ge_iff: "j \<le> LTP \<sigma> (\<tau> \<sigma> i + n) \<longleftrightarrow> \<delta> \<sigma> j i \<le> n"
+  by (simp add: add.commute i_LTP_tau le_diff_conv trans_le_add2)
+
+lemma LTP_minus_lt_if:
+  assumes "j \<le> i" "\<tau> \<sigma> 0 + n \<le> \<tau> \<sigma> i" "\<delta> \<sigma> i j < n"
+  shows "LTP \<sigma> (\<tau> \<sigma> i - n) < j"
+proof -
+  have not_in: "k \<notin> {ia. \<tau> \<sigma> ia \<le> \<tau> \<sigma> i - n}" if "j \<le> k" for k
+    using assms \<tau>_mono[OF that, of \<sigma>]
+    by auto
+  then have "{ia. \<tau> \<sigma> ia \<le> \<tau> \<sigma> i - n} \<subseteq> {0..<j}"
+    using not_le_imp_less
+    by (clarsimp; blast)
+  then have "finite {ia. \<tau> \<sigma> ia \<le> \<tau> \<sigma> i - n}"
+    using subset_eq_atLeast0_lessThan_finite
+    by blast
+  moreover have "0 \<in> {ia. \<tau> \<sigma> ia \<le> \<tau> \<sigma> i - n}"
+    using assms(2)
+    by auto
+  ultimately show ?thesis
+    unfolding LTP_def
+    by (metis Max_in not_in empty_iff not_le_imp_less)
+qed
+
+lemma LTP_minus_lt_iff:
+  assumes "\<tau> \<sigma> 0 + n \<le> \<tau> \<sigma> i"
+  shows "LTP \<sigma> (\<tau> \<sigma> i - n) < j \<longleftrightarrow> (if \<not> j \<le> i \<and> n = 0 then \<delta> \<sigma> j i > 0 else \<delta> \<sigma> i j < n)"
+proof (cases "j \<le> i")
+  case True
+  then show ?thesis
+    using assms i_le_LTPi_minus[of \<sigma> n i] LTP_minus_lt_if[of j i \<sigma> n]
+    by (cases n)
+      (auto simp add: i_LTP_tau linorder_not_less Suc_le_eq dest!: tau_LTP_k[rotated])
+next
+  case False
+  have delta: "\<delta> \<sigma> i j = 0"
+    using False
+    by auto
+  show ?thesis
+  proof (cases n)
+    case 0
+    then show ?thesis
+      using False assms
+      by (metis add.right_neutral diff_is_0_eq diff_zero i_LTP_tau linorder_not_less)
+  next
+    case (Suc n')
+    then show ?thesis
+      using False assms
+      by (cases i)
+        (auto simp: Suc_le_eq not_le elim!: order.strict_trans[rotated] intro!: i_le_LTPi_minus)
+  qed
+qed
+
+lemma LTP_minus_eq_iff:
+  assumes "\<tau> \<sigma> 0 + n \<le> \<tau> \<sigma> i"
+  shows "j = LTP \<sigma> (\<tau> \<sigma> i - n) \<longleftrightarrow>
+  (case n of 0 \<Rightarrow> i \<le> j \<and> \<delta> \<sigma> j i = 0 \<and> \<delta> \<sigma> (Suc j) j > 0
+  | _ \<Rightarrow> j \<le> i \<and> n \<le> \<delta> \<sigma> i j \<and> \<delta> \<sigma> i (Suc j) < n)"
+proof (cases n)
+  case 0
+  show ?thesis
+    using assms 0 i_LTP_tau[of \<sigma> "\<tau> \<sigma> i" "LTP \<sigma> (\<tau> \<sigma> i)"]
+      i_LTP_tau[of \<sigma> "\<tau> \<sigma> i" "Suc (LTP \<sigma> (\<tau> \<sigma> i))"] i_LTP_tau[of \<sigma> "\<tau> \<sigma> i" "j"]
+      less_\<tau>D[of \<sigma> "(LTP \<sigma> (\<tau> \<sigma> i))" "Suc j"]
+    by (auto simp: i_le_LTPi not_le elim!: antisym dest!:
+      order_antisym_conv[of "\<tau> \<sigma> i" "\<tau> \<sigma> j", THEN iffD1, rotated]
+      order_antisym_conv[of "\<tau> \<sigma> i" "\<tau> \<sigma> (LTP \<sigma> (\<tau> \<sigma> i))", THEN iffD1, rotated])
+next
+  case (Suc n')
+  show ?thesis
+    using assms
+    by (simp add: Suc eq_iff[of j "LTP \<sigma> (\<tau> \<sigma> i - Suc n')"] less_Suc_eq_le[of "LTP \<sigma> (\<tau> \<sigma> i - Suc n')" j, symmetric] LTP_minus_ge_iff LTP_minus_lt_iff)
+qed
+
+lemma LTP_plus_eq_iff:
+  shows "j = LTP \<sigma> (\<tau> \<sigma> i + n) \<longleftrightarrow> (\<delta> \<sigma> j i \<le> n \<and> \<delta> \<sigma> (Suc j) i > n)"
+  unfolding eq_iff[of j "LTP \<sigma> (\<tau> \<sigma> i + n)"]
+  by (meson LTP_plus_ge_iff linorder_not_less not_less_eq_eq)
+
+lemma LTP_p_def: "\<tau> \<sigma> 0 + left I \<le> \<tau> \<sigma> i \<Longrightarrow> LTP_p \<sigma> i I = (case left I of 0 \<Rightarrow> i | _ \<Rightarrow> LTP \<sigma> (\<tau> \<sigma> i - left I))"
+  using i_le_LTPi by (auto simp: min_def i_LTP_tau split: nat.splits)
+
+definition "check_upt_LTP_p \<sigma> I li xs i \<longleftrightarrow> (case xs of [] \<Rightarrow>
+  (case left I of 0 \<Rightarrow> i < li | Suc n \<Rightarrow>
+    (if \<not> li \<le> i \<and> left I = 0 then 0 < \<delta> \<sigma> li i else \<delta> \<sigma> i li < left I))
+  | _ \<Rightarrow> xs = [li..<li + length xs] \<and>
+    (case left I of 0 \<Rightarrow> li + length xs - 1 = i | Suc n \<Rightarrow>
+      (li + length xs - 1 \<le> i \<and> left I \<le> \<delta> \<sigma> i (li + length xs - 1) \<and> \<delta> \<sigma> i (li + length xs) < left I)))"
+
+lemma check_upt_l_cong:
+  assumes "\<And>j. j \<le> max i li \<Longrightarrow> \<tau> \<sigma> j = \<tau> \<sigma>' j"
+  shows "check_upt_LTP_p \<sigma> I li xs i = check_upt_LTP_p \<sigma>' I li xs i"
+proof -
+  have "li + length ys \<le> i \<Longrightarrow> Suc n \<le> \<delta> \<sigma>' i (li + length ys) \<Longrightarrow>
+    (Suc (li + length ys)) \<le> i" for ys :: "nat list" and n
+    by (cases "li + length ys = i") auto
+  then show ?thesis
+    using assms
+    by (fastforce simp: check_upt_LTP_p_def Let_def simp del: upt.simps split: list.splits nat.splits)
+qed
+
+lemma check_upt_LTP_p_eq:
+  assumes "\<tau> \<sigma> 0 + left I \<le> \<tau> \<sigma> i"
+  shows "xs = [li..<Suc (LTP_p \<sigma> i I)] \<longleftrightarrow> check_upt_LTP_p \<sigma> I li xs i"
+proof -
+  have "li + length xs = Suc (LTP_p \<sigma> i I) \<longleftrightarrow> li + length xs - 1 = LTP_p \<sigma> i I" if "xs \<noteq> []"
+    using that
+    by (cases xs) auto
+  then have "xs = [li..<Suc (LTP_p \<sigma> i I)] \<longleftrightarrow> (xs = [] \<and> LTP_p \<sigma> i I < li) \<or>
+    (xs \<noteq> [] \<and> xs = [li..<li + length xs] \<and> li + length xs - 1 = LTP_p \<sigma> i I)"
+    by auto
+  moreover have "\<dots> \<longleftrightarrow> (xs = [] \<and>
+    (case left I of 0 \<Rightarrow> i < li | Suc n \<Rightarrow>
+      (if \<not> li \<le> i \<and> left I = 0 then 0 < \<delta> \<sigma> li i else \<delta> \<sigma> i li < left I))) \<or>
+    (xs \<noteq> [] \<and> xs = [li..<li + length xs] \<and>
+    (case left I of 0 \<Rightarrow> li + length xs - 1 = i | Suc n \<Rightarrow>
+      (case left I of 0 \<Rightarrow> i \<le> li + length xs - 1 \<and>
+        \<delta> \<sigma> (li + length xs - 1) i = 0 \<and> 0 < \<delta> \<sigma> (Suc (li + length xs - 1)) (li + length xs - 1)
+      | Suc n \<Rightarrow> li + length xs - 1 \<le> i \<and>
+        left I \<le> \<delta> \<sigma> i (li + length xs - 1) \<and> \<delta> \<sigma> i (Suc (li + length xs - 1)) < left I)))"
+    using LTP_p_def[OF assms, symmetric]
+    unfolding LTP_minus_lt_iff[OF assms, symmetric]
+    unfolding LTP_minus_eq_iff[OF assms, symmetric]
+    by (auto split: nat.splits)
+  moreover have "\<dots> \<longleftrightarrow> (case xs of [] \<Rightarrow>
+    (case left I of 0 \<Rightarrow> i < li | Suc n \<Rightarrow>
+      (if \<not> li \<le> i \<and> left I = 0 then 0 < \<delta> \<sigma> li i else \<delta> \<sigma> i li < left I))
+    | _ \<Rightarrow> xs = [li..<li + length xs] \<and>
+      (case left I of 0 \<Rightarrow> li + length xs - 1 = i | Suc n \<Rightarrow>
+        (li + length xs - 1 \<le> i \<and> left I \<le> \<delta> \<sigma> i (li + length xs - 1) \<and> \<delta> \<sigma> i (li + length xs) < left I)))"
+    by (auto split: nat.splits list.splits)
+  ultimately show ?thesis
+    unfolding check_upt_LTP_p_def
+    by simp
+qed
+
+lemma v_check_exec_Once_code[code]: "v_check_exec \<sigma> vs (Formula.Once I \<phi>) vp = (case vp of
+  VOnce i li vps \<Rightarrow>
+    (case right I of \<infinity> \<Rightarrow> li = 0 | enat b \<Rightarrow> ((li = 0 \<or> b < \<delta> \<sigma> i (li - 1)) \<and> \<delta> \<sigma> i li \<le> b)) 
+    \<and> \<tau> \<sigma> 0 + left I \<le> \<tau> \<sigma> i
+    \<and> check_upt_LTP_p \<sigma> I li (map v_at vps) i \<and> Ball (set vps) (v_check_exec \<sigma> vs \<phi>)
+  | VOnceOut i \<Rightarrow> \<tau> \<sigma> i < \<tau> \<sigma> 0 + left I 
+  | _ \<Rightarrow> False)"
+  by (auto simp: Let_def check_upt_LTP_p_eq ETP_minus_le_iff ETP_minus_eq_iff split: vproof.splits enat.splits simp del: upt_Suc)
+
+lemma s_check_exec_Historically_code[code]: "s_check_exec \<sigma> vs (Formula.Historically I \<phi>) vp = (case vp of
+  SHistorically i li vps \<Rightarrow>
+    (case right I of \<infinity> \<Rightarrow> li = 0 | enat b \<Rightarrow> ((li = 0 \<or> b < \<delta> \<sigma> i (li - 1)) \<and> \<delta> \<sigma> i li \<le> b))
+    \<and> \<tau> \<sigma> 0 + left I \<le> \<tau> \<sigma> i
+    \<and> check_upt_LTP_p \<sigma> I li (map s_at vps) i \<and> Ball (set vps) (s_check_exec \<sigma> vs \<phi>)
+  | SHistoricallyOut i \<Rightarrow> \<tau> \<sigma> i < \<tau> \<sigma> 0 + left I 
+  | _ \<Rightarrow> False)"
+  by (auto simp: Let_def check_upt_LTP_p_eq ETP_minus_le_iff ETP_minus_eq_iff split: sproof.splits enat.splits simp del: upt_Suc)
+
+lemma v_check_exec_Since_code[code]: "v_check_exec \<sigma> vs (Formula.Since \<phi> I \<psi>) vp = (case vp of
+  VSince i vp1 vp2s \<Rightarrow>
+    let j = v_at vp1 in
+    (case right I of \<infinity> \<Rightarrow> True | enat b \<Rightarrow> \<delta> \<sigma> i j \<le> b) \<and> j \<le> i
+    \<and> \<tau> \<sigma> 0 + left I \<le> \<tau> \<sigma> i
+    \<and> check_upt_LTP_p \<sigma> I j (map v_at vp2s) i
+    \<and> v_check_exec \<sigma> vs \<phi> vp1 \<and> Ball (set vp2s) (v_check_exec \<sigma> vs \<psi>)
+  | VSinceInf i li vp2s \<Rightarrow>
+    (case right I of \<infinity> \<Rightarrow> li = 0 | enat b \<Rightarrow> ((li = 0 \<or> b < \<delta> \<sigma> i (li - 1)) \<and> \<delta> \<sigma> i li \<le> b)) \<and>
+    \<tau> \<sigma> 0 + left I \<le> \<tau> \<sigma> i \<and>
+     check_upt_LTP_p \<sigma> I li (map v_at vp2s) i \<and> Ball (set vp2s) (v_check_exec \<sigma> vs \<psi>)
+  | VSinceOut i \<Rightarrow> \<tau> \<sigma> i < \<tau> \<sigma> 0 + left I 
+  | _ \<Rightarrow> False)"
+  by (auto simp: Let_def check_upt_LTP_p_eq ETP_minus_le_iff ETP_minus_eq_iff split: vproof.splits enat.splits simp del: upt_Suc)
+
+lemma ETP_f_le_iff: "max i (ETP \<sigma> (\<tau> \<sigma> i + a)) \<le> j \<longleftrightarrow> i \<le> j \<and> \<delta> \<sigma> j i \<ge> a"
+  by (metis add.commute max.bounded_iff \<tau>_mono i_ETP_tau le_diff_conv2)
+
+lemma ETP_f_ge_iff: "j \<le> max i (ETP \<sigma> (\<tau> \<sigma> i + n)) \<longleftrightarrow> (case n of 0 \<Rightarrow> j \<le> i
+  | Suc n' \<Rightarrow> (case j of 0 \<Rightarrow> True | Suc j' \<Rightarrow> \<delta> \<sigma> j' i < n))"
+proof (cases n)
+  case 0
+  then show ?thesis
+    by (auto simp: max_def) (metis i_ge_etpi verit_la_disequality)
+next
+  case (Suc n')
+  have max: "max i (ETP \<sigma> (\<tau> \<sigma> i + n)) = ETP \<sigma> (\<tau> \<sigma> i + n)"
+    by (auto simp: max_def Suc)
+       (metis Groups.ab_semigroup_add_class.add.commute ETP_ge less_or_eq_imp_le plus_1_eq_Suc)
+  have "j \<le> max i (ETP \<sigma> (\<tau> \<sigma> i + n)) \<longleftrightarrow> (\<forall>ia. \<tau> \<sigma> i + n \<le> \<tau> \<sigma> ia \<longrightarrow> j \<le> ia)"
+    unfolding max
+    unfolding ETP_def
+    by (meson LeastI_ex Least_le order.trans ex_le_\<tau>)
+  moreover have "\<dots> \<longleftrightarrow> (case j of 0 \<Rightarrow> True | Suc j' \<Rightarrow> \<not>\<tau> \<sigma> i + n \<le> \<tau> \<sigma> j')"
+    by (auto split: nat.splits) (meson i_ETP_tau le_trans not_less_eq_eq)
+  moreover have "\<dots> \<longleftrightarrow> (case j of 0 \<Rightarrow> True | Suc j' \<Rightarrow> \<delta> \<sigma> j' i < n)"
+    by (auto simp: Suc split: nat.splits)
+  ultimately show ?thesis
+    by (auto simp: Suc)
+qed
+
+definition "check_upt_ETP_f \<sigma> I i xs hi \<longleftrightarrow> (let j = Suc hi - length xs in
+  (case xs of [] \<Rightarrow> (case left I of 0 \<Rightarrow> Suc hi \<le> i | Suc n' \<Rightarrow> \<delta> \<sigma> hi i < left I)
+  | _ \<Rightarrow> (xs = [j..<Suc hi] \<and>
+  (case left I of 0 \<Rightarrow> j \<le> i | Suc n' \<Rightarrow>
+  (case j of 0 \<Rightarrow> True | Suc j' \<Rightarrow> \<delta> \<sigma> j' i < left I)) \<and>
+  i \<le> j \<and> left I \<le> \<delta> \<sigma> j i)))"
+
+lemma check_upt_lu_cong:
+  assumes "\<And>j. min i hi \<le> j \<and> j \<le> max i hi \<Longrightarrow> \<tau> \<sigma> j = \<tau> \<sigma>' j"
+  shows "check_upt_ETP_f \<sigma> I i xs hi = check_upt_ETP_f \<sigma>' I i xs hi"
+  using assms
+  unfolding check_upt_ETP_f_def
+  by (auto simp add: Let_def le_Suc_eq split: list.splits nat.splits)
+
+lemma check_upt_ETP_f_eq: "xs = [ETP_f \<sigma> i I..<Suc hi] \<longleftrightarrow> check_upt_ETP_f \<sigma> I i xs hi"
+proof -
+  have F1: "(case left I of 0 \<Rightarrow> Suc hi \<le> i | Suc n' \<Rightarrow> \<delta> \<sigma> hi i < left I) =
+    (Suc hi \<le> ETP_f \<sigma> i I)"
+    unfolding ETP_f_ge_iff[where ?j="Suc hi" and ?n="left I"]
+    by (auto split: nat.splits)
+  have "xs = [ETP_f \<sigma> i I..<Suc hi] \<longleftrightarrow> (let j = Suc hi - length xs in
+    (xs = [] \<and> (case left I of 0 \<Rightarrow> Suc hi \<le> i | Suc n' \<Rightarrow> \<delta> \<sigma> hi i < left I)) \<or>
+    (xs \<noteq> [] \<and> xs = [j..<Suc hi] \<and>
+    (case left I of 0 \<Rightarrow> j \<le> i | Suc n' \<Rightarrow>
+    (case j of 0 \<Rightarrow> True | Suc j' \<Rightarrow> \<delta> \<sigma> j' i < left I)) \<and>
+    i \<le> j \<and> left I \<le> \<delta> \<sigma> j i))"
+    unfolding F1
+    unfolding Let_def
+    unfolding ETP_f_ge_iff[where ?n="left I", symmetric]
+    unfolding ETP_f_le_iff[symmetric]
+    unfolding eq_iff[of _ "ETP_f \<sigma> i I", symmetric]
+    by auto
+  moreover have "\<dots> \<longleftrightarrow> (let j = Suc hi - length xs in
+    (case xs of [] \<Rightarrow> (case left I of 0 \<Rightarrow> Suc hi \<le> i | Suc n' \<Rightarrow> \<delta> \<sigma> hi i < left I)
+    | _ \<Rightarrow> (xs = [j..<Suc hi] \<and>
+    (case left I of 0 \<Rightarrow> j \<le> i | Suc n' \<Rightarrow>
+    (case j of 0 \<Rightarrow> True | Suc j' \<Rightarrow> \<delta> \<sigma> j' i < left I)) \<and>
+    i \<le> j \<and> left I \<le> \<delta> \<sigma> j i)))"
+    by (auto simp: Let_def split: list.splits)
+  finally show ?thesis
+    unfolding check_upt_ETP_f_def .
+qed
+
+lemma v_check_exec_Eventually_code[code]: "v_check_exec \<sigma> vs (Formula.Eventually I \<phi>) vp = (case vp of
+  VEventually i hi vps \<Rightarrow>
+    (case right I of \<infinity> \<Rightarrow> False | enat b \<Rightarrow> (\<delta> \<sigma> hi i \<le> b \<and> b < \<delta> \<sigma> (Suc hi) i)) \<and>
+     check_upt_ETP_f \<sigma> I i (map v_at vps) hi \<and> Ball (set vps) (v_check_exec \<sigma> vs \<phi>)
+  | _ \<Rightarrow> False)"
+  by (auto simp: Let_def LTP_plus_ge_iff LTP_plus_eq_iff check_upt_ETP_f_eq simp del: upt_Suc
+      split: vproof.splits enat.splits)
+
+lemma s_check_exec_Always_code[code]: "s_check_exec \<sigma> vs (Formula.Always I \<phi>) sp = (case sp of
+  SAlways i hi sps \<Rightarrow>
+    (case right I of \<infinity> \<Rightarrow> False | enat b \<Rightarrow> (\<delta> \<sigma> hi i \<le> b \<and> b < \<delta> \<sigma> (Suc hi) i)) 
+    \<and> check_upt_ETP_f \<sigma> I i (map s_at sps) hi \<and> Ball (set sps) (s_check_exec \<sigma> vs \<phi>)
+  | _ \<Rightarrow> False)"
+  by (auto simp: Let_def LTP_plus_ge_iff LTP_plus_eq_iff check_upt_ETP_f_eq simp del: upt_Suc
+      split: sproof.splits enat.splits)
+
+lemma v_check_exec_Until_code[code]: "v_check_exec \<sigma> vs (Formula.Until \<phi> I \<psi>) vp = (case vp of
+  VUntil i vp2s vp1 \<Rightarrow>
+    let j = v_at vp1 in 
+    (case right I of \<infinity> \<Rightarrow> True | enat b \<Rightarrow> j < LTP_f \<sigma> i b)
+    \<and> i \<le> j \<and> check_upt_ETP_f \<sigma> I i (map v_at vp2s) j
+    \<and> v_check_exec \<sigma> vs \<phi> vp1 \<and> Ball (set vp2s) (v_check_exec \<sigma> vs \<psi>)
+ | VUntilInf i hi vp2s \<Rightarrow>
+    (case right I of \<infinity> \<Rightarrow> False | enat b \<Rightarrow> (\<delta> \<sigma> hi i \<le> b \<and> b < \<delta> \<sigma> (Suc hi) i)) \<and>
+     check_upt_ETP_f \<sigma> I i (map v_at vp2s) hi \<and> Ball (set vp2s) (v_check_exec \<sigma> vs \<psi>)
+ | _ \<Rightarrow> False)"
+  by (auto simp: Let_def LTP_plus_ge_iff LTP_plus_eq_iff check_upt_ETP_f_eq simp del: upt_Suc
+      split: vproof.splits enat.splits)
+
+subsection\<open>ETP/LTP setup\<close>
+
+lemma ETP_aux: "\<not> t \<le> \<tau> \<sigma> i \<Longrightarrow> i \<le> (LEAST i. t \<le> \<tau> \<sigma> i)"
+  by (meson LeastI_ex \<tau>_mono ex_le_\<tau> nat_le_linear order_trans)
+
+function ETP_rec where
+  "ETP_rec \<sigma> t i = (if \<tau> \<sigma> i \<ge> t then i else ETP_rec \<sigma> t (i + 1))"
+  by pat_completeness auto
+termination
+  using ETP_aux
+  by (relation "measure (\<lambda>(\<sigma>, t, i). Suc (ETP \<sigma> t) - i)")
+    (fastforce simp: ETP_def)+
+
+lemma ETP_rec_sound: "ETP_rec \<sigma> t j = (LEAST i. i \<ge> j \<and> t \<le> \<tau> \<sigma> i)"
+proof (induction \<sigma> t j rule: ETP_rec.induct)
+  case (1 \<sigma> t i)
+  show ?case
+  proof (cases "\<tau> \<sigma> i \<ge> t")
+    case True
+    then show ?thesis
+      by simp (metis (no_types, lifting) Least_equality order_refl)
+  next
+    case False
+    then show ?thesis
+      using 1[OF False]
+      by (simp add: ETP_rec.simps[of _ _ i] del: ETP_rec.simps)
+         (metis Suc_leD le_antisym not_less_eq_eq)
+  qed
+qed
+
+lemma ETP_code[code]: "ETP \<sigma> t = ETP_rec \<sigma> t 0"
+  using ETP_rec_sound[of \<sigma> t 0]
+  by (auto simp: ETP_def)
+
+lemma LTP_aux:
+  assumes "\<tau> \<sigma> (Suc i) \<le> t"
+  shows "i \<le> Max {i. \<tau> \<sigma> i \<le> t}"
+proof -
+  have "finite {i. \<tau> \<sigma> i \<le> t}"
+    by (smt (verit, del_insts) \<tau>_mono finite_nat_set_iff_bounded_le i_LTP_tau le0 le_trans mem_Collect_eq) 
+  moreover have "i \<in> {i. \<tau> \<sigma> i \<le> t}"
+    using le_trans[OF \<tau>_mono[of i "Suc i" \<sigma>] assms]
+    by auto
+  ultimately show ?thesis
+    by (rule Max_ge)
+qed
+
+function (sequential) LTP_rec where
+  "LTP_rec \<sigma> t i = (if \<tau> \<sigma> (Suc i) \<le> t then LTP_rec \<sigma> t (i + 1) else i)"
+  by pat_completeness auto
+termination
+  using LTP_aux
+  by (relation "measure (\<lambda>(\<sigma>, t, i). Suc (LTP \<sigma> t) - i)") (fastforce simp: LTP_def)+
+
+lemma LTP_rec_sound: "LTP_rec \<sigma> t j = Max ({i. i \<ge> j \<and> (\<tau> \<sigma> i) \<le> t} \<union> {j})"
+proof (induction \<sigma> t j rule: LTP_rec.induct)
+  case (1 \<sigma> t j)
+  have fin: "finite {i. j \<le> i \<and> \<tau> \<sigma> i \<le> t}"
+    by (smt (verit, del_insts) \<tau>_mono finite_nat_set_iff_bounded_le i_LTP_tau le0 le_trans
+        mem_Collect_eq)
+  show ?case
+  proof (cases "\<tau> \<sigma> (Suc j) \<le> t")
+    case True
+    have diffI: "{i. Suc j \<le> i \<and> \<tau> \<sigma> i \<le> t} = {i. j \<le> i \<and> \<tau> \<sigma> i \<le> t} - {j}"
+      by auto
+    show ?thesis
+      using 1[OF True] True fin
+      by (auto simp del: LTP_rec.simps simp add: LTP_rec.simps[of _ _ j] diffI intro: max_aux)
+  next
+    case False
+    then show ?thesis
+      using fin
+      by (auto simp: not_le intro!: Max_insert2[symmetric]
+        dest!: order.strict_trans1 less_\<tau>D)
+  qed
+qed
+
+lemma LTP_code[code]: "LTP \<sigma> t = (if t < \<tau> \<sigma> 0
+  then Code.abort (STR ''LTP: undefined'') (\<lambda>_. LTP \<sigma> t)
+  else LTP_rec \<sigma> t 0)"
+  using LTP_rec_sound[of \<sigma> t 0]
+  by (auto simp: LTP_def insert_absorb simp del: LTP_rec.simps)
+
+lemma map_part_code[code]: "Rep_part (map_part f xs) = map (map_prod id f) (Rep_part xs)"
+  using Rep_part[of xs]
+  by (auto simp: map_part_def intro!: Abs_part_inverse)
+
+lemma coset_subset_set_code[code]:
+  "(List.coset (xs :: _ :: universe list) \<subseteq> set ys) = (case universe of None \<Rightarrow> False
+  | Some zs \<Rightarrow> \<forall>z \<in> set zs. z \<in> set xs \<or> z \<in> set ys)"
+  using finite_compl finite_subset
+  by (auto split: option.splits dest!: infinite finite)
+
+lemma is_empty_coset[code]: "Set.is_empty (List.coset (xs :: _ :: universe list)) =
+  (case universe of None \<Rightarrow> False
+  | Some zs \<Rightarrow> \<forall>z \<in> set zs. z \<in> set xs)"
+  using coset_subset_set_code[of xs] by (auto simp: Set.is_empty_def split: option.splits dest: infinite finite)
+
+subsection \<open>Exported functions\<close>
+
+type_synonym name = string8
+
+declare Formula.future_bounded.simps[code]
+
+definition collect_paths :: "('n, 'd :: {default, linorder}) trace \<Rightarrow> ('n, 'd) formula \<Rightarrow> ('n, 'd) expl \<Rightarrow> 'd set list set option" where
+  "collect_paths \<sigma> \<phi> e = (if (distinct_paths e \<and> check_all_aux \<sigma> (\<lambda>_. UNIV) \<phi> e) then None else Some (collect_paths_aux {[]} \<sigma> (\<lambda>_. UNIV) \<phi> e))"
+
+definition check :: "(name, event_data) trace \<Rightarrow> (name, event_data) formula \<Rightarrow> (name, event_data) expl \<Rightarrow> bool" where
+  "check = check_all"
+
+definition collect_paths_specialized :: "(name, event_data) trace \<Rightarrow> (name, event_data) formula \<Rightarrow> (name, event_data) expl \<Rightarrow> event_data set list set option" where
+  "collect_paths_specialized = collect_paths"
+
+definition trace_of_list_specialized :: "((name \<times> event_data list) set \<times> nat) list \<Rightarrow> (name, event_data) trace" where
+  "trace_of_list_specialized xs = trace_of_list xs"
+
+definition specialized_set :: "(name \<times> event_data list) list \<Rightarrow> (name \<times> event_data list) set" where
+  "specialized_set = set"
+
+definition ed_set :: "event_data list \<Rightarrow> event_data set" where
+  "ed_set = set"
+
+definition sum_nat :: "nat \<Rightarrow> nat \<Rightarrow> nat" where
+  "sum_nat m n = m + n"
+
+definition sub_nat :: "nat \<Rightarrow> nat \<Rightarrow> nat" where
+  "sub_nat m n = m - n"
+
+lift_definition abs_part :: "(event_data set \<times> 'a) list \<Rightarrow> (event_data, 'a) part" is
+  "\<lambda>xs.
+   let Ds = map fst xs in
+   if {} \<in> set Ds
+   \<or> (\<exists>D \<in> set Ds. \<exists>E \<in> set Ds. D \<noteq> E \<and> D \<inter> E \<noteq> {})
+   \<or> \<not> distinct Ds
+   \<or> (\<Union>D \<in> set Ds. D) \<noteq> UNIV then [(UNIV, undefined)] else xs"
+  by (auto simp: partition_on_def disjoint_def)
+
+export_code interval enat nat_of_integer integer_of_nat
+  STT Formula.TT Inl EInt Formula.Var Leaf set part_hd sum_nat sub_nat subsvals
+  check trace_of_list_specialized specialized_set ed_set abs_part 
+  collect_paths_specialized
+  in OCaml module_name Checker file_prefix "checker"
+
+(*<*)
+end
+(*>*)
diff --git a/thys/MFOTL_Checker/Event_Data.thy b/thys/MFOTL_Checker/Event_Data.thy
new file mode 100644
--- /dev/null
+++ b/thys/MFOTL_Checker/Event_Data.thy
@@ -0,0 +1,173 @@
+(*<*)
+theory Event_Data
+  imports
+    "HOL-Library.Char_ord"
+begin
+(*>*)
+
+section \<open>Type of Events\<close>
+
+subsection \<open>Code Adaptation for 8-bit strings\<close>
+
+typedef string8 = "UNIV :: char list set" ..
+
+setup_lifting type_definition_string8
+
+lift_definition empty_string :: string8 is "[]" .
+lift_definition string8_literal :: "String.literal \<Rightarrow> string8" is String.explode .
+lift_definition literal_string8:: "string8 \<Rightarrow> String.literal" is String.Abs_literal .
+declare [[coercion string8_literal]]
+
+instantiation string8 :: "{equal, linorder}"
+begin
+
+lift_definition equal_string8 :: "string8 \<Rightarrow> string8 \<Rightarrow> bool" is HOL.equal .
+lift_definition less_eq_string8 :: "string8 \<Rightarrow> string8 \<Rightarrow> bool" is ord_class.lexordp_eq .
+lift_definition less_string8 :: "string8 \<Rightarrow> string8 \<Rightarrow> bool" is ord_class.lexordp .
+
+instance by intro_classes
+    (transfer; auto simp: equal_eq lexordp_conv_lexordp_eq lexordp_eq_linear
+      intro: lexordp_eq_refl lexordp_eq_trans lexordp_eq_antisym)+
+
+end
+
+lifting_forget string8.lifting
+
+declare [[code drop: literal_string8 string8_literal "HOL.equal :: string8 \<Rightarrow> _"
+      "(\<le>) :: string8 \<Rightarrow> _" "(<) :: string8 \<Rightarrow> _"
+      "Code_Evaluation.term_of :: string8 \<Rightarrow> _"]]
+
+code_printing
+  type_constructor string8 \<rightharpoonup> (OCaml) "string"
+  | constant "HOL.equal :: string8 \<Rightarrow> string8 \<Rightarrow> bool" \<rightharpoonup> (OCaml) "Stdlib.(=)"
+  | constant "(\<le>) :: string8 \<Rightarrow> string8 \<Rightarrow> bool" \<rightharpoonup> (OCaml) "Stdlib.(<=)"
+  | constant "(<) :: string8 \<Rightarrow> string8 \<Rightarrow> bool" \<rightharpoonup> (OCaml) "Stdlib.(<)"
+  | constant "empty_string :: string8" \<rightharpoonup> (OCaml) "\"\""
+  | constant "string8_literal :: String.literal \<Rightarrow> string8" \<rightharpoonup> (OCaml) "id"
+  | constant "literal_string8 :: string8 \<Rightarrow> String.literal" \<rightharpoonup> (OCaml) "id"
+
+ML \<open>structure String8 = struct fun to_term x = @{term Abs_string8} $ HOLogic.mk_string x; end;\<close>
+
+code_printing
+  type_constructor string8 \<rightharpoonup> (Eval) "string"
+  | constant "string8_literal :: String.literal \<Rightarrow> string8" \<rightharpoonup> (Eval) "_"
+  | constant "HOL.equal :: string8 \<Rightarrow> string8 \<Rightarrow> bool" \<rightharpoonup> (Eval) infixl 6 "="
+  | constant "(\<le>) :: string8 \<Rightarrow> string8 \<Rightarrow> bool" \<rightharpoonup> (Eval) infixl 6 "<="
+  | constant "(<) :: string8 \<Rightarrow> string8 \<Rightarrow> bool" \<rightharpoonup> (Eval) infixl 6 "<"
+  | constant "empty_string :: string8" \<rightharpoonup> (Eval) "\"\""
+  | constant "Code_Evaluation.term_of :: string8 \<Rightarrow> term" \<rightharpoonup> (Eval) "String8.to'_term"
+
+ML \<open>structure String8 =struct fun to_term x = @{term Abs_string8} $ HOLogic.mk_string x; end;\<close>
+
+code_printing
+  type_constructor string8 \<rightharpoonup> (Eval) "string"
+  | constant "string8_literal :: String.literal \<Rightarrow> string8" \<rightharpoonup> (Eval) "_"
+  | constant "HOL.equal :: string8 \<Rightarrow> string8 \<Rightarrow> bool" \<rightharpoonup> (Eval) infixl 6 "="
+  | constant "(\<le>) :: string8 \<Rightarrow> string8 \<Rightarrow> bool" \<rightharpoonup> (Eval) infixl 6 "<="
+  | constant "(<) :: string8 \<Rightarrow> string8 \<Rightarrow> bool" \<rightharpoonup> (Eval) infixl 6 "<"
+  | constant "Code_Evaluation.term_of :: string8 \<Rightarrow> term" \<rightharpoonup> (Eval) "String8.to'_term"
+
+subsection \<open>Event Parameters\<close>
+
+definition div_to_zero :: "integer \<Rightarrow> integer \<Rightarrow> integer" where
+  "div_to_zero x y = (let z = fst (Code_Numeral.divmod_abs x y) in
+    if (x < 0) \<noteq> (y < 0) then - z else z)"
+
+definition mod_to_zero :: "integer \<Rightarrow> integer \<Rightarrow> integer" where
+  "mod_to_zero x y = (let z = snd (Code_Numeral.divmod_abs x y) in
+    if x < 0 then - z else z)"
+
+lemma "b \<noteq> 0 \<Longrightarrow> div_to_zero a b * b + mod_to_zero a b = a"
+  unfolding div_to_zero_def mod_to_zero_def Let_def
+  by (auto simp: minus_mod_eq_mult_div[symmetric] div_minus_right mod_minus_right ac_simps)
+
+datatype event_data = EInt integer | EString string8
+
+instantiation event_data :: "{ord, plus, minus, uminus, times, divide, modulo}"
+begin
+
+fun less_eq_event_data where
+  "EInt x \<le> EInt y \<longleftrightarrow> x \<le> y"
+| "EString x \<le> EString y \<longleftrightarrow> x \<le> y"
+| "EInt _ \<le> EString _ \<longleftrightarrow> True"
+| "(_ :: event_data) \<le> _ \<longleftrightarrow> False"
+
+definition less_event_data :: "event_data \<Rightarrow> event_data \<Rightarrow> bool" where
+  "less_event_data x y \<longleftrightarrow> x \<le> y \<and> \<not> y \<le> x"
+
+fun plus_event_data where
+  "EInt x + EInt y = EInt (x + y)"
+| "(_::event_data) + _ = undefined"
+
+fun minus_event_data where
+  "EInt x - EInt y = EInt (x - y)"
+| "(_::event_data) - _ = undefined"
+
+fun uminus_event_data where
+  "- EInt x = EInt (- x)"
+| "- (_::event_data) = undefined"
+
+fun times_event_data where
+  "EInt x * EInt y = EInt (x * y)"
+| "(_::event_data) * _ = undefined"
+
+fun divide_event_data where
+  "EInt x div EInt y = EInt (div_to_zero x y)"
+| "(_::event_data) div _ = undefined"
+
+fun modulo_event_data where
+  "EInt x mod EInt y = EInt (mod_to_zero x y)"
+| "(_::event_data) mod _ = undefined"
+
+instance ..
+
+end
+
+lemma infinite_UNIV_event_data:
+  "\<not>finite (UNIV :: event_data set)"
+proof -
+  define f where "f = (\<lambda>k. EInt k)"
+  have inj: "inj_on f (UNIV :: integer set)"
+    unfolding f_def by (meson event_data.inject(1) injI)
+  show ?thesis using finite_imageD[OF _ inj]
+    by (meson infinite_UNIV_char_0 infinite_iff_countable_subset top_greatest)
+qed
+
+primrec integer_of_event_data :: "event_data \<Rightarrow> integer" where
+  "integer_of_event_data (EInt _) = undefined"
+| "integer_of_event_data (EString _) = undefined"
+
+instantiation event_data :: default begin
+
+definition default_event_data :: event_data where "default = EInt 0"
+
+instance proof qed
+
+end
+
+instantiation event_data :: linorder begin
+instance
+proof (standard, unfold less_event_data_def, goal_cases less refl trans antisym total)
+  case (refl x)
+  then show ?case
+    by (cases x) auto
+next
+  case (trans x y z)
+  then show ?case
+    by (cases x; cases y; cases z) auto
+next
+  case (antisym x y)
+  then show ?case
+    by (cases x; cases y) auto
+next
+  case (total x y)
+  then show ?case
+    by (cases x; cases y) auto
+qed simp
+
+end
+
+
+(*<*)
+end
+(*>*)
diff --git a/thys/MFOTL_Checker/Examples.thy b/thys/MFOTL_Checker/Examples.thy
new file mode 100644
--- /dev/null
+++ b/thys/MFOTL_Checker/Examples.thy
@@ -0,0 +1,104 @@
+(*<*)
+theory Examples
+imports Monitor Checker_Code
+begin
+(*>*)
+
+section \<open>Examples\<close>
+
+definition monitor :: "(('n :: linorder \<times> 'd :: {default, linorder} list) set \<times> nat) list \<Rightarrow> ('n, 'd) formula \<Rightarrow> ('n, 'd) expl list" where
+  "monitor \<pi> \<phi> = map (\<lambda>i. eval (trace_of_list \<pi>) (\<lambda>p q. size p \<le> size q) (sorted_list_of_set (fv \<phi>)) i \<phi>) [0 ..< length \<pi>]"
+definition check :: "(('n :: linorder \<times> 'd :: {default, linorder} list) set \<times> nat) list \<Rightarrow> ('n, 'd) formula \<Rightarrow> bool" where
+  "check \<pi> \<phi> = list_all (check_all (trace_of_list \<pi>) \<phi>) (monitor \<pi> \<phi>)"
+
+subsection \<open>Infinite Domain\<close>
+
+definition prefix :: "((string \<times> string list) set \<times> nat) list" where 
+  "prefix =
+     [({(''mgr_S'', [''Mallory'', ''Alice'']),
+        (''mgr_S'', [''Merlin'', ''Bob'']),
+        (''mgr_S'', [''Merlin'', ''Charlie''])}, 1307532861::nat),
+      ({(''approve'', [''Mallory'', ''152''])}, 1307532861),
+      ({(''approve'', [''Merlin'', ''163'']),
+        (''publish'', [''Alice'', ''160'']),
+        (''mgr_F'', [''Merlin'', ''Charlie''])}, 1307955600),
+      ({(''approve'', [''Merlin'', ''187'']),
+        (''publish'', [''Bob'', ''163'']),
+        (''publish'', [''Alice'', ''163'']),
+        (''publish'', [''Charlie'', ''163'']),
+        (''publish'', [''Charlie'', ''152''])}, 1308477599)]"
+
+definition phi :: "(string, string) Formula.formula" where
+  "phi = Formula.Imp (Formula.Pred ''publish'' [Formula.Var ''a'', Formula.Var ''f''])
+    (Formula.Once (init 604800) (Formula.Exists ''m'' (Formula.Since 
+      (Formula.Neg (Formula.Pred ''mgr_F'' [Formula.Var ''m'', Formula.Var ''a''])) all
+      (Formula.And (Formula.Pred ''mgr_S'' [Formula.Var ''m'', Formula.Var ''a''])
+                 (Formula.Pred ''approve'' [Formula.Var ''m'', Formula.Var ''f''])))))"
+
+value "monitor prefix phi"
+lemma "check prefix phi"
+  by eval
+
+subsection \<open>Finite Domain\<close>
+
+datatype Domain = Mallory | Merlin | Martin | Alice | Bob | Charlie | David | Default | R42 | R152 | R160 | R163 | R187
+
+definition ord :: "Domain \<Rightarrow> nat" where
+  "ord d = (case d of
+     Mallory \<Rightarrow> 0
+   | Merlin \<Rightarrow> 1
+   | Martin \<Rightarrow> 2
+   | Alice \<Rightarrow> 3
+   | Bob \<Rightarrow> 4
+   | Charlie \<Rightarrow> 5
+   | David \<Rightarrow> 6
+   | Default \<Rightarrow> 7
+   | R42 \<Rightarrow> 8
+   | R152 \<Rightarrow> 9
+   | R160 \<Rightarrow> 10
+   | R163 \<Rightarrow> 11
+   | R187 \<Rightarrow> 12)"
+
+instantiation Domain :: default begin
+definition "default_Domain = Default"
+instance ..
+end
+instantiation Domain :: universe begin
+definition "universe_Domain = Some [Mallory, Merlin, Martin, Alice, Bob, Charlie, David, Default, R42, R152, R160, R163, R187]"
+instance by standard (auto simp: universe_Domain_def intro: Domain.exhaust)
+end
+instantiation Domain :: linorder begin
+definition "less_eq_Domain d d' = (ord d \<le> ord d')"
+definition "less_Domain d d' = (ord d < ord d')"
+instance by standard (auto simp: less_eq_Domain_def less_Domain_def ord_def split: Domain.splits)
+end
+
+definition fprefix :: "((string \<times> Domain list) set \<times> nat) list" where 
+  "fprefix =
+     [({(''mgr_S'', [Mallory, Alice]),
+        (''mgr_S'', [Merlin, Bob]),
+        (''mgr_S'', [Merlin, Charlie])}, 1307532861::nat),
+      ({(''approve'', [Mallory, R152])}, 1307532861),
+      ({(''approve'', [Merlin, R163]),
+        (''publish'', [Alice, R160]),
+        (''mgr_F'', [Merlin, Charlie])}, 1307955600),
+      ({(''approve'', [Merlin, R187]),
+        (''publish'', [Bob, R163]),
+        (''publish'', [Alice, R163]),
+        (''publish'', [Charlie, R163]),
+        (''publish'', [Charlie, R152])}, 1308477599)]"
+
+definition fphi :: "(string, Domain) Formula.formula" where
+  "fphi = Formula.Imp (Formula.Pred ''publish'' [Formula.Var ''a'', Formula.Var ''f''])
+    (Formula.Once (init 604800) (Formula.Exists ''m'' (Formula.Since 
+      (Formula.Neg (Formula.Pred ''mgr_F'' [Formula.Var ''m'', Formula.Var ''a''])) all
+      (Formula.And (Formula.Pred ''mgr_S'' [Formula.Var ''m'', Formula.Var ''a''])
+                 (Formula.Pred ''approve'' [Formula.Var ''m'', Formula.Var ''f''])))))"
+
+value "monitor fprefix fphi"
+lemma "check fprefix fphi"
+  by eval
+
+(*<*)
+end
+(*>*)
\ No newline at end of file
diff --git a/thys/MFOTL_Checker/Formula.thy b/thys/MFOTL_Checker/Formula.thy
new file mode 100644
--- /dev/null
+++ b/thys/MFOTL_Checker/Formula.thy
@@ -0,0 +1,370 @@
+(*<*)
+theory Formula
+  imports Trace
+begin
+(*>*)
+
+section \<open>Metric First-Order Temporal Logic\<close>
+
+subsection \<open>Syntax\<close>
+
+type_synonym ('n, 'a) event = "('n \<times> 'a list)"
+type_synonym ('n, 'a) database = "('n, 'a) event set"
+type_synonym ('n, 'a) prefix = "('n \<times> 'a list) prefix"
+type_synonym ('n, 'a) trace = "('n \<times> 'a list) trace"
+type_synonym ('n, 'a) env = "'n \<Rightarrow> 'a"
+type_synonym ('n, 'a) envset = "'n \<Rightarrow> 'a set"
+
+datatype (fv_trm: 'n, 'a) trm = is_Var: Var 'n ("\<^bold>v") | is_Const: Const 'a ("\<^bold>c")
+
+lemma in_fv_trm_conv: "x \<in> fv_trm t \<longleftrightarrow> t = \<^bold>v x"
+  by (cases t) auto
+
+datatype ('n, 'a) formula = 
+  TT                                            ("\<top>")
+| FF                                            ("\<bottom>")
+| Eq_Const 'n 'a                                ("_ \<^bold>\<approx> _" [85, 85] 85)
+| Pred 'n "('n, 'a) trm list"                   ("_ \<dagger> _" [85, 85] 85)
+| Neg "('n, 'a) formula"                        ("\<not>\<^sub>F _" [82] 82)
+| Or "('n, 'a) formula" "('n, 'a) formula"      (infixr "\<or>\<^sub>F" 80)
+| And "('n, 'a) formula" "('n, 'a) formula"     (infixr "\<and>\<^sub>F" 80)
+| Imp "('n, 'a) formula" "('n, 'a) formula"     (infixr "\<longrightarrow>\<^sub>F" 79)
+| Iff "('n, 'a) formula" "('n, 'a) formula"     (infixr "\<longleftrightarrow>\<^sub>F" 79)
+| Exists "'n" "('n, 'a) formula"                ("\<exists>\<^sub>F_. _" [70,70] 70)
+| Forall "'n" "('n, 'a) formula"                ("\<forall>\<^sub>F_. _" [70,70] 70)
+| Prev \<I> "('n, 'a) formula"                     ("\<^bold>Y _ _" [1000, 65] 65)
+| Next \<I> "('n, 'a) formula"                     ("\<^bold>X _ _" [1000, 65] 65)
+| Once \<I> "('n, 'a) formula"                     ("\<^bold>P _ _" [1000, 65] 65)
+| Historically \<I> "('n, 'a) formula"             ("\<^bold>H _ _" [1000, 65] 65)
+| Eventually \<I> "('n, 'a) formula"               ("\<^bold>F _ _" [1000, 65] 65)
+| Always \<I> "('n, 'a) formula"                   ("\<^bold>G _ _" [1000, 65] 65)
+| Since "('n, 'a) formula" \<I> "('n, 'a) formula" ("_ \<^bold>S _ _" [60,1000,60] 60)
+| Until "('n, 'a) formula" \<I> "('n, 'a) formula" ("_ \<^bold>U _ _" [60,1000,60] 60)
+
+primrec fv :: "('n, 'a) formula \<Rightarrow> 'n set" where
+  "fv (r \<dagger> ts) = \<Union> (fv_trm ` set ts)"
+| "fv \<top> = {}"
+| "fv \<bottom> = {}"
+| "fv (x \<^bold>\<approx> c) = {x}"
+| "fv (\<not>\<^sub>F \<phi>) = fv \<phi>"
+| "fv (\<phi> \<or>\<^sub>F \<psi>) = fv \<phi> \<union> fv \<psi>"
+| "fv (\<phi> \<and>\<^sub>F \<psi>) = fv \<phi> \<union> fv \<psi>"
+| "fv (\<phi> \<longrightarrow>\<^sub>F \<psi>) = fv \<phi> \<union> fv \<psi>"
+| "fv (\<phi> \<longleftrightarrow>\<^sub>F \<psi>) = fv \<phi> \<union> fv \<psi>"
+| "fv (\<exists>\<^sub>Fx. \<phi>) = fv \<phi> - {x}"
+| "fv (\<forall>\<^sub>Fx. \<phi>) = fv \<phi> - {x}"
+| "fv (\<^bold>Y I \<phi>) = fv \<phi>"
+| "fv (\<^bold>X I \<phi>) = fv \<phi>"
+| "fv (\<^bold>P I \<phi>) = fv \<phi>"
+| "fv (\<^bold>H I \<phi>) = fv \<phi>"
+| "fv (\<^bold>F I \<phi>) = fv \<phi>"
+| "fv (\<^bold>G I \<phi>) = fv \<phi>"
+| "fv (\<phi> \<^bold>S I \<psi>) = fv \<phi> \<union> fv \<psi>"
+| "fv (\<phi> \<^bold>U I \<psi>) = fv \<phi> \<union> fv \<psi>"
+
+primrec "consts" :: "('n, 'a) formula \<Rightarrow> 'a set" where
+  "consts (r \<dagger> ts) = {}" \<comment> \<open>terms may also contain constants,
+     but these only filter out values from the trace and do not introduce
+     new values of interest (i.e., do not extend the active domain)\<close>
+| "consts \<top> = {}"
+| "consts \<bottom> = {}"
+| "consts (x \<^bold>\<approx> c) = {c}"
+| "consts (\<not>\<^sub>F \<phi>) = consts \<phi>"
+| "consts (\<phi> \<or>\<^sub>F \<psi>) = consts \<phi> \<union> consts \<psi>"
+| "consts (\<phi> \<and>\<^sub>F \<psi>) = consts \<phi> \<union> consts \<psi>"
+| "consts (\<phi> \<longrightarrow>\<^sub>F \<psi>) = consts \<phi> \<union> consts \<psi>"
+| "consts (\<phi> \<longleftrightarrow>\<^sub>F \<psi>) = consts \<phi> \<union> consts \<psi>"
+| "consts (\<exists>\<^sub>Fx. \<phi>) = consts \<phi>"
+| "consts (\<forall>\<^sub>Fx. \<phi>) = consts \<phi>"
+| "consts (\<^bold>Y I \<phi>) = consts \<phi>"
+| "consts (\<^bold>X I \<phi>) = consts \<phi>"
+| "consts (\<^bold>P I \<phi>) = consts \<phi>"
+| "consts (\<^bold>H I \<phi>) = consts \<phi>"
+| "consts (\<^bold>F I \<phi>) = consts \<phi>"
+| "consts (\<^bold>G I \<phi>) = consts \<phi>"
+| "consts (\<phi> \<^bold>S I \<psi>) = consts \<phi> \<union> consts \<psi>"
+| "consts (\<phi> \<^bold>U I \<psi>) = consts \<phi> \<union> consts \<psi>"
+
+lemma finite_fv_trm[simp]: "finite (fv_trm t)"
+  by (cases t) simp_all
+
+lemma finite_fv[simp]: "finite (fv \<phi>)"
+  by (induction \<phi>) simp_all
+
+lemma finite_consts[simp]: "finite (consts \<phi>)"
+  by (induction \<phi>) simp_all
+
+definition nfv :: "('n, 'a) formula \<Rightarrow> nat" where
+  "nfv \<phi> = card (fv \<phi>)"
+
+fun future_bounded :: "('n, 'a) formula \<Rightarrow> bool" where
+  "future_bounded \<top> = True"
+| "future_bounded \<bottom> = True"
+| "future_bounded (_ \<dagger> _) = True"
+| "future_bounded (_ \<^bold>\<approx> _) = True"
+| "future_bounded (\<not>\<^sub>F \<phi>) = future_bounded \<phi>"
+| "future_bounded (\<phi> \<or>\<^sub>F \<psi>) = (future_bounded \<phi> \<and> future_bounded \<psi>)"
+| "future_bounded (\<phi> \<and>\<^sub>F \<psi>) = (future_bounded \<phi> \<and> future_bounded \<psi>)"
+| "future_bounded (\<phi> \<longrightarrow>\<^sub>F \<psi>) = (future_bounded \<phi> \<and> future_bounded \<psi>)"
+| "future_bounded (\<phi> \<longleftrightarrow>\<^sub>F \<psi>) = (future_bounded \<phi> \<and> future_bounded \<psi>)"
+| "future_bounded (\<exists>\<^sub>F_. \<phi>) = future_bounded \<phi>"
+| "future_bounded (\<forall>\<^sub>F_. \<phi>) = future_bounded \<phi>"
+| "future_bounded (\<^bold>Y I \<phi>) = future_bounded \<phi>"
+| "future_bounded (\<^bold>X I \<phi>) = future_bounded \<phi>"
+| "future_bounded (\<^bold>P I \<phi>) = future_bounded \<phi>"
+| "future_bounded (\<^bold>H I \<phi>) = future_bounded \<phi>"
+| "future_bounded (\<^bold>F I \<phi>) = (future_bounded \<phi> \<and> right I \<noteq> \<infinity>)"
+| "future_bounded (\<^bold>G I \<phi>) = (future_bounded \<phi> \<and> right I \<noteq> \<infinity>)"
+| "future_bounded (\<phi> \<^bold>S I \<psi>) = (future_bounded \<phi> \<and> future_bounded \<psi>)"
+| "future_bounded (\<phi> \<^bold>U I \<psi>) = (future_bounded \<phi> \<and> future_bounded \<psi> \<and> right I \<noteq> \<infinity>)"
+
+subsection \<open>Semantics\<close>
+
+primrec eval_trm :: "('n, 'a) env \<Rightarrow> ('n, 'a) trm \<Rightarrow> 'a"("_\<lbrakk>_\<rbrakk>" [70,89] 89) where
+  "eval_trm v (\<^bold>v x) = v x"
+| "eval_trm v (\<^bold>c x) = x"
+
+lemma eval_trm_fv_cong: "\<forall>x\<in>fv_trm t. v x = v' x \<Longrightarrow> v\<lbrakk>t\<rbrakk> = v'\<lbrakk>t\<rbrakk>"
+  by (induction t) simp_all
+
+definition eval_trms :: "('n, 'a) env \<Rightarrow> ('n, 'a) trm list \<Rightarrow> 'a list" ("_\<^bold>\<lbrakk>_\<^bold>\<rbrakk>" [70,89] 89) where
+  "eval_trms v ts = map (eval_trm v) ts"
+
+lemma eval_trms_fv_cong: 
+  "\<forall>t\<in>set ts. \<forall>x\<in>fv_trm t. v x = v' x \<Longrightarrow> v\<^bold>\<lbrakk>ts\<^bold>\<rbrakk> = v'\<^bold>\<lbrakk>ts\<^bold>\<rbrakk>"
+  using eval_trm_fv_cong[of _ v v']
+  by (auto simp: eval_trms_def)
+
+(* vs :: "'a envset" is used whenever we define executable functions *)
+primrec eval_trm_set :: "('n, 'a) envset \<Rightarrow> ('n, 'a) trm \<Rightarrow> ('n, 'a) trm \<times> 'a set"("_\<lbrace>_\<rbrace>" [70,89] 89) where
+  "eval_trm_set vs (\<^bold>v x) = (\<^bold>v x, vs x)"
+| "eval_trm_set vs (\<^bold>c x) = (\<^bold>c x, {x})"
+
+definition eval_trms_set :: "('n, 'a) envset \<Rightarrow> ('n, 'a) trm list \<Rightarrow> (('n, 'a) trm \<times> 'a set) list" ("_\<^bold>\<lbrace>_\<^bold>\<rbrace>" [70,89] 89)
+  where "eval_trms_set vs ts = map (eval_trm_set vs) ts"
+
+lemma eval_trms_set_Nil: "vs\<^bold>\<lbrace>[]\<^bold>\<rbrace> = []"
+  by (simp add: eval_trms_set_def)
+
+lemma eval_trms_set_Cons: 
+  "vs\<^bold>\<lbrace>(t # ts)\<^bold>\<rbrace> = vs\<lbrace>t\<rbrace> # vs\<^bold>\<lbrace>ts\<^bold>\<rbrace>"
+  by (simp add: eval_trms_set_def)
+
+primrec sat :: "('n, 'a) trace \<Rightarrow> ('n, 'a) env \<Rightarrow> nat \<Rightarrow> ('n, 'a) formula \<Rightarrow> bool" ("\<langle>_, _, _\<rangle> \<Turnstile> _" [56, 56, 56, 56] 55) where
+  "\<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<top> = True"
+| "\<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<bottom> = False"
+| "\<langle>\<sigma>, v, i\<rangle> \<Turnstile> r \<dagger> ts = ((r, v\<^bold>\<lbrakk>ts\<^bold>\<rbrakk>) \<in> \<Gamma> \<sigma> i)"
+| "\<langle>\<sigma>, v, i\<rangle> \<Turnstile> x \<^bold>\<approx> c = (v x = c)"
+| "\<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<not>\<^sub>F \<phi> = (\<not> \<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<phi>)"
+| "\<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<phi> \<or>\<^sub>F \<psi> = (\<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<phi> \<or> \<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<psi>)"
+| "\<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<phi> \<and>\<^sub>F \<psi> = (\<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<phi> \<and> \<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<psi>)"
+| "\<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<phi> \<longrightarrow>\<^sub>F \<psi> = (\<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<phi> \<longrightarrow> \<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<psi>)"
+| "\<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<phi> \<longleftrightarrow>\<^sub>F \<psi> = (\<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<phi> \<longleftrightarrow> \<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<psi>)"
+| "\<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<exists>\<^sub>Fx. \<phi> = (\<exists>z. \<langle>\<sigma>, v(x := z), i\<rangle> \<Turnstile> \<phi>)"
+| "\<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<forall>\<^sub>Fx. \<phi> = (\<forall>z. \<langle>\<sigma>, v(x := z), i\<rangle> \<Turnstile> \<phi>)"
+| "\<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<^bold>Y I \<phi> = (case i of 0 \<Rightarrow> False | Suc j \<Rightarrow> mem (\<tau> \<sigma> i - \<tau> \<sigma> j) I \<and> \<langle>\<sigma>, v, j\<rangle> \<Turnstile> \<phi>)"
+| "\<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<^bold>X I \<phi> = (mem (\<tau> \<sigma> (Suc i) - \<tau> \<sigma> i) I \<and> \<langle>\<sigma>, v, Suc i\<rangle> \<Turnstile> \<phi>)"
+| "\<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<^bold>P I \<phi> = (\<exists>j\<le>i. mem (\<tau> \<sigma> i - \<tau> \<sigma> j) I \<and> \<langle>\<sigma>, v, j\<rangle> \<Turnstile> \<phi>)"
+| "\<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<^bold>H I \<phi> = (\<forall>j\<le>i. mem (\<tau> \<sigma> i - \<tau> \<sigma> j) I \<longrightarrow> \<langle>\<sigma>, v, j\<rangle> \<Turnstile> \<phi>)"
+| "\<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<^bold>F I \<phi> = (\<exists>j\<ge>i. mem (\<tau> \<sigma> j - \<tau> \<sigma> i) I \<and> \<langle>\<sigma>, v, j\<rangle> \<Turnstile> \<phi>)"
+| "\<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<^bold>G I \<phi> = (\<forall>j\<ge>i. mem (\<tau> \<sigma> j - \<tau> \<sigma> i) I \<longrightarrow> \<langle>\<sigma>, v, j\<rangle> \<Turnstile> \<phi>)"
+| "\<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<phi> \<^bold>S I \<psi> = (\<exists>j\<le>i. mem (\<tau> \<sigma> i - \<tau> \<sigma> j) I \<and> \<langle>\<sigma>, v, j\<rangle> \<Turnstile> \<psi> \<and> (\<forall>k\<in>{j<..i}. \<langle>\<sigma>, v, k\<rangle> \<Turnstile> \<phi>))"
+| "\<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<phi> \<^bold>U I \<psi> = (\<exists>j\<ge>i. mem (\<tau> \<sigma> j - \<tau> \<sigma> i) I \<and> \<langle>\<sigma>, v, j\<rangle> \<Turnstile> \<psi> \<and> (\<forall>k\<in>{i..<j}. \<langle>\<sigma>, v, k\<rangle> \<Turnstile> \<phi>))"
+
+lemma sat_fv_cong: "\<forall>x\<in>fv \<phi>. v x = v' x \<Longrightarrow> \<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<phi> = \<langle>\<sigma>, v', i\<rangle> \<Turnstile> \<phi>"
+proof (induct \<phi> arbitrary: v v' i)
+  case (Pred n ts)
+  thus ?case
+    by (simp cong: map_cong eval_trms_fv_cong[rule_format, OF Pred[simplified, rule_format]] 
+        split: option.splits)
+next
+  case (Exists t \<phi>)
+  then show ?case unfolding sat.simps 
+    by (intro iff_exI) (simp add: nth_Cons')
+next
+  case (Forall t \<phi>)
+  then show ?case unfolding sat.simps 
+    by (intro iff_allI) (simp add: nth_Cons')
+qed (auto 10 0 simp: Let_def split: nat.splits intro!: iff_exI eval_trm_fv_cong)
+
+lemma sat_Until_rec: "\<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<phi> \<^bold>U I \<psi> \<longleftrightarrow>
+  (mem 0 I \<and> \<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<psi> \<or>
+   \<Delta> \<sigma> (i + 1) \<le> right I \<and> \<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<phi> \<and> \<langle>\<sigma>, v, i + 1\<rangle> \<Turnstile> \<phi> \<^bold>U (subtract (\<Delta> \<sigma> (i + 1)) I) \<psi>)"
+  (is "?L \<longleftrightarrow> ?R")
+proof (rule iffI; (elim disjE conjE)?)
+  assume ?L
+  then obtain j where j: "i \<le> j" "mem (\<tau> \<sigma> j - \<tau> \<sigma> i) I" "\<langle>\<sigma>, v, j\<rangle> \<Turnstile> \<psi>" "\<forall>k \<in> {i ..< j}. \<langle>\<sigma>, v, k\<rangle> \<Turnstile> \<phi>"
+    by auto
+  then show ?R
+  proof (cases "i = j")
+    case False
+    with j(1,2) have "\<Delta> \<sigma> (i + 1) \<le> right I"
+      by (auto elim: order_trans[rotated] simp: diff_le_mono)
+    moreover from False j(1,4) have "\<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<phi>" by auto
+    moreover from False j have "\<langle>\<sigma>, v, i + 1\<rangle> \<Turnstile> \<phi> \<^bold>U (subtract (\<Delta> \<sigma> (i + 1)) I) \<psi>"
+      by (cases "right I") (auto simp: le_diff_conv le_diff_conv2 intro!: exI[of _ j])
+    ultimately show ?thesis by blast
+  qed simp
+next
+  assume \<Delta>: "\<Delta> \<sigma> (i + 1) \<le> right I" and now: "\<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<phi>" and
+   "next": "\<langle>\<sigma>, v, i + 1\<rangle> \<Turnstile> \<phi> \<^bold>U (subtract (\<Delta> \<sigma> (i + 1)) I) \<psi>"
+  from "next" obtain j where j: "i + 1 \<le> j" "mem (\<tau> \<sigma> j - \<tau> \<sigma> (i + 1)) (subtract (\<Delta> \<sigma> (i + 1)) I)"
+      "\<langle>\<sigma>, v, j\<rangle> \<Turnstile> \<psi>" "\<forall>k \<in> {i + 1 ..< j}. \<langle>\<sigma>, v, k\<rangle> \<Turnstile> \<phi>"
+    by auto
+  from \<Delta> j(1,2) have "mem (\<tau> \<sigma> j - \<tau> \<sigma> i) I"
+    by (cases "right I") (auto simp: le_diff_conv2)
+  with now j(1,3,4) show ?L by (auto simp: le_eq_less_or_eq[of i] intro!: exI[of _ j])
+qed auto
+
+lemma sat_Since_rec: "\<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<phi> \<^bold>S I \<psi> \<longleftrightarrow>
+  mem 0 I \<and> \<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<psi> \<or>
+  (i > 0 \<and> \<Delta> \<sigma> i \<le> right I \<and> \<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<phi> \<and> \<langle>\<sigma>, v, i - 1\<rangle> \<Turnstile> \<phi> \<^bold>S (subtract (\<Delta> \<sigma> i) I) \<psi>)"
+  (is "?L \<longleftrightarrow> ?R")
+proof (rule iffI; (elim disjE conjE)?)
+  assume ?L
+  then obtain j where j: "j \<le> i" "mem (\<tau> \<sigma> i - \<tau> \<sigma> j) I" "\<langle>\<sigma>, v, j\<rangle> \<Turnstile> \<psi>" "\<forall>k \<in> {j <.. i}. \<langle>\<sigma>, v, k\<rangle> \<Turnstile> \<phi>"
+    by auto
+  then show ?R
+  proof (cases "i = j")
+    case False
+    with j(1) obtain k where [simp]: "i = k + 1"
+      by (cases i) auto
+    with j(1,2) False have "\<Delta> \<sigma> i \<le> right I"
+      by (auto elim: order_trans[rotated] simp: diff_le_mono2 le_Suc_eq)
+    moreover from False j(1,4) have "\<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<phi>" by auto
+    moreover from False j have "\<langle>\<sigma>, v, i - 1\<rangle> \<Turnstile> \<phi> \<^bold>S (subtract (\<Delta> \<sigma> i) I) \<psi>"
+      by (cases "right I") (auto simp: le_diff_conv le_diff_conv2 intro!: exI[of _ j])
+    ultimately show ?thesis by auto
+  qed simp
+next
+  assume i: "0 < i" and \<Delta>: "\<Delta> \<sigma> i \<le> right I" and now: "\<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<phi>" and
+   "prev": "\<langle>\<sigma>, v, i - 1\<rangle> \<Turnstile> \<phi> \<^bold>S (subtract (\<Delta> \<sigma> i) I) \<psi>"
+  from "prev" obtain j where j: "j \<le> i - 1" "mem (\<tau> \<sigma> (i - 1) - \<tau> \<sigma> j) ((subtract (\<Delta> \<sigma> i) I))"
+      "\<langle>\<sigma>, v, j\<rangle> \<Turnstile> \<psi>" "\<forall>k \<in> {j <.. i - 1}. \<langle>\<sigma>, v, k\<rangle> \<Turnstile> \<phi>"
+    by auto
+  from \<Delta> i j(1,2) have "mem (\<tau> \<sigma> i - \<tau> \<sigma> j) I"
+    by (cases "right I") (auto simp: le_diff_conv2)
+  with now i j(1,3,4) show ?L by (auto simp: le_Suc_eq gr0_conv_Suc intro!: exI[of _ j])
+qed auto
+
+lemma sat_Since_0: "\<langle>\<sigma>, v, 0\<rangle> \<Turnstile> \<phi> \<^bold>S I \<psi> \<longleftrightarrow> mem 0 I \<and> \<langle>\<sigma>, v, 0\<rangle> \<Turnstile> \<psi>"
+  by auto
+
+lemma sat_Since_point: "\<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<phi> \<^bold>S I \<psi> \<Longrightarrow>
+    (\<And>j. j \<le> i \<Longrightarrow> mem (\<tau> \<sigma> i - \<tau> \<sigma> j) I \<Longrightarrow> \<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<phi> \<^bold>S (point (\<tau> \<sigma> i - \<tau> \<sigma> j)) \<psi> \<Longrightarrow> P) \<Longrightarrow> P"
+  by (auto intro: diff_le_self)
+
+lemma sat_Since_pointD: "\<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<phi> \<^bold>S (point t) \<psi> \<Longrightarrow> mem t I \<Longrightarrow> \<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<phi> \<^bold>S I \<psi>"
+  by auto
+
+lemma sat_Once_Since: "\<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<^bold>P I \<phi> = \<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<top> \<^bold>S I \<phi>"
+  by auto
+
+lemma sat_Once_rec: "\<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<^bold>P I \<phi> \<longleftrightarrow>
+  mem 0 I \<and> \<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<phi> \<or> 
+  (i > 0 \<and> \<Delta> \<sigma> i \<le> right I \<and> \<langle>\<sigma>, v, i - 1\<rangle> \<Turnstile> \<^bold>P (subtract (\<Delta> \<sigma> i) I) \<phi>)"
+  unfolding sat_Once_Since
+  by (subst sat_Since_rec) auto
+
+lemma sat_Historically_Once: "\<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<^bold>H I \<phi> = \<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<not>\<^sub>F (\<^bold>P I \<not>\<^sub>F \<phi>)"
+  by auto
+
+lemma sat_Historically_rec: "\<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<^bold>H I \<phi> \<longleftrightarrow>
+  (mem 0 I \<longrightarrow> \<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<phi>) \<and> 
+  (i > 0 \<longrightarrow> \<Delta> \<sigma> i \<le> right I \<longrightarrow> \<langle>\<sigma>, v, i - 1\<rangle> \<Turnstile> \<^bold>H (subtract (\<Delta> \<sigma> i) I) \<phi>)"
+  unfolding sat_Historically_Once sat.simps(5)
+  by (subst sat_Once_rec) auto
+
+lemma sat_Eventually_Until: "\<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<^bold>F I \<phi> = \<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<top> \<^bold>U I \<phi>"
+  by auto
+
+lemma sat_Eventually_rec: "\<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<^bold>F I \<phi> \<longleftrightarrow>
+  mem 0 I \<and> \<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<phi> \<or> 
+  (\<Delta> \<sigma> (i + 1) \<le> right I \<and> \<langle>\<sigma>, v, i + 1\<rangle> \<Turnstile> \<^bold>F (subtract (\<Delta> \<sigma> (i + 1)) I) \<phi>)"
+  unfolding sat_Eventually_Until
+  by (subst sat_Until_rec) auto
+
+lemma sat_Always_Eventually: "\<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<^bold>G I \<phi> = \<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<not>\<^sub>F (\<^bold>F I \<not>\<^sub>F \<phi>)"
+  by auto
+
+lemma sat_Always_rec: "\<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<^bold>G I \<phi> \<longleftrightarrow>
+  (mem 0 I \<longrightarrow> \<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<phi>) \<and> 
+  (\<Delta> \<sigma> (i + 1) \<le> right I \<longrightarrow> \<langle>\<sigma>, v, i + 1\<rangle> \<Turnstile> \<^bold>G (subtract (\<Delta> \<sigma> (i + 1)) I) \<phi>)"
+  unfolding sat_Always_Eventually sat.simps(5)
+  by (subst sat_Eventually_rec) auto
+
+bundle MFOTL_no_notation begin
+
+text \<open> For bold font, type ``backslash'' followed by the word ``bold''  \<close>
+no_notation Var ("\<^bold>v")
+     and Const ("\<^bold>c")
+
+text \<open> For subscripts type ``backslash'' followed by ``sub''  \<close>
+no_notation TT ("\<top>")
+     and FF ("\<bottom>")
+     and Pred ("_ \<dagger> _" [85, 85] 85)
+     and Eq_Const ("_ \<^bold>\<approx> _" [85, 85] 85)
+     and Neg ("\<not>\<^sub>F _" [82] 82)
+     and And (infixr "\<and>\<^sub>F" 80)
+     and Or (infixr "\<or>\<^sub>F" 80)
+     and Imp (infixr "\<longrightarrow>\<^sub>F" 79)
+     and Iff (infixr "\<longleftrightarrow>\<^sub>F" 79)
+     and Exists ("\<exists>\<^sub>F_. _" [70,70] 70)
+     and Forall ("\<forall>\<^sub>F_. _" [70,70] 70)
+     and Prev ("\<^bold>Y _ _" [1000, 65] 65)
+     and Next ("\<^bold>X _ _" [1000, 65] 65)
+     and Once ("\<^bold>P _ _" [1000, 65] 65)
+     and Eventually ("\<^bold>F _ _" [1000, 65] 65)
+     and Historically ("\<^bold>H _ _" [1000, 65] 65)
+     and Always ("\<^bold>G _ _" [1000, 65] 65)
+     and Since ("_ \<^bold>S _ _" [60,1000,60] 60)
+     and Until ("_ \<^bold>U _ _" [60,1000,60] 60)
+
+no_notation eval_trm ("_\<lbrakk>_\<rbrakk>" [70,89] 89)
+     and eval_trms ("_\<^bold>\<lbrakk>_\<^bold>\<rbrakk>" [70,89] 89)
+     and eval_trm_set ("_\<lbrace>_\<rbrace>" [70,89] 89)
+     and eval_trms_set ("_\<^bold>\<lbrace>_\<^bold>\<rbrace>" [70,89] 89)
+     and sat ("\<langle>_, _, _\<rangle> \<Turnstile> _" [56, 56, 56, 56] 55)
+     and Interval.interval ("\<^bold>[_,_\<^bold>]")
+
+end
+
+bundle MFOTL_notation begin
+
+notation Var ("\<^bold>v")
+     and Const ("\<^bold>c")
+
+notation TT ("\<top>")
+     and FF ("\<bottom>")
+     and Pred ("_ \<dagger> _" [85, 85] 85)
+     and Eq_Const ("_ \<^bold>\<approx> _" [85, 85] 85)
+     and Neg ("\<not>\<^sub>F _" [82] 82)
+     and And (infixr "\<and>\<^sub>F" 80)
+     and Or (infixr "\<or>\<^sub>F" 80)
+     and Imp (infixr "\<longrightarrow>\<^sub>F" 79)
+     and Iff (infixr "\<longleftrightarrow>\<^sub>F" 79)
+     and Exists ("\<exists>\<^sub>F_. _" [70,70] 70)
+     and Forall ("\<forall>\<^sub>F_. _" [70,70] 70)
+     and Prev ("\<^bold>Y _ _" [1000, 65] 65)
+     and Next ("\<^bold>X _ _" [1000, 65] 65)
+     and Once ("\<^bold>P _ _" [1000, 65] 65)
+     and Eventually ("\<^bold>F _ _" [1000, 65] 65)
+     and Historically ("\<^bold>H _ _" [1000, 65] 65)
+     and Always ("\<^bold>G _ _" [1000, 65] 65)
+     and Since ("_ \<^bold>S _ _" [60,1000,60] 60)
+     and Until ("_ \<^bold>U _ _" [60,1000,60] 60)
+
+notation eval_trm ("_\<lbrakk>_\<rbrakk>" [70,89] 89)
+     and eval_trms ("_\<^bold>\<lbrakk>_\<^bold>\<rbrakk>" [70,89] 89)
+     and eval_trm_set ("_\<lbrace>_\<rbrace>" [70,89] 89)
+     and eval_trms_set ("_\<^bold>\<lbrace>_\<^bold>\<rbrace>" [70,89] 89)
+     and sat ("\<langle>_, _, _\<rangle> \<Turnstile> _" [56, 56, 56, 56] 55)
+     and Interval.interval ("\<^bold>[_,_\<^bold>]")
+
+end
+
+unbundle MFOTL_no_notation
+
+(*<*)
+end
+(*>*)
\ No newline at end of file
diff --git a/thys/MFOTL_Checker/Monitor.thy b/thys/MFOTL_Checker/Monitor.thy
new file mode 100644
--- /dev/null
+++ b/thys/MFOTL_Checker/Monitor.thy
@@ -0,0 +1,587 @@
+(*<*)
+theory Monitor
+  imports Checker_Code
+begin
+(*>*)
+
+section \<open>Unverified Explanation-Producing Monitoring Algorithm\<close>
+
+fun merge_part2_raw :: "('a \<Rightarrow> 'b \<Rightarrow> 'c) \<Rightarrow> ('d set \<times> 'a) list \<Rightarrow> ('d set \<times> 'b) list \<Rightarrow> ('d set \<times> 'c) list" where
+  "merge_part2_raw f [] _ = []"  
+| "merge_part2_raw f ((P1, v1) # part1) part2 = 
+    (let part12 = List.map_filter (\<lambda>(P2, v2). if P1 \<inter> P2 \<noteq> {} then Some(P1 \<inter> P2, f v1 v2) else None) part2 in
+     let part2not1 = List.map_filter (\<lambda>(P2, v2). if P2 - P1 \<noteq> {} then Some(P2 - P1, v2) else None) part2 in
+     part12 @ (merge_part2_raw f part1 part2not1))"
+
+fun merge_part3_raw :: "('a \<Rightarrow> 'b \<Rightarrow> 'c \<Rightarrow> 'e) \<Rightarrow> ('d set \<times> 'a) list \<Rightarrow> ('d set \<times> 'b) list \<Rightarrow> ('d set \<times> 'c) list \<Rightarrow> ('d set \<times> 'e) list" where
+  "merge_part3_raw f [] _ _ = []" 
+| "merge_part3_raw f _ [] _ = []" 
+| "merge_part3_raw f _ _ [] = []"
+| "merge_part3_raw f part1 part2 part3 = merge_part2_raw (\<lambda>pt3 f'. f' pt3) part3 (merge_part2_raw f part1 part2)"
+
+lemma partition_on_empty_iff: 
+  "partition_on X \<P> \<Longrightarrow> \<P> = {} \<longleftrightarrow> X = {}"
+  "partition_on X \<P> \<Longrightarrow> \<P> \<noteq> {} \<longleftrightarrow> X \<noteq> {}"
+  by (auto simp: partition_on_def)
+
+lemma wf_part_list_filter_inter: 
+  defines "inP1 P1 f v1 part2 
+    \<equiv> List.map_filter (\<lambda>(P2, v2). if P1 \<inter> P2 \<noteq> {} then Some(P1 \<inter> P2, f v1 v2) else None) part2"
+  assumes "partition_on X (set (map fst ((P1, v1) # part1)))"
+    and "partition_on X (set (map fst part2))"
+  shows "partition_on P1 (set (map fst (inP1 P1 f v1 part2)))"
+    and "distinct (map fst ((P1, v1) # part1)) \<Longrightarrow> distinct (map fst (part2)) \<Longrightarrow>
+    distinct (map fst (inP1 P1 f v1 part2))"
+proof (rule partition_onI)
+  show "\<Union> (set (map fst (inP1 P1 f v1 part2))) = P1"
+  proof -
+    have "\<exists>P2. (P1 \<inter> P2 \<noteq> {} \<longrightarrow> (\<exists>v2. (P2, v2) \<in> set part2) \<and> x \<in> P2) \<and> P1 \<inter> P2 \<noteq> {}"
+      if "\<Union> (fst ` set part2) = P1 \<union> \<Union> (fst ` set part1)" and "x \<in> P1" for x
+      using that by (metis (no_types, lifting) Int_iff UN_iff Un_Int_eq(3) empty_iff prod.collapse)
+    with partition_onD1[OF assms(2)] partition_onD1[OF assms(3)] show ?thesis
+      by (auto simp: map_filter_def inP1_def split: if_splits)
+  qed
+  show "\<And>A1 A2. A1 \<in> set (map fst (inP1 P1 f v1 part2)) \<Longrightarrow>
+    A2 \<in> set (map fst (inP1 P1 f v1 part2)) \<Longrightarrow> A1 \<noteq> A2 \<Longrightarrow> disjnt A1 A2" 
+    using partition_onD2[OF assms(2)] partition_onD2[OF assms(3)]
+    by (force simp: disjnt_iff map_filter_def disjoint_def inP1_def split: if_splits)
+  show "{} \<notin> set (map fst (inP1 P1 f v1 part2))" 
+    using assms
+    by (auto simp: map_filter_def split: if_splits)
+  show "distinct (map fst ((P1, v1) # part1)) \<Longrightarrow> distinct (map fst part2) \<Longrightarrow>
+    distinct (map fst (inP1 P1 f v1 part2))"
+    using partition_onD2[OF assms(3), unfolded disjoint_def, simplified, rule_format]
+    by (clarsimp simp: inP1_def map_filter_def distinct_map inj_on_def Ball_def) blast
+qed
+
+lemma wf_part_list_filter_minus: 
+  defines "notinP2 P1 f v1 part2 
+    \<equiv> List.map_filter (\<lambda>(P2, v2). if P2 - P1 \<noteq> {} then Some(P2 - P1, v2) else None) part2"
+  assumes "partition_on X (set (map fst ((P1, v1) # part1)))"
+    and "partition_on X (set (map fst part2))"
+  shows "partition_on (X - P1) (set (map fst (notinP2 P1 f v1 part2)))"
+    and "distinct (map fst ((P1, v1) # part1)) \<Longrightarrow> distinct (map fst (part2)) \<Longrightarrow>
+      distinct (map fst (notinP2 P1 f v1 part2))"
+proof (rule partition_onI)
+  show "\<Union> (set (map fst (notinP2 P1 f v1 part2))) = X - P1"
+  proof -
+    have "\<exists>P2. ((\<exists>x\<in>P2. x \<notin> P1) \<longrightarrow> (\<exists>v2. (P2, v2) \<in> set part2)) \<and> (\<exists>x\<in>P2. x \<notin> P1) \<and> x \<in> P2"
+      if "\<Union> (fst ` set part2) = P1 \<union> \<Union> (fst ` set part1)" "x \<notin> P1" "(P1', v1) \<in> set part1" "x \<in> P1'" for x P1' v1
+      using that by (metis (no_types, lifting) UN_iff Un_iff fst_conv prod.collapse)
+    with partition_onD1[OF assms(2)] partition_onD1[OF assms(3)] show ?thesis
+      by (auto simp: map_filter_def subset_eq split_beta notinP2_def split: if_splits)
+  qed
+  show "\<And>A1 A2. A1 \<in> set (map fst (notinP2 P1 f v1 part2)) \<Longrightarrow>
+    A2 \<in> set (map fst (notinP2 P1 f v1 part2)) \<Longrightarrow> A1 \<noteq> A2 \<Longrightarrow> disjnt A1 A2" 
+    using partition_onD2[OF assms(3)]
+    by (auto simp: disjnt_def map_filter_def disjoint_def notinP2_def Ball_def Bex_def image_iff split: if_splits)
+  show "{} \<notin> set (map fst (notinP2 P1 f v1 part2))" 
+    using assms
+    by (auto simp: map_filter_def split: if_splits)
+  show "distinct (map fst ((P1, v1) # part1)) \<Longrightarrow> distinct (map fst part2) \<Longrightarrow>
+    distinct (map fst ((notinP2 P1 f v1 part2)))"
+    using partition_onD2[OF assms(3), unfolded disjoint_def]
+    by (clarsimp simp: notinP2_def map_filter_def distinct_map inj_on_def Ball_def Bex_def image_iff) blast
+qed
+
+lemma wf_part_list_tail: 
+  assumes "partition_on X (set (map fst ((P1, v1) # part1)))"
+    and "distinct (map fst ((P1, v1) # part1))"
+  shows "partition_on (X - P1) (set (map fst part1))"
+    and "distinct (map fst part1)"
+proof (rule partition_onI)
+  show "\<Union> (set (map fst part1)) = X - P1"
+    using partition_onD1[OF assms(1)] partition_onD2[OF assms(1)] assms(2)
+    by (auto simp: disjoint_def image_iff)
+  show "\<And>A1 A2. A1 \<in> set (map fst part1) \<Longrightarrow> A2 \<in> set (map fst part1) \<Longrightarrow> A1 \<noteq> A2 \<Longrightarrow> disjnt A1 A2" 
+    using partition_onD2[OF assms(1)]
+    by (clarsimp simp: disjnt_def disjoint_def)
+      (smt (verit, ccfv_SIG) Diff_disjoint Int_Diff Int_commute fst_conv)
+  show "{} \<notin> set (map fst part1)" 
+    using partition_onD3[OF assms(1)]
+    by (auto simp: map_filter_def split: if_splits)
+  show "distinct (map fst (part1))"
+    using assms(2)
+    by auto
+qed
+
+lemma partition_on_append: "partition_on X (set xs) \<Longrightarrow> partition_on Y (set ys) \<Longrightarrow> X \<inter> Y = {} \<Longrightarrow>
+  partition_on (X \<union> Y) (set (xs @ ys))"
+  by (auto simp: partition_on_def intro!: disjoint_union)
+
+lemma wf_part_list_merge_part2_raw: 
+  "partition_on X (set (map fst part1)) \<and> distinct (map fst part1) \<Longrightarrow>
+   partition_on X (set (map fst part2)) \<and> distinct (map fst part2) \<Longrightarrow>
+   partition_on X (set (map fst (merge_part2_raw f part1 part2))) 
+    \<and> distinct (map fst (merge_part2_raw f part1 part2))"
+proof(induct f part1 part2 arbitrary: X rule: merge_part2_raw.induct)
+  case (2 f P1 v1 part1 part2)
+  let ?inP1 = "List.map_filter (\<lambda>(P2, v2). if P1 \<inter> P2 \<noteq> {} then Some (P1 \<inter> P2, f v1 v2) else None) part2"
+    and ?notinP1 = "List.map_filter (\<lambda>(P2, v2). if P2 - P1 \<noteq> {} then Some (P2 - P1, v2) else None) part2"
+  have "P1 \<union> X = X"
+    using "2.prems"
+    by (auto simp: partition_on_def)
+  have wf_part1: "partition_on (X - P1) (set (map fst part1))"
+    "distinct (map fst part1)"
+    using wf_part_list_tail "2.prems" by auto
+  moreover have wf_notinP1: "partition_on (X - P1) (set (map fst ?notinP1))" 
+    "distinct (map fst (?notinP1))"
+    using wf_part_list_filter_minus[OF 2(2)[THEN conjunct1]] 
+      "2.prems" by auto
+  ultimately have IH: "partition_on (X - P1) (set (map fst (merge_part2_raw f part1 (?notinP1))))"
+    "distinct (map fst (merge_part2_raw f part1 (?notinP1)))"
+    using "2.hyps"[OF refl refl] by auto
+  moreover have wf_inP1: "partition_on P1 (set (map fst ?inP1))" "distinct (map fst ?inP1)"
+    using wf_part_list_filter_inter[OF 2(2)[THEN conjunct1]]
+      "2.prems" by auto
+  moreover have "(fst ` set ?inP1) \<inter> (fst ` set (merge_part2_raw f part1 (?notinP1))) = {}"
+    using IH(1)[THEN partition_onD1]
+    by (fastforce simp: map_filter_def split: prod.splits if_splits)
+  ultimately show ?case 
+    using partition_on_append[OF wf_inP1(1) IH(1)] \<open>P1 \<union> X = X\<close> wf_inP1(2) IH(2)
+    by simp
+qed simp
+
+lemma wf_part_list_merge_part3_raw: 
+  "partition_on X (set (map fst part1)) \<and> distinct (map fst part1) \<Longrightarrow>
+   partition_on X (set (map fst part2)) \<and> distinct (map fst part2) \<Longrightarrow>
+   partition_on X (set (map fst part3)) \<and> distinct (map fst part3) \<Longrightarrow>
+   partition_on X (set (map fst (merge_part3_raw f part1 part2 part3))) 
+    \<and> distinct (map fst (merge_part3_raw f part1 part2 part3))"
+proof(induct f part1 part2 part3 arbitrary: X rule: merge_part3_raw.induct)
+  case (4 f v va vb vc vd ve)
+  have "partition_on X (set (map fst (v # va))) \<and> distinct (map fst (vb # vc))"
+    using 4 by blast
+  moreover have "partition_on X (set (map fst (vb # vc))) \<and> distinct (map fst (vb # vc))"
+    using 4 by blast
+  ultimately have "partition_on X (set (map fst (merge_part2_raw f (v # va) (vb # vc)))) 
+  \<and> distinct (map fst (merge_part2_raw f (v # va) (vb # vc)))"
+    using wf_part_list_merge_part2_raw[of X "(v # va)" "(vb # vc)" f] 4
+    by fastforce
+  moreover have "partition_on X (set (map fst (vd # ve))) \<and> distinct (map fst (vd # ve))"
+    using 4 by blast
+  ultimately show ?case 
+    using wf_part_list_merge_part2_raw[of X "(vd # ve)" "(merge_part2_raw f (v # va) (vb # vc))" "(\<lambda>pt3 f'. f' pt3)"]
+    by simp
+qed auto
+
+lift_definition merge_part2 :: "('a \<Rightarrow> 'a \<Rightarrow> 'a) \<Rightarrow> ('d, 'a) part \<Rightarrow> ('d, 'a) part \<Rightarrow> ('d, 'a) part" is merge_part2_raw
+  by (rule wf_part_list_merge_part2_raw)
+
+lift_definition merge_part3 :: "('a \<Rightarrow> 'a \<Rightarrow> 'a \<Rightarrow> 'a) \<Rightarrow> ('d, 'a) part \<Rightarrow> ('d, 'a) part \<Rightarrow> ('d, 'a) part \<Rightarrow> ('d, 'a) part" is merge_part3_raw
+  by (rule wf_part_list_merge_part3_raw)
+
+definition proof_app :: "('n, 'd) proof \<Rightarrow> ('n, 'd) proof \<Rightarrow> ('n, 'd) proof" (infixl "\<oplus>" 65) where
+  "p \<oplus> q = (case (p, q) of
+   (Inl (SHistorically i li sps), Inl q) \<Rightarrow> Inl (SHistorically (i+1) li (sps @ [q]))
+ | (Inl (SAlways i hi sps), Inl q) \<Rightarrow> Inl (SAlways (i-1) hi (q # sps))
+ | (Inl (SSince sp2 sp1s), Inl q) \<Rightarrow> Inl (SSince sp2 (sp1s @ [q]))
+ | (Inl (SUntil sp1s sp2), Inl q) \<Rightarrow> Inl (SUntil (q # sp1s) sp2)
+ | (Inr (VSince i vp1 vp2s), Inr q) \<Rightarrow> Inr (VSince (i+1) vp1 (vp2s @ [q]))
+ | (Inr (VOnce i li vps), Inr q) \<Rightarrow> Inr (VOnce (i+1) li (vps @ [q]))
+ | (Inr (VEventually i hi vps), Inr q) \<Rightarrow> Inr (VEventually (i-1) hi (q # vps))
+ | (Inr (VSinceInf i li vp2s), Inr q) \<Rightarrow> Inr (VSinceInf (i+1) li (vp2s @ [q]))
+ | (Inr (VUntil i vp2s vp1), Inr q) \<Rightarrow> Inr (VUntil (i-1) (q # vp2s) vp1)
+ | (Inr (VUntilInf i hi vp2s), Inr q) \<Rightarrow> Inr (VUntilInf (i-1) hi (q # vp2s)))"
+
+definition proof_incr :: "('n, 'd) proof \<Rightarrow> ('n, 'd) proof" where
+  "proof_incr p = (case p of
+   Inl (SOnce i sp) \<Rightarrow> Inl (SOnce (i+1) sp)
+ | Inl (SEventually i sp) \<Rightarrow> Inl (SEventually (i-1) sp)
+ | Inl (SHistorically i li sps) \<Rightarrow> Inl (SHistorically (i+1) li sps)
+ | Inl (SAlways i hi sps) \<Rightarrow> Inl (SAlways (i-1) hi sps)
+ | Inr (VSince i vp1 vp2s) \<Rightarrow> Inr (VSince (i+1) vp1 vp2s)
+ | Inr (VOnce i li vps) \<Rightarrow> Inr (VOnce (i+1) li vps)
+ | Inr (VEventually i hi vps) \<Rightarrow> Inr (VEventually (i-1) hi vps)
+ | Inr (VHistorically i vp) \<Rightarrow> Inr (VHistorically (i+1) vp)
+ | Inr (VAlways i vp) \<Rightarrow> Inr (VAlways (i-1) vp)
+ | Inr (VSinceInf i li vp2s) \<Rightarrow> Inr (VSinceInf (i+1) li vp2s)
+ | Inr (VUntil i vp2s vp1) \<Rightarrow> Inr (VUntil (i-1) vp2s vp1)
+ | Inr (VUntilInf i hi vp2s) \<Rightarrow> Inr (VUntilInf (i-1) hi vp2s))"
+
+definition min_list_wrt :: "(('n, 'd) proof \<Rightarrow> ('n, 'd) proof \<Rightarrow> bool) \<Rightarrow> ('n, 'd) proof list \<Rightarrow> ('n, 'd) proof" where
+  "min_list_wrt r xs = hd [x \<leftarrow> xs. \<forall>y \<in> set xs. r x y]"
+
+definition do_neg :: "('n, 'd) proof \<Rightarrow> ('n, 'd) proof list" where
+  "do_neg p = (case p of
+  Inl sp \<Rightarrow> [Inr (VNeg sp)]
+| Inr vp \<Rightarrow> [Inl (SNeg vp)])"
+
+definition do_or :: "('n, 'd) proof \<Rightarrow> ('n, 'd) proof \<Rightarrow> ('n, 'd) proof list" where
+  "do_or p1 p2 = (case (p1, p2) of
+  (Inl sp1, Inl sp2) \<Rightarrow> [Inl (SOrL sp1), Inl (SOrR sp2)]
+| (Inl sp1, Inr _  ) \<Rightarrow> [Inl (SOrL sp1)]
+| (Inr _  , Inl sp2) \<Rightarrow> [Inl (SOrR sp2)]
+| (Inr vp1, Inr vp2) \<Rightarrow> [Inr (VOr vp1 vp2)])"
+
+definition do_and :: "('n, 'd) proof \<Rightarrow> ('n, 'd) proof \<Rightarrow> ('n, 'd) proof list" where
+  "do_and p1 p2 = (case (p1, p2) of
+  (Inl sp1, Inl sp2) \<Rightarrow> [Inl (SAnd sp1 sp2)]
+| (Inl _  , Inr vp2) \<Rightarrow> [Inr (VAndR vp2)]
+| (Inr vp1, Inl _  ) \<Rightarrow> [Inr (VAndL vp1)]
+| (Inr vp1, Inr vp2) \<Rightarrow> [Inr (VAndL vp1), Inr (VAndR vp2)])"
+
+definition do_imp :: "('n, 'd) proof \<Rightarrow> ('n, 'd) proof \<Rightarrow> ('n, 'd) proof list" where
+  "do_imp p1 p2 = (case (p1, p2) of
+  (Inl _  , Inl sp2) \<Rightarrow> [Inl (SImpR sp2)]
+| (Inl sp1, Inr vp2) \<Rightarrow> [Inr (VImp sp1 vp2)]
+| (Inr vp1, Inl sp2) \<Rightarrow> [Inl (SImpL vp1), Inl (SImpR sp2)]
+| (Inr vp1, Inr _  ) \<Rightarrow> [Inl (SImpL vp1)])"
+
+definition do_iff :: "('n, 'd) proof \<Rightarrow> ('n, 'd) proof \<Rightarrow> ('n, 'd) proof list" where
+  "do_iff p1 p2 = (case (p1, p2) of
+  (Inl sp1, Inl sp2) \<Rightarrow> [Inl (SIffSS sp1 sp2)]
+| (Inl sp1, Inr vp2) \<Rightarrow> [Inr (VIffSV sp1 vp2)]
+| (Inr vp1, Inl sp2) \<Rightarrow> [Inr (VIffVS vp1 sp2)]
+| (Inr vp1, Inr vp2) \<Rightarrow> [Inl (SIffVV vp1 vp2)])"
+
+definition do_exists :: "'n \<Rightarrow> ('n, 'd::{default,linorder}) proof + ('d, ('n, 'd) proof) part \<Rightarrow> ('n, 'd) proof list" where
+  "do_exists x p_part = (case p_part of
+  Inl p \<Rightarrow> (case p of
+    Inl sp \<Rightarrow> [Inl (SExists x default sp)]
+  | Inr vp \<Rightarrow> [Inr (VExists x (trivial_part vp))])
+| Inr part \<Rightarrow> (if (\<exists>x\<in>Vals part. isl x) then 
+                map (\<lambda>(D,p). map_sum (SExists x (Min D)) id p) (filter (\<lambda>(_, p). isl p) (subsvals part))
+              else
+                [Inr (VExists x (map_part projr part))]))"
+
+definition do_forall :: "'n \<Rightarrow> ('n, 'd::{default,linorder}) proof + ('d, ('n, 'd) proof) part \<Rightarrow> ('n, 'd) proof list" where
+  "do_forall x p_part = (case p_part of
+  Inl p \<Rightarrow> (case p of
+    Inl sp \<Rightarrow> [Inl (SForall x (trivial_part sp))]
+  | Inr vp \<Rightarrow> [Inr (VForall x default vp)])
+| Inr part \<Rightarrow> (if (\<forall>x\<in>Vals part. isl x) then 
+                [Inl (SForall x (map_part projl part))]
+              else 
+                map (\<lambda>(D,p). map_sum id (VForall x (Min D)) p) (filter (\<lambda>(_, p). \<not>isl p) (subsvals part))))"
+
+definition do_prev :: "nat \<Rightarrow> \<I> \<Rightarrow> nat \<Rightarrow> ('n, 'd) proof \<Rightarrow> ('n, 'd) proof list" where
+  "do_prev i I t p = (case (p, t < left I) of
+  (Inl _ , True) \<Rightarrow> [Inr (VPrevOutL i)]
+| (Inl sp, False) \<Rightarrow> (if mem t I then [Inl (SPrev sp)] else [Inr (VPrevOutR i)])
+| (Inr vp, True) \<Rightarrow> [Inr (VPrev vp), Inr (VPrevOutL i)]
+| (Inr vp, False) \<Rightarrow> (if mem t I then [Inr (VPrev vp)] else [Inr (VPrev vp), Inr (VPrevOutR i)]))"
+
+definition do_next :: "nat \<Rightarrow> \<I> \<Rightarrow> nat \<Rightarrow> ('n, 'd) proof \<Rightarrow> ('n, 'd) proof list" where
+  "do_next i I t p = (case (p, t < left I) of
+  (Inl _ , True) \<Rightarrow> [Inr (VNextOutL i)]
+| (Inl sp, False) \<Rightarrow> (if mem t I then [Inl (SNext sp)] else [Inr (VNextOutR i)])
+| (Inr vp, True) \<Rightarrow> [Inr (VNext vp), Inr (VNextOutL i)]
+| (Inr vp, False) \<Rightarrow> (if mem t I then [Inr (VNext vp)] else [Inr (VNext vp), Inr (VNextOutR i)]))"
+
+definition do_once_base :: "nat \<Rightarrow> nat \<Rightarrow> ('n, 'd) proof \<Rightarrow> ('n, 'd) proof list" where
+  "do_once_base i a p' = (case (p', a = 0) of
+  (Inl sp', True) \<Rightarrow> [Inl (SOnce i sp')]
+| (Inr vp', True) \<Rightarrow> [Inr (VOnce i i [vp'])]
+| ( _ , False) \<Rightarrow> [Inr (VOnce i i [])])"
+
+definition do_once :: "nat \<Rightarrow> nat \<Rightarrow> ('n, 'd) proof \<Rightarrow> ('n, 'd) proof \<Rightarrow> ('n, 'd) proof list" where
+  "do_once i a p p' = (case (p, a = 0, p') of
+  (Inl sp, True,  Inr _ ) \<Rightarrow> [Inl (SOnce i sp)]
+| (Inl sp, True,  Inl (SOnce _ sp')) \<Rightarrow> [Inl (SOnce i sp'), Inl (SOnce i sp)]
+| (Inl _ , False, Inl (SOnce _ sp')) \<Rightarrow> [Inl (SOnce i sp')]
+| (Inl _ , False, Inr (VOnce _ li vps')) \<Rightarrow> [Inr (VOnce i li vps')]
+| (Inr _ , True,  Inl (SOnce _ sp')) \<Rightarrow> [Inl (SOnce i sp')]
+| (Inr vp, True,  Inr vp') \<Rightarrow> [(Inr vp') \<oplus> (Inr vp)]
+| (Inr _ , False, Inl (SOnce _ sp')) \<Rightarrow> [Inl (SOnce i sp')]
+| (Inr _ , False, Inr (VOnce _ li vps')) \<Rightarrow> [Inr (VOnce i li vps')])"
+
+definition do_eventually_base :: "nat \<Rightarrow> nat \<Rightarrow> ('n, 'd) proof \<Rightarrow> ('n, 'd) proof list" where
+  "do_eventually_base i a p' = (case (p', a = 0) of
+  (Inl sp', True) \<Rightarrow> [Inl (SEventually i sp')]
+| (Inr vp', True) \<Rightarrow> [Inr (VEventually i i [vp'])]
+| ( _ , False) \<Rightarrow> [Inr (VEventually i i [])])"
+
+definition do_eventually :: "nat \<Rightarrow> nat \<Rightarrow> ('n, 'd) proof \<Rightarrow> ('n, 'd) proof \<Rightarrow> ('n, 'd) proof list" where
+  "do_eventually i a p p' = (case (p, a = 0, p') of
+  (Inl sp, True,  Inr _ ) \<Rightarrow> [Inl (SEventually i sp)]
+| (Inl sp, True,  Inl (SEventually _ sp')) \<Rightarrow> [Inl (SEventually i sp'), Inl (SEventually i sp)]
+| (Inl _ , False, Inl (SEventually _ sp')) \<Rightarrow> [Inl (SEventually i sp')]
+| (Inl _ , False, Inr (VEventually _ hi vps')) \<Rightarrow> [Inr (VEventually i hi vps')]
+| (Inr _ , True,  Inl (SEventually _ sp')) \<Rightarrow> [Inl (SEventually i sp')]
+| (Inr vp, True,  Inr vp') \<Rightarrow> [(Inr vp') \<oplus> (Inr vp)]
+| (Inr _ , False, Inl (SEventually _ sp')) \<Rightarrow> [Inl (SEventually i sp')]
+| (Inr _ , False, Inr (VEventually _ hi vps')) \<Rightarrow> [Inr (VEventually i hi vps')])"
+
+definition do_historically_base :: "nat \<Rightarrow> nat \<Rightarrow> ('n, 'd) proof \<Rightarrow> ('n, 'd) proof list" where
+  "do_historically_base i a p' = (case (p', a = 0) of
+  (Inl sp', True) \<Rightarrow> [Inl (SHistorically i i [sp'])]
+| (Inr vp', True) \<Rightarrow> [Inr (VHistorically i vp')]
+| ( _ , False) \<Rightarrow> [Inl (SHistorically i i [])])"
+
+definition do_historically :: "nat \<Rightarrow> nat \<Rightarrow> ('n, 'd) proof \<Rightarrow> ('n, 'd) proof \<Rightarrow> ('n, 'd) proof list" where
+  "do_historically i a p p' = (case (p, a = 0, p') of
+  (Inl _ , True,  Inr (VHistorically _ vp')) \<Rightarrow> [Inr (VHistorically i vp')]
+| (Inl sp, True,  Inl sp') \<Rightarrow> [(Inl sp') \<oplus> (Inl sp)]
+| (Inl _ , False, Inl (SHistorically _ li sps')) \<Rightarrow> [Inl (SHistorically i li sps')]
+| (Inl _ , False, Inr (VHistorically _ vp')) \<Rightarrow> [Inr (VHistorically i vp')]
+| (Inr vp, True,  Inl _ ) \<Rightarrow> [Inr (VHistorically i vp)]
+| (Inr vp, True,  Inr (VHistorically _ vp')) \<Rightarrow> [Inr (VHistorically i vp), Inr (VHistorically i vp')]
+| (Inr _ , False, Inl (SHistorically _ li sps')) \<Rightarrow> [Inl (SHistorically i li sps')]
+| (Inr _ , False, Inr (VHistorically _ vp')) \<Rightarrow> [Inr (VHistorically i vp')])"
+
+definition do_always_base :: "nat \<Rightarrow> nat \<Rightarrow> ('n, 'd) proof \<Rightarrow> ('n, 'd) proof list" where
+  "do_always_base i a p' = (case (p', a = 0) of
+  (Inl sp', True) \<Rightarrow> [Inl (SAlways i i [sp'])]
+| (Inr vp', True) \<Rightarrow> [Inr (VAlways i vp')]
+| ( _ , False) \<Rightarrow> [Inl (SAlways i i [])])"
+
+definition do_always :: "nat \<Rightarrow> nat \<Rightarrow> ('n, 'd) proof \<Rightarrow> ('n, 'd) proof \<Rightarrow> ('n, 'd) proof list" where
+  "do_always i a p p' = (case (p, a = 0, p') of
+  (Inl _ , True,  Inr (VAlways _ vp')) \<Rightarrow> [Inr (VAlways i vp')]
+| (Inl sp, True,  Inl sp') \<Rightarrow> [(Inl sp') \<oplus> (Inl sp)]
+| (Inl _ , False, Inl (SAlways _ hi sps')) \<Rightarrow> [Inl (SAlways i hi sps')]
+| (Inl _ , False, Inr (VAlways _ vp')) \<Rightarrow> [Inr (VAlways i vp')]
+| (Inr vp, True,  Inl _ ) \<Rightarrow> [Inr (VAlways i vp)]
+| (Inr vp, True,  Inr (VAlways _ vp')) \<Rightarrow> [Inr (VAlways i vp), Inr (VAlways i vp')]
+| (Inr _ , False, Inl (SAlways _ hi sps')) \<Rightarrow> [Inl (SAlways i hi sps')]
+| (Inr _ , False, Inr (VAlways _ vp')) \<Rightarrow> [Inr (VAlways i vp')])"
+
+definition do_since_base :: "nat \<Rightarrow> nat \<Rightarrow> ('n, 'd) proof \<Rightarrow> ('n, 'd) proof \<Rightarrow> ('n, 'd) proof list" where
+  "do_since_base i a p1 p2 = (case (p1, p2, a = 0) of
+  ( _ , Inl sp2, True) \<Rightarrow> [Inl (SSince sp2 [])]
+| (Inl _ , _ , False) \<Rightarrow> [Inr (VSinceInf i i [])]
+| (Inl _ , Inr vp2, True) \<Rightarrow> [Inr (VSinceInf i i [vp2])]
+| (Inr vp1, _ , False) \<Rightarrow> [Inr (VSince i vp1 []), Inr (VSinceInf i i [])]
+| (Inr vp1, Inr sp2, True) \<Rightarrow> [Inr (VSince i vp1 [sp2]), Inr (VSinceInf i i [sp2])])"
+
+definition do_since :: "nat \<Rightarrow> nat \<Rightarrow> ('n, 'd) proof \<Rightarrow> ('n, 'd) proof \<Rightarrow> ('n, 'd) proof \<Rightarrow> ('n, 'd) proof list" where
+  "do_since i a p1 p2 p' = (case (p1, p2, a = 0, p') of 
+  (Inl sp1, Inr _ , True, Inl sp') \<Rightarrow> [(Inl sp') \<oplus> (Inl sp1)]
+| (Inl sp1, _ , False, Inl sp') \<Rightarrow> [(Inl sp') \<oplus> (Inl sp1)]
+| (Inl sp1, Inl sp2, True, Inl sp') \<Rightarrow> [(Inl sp') \<oplus> (Inl sp1), Inl (SSince sp2 [])]
+| (Inl _ , Inr vp2, True, Inr (VSinceInf _ _ _ )) \<Rightarrow> [p' \<oplus> (Inr vp2)]
+| (Inl _ , _ , False, Inr (VSinceInf _ li vp2s')) \<Rightarrow> [Inr (VSinceInf i li vp2s')]
+| (Inl _ , Inr vp2, True, Inr (VSince _ _ _ )) \<Rightarrow> [p' \<oplus> (Inr vp2)]
+| (Inl _ , _ , False, Inr (VSince _ vp1' vp2s')) \<Rightarrow> [Inr (VSince i vp1' vp2s')]
+| (Inr vp1, Inr vp2, True, Inl _ ) \<Rightarrow> [Inr (VSince i vp1 [vp2])]
+| (Inr vp1, _ , False, Inl _ ) \<Rightarrow> [Inr (VSince i vp1 [])]
+| (Inr _ , Inl sp2, True, Inl _ ) \<Rightarrow> [Inl (SSince sp2 [])]
+| (Inr vp1, Inr vp2, True, Inr (VSinceInf _ _ _ )) \<Rightarrow> [Inr (VSince i vp1 [vp2]), p' \<oplus> (Inr vp2)]
+| (Inr vp1, _, False, Inr (VSinceInf _ li vp2s')) \<Rightarrow> [Inr (VSince i vp1 []), Inr (VSinceInf i li vp2s')]
+| ( _ , Inl sp2, True, Inr (VSinceInf _ _ _ )) \<Rightarrow> [Inl (SSince sp2 [])]
+| (Inr vp1, Inr vp2, True, Inr (VSince _ _ _ )) \<Rightarrow> [Inr (VSince i vp1 [vp2]), p' \<oplus> (Inr vp2)]
+| (Inr vp1, _ , False, Inr (VSince _ vp1' vp2s')) \<Rightarrow> [Inr (VSince i vp1 []), Inr (VSince i vp1' vp2s')]
+| ( _ , Inl vp2, True, Inr (VSince _ _ _ )) \<Rightarrow> [Inl (SSince vp2 [])])"
+
+definition do_until_base :: "nat \<Rightarrow> nat \<Rightarrow> ('n, 'd) proof \<Rightarrow> ('n, 'd) proof \<Rightarrow> ('n, 'd) proof list" where
+  "do_until_base i a p1 p2 = (case (p1, p2, a = 0) of
+  ( _ , Inl sp2, True) \<Rightarrow> [Inl (SUntil [] sp2)]
+| (Inl sp1, _ , False) \<Rightarrow> [Inr (VUntilInf i i [])]
+| (Inl sp1, Inr vp2, True) \<Rightarrow> [Inr (VUntilInf i i [vp2])]
+| (Inr vp1, _ , False) \<Rightarrow> [Inr (VUntil i [] vp1), Inr (VUntilInf i i [])]
+| (Inr vp1, Inr vp2, True) \<Rightarrow> [Inr (VUntil i [vp2] vp1), Inr (VUntilInf i i [vp2])])"
+
+definition do_until :: "nat \<Rightarrow> nat \<Rightarrow> ('n, 'd) proof \<Rightarrow> ('n, 'd) proof \<Rightarrow> ('n, 'd) proof \<Rightarrow> ('n, 'd) proof list" where
+  "do_until i a p1 p2 p' = (case (p1, p2, a = 0, p') of
+  (Inl sp1, Inr _ , True, Inl (SUntil _ _ )) \<Rightarrow> [p' \<oplus> (Inl sp1)]
+| (Inl sp1, _ , False, Inl (SUntil _ _ )) \<Rightarrow> [p' \<oplus> (Inl sp1)]
+| (Inl sp1, Inl sp2, True, Inl (SUntil _ _ )) \<Rightarrow> [p' \<oplus> (Inl sp1), Inl (SUntil [] sp2)]
+| (Inl _ , Inr vp2, True, Inr (VUntilInf _ _ _ )) \<Rightarrow> [p' \<oplus> (Inr vp2)]
+| (Inl _ , _ , False, Inr (VUntilInf _ hi vp2s')) \<Rightarrow> [Inr (VUntilInf i hi vp2s')]
+| (Inl _ , Inr vp2, True, Inr (VUntil _ _ _ )) \<Rightarrow> [p' \<oplus> (Inr vp2)]
+| (Inl _ , _ , False, Inr (VUntil _ vp2s' vp1')) \<Rightarrow> [Inr (VUntil i vp2s' vp1')]
+| (Inr vp1, Inr vp2, True, Inl (SUntil _ _ )) \<Rightarrow> [Inr (VUntil i [vp2] vp1)]
+| (Inr vp1, _ , False, Inl (SUntil _ _ )) \<Rightarrow> [Inr (VUntil i [] vp1)]
+| (Inr vp1, Inl sp2, True, Inl (SUntil _ _ )) \<Rightarrow> [Inl (SUntil [] sp2)]
+| (Inr vp1, Inr vp2, True, Inr (VUntilInf _ _ _ )) \<Rightarrow> [Inr (VUntil i [vp2] vp1), p' \<oplus> (Inr vp2)]
+| (Inr vp1, _ , False, Inr (VUntilInf _ hi vp2s')) \<Rightarrow> [Inr (VUntil i [] vp1), Inr (VUntilInf i hi vp2s')]
+| ( _ , Inl sp2, True, Inr (VUntilInf _ hi vp2s')) \<Rightarrow> [Inl (SUntil [] sp2)]
+| (Inr vp1, Inr vp2, True, Inr (VUntil _ _ _ )) \<Rightarrow> [Inr (VUntil i [vp2] vp1), p' \<oplus> (Inr vp2)]
+| (Inr vp1, _ , False, Inr (VUntil _ vp2s' vp1')) \<Rightarrow> [Inr (VUntil i [] vp1), Inr (VUntil i vp2s' vp1')]
+| ( _ , Inl sp2, True, Inr (VUntil _ _ _ )) \<Rightarrow> [Inl (SUntil [] sp2)])"
+
+fun match :: "('n, 'd) Formula.trm list \<Rightarrow> 'd list \<Rightarrow> ('n \<rightharpoonup> 'd) option" where
+  "match [] [] = Some Map.empty"
+| "match (Formula.Const x # ts) (y # ys) = (if x = y then match ts ys else None)"
+| "match (Formula.Var x # ts) (y # ys) = (case match ts ys of
+      None \<Rightarrow> None
+    | Some f \<Rightarrow> (case f x of
+        None \<Rightarrow> Some (f(x \<mapsto> y))
+      | Some z \<Rightarrow> if y = z then Some f else None))"
+| "match _ _ = None"
+
+fun pdt_of :: "nat \<Rightarrow> 'n \<Rightarrow> ('n, 'd :: linorder) Formula.trm list \<Rightarrow> 'n list \<Rightarrow> ('n \<rightharpoonup> 'd) list \<Rightarrow> ('n, 'd) expl" where
+  "pdt_of i r ts [] V = (if List.null V then Leaf (Inr (VPred i r ts)) else Leaf (Inl (SPred i r ts)))"
+| "pdt_of i r ts (x # vs) V =
+     (let ds = remdups (List.map_filter (\<lambda>v. v x) V);
+          part = tabulate ds (\<lambda>d. pdt_of i r ts vs (filter (\<lambda>v. v x = Some d) V)) (pdt_of i r ts vs [])
+     in Node x part)"
+
+fun "apply_pdt1" :: "'n list \<Rightarrow> (('n, 'd) proof \<Rightarrow> ('n, 'd) proof) \<Rightarrow> ('n, 'd) expl \<Rightarrow> ('n, 'd) expl" where
+  "apply_pdt1 vs f (Leaf pt) = Leaf (f pt)"
+| "apply_pdt1 (z # vs) f (Node x part) =
+  (if x = z then
+     Node x (map_part (\<lambda>expl. apply_pdt1 vs f expl) part)
+   else
+     apply_pdt1 vs f (Node x part))"
+| "apply_pdt1 [] _ (Node _ _) = undefined"
+
+fun "apply_pdt2" :: "'n list \<Rightarrow> (('n, 'd) proof \<Rightarrow> ('n, 'd) proof \<Rightarrow> ('n, 'd) proof) \<Rightarrow> ('n, 'd) expl \<Rightarrow> ('n, 'd) expl \<Rightarrow> ('n, 'd) expl" where
+  "apply_pdt2 vs f (Leaf pt1) (Leaf pt2) = Leaf (f pt1 pt2)"
+| "apply_pdt2 vs f (Leaf pt1) (Node x part2) = Node x (map_part (apply_pdt1 vs (f pt1)) part2)"
+| "apply_pdt2 vs f (Node x part1) (Leaf pt2) = Node x (map_part (apply_pdt1 vs (\<lambda>pt1. f pt1 pt2)) part1)"
+| "apply_pdt2 (z # vs) f (Node x part1) (Node y part2) =
+    (if x = z \<and> y = z then
+       Node z (merge_part2 (apply_pdt2 vs f) part1 part2)
+     else if x = z then
+       Node x (map_part (\<lambda>expl1. apply_pdt2 vs f expl1 (Node y part2)) part1)
+     else if y = z then
+       Node y (map_part (\<lambda>expl2. apply_pdt2 vs f (Node x part1) expl2) part2)
+     else
+       apply_pdt2 vs f (Node x part1) (Node y part2))"
+| "apply_pdt2 [] _ (Node _ _) (Node _ _) = undefined"
+
+fun "apply_pdt3" :: "'n list \<Rightarrow> (('n, 'd) proof \<Rightarrow> ('n, 'd) proof \<Rightarrow> ('n, 'd) proof \<Rightarrow> ('n, 'd) proof) \<Rightarrow> ('n, 'd) expl \<Rightarrow> ('n, 'd) expl \<Rightarrow> ('n, 'd) expl \<Rightarrow> ('n, 'd) expl" where
+  "apply_pdt3 vs f (Leaf pt1) (Leaf pt2) (Leaf pt3) = Leaf (f pt1 pt2 pt3)"
+| "apply_pdt3 vs f (Leaf pt1) (Leaf pt2) (Node x part3) = Node x (map_part (apply_pdt2 vs (f pt1) (Leaf pt2)) part3)" 
+| "apply_pdt3 vs f (Leaf pt1) (Node x part2) (Leaf pt3) = Node x (map_part (apply_pdt2 vs (\<lambda>pt2. f pt1 pt2) (Leaf pt3)) part2)"
+| "apply_pdt3 vs f (Node x part1) (Leaf pt2) (Leaf pt3) = Node x (map_part (apply_pdt2 vs (\<lambda>pt1. f pt1 pt2) (Leaf pt3)) part1)"
+| "apply_pdt3 (w # vs) f (Leaf pt1) (Node y part2) (Node z part3) = 
+  (if y = w \<and> z = w then
+     Node w (merge_part2 (apply_pdt2 vs (f pt1)) part2 part3)
+   else if y = w then
+     Node y (map_part (\<lambda>expl2. apply_pdt2 vs (f pt1) expl2 (Node z part3)) part2)
+   else if z = w then
+     Node z (map_part (\<lambda>expl3. apply_pdt2 vs (f pt1) (Node y part2) expl3) part3)
+   else
+     apply_pdt3 vs f (Leaf pt1) (Node y part2) (Node z part3))"
+| "apply_pdt3 (w # vs) f (Node x part1) (Node y part2) (Leaf pt3) = 
+  (if x = w \<and> y = w then
+     Node w (merge_part2 (apply_pdt2 vs (\<lambda>pt1 pt2. f pt1 pt2 pt3)) part1 part2)
+   else if x = w then
+     Node x (map_part (\<lambda>expl1. apply_pdt2 vs (\<lambda>pt1 pt2. f pt1 pt2 pt3) expl1 (Node y part2)) part1)
+   else if y = w then
+     Node y (map_part (\<lambda>expl2. apply_pdt2 vs (\<lambda>pt1 pt2. f pt1 pt2 pt3) (Node x part1) expl2) part2)
+   else
+     apply_pdt3 vs f (Node x part1) (Node y part2) (Leaf pt3))"
+| "apply_pdt3 (w # vs) f (Node x part1) (Leaf pt2) (Node z part3) = 
+  (if x = w \<and> z = w then
+     Node w (merge_part2 (apply_pdt2 vs (\<lambda>pt1. f pt1 pt2)) part1 part3)
+   else if x = w then
+     Node x (map_part (\<lambda>expl1. apply_pdt2 vs (\<lambda>pt1. f pt1 pt2) expl1 (Node z part3)) part1)
+   else if z = w then
+     Node z (map_part (\<lambda>expl3. apply_pdt2 vs (\<lambda>pt1. f pt1 pt2) (Node x part1) expl3) part3)
+   else
+     apply_pdt3 vs f (Node x part1) (Leaf pt2) (Node z part3))"
+| "apply_pdt3 (w # vs) f (Node x part1) (Node y part2) (Node z part3) = 
+  (if x = w \<and> y = w \<and> z = w then
+     Node z (merge_part3 (apply_pdt3 vs f) part1 part2 part3)
+   else if x = w \<and> y = w then
+     Node w (merge_part2 (apply_pdt3 vs (\<lambda>pt3 pt1 pt2. f pt1 pt2 pt3) (Node z part3)) part1 part2)
+   else if x = w \<and> z = w then
+     Node w (merge_part2 (apply_pdt3 vs (\<lambda>pt2 pt1 pt3. f pt1 pt2 pt3) (Node y part2)) part1 part3)
+   else if y = w \<and> z = w then
+     Node w (merge_part2 (apply_pdt3 vs (\<lambda>pt1. f pt1) (Node x part1)) part2 part3)
+   else if x = w then
+     Node x (map_part (\<lambda>expl1. apply_pdt3 vs f expl1 (Node y part2) (Node z part3)) part1)
+   else if y = w then
+     Node y (map_part (\<lambda>expl2. apply_pdt3 vs f (Node x part1) expl2 (Node z part3)) part2)
+   else if z = w then
+     Node z (map_part (\<lambda>expl3. apply_pdt3 vs f (Node x part1) (Node y part2) expl3) part3)
+   else 
+     apply_pdt3 vs f (Node x part1) (Node y part2) (Node z part3))"
+| "apply_pdt3 [] _ _ _ _ = undefined"
+
+fun "hide_pdt" :: "'n list \<Rightarrow> (('n, 'd) proof + ('d, ('n, 'd) proof) part \<Rightarrow> ('n, 'd) proof) \<Rightarrow> ('n, 'd) expl \<Rightarrow> ('n, 'd) expl" where
+  "hide_pdt vs f (Leaf pt) = Leaf (f (Inl pt))"
+| "hide_pdt [x] f (Node y part) = Leaf (f (Inr (map_part unleaf part)))"
+| "hide_pdt (x # xs) f (Node y part) = 
+  (if x = y then
+     Node y (map_part (hide_pdt xs f) part)
+   else
+     hide_pdt xs f (Node y part))"
+| "hide_pdt [] _ _ = undefined"
+
+context 
+  fixes \<sigma> :: "('n, 'd :: {default, linorder}) trace" and
+  cmp :: "('n, 'd) proof \<Rightarrow> ('n, 'd) proof \<Rightarrow> bool"
+begin
+
+function (sequential) eval :: "'n list \<Rightarrow> nat \<Rightarrow> ('n, 'd) Formula.formula \<Rightarrow> ('n, 'd) expl" where
+  "eval vs i Formula.TT = Leaf (Inl (STT i))"
+| "eval vs i Formula.FF = Leaf (Inr (VFF i))"
+| "eval vs i (Eq_Const x c) = Node x (tabulate [c] (\<lambda>c. Leaf (Inl (SEq_Const i x c))) (Leaf (Inr (VEq_Const i x c))))"
+| "eval vs i (Formula.Pred r ts) = 
+  (pdt_of i r ts (filter (\<lambda>x. x \<in> Formula.fv (Formula.Pred r ts)) vs) (List.map_filter (match ts) (sorted_list_of_set (snd ` {rd \<in> \<Gamma> \<sigma> i. fst rd = r}))))"
+| "eval vs i (Formula.Neg \<phi>) = apply_pdt1 vs (\<lambda>p. min_list_wrt cmp (do_neg p)) (eval vs i \<phi>)"
+| "eval vs i (Formula.Or \<phi> \<psi>) = apply_pdt2 vs (\<lambda>p1 p2. min_list_wrt cmp (do_or p1 p2)) (eval vs i \<phi>) (eval vs i \<psi>)"
+| "eval vs i (Formula.And \<phi> \<psi>) = apply_pdt2 vs (\<lambda>p1 p2. min_list_wrt cmp (do_and p1 p2)) (eval vs i \<phi>) (eval vs i \<psi>)"
+| "eval vs i (Formula.Imp \<phi> \<psi>) = apply_pdt2 vs (\<lambda>p1 p2. min_list_wrt cmp (do_imp p1 p2)) (eval vs i \<phi>) (eval vs i \<psi>)"
+| "eval vs i (Formula.Iff \<phi> \<psi>) = apply_pdt2 vs (\<lambda>p1 p2. min_list_wrt cmp (do_iff p1 p2)) (eval vs i \<phi>) (eval vs i \<psi>)"
+| "eval vs i (Formula.Exists x \<phi>) = hide_pdt (vs @ [x]) (\<lambda>p. min_list_wrt cmp (do_exists x p)) (eval (vs @ [x]) i \<phi>)"
+| "eval vs i (Formula.Forall x \<phi>) = hide_pdt (vs @ [x]) (\<lambda>p. min_list_wrt cmp (do_forall x p)) (eval (vs @ [x]) i \<phi>)"
+| "eval vs i (Formula.Prev I \<phi>) = (if i = 0 then Leaf (Inr VPrevZ) 
+                                   else apply_pdt1 vs (\<lambda>p. min_list_wrt cmp (do_prev i I (\<Delta> \<sigma> i) p)) (eval vs (i-1) \<phi>))"
+| "eval vs i (Formula.Next I \<phi>) = apply_pdt1 vs (\<lambda>l. min_list_wrt cmp (do_next i I (\<Delta> \<sigma> (i+1)) l)) (eval vs (i+1) \<phi>)"
+| "eval vs i (Formula.Once I \<phi>) = 
+  (if \<tau> \<sigma> i < \<tau> \<sigma> 0 + left I then Leaf (Inr (VOnceOut i)) 
+   else (let expl = eval vs i \<phi> in
+        (if i = 0 then 
+           apply_pdt1 vs (\<lambda>p. min_list_wrt cmp (do_once_base 0 0 p)) expl
+         else (if right I \<ge> enat (\<Delta> \<sigma> i) then
+                 apply_pdt2 vs (\<lambda>p p'. min_list_wrt cmp (do_once i (left I) p p')) expl
+                            (eval vs (i-1) (Formula.Once (subtract (\<Delta> \<sigma> i) I) \<phi>))
+               else apply_pdt1 vs (\<lambda>p. min_list_wrt cmp (do_once_base i (left I) p)) expl))))"
+| "eval vs i (Formula.Historically I \<phi>) = 
+  (if \<tau> \<sigma> i < \<tau> \<sigma> 0 + left I then Leaf (Inl (SHistoricallyOut i)) 
+   else (let expl = eval vs i \<phi> in
+        (if i = 0 then 
+           apply_pdt1 vs (\<lambda>p. min_list_wrt cmp (do_historically_base 0 0 p)) expl
+         else (if right I \<ge> enat (\<Delta> \<sigma> i) then
+                 apply_pdt2 vs (\<lambda>p p'. min_list_wrt cmp (do_historically i (left I) p p')) expl
+                            (eval vs (i-1) (Formula.Historically (subtract (\<Delta> \<sigma> i) I) \<phi>))
+               else apply_pdt1 vs (\<lambda>p. min_list_wrt cmp (do_historically_base i (left I) p)) expl))))"
+| "eval vs i (Formula.Eventually I \<phi>) = 
+  (let expl = eval vs i \<phi> in
+  (if right I = \<infinity> then undefined 
+   else (if right I \<ge> enat (\<Delta> \<sigma> (i+1)) then
+           apply_pdt2 vs (\<lambda>p p'. min_list_wrt cmp (do_eventually i (left I) p p')) expl
+                            (eval vs (i+1) (Formula.Eventually (subtract (\<Delta> \<sigma> (i+1)) I) \<phi>))
+         else apply_pdt1 vs (\<lambda>p. min_list_wrt cmp (do_eventually_base i (left I) p)) expl)))"
+| "eval vs i (Formula.Always I \<phi>) = 
+  (let expl = eval vs i \<phi> in
+  (if right I = \<infinity> then undefined 
+   else (if right I \<ge> enat (\<Delta> \<sigma> (i+1)) then
+           apply_pdt2 vs (\<lambda>p p'. min_list_wrt cmp (do_always i (left I) p p')) expl
+                            (eval vs (i+1) (Formula.Always (subtract (\<Delta> \<sigma> (i+1)) I) \<phi>))
+         else apply_pdt1 vs (\<lambda>p. min_list_wrt cmp (do_always_base i (left I) p)) expl)))"
+| "eval vs i (Formula.Since \<phi> I \<psi>) = 
+  (if \<tau> \<sigma> i < \<tau> \<sigma> 0 + left I then Leaf (Inr (VSinceOut i)) 
+   else (let expl1 = eval vs i \<phi> in
+         let expl2 = eval vs i \<psi> in
+         (if i = 0 then 
+            apply_pdt2 vs (\<lambda>p1 p2. min_list_wrt cmp (do_since_base 0 0 p1 p2)) expl1 expl2
+          else (if right I \<ge> enat (\<Delta> \<sigma> i) then
+                  apply_pdt3 vs (\<lambda>p1 p2 p'. min_list_wrt cmp (do_since i (left I) p1 p2 p')) expl1 expl2
+                             (eval vs (i-1) (Formula.Since \<phi> (subtract (\<Delta> \<sigma> i) I) \<psi>))
+                else apply_pdt2 vs (\<lambda>p1 p2. min_list_wrt cmp (do_since_base i (left I) p1 p2)) expl1 expl2))))"
+| "eval vs i (Formula.Until \<phi> I \<psi>) = 
+  (let expl1 = eval vs i \<phi> in
+   let expl2 = eval vs i \<psi> in
+   (if right I = \<infinity> then undefined 
+    else (if right I \<ge> enat (\<Delta> \<sigma> (i+1)) then
+            apply_pdt3 vs (\<lambda>p1 p2 p'. min_list_wrt cmp (do_until i (left I) p1 p2 p')) expl1 expl2
+                             (eval vs (i+1) (Formula.Until \<phi> (subtract (\<Delta> \<sigma> (i+1)) I) \<psi>))
+          else apply_pdt2 vs (\<lambda>p1 p2. min_list_wrt cmp (do_until_base i (left I) p1 p2)) expl1 expl2)))"
+  by pat_completeness auto
+
+fun dist where
+  "dist i (Formula.Once _ _) = i"
+| "dist i (Formula.Historically _ _) = i"
+| "dist i (Formula.Eventually I _) = LTP \<sigma> (case right I of \<infinity> \<Rightarrow> 0 | enat b \<Rightarrow> (\<tau> \<sigma> i + b)) - i"
+| "dist i (Formula.Always I _) = LTP \<sigma> (case right I of \<infinity> \<Rightarrow> 0 | enat b \<Rightarrow> (\<tau> \<sigma> i + b)) - i"
+| "dist i (Formula.Since _ _ _) = i"
+| "dist i (Formula.Until _ I _) = LTP \<sigma> (case right I of \<infinity> \<Rightarrow> 0 | enat b \<Rightarrow> (\<tau> \<sigma> i + b)) - i"
+| "dist _ _ = undefined"
+
+lemma i_less_LTP: "\<tau> \<sigma> (Suc i) \<le> b + \<tau> \<sigma> i \<Longrightarrow> i < LTP \<sigma> (b + \<tau> \<sigma> i)"
+  by (metis Suc_le_lessD i_le_LTPi_add le_iff_add)
+
+termination eval
+  by (relation "measures [\<lambda>(_, _, \<phi>). size \<phi>, \<lambda>(_, i, \<phi>). dist i \<phi>]")
+    (auto simp: add.commute le_diff_conv i_less_LTP intro!: diff_less_mono2)
+
+end
+
+end
\ No newline at end of file
diff --git a/thys/MFOTL_Checker/Partition.thy b/thys/MFOTL_Checker/Partition.thy
new file mode 100644
--- /dev/null
+++ b/thys/MFOTL_Checker/Partition.thy
@@ -0,0 +1,297 @@
+(*<*)
+theory Partition
+  imports "HOL-Library.Disjoint_Sets"
+begin
+(*>*)
+
+section \<open>Valued Partitions\<close>
+
+lemma part_list_set_eq_aux1:
+  assumes
+    "\<forall>i<length xs. \<forall>j<length xs. i \<noteq> j \<longrightarrow>  fst (xs ! i) \<inter> fst (xs ! j) = {}"
+    "{} \<notin> fst ` set xs"
+  shows "disjoint (fst ` set xs) \<and> distinct (map fst xs)"
+proof -
+  from assms(1) have "disjoint (fst ` set xs)"
+    by (metis disjnt_def in_set_conv_nth pairwise_imageI)
+  moreover have "distinct (map fst xs)"
+    using assms
+    by (smt (verit) distinct_conv_nth image_iff inf.idem 
+        length_map nth_map nth_mem) 
+  ultimately show ?thesis
+    by blast
+qed
+
+lemma part_list_set_eq_aux2:
+  assumes
+    "disjoint (fst ` set xs)"
+    "distinct (map fst xs)"
+    "i < length xs"
+    "j < length xs"
+    "i \<noteq> j"
+  shows "fst (xs ! i) \<inter> fst (xs ! j) = {}"
+proof -
+  from assms have "fst (xs ! i) \<in> fst ` set xs"
+    and "fst (xs ! j) \<in> fst ` set xs"
+    by auto
+  moreover have "fst (xs ! i) \<noteq> fst (xs ! j)"
+    using assms(2-) nth_eq_iff_index_eq 
+    by fastforce 
+  ultimately show ?thesis
+    using assms(1) unfolding disjoint_def
+    by blast
+qed
+
+lemma part_list_eq: 
+  "(\<Union>X \<in> fst ` set xs. X) = UNIV
+    \<and> (\<forall>i < length xs. \<forall>j < length xs. i \<noteq> j 
+      \<longrightarrow> fst (xs ! i) \<inter> fst (xs ! j) = {}) \<and> {} \<notin> fst ` set xs
+  \<longleftrightarrow> partition_on UNIV (set (map fst xs)) \<and> distinct (map fst xs)"
+  using part_list_set_eq_aux1 part_list_set_eq_aux2
+  unfolding partition_on_def by (auto 5 0)
+
+text \<open>@{typ 'd}: domain (such that the union of @{typ 'd} sets form a partition)\<close>
+typedef ('d, 'a) part = "{xs :: ('d set \<times> 'a) list. partition_on UNIV (set (map fst xs)) \<and> distinct (map fst xs)}"
+  by (rule exI[of _ "[(UNIV, undefined)]"]) (auto simp: partition_on_def)
+
+setup_lifting type_definition_part
+
+lift_bnf (no_warn_wits, no_warn_transfer) (dead 'd, Vals: 'a) part
+  unfolding part_list_eq[symmetric]
+  by (auto simp: image_iff)
+
+subsection \<open>\<^const>\<open>size\<close> setup\<close>
+
+lift_definition subs :: "('d, 'a) part \<Rightarrow> 'd set list" is "map fst" .
+
+lift_definition Subs :: "('d, 'a) part \<Rightarrow> 'd set set" is "set o map fst" .
+
+lift_definition vals :: "('d, 'a) part \<Rightarrow> 'a list" is "map snd" .
+
+lift_definition SubsVals :: "('d, 'a) part \<Rightarrow> ('d set \<times> 'a) set" is "set" .
+
+lift_definition subsvals :: "('d, 'a) part \<Rightarrow> ('d set \<times> 'a) list" is "id" .
+
+lift_definition size_part :: "('d \<Rightarrow> nat) \<Rightarrow> ('a \<Rightarrow> nat) \<Rightarrow> ('d, 'a) part \<Rightarrow> nat" is "\<lambda>f g. size_list (\<lambda>(x, y). sum f x + g y)" .
+
+instantiation part :: (type, type) size begin
+
+definition size_part where
+size_part_overloaded_def: "size_part = Partition.size_part (\<lambda>_. 0) (\<lambda>_. 0)"
+
+instance ..
+
+end
+
+lemma size_part_overloaded_simps[simp]: "size x = size (vals x)"
+  unfolding size_part_overloaded_def
+  by transfer (auto simp: size_list_conv_sum_list)
+
+lemma part_size_o_map: "inj h \<Longrightarrow> size_part f g \<circ> map_part h = size_part f (g \<circ> h)"
+  by (rule ext, transfer)
+    (auto simp: fun_eq_iff map_prod_def o_def split_beta case_prod_beta[abs_def])
+
+setup \<open>
+BNF_LFP_Size.register_size_global \<^type_name>\<open>part\<close> \<^const_name>\<open>size_part\<close>
+  @{thm size_part_overloaded_def} @{thms size_part_def size_part_overloaded_simps}
+  @{thms part_size_o_map}
+\<close>
+
+lemma is_measure_size_part[measure_function]: "is_measure f \<Longrightarrow> is_measure g \<Longrightarrow> is_measure (size_part f g)"
+  by (rule is_measure_trivial)
+
+lemma size_part_estimation[termination_simp]: "x \<in> Vals xs \<Longrightarrow> y < g x \<Longrightarrow> y < size_part f g xs"
+  by transfer (auto simp: termination_simp)
+
+lemma size_part_estimation'[termination_simp]: "x \<in> Vals xs \<Longrightarrow> y \<le> g x \<Longrightarrow> y \<le> size_part f g xs"
+  by transfer (auto simp: termination_simp)
+
+lemma size_part_pointwise[termination_simp]: "(\<And>x. x \<in> Vals xs \<Longrightarrow> f x \<le> g x) \<Longrightarrow> size_part h f xs \<le> size_part h g xs"
+  by transfer (force simp: image_iff intro!: size_list_pointwise)
+
+subsection \<open>Functions on Valued Partitions\<close>
+
+lemma Vals_code[code]: "Vals x = set (map snd (Rep_part x))"
+  by (force simp: Vals_def)
+
+lemma Vals_transfer[transfer_rule]: "rel_fun (pcr_part (=) (=)) (=) (set \<circ> map snd) Vals"
+  by (force simp: Vals_def rel_fun_def pcr_part_def cr_part_def rel_set_eq prod.rel_eq list.rel_eq)
+
+lemma set_vals[simp]: "set (vals xs) = Vals xs"
+  by transfer simp
+
+lift_definition part_hd :: "('d, 'a) part \<Rightarrow> 'a" is "snd \<circ> hd" .
+
+lift_definition tabulate :: "'d list \<Rightarrow> ('d \<Rightarrow> 'n) \<Rightarrow> 'n \<Rightarrow> ('d, 'n) part" is
+  "\<lambda>ds f z. if distinct ds then if set ds = UNIV then map (\<lambda>d. ({d}, f d)) ds else (- set ds, z) # map (\<lambda>d. ({d}, f d)) ds else [(UNIV, z)]"
+  by (auto simp: o_def distinct_map inj_on_def partition_on_def disjoint_def)
+
+lift_definition lookup_part :: "('d, 'a) part \<Rightarrow> 'd \<Rightarrow> 'a" is "\<lambda>xs d. snd (the (find (\<lambda>(D, _). d \<in> D) xs))" .
+
+lemma Vals_tabulate[simp]: "Vals (tabulate xs f z) =
+  (if distinct xs then if set xs = UNIV then f ` set xs else {z} \<union> f ` set xs else {z})"
+  by transfer (auto simp: image_iff)
+
+lemma lookup_part_tabulate[simp]: "lookup_part (tabulate xs f z) x =
+  (if distinct xs \<and> x \<in> set xs then f x else z)"
+  by (transfer fixing: x xs f z)
+    (auto simp: find_dropWhile dropWhile_eq_Cons_conv map_eq_append_conv split: list.splits)
+
+lemma part_hd_Vals[simp]: "part_hd part \<in> Vals part"
+  by transfer (auto simp: partition_on_def image_iff intro!: hd_in_set)
+
+lemma lookup_part_Vals[simp]: "lookup_part part d \<in> Vals part"
+proof (transfer, goal_cases part)
+  case (part xs d)
+  then have unique: "(\<forall>i<length xs. \<forall>j<length xs. i \<noteq> j \<longrightarrow> fst (xs ! i) \<inter> fst (xs ! j) = {})"
+    using part_list_eq[of xs]
+    by simp
+  from part obtain D x where D: "(D, x) \<in> set xs" "d \<in> D"
+    unfolding partition_on_def
+    by fastforce
+  with unique have "find (\<lambda>(D, _). d \<in> D) xs = Some (D, x)"
+    unfolding set_eq_iff
+    by (auto simp: find_Some_iff in_set_conv_nth split_beta)
+  with D show ?case
+    by (force simp: image_iff)
+qed
+
+lemma lookup_part_SubsVals: "\<exists>D. d \<in> D \<and> (D, lookup_part part d) \<in> SubsVals part"
+proof (transfer, goal_cases part)
+  case (part d xs)
+  then have unique: "(\<forall>i<length xs. \<forall>j<length xs. i \<noteq> j \<longrightarrow> fst (xs ! i) \<inter> fst (xs ! j) = {})"
+    using part_list_eq[of xs]
+    by simp
+  from part obtain D x where D: "(D, x) \<in> set xs" "d \<in> D"
+    unfolding partition_on_def
+    by fastforce
+  with unique have "find (\<lambda>(D, _). d \<in> D) xs = Some (D, x)"
+    unfolding set_eq_iff
+    by (auto simp: find_Some_iff in_set_conv_nth split_beta)
+  with D show ?case
+    by (force simp: image_iff)
+qed
+
+lemma lookup_part_from_subvals: "(D, e) \<in> set (subsvals part) \<Longrightarrow> d \<in> D \<Longrightarrow> lookup_part part d = e"
+proof (transfer fixing: D e d, goal_cases)
+  case (1 part)
+  then show ?case 
+  proof (cases "find (\<lambda>(D, _). d \<in> D) part")
+    case (Some De)
+    from 1 show ?thesis 
+      unfolding partition_on_def set_eq_iff Some using Some unfolding find_Some_iff
+      by (fastforce dest!: spec[of _ d] simp: in_set_conv_nth split_beta dest: part_list_set_eq_aux2)
+  qed (auto simp: partition_on_def image_iff find_None_iff)
+qed
+
+lemma size_lookup_part_estimation[termination_simp]: "size (lookup_part part d) < Suc (size_part (\<lambda>_. 0) size part)"
+  unfolding less_Suc_eq_le
+  by (rule size_part_estimation'[OF _ order_refl]) simp
+
+lemma subsvals_part_estimation[termination_simp]: "(D, e) \<in> set (subsvals part) \<Longrightarrow> size e < Suc (size_part (\<lambda>_. 0) size part)"
+  unfolding less_Suc_eq_le
+  by (rule size_part_estimation'[OF _ order_refl], transfer)
+    (force simp: image_iff)
+
+lemma size_part_hd_estimation[termination_simp]: "size (part_hd part) < Suc (size_part (\<lambda>_. 0) size part)"
+  unfolding less_Suc_eq_le
+  by (rule size_part_estimation'[OF _ order_refl]) simp
+
+lemma size_last_estimation[termination_simp]: "xs \<noteq> [] \<Longrightarrow> size (last xs) < size_list size xs"
+  by (induct xs) auto
+
+lift_definition lookup :: "('d, 'a) part \<Rightarrow> 'd \<Rightarrow> ('d set \<times> 'a)" is "\<lambda>xs d. the (find (\<lambda>(D, _). d \<in> D) xs)" .
+
+lemma snd_lookup[simp]: "snd (lookup part d) = lookup_part part d"
+  by transfer auto
+
+lemma distinct_disjoint_uniq: "distinct xs \<Longrightarrow> disjoint (set xs) \<Longrightarrow>
+  i < j \<Longrightarrow> j < length xs \<Longrightarrow> d \<in> xs ! i \<Longrightarrow> d \<in> xs ! j \<Longrightarrow> False"
+  unfolding disjoint_def disjoint_iff
+  by (metis (no_types, lifting) order.strict_trans min.strict_order_iff nth_eq_iff_index_eq nth_mem)
+
+lemma partition_on_UNIV_find_Some:
+  "partition_on UNIV (set (map fst part)) \<Longrightarrow> distinct (map fst part) \<Longrightarrow>
+  \<exists>y. find (\<lambda>(D, _). d \<in> D) part = Some y"
+  unfolding partition_on_def set_eq_iff
+  by (auto simp: find_Some_iff in_set_conv_nth
+      Ball_def image_iff Bex_def split_beta dest: distinct_disjoint_uniq dest!: spec[of _ d]
+      intro!: exI[where P="\<lambda>x. \<exists>y z. P x y z \<and> Q x y z" for P Q, OF exI, OF exI, OF conjI])
+
+lemma fst_lookup: "d \<in> fst (lookup part d)"
+proof (transfer fixing: d, goal_cases)
+  case (1 part)
+  then obtain y where "find (\<lambda>(D, _). d \<in> D) part = Some y" using partition_on_UNIV_find_Some
+    by fastforce
+  then show ?case
+    by (auto dest: find_Some_iff[THEN iffD1])
+qed
+
+lemma lookup_subsvals: "lookup part d \<in> set (subsvals part)"
+proof (transfer fixing: d, goal_cases)
+  case (1 part)
+  then obtain y where "find (\<lambda>(D, _). d \<in> D) part = Some y" using partition_on_UNIV_find_Some
+    by fastforce
+  then show ?case
+    by (auto simp: in_set_conv_nth dest: find_Some_iff[THEN iffD1])
+qed
+
+lift_definition trivial_part :: "'pt \<Rightarrow> ('d, 'pt) part" is "\<lambda>pt. [(UNIV, pt)]"
+  by (simp add: partition_on_space)
+
+lemma part_hd_trivial[simp]: "part_hd (trivial_part pt) = pt"
+  unfolding part_hd_def
+  by (transfer) simp
+
+lemma SubsVals_trivial[simp]: "SubsVals (trivial_part pt) = {(UNIV, pt)}"
+  unfolding SubsVals_def
+  by (transfer) simp
+
+section \<open>Partitioned Decision Trees\<close>
+
+(* 'd: domain; 'l: leaf, 'n: variable *)
+datatype (dead 'd, leaves: 'l, vars: 'n) pdt = Leaf (unleaf: 'l) | Node 'n "('d, ('d, 'l, 'n) pdt) part"
+
+inductive vars_order :: "'n list \<Rightarrow> ('d, 'l, 'n) pdt \<Rightarrow> bool" where
+  "vars_order vs (Leaf _)"
+| "\<forall>expl \<in> Vals part1. vars_order vs expl \<Longrightarrow> vars_order (x # vs) (Node x part1)"
+| "vars_order vs (Node x part1) \<Longrightarrow> x \<noteq> z \<Longrightarrow> vars_order (z # vs) (Node x part1)"
+
+lemma vars_order_Node:
+  assumes "distinct xs"
+  shows "vars_order xs (Node x part) = (\<exists>ys zs. xs = ys @ x # zs \<and> (\<forall>e \<in> Vals part. vars_order zs e))"
+proof (safe, goal_cases LR RL)
+  case LR
+  then show ?case 
+    by (induct xs "Node x part" rule: vars_order.induct)
+      (auto 4 3 intro: exI[of _ "_ # _"])
+next
+  case (RL ys zs)
+  with assms show ?case 
+    by (induct ys arbitrary: xs)
+      (auto intro: vars_order.intros)
+qed
+
+fun distinct_paths where
+  "distinct_paths (Leaf _) = True"
+| "distinct_paths (Node x part) = (\<forall>e \<in> Vals part. x \<notin> vars e \<and> distinct_paths e)"
+
+fun eval_pdt where
+  "eval_pdt v (Leaf l) = l"
+| "eval_pdt v (Node x part) = eval_pdt v (lookup_part part (v x))"
+
+lemma eval_pdt_cong: "\<forall>x \<in> vars e. v x = v' x \<Longrightarrow>  eval_pdt v e = eval_pdt v' e"
+  by (induct e) auto
+
+lemma vars_order_vars: "vars_order vs e \<Longrightarrow> vars e \<subseteq> set vs"
+  by (induct vs e rule: vars_order.induct) auto
+
+lemma vars_order_distinct_paths: "vars_order vs e \<Longrightarrow> distinct vs \<Longrightarrow> distinct_paths e"
+  by (induct vs e rule: vars_order.induct) (auto dest!: vars_order_vars)
+
+lemma eval_pdt_fun_upd: "vars_order vs e \<Longrightarrow> x \<notin> set vs \<Longrightarrow> eval_pdt (v(x := d)) e = eval_pdt v e"
+  by (induct vs e rule: vars_order.induct) auto
+
+(*<*)
+end
+(*>*)
\ No newline at end of file
diff --git a/thys/MFOTL_Checker/Prelim.thy b/thys/MFOTL_Checker/Prelim.thy
new file mode 100644
--- /dev/null
+++ b/thys/MFOTL_Checker/Prelim.thy
@@ -0,0 +1,142 @@
+(*<*)
+theory Prelim
+imports Main
+begin
+(*>*)
+
+section \<open>Auxiliary Lemmas\<close>
+
+lemma Cons_eq_upt_conv: "x # xs = [m ..< n] \<longleftrightarrow> m < n \<and> x = m \<and> xs = [Suc m ..< n]"
+  by (induct n arbitrary: xs) (force simp: Cons_eq_append_conv)+
+
+lemma map_setE[elim_format]: "map f xs = ys \<Longrightarrow> y \<in> set ys \<Longrightarrow> \<exists>x\<in>set xs. f x = y"
+  by (induct xs arbitrary: ys) auto
+
+lemma set_Cons_eq: "set_Cons X XS = (\<Union>xs\<in>XS. (\<lambda>x. x # xs) ` X)"
+  by (auto simp: set_Cons_def)
+
+lemma set_Cons_empty_iff: "set_Cons X XS = {} \<longleftrightarrow> (X = {} \<or> XS = {})"
+  by (auto simp: set_Cons_eq)
+
+lemma infinite_set_ConsI:
+  "XS \<noteq> {} \<Longrightarrow> infinite X \<Longrightarrow> infinite (set_Cons X XS)"
+  "X \<noteq> {} \<Longrightarrow> infinite XS \<Longrightarrow> infinite (set_Cons X XS)"
+proof(unfold set_Cons_eq)
+  assume "infinite X" and "XS \<noteq> {}"
+  then obtain xs where "xs \<in> XS"
+    by blast
+  hence "inj (\<lambda>x. x # xs)"
+    by (clarsimp simp: inj_on_def)
+  hence "infinite ((\<lambda>x. x # xs) ` X)"
+    using \<open>infinite X\<close> finite_imageD inj_on_def
+    by blast
+  moreover have "((\<lambda>x. x # xs) ` X) \<subseteq> (\<Union>xs\<in>XS. (\<lambda>x. x # xs) ` X)"
+    using \<open>xs \<in> XS\<close> by auto
+  ultimately show "infinite (\<Union>xs\<in>XS. (\<lambda>x. x # xs) ` X)"
+    by (simp add: infinite_super)
+next
+  assume "infinite XS" and "X \<noteq> {}"
+  then show "infinite (\<Union>xs\<in>XS. (\<lambda>x. x # xs) ` X)"
+    by (elim contrapos_nn finite_surj[of _ _ tl]) (auto simp: image_iff)
+qed
+
+primrec fst_pos :: "'a list \<Rightarrow> 'a \<Rightarrow> nat option"
+  where "fst_pos [] x = None"
+  | "fst_pos (y#ys) x = (if x = y then Some 0 else
+      (case fst_pos ys x of None \<Rightarrow> None | Some n \<Rightarrow> Some (Suc n)))"
+
+lemma fst_pos_None_iff: "fst_pos xs x = None \<longleftrightarrow> x \<notin> set xs"
+  by (induct xs arbitrary: x; force split: option.splits)
+
+lemma nth_fst_pos: "x \<in> set xs \<Longrightarrow> xs ! (the (fst_pos xs x)) = x"
+  by (induct xs arbitrary: x; fastforce simp: fst_pos_None_iff split: option.splits)
+
+primrec positions :: "'a list \<Rightarrow> 'a \<Rightarrow> nat list"
+  where "positions [] x = []"
+  | "positions (y#ys) x = (\<lambda>ns. if x = y then 0 # ns else ns) (map Suc (positions ys x))"
+
+lemma eq_positions_iff: "length xs = length ys
+  \<Longrightarrow> positions xs x = positions ys y \<longleftrightarrow> (\<forall>n< length xs. xs ! n = x \<longleftrightarrow> ys ! n = y)"
+  by (induct xs ys arbitrary: x y rule: list_induct2) (use less_Suc_eq_0_disj in auto)
+
+lemma positions_eq_nil_iff: "positions xs x = [] \<longleftrightarrow> x \<notin> set xs"
+  by (induct xs) simp_all
+
+lemma positions_nth: "n \<in> set (positions xs x) \<Longrightarrow> xs ! n = x"
+  by (induct xs arbitrary: n x)
+    (auto simp: positions_eq_nil_iff[symmetric] split: if_splits)
+
+lemma set_positions_eq: "set (positions xs x) = {n. xs ! n = x \<and> n < length xs}"
+  by (induct xs arbitrary: x)
+    (use less_Suc_eq_0_disj in \<open>auto simp: positions_eq_nil_iff[symmetric] image_iff split: if_splits\<close>)
+
+lemma positions_length: "n \<in> set (positions xs x) \<Longrightarrow> n < length xs"
+  by (induct xs arbitrary: n x)
+    (auto simp: positions_eq_nil_iff[symmetric] split: if_splits)
+
+lemma positions_nth_cong:
+  "m \<in> set (positions xs x) \<Longrightarrow> n \<in> set (positions xs x) \<Longrightarrow> xs ! n = xs ! m"
+  using positions_nth[of _ xs x] by simp
+
+lemma fst_pos_in_positions: "x \<in> set xs \<Longrightarrow> the (fst_pos xs x) \<in> set (positions xs x)"
+  by (induct xs arbitrary: x, simp)
+    (fastforce simp: hd_map fst_pos_None_iff split: option.splits)
+
+lemma hd_positions_eq_fst_pos: "x \<in> set xs \<Longrightarrow> hd (positions xs x) = the (fst_pos xs x)"
+  by (induct xs arbitrary: x)
+    (auto simp: hd_map fst_pos_None_iff positions_eq_nil_iff split: option.splits)
+
+lemma sorted_positions: "sorted (positions xs x)"
+  by (induct xs arbitrary: x) (auto simp add: sorted_iff_nth_Suc nth_Cons' gr0_conv_Suc)
+
+lemma Min_sorted_list: "sorted xs \<Longrightarrow> xs \<noteq> [] \<Longrightarrow> Min (set xs) = hd xs"
+  by (induct xs)
+    (auto simp: Min_insert2)
+
+lemma Min_positions: "x \<in> set xs \<Longrightarrow> Min (set (positions xs x)) = the (fst_pos xs x)"
+  by (auto simp: Min_sorted_list[OF sorted_positions]
+      positions_eq_nil_iff hd_positions_eq_fst_pos)
+
+lemma subset_positions_map_fst: "set (positions tXs tX) \<subseteq> set (positions (map fst tXs) (fst tX))"
+  by (induct tXs arbitrary: tX)
+    (auto simp: subset_eq)
+
+lemma subset_positions_map_snd: "set (positions tXs tX) \<subseteq> set (positions (map snd tXs) (snd tX))"
+  by (induct tXs arbitrary: tX)
+    (auto simp: subset_eq)
+
+lemma Max_eqI: "finite A \<Longrightarrow> A \<noteq> {} \<Longrightarrow> (\<And>a. a \<in> A \<Longrightarrow> a \<le> b) \<Longrightarrow> \<exists>a\<in>A. b \<le> a \<Longrightarrow> Max A = b"
+  by (rule antisym[OF Max.boundedI Max_ge_iff[THEN iffD2]]; clarsimp)
+
+lemma Max_Suc: "X \<noteq> {} \<Longrightarrow> finite X \<Longrightarrow> Max (Suc ` X) = Suc (Max X)"
+  using Max_ge Max_in
+  by (intro Max_eqI) blast+
+
+lemma Max_insert0: "X \<noteq> {} \<Longrightarrow> finite X \<Longrightarrow> Max (insert (0::nat) X) = Max X"
+  using Max_ge Max_in
+  by (intro Max_eqI) blast+
+
+lemma positions_Cons_notin_tail: "x \<notin> set xs \<Longrightarrow> positions (x # xs) x = [0::nat]"
+  by (cases xs) (auto simp: positions_eq_nil_iff)
+
+lemma Max_set_positions_Cons_hd:
+  "x \<notin> set xs \<Longrightarrow> Max (set (positions (x # xs) x)) = 0"
+  by (subst positions_Cons_notin_tail) simp_all
+
+lemma Max_set_positions_Cons_tl:
+  "y \<in> set xs \<Longrightarrow> Max (set (positions (x # xs) y)) = Suc (Max (set (positions xs y)))"
+  by (auto simp: Max_Suc positions_eq_nil_iff)
+
+lemma max_aux: "finite X \<Longrightarrow> Suc j \<in> X \<Longrightarrow> Max (insert (Suc j) (X - {j})) = Max (insert j X)"
+  by (smt (verit) max.orderI Max.insert_remove Max_ge Max_insert empty_iff insert_Diff_single
+      insert_absorb insert_iff max_def not_less_eq_eq)
+
+lemma ball_swap: "(\<forall>x \<in> A. \<forall>y \<in> B. P x y) = (\<forall>y \<in> B. \<forall>x \<in> A. P x y)"
+  by auto
+
+lemma ball_triv_nonempty: "A \<noteq> {} \<Longrightarrow> (\<forall>x \<in> A. P) = P"
+  by auto
+
+(*<*)
+end
+(*>*)
\ No newline at end of file
diff --git a/thys/MFOTL_Checker/Proof_Object.thy b/thys/MFOTL_Checker/Proof_Object.thy
new file mode 100644
--- /dev/null
+++ b/thys/MFOTL_Checker/Proof_Object.thy
@@ -0,0 +1,123 @@
+(*<*)
+theory Proof_Object
+  imports Formula Partition
+begin
+(*>*)
+
+section \<open>Proof Objects\<close>
+
+datatype (dead 'n, dead 'd) sproof = STT nat 
+  | SPred nat 'n "('n, 'd) Formula.trm list"
+  | SEq_Const nat 'n 'd
+  | SNeg "('n, 'd) vproof" 
+  | SOrL "('n, 'd) sproof" 
+  | SOrR "('n, 'd) sproof" 
+  | SAnd "('n, 'd) sproof" "('n, 'd) sproof"
+  | SImpL "('n, 'd) vproof" 
+  | SImpR "('n, 'd) sproof"
+  | SIffSS "('n, 'd) sproof" "('n, 'd) sproof" 
+  | SIffVV "('n, 'd) vproof" "('n, 'd) vproof" 
+  | SExists 'n 'd "('n, 'd) sproof"
+  | SForall 'n "('d, ('n, 'd) sproof) part" 
+  | SPrev "('n, 'd) sproof"
+  | SNext "('n, 'd) sproof"
+  | SOnce nat "('n, 'd) sproof"
+  | SEventually nat "('n, 'd) sproof" 
+  | SHistorically nat nat "('n, 'd) sproof list" 
+  | SHistoricallyOut nat
+  | SAlways nat nat "('n, 'd) sproof list"
+  | SSince "('n, 'd) sproof" "('n, 'd) sproof list" 
+  | SUntil "('n, 'd) sproof list" "('n, 'd) sproof" 
+  and ('n, 'd) vproof = VFF nat 
+  | VPred nat 'n "('n, 'd) Formula.trm list"
+  | VEq_Const nat 'n 'd
+  | VNeg "('n, 'd) sproof" 
+  | VOr "('n, 'd) vproof" "('n, 'd) vproof"
+  | VAndL "('n, 'd) vproof" 
+  | VAndR "('n, 'd) vproof" 
+  | VImp "('n, 'd) sproof" "('n, 'd) vproof" 
+  | VIffSV "('n, 'd) sproof" "('n, 'd) vproof" 
+  | VIffVS "('n, 'd) vproof" "('n, 'd) sproof" 
+  | VExists 'n "('d, ('n, 'd) vproof) part" 
+  | VForall 'n 'd "('n, 'd) vproof"
+  | VPrev "('n, 'd) vproof"
+  | VPrevZ
+  | VPrevOutL nat 
+  | VPrevOutR nat
+  | VNext "('n, 'd) vproof" 
+  | VNextOutL nat 
+  | VNextOutR nat 
+  | VOnceOut nat 
+  | VOnce nat nat "('n, 'd) vproof list" 
+  | VEventually nat nat "('n, 'd) vproof list"
+  | VHistorically nat "('n, 'd) vproof" 
+  | VAlways nat "('n, 'd) vproof"
+  | VSinceOut nat
+  | VSince nat "('n, 'd) vproof" "('n, 'd) vproof list" 
+  | VSinceInf nat nat "('n, 'd) vproof list" 
+  | VUntil nat "('n, 'd) vproof list" "('n, 'd) vproof"
+  | VUntilInf nat nat "('n, 'd) vproof list"
+
+type_synonym ('n, 'd) "proof" = "('n, 'd) sproof + ('n, 'd) vproof"
+
+type_synonym ('n, 'd) expl = "('d, ('n, 'd) proof, 'n) pdt"
+
+fun s_at :: "('n, 'd) sproof \<Rightarrow> nat" and 
+  v_at :: "('n, 'd) vproof \<Rightarrow> nat" where
+  "s_at (STT i) = i"
+| "s_at (SPred i _ _) = i"
+| "s_at (SEq_Const i _ _) = i"
+| "s_at (SNeg vp) = v_at vp"
+| "s_at (SOrL sp1) = s_at sp1"
+| "s_at (SOrR sp2) = s_at sp2"
+| "s_at (SAnd sp1 _) = s_at sp1"
+| "s_at (SImpL vp1) = v_at vp1"
+| "s_at (SImpR sp2) = s_at sp2"
+| "s_at (SIffSS sp1 _) = s_at sp1"
+| "s_at (SIffVV vp1 _) = v_at vp1"
+| "s_at (SExists _ _ sp) = s_at sp"
+| "s_at (SForall _ part) = s_at (part_hd part)"
+| "s_at (SPrev sp) = s_at sp + 1"
+| "s_at (SNext sp) = s_at sp - 1"
+| "s_at (SOnce i _) = i"
+| "s_at (SEventually i _) = i"
+| "s_at (SHistorically i _ _) = i"
+| "s_at (SHistoricallyOut i) = i"
+| "s_at (SAlways i _ _) = i"
+| "s_at (SSince sp2 sp1s) = (case sp1s of [] \<Rightarrow> s_at sp2 | _ \<Rightarrow> s_at (last sp1s))"
+| "s_at (SUntil sp1s sp2) = (case sp1s of [] \<Rightarrow> s_at sp2 | sp1 # _ \<Rightarrow> s_at sp1)"
+| "v_at (VFF i) = i"
+| "v_at (VPred i _ _) = i"
+| "v_at (VEq_Const i _ _) = i"
+| "v_at (VNeg sp) = s_at sp"
+| "v_at (VOr vp1 _) = v_at vp1"
+| "v_at (VAndL vp1) = v_at vp1"
+| "v_at (VAndR vp2) = v_at vp2"
+| "v_at (VImp sp1 _) = s_at sp1"
+| "v_at (VIffSV sp1 _) = s_at sp1"
+| "v_at (VIffVS vp1 _) = v_at vp1"
+| "v_at (VExists _ part) = v_at (part_hd part)"
+| "v_at (VForall _ _ vp1) = v_at vp1"
+| "v_at (VPrev vp) = v_at vp + 1"
+| "v_at (VPrevZ) = 0"
+| "v_at (VPrevOutL i) = i"
+| "v_at (VPrevOutR i) = i"
+| "v_at (VNext vp) = v_at vp - 1"
+| "v_at (VNextOutL i) = i"
+| "v_at (VNextOutR i) = i"
+| "v_at (VOnceOut i) = i"
+| "v_at (VOnce i _ _) = i"
+| "v_at (VEventually i _ _) = i"
+| "v_at (VHistorically i _) = i"
+| "v_at (VAlways i _) = i"
+| "v_at (VSinceOut i) = i"
+| "v_at (VSince i _ _) = i"
+| "v_at (VSinceInf i _ _) = i"
+| "v_at (VUntil i _ _) = i"
+| "v_at (VUntilInf i _ _) = i"
+
+definition p_at :: "('n, 'd) proof \<Rightarrow> nat" where "p_at p = case_sum s_at v_at p" 
+
+(*<*)
+end
+(*>*)
diff --git a/thys/MFOTL_Checker/Proof_System.thy b/thys/MFOTL_Checker/Proof_System.thy
new file mode 100644
--- /dev/null
+++ b/thys/MFOTL_Checker/Proof_System.thy
@@ -0,0 +1,534 @@
+(*<*)
+theory Proof_System
+  imports Formula Partition
+begin
+(*>*)
+
+section \<open>Proof System\<close>
+
+unbundle MFOTL_notation
+
+context begin
+
+inductive SAT and VIO :: "('n, 'd) trace \<Rightarrow> ('n, 'd) env \<Rightarrow> nat \<Rightarrow> ('n, 'd) formula \<Rightarrow> bool" for \<sigma> where
+  STT: "SAT \<sigma> v i TT"
+| VFF: "VIO \<sigma> v i FF"
+| SPred: "(r, eval_trms v ts) \<in> \<Gamma> \<sigma> i \<Longrightarrow> SAT \<sigma> v i (Pred r ts)"
+| VPred: "(r, eval_trms v ts) \<notin> \<Gamma> \<sigma> i \<Longrightarrow> VIO \<sigma> v i (Pred r ts)"
+| SEq_Const: "v x = c \<Longrightarrow> SAT \<sigma> v i (Eq_Const x c)"
+| VEq_Const: "v x \<noteq> c \<Longrightarrow> VIO \<sigma> v i (Eq_Const x c)"
+| SNeg: "VIO \<sigma> v i \<phi> \<Longrightarrow> SAT \<sigma> v i (Neg \<phi>)"
+| VNeg: "SAT \<sigma> v i \<phi> \<Longrightarrow> VIO \<sigma> v i (Neg \<phi>)"
+| SOrL: "SAT \<sigma> v i \<phi> \<Longrightarrow> SAT \<sigma> v i (Or \<phi> \<psi>)"
+| SOrR: "SAT \<sigma> v i \<psi> \<Longrightarrow> SAT \<sigma> v i (Or \<phi> \<psi>)"
+| VOr: "VIO \<sigma> v i \<phi> \<Longrightarrow> VIO \<sigma> v i \<psi> \<Longrightarrow> VIO \<sigma> v i (Or \<phi> \<psi>)"
+| SAnd: "SAT \<sigma> v i \<phi> \<Longrightarrow> SAT \<sigma> v i \<psi> \<Longrightarrow> SAT \<sigma> v i (And \<phi> \<psi>)"
+| VAndL: "VIO \<sigma> v i \<phi> \<Longrightarrow> VIO \<sigma> v i (And \<phi> \<psi>)"
+| VAndR: "VIO \<sigma> v i \<psi> \<Longrightarrow> VIO \<sigma> v i (And \<phi> \<psi>)"
+| SImpL: "VIO \<sigma> v i \<phi> \<Longrightarrow> SAT \<sigma> v i (Imp \<phi> \<psi>)"
+| SImpR: "SAT \<sigma> v i \<psi> \<Longrightarrow> SAT \<sigma> v i (Imp \<phi> \<psi>)"
+| VImp: "SAT \<sigma> v i \<phi> \<Longrightarrow> VIO \<sigma> v i \<psi> \<Longrightarrow> VIO \<sigma> v i (Imp \<phi> \<psi>)"
+| SIffSS: "SAT \<sigma> v i \<phi> \<Longrightarrow> SAT \<sigma> v i \<psi> \<Longrightarrow> SAT \<sigma> v i (Iff \<phi> \<psi>)"
+| SIffVV: "VIO \<sigma> v i \<phi> \<Longrightarrow> VIO \<sigma> v i \<psi> \<Longrightarrow> SAT \<sigma> v i (Iff \<phi> \<psi>)"
+| VIffSV: "SAT \<sigma> v i \<phi> \<Longrightarrow> VIO \<sigma> v i \<psi> \<Longrightarrow> VIO \<sigma> v i (Iff \<phi> \<psi>)"
+| VIffVS: "VIO \<sigma> v i \<phi> \<Longrightarrow> SAT \<sigma> v i \<psi> \<Longrightarrow> VIO \<sigma> v i (Iff \<phi> \<psi>)"
+| SExists: "\<exists>z. SAT \<sigma> (v (x := z)) i \<phi> \<Longrightarrow> SAT \<sigma> v i (Exists x \<phi>)"
+| VExists: "\<forall>z. VIO \<sigma> (v (x := z)) i \<phi> \<Longrightarrow> VIO \<sigma> v i (Exists x \<phi>)"
+| SForall: "\<forall>z. SAT \<sigma> (v (x := z)) i \<phi> \<Longrightarrow> SAT \<sigma> v i (Forall x \<phi>)"
+| VForall: "\<exists>z. VIO \<sigma> (v (x := z)) i \<phi> \<Longrightarrow> VIO \<sigma> v i (Forall x \<phi>)"
+| SPrev: "i > 0 \<Longrightarrow> mem (\<Delta> \<sigma> i) I \<Longrightarrow> SAT \<sigma> v (i-1) \<phi> \<Longrightarrow> SAT \<sigma> v i (\<^bold>Y I \<phi>)"
+| VPrev: "i > 0 \<Longrightarrow> VIO \<sigma> v (i-1) \<phi> \<Longrightarrow> VIO \<sigma> v i (\<^bold>Y I \<phi>)"
+| VPrevZ: "i = 0 \<Longrightarrow> VIO \<sigma> v i (\<^bold>Y I \<phi>)"
+| VPrevOutL: "i > 0 \<Longrightarrow> (\<Delta> \<sigma> i) < (left I) \<Longrightarrow> VIO \<sigma> v i (\<^bold>Y I \<phi>)"
+| VPrevOutR: "i > 0 \<Longrightarrow> enat (\<Delta> \<sigma> i) > (right I) \<Longrightarrow> VIO \<sigma> v i (\<^bold>Y I \<phi>)"
+| SNext: "mem (\<Delta> \<sigma> (i+1)) I \<Longrightarrow> SAT \<sigma> v (i+1) \<phi> \<Longrightarrow> SAT \<sigma> v i (\<^bold>X I \<phi>)"
+| VNext: "VIO \<sigma> v (i+1) \<phi> \<Longrightarrow> VIO \<sigma> v i (\<^bold>X I \<phi>)"
+| VNextOutL: "(\<Delta> \<sigma> (i+1)) < (left I) \<Longrightarrow> VIO \<sigma> v i (\<^bold>X I \<phi>)"
+| VNextOutR: "enat (\<Delta> \<sigma> (i+1)) > (right I) \<Longrightarrow> VIO \<sigma> v i (\<^bold>X I \<phi>)"
+| SOnce: "j \<le> i \<Longrightarrow> mem (\<delta> \<sigma> i j) I \<Longrightarrow> SAT \<sigma> v j \<phi> \<Longrightarrow> SAT \<sigma> v i (\<^bold>P I \<phi>)"
+| VOnceOut: "\<tau> \<sigma> i < \<tau> \<sigma> 0 + left I \<Longrightarrow> VIO \<sigma> v i (\<^bold>P I \<phi>)"
+| VOnce: "j = (case right I of \<infinity> \<Rightarrow> 0 
+               | enat b \<Rightarrow> ETP_p \<sigma> i b) \<Longrightarrow>
+          (\<tau> \<sigma> i) \<ge> (\<tau> \<sigma> 0) + left I \<Longrightarrow>
+          (\<And>k. k \<in> {j .. LTP_p \<sigma> i I} \<Longrightarrow> VIO \<sigma> v k \<phi>) \<Longrightarrow> VIO \<sigma> v i (\<^bold>P I \<phi>)"
+| SEventually: "j \<ge> i \<Longrightarrow> mem (\<delta> \<sigma> j i) I  \<Longrightarrow> SAT \<sigma> v j \<phi> \<Longrightarrow> SAT \<sigma> v i (\<^bold>F I \<phi>)"
+| VEventually: "(\<And>k. k \<in> (case right I of \<infinity> \<Rightarrow> {ETP_f \<sigma> i I ..}
+                           | enat b \<Rightarrow> {ETP_f \<sigma> i I .. LTP_f \<sigma> i b}) \<Longrightarrow> VIO \<sigma> v k \<phi>) \<Longrightarrow> 
+                VIO \<sigma> v i (\<^bold>F I \<phi>)"
+| SHistorically: "j = (case right I of \<infinity> \<Rightarrow> 0
+                       | enat b \<Rightarrow> ETP_p \<sigma> i b) \<Longrightarrow>
+                 (\<tau> \<sigma> i) \<ge> (\<tau> \<sigma> 0) + left I \<Longrightarrow>
+                 (\<And>k. k \<in> {j .. LTP_p \<sigma> i I} \<Longrightarrow> SAT \<sigma> v k \<phi>) \<Longrightarrow> SAT \<sigma> v i (\<^bold>H I \<phi>)"
+| SHistoricallyOut: "\<tau> \<sigma> i < \<tau> \<sigma> 0 + left I \<Longrightarrow> SAT \<sigma> v i (\<^bold>H I \<phi>)"
+| VHistorically: "j \<le> i \<Longrightarrow> mem (\<delta> \<sigma> i j) I  \<Longrightarrow> VIO \<sigma> v j \<phi> \<Longrightarrow> VIO \<sigma> v i (\<^bold>H I \<phi>)"
+| SAlways: "(\<And>k. k \<in> (case right I of \<infinity> \<Rightarrow> {ETP_f \<sigma> i I ..} 
+                       | enat b \<Rightarrow> {ETP_f \<sigma> i I .. LTP_f \<sigma> i b}) \<Longrightarrow> SAT \<sigma> v k \<phi>) \<Longrightarrow>
+            SAT \<sigma> v i (\<^bold>G I \<phi>)"
+| VAlways: "j \<ge> i \<Longrightarrow> mem (\<delta> \<sigma> j i) I  \<Longrightarrow> VIO \<sigma> v j \<phi> \<Longrightarrow> VIO \<sigma> v i (\<^bold>G I \<phi>)"
+| SSince: "j \<le> i \<Longrightarrow> mem (\<delta> \<sigma> i j) I  \<Longrightarrow> SAT \<sigma> v j \<psi> \<Longrightarrow> (\<And>k. k \<in> {j <.. i} \<Longrightarrow> 
+           SAT \<sigma> v k \<phi>) \<Longrightarrow> SAT \<sigma> v i (\<phi> \<^bold>S I \<psi>)"
+| VSinceOut: "\<tau> \<sigma> i < \<tau> \<sigma> 0 + left I \<Longrightarrow> VIO \<sigma> v i (\<phi> \<^bold>S I \<psi>)"
+| VSince: "(case right I of \<infinity> \<Rightarrow> True 
+            | enat b \<Rightarrow> ETP \<sigma> ((\<tau> \<sigma> i) - b) \<le> j) \<Longrightarrow> 
+           j \<le> i \<Longrightarrow> (\<tau> \<sigma> 0) + left I \<le> (\<tau> \<sigma> i) \<Longrightarrow> VIO \<sigma> v j \<phi> \<Longrightarrow>
+           (\<And>k. k \<in> {j .. (LTP_p \<sigma> i I)} \<Longrightarrow> VIO \<sigma> v k \<psi>) \<Longrightarrow> VIO \<sigma> v i (\<phi> \<^bold>S I \<psi>)"
+| VSinceInf: "j = (case right I of \<infinity> \<Rightarrow> 0 
+                   | enat b \<Rightarrow> ETP_p \<sigma> i b) \<Longrightarrow>
+             (\<tau> \<sigma> i) \<ge> (\<tau> \<sigma> 0) + left I \<Longrightarrow> 
+             (\<And>k. k \<in> {j .. LTP_p \<sigma> i I} \<Longrightarrow> VIO \<sigma> v k \<psi>) \<Longrightarrow> VIO \<sigma> v i (\<phi> \<^bold>S I \<psi>)"
+| SUntil: "j \<ge> i \<Longrightarrow> mem (\<delta> \<sigma> j i) I  \<Longrightarrow> SAT \<sigma> v j \<psi> \<Longrightarrow> (\<And>k. k \<in> {i ..< j} \<Longrightarrow> SAT \<sigma> v k \<phi>) \<Longrightarrow> 
+           SAT \<sigma> v i (\<phi> \<^bold>U I \<psi>)"
+| VUntil: "(case right I of \<infinity> \<Rightarrow> True 
+            | enat b \<Rightarrow> j < LTP_f \<sigma> i b) \<Longrightarrow> 
+           j \<ge> i \<Longrightarrow> VIO \<sigma> v j \<phi> \<Longrightarrow> (\<And>k. k \<in> {ETP_f \<sigma> i I .. j} \<Longrightarrow> VIO \<sigma> v k \<psi>) \<Longrightarrow> 
+           VIO \<sigma> v i (\<phi> \<^bold>U I \<psi>)"
+| VUntilInf: "(\<And>k. k \<in> (case right I of \<infinity> \<Rightarrow> {ETP_f \<sigma> i I ..} 
+                         | enat b \<Rightarrow> {ETP_f \<sigma> i I .. LTP_f \<sigma> i b}) \<Longrightarrow> VIO \<sigma> v k \<psi>) \<Longrightarrow>
+              VIO \<sigma> v i (\<phi> \<^bold>U I \<psi>)"
+
+subsection \<open>Soundness and Completeness\<close>
+
+lemma not_sat_SinceD:
+  assumes unsat: "\<not> \<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<phi> \<^bold>S I \<psi>" and
+    witness: "\<exists>j \<le> i. mem (\<tau> \<sigma> i - \<tau> \<sigma> j) I \<and> \<langle>\<sigma>, v, j\<rangle> \<Turnstile> \<psi>"
+  shows "\<exists>j \<le> i. ETP \<sigma> (case right I of \<infinity> \<Rightarrow> 0 | enat n \<Rightarrow> \<tau> \<sigma> i - n) \<le> j \<and> \<not> \<langle>\<sigma>, v, j\<rangle> \<Turnstile> \<phi>
+  \<and> (\<forall>k \<in> {j .. (min i (LTP \<sigma> (\<tau> \<sigma> i - left I)))}. \<not> \<langle>\<sigma>, v, k\<rangle> \<Turnstile> \<psi>)"
+proof -
+  define A and j where A_def: "A \<equiv> {j. j \<le> i \<and> mem (\<tau> \<sigma> i - \<tau> \<sigma> j) I \<and> \<langle>\<sigma>, v, j\<rangle> \<Turnstile> \<psi>}"
+    and j_def: "j \<equiv> Max A"
+  from witness have j: "j \<le> i" "\<langle>\<sigma>, v, j\<rangle> \<Turnstile> \<psi>" "mem (\<tau> \<sigma> i - \<tau> \<sigma> j) I"
+    using Max_in[of A] unfolding j_def[symmetric] unfolding A_def
+    by auto
+  moreover
+  from j(3) have "ETP \<sigma> (case right I of enat n \<Rightarrow> \<tau> \<sigma> i - n | \<infinity> \<Rightarrow> 0) \<le> j"
+    unfolding ETP_def by (intro Least_le) (auto split: enat.splits)
+  moreover
+  { fix j
+    assume j: "\<tau> \<sigma> j \<le> \<tau> \<sigma> i"
+    then obtain k where k: "\<tau> \<sigma> i < \<tau> \<sigma> k"
+      by (meson ex_le_\<tau> gt_ex less_le_trans)
+    have "j \<le> ETP \<sigma> (Suc (\<tau> \<sigma> i))"
+      unfolding ETP_def
+    proof (intro LeastI2[of _ k "\<lambda>i. j \<le> i"])
+      fix l
+      assume "Suc (\<tau> \<sigma> i) \<le> \<tau> \<sigma> l"
+      with j show "j \<le> l"
+        by (metis lessI less_\<tau>D nless_le order_less_le_trans)
+    qed (auto simp: Suc_le_eq k(1))
+  } note * = this
+  { fix k
+    assume "k \<in> {j <.. (min i (LTP \<sigma> (\<tau> \<sigma> i - left I)))}"
+    with j(3) have k: "j < k" "k \<le> i" "k \<le> Max {j. left I + \<tau> \<sigma> j \<le> \<tau> \<sigma> i}"
+      by (auto simp: LTP_def le_diff_conv2 add.commute)
+    with j(3) obtain l where "left I + \<tau> \<sigma> l \<le> \<tau> \<sigma> i" "k \<le> l"
+      by (subst (asm) Max_ge_iff) (auto simp: le_diff_conv2 *
+          intro!: finite_subset[of _ "{0 .. ETP \<sigma> (\<tau> \<sigma> i + 1)}"])
+    then have "mem (\<tau> \<sigma> i - \<tau> \<sigma> k) I"
+      using k(1,2) j(3)
+      by (cases "right I") (auto simp: le_diff_conv le_diff_conv2 add.commute dest: \<tau>_mono
+         elim: order_trans[rotated] order_trans)
+    with Max_ge[of A k] k have "\<not> \<langle>\<sigma>, v, k\<rangle> \<Turnstile> \<psi>"
+      unfolding j_def[symmetric] unfolding A_def
+      by auto
+  }
+  ultimately show ?thesis using unsat
+    by (auto dest!: spec[of _ j])
+qed
+
+lemma not_sat_UntilD:
+  assumes unsat: "\<not> \<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<phi> \<^bold>U I \<psi>"
+    and witness: "\<exists>j \<ge> i. mem (\<delta> \<sigma> j i) I \<and> \<langle>\<sigma>, v, j\<rangle> \<Turnstile> \<psi>"
+  shows "\<exists>j \<ge> i. (case right I of \<infinity> \<Rightarrow> True | enat n \<Rightarrow> j < LTP \<sigma> (\<tau> \<sigma> i + n))
+  \<and> \<not> (\<langle>\<sigma>, v, j\<rangle> \<Turnstile> \<phi>) \<and> (\<forall>k \<in> {(max i (ETP \<sigma> (\<tau> \<sigma> i + left I))) .. j}.
+   \<not> \<langle>\<sigma>, v, k\<rangle> \<Turnstile> \<psi>)"
+proof -
+  from \<tau>_mono have i0: "\<tau> \<sigma> 0 \<le> \<tau> \<sigma> i" by auto
+  from witness obtain jmax where jmax: "jmax \<ge> i" "\<langle>\<sigma>, v, jmax\<rangle> \<Turnstile> \<psi>"
+    "mem (\<delta> \<sigma> jmax i) I" by blast
+  define A and j where A_def: "A \<equiv> {j. j \<ge> i \<and> j \<le> jmax
+  \<and> mem (\<delta> \<sigma> j i) I \<and> \<langle>\<sigma>, v, j\<rangle> \<Turnstile> \<psi>}" and j_def: "j \<equiv> Min A"
+  have j: "j \<ge> i" "\<langle>\<sigma>, v, j\<rangle> \<Turnstile> \<psi>" "mem (\<delta> \<sigma> j i) I"
+    using A_def j_def jmax Min_in[of A]
+    unfolding j_def[symmetric] unfolding A_def
+    by fastforce+
+  moreover have "case right I of \<infinity> \<Rightarrow> True | enat n \<Rightarrow> j \<le> LTP \<sigma> (\<tau> \<sigma> i + n)"
+    using i0 j(1,3)
+    by (auto simp: i_LTP_tau trans_le_add1 split: enat.splits)
+  moreover
+  { fix k
+    assume k_def: "k \<in> {(max i (ETP \<sigma> (\<tau> \<sigma> i + left I))) ..< j}"
+    then have ki: "\<tau> \<sigma> k \<ge> \<tau> \<sigma> i + left I" using i_ETP_tau by auto
+    with k_def have kj: "k < j" by auto
+    then have "\<tau> \<sigma> k \<le> \<tau> \<sigma> j" by auto
+    then have "\<delta> \<sigma> k i \<le> \<delta> \<sigma> j i" by auto
+    with this j(3) have "enat (\<delta> \<sigma> k i) \<le> right I"
+      by (meson enat_ord_simps(1) order_subst2)
+    with this ki j(3) have mem_k: "mem (\<delta> \<sigma> k i) I"
+      unfolding ETP_def by (auto simp: Least_le)
+
+    with j_def have "j \<le> jmax" using Min_in[of A]
+      using jmax A_def
+      by (metis (mono_tags, lifting) Collect_empty_eq
+          finite_nat_set_iff_bounded_le mem_Collect_eq order_refl)
+    with this k_def have kjm: "k \<le> jmax" by auto
+
+    with this mem_k ki Min_le[of A k] k_def have "k \<notin> A"
+      unfolding j_def[symmetric] unfolding A_def unfolding ETP_def
+      using finite_nat_set_iff_bounded_le kj leD by blast
+    with this mem_k k_def kjm have "\<not> \<langle>\<sigma>, v, k\<rangle> \<Turnstile> \<psi>"
+      by (simp add: A_def) }
+  ultimately show ?thesis using unsat
+    by (auto split: enat.splits dest!: spec[of _ j])
+qed
+
+lemma soundness_raw: "(SAT \<sigma> v i \<phi> \<longrightarrow> \<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<phi>) \<and> (VIO \<sigma> v i \<phi> \<longrightarrow> \<not> \<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<phi>)"
+proof (induct v i \<phi> rule: SAT_VIO.induct)
+  case (VOnceOut i I v \<phi>)
+  { fix j
+    from \<tau>_mono have j0: "\<tau> \<sigma> 0 \<le> \<tau> \<sigma> j" by auto
+    then have "\<tau> \<sigma> i < \<tau> \<sigma> j + left I" using VOnceOut by linarith
+    then have "\<delta> \<sigma> i j < left I"
+      using VOnceOut less_\<tau>D verit_comp_simplify1(3) by fastforce
+    then have "\<not> mem (\<delta> \<sigma> i j) I" by auto }
+  then show ?case
+    by auto
+next
+  case (VOnce j I i v \<phi>)
+  { fix k
+    assume k_def: "\<langle>\<sigma>, v, k\<rangle> \<Turnstile> \<phi> \<and> mem (\<delta> \<sigma> i k) I \<and> k \<le> i"
+    then have k_tau: "\<tau> \<sigma> k \<le> \<tau> \<sigma> i - left I"
+      using diff_le_mono2 by fastforce
+    then have k_ltp: "k \<le> LTP \<sigma> (\<tau> \<sigma> i - left I)"
+      using VOnce i_LTP_tau add_le_imp_le_diff
+      by blast
+    then have "k \<notin> {j .. LTP_p \<sigma> i I}"
+      using k_def VOnce k_tau
+      by auto
+    then have "k < j" using k_def k_ltp by auto }
+  then show ?case
+    using VOnce
+    by (cases "right I = \<infinity>")
+      (auto 0 0 simp: i_ETP_tau i_LTP_tau le_diff_conv2)
+next
+  case (VEventually I i v \<phi>)
+  { fix k n
+    assume r: "right I = enat n"
+    from this have tin0: "\<tau> \<sigma> i + n \<ge> \<tau> \<sigma> 0"
+      by (auto simp add: trans_le_add1)
+    define j where "j = LTP \<sigma> ((\<tau> \<sigma> i) + n)"
+    then have j_i: "i \<le> j"
+      by (auto simp add: i_LTP_tau trans_le_add1 j_def)
+    assume k_def: "\<langle>\<sigma>, v, k\<rangle> \<Turnstile> \<phi> \<and> mem (\<delta> \<sigma> k i) I \<and> i \<le> k"
+    then have "\<tau> \<sigma> k \<ge> \<tau> \<sigma> i + left I"
+      using le_diff_conv2 by auto
+    then have k_etp: "k \<ge> ETP \<sigma> (\<tau> \<sigma> i + left I)"
+      using i_ETP_tau by blast
+    from this k_def VEventually have "k \<notin> {ETP_f \<sigma> i I .. j}"
+      by (auto simp: r j_def)
+    then have "j < k" using r k_def k_etp by auto
+    from k_def r have "\<delta> \<sigma> k i \<le> n" by auto
+    then have "\<tau> \<sigma> k \<le> \<tau> \<sigma> i + n" by auto
+    then have "k \<le> j" using tin0 i_LTP_tau by (auto simp add: j_def) }
+  note aux = this
+  show ?case
+  proof (cases "right I")
+    case (enat n)
+    show ?thesis
+      using VEventually[unfolded enat, simplified] aux
+      by (simp add: i_ETP_tau enat)
+        (metis \<tau>_mono le_add_diff_inverse nat_add_left_cancel_le)
+  next
+    case infinity
+    show ?thesis
+      using VEventually
+      by (auto simp: infinity i_ETP_tau le_diff_conv2)
+  qed
+next
+  case (SHistorically j I i v \<phi>)
+  { fix k
+    assume k_def: "\<not> \<langle>\<sigma>, v, k\<rangle> \<Turnstile> \<phi> \<and> mem (\<delta> \<sigma> i k) I \<and> k \<le> i"
+    then have k_tau: "\<tau> \<sigma> k \<le> \<tau> \<sigma> i - left I"
+      using diff_le_mono2 by fastforce
+    then have k_ltp: "k \<le> LTP \<sigma> (\<tau> \<sigma> i - left I)"
+      using SHistorically i_LTP_tau add_le_imp_le_diff
+      by blast
+    then have "k \<notin> {j .. LTP_p \<sigma> i I}"
+      using k_def SHistorically k_tau
+      by auto
+    then have "k < j" using k_def k_ltp by auto }
+  then show ?case
+    using SHistorically
+    by (cases "right I = \<infinity>")
+      (auto 0 0 simp add: le_diff_conv2 i_ETP_tau i_LTP_tau)
+next
+  case (SHistoricallyOut i I v \<phi>)
+  { fix j
+    from \<tau>_mono have j0: "\<tau> \<sigma> 0 \<le> \<tau> \<sigma> j" by auto
+    then have "\<tau> \<sigma> i < \<tau> \<sigma> j + left I" using SHistoricallyOut by linarith
+    then have "\<delta> \<sigma> i j < left I"
+      using SHistoricallyOut less_\<tau>D not_le by fastforce
+    then have "\<not> mem (\<delta> \<sigma> i j) I" by auto }
+  then show ?case by auto
+next
+  case (SAlways I i v \<phi>)
+  { fix k n
+    assume r: "right I = enat n"
+    from this SAlways have tin0: "\<tau> \<sigma> i + n \<ge> \<tau> \<sigma> 0"
+      by (auto simp add: trans_le_add1)
+    define j where "j = LTP \<sigma> ((\<tau> \<sigma> i) + n)"
+    from SAlways have j_i: "i \<le> j"
+      by (auto simp add: i_LTP_tau trans_le_add1 j_def)
+    assume k_def: "\<not> \<langle>\<sigma>, v, k\<rangle> \<Turnstile> \<phi> \<and> mem (\<delta> \<sigma> k i) I \<and> i \<le> k"
+    then have "\<tau> \<sigma> k \<ge> \<tau> \<sigma> i + left I"
+      using le_diff_conv2 by auto
+    then have k_etp: "k \<ge> ETP \<sigma> (\<tau> \<sigma> i + left I)"
+      using SAlways i_ETP_tau by blast
+    from this k_def SAlways have "k \<notin> {ETP_f \<sigma> i I .. j}"
+      by (auto simp: r j_def)
+    then have "j < k" using SAlways k_def k_etp by simp
+    from k_def r have "\<delta> \<sigma> k i \<le> n" by simp
+    then have "\<tau> \<sigma> k \<le> \<tau> \<sigma> i + n" by simp
+    then have "k \<le> j"
+      using tin0 i_LTP_tau  
+      by (auto simp add: j_def) }
+  note aux = this
+  show ?case
+  proof (cases "right I")
+    case (enat n)
+    show ?thesis
+      using SAlways[unfolded enat, simplified] aux
+      by (simp add: i_ETP_tau le_diff_conv2 enat)
+        (metis Groups.ab_semigroup_add_class.add.commute add_le_imp_le_diff)
+  next
+    case infinity
+    show ?thesis
+      using SAlways
+      by (auto simp: infinity i_ETP_tau le_diff_conv2)
+  qed
+next
+  case (VSinceOut i I v \<phi> \<psi>)
+  { fix j
+    from \<tau>_mono have j0: "\<tau> \<sigma> 0 \<le> \<tau> \<sigma> j" by auto
+    then have "\<tau> \<sigma> i < \<tau> \<sigma> j + left I" using VSinceOut by linarith
+    then have "\<delta> \<sigma> i j < left I" using VSinceOut j0
+      by (metis add.commute gr_zeroI leI less_\<tau>D less_diff_conv2 order_less_imp_not_less zero_less_diff)
+    then have "\<not> mem (\<delta> \<sigma> i j) I" by auto }
+  then show ?case using VSinceOut by auto
+next
+  case (VSince I i j v \<phi> \<psi>)
+  { fix k
+    assume k_def: "\<langle>\<sigma>, v, k\<rangle> \<Turnstile> \<psi> \<and> mem (\<delta> \<sigma> i k) I \<and> k \<le> i"
+    then have "\<tau> \<sigma> k \<le> \<tau> \<sigma> i - left I" using diff_le_mono2 by fastforce
+    then have k_ltp: "k \<le> LTP \<sigma> (\<tau> \<sigma> i - left I)"
+      using VSince i_LTP_tau add_le_imp_le_diff
+      by blast
+    then have "k < j" using k_def VSince(7)[of k]
+      by force
+    then have "j \<in> {k <.. i} \<and> \<not> \<langle>\<sigma>, v, j\<rangle> \<Turnstile> \<phi>" using VSince
+      by auto }
+  then show ?case using VSince
+    by force
+next
+  case (VSinceInf j I i v \<psi> \<phi>)
+  { fix k
+    assume k_def: "\<langle>\<sigma>, v, k\<rangle> \<Turnstile> \<psi> \<and> mem (\<delta> \<sigma> i k) I \<and> k \<le> i"
+    then have k_tau: "\<tau> \<sigma> k \<le> \<tau> \<sigma> i - left I"
+      using diff_le_mono2 by fastforce
+    then have k_ltp: "k \<le> LTP \<sigma> (\<tau> \<sigma> i - left I)"
+      using VSinceInf i_LTP_tau add_le_imp_le_diff
+      by blast
+    then have "k \<notin> {j .. LTP_p \<sigma> i I}"
+      using k_def VSinceInf k_tau
+      by auto
+    then have "k < j" using k_def k_ltp by auto }
+  then show ?case
+    using VSinceInf
+    by (cases "right I = \<infinity>")
+      (auto 0 0 simp: i_ETP_tau i_LTP_tau le_diff_conv2)
+next
+  case (VUntil I j i v \<phi> \<psi>)
+  { fix k
+    assume k_def: "\<langle>\<sigma>, v, k\<rangle> \<Turnstile> \<psi> \<and> mem (\<delta> \<sigma> k i) I \<and> i \<le> k"
+    then have "\<tau> \<sigma> k \<ge> \<tau> \<sigma> i + left I"
+      using le_diff_conv2 by auto
+    then have k_etp: "k \<ge> ETP \<sigma> (\<tau> \<sigma> i + left I)"
+      using VUntil i_ETP_tau by blast
+    from this k_def VUntil have "k \<notin> {ETP_f \<sigma> i I .. j}" by auto
+    then have "j < k" using k_etp k_def by auto
+    then have "j \<in> {i ..< k} \<and> VIO \<sigma> v j \<phi>" using VUntil k_def
+      by auto }
+  then show ?case
+    using VUntil by force
+next
+  case (VUntilInf I i v \<psi> \<phi>)
+  { fix k n
+    assume r: "right I = enat n"
+    from this VUntilInf have tin0: "\<tau> \<sigma> i + n \<ge> \<tau> \<sigma> 0"
+      by (auto simp add: trans_le_add1)
+    define j where "j = LTP \<sigma> ((\<tau> \<sigma> i) + n)"
+    from VUntilInf have j_i: "i \<le> j"
+      by (auto simp add: i_LTP_tau trans_le_add1 j_def)
+    assume k_def: "\<langle>\<sigma>, v, k\<rangle> \<Turnstile> \<psi> \<and> mem (\<delta> \<sigma> k i) I \<and> i \<le> k"
+    then have "\<tau> \<sigma> k \<ge> \<tau> \<sigma> i + left I"
+      using le_diff_conv2 by auto
+    then have k_etp: "k \<ge> ETP \<sigma> (\<tau> \<sigma> i + left I)"
+      using VUntilInf i_ETP_tau by blast
+    from this k_def VUntilInf have "k \<notin> {ETP_f \<sigma> i I .. j}"
+      by (auto simp: r j_def)
+    then have "j < k" using VUntilInf k_def k_etp by auto
+    from k_def r have "\<delta> \<sigma> k i \<le> n" by auto
+    then have "\<tau> \<sigma> k \<le> \<tau> \<sigma> i + n" by auto
+    then have "k \<le> j"
+      using tin0 VUntilInf i_LTP_tau r k_def 
+      by (force simp add: j_def) }
+  note aux = this
+  show ?case
+  proof (cases "right I")
+    case (enat n)
+    show ?thesis
+      using VUntilInf[unfolded enat, simplified] aux
+      by (simp add: i_ETP_tau enat)
+        (metis \<tau>_mono le_add_diff_inverse nat_add_left_cancel_le)
+  next
+    case infinity
+    show ?thesis
+      using VUntilInf
+      by (auto simp: infinity i_ETP_tau le_diff_conv2)
+  qed
+qed (auto simp: fun_upd_def split: nat.splits)
+
+lemmas soundness = soundness_raw[THEN conjunct1, THEN mp] soundness_raw[THEN conjunct2, THEN mp]
+
+lemma completeness_raw: "(\<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<phi> \<longrightarrow> SAT \<sigma> v i \<phi>) \<and> (\<not> \<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<phi> \<longrightarrow> VIO \<sigma> v i \<phi>)"
+proof (induct \<phi> arbitrary: v i)
+  case (Prev I \<phi>)
+  show ?case using Prev
+    by (auto intro: SAT_VIO.SPrev SAT_VIO.VPrev SAT_VIO.VPrevOutL SAT_VIO.VPrevOutR SAT_VIO.VPrevZ split: nat.splits)
+next
+  case (Once I \<phi>)
+  { assume "\<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<^bold>P I \<phi>"
+    with Once have "SAT \<sigma> v i (\<^bold>P I \<phi>)"
+      by (auto intro: SAT_VIO.SOnce) }
+  moreover
+  { assume i_l: "\<tau> \<sigma> i < \<tau> \<sigma> 0 + left I"
+    with Once have "VIO \<sigma> v i (\<^bold>P I \<phi>)"
+      by (auto intro: SAT_VIO.VOnceOut) }
+  moreover
+  { assume unsat: "\<not> \<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<^bold>P I \<phi>"
+      and i_ge: "\<tau> \<sigma> 0 + left I \<le> \<tau> \<sigma> i"
+    with Once have "VIO \<sigma> v i (\<^bold>P I \<phi>)"
+      by (auto intro!: SAT_VIO.VOnce simp: i_LTP_tau i_ETP_tau
+          split: enat.splits) }
+  ultimately show ?case
+    by force
+next
+  case (Historically I \<phi>)
+  from \<tau>_mono have i0: "\<tau> \<sigma> 0 \<le> \<tau> \<sigma> i" by auto
+  { assume sat: "\<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<^bold>H I \<phi>"
+      and i_ge: "\<tau> \<sigma> i \<ge> \<tau> \<sigma> 0 + left I"
+    with Historically have "SAT \<sigma> v i (\<^bold>H I \<phi>)"
+      using le_diff_conv
+      by (auto intro!: SAT_VIO.SHistorically simp: i_LTP_tau i_ETP_tau
+          split: enat.splits) }
+  moreover
+  { assume "\<not> \<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<^bold>H I \<phi>"
+    with Historically have "VIO \<sigma> v i (\<^bold>H I \<phi>)"
+      by (auto intro: SAT_VIO.VHistorically) }
+  moreover
+  { assume i_l: "\<tau> \<sigma> i < \<tau> \<sigma> 0 + left I"
+    with Historically have "SAT \<sigma> v i (\<^bold>H I \<phi>)"
+      by (auto intro: SAT_VIO.SHistoricallyOut) }
+  ultimately show ?case
+    by force
+next
+  case (Eventually I \<phi>)
+  from \<tau>_mono have i0: "\<tau> \<sigma> 0 \<le> \<tau> \<sigma> i" by auto
+  { assume "\<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<^bold>F I \<phi>"
+    with Eventually have "SAT \<sigma> v i (\<^bold>F I \<phi>)"
+      by (auto intro: SAT_VIO.SEventually) }
+  moreover
+  { assume unsat: "\<not> \<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<^bold>F I \<phi>"
+    with Eventually have "VIO \<sigma> v i (\<^bold>F I \<phi>)"
+      by (auto intro!: SAT_VIO.VEventually simp: add_increasing2 i0 i_LTP_tau i_ETP_tau
+          split: enat.splits) }
+  ultimately show ?case by auto
+next
+  case (Always I \<phi>)
+    from \<tau>_mono have i0: "\<tau> \<sigma> 0 \<le> \<tau> \<sigma> i" by auto
+  { assume "\<not> \<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<^bold>G I \<phi>"
+    with Always have "VIO \<sigma> v i (\<^bold>G I \<phi>)"
+      by (auto intro: SAT_VIO.VAlways) }
+  moreover
+  { assume sat: "\<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<^bold>G I \<phi>"
+    with Always have "SAT \<sigma> v i (\<^bold>G I \<phi>)"
+      by (auto intro!: SAT_VIO.SAlways simp: add_increasing2 i0 i_LTP_tau i_ETP_tau le_diff_conv split: enat.splits)}
+  ultimately show ?case by auto
+next
+  case (Since \<phi> I \<psi>)
+  { assume "\<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<phi> \<^bold>S I \<psi>"
+    with Since have "SAT \<sigma> v i (\<phi> \<^bold>S I \<psi>)"
+      by (auto intro: SAT_VIO.SSince) }
+  moreover
+  { assume i_l: "\<tau> \<sigma> i < \<tau> \<sigma> 0 + left I"
+    with Since have "VIO \<sigma> v i (\<phi> \<^bold>S I \<psi>)"
+      by (auto intro: SAT_VIO.VSinceOut) }
+  moreover
+  { assume unsat: "\<not> \<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<phi> \<^bold>S I \<psi>"
+      and nw: "\<forall>j\<le>i. \<not> mem (\<delta> \<sigma> i j) I \<or> \<not> \<langle>\<sigma>, v, j\<rangle> \<Turnstile> \<psi>"
+      and i_ge: "\<tau> \<sigma> 0 + left I \<le> \<tau> \<sigma> i"
+    with Since have "VIO \<sigma> v i (\<phi> \<^bold>S I \<psi>)"
+      by (auto intro!: SAT_VIO.VSinceInf simp: i_LTP_tau i_ETP_tau
+          split: enat.splits)}
+  moreover
+  { assume unsat: "\<not> \<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<phi> \<^bold>S I \<psi>"
+      and jw: "\<exists>j\<le>i. mem (\<delta> \<sigma> i j) I \<and> \<langle>\<sigma>, v, j\<rangle> \<Turnstile> \<psi>"
+      and i_ge: "\<tau> \<sigma> 0 + left I \<le> \<tau> \<sigma> i"
+    from unsat jw not_sat_SinceD[of \<sigma> v i \<phi> I \<psi>]
+    obtain j where j: "j \<le> i"
+      "case right I of \<infinity> \<Rightarrow> True | enat n \<Rightarrow> ETP \<sigma> (\<tau> \<sigma> i - n) \<le> j"
+      "\<not> \<langle>\<sigma>, v, j\<rangle> \<Turnstile> \<phi>" "(\<forall>k \<in> {j .. (min i (LTP \<sigma> (\<tau> \<sigma> i - left I)))}.
+      \<not> \<langle>\<sigma>, v, k\<rangle> \<Turnstile> \<psi>)" by (auto split: enat.splits)
+    with Since have "VIO \<sigma> v i (\<phi> \<^bold>S I \<psi>)"
+      using i_ge unsat jw
+      by (auto intro!: SAT_VIO.VSince) }
+  ultimately show ?case
+    by (force simp del: sat.simps)
+next
+  case (Until \<phi> I \<psi>)
+  from \<tau>_mono have i0: "\<tau> \<sigma> 0 \<le> \<tau> \<sigma> i" by auto
+  { assume "\<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<phi> \<^bold>U I \<psi>"
+    with Until have "SAT \<sigma> v i (\<phi> \<^bold>U I \<psi>)"
+      by (auto intro: SAT_VIO.SUntil) }
+  moreover
+  { assume unsat: "\<not> \<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<phi> \<^bold>U I \<psi>"
+      and witness: "\<exists>j \<ge> i. mem (\<delta> \<sigma> j i) I \<and> \<langle>\<sigma>, v, j\<rangle> \<Turnstile> \<psi>"
+    from this Until not_sat_UntilD[of \<sigma> v i \<phi> I \<psi>] obtain j
+      where j: "j \<ge> i" "(case right I of \<infinity> \<Rightarrow> True | enat n
+      \<Rightarrow> j < LTP \<sigma> (\<tau> \<sigma> i + n))" "\<not> (\<langle>\<sigma>, v, j\<rangle> \<Turnstile> \<phi>)"
+        "(\<forall>k \<in> {(max i (ETP \<sigma> (\<tau> \<sigma> i + left I))) .. j}. \<not> \<langle>\<sigma>, v, k\<rangle> \<Turnstile> \<psi>)"
+      by auto
+    with Until have "VIO \<sigma> v i (\<phi> \<^bold>U I \<psi>)"
+      using unsat witness 
+      by (auto intro!: SAT_VIO.VUntil) }
+  moreover
+  { assume unsat: "\<not> \<langle>\<sigma>, v, i\<rangle> \<Turnstile> \<phi> \<^bold>U I \<psi>"
+      and no_witness: "\<forall>j \<ge> i. \<not> mem (\<delta> \<sigma> j i) I \<or> \<not> \<langle>\<sigma>, v, j\<rangle> \<Turnstile> \<psi>"
+    with Until have "VIO \<sigma> v i (\<phi> \<^bold>U I \<psi>)"
+      by (auto intro!: SAT_VIO.VUntilInf simp: add_increasing2 i0 i_LTP_tau i_ETP_tau
+          split: enat.splits)
+  }
+  ultimately show ?case by auto
+qed (auto intro: SAT_VIO.intros)
+
+lemmas completeness = completeness_raw[THEN conjunct1, THEN mp] completeness_raw[THEN conjunct2, THEN mp]
+
+lemma SAT_or_VIO: "SAT \<sigma> v i \<phi> \<or> VIO \<sigma> v i \<phi>"
+  using completeness[of \<sigma> v i \<phi>] by auto
+
+end
+
+unbundle MFOTL_no_notation
+
+(*<*)
+end
+(*>*)
\ No newline at end of file
diff --git a/thys/MFOTL_Checker/ROOT b/thys/MFOTL_Checker/ROOT
new file mode 100644
--- /dev/null
+++ b/thys/MFOTL_Checker/ROOT
@@ -0,0 +1,21 @@
+chapter AFP
+
+session MFOTL_Checker (AFP) = "MFOTL_Monitor" +
+  options [timeout = 1200]
+  theories
+    Trace
+    Formula
+    Partition
+    Proof_System
+    Proof_Object
+    Prelim
+    Checker
+    Event_Data
+    Checker_Code
+    Monitor
+    Examples
+  document_files
+    "root.tex"
+    "root.bib"
+  export_files (in ".") [2]
+    "MFOTL_Checker.Checker_Code:code/**"
diff --git a/thys/MFOTL_Checker/Trace.thy b/thys/MFOTL_Checker/Trace.thy
new file mode 100644
--- /dev/null
+++ b/thys/MFOTL_Checker/Trace.thy
@@ -0,0 +1,449 @@
+(*<*)
+theory Trace
+  imports "MFOTL_Monitor.Interval" "HOL-Library.Stream"
+begin
+(*>*)
+
+section \<open>Traces and Trace Prefixes\<close>
+
+subsection \<open>Infinite Traces\<close>
+
+coinductive ssorted :: "'a :: linorder stream \<Rightarrow> bool" where
+  "shd s \<le> shd (stl s) \<Longrightarrow> ssorted (stl s) \<Longrightarrow> ssorted s"
+
+lemma ssorted_siterate[simp]: "(\<And>n. n \<le> f n) \<Longrightarrow> ssorted (siterate f n)"
+  by (coinduction arbitrary: n) auto
+
+lemma ssortedD: "ssorted s \<Longrightarrow> s !! i \<le> stl s !! i"
+  by (induct i arbitrary: s) (auto elim: ssorted.cases)
+
+lemma ssorted_sdrop: "ssorted s \<Longrightarrow> ssorted (sdrop i s)"
+  by (coinduction arbitrary: i s) (auto elim: ssorted.cases ssortedD)
+
+lemma ssorted_monoD: "ssorted s \<Longrightarrow> i \<le> j \<Longrightarrow> s !! i \<le> s !! j"
+proof (induct "j - i" arbitrary: j)
+  case (Suc x)
+  from Suc(1)[of "j - 1"] Suc(2-4) ssortedD[of s "j - 1"]
+    show ?case by (cases j) (auto simp: le_Suc_eq Suc_diff_le)
+qed simp
+
+lemma sorted_stake: "ssorted s \<Longrightarrow> sorted (stake i s)"
+  by (induct i arbitrary: s)
+    (auto elim: ssorted.cases simp: in_set_conv_nth
+      intro!: ssorted_monoD[of _ 0, simplified, THEN order_trans, OF _ ssortedD])
+
+lemma ssorted_monoI: "\<forall>i j. i \<le> j \<longrightarrow> s !! i \<le> s !! j \<Longrightarrow> ssorted s"
+  by (coinduction arbitrary: s)
+    (auto dest: spec2[of _ "Suc _" "Suc _"] spec2[of _ 0 "Suc 0"])
+
+lemma ssorted_iff_mono: "ssorted s \<longleftrightarrow> (\<forall>i j. i \<le> j \<longrightarrow> s !! i \<le> s !! j)"
+  using ssorted_monoI ssorted_monoD by metis
+
+lemma ssorted_iff_le_Suc: "ssorted s \<longleftrightarrow> (\<forall>i. s !! i \<le> s !! Suc i)"
+  using mono_iff_le_Suc[of "snth s"] by (simp add: mono_def ssorted_iff_mono)
+
+definition "sincreasing s = (\<forall>x. \<exists>i. x < s !! i)"
+
+lemma sincreasingI: "(\<And>x. \<exists>i. x < s !! i) \<Longrightarrow> sincreasing s"
+  by (simp add: sincreasing_def)
+
+lemma sincreasing_grD:
+  fixes x :: "'a :: semilattice_sup"
+  assumes "sincreasing s"
+  shows "\<exists>j>i. x < s !! j"
+proof -
+  let ?A = "insert x {s !! n | n. n \<le> i}"
+  from assms obtain j where *: "Sup_fin ?A < s !! j"
+    by (auto simp: sincreasing_def)
+  then have "x < s !! j"
+    by (rule order.strict_trans1[rotated]) (auto intro: Sup_fin.coboundedI)
+  moreover have "i < j"
+  proof (rule ccontr)
+    assume "\<not> i < j"
+    then have "s !! j \<in> ?A" by (auto simp: not_less)
+    then have "s !! j \<le> Sup_fin ?A"
+      by (auto intro: Sup_fin.coboundedI)
+    with * show False by simp
+  qed
+  ultimately show ?thesis by blast
+qed
+
+lemma sincreasing_siterate_nat[simp]:
+  fixes n :: nat
+  assumes "(\<And>n. n < f n)"
+  shows "sincreasing (siterate f n)"
+unfolding sincreasing_def proof
+  fix x
+  show "\<exists>i. x < siterate f n !! i"
+  proof (induction x)
+    case 0
+    have "0 < siterate f n !! 1"
+      using order.strict_trans1[OF le0 assms] by simp
+    then show ?case ..
+  next
+    case (Suc x)
+    then obtain i where "x < siterate f n !! i" ..
+    then have "Suc x < siterate f n !! Suc i"
+      using order.strict_trans1[OF _ assms] by (simp del: snth.simps)
+    then show ?case ..
+  qed
+qed
+
+lemma sincreasing_stl: "sincreasing s \<Longrightarrow> sincreasing (stl s)" for s :: "'a :: semilattice_sup stream"
+  by (auto 0 4 simp: gr0_conv_Suc intro!: sincreasingI dest: sincreasing_grD[of s 0])
+
+definition "sfinite s = (\<forall>i. finite (s !! i))"
+
+lemma sfiniteI: "(\<And>i. finite (s !! i)) \<Longrightarrow> sfinite s"
+  by (simp add: sfinite_def)
+
+typedef 'a trace = "{s :: ('a set \<times> nat) stream. ssorted (smap snd s) \<and> sincreasing (smap snd s) \<and> sfinite (smap fst s)}"
+  by (intro exI[of _ "smap (\<lambda>i. ({}, i)) nats"])
+    (auto simp: stream.map_comp stream.map_ident sfinite_def cong: stream.map_cong)
+
+setup_lifting type_definition_trace
+
+lift_definition \<Gamma> :: "'a trace \<Rightarrow> nat \<Rightarrow> 'a set" is
+  "\<lambda>s i. fst (s !! i)" .
+lift_definition \<tau> :: "'a trace \<Rightarrow> nat \<Rightarrow> nat" is
+  "\<lambda>s i. snd (s !! i)" .
+
+lemma stream_eq_iff: "s = s' \<longleftrightarrow> (\<forall>n. s !! n = s' !! n)"
+  by (metis stream.map_cong0 stream_smap_nats)
+
+lemma trace_eqI: "(\<And>i. \<Gamma> \<sigma> i = \<Gamma> \<sigma>' i) \<Longrightarrow> (\<And>i. \<tau> \<sigma> i = \<tau> \<sigma>' i) \<Longrightarrow> \<sigma> = \<sigma>'"
+  by transfer (auto simp: stream_eq_iff intro!: prod_eqI)
+
+lemma \<tau>_mono[simp]: "i \<le> j \<Longrightarrow> \<tau> s i \<le> \<tau> s j"
+  by transfer (auto simp: ssorted_iff_mono)
+
+lemma ex_le_\<tau>: "\<exists>j\<ge>i. x \<le> \<tau> s j"
+  by (transfer fixing: i x) (auto dest!: sincreasing_grD[of _ i x] less_imp_le)
+
+lemma le_\<tau>_less: "\<tau> \<sigma> i \<le> \<tau> \<sigma> j \<Longrightarrow> j < i \<Longrightarrow> \<tau> \<sigma> i = \<tau> \<sigma> j"
+  by (simp add: antisym)
+
+lemma less_\<tau>D: "\<tau> \<sigma> i < \<tau> \<sigma> j \<Longrightarrow> i < j"
+  by (meson \<tau>_mono less_le_not_le not_le_imp_less)
+
+abbreviation "\<Delta> s i \<equiv> \<tau> s i - \<tau> s (i - 1)"
+
+subsection \<open>Finite Trace Prefixes\<close>
+
+typedef 'a prefix = "{p :: ('a set \<times> nat) list. sorted (map snd p)}"
+  by (auto intro!: exI[of _ "[]"])
+
+setup_lifting type_definition_prefix
+
+lift_definition pmap_\<Gamma> :: "('a set \<Rightarrow> 'b set) \<Rightarrow> 'a prefix \<Rightarrow> 'b prefix" is
+  "\<lambda>f. map (\<lambda>(x, i). (f x, i))"
+  by (simp add: split_beta comp_def)
+
+lift_definition last_ts :: "'a prefix \<Rightarrow> nat" is
+  "\<lambda>p. (case p of [] \<Rightarrow> 0 | _ \<Rightarrow> snd (last p))" .
+
+lift_definition first_ts :: "nat \<Rightarrow> 'a prefix \<Rightarrow> nat" is
+  "\<lambda>n p. (case p of [] \<Rightarrow> n | _ \<Rightarrow> snd (hd p))" .
+
+lift_definition pnil :: "'a prefix" is "[]" by simp
+
+lift_definition plen :: "'a prefix \<Rightarrow> nat" is "length" .
+
+lift_definition psnoc :: "'a prefix \<Rightarrow> 'a set \<times> nat \<Rightarrow> 'a prefix" is
+  "\<lambda>p x. if (case p of [] \<Rightarrow> 0 | _ \<Rightarrow> snd (last p)) \<le> snd x then p @ [x] else []"
+proof (goal_cases sorted_psnoc)
+  case (sorted_psnoc p x)
+  then show ?case
+    by (induction p) (auto split: if_splits list.splits)
+qed
+
+instantiation prefix :: (type) order begin
+
+lift_definition less_eq_prefix :: "'a prefix \<Rightarrow> 'a prefix \<Rightarrow> bool" is
+  "\<lambda>p q. \<exists>r. q = p @ r" .
+
+definition less_prefix :: "'a prefix \<Rightarrow> 'a prefix \<Rightarrow> bool" where
+  "less_prefix x y = (x \<le> y \<and> \<not> y \<le> x)"
+
+instance
+proof (standard, goal_cases less refl trans antisym)
+  case (less x y)
+  then show ?case unfolding less_prefix_def ..
+next
+  case (refl x)
+  then show ?case by transfer auto
+next
+  case (trans x y z)
+  then show ?case by transfer auto
+next
+  case (antisym x y)
+  then show ?case by transfer auto
+qed
+
+end
+
+lemma psnoc_inject[simp]:
+  "last_ts p \<le> snd x \<Longrightarrow> last_ts q \<le> snd y \<Longrightarrow> psnoc p x = psnoc q y \<longleftrightarrow> (p = q \<and> x = y)"
+  by transfer auto
+
+lift_definition prefix_of :: "'a prefix \<Rightarrow> 'a trace \<Rightarrow> bool" is "\<lambda>p s. stake (length p) s = p" .
+
+lemma prefix_of_pnil[simp]: "prefix_of pnil \<sigma>"
+  by transfer auto
+
+lemma plen_pnil[simp]: "plen pnil = 0"
+  by transfer auto
+
+lemma plen_mono: "\<pi> \<le> \<pi>' \<Longrightarrow> plen \<pi> \<le> plen \<pi>'"
+  by transfer auto
+
+lemma prefix_of_psnocE: "prefix_of (psnoc p x) s \<Longrightarrow> last_ts p \<le> snd x \<Longrightarrow>
+  (prefix_of p s \<Longrightarrow> \<Gamma> s (plen p) = fst x \<Longrightarrow> \<tau> s (plen p) = snd x \<Longrightarrow> P) \<Longrightarrow> P"
+  by transfer (simp del: stake.simps add: stake_Suc)
+
+lemma le_pnil[simp]: "pnil \<le> \<pi>"
+  by transfer auto
+
+lift_definition take_prefix :: "nat \<Rightarrow> 'a trace \<Rightarrow> 'a prefix" is stake
+  by (auto dest: sorted_stake)
+
+lemma plen_take_prefix[simp]: "plen (take_prefix i \<sigma>) = i"
+  by transfer auto
+
+lemma plen_psnoc[simp]: "last_ts \<pi> \<le> snd x \<Longrightarrow> plen (psnoc \<pi> x) = plen \<pi> + 1"
+  by transfer auto
+
+lemma prefix_of_take_prefix[simp]: "prefix_of (take_prefix i \<sigma>) \<sigma>"
+  by transfer auto
+
+lift_definition pdrop :: "nat \<Rightarrow> 'a prefix \<Rightarrow> 'a prefix" is drop
+  by (auto simp: drop_map[symmetric] sorted_wrt_drop)
+
+lemma pdrop_0[simp]: "pdrop 0 \<pi> = \<pi>"
+  by transfer auto
+
+lemma prefix_of_antimono: "\<pi> \<le> \<pi>' \<Longrightarrow> prefix_of \<pi>' s \<Longrightarrow> prefix_of \<pi> s"
+  by transfer (auto simp del: stake_add simp add: stake_add[symmetric])
+
+lemma prefix_of_imp_linear: "prefix_of \<pi> \<sigma> \<Longrightarrow> prefix_of \<pi>' \<sigma> \<Longrightarrow> \<pi> \<le> \<pi>' \<or> \<pi>' \<le> \<pi>"
+proof transfer
+  fix \<pi> \<pi>' and \<sigma> :: "('a set \<times> nat) stream"
+  assume assms: "stake (length \<pi>) \<sigma> = \<pi>" "stake (length \<pi>') \<sigma> = \<pi>'"
+  show "(\<exists>r. \<pi>' = \<pi> @ r) \<or> (\<exists>r. \<pi> = \<pi>' @ r)"
+  proof (cases "length \<pi>" "length \<pi>'" rule: le_cases)
+    case le
+    then have "\<pi>' = take (length \<pi>) \<pi>' @ drop (length \<pi>) \<pi>'"
+      by simp
+    moreover have "take (length \<pi>) \<pi>' = \<pi>"
+      using assms le by (metis min.absorb1 take_stake)
+    ultimately show ?thesis by auto
+  next
+    case ge
+    then have "\<pi> = take (length \<pi>') \<pi> @ drop (length \<pi>') \<pi>"
+      by simp
+    moreover have "take (length \<pi>') \<pi> = \<pi>'"
+      using assms ge by (metis min.absorb1 take_stake)
+    ultimately show ?thesis by auto
+  qed
+qed
+
+lemma \<tau>_prefix_conv: "prefix_of p s \<Longrightarrow> prefix_of p s' \<Longrightarrow> i < plen p \<Longrightarrow> \<tau> s i = \<tau> s' i"
+  by transfer (simp add: stake_nth[symmetric])
+
+lemma \<Gamma>_prefix_conv: "prefix_of p s \<Longrightarrow> prefix_of p s' \<Longrightarrow> i < plen p \<Longrightarrow> \<Gamma> s i = \<Gamma> s' i"
+  by transfer (simp add: stake_nth[symmetric])
+
+lemma sincreasing_sdrop:
+  fixes s :: "('a :: semilattice_sup) stream"
+  assumes "sincreasing s"
+  shows "sincreasing (sdrop n s)"
+proof (rule sincreasingI)
+  fix x
+  obtain i where "n < i" and "x < s !! i"
+    using sincreasing_grD[OF assms] by blast
+  then have "x < sdrop n s !! (i - n)"
+    by (simp add: sdrop_snth)
+  then show "\<exists>i. x < sdrop n s !! i" ..
+qed
+
+lemma ssorted_shift:
+  "ssorted (xs @- s) = (sorted xs \<and> ssorted s \<and> (\<forall>x\<in>set xs. \<forall>y\<in>sset s. x \<le> y))"
+proof safe
+  assume *: "ssorted (xs @- s)"
+  then show "sorted xs"
+    by (auto simp: ssorted_iff_mono shift_snth sorted_iff_nth_mono split: if_splits)
+  from ssorted_sdrop[OF *, of "length xs"] show "ssorted s"
+    by (auto simp: sdrop_shift)
+  fix x y assume "x \<in> set xs" "y \<in> sset s"
+  then obtain i j where "i < length xs" "xs ! i = x" "s !! j = y"
+    by (auto simp: set_conv_nth sset_range)
+  with ssorted_monoD[OF *, of i "j + length xs"] show "x \<le> y" by auto
+next
+  assume "sorted xs" "ssorted s" "\<forall>x\<in>set xs. \<forall>y\<in>sset s. x \<le> y"
+  then show "ssorted (xs @- s)"
+  proof (coinduction arbitrary: xs s)
+    case (ssorted xs s)
+    with \<open>ssorted s\<close> show ?case
+      by (subst (asm) ssorted.simps) (auto 0 4 simp: neq_Nil_conv shd_sset intro: exI[of _ "_ # _"])
+  qed
+qed
+
+lemma sincreasing_shift:
+  assumes "sincreasing s"
+  shows "sincreasing (xs @- s)"
+proof (rule sincreasingI)
+  fix x
+  from assms obtain i where "x < s !! i"
+    unfolding sincreasing_def by blast
+  then have "x < (xs @- s) !! (length xs + i)"
+    by simp
+  then show "\<exists>i. x < (xs @- s) !! i" ..
+qed
+
+lift_definition pts :: "'a prefix \<Rightarrow> nat list" is "map snd" .
+
+lemma pts_pmap_\<Gamma>[simp]: "pts (pmap_\<Gamma> f \<pi>) = pts \<pi>"
+  by (transfer fixing: f) (simp add: split_beta)
+
+subsection \<open>Earliest and Latest Time-Points\<close>
+
+definition ETP:: "'a trace \<Rightarrow> nat \<Rightarrow> nat"  where
+  "ETP \<sigma> t = (LEAST i. \<tau> \<sigma> i \<ge> t)"
+
+definition LTP:: "'a trace \<Rightarrow> nat \<Rightarrow> nat" where
+  "LTP \<sigma> t = Max {i. (\<tau> \<sigma> i) \<le> t}"
+
+abbreviation "\<delta> \<sigma> i j \<equiv> (\<tau> \<sigma> i - \<tau> \<sigma> j)"
+
+abbreviation "ETP_p \<sigma> i b \<equiv> ETP \<sigma> ((\<tau> \<sigma> i) - b)"
+abbreviation "LTP_p \<sigma> i I \<equiv> min i (LTP \<sigma> ((\<tau> \<sigma> i) - left I))"
+abbreviation "ETP_f \<sigma> i I \<equiv> max i (ETP \<sigma> ((\<tau> \<sigma> i) + left I))"
+abbreviation "LTP_f \<sigma> i b \<equiv> LTP \<sigma> ((\<tau> \<sigma> i) + b)"
+
+definition max_opt where
+  "max_opt a b = (case (a,b) of (Some x, Some y) \<Rightarrow> Some (max x y) | _ \<Rightarrow> None)"
+
+definition "LTP_p_safe \<sigma> i I = (if \<tau> \<sigma> i - left I \<ge> \<tau> \<sigma> 0 then LTP_p \<sigma> i I else 0)"
+
+lemma i_ETP_tau: "i \<ge> ETP \<sigma> n \<longleftrightarrow> \<tau> \<sigma> i \<ge> n"
+proof
+  assume P: "i \<ge> ETP \<sigma> n"
+  define j where j_def: "j \<equiv> ETP \<sigma> n"
+  then have i_j: "\<tau> \<sigma> i \<ge> \<tau> \<sigma> j" using P by auto
+  from j_def have "\<tau> \<sigma> j \<ge> n"
+    unfolding ETP_def using LeastI_ex ex_le_\<tau> by force
+  then show "\<tau> \<sigma> i \<ge> n" using i_j by auto
+next
+  assume Q: "\<tau> \<sigma> i \<ge> n"
+  then show "ETP \<sigma> n \<le> i" unfolding ETP_def
+    by (auto simp add: Least_le)
+qed
+
+lemma tau_LTP_k: 
+  assumes "\<tau> \<sigma> 0 \<le> n" "LTP \<sigma> n < k"
+  shows "\<tau> \<sigma> k > n"
+proof -
+  have "finite {i. \<tau> \<sigma> i \<le> n}"
+    by (rule ccontr, unfold infinite_nat_iff_unbounded_le mem_Collect_eq)
+      (metis Suc_le_eq i_ETP_tau  leD)
+  then show ?thesis
+    using assms(2) Max.coboundedI linorder_not_less
+    unfolding LTP_def by auto
+qed
+
+lemma i_LTP_tau:
+  assumes n_asm: "n \<ge> \<tau> \<sigma> 0"
+  shows "(i \<le> LTP \<sigma> n \<longleftrightarrow> \<tau> \<sigma> i \<le> n)"
+proof
+  define A and j where A_def: "A \<equiv> {i. \<tau> \<sigma> i \<le> n}" and j_def: "j \<equiv> LTP \<sigma> n"
+  assume P: "i \<le> LTP \<sigma> n"
+  from n_asm A_def have A_ne: "A \<noteq> {}" by auto
+  from j_def have i_j: "\<tau> \<sigma> i \<le> \<tau> \<sigma> j" using P by auto
+  have not_in: "k \<notin> A" if "j < k" for k
+    using n_asm that tau_LTP_k leD
+    unfolding A_def j_def by blast
+  then have "A \<subseteq> {0..<Suc j}"
+    using assms not_less_eq
+    unfolding A_def j_def 
+    by fastforce
+  then have fin_A: "finite A"
+    using subset_eq_atLeast0_lessThan_finite[of A "Suc j"]
+    by simp
+  from A_ne j_def have "\<tau> \<sigma> j \<le> n"
+    using Max_in[of A] A_def fin_A 
+    unfolding LTP_def 
+    by simp
+  then show "\<tau> \<sigma> i \<le> n" using i_j by auto
+next
+  define A and j where A_def: "A \<equiv> {i. \<tau> \<sigma> i \<le> n}" and j_def: "j \<equiv> LTP \<sigma> n"
+  assume Q: "\<tau> \<sigma> i \<le> n" 
+  have not_in: "k \<notin> A" if "j < k" for k
+    using n_asm that tau_LTP_k leD
+    unfolding A_def j_def by blast
+  then have "A \<subseteq> {0..<Suc j}"
+    using assms not_less_eq
+    unfolding A_def j_def 
+    by fastforce
+  then have fin_A: "finite A"
+    using subset_eq_atLeast0_lessThan_finite[of A "Suc j"]
+    by simp
+  moreover have "i \<in> A" using Q A_def by auto
+  ultimately show "i \<le> LTP \<sigma> n" 
+    using Max_ge[of A] A_def 
+    unfolding LTP_def
+    by auto
+qed
+
+lemma ETP_\<delta>: "i \<ge> ETP \<sigma> (\<tau> \<sigma> l + n) \<Longrightarrow> \<delta> \<sigma> i l \<ge> n"
+proof -
+  assume P: "i \<ge> ETP \<sigma> (\<tau> \<sigma> l + n)"
+  then have "\<tau> \<sigma> i \<ge> \<tau> \<sigma> l + n" by (auto simp add: i_ETP_tau)
+  then show ?thesis by auto
+qed
+
+lemma ETP_ge: "ETP \<sigma> (\<tau> \<sigma> l + n + 1) > l"
+proof -
+  define j where j_def: "j \<equiv> \<tau> \<sigma> l + n + 1"
+  then have etp_j: "\<tau> \<sigma> (ETP \<sigma> j) \<ge> j" unfolding ETP_def
+    using LeastI_ex ex_le_\<tau> by force
+  then have "\<tau> \<sigma> (ETP \<sigma> j) > \<tau> \<sigma> l" using j_def by auto
+  then show ?thesis using j_def less_\<tau>D by blast
+qed
+
+lemma i_le_LTPi: "i \<le> LTP \<sigma> (\<tau> \<sigma> i)"
+  using \<tau>_mono i_LTP_tau[of \<sigma> "\<tau> \<sigma> i" i]
+  by auto
+
+lemma i_le_LTPi_add: "i \<le> LTP \<sigma> (\<tau> \<sigma> i + n)"
+  using i_le_LTPi
+  by (simp add: add_increasing2 i_LTP_tau)
+
+lemma i_le_LTPi_minus:
+  assumes "\<tau> \<sigma> 0 + n \<le> \<tau> \<sigma> i" "i > 0" "n > 0"
+  shows "LTP \<sigma> (\<tau> \<sigma> i - n) < i"
+  unfolding LTP_def
+proof (subst Max_less_iff; (intro ballI; elim CollectE)?)
+  show "finite {j. \<tau> \<sigma> j \<le> \<tau> \<sigma> i - n}"
+    unfolding finite_nat_set_iff_bounded_le
+  proof (intro exI[of _ i], safe)
+    fix j
+    assume "\<tau> \<sigma> j \<le> \<tau> \<sigma> i - n"
+    with assms(1,3) show "j \<le> i"
+      by (metis add_leD2 add_strict_increasing le_add_diff_inverse less_\<tau>D less_or_eq_imp_le)
+  qed
+next
+  from assms(1) show "{j. \<tau> \<sigma> j \<le> \<tau> \<sigma> i - n} \<noteq> {}"
+    by (auto simp: le_diff_conv2)
+next
+  fix j
+  assume "\<tau> \<sigma> j \<le> \<tau> \<sigma> i - n"
+  with assms(1,3) show "j < i"
+    by (metis add_leD2 add_strict_increasing le_add_diff_inverse less_\<tau>D)
+qed
+
+lemma i_ge_etpi: "ETP \<sigma> (\<tau> \<sigma> i) \<le> i"
+  using i_ETP_tau by auto
+
+(*<*)
+end
+(*>*)
diff --git a/thys/MFOTL_Checker/document/root.bib b/thys/MFOTL_Checker/document/root.bib
new file mode 100644
--- /dev/null
+++ b/thys/MFOTL_Checker/document/root.bib
@@ -0,0 +1,34 @@
+@inproceedings{DBLP:conf/tacas/LimaHRTY23,
+  author       = {Leonardo Lima and
+                  Andrei Herasimau and
+                  Martin Raszyk and
+                  Dmitriy Traytel and
+                  Simon Yuan},
+  editor       = {Sriram Sankaranarayanan and
+                  Natasha Sharygina},
+  title        = {Explainable Online Monitoring of Metric Temporal Logic},
+  booktitle    = {{TACAS} 2023},
+  series       = {LNCS},
+  volume       = {13994},
+  pages        = {473--491},
+  publisher    = {Springer},
+  year         = {2023},
+  doi          = {10.1007/978-3-031-30820-8_28}
+}
+
+@inproceedings{DBLP:conf/tacas/LimaHT24,
+  author       = {Leonardo Lima and
+                  Jonathan Juli{\'a}n Huerta y Munive and
+                  Dmitriy Traytel},
+  editor       = {Bernd Finkbeiner and
+                  Laura Kov{\'a}cs},
+  title        = {Explainable Online Monitoring of Metric First-Order Temporal Logic},
+  booktitle    = {{TACAS} 2024},
+  series       = {LNCS},
+  volume       = {14570},
+  pages        = {288--307},
+  publisher    = {Springer},
+  year         = {2024},
+  doi          = {10.1007/978-3-031-57246-3_16}
+}
+
diff --git a/thys/MFOTL_Checker/document/root.tex b/thys/MFOTL_Checker/document/root.tex
new file mode 100644
--- /dev/null
+++ b/thys/MFOTL_Checker/document/root.tex
@@ -0,0 +1,44 @@
+\documentclass[10pt,a4paper]{article}
+\usepackage[T1]{fontenc}
+\usepackage{isabelle,isabellesym}
+\usepackage{a4wide}
+\usepackage[english]{babel}
+\usepackage{eufrak}
+\usepackage{amssymb}
+
+% this should be the last package used
+\usepackage{pdfsetup}
+
+% urls in roman style, theory text in math-similar italics
+\urlstyle{rm}
+\isabellestyle{literal}
+
+
+\begin{document}
+
+\title{A Verified Proof Checker for Metric First-Order Temporal Logic}
+\author{Andrei Herasimau \and Jonathan Jul\'{i}an Huerta y Munive \and Leonardo Lima \and Martin Raszyk \and Dmitriy Traytel}
+
+\maketitle
+
+\begin{abstract}
+Metric first-order temporal logic (MFOTL) is an expressive formalism for specifying temporal and data-dependent constraints on streams of time-stamped, data-carrying events. Recently, we have developed a monitoring algorithm that not only outputs the satisfaction or violation of MFOTL formulas but also explains its verdicts in the form of proof trees~\cite{DBLP:conf/tacas/LimaHRTY23,DBLP:conf/tacas/LimaHT24}. These explanations serve as certificates, and in this entry we verify the correctness of a certificate checker. The checker is used to certify the output of our new, unverified monitoring tool WhyMon. The formalization contains another unverified, executable implementation of an explanation-producing monitoring algorithm used to exemplify our checker.
+\end{abstract}
+
+\tableofcontents
+
+% sane default for proof documents
+\parindent 0pt\parskip 0.5ex
+
+% generated text of all theories
+\input{session}
+
+\bibliographystyle{abbrv}
+\bibliography{root}
+
+\end{document}
+
+%%% Local Variables:
+%%% mode: latex
+%%% TeX-master: t
+%%% End:
diff --git a/thys/ROOTS b/thys/ROOTS
--- a/thys/ROOTS
+++ b/thys/ROOTS
@@ -1,813 +1,814 @@
 ABY3_Protocols
 ADS_Functor
 AI_Planning_Languages_Semantics
 AODV
 AOT
 AVL-Trees
 AWN
 Abortable_Linearizable_Modules
 Abs_Int_ITP2012
 Abstract-Hoare-Logics
 Abstract-Rewriting
 Abstract_Completeness
 Abstract_Soundness
 Ackermanns_not_PR
 Actuarial_Mathematics
 Adaptive_State_Counting
 Affine_Arithmetic
 Aggregation_Algebras
 Akra_Bazzi
 Algebraic_Numbers
 Algebraic_VCs
 Allen_Calculus
 Amicable_Numbers
 Amortized_Complexity
 AnselmGod
 Applicative_Lifting
 Approximate_Model_Counting
 Approximation_Algorithms
 Architectural_Design_Patterns
 Aristotles_Assertoric_Syllogistic
 Arith_Prog_Rel_Primes
 ArrowImpossibilityGS
 Attack_Trees
 Auto2_HOL
 Auto2_Imperative_HOL
 AutoFocus-Stream
 Automated_Stateful_Protocol_Verification
 Automatic_Refinement
 AxiomaticCategoryTheory
 BDD
 BD_Security_Compositional
 BNF_CC
 BNF_Operations
 BTree
 Balog_Szemeredi_Gowers
 Banach_Steinhaus
 Belief_Revision
 Bell_Numbers_Spivey
 BenOr_Kozen_Reif
 Berlekamp_Zassenhaus
 Bernoulli
 Bertrands_Postulate
 Bicategory
 BinarySearchTree
 Binary_Code_Imprimitive
 Binding_Syntax_Theory
 Binomial-Heaps
 Binomial-Queues
 BirdKMP
 Birkhoff_Finite_Distributive_Lattices
 Blue_Eyes
 Bondy
 Boolean_Expression_Checkers
 Boolos_Curious_Inference
 Boolos_Curious_Inference_Automated
 Bounded_Deducibility_Security
 Broadcast_Psi
 Buchi_Complementation
 Budan_Fourier
 Buffons_Needle
 Buildings
 BytecodeLogicJmlTypes
 C2KA_DistributedSystems
 CAVA_Automata
 CAVA_LTL_Modelchecker
 CCS
 CHERI-C_Memory_Model
 CISC-Kernel
 Concentration_Inequalities
 CRDT
 CRYSTALS-Kyber
 CRYSTALS-Kyber_Security
 CSP_RefTK
 CVP_Hardness
 CYK
 CZH_Elementary_Categories
 CZH_Foundations
 CZH_Universal_Constructions
 CakeML
 CakeML_Codegen
 Call_Arity
 Card_Equiv_Relations
 Card_Multisets
 Card_Number_Partitions
 Card_Partitions
 Cardinality_Continuum
 Cartan_FP
 Case_Labeling
 Catalan_Numbers
 Category
 Category2
 Category3
 Catoids
 Cauchy
 Cayley_Hamilton
 Certification_Monads
 Ceva
 Chandy_Lamport
 Chebyshev_Polynomials
 Chord_Segments
 Circus
 Clean
 Clique_and_Monotone_Circuits
 ClockSynchInst
 Closest_Pair_Points
 CoCon
 CoSMeDis
 CoSMed
 CofGroups
 Coinductive
 Coinductive_Languages
 Collections
 Combinable_Wands
 Combinatorial_Enumeration_Algorithms
 Combinatorics_Words
 Combinatorics_Words_Graph_Lemma
 Combinatorics_Words_Lyndon
 CommCSL
 Commuting_Hermitian
 Comparison_Sort_Lower_Bound
 Compiling-Exceptions-Correctly
 Complete_Non_Orders
 Completeness
 Complex_Bounded_Operators
 Complex_Geometry
 Complx
 ComponentDependencies
 ConcurrentGC
 ConcurrentHOL
 ConcurrentIMP
 Concurrent_Ref_Alg
 Concurrent_Revisions
 Conditional_Simplification
 Conditional_Transfer_Rule
 CondNormReasHOL
 Consensus_Refined
 Constructive_Cryptography
 Constructive_Cryptography_CM
 Constructor_Funs
 Containers
 Continued_Fractions
 Cook_Levin
 CoreC++
 Core_DOM
 Core_SC_DOM
 Correctness_Algebras
 Cotangent_PFD_Formula
 Count_Complex_Roots
 Coupledsim_Contrasim
 CryptHOL
 CryptoBasedCompositionalProperties
 Crypto_Standards
 CubicalCategories
 Cubic_Quartic_Equations
 DCR-ExecutionEquivalence
 DFS_Framework
 DOM_Components
 DPRM_Theorem
 DPT-SAT-Solver
 DataRefinementIBP
 Datatype_Order_Generator
 Decl_Sem_Fun_PL
 Decreasing-Diagrams
 Decreasing-Diagrams-II
 Dedekind_Real
 Deep_Learning
 Delta_System_Lemma
 Density_Compiler
 Dependent_SIFUM_Refinement
 Dependent_SIFUM_Type_Systems
 Depth-First-Search
 Derangements
 Deriving
 Descartes_Sign_Rule
 Design_Theory
 Dict_Construction
 Differential_Dynamic_Logic
 Differential_Game_Logic
 DigitsInBase
 Digit_Expansions
 Dijkstra_Shortest_Path
 Diophantine_Eqns_Lin_Hom
 Directed_Sets
 Dirichlet_L
 Dirichlet_Series
 DiscretePricing
 Discrete_Summation
 Disintegration
 DiskPaxos
 Distributed_Distinct_Elements
 Dominance_CHK
 Doob_Convergence
 DynamicArchitectures
 Dynamic_Tables
 E_Transcendental
 Earley_Parser
 Echelon_Form
 EdmondsKarp_Maxflow
 Edwards_Elliptic_Curves_Group
 Efficient-Mergesort
 Efficient_Weighted_Path_Order
 Elimination_Of_Repeated_Factors
 Elliptic_Curves_Group_Law
 Encodability_Process_Calculi
 Epistemic_Logic
 Equivalence_Relation_Enumeration
 Ergodic_Theory
 Error_Function
 Euler_MacLaurin
 Euler_Partition
 Euler_Polyhedron_Formula
 Eudoxus_Reals
 Eval_FO
 Example-Submission
 Executable_Randomized_Algorithms
 Expander_Graphs
 Extended_Finite_State_Machine_Inference
 Extended_Finite_State_Machines
 FFT
 FLP
 FOL-Fitting
 FOL_Axiomatic
 FOL_Harrison
 FOL_Seq_Calc1
 FOL_Seq_Calc2
 FOL_Seq_Calc3
 FO_Theory_Rewriting
 FSM_Tests
 Factor_Algebraic_Polynomial
 Factored_Transition_System_Bounding
 Falling_Factorial_Sum
 Farkas
 FeatherweightJava
 Featherweight_OCL
 Fermat3_4
 FileRefinement
 FinFun
 Finger-Trees
 Finite-Map-Extras
 Finite_Automata_HF
 Finite_Fields
 Finitely_Generated_Abelian_Groups
 First_Order_Terms
 First_Welfare_Theorem
 Fishburn_Impossibility
 Fisher_Yates
 Fishers_Inequality
 Fixed_Length_Vector
 Flow_Networks
 Floyd_Warshall
 Flyspeck-Tame
 FocusStreamsCaseStudies
 Forcing
 Formal_Puiseux_Series
 Formal_SSA
 Formula_Derivatives
 Foundation_of_geometry
 Fourier
 Free-Boolean-Algebra
 Free-Groups
 Frequency_Moments
 Fresh_Identifiers
 FunWithFunctions
 FunWithTilings
 Functional-Automata
 Functional_Ordered_Resolution_Prover
 Furstenberg_Topology
 GPU_Kernel_PL
 Gabow_SCC
 GaleStewart_Games
 Gale_Shapley
 Game_Based_Crypto
 Gauss-Jordan-Elim-Fun
 Gauss_Jordan
 Gauss_Sums
 Gaussian_Integers
 GenClock
 General-Triangle
 Generalized_Counting_Sort
 Generic_Deriving
 Generic_Join
 GewirthPGCProof
 Girth_Chromatic
 Given_Clause_Loops
 Go
 GoedelGod
 Goedel_HFSet_Semantic
 Goedel_HFSet_Semanticless
 Goedel_Incompleteness
 Goodstein_Lambda
 GraphMarkingIBP
 Graph_Saturation
 Graph_Theory
 Gray_Codes
 Green
 Groebner_Bases
 Groebner_Macaulay
 Gromov_Hyperbolicity
 Grothendieck_Schemes
 Group-Ring-Module
 HOL-CSP
 HOL-CSPM
 HOL-CSP_OpSem
 HOLCF-Prelude
 HRB-Slicing
 Hahn_Jordan_Decomposition
 Hales_Jewett
 Heard_Of
 Hello_World
 HereditarilyFinite
 Hermite
 Hermite_Lindemann
 Hidden_Markov_Models
 Higher_Order_Terms
 HoareForDivergence
 Hoare_Time
 Hood_Melville_Queue
 HotelKeyCards
 Huffman
 Hybrid_Logic
 Hybrid_Multi_Lane_Spatial_Logic
 Hybrid_Systems_VCs
 HyperCTL
 HyperHoareLogic
 Hyperdual
 Hypergraph_Basics
 Hypergraph_Colourings
 IEEE_Floating_Point
 IFC_Tracking
 IMAP-CRDT
 IMO2019
 IMP2
 IMP2_Binary_Heap
 IMP_Compiler
 IMP_Compiler_Reuse
 Interval_Analysis
 IO_Language_Conformance
 IP_Addresses
 Imperative_Insertion_Sort
 Implicational_Logic
 Impossible_Geometry
 IMP_Noninterference
 Incompleteness
 Incredible_Proof_Machine
 Independence_CH
 Inductive_Confidentiality
 Inductive_Inference
 InfPathElimination
 InformationFlowSlicing
 InformationFlowSlicing_Inter
 Integration
 Interpolation_Polynomials_HOL_Algebra
 Interpreter_Optimizations
 Interval_Arithmetic_Word32
 Intro_Dest_Elim
 Involutions2Squares
 Iptables_Semantics
 Irrational_Series_Erdos_Straus
 Irrationality_J_Hancl
 Irrationals_From_THEBOOK
 IsaGeoCoq
 IsaNet
 Isabelle_C
 Isabelle_hoops
 Isabelle_Marries_Dirac
 Isabelle_Meta_Model
 Jacobson_Basic_Algebra
 Jinja
 JinjaDCI
 JinjaThreads
 JiveDataStoreModel
 Jordan_Hoelder
 Jordan_Normal_Form
 KAD
 Karatsuba
 KAT_and_DRA
 KBPs
 KD_Tree
 Key_Agreement_Strong_Adversaries
 Khovanskii_Theorem
 Kleene_Algebra
 Kneser_Cauchy_Davenport
 Knights_Tour
 Knot_Theory
 Knuth_Bendix_Order
 Knuth_Morris_Pratt
 KnuthMorrisPratt
 Koenigsberg_Friendship
 Kruskal
 Kummer_Congruence
 Kuratowski_Closure_Complement
 LLL_Basis_Reduction
 LLL_Factorization
 LOFT
 LP_Duality
 LTL
 LTL_Master_Theorem
 LTL_Normal_Form
 LTL_to_DRA
 LTL_to_GBA
 Lam-ml-Normalization
 LambdaAuth
 LambdaMu
 Lambda_Free_EPO
 Lambda_Free_KBOs
 Lambda_Free_RPOs
 Lambert_Series
 Lambert_W
 Landau_Symbols
 Laplace_Transform
 Latin_Square
 LatticeProperties
 Launchbury
 Laws_of_Large_Numbers
 Lazy-Lists-II
 Lazy_Case
 Lehmer
 Lifting_Definition_Option
 Lifting_the_Exponent
 LightweightJava
 LinearQuantifierElim
 Linear_Inequalities
 Linear_Programming
 Linear_Recurrences
 Liouville_Numbers
 List-Index
 List-Infinite
 List_Interleaving
 List_Inversions
 List_Update
 LocalLexing
 Localization_Ring
 Locally-Nameless-Sigma
 Logging_Independent_Anonymity
 Lovasz_Local
 Lowe_Ontological_Argument
 Lower_Semicontinuous
 Lp
 Lucas_Theorem
 MDP-Algorithms
 MDP-Rewards
 MFMC_Countable
 MFODL_Monitor_Optimized
+MFOTL_Checker
 MFOTL_Monitor
 MSO_Regex_Equivalence
 Markov_Models
 Marriage
 Martingales
 Mason_Stothers
 Matrices_for_ODEs
 Matrix
 Matrix_Tensor
 Matroids
 Max-Card-Matching
 Maximum_Segment_Sum
 Median_Method
 Median_Of_Medians_Selection
 Menger
 Mereology
 Mersenne_Primes
 Metalogic_ProofChecker
 MHComputation
 MiniML
 MiniSail
 Minimal_SSA
 Minkowskis_Theorem
 Minsky_Machines
 MLSS_Decision_Proc
 ML_Unification
 Modal_Logics_for_NTS
 Modular_Assembly_Kit_Security
 Modular_arithmetic_LLL_and_HNF_algorithms
 Monad_Memo_DP
 Monad_Normalisation
 MonoBoolTranAlgebra
 MonoidalCategory
 Monomorphic_Monad
 MuchAdoAboutTwo
 Multi_Party_Computation
 Multirelations
 Multirelations_Heterogeneous
 Multiset_Ordering_NPC
 Multitape_To_Singletape_TM
 Myhill-Nerode
 Name_Carrying_Type_Inference
 Nano_JSON
 Nash_Williams
 Nat-Interval-Logic
 Native_Word
 Nested_Multisets_Ordinals
 Network_Security_Policy_Verification
 Neumann_Morgenstern_Utility
 No_FTL_observers
 No_FTL_observers_Gen_Rel
 Nominal2
 Nominal_Myhill_Nerode
 Noninterference_CSP
 Noninterference_Concurrent_Composition
 Noninterference_Generic_Unwinding
 Noninterference_Inductive_Unwinding
 Noninterference_Ipurge_Unwinding
 Noninterference_Sequential_Composition
 NormByEval
 Nullstellensatz
 Number_Theoretic_Transform
 Octonions
 OmegaCatoidsQuantales
 OpSets
 Open_Induction
 Optics
 Optimal_BST
 Orbit_Stabiliser
 Order_Lattice_Props
 Ordered_Resolution_Prover
 Ordinal
 Ordinal_Partitions
 Ordinals_and_Cardinals
 Ordinary_Differential_Equations
 PAC_Checker
 PAL
 PAPP_Impossibility
 PCF
 PLM
 POPLmark-deBruijn
 PSemigroupsConvolution
 Package_logic
 Padic_Field
 Padic_Ints
 Pairing_Heap
 Paraconsistency
 Parity_Game
 Partial_Function_MR
 Partial_Order_Reduction
 Password_Authentication_Protocol
 Pell
 Perfect_Fields
 Perfect-Number-Thm
 Perron_Frobenius
 Physical_Quantities
 Pi_Calculus
 Pi_Transcendental
 Planarity_Certificates
 Pluennecke_Ruzsa_Inequality
 Poincare_Bendixson
 Poincare_Disc
 Polygonal_Number_Theorem
 Polylog
 Polynomial_Crit_Geometry
 Polynomial_Factorization
 Polynomial_Interpolation
 Polynomials
 Pop_Refinement
 Posix-Lexing
 Possibilistic_Noninterference
 Power_Sum_Polynomials
 Pratt_Certificate
 Prefix_Free_Code_Combinators
 Presburger-Automata
 Prim_Dijkstra_Simple
 Prime_Distribution_Elementary
 Prime_Harmonic_Series
 Prime_Number_Theorem
 Priority_Queue_Braun
 Priority_Search_Trees
 Probabilistic_Noninterference
 Probabilistic_Prime_Tests
 Probabilistic_System_Zoo
 Probabilistic_Timed_Automata
 Probabilistic_While
 Probability_Inequality_Completeness
 Program-Conflict-Analysis
 Progress_Tracking
 Projective_Geometry
 Projective_Measurements
 Promela
 Proof_Strategy_Language
 PropResPI
 Propositional_Logic_Class
 Propositional_Proof_Systems
 Prpu_Maxflow
 PseudoHoops
 Psi_Calculi
 Ptolemys_Theorem
 Public_Announcement_Logic
 Q0_Metatheory
 Q0_Soundness
 QBF_Solver_Verification
 QHLProver
 QR_Decomposition
 Quantales
 Quantales_Converse
 Quantifier_Elimination_Hybrid
 Quasi_Borel_Spaces
 Quaternions
 Query_Optimization
 Quick_Sort_Cost
 RIPEMD-160-SPARK
 ROBDD
 RSAPSS
 Ramsey-Infinite
 Random_BSTs
 Random_Graph_Subgraph_Threshold
 Randomised_BSTs
 Randomised_Social_Choice
 Rank_Nullity_Theorem
 Real_Impl
 Real_Power
 Real_Time_Deque
 Recursion-Addition
 Recursion-Theory-I
 Refine_Imperative_HOL
 Refine_Monadic
 RefinementReactive
 Regex_Equivalence
 Region_Quadtrees
 Registers
 Regression_Test_Selection
 Regular-Sets
 Regular_Algebras
 Regular_Tree_Relations
 Relation_Algebra
 Relational-Incorrectness-Logic
 Relational_Cardinality
 Relational_Disjoint_Set_Forests
 Relational_Forests
 Relational_Method
 Relational_Minimum_Spanning_Trees
 Relational_Paths
 Rensets
 Rep_Fin_Groups
 ResiduatedTransitionSystem
 Residuated_Lattices
 Resolution_FOL
 Rewrite_Properties_Reduction
 Rewriting_Z
 Ribbon_Proofs
 Risk_Free_Lending
 Robbins-Conjecture
 Robinson_Arithmetic
 Root_Balanced_Tree
 Roth_Arithmetic_Progressions
 Routing
 Roy_Floyd_Warshall
 SATSolverVerification
 SCC_Bloemen_Sequential
 SC_DOM_Components
 SDS_Impossibility
 SIFPL
 SIFUM_Type_Systems
 SPARCv8
 S_Finite_Measure_Monad
 Safe_Distance
 Safe_OCL
 Safe_Range_RC
 Saturation_Framework
 Saturation_Framework_Extensions
 Sauer_Shelah_Lemma
 Schutz_Spacetime
 Schwartz_Zippel
 Secondary_Sylow
 Security_Protocol_Refinement
 Selection_Heap_Sort
 SenSocialChoice
 Separata
 Separation_Algebra
 Separation_Logic_Imperative_HOL
 Separation_Logic_Unbounded
 SequentInvertibility
 Shadow_DOM
 Shadow_SC_DOM
 Shivers-CFA
 ShortestPath
 Show
 Sigma_Commit_Crypto
 Signature_Groebner
 Simpl
 Simple_Clause_Learning
 Simple_Firewall
 Simplex
 Simplicial_complexes_and_boolean_functions
 SimplifiedOntologicalArgument
 Skew_Heap
 Skip_Lists
 Slicing
 Sliding_Window_Algorithm
 Smith_Normal_Form
 Smooth_Manifolds
 Solidity
 Sophomores_Dream
 Sort_Encodings
 Source_Coding_Theorem
 SpecCheck
 Special_Function_Bounds
 Splay_Tree
 Sqrt_Babylonian
 Stable_Matching
 Stalnaker_Logic
 Standard_Borel_Spaces
 Statecharts
 Stateful_Protocol_Composition_and_Typing
 Stellar_Quorums
 Stern_Brocot
 Stewart_Apollonius
 Stirling_Formula
 Stochastic_Matrices
 Stone_Algebras
 Stone_Kleene_Relation_Algebras
 Stone_Relation_Algebras
 Store_Buffer_Reduction
 Stream-Fusion
 Stream_Fusion_Code
 StrictOmegaCategories
 Strong_Security
 Sturm_Sequences
 Sturm_Tarski
 Stuttering_Equivalence
 Subresultants
 Subset_Boolean_Algebras
 Sumcheck_Protocol
 SumSquares
 Sunflowers
 SuperCalc
 Suppes_Theorem
 Surprise_Paradox
 Symmetric_Polynomials
 Syntax_Independent_Logic
 Synthetic_Completeness
 Szemeredi_Regularity
 Szpilrajn
 TESL_Language
 TLA
 Tail_Recursive_Functions
 Tarskis_Geometry
 Taylor_Models
 Three_Circles
 Three_Squares
 Timed_Automata
 Topological_Semantics
 Topology
 TortoiseHare
 TsirelsonBound
 Transcendence_Series_Hancl_Rucki
 Transformer_Semantics
 Transition_Systems_and_Automata
 Transitive-Closure
 Transitive-Closure-II
 Transitive_Models
 Transport
 Treaps
 Tree-Automata
 Tree_Decomposition
 Tree_Enumeration
 Triangle
 Trie
 Turans_Graph_Theorem
 Twelvefold_Way
 Two_Generated_Word_Monoids_Intersection
 Tycon
 Types_Tableaus_and_Goedels_God
 Types_To_Sets_Extension
 UPF
 UPF_Firewall
 UTP
 Uncertainty_Principle
 Undirected_Graph_Theory
 Universal_Hash_Families
 Universal_Turing_Machine
 UpDown_Scheme
 VYDRA_MDL
 Valuation
 Van_Emde_Boas_Trees
 Van_der_Waerden
 VectorSpace
 VeriComp
 Verified-Prover
 Verified_SAT_Based_AI_Planning
 VerifyThis2018
 VerifyThis2019
 Vickrey_Clarke_Groves
 Virtual_Substitution
 VolpanoSmith
 WHATandWHERE_Security
 WOOT_Strong_Eventual_Consistency
 WebAssembly
 Weight_Balanced_Trees
 Weighted_Arithmetic_Geometric_Mean
 Weighted_Path_Order
 Well_Quasi_Orders
 Wetzels_Problem
 Wieferich_Kempner
 Winding_Number_Eval
 Word_Lib
 WorkerWrapper
 X86_Semantics
 XML
 Youngs_Inequality
 ZFC_in_HOL
 Zeckendorf
 Zeta_3_Irrational
 Zeta_Function
 pGCL
 Labeled_Transition_Systems
 Pushdown_Systems