[STATEMENT]
theorem step1_a [simp]:
  "DataRefinement ({.Loop'.} o Q3'_a) R2'_a R2'_a Q3''_a"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. DataRefinement ({. Loop' .} \<circ> Q3'_a) R2'_a R2'_a Q3''_a
[PROOF STEP]
apply (simp add: data_refinement_hoare hoare_demonic Q3''_a_def Init'_def Init''_def
       Loop'_def R1'_a_def Q3'_a_def tail_def head_def angelic_def subset_eq)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. DataRefinement ({. {(stk, mrk). distinct stk} .} \<circ> [: \<lambda>(stk, mrk). {ab. stk \<noteq> [] \<and> (case ab of (stk', mrk') \<Rightarrow> \<exists>y. (hd stk, y) \<in> next \<and> y \<notin> mrk \<and> stk' = y # stk \<and> mrk' = insert y mrk)} :]) R2'_a R2'_a [: \<lambda>(p, t, lnk, lbl, mrk). {ab. p \<noteq> nil \<and> (case ab of (p', t', lnk', lbl', mrk') \<Rightarrow> \<exists>i. g mrk lbl (lnk i) p \<and> p' = lnk i p \<and> t' = p \<and> lnk' = lnk(i := (lnk i)(p := t)) \<and> lbl' = lbl(p := i) \<and> mrk' = insert (lnk i p) mrk)} :]
[PROOF STEP]
apply (unfold next_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. DataRefinement ({. {(stk, mrk). distinct stk} .} \<circ> [: \<lambda>(stk, mrk). {ab. stk \<noteq> [] \<and> (case ab of (stk', mrk') \<Rightarrow> \<exists>y. (hd stk, y) \<in> {(a, b). (\<exists>i. link0 i a = b) \<and> a \<noteq> nil \<and> b \<noteq> nil \<and> label0 a = none} \<and> y \<notin> mrk \<and> stk' = y # stk \<and> mrk' = insert y mrk)} :]) R2'_a R2'_a [: \<lambda>(p, t, lnk, lbl, mrk). {ab. p \<noteq> nil \<and> (case ab of (p', t', lnk', lbl', mrk') \<Rightarrow> \<exists>i. g mrk lbl (lnk i) p \<and> p' = lnk i p \<and> t' = p \<and> lnk' = lnk(i := (lnk i)(p := t)) \<and> lbl' = lbl(p := i) \<and> mrk' = insert (lnk i p) mrk)} :]
[PROOF STEP]
apply (simp add: R2'_a_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. DataRefinement ({. {(stk, mrk). distinct stk} .} \<circ> [: \<lambda>(stk, mrk). {ab. stk \<noteq> [] \<and> (case ab of (stk', mrk') \<Rightarrow> \<exists>y. (\<exists>i. link0 i (hd stk) = y) \<and> hd stk \<noteq> nil \<and> y \<noteq> nil \<and> label0 (hd stk) = none \<and> y \<notin> mrk \<and> stk' = y # stk \<and> mrk' = insert y mrk)} :]) {: \<lambda>(p, t, lnk, lbl, mrk). {(stk, mrk'). p = head stk \<and> t = head (tail stk) \<and> stack lnk lbl t (tail stk) \<and> link0 = link_0 lnk lbl p (tail stk) \<and> label0 = label_0 lbl (tail stk) \<and> nil \<notin> set stk \<and> mrk' = mrk} :} {: \<lambda>(p, t, lnk, lbl, mrk). {(stk, mrk'). p = head stk \<and> t = head (tail stk) \<and> stack lnk lbl t (tail stk) \<and> link0 = link_0 lnk lbl p (tail stk) \<and> label0 = label_0 lbl (tail stk) \<and> nil \<notin> set stk \<and> mrk' = mrk} :} [: \<lambda>(p, t, lnk, lbl, mrk). {ab. p \<noteq> nil \<and> (case ab of (p', t', lnk', lbl', mrk') \<Rightarrow> \<exists>i. g mrk lbl (lnk i) p \<and> p' = lnk i p \<and> t' = p \<and> lnk' = lnk(i := (lnk i)(p := t)) \<and> lbl' = lbl(p := i) \<and> mrk' = insert (lnk i p) mrk)} :]
[PROOF STEP]
apply (simp add: data_refinement_hoare)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>a b. \<Turnstile> {s'. (a, b) \<in> (case s' of (p, t, lnk, lbl, mrk) \<Rightarrow> {(stk, mrk'). p = head stk \<and> t = head (tail stk) \<and> stack lnk lbl t (tail stk) \<and> link0 = link_0 lnk lbl p (tail stk) \<and> label0 = label_0 lbl (tail stk) \<and> nil \<notin> set stk \<and> mrk' = mrk}) \<and> distinct a}{| [: \<lambda>(p, t, lnk, lbl, mrk). {ab. p \<noteq> nil \<and> (case ab of (p', t', lnk', lbl', mrk') \<Rightarrow> \<exists>i. g mrk lbl (lnk i) p \<and> p' = lnk i p \<and> t' = p \<and> lnk' = lnk(i := (lnk i)(p := t)) \<and> lbl' = lbl(p := i) \<and> mrk' = insert (lnk i p) mrk)} :] |}{: \<lambda>(p, t, lnk, lbl, mrk). {(stk, mrk'). p = head stk \<and> t = head (tail stk) \<and> stack lnk lbl t (tail stk) \<and> link0 = link_0 lnk lbl p (tail stk) \<and> label0 = label_0 lbl (tail stk) \<and> nil \<notin> set stk \<and> mrk' = mrk} :} {ab. a \<noteq> [] \<and> (case ab of (stk', mrk') \<Rightarrow> \<exists>y. (\<exists>i. link0 i (hd a) = y) \<and> hd a \<noteq> nil \<and> y \<noteq> nil \<and> label0 (hd a) = none \<and> y \<notin> b \<and> stk' = y # a \<and> mrk' = insert y b)}
[PROOF STEP]
apply (simp_all add: R2'_a_def angelic_def hoare_demonic simp_eq_emptyset)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>a b aa ab. stack aa ab (head (tail a)) (tail a) \<and> link0 = link_0 aa ab (head a) (tail a) \<and> label0 = label_0 ab (tail a) \<and> nil \<notin> set a \<and> distinct a \<longrightarrow> {aba. head a = hd a \<and> tail a = tl a \<and> hd a \<noteq> nil \<and> a \<noteq> [] \<and> (case aba of (p', t', lnk', lbl', mrk') \<Rightarrow> \<exists>i. g b ab (aa i) (head a) \<and> p' = aa i (head a) \<and> t' = head a \<and> lnk' = aa(i := (aa i)(head a := head (tail a))) \<and> lbl' = ab(head a := i) \<and> mrk' = insert (aa i (head a)) b)} \<subseteq> {s. \<exists>ac ba. (ac, ba) \<in> (case s of (p, t, lnk, lbl, mrk) \<Rightarrow> {(stk, mrk'). p = head stk \<and> t = head (tail stk) \<and> stack lnk lbl t (tail stk) \<and> link_0 aa ab (head a) (tail a) = link_0 lnk lbl p (tail stk) \<and> label_0 ab (tail a) = label_0 lbl (tail stk) \<and> nil \<notin> set stk \<and> mrk' = mrk}) \<and> a \<noteq> [] \<and> (\<exists>y. ac = y # a \<and> label_0 ab (tail a) (hd a) = none \<and> (\<exists>i. link_0 aa ab (head a) (tail a) i (hd a) = y) \<and> hd a \<noteq> nil \<and> y \<noteq> nil \<and> y \<notin> b \<and> ba = insert y b)}
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a b aa ab i. \<lbrakk>stack aa ab (head (tl a)) (tl a); head a = hd a; link0 = link_0 aa ab (hd a) (tl a); tail a = tl a; label0 = label_0 ab (tl a); hd a \<noteq> nil; nil \<notin> set a; distinct a; a \<noteq> []; g b ab (aa i) (hd a)\<rbrakk> \<Longrightarrow> \<exists>ac. aa i (hd a) = head ac \<and> hd a = head (tail ac) \<and> stack (aa(i := (aa i)(hd a := head (tl a)))) (ab(hd a := i)) (hd a) (tail ac) \<and> link_0 aa ab (hd a) (tl a) = link_0 (aa(i := (aa i)(hd a := head (tl a)))) (ab(hd a := i)) (aa i (hd a)) (tail ac) \<and> label_0 ab (tl a) = label_0 (ab(hd a := i)) (tail ac) \<and> nil \<notin> set ac \<and> (\<exists>y. ac = y # a \<and> label_0 ab (tl a) (hd a) = none \<and> (\<exists>i. link_0 aa ab (hd a) (tl a) i (hd a) = y) \<and> y \<noteq> nil \<and> y \<notin> b \<and> insert (aa i (hd a)) b = insert y b)
[PROOF STEP]
apply (rule_tac x = "aa i (hd a) # a" in exI)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a b aa ab i. \<lbrakk>stack aa ab (head (tl a)) (tl a); head a = hd a; link0 = link_0 aa ab (hd a) (tl a); tail a = tl a; label0 = label_0 ab (tl a); hd a \<noteq> nil; nil \<notin> set a; distinct a; a \<noteq> []; g b ab (aa i) (hd a)\<rbrakk> \<Longrightarrow> aa i (hd a) = head (aa i (hd a) # a) \<and> hd a = head (tail (aa i (hd a) # a)) \<and> stack (aa(i := (aa i)(hd a := head (tl a)))) (ab(hd a := i)) (hd a) (tail (aa i (hd a) # a)) \<and> link_0 aa ab (hd a) (tl a) = link_0 (aa(i := (aa i)(hd a := head (tl a)))) (ab(hd a := i)) (aa i (hd a)) (tail (aa i (hd a) # a)) \<and> label_0 ab (tl a) = label_0 (ab(hd a := i)) (tail (aa i (hd a) # a)) \<and> nil \<notin> set (aa i (hd a) # a) \<and> (\<exists>y. aa i (hd a) # a = y # a \<and> label_0 ab (tl a) (hd a) = none \<and> (\<exists>i. link_0 aa ab (hd a) (tl a) i (hd a) = y) \<and> y \<noteq> nil \<and> y \<notin> b \<and> insert (aa i (hd a)) b = insert y b)
[PROOF STEP]
apply safe
[PROOF STATE]
proof (prove)
goal (7 subgoals):
 1. \<And>a b aa ab i. \<lbrakk>stack aa ab (head (tl a)) (tl a); head a = hd a; link0 = link_0 aa ab (hd a) (tl a); tail a = tl a; label0 = label_0 ab (tl a); hd a \<noteq> nil; nil \<notin> set a; distinct a; a \<noteq> []; g b ab (aa i) (hd a)\<rbrakk> \<Longrightarrow> aa i (hd a) = head (aa i (hd a) # a)
 2. \<And>a b aa ab i. \<lbrakk>stack aa ab (head (tl a)) (tl a); head a = hd a; link0 = link_0 aa ab (hd a) (tl a); tail a = tl a; label0 = label_0 ab (tl a); hd a \<noteq> nil; nil \<notin> set a; distinct a; a \<noteq> []; g b ab (aa i) (hd a)\<rbrakk> \<Longrightarrow> hd a = head (tail (aa i (hd a) # a))
 3. \<And>a b aa ab i. \<lbrakk>stack aa ab (head (tl a)) (tl a); head a = hd a; link0 = link_0 aa ab (hd a) (tl a); tail a = tl a; label0 = label_0 ab (tl a); hd a \<noteq> nil; nil \<notin> set a; distinct a; a \<noteq> []; g b ab (aa i) (hd a)\<rbrakk> \<Longrightarrow> stack (aa(i := (aa i)(hd a := head (tl a)))) (ab(hd a := i)) (hd a) (tail (aa i (hd a) # a))
 4. \<And>a b aa ab i. \<lbrakk>stack aa ab (head (tl a)) (tl a); head a = hd a; link0 = link_0 aa ab (hd a) (tl a); tail a = tl a; label0 = label_0 ab (tl a); hd a \<noteq> nil; nil \<notin> set a; distinct a; a \<noteq> []; g b ab (aa i) (hd a)\<rbrakk> \<Longrightarrow> link_0 aa ab (hd a) (tl a) = link_0 (aa(i := (aa i)(hd a := head (tl a)))) (ab(hd a := i)) (aa i (hd a)) (tail (aa i (hd a) # a))
 5. \<And>a b aa ab i. \<lbrakk>stack aa ab (head (tl a)) (tl a); head a = hd a; link0 = link_0 aa ab (hd a) (tl a); tail a = tl a; label0 = label_0 ab (tl a); hd a \<noteq> nil; nil \<notin> set a; distinct a; a \<noteq> []; g b ab (aa i) (hd a)\<rbrakk> \<Longrightarrow> label_0 ab (tl a) = label_0 (ab(hd a := i)) (tail (aa i (hd a) # a))
 6. \<And>a b aa ab i. \<lbrakk>stack aa ab (head (tl a)) (tl a); head a = hd a; link0 = link_0 aa ab (hd a) (tl a); tail a = tl a; label0 = label_0 ab (tl a); hd a \<noteq> nil; nil \<notin> set a; distinct a; a \<noteq> []; g b ab (aa i) (hd a); nil \<in> set (aa i (hd a) # a)\<rbrakk> \<Longrightarrow> False
 7. \<And>a b aa ab i. \<lbrakk>stack aa ab (head (tl a)) (tl a); head a = hd a; link0 = link_0 aa ab (hd a) (tl a); tail a = tl a; label0 = label_0 ab (tl a); hd a \<noteq> nil; nil \<notin> set a; distinct a; a \<noteq> []; g b ab (aa i) (hd a)\<rbrakk> \<Longrightarrow> \<exists>y. aa i (hd a) # a = y # a \<and> label_0 ab (tl a) (hd a) = none \<and> (\<exists>i. link_0 aa ab (hd a) (tl a) i (hd a) = y) \<and> y \<noteq> nil \<and> y \<notin> b \<and> insert (aa i (hd a)) b = insert y b
[PROOF STEP]
apply simp_all
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>a b aa ab i. \<lbrakk>stack aa ab (head (tl a)) (tl a); head a = hd a; link0 = link_0 aa ab (hd a) (tl a); tail a = tl a; label0 = label_0 ab (tl a); hd a \<noteq> nil; nil \<notin> set a; distinct a; a \<noteq> []; g b ab (aa i) (hd a)\<rbrakk> \<Longrightarrow> stack (aa(i := (aa i)(hd a := head (tl a)))) (ab(hd a := i)) (hd a) a
 2. \<And>a b aa ab i. \<lbrakk>stack aa ab (head (tl a)) (tl a); head a = hd a; link0 = link_0 aa ab (hd a) (tl a); tail a = tl a; label0 = label_0 ab (tl a); hd a \<noteq> nil; nil \<notin> set a; distinct a; a \<noteq> []; g b ab (aa i) (hd a)\<rbrakk> \<Longrightarrow> link_0 aa ab (hd a) (tl a) = link_0 (aa(i := (aa i)(hd a := head (tl a)))) (ab(hd a := i)) (aa i (hd a)) a
 3. \<And>a b aa ab i. \<lbrakk>stack aa ab (head (tl a)) (tl a); head a = hd a; link0 = link_0 aa ab (hd a) (tl a); tail a = tl a; label0 = label_0 ab (tl a); hd a \<noteq> nil; nil \<notin> set a; distinct a; a \<noteq> []; g b ab (aa i) (hd a)\<rbrakk> \<Longrightarrow> label_0 ab (tl a) = label_0 (ab(hd a := i)) a
 4. \<And>a b aa ab i. \<lbrakk>pointer.stack (aa i (hd a)) aa ab (graph.head (aa i (hd a)) (tl a)) (tl a); graph.head (aa i (hd a)) a = hd a; link0 = link_0 aa ab (hd a) (tl a); tail a = tl a; label0 = label_0 ab (tl a); hd a \<noteq> aa i (hd a); aa i (hd a) \<notin> set a; distinct a; a \<noteq> []; g b ab (aa i) (hd a); nil = aa i (hd a)\<rbrakk> \<Longrightarrow> False
 5. \<And>a b aa ab i. \<lbrakk>stack aa ab (head (tl a)) (tl a); head a = hd a; link0 = link_0 aa ab (hd a) (tl a); tail a = tl a; label0 = label_0 ab (tl a); hd a \<noteq> nil; nil \<notin> set a; distinct a; a \<noteq> []; g b ab (aa i) (hd a)\<rbrakk> \<Longrightarrow> label_0 ab (tl a) (hd a) = none \<and> (\<exists>ia. link_0 aa ab (hd a) (tl a) ia (hd a) = aa i (hd a)) \<and> aa i (hd a) \<noteq> nil \<and> aa i (hd a) \<notin> b
[PROOF STEP]
apply (simp add: g_def  neq_Nil_conv)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>a b aa ab i. \<lbrakk>stack aa ab (head (tl a)) (tl a); head a = hd a; link0 = link_0 aa ab (hd a) (tl a); tail a = tl a; label0 = label_0 ab (tl a); hd a \<noteq> nil; nil \<notin> set a; distinct a; \<exists>y ys. a = y # ys; aa i (hd a) \<noteq> nil \<and> aa i (hd a) \<notin> b \<and> ab (hd a) = none\<rbrakk> \<Longrightarrow> stack (aa(i := (aa i)(hd a := head (tl a)))) (ab(hd a := i)) (hd a) a
 2. \<And>a b aa ab i. \<lbrakk>stack aa ab (head (tl a)) (tl a); head a = hd a; link0 = link_0 aa ab (hd a) (tl a); tail a = tl a; label0 = label_0 ab (tl a); hd a \<noteq> nil; nil \<notin> set a; distinct a; a \<noteq> []; g b ab (aa i) (hd a)\<rbrakk> \<Longrightarrow> link_0 aa ab (hd a) (tl a) = link_0 (aa(i := (aa i)(hd a := head (tl a)))) (ab(hd a := i)) (aa i (hd a)) a
 3. \<And>a b aa ab i. \<lbrakk>stack aa ab (head (tl a)) (tl a); head a = hd a; link0 = link_0 aa ab (hd a) (tl a); tail a = tl a; label0 = label_0 ab (tl a); hd a \<noteq> nil; nil \<notin> set a; distinct a; a \<noteq> []; g b ab (aa i) (hd a)\<rbrakk> \<Longrightarrow> label_0 ab (tl a) = label_0 (ab(hd a := i)) a
 4. \<And>a b aa ab i. \<lbrakk>pointer.stack (aa i (hd a)) aa ab (graph.head (aa i (hd a)) (tl a)) (tl a); graph.head (aa i (hd a)) a = hd a; link0 = link_0 aa ab (hd a) (tl a); tail a = tl a; label0 = label_0 ab (tl a); hd a \<noteq> aa i (hd a); aa i (hd a) \<notin> set a; distinct a; a \<noteq> []; g b ab (aa i) (hd a); nil = aa i (hd a)\<rbrakk> \<Longrightarrow> False
 5. \<And>a b aa ab i. \<lbrakk>stack aa ab (head (tl a)) (tl a); head a = hd a; link0 = link_0 aa ab (hd a) (tl a); tail a = tl a; label0 = label_0 ab (tl a); hd a \<noteq> nil; nil \<notin> set a; distinct a; a \<noteq> []; g b ab (aa i) (hd a)\<rbrakk> \<Longrightarrow> label_0 ab (tl a) (hd a) = none \<and> (\<exists>ia. link_0 aa ab (hd a) (tl a) ia (hd a) = aa i (hd a)) \<and> aa i (hd a) \<noteq> nil \<and> aa i (hd a) \<notin> b
[PROOF STEP]
apply clarify
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>a b aa ab i y ys. \<lbrakk>stack aa ab (head (tl (y # ys))) (tl (y # ys)); head (y # ys) = hd (y # ys); link0 = link_0 aa ab (hd (y # ys)) (tl (y # ys)); tail (y # ys) = tl (y # ys); label0 = pointer.label_0 (ab (hd (y # ys))) ab (tl (y # ys)); hd (y # ys) \<noteq> nil; nil \<notin> set (y # ys); distinct (y # ys); aa i (hd (y # ys)) \<noteq> nil; aa i (hd (y # ys)) \<notin> b; none = ab (hd (y # ys))\<rbrakk> \<Longrightarrow> stack (aa(i := (aa i)(hd (y # ys) := head (tl (y # ys))))) (ab(hd (y # ys) := i)) (hd (y # ys)) (y # ys)
 2. \<And>a b aa ab i. \<lbrakk>stack aa ab (head (tl a)) (tl a); head a = hd a; link0 = link_0 aa ab (hd a) (tl a); tail a = tl a; label0 = label_0 ab (tl a); hd a \<noteq> nil; nil \<notin> set a; distinct a; a \<noteq> []; g b ab (aa i) (hd a)\<rbrakk> \<Longrightarrow> link_0 aa ab (hd a) (tl a) = link_0 (aa(i := (aa i)(hd a := head (tl a)))) (ab(hd a := i)) (aa i (hd a)) a
 3. \<And>a b aa ab i. \<lbrakk>stack aa ab (head (tl a)) (tl a); head a = hd a; link0 = link_0 aa ab (hd a) (tl a); tail a = tl a; label0 = label_0 ab (tl a); hd a \<noteq> nil; nil \<notin> set a; distinct a; a \<noteq> []; g b ab (aa i) (hd a)\<rbrakk> \<Longrightarrow> label_0 ab (tl a) = label_0 (ab(hd a := i)) a
 4. \<And>a b aa ab i. \<lbrakk>pointer.stack (aa i (hd a)) aa ab (graph.head (aa i (hd a)) (tl a)) (tl a); graph.head (aa i (hd a)) a = hd a; link0 = link_0 aa ab (hd a) (tl a); tail a = tl a; label0 = label_0 ab (tl a); hd a \<noteq> aa i (hd a); aa i (hd a) \<notin> set a; distinct a; a \<noteq> []; g b ab (aa i) (hd a); nil = aa i (hd a)\<rbrakk> \<Longrightarrow> False
 5. \<And>a b aa ab i. \<lbrakk>stack aa ab (head (tl a)) (tl a); head a = hd a; link0 = link_0 aa ab (hd a) (tl a); tail a = tl a; label0 = label_0 ab (tl a); hd a \<noteq> nil; nil \<notin> set a; distinct a; a \<noteq> []; g b ab (aa i) (hd a)\<rbrakk> \<Longrightarrow> label_0 ab (tl a) (hd a) = none \<and> (\<exists>ia. link_0 aa ab (hd a) (tl a) ia (hd a) = aa i (hd a)) \<and> aa i (hd a) \<noteq> nil \<and> aa i (hd a) \<notin> b
[PROOF STEP]
apply (simp add: g_def  neq_Nil_conv)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>a b aa ab i. \<lbrakk>stack aa ab (head (tl a)) (tl a); head a = hd a; link0 = link_0 aa ab (hd a) (tl a); tail a = tl a; label0 = label_0 ab (tl a); hd a \<noteq> nil; nil \<notin> set a; distinct a; a \<noteq> []; g b ab (aa i) (hd a)\<rbrakk> \<Longrightarrow> link_0 aa ab (hd a) (tl a) = link_0 (aa(i := (aa i)(hd a := head (tl a)))) (ab(hd a := i)) (aa i (hd a)) a
 2. \<And>a b aa ab i. \<lbrakk>stack aa ab (head (tl a)) (tl a); head a = hd a; link0 = link_0 aa ab (hd a) (tl a); tail a = tl a; label0 = label_0 ab (tl a); hd a \<noteq> nil; nil \<notin> set a; distinct a; a \<noteq> []; g b ab (aa i) (hd a)\<rbrakk> \<Longrightarrow> label_0 ab (tl a) = label_0 (ab(hd a := i)) a
 3. \<And>a b aa ab i. \<lbrakk>pointer.stack (aa i (hd a)) aa ab (graph.head (aa i (hd a)) (tl a)) (tl a); graph.head (aa i (hd a)) a = hd a; link0 = link_0 aa ab (hd a) (tl a); tail a = tl a; label0 = label_0 ab (tl a); hd a \<noteq> aa i (hd a); aa i (hd a) \<notin> set a; distinct a; a \<noteq> []; g b ab (aa i) (hd a); nil = aa i (hd a)\<rbrakk> \<Longrightarrow> False
 4. \<And>a b aa ab i. \<lbrakk>stack aa ab (head (tl a)) (tl a); head a = hd a; link0 = link_0 aa ab (hd a) (tl a); tail a = tl a; label0 = label_0 ab (tl a); hd a \<noteq> nil; nil \<notin> set a; distinct a; a \<noteq> []; g b ab (aa i) (hd a)\<rbrakk> \<Longrightarrow> label_0 ab (tl a) (hd a) = none \<and> (\<exists>ia. link_0 aa ab (hd a) (tl a) ia (hd a) = aa i (hd a)) \<and> aa i (hd a) \<noteq> nil \<and> aa i (hd a) \<notin> b
[PROOF STEP]
apply (case_tac a)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>a b aa ab i. \<lbrakk>stack aa ab (head (tl a)) (tl a); head a = hd a; link0 = link_0 aa ab (hd a) (tl a); tail a = tl a; label0 = label_0 ab (tl a); hd a \<noteq> nil; nil \<notin> set a; distinct a; a \<noteq> []; g b ab (aa i) (hd a); a = []\<rbrakk> \<Longrightarrow> link_0 aa ab (hd a) (tl a) = link_0 (aa(i := (aa i)(hd a := head (tl a)))) (ab(hd a := i)) (aa i (hd a)) a
 2. \<And>a b aa ab i ac list. \<lbrakk>stack aa ab (head (tl a)) (tl a); head a = hd a; link0 = link_0 aa ab (hd a) (tl a); tail a = tl a; label0 = label_0 ab (tl a); hd a \<noteq> nil; nil \<notin> set a; distinct a; a \<noteq> []; g b ab (aa i) (hd a); a = ac # list\<rbrakk> \<Longrightarrow> link_0 aa ab (hd a) (tl a) = link_0 (aa(i := (aa i)(hd a := head (tl a)))) (ab(hd a := i)) (aa i (hd a)) a
 3. \<And>a b aa ab i. \<lbrakk>stack aa ab (head (tl a)) (tl a); head a = hd a; link0 = link_0 aa ab (hd a) (tl a); tail a = tl a; label0 = label_0 ab (tl a); hd a \<noteq> nil; nil \<notin> set a; distinct a; a \<noteq> []; g b ab (aa i) (hd a)\<rbrakk> \<Longrightarrow> label_0 ab (tl a) = label_0 (ab(hd a := i)) a
 4. \<And>a b aa ab i. \<lbrakk>pointer.stack (aa i (hd a)) aa ab (graph.head (aa i (hd a)) (tl a)) (tl a); graph.head (aa i (hd a)) a = hd a; link0 = link_0 aa ab (hd a) (tl a); tail a = tl a; label0 = label_0 ab (tl a); hd a \<noteq> aa i (hd a); aa i (hd a) \<notin> set a; distinct a; a \<noteq> []; g b ab (aa i) (hd a); nil = aa i (hd a)\<rbrakk> \<Longrightarrow> False
 5. \<And>a b aa ab i. \<lbrakk>stack aa ab (head (tl a)) (tl a); head a = hd a; link0 = link_0 aa ab (hd a) (tl a); tail a = tl a; label0 = label_0 ab (tl a); hd a \<noteq> nil; nil \<notin> set a; distinct a; a \<noteq> []; g b ab (aa i) (hd a)\<rbrakk> \<Longrightarrow> label_0 ab (tl a) (hd a) = none \<and> (\<exists>ia. link_0 aa ab (hd a) (tl a) ia (hd a) = aa i (hd a)) \<and> aa i (hd a) \<noteq> nil \<and> aa i (hd a) \<notin> b
[PROOF STEP]
apply (simp_all add: g_def  neq_Nil_conv)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>a b aa ab i. \<lbrakk>stack aa ab (head (tl a)) (tl a); head a = hd a; link0 = link_0 aa ab (hd a) (tl a); tail a = tl a; label0 = label_0 ab (tl a); hd a \<noteq> nil; nil \<notin> set a; distinct a; \<exists>y ys. a = y # ys; aa i (hd a) \<noteq> nil \<and> aa i (hd a) \<notin> b \<and> ab (hd a) = none\<rbrakk> \<Longrightarrow> label_0 ab (tl a) = label_0 (ab(hd a := i)) a
 2. \<And>a b aa ab i. \<lbrakk>stack aa ab (head (tl a)) (tl a); head a = hd a; link0 = link_0 aa ab (hd a) (tl a); tail a = tl a; label0 = label_0 ab (tl a); hd a \<noteq> nil; nil \<notin> set a; distinct a; \<exists>y ys. a = y # ys; aa i (hd a) \<noteq> nil \<and> aa i (hd a) \<notin> b \<and> ab (hd a) = none\<rbrakk> \<Longrightarrow> label_0 ab (tl a) (hd a) = none \<and> (\<exists>ia. link_0 aa ab (hd a) (tl a) ia (hd a) = aa i (hd a))
[PROOF STEP]
apply (case_tac a)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>a b aa ab i. \<lbrakk>stack aa ab (head (tl a)) (tl a); head a = hd a; link0 = link_0 aa ab (hd a) (tl a); tail a = tl a; label0 = label_0 ab (tl a); hd a \<noteq> nil; nil \<notin> set a; distinct a; \<exists>y ys. a = y # ys; aa i (hd a) \<noteq> nil \<and> aa i (hd a) \<notin> b \<and> ab (hd a) = none; a = []\<rbrakk> \<Longrightarrow> label_0 ab (tl a) = label_0 (ab(hd a := i)) a
 2. \<And>a b aa ab i ac list. \<lbrakk>stack aa ab (head (tl a)) (tl a); head a = hd a; link0 = link_0 aa ab (hd a) (tl a); tail a = tl a; label0 = label_0 ab (tl a); hd a \<noteq> nil; nil \<notin> set a; distinct a; \<exists>y ys. a = y # ys; aa i (hd a) \<noteq> nil \<and> aa i (hd a) \<notin> b \<and> ab (hd a) = none; a = ac # list\<rbrakk> \<Longrightarrow> label_0 ab (tl a) = label_0 (ab(hd a := i)) a
 3. \<And>a b aa ab i. \<lbrakk>stack aa ab (head (tl a)) (tl a); head a = hd a; link0 = link_0 aa ab (hd a) (tl a); tail a = tl a; label0 = label_0 ab (tl a); hd a \<noteq> nil; nil \<notin> set a; distinct a; \<exists>y ys. a = y # ys; aa i (hd a) \<noteq> nil \<and> aa i (hd a) \<notin> b \<and> ab (hd a) = none\<rbrakk> \<Longrightarrow> label_0 ab (tl a) (hd a) = none \<and> (\<exists>ia. link_0 aa ab (hd a) (tl a) ia (hd a) = aa i (hd a))
[PROOF STEP]
apply simp_all
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a b aa ab i. \<lbrakk>stack aa ab (head (tl a)) (tl a); head a = hd a; link0 = link_0 aa ab (hd a) (tl a); tail a = tl a; label0 = label_0 ab (tl a); hd a \<noteq> nil; nil \<notin> set a; distinct a; \<exists>y ys. a = y # ys; aa i (hd a) \<noteq> nil \<and> aa i (hd a) \<notin> b \<and> ab (hd a) = none\<rbrakk> \<Longrightarrow> label_0 ab (tl a) (hd a) = none \<and> (\<exists>ia. link_0 aa ab (hd a) (tl a) ia (hd a) = aa i (hd a))
[PROOF STEP]
apply (case_tac a)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>a b aa ab i. \<lbrakk>stack aa ab (head (tl a)) (tl a); head a = hd a; link0 = link_0 aa ab (hd a) (tl a); tail a = tl a; label0 = label_0 ab (tl a); hd a \<noteq> nil; nil \<notin> set a; distinct a; \<exists>y ys. a = y # ys; aa i (hd a) \<noteq> nil \<and> aa i (hd a) \<notin> b \<and> ab (hd a) = none; a = []\<rbrakk> \<Longrightarrow> label_0 ab (tl a) (hd a) = none \<and> (\<exists>ia. link_0 aa ab (hd a) (tl a) ia (hd a) = aa i (hd a))
 2. \<And>a b aa ab i ac list. \<lbrakk>stack aa ab (head (tl a)) (tl a); head a = hd a; link0 = link_0 aa ab (hd a) (tl a); tail a = tl a; label0 = label_0 ab (tl a); hd a \<noteq> nil; nil \<notin> set a; distinct a; \<exists>y ys. a = y # ys; aa i (hd a) \<noteq> nil \<and> aa i (hd a) \<notin> b \<and> ab (hd a) = none; a = ac # list\<rbrakk> \<Longrightarrow> label_0 ab (tl a) (hd a) = none \<and> (\<exists>ia. link_0 aa ab (hd a) (tl a) ia (hd a) = aa i (hd a))
[PROOF STEP]
by auto


[STATEMENT]
lemma normalize_ports_generic_normalized_n_primitive:
    assumes n: "normalized_nnf_match m"  and wf_disc_sel: "wf_disc_sel (disc,sel) C"
    and noNeg: "\<And>m. normalized_nnf_match m \<Longrightarrow> \<not> has_disc_negated disc False (rewrite_neg m)"
    and normalize_nnf_pos: "\<And>m m'.
        normalized_nnf_match  m \<Longrightarrow> \<not> has_disc_negated disc False m \<Longrightarrow>
          m' \<in> set (normalize_pos m) \<Longrightarrow> normalized_nnf_match m'"
    and normalize_pos: "\<And>m m'.
        normalized_nnf_match m \<Longrightarrow>  \<not> has_disc_negated disc False m \<Longrightarrow>
          \<forall>m'\<in>set (normalize_pos m).
                 normalized_n_primitive (disc,sel) (\<lambda>ps. case ps of L4Ports _ pts \<Rightarrow> length pts \<le> 1) m'"
    shows "\<forall>m' \<in> set (normalize_ports_generic normalize_pos rewrite_neg m).
             normalized_n_primitive (disc,sel) (\<lambda>ps. case ps of L4Ports _ pts \<Rightarrow> length pts \<le> 1) m'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>m'\<in>set (normalize_ports_generic normalize_pos rewrite_neg m). normalized_n_primitive (disc, sel) (\<lambda>ps. case ps of L4Ports x pts \<Rightarrow> length pts \<le> 1) m'
[PROOF STEP]
unfolding normalize_ports_generic_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>m'\<in>set (concat (map normalize_pos (normalize_match (rewrite_neg m)))). normalized_n_primitive (disc, sel) (\<lambda>ps. case ps of L4Ports x pts \<Rightarrow> length pts \<le> 1) m'
[PROOF STEP]
apply(intro ballI, rename_tac m')
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>m'. m' \<in> set (concat (map normalize_pos (normalize_match (rewrite_neg m)))) \<Longrightarrow> normalized_n_primitive (disc, sel) (\<lambda>ps. case ps of L4Ports x pts \<Rightarrow> length pts \<le> 1) m'
[PROOF STEP]
apply(simp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>m'. \<exists>x\<in>set (normalize_match (rewrite_neg m)). m' \<in> set (normalize_pos x) \<Longrightarrow> normalized_n_primitive (disc, sel) (\<lambda>ps. case ps of L4Ports x pts \<Rightarrow> length pts \<le> 1) m'
[PROOF STEP]
apply(elim bexE, rename_tac a)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>m' a. \<lbrakk>a \<in> set (normalize_match (rewrite_neg m)); m' \<in> set (normalize_pos a)\<rbrakk> \<Longrightarrow> normalized_n_primitive (disc, sel) (\<lambda>ps. case ps of L4Ports x pts \<Rightarrow> length pts \<le> 1) m'
[PROOF STEP]
apply(subgoal_tac "normalized_nnf_match a")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>m' a. \<lbrakk>a \<in> set (normalize_match (rewrite_neg m)); m' \<in> set (normalize_pos a); normalized_nnf_match a\<rbrakk> \<Longrightarrow> normalized_n_primitive (disc, sel) (\<lambda>ps. case ps of L4Ports x pts \<Rightarrow> length pts \<le> 1) m'
 2. \<And>m' a. \<lbrakk>a \<in> set (normalize_match (rewrite_neg m)); m' \<in> set (normalize_pos a)\<rbrakk> \<Longrightarrow> normalized_nnf_match a
[PROOF STEP]
prefer 2
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>m' a. \<lbrakk>a \<in> set (normalize_match (rewrite_neg m)); m' \<in> set (normalize_pos a)\<rbrakk> \<Longrightarrow> normalized_nnf_match a
 2. \<And>m' a. \<lbrakk>a \<in> set (normalize_match (rewrite_neg m)); m' \<in> set (normalize_pos a); normalized_nnf_match a\<rbrakk> \<Longrightarrow> normalized_n_primitive (disc, sel) (\<lambda>ps. case ps of L4Ports x pts \<Rightarrow> length pts \<le> 1) m'
[PROOF STEP]
using normalized_nnf_match_normalize_match
[PROOF STATE]
proof (prove)
using this:
\<forall>m'\<in>set (normalize_match ?m). normalized_nnf_match m'

goal (2 subgoals):
 1. \<And>m' a. \<lbrakk>a \<in> set (normalize_match (rewrite_neg m)); m' \<in> set (normalize_pos a)\<rbrakk> \<Longrightarrow> normalized_nnf_match a
 2. \<And>m' a. \<lbrakk>a \<in> set (normalize_match (rewrite_neg m)); m' \<in> set (normalize_pos a); normalized_nnf_match a\<rbrakk> \<Longrightarrow> normalized_n_primitive (disc, sel) (\<lambda>ps. case ps of L4Ports x pts \<Rightarrow> length pts \<le> 1) m'
[PROOF STEP]
apply blast
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>m' a. \<lbrakk>a \<in> set (normalize_match (rewrite_neg m)); m' \<in> set (normalize_pos a); normalized_nnf_match a\<rbrakk> \<Longrightarrow> normalized_n_primitive (disc, sel) (\<lambda>ps. case ps of L4Ports x pts \<Rightarrow> length pts \<le> 1) m'
[PROOF STEP]
apply(subgoal_tac "\<not> has_disc_negated disc False a")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>m' a. \<lbrakk>a \<in> set (normalize_match (rewrite_neg m)); m' \<in> set (normalize_pos a); normalized_nnf_match a; \<not> has_disc_negated disc False a\<rbrakk> \<Longrightarrow> normalized_n_primitive (disc, sel) (\<lambda>ps. case ps of L4Ports x pts \<Rightarrow> length pts \<le> 1) m'
 2. \<And>m' a. \<lbrakk>a \<in> set (normalize_match (rewrite_neg m)); m' \<in> set (normalize_pos a); normalized_nnf_match a\<rbrakk> \<Longrightarrow> \<not> has_disc_negated disc False a
[PROOF STEP]
prefer 2
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>m' a. \<lbrakk>a \<in> set (normalize_match (rewrite_neg m)); m' \<in> set (normalize_pos a); normalized_nnf_match a\<rbrakk> \<Longrightarrow> \<not> has_disc_negated disc False a
 2. \<And>m' a. \<lbrakk>a \<in> set (normalize_match (rewrite_neg m)); m' \<in> set (normalize_pos a); normalized_nnf_match a; \<not> has_disc_negated disc False a\<rbrakk> \<Longrightarrow> normalized_n_primitive (disc, sel) (\<lambda>ps. case ps of L4Ports x pts \<Rightarrow> length pts \<le> 1) m'
[PROOF STEP]
subgoal for ls
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>a_ \<in> set (normalize_match (rewrite_neg m)); ls \<in> set (normalize_pos a_); normalized_nnf_match a_\<rbrakk> \<Longrightarrow> \<not> has_disc_negated disc False a_
[PROOF STEP]
(*TODO: same is already above!*)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>a_ \<in> set (normalize_match (rewrite_neg m)); ls \<in> set (normalize_pos a_); normalized_nnf_match a_\<rbrakk> \<Longrightarrow> \<not> has_disc_negated disc False a_
[PROOF STEP]
apply(rule_tac m="rewrite_neg m" in not_has_disc_normalize_match)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>a_ \<in> set (normalize_match (rewrite_neg m)); ls \<in> set (normalize_pos a_); normalized_nnf_match a_\<rbrakk> \<Longrightarrow> \<not> has_disc_negated disc False (rewrite_neg m)
 2. \<lbrakk>a_ \<in> set (normalize_match (rewrite_neg m)); ls \<in> set (normalize_pos a_); normalized_nnf_match a_\<rbrakk> \<Longrightarrow> a_ \<in> set (normalize_match (rewrite_neg m))
[PROOF STEP]
using noNeg n
[PROOF STATE]
proof (prove)
using this:
normalized_nnf_match ?m \<Longrightarrow> \<not> has_disc_negated disc False (rewrite_neg ?m)
normalized_nnf_match m

goal (2 subgoals):
 1. \<lbrakk>a_ \<in> set (normalize_match (rewrite_neg m)); ls \<in> set (normalize_pos a_); normalized_nnf_match a_\<rbrakk> \<Longrightarrow> \<not> has_disc_negated disc False (rewrite_neg m)
 2. \<lbrakk>a_ \<in> set (normalize_match (rewrite_neg m)); ls \<in> set (normalize_pos a_); normalized_nnf_match a_\<rbrakk> \<Longrightarrow> a_ \<in> set (normalize_match (rewrite_neg m))
[PROOF STEP]
apply blast
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>a_ \<in> set (normalize_match (rewrite_neg m)); ls \<in> set (normalize_pos a_); normalized_nnf_match a_\<rbrakk> \<Longrightarrow> a_ \<in> set (normalize_match (rewrite_neg m))
[PROOF STEP]
by blast
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>m' a. \<lbrakk>a \<in> set (normalize_match (rewrite_neg m)); m' \<in> set (normalize_pos a); normalized_nnf_match a; \<not> has_disc_negated disc False a\<rbrakk> \<Longrightarrow> normalized_n_primitive (disc, sel) (\<lambda>ps. case ps of L4Ports x pts \<Rightarrow> length pts \<le> 1) m'
[PROOF STEP]
apply(subgoal_tac "normalized_nnf_match m'")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>m' a. \<lbrakk>a \<in> set (normalize_match (rewrite_neg m)); m' \<in> set (normalize_pos a); normalized_nnf_match a; \<not> has_disc_negated disc False a; normalized_nnf_match m'\<rbrakk> \<Longrightarrow> normalized_n_primitive (disc, sel) (\<lambda>ps. case ps of L4Ports x pts \<Rightarrow> length pts \<le> 1) m'
 2. \<And>m' a. \<lbrakk>a \<in> set (normalize_match (rewrite_neg m)); m' \<in> set (normalize_pos a); normalized_nnf_match a; \<not> has_disc_negated disc False a\<rbrakk> \<Longrightarrow> normalized_nnf_match m'
[PROOF STEP]
prefer 2
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>m' a. \<lbrakk>a \<in> set (normalize_match (rewrite_neg m)); m' \<in> set (normalize_pos a); normalized_nnf_match a; \<not> has_disc_negated disc False a\<rbrakk> \<Longrightarrow> normalized_nnf_match m'
 2. \<And>m' a. \<lbrakk>a \<in> set (normalize_match (rewrite_neg m)); m' \<in> set (normalize_pos a); normalized_nnf_match a; \<not> has_disc_negated disc False a; normalized_nnf_match m'\<rbrakk> \<Longrightarrow> normalized_n_primitive (disc, sel) (\<lambda>ps. case ps of L4Ports x pts \<Rightarrow> length pts \<le> 1) m'
[PROOF STEP]
using normalize_nnf_pos
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>normalized_nnf_match ?m; \<not> has_disc_negated disc False ?m; ?m' \<in> set (normalize_pos ?m)\<rbrakk> \<Longrightarrow> normalized_nnf_match ?m'

goal (2 subgoals):
 1. \<And>m' a. \<lbrakk>a \<in> set (normalize_match (rewrite_neg m)); m' \<in> set (normalize_pos a); normalized_nnf_match a; \<not> has_disc_negated disc False a\<rbrakk> \<Longrightarrow> normalized_nnf_match m'
 2. \<And>m' a. \<lbrakk>a \<in> set (normalize_match (rewrite_neg m)); m' \<in> set (normalize_pos a); normalized_nnf_match a; \<not> has_disc_negated disc False a; normalized_nnf_match m'\<rbrakk> \<Longrightarrow> normalized_n_primitive (disc, sel) (\<lambda>ps. case ps of L4Ports x pts \<Rightarrow> length pts \<le> 1) m'
[PROOF STEP]
apply blast
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>m' a. \<lbrakk>a \<in> set (normalize_match (rewrite_neg m)); m' \<in> set (normalize_pos a); normalized_nnf_match a; \<not> has_disc_negated disc False a; normalized_nnf_match m'\<rbrakk> \<Longrightarrow> normalized_n_primitive (disc, sel) (\<lambda>ps. case ps of L4Ports x pts \<Rightarrow> length pts \<le> 1) m'
[PROOF STEP]
using normalize_pos
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>normalized_nnf_match ?m; \<not> has_disc_negated disc False ?m\<rbrakk> \<Longrightarrow> \<forall>m'\<in>set (normalize_pos ?m). normalized_n_primitive (disc, sel) (\<lambda>ps. case ps of L4Ports x pts \<Rightarrow> length pts \<le> 1) m'

goal (1 subgoal):
 1. \<And>m' a. \<lbrakk>a \<in> set (normalize_match (rewrite_neg m)); m' \<in> set (normalize_pos a); normalized_nnf_match a; \<not> has_disc_negated disc False a; normalized_nnf_match m'\<rbrakk> \<Longrightarrow> normalized_n_primitive (disc, sel) (\<lambda>ps. case ps of L4Ports x pts \<Rightarrow> length pts \<le> 1) m'
[PROOF STEP]
by blast


[STATEMENT]
lemma OclAny_allInstances_generic_oclIsTypeOf\<^sub>O\<^sub>c\<^sub>l\<^sub>A\<^sub>n\<^sub>y1:
assumes [simp]: "\<And>x. pre_post (x, x) = x"
shows "\<exists>\<tau>. (\<tau> \<Turnstile>     ((OclAllInstances_generic pre_post OclAny)->forAll\<^sub>S\<^sub>e\<^sub>t(X|X .oclIsTypeOf(OclAny))))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>\<tau>. \<tau> \<Turnstile> UML_Set.OclForall (OclAllInstances_generic pre_post OclAny) OclIsTypeOf\<^sub>O\<^sub>c\<^sub>l\<^sub>A\<^sub>n\<^sub>y
[PROOF STEP]
apply(rule_tac x = \<tau>\<^sub>0 in exI, simp add: \<tau>\<^sub>0_def OclValid_def del: OclAllInstances_generic_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. UML_Set.OclForall (OclAllInstances_generic pre_post OclAsType\<^sub>O\<^sub>c\<^sub>l\<^sub>A\<^sub>n\<^sub>y_\<AA>) OclIsTypeOf\<^sub>O\<^sub>c\<^sub>l\<^sub>A\<^sub>n\<^sub>y (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) = \<lfloor>\<lfloor>True\<rfloor>\<rfloor>
[PROOF STEP]
apply(simp only: assms UML_Set.OclForall_def refl if_True
                  OclAllInstances_generic_defined[simplified OclValid_def])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (if \<exists>x\<in>\<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (OclAllInstances_generic pre_post OclAsType\<^sub>O\<^sub>c\<^sub>l\<^sub>A\<^sub>n\<^sub>y_\<AA> (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>))\<rceil>\<rceil>. \<lambda>_. x.oclIsTypeOf(OclAny) (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) = false (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) then false (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) else if \<exists>x\<in>\<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (OclAllInstances_generic pre_post OclAsType\<^sub>O\<^sub>c\<^sub>l\<^sub>A\<^sub>n\<^sub>y_\<AA> (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>))\<rceil>\<rceil>. \<lambda>_. x.oclIsTypeOf(OclAny) (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) = invalid (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) then invalid (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) else if \<exists>x\<in>\<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (OclAllInstances_generic pre_post OclAsType\<^sub>O\<^sub>c\<^sub>l\<^sub>A\<^sub>n\<^sub>y_\<AA> (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>))\<rceil>\<rceil>. \<lambda>_. x.oclIsTypeOf(OclAny) (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) = null (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) then null (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) else true (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>)) = \<lfloor>\<lfloor>True\<rfloor>\<rfloor>
[PROOF STEP]
apply(simp only: OclAllInstances_generic_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (if \<exists>x\<in>\<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>Some ` (OclAsType\<^sub>O\<^sub>c\<^sub>l\<^sub>A\<^sub>n\<^sub>y_\<AA> ` ran (heap (pre_post (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>))) - {\<bottom>})\<rfloor>\<rfloor>)\<rceil>\<rceil>. \<lambda>_. x.oclIsTypeOf(OclAny) (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) = false (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) then false (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) else if \<exists>x\<in>\<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>Some ` (OclAsType\<^sub>O\<^sub>c\<^sub>l\<^sub>A\<^sub>n\<^sub>y_\<AA> ` ran (heap (pre_post (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>))) - {\<bottom>})\<rfloor>\<rfloor>)\<rceil>\<rceil>. \<lambda>_. x.oclIsTypeOf(OclAny) (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) = invalid (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) then invalid (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) else if \<exists>x\<in>\<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>Some ` (OclAsType\<^sub>O\<^sub>c\<^sub>l\<^sub>A\<^sub>n\<^sub>y_\<AA> ` ran (heap (pre_post (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>))) - {\<bottom>})\<rfloor>\<rfloor>)\<rceil>\<rceil>. \<lambda>_. x.oclIsTypeOf(OclAny) (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) = null (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) then null (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) else true (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>)) = \<lfloor>\<lfloor>True\<rfloor>\<rfloor>
[PROOF STEP]
apply(subst (1 2 3) Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e_inverse, simp add: bot_option_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (if \<exists>x\<in>\<lceil>\<lceil>\<lfloor>\<lfloor>Some ` (OclAsType\<^sub>O\<^sub>c\<^sub>l\<^sub>A\<^sub>n\<^sub>y_\<AA> ` ran (heap (pre_post (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>))) - {\<bottom>})\<rfloor>\<rfloor>\<rceil>\<rceil>. \<lambda>_. x.oclIsTypeOf(OclAny) (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) = false (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) then false (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) else if \<exists>x\<in>\<lceil>\<lceil>\<lfloor>\<lfloor>Some ` (OclAsType\<^sub>O\<^sub>c\<^sub>l\<^sub>A\<^sub>n\<^sub>y_\<AA> ` ran (heap (pre_post (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>))) - {\<bottom>})\<rfloor>\<rfloor>\<rceil>\<rceil>. \<lambda>_. x.oclIsTypeOf(OclAny) (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) = invalid (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) then invalid (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) else if \<exists>x\<in>\<lceil>\<lceil>\<lfloor>\<lfloor>Some ` (OclAsType\<^sub>O\<^sub>c\<^sub>l\<^sub>A\<^sub>n\<^sub>y_\<AA> ` ran (heap (pre_post (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>))) - {\<bottom>})\<rfloor>\<rfloor>\<rceil>\<rceil>. \<lambda>_. x.oclIsTypeOf(OclAny) (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) = null (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) then null (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>) else true (\<lparr>heap = Map.empty, assocs = Map.empty\<rparr>, \<lparr>heap = Map.empty, assocs = Map.empty\<rparr>)) = \<lfloor>\<lfloor>True\<rfloor>\<rfloor>
[PROOF STEP]
by(simp add: OclIsTypeOf\<^sub>O\<^sub>c\<^sub>l\<^sub>A\<^sub>n\<^sub>y_OclAny)


[STATEMENT]
lemma new_character_data_get_child_nodes_is_l_new_character_data_get_child_nodes [instances]:
  "l_new_character_data_get_child_nodes type_wf known_ptr get_child_nodes get_child_nodes_locs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. l_new_character_data_get_child_nodes DocumentClass.type_wf DocumentClass.known_ptr get_child_nodes get_child_nodes_locs
[PROOF STEP]
using new_character_data_is_l_new_character_data get_child_nodes_is_l_get_child_nodes
[PROOF STATE]
proof (prove)
using this:
l_new_character_data DocumentClass.type_wf
l_get_child_nodes DocumentClass.type_wf DocumentClass.known_ptr get_child_nodes get_child_nodes_locs

goal (1 subgoal):
 1. l_new_character_data_get_child_nodes DocumentClass.type_wf DocumentClass.known_ptr get_child_nodes get_child_nodes_locs
[PROOF STEP]
apply(simp add: l_new_character_data_get_child_nodes_def l_new_character_data_get_child_nodes_axioms_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>l_new_character_data DocumentClass.type_wf; l_get_child_nodes DocumentClass.type_wf DocumentClass.known_ptr get_child_nodes get_child_nodes_locs\<rbrakk> \<Longrightarrow> l_new_character_data DocumentClass.type_wf \<and> l_get_child_nodes DocumentClass.type_wf DocumentClass.known_ptr get_child_nodes get_child_nodes_locs \<and> (\<forall>ptr' new_character_data_ptr. ptr' \<noteq> cast\<^sub>c\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>_\<^sub>d\<^sub>a\<^sub>t\<^sub>a\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_character_data_ptr \<longrightarrow> (\<forall>h. h \<turnstile> new_character_data \<rightarrow>\<^sub>r new_character_data_ptr \<longrightarrow> (\<forall>h'. h \<turnstile> new_character_data \<rightarrow>\<^sub>h h' \<longrightarrow> (\<forall>r. r \<in> get_child_nodes_locs ptr' \<longrightarrow> r h h')))) \<and> (\<forall>h new_character_data_ptr. h \<turnstile> new_character_data \<rightarrow>\<^sub>r new_character_data_ptr \<longrightarrow> (\<forall>h'. h \<turnstile> new_character_data \<rightarrow>\<^sub>h h' \<longrightarrow> h' \<turnstile> get_child_nodes (cast\<^sub>c\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>_\<^sub>d\<^sub>a\<^sub>t\<^sub>a\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_character_data_ptr) \<rightarrow>\<^sub>r []))
[PROOF STEP]
using get_child_nodes_new_character_data new_character_data_no_child_nodes
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?ptr' \<noteq> cast\<^sub>c\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>_\<^sub>d\<^sub>a\<^sub>t\<^sub>a\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r ?new_character_data_ptr; ?h \<turnstile> new_character_data \<rightarrow>\<^sub>r ?new_character_data_ptr; ?h \<turnstile> new_character_data \<rightarrow>\<^sub>h ?h'; ?r \<in> get_child_nodes_locs ?ptr'\<rbrakk> \<Longrightarrow> ?r ?h ?h'
\<lbrakk>?h \<turnstile> new_character_data \<rightarrow>\<^sub>r ?new_character_data_ptr; ?h \<turnstile> new_character_data \<rightarrow>\<^sub>h ?h'\<rbrakk> \<Longrightarrow> ?h' \<turnstile> get_child_nodes (cast\<^sub>c\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>_\<^sub>d\<^sub>a\<^sub>t\<^sub>a\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r ?new_character_data_ptr) \<rightarrow>\<^sub>r []

goal (1 subgoal):
 1. \<lbrakk>l_new_character_data DocumentClass.type_wf; l_get_child_nodes DocumentClass.type_wf DocumentClass.known_ptr get_child_nodes get_child_nodes_locs\<rbrakk> \<Longrightarrow> l_new_character_data DocumentClass.type_wf \<and> l_get_child_nodes DocumentClass.type_wf DocumentClass.known_ptr get_child_nodes get_child_nodes_locs \<and> (\<forall>ptr' new_character_data_ptr. ptr' \<noteq> cast\<^sub>c\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>_\<^sub>d\<^sub>a\<^sub>t\<^sub>a\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_character_data_ptr \<longrightarrow> (\<forall>h. h \<turnstile> new_character_data \<rightarrow>\<^sub>r new_character_data_ptr \<longrightarrow> (\<forall>h'. h \<turnstile> new_character_data \<rightarrow>\<^sub>h h' \<longrightarrow> (\<forall>r. r \<in> get_child_nodes_locs ptr' \<longrightarrow> r h h')))) \<and> (\<forall>h new_character_data_ptr. h \<turnstile> new_character_data \<rightarrow>\<^sub>r new_character_data_ptr \<longrightarrow> (\<forall>h'. h \<turnstile> new_character_data \<rightarrow>\<^sub>h h' \<longrightarrow> h' \<turnstile> get_child_nodes (cast\<^sub>c\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>_\<^sub>d\<^sub>a\<^sub>t\<^sub>a\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r new_character_data_ptr) \<rightarrow>\<^sub>r []))
[PROOF STEP]
by fast


[STATEMENT]
lemma mult_float_mono2:
  notes mono_rules = plus_up_mono add_mono nprt_mono nprt_le_zero zero_le_pprt pprt_mono
  shows "a \<le> b \<Longrightarrow>
       ab \<le> bb \<Longrightarrow>
       aa \<le> a \<Longrightarrow>
       b \<le> ba \<Longrightarrow>
       ac \<le> ab \<Longrightarrow>
       bb \<le> bc \<Longrightarrow>
       plus_up prec (pprt b * pprt bb)
        (plus_up prec (pprt a * nprt bb)
          (plus_up prec (nprt b * pprt ab)
            (nprt a * nprt ab)))
       \<le> plus_up prec (pprt ba * pprt bc)
           (plus_up prec (pprt aa * nprt bc)
             (plus_up prec (nprt ba * pprt ac)
               (nprt aa * nprt ac)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>a \<le> b; ab \<le> bb; aa \<le> a; b \<le> ba; ac \<le> ab; bb \<le> bc\<rbrakk> \<Longrightarrow> plus_up prec (pprt b * pprt bb) (plus_up prec (pprt a * nprt bb) (plus_up prec (nprt b * pprt ab) (nprt a * nprt ab))) \<le> plus_up prec (pprt ba * pprt bc) (plus_up prec (pprt aa * nprt bc) (plus_up prec (nprt ba * pprt ac) (nprt aa * nprt ac)))
[PROOF STEP]
apply (rule order_trans)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>a \<le> b; ab \<le> bb; aa \<le> a; b \<le> ba; ac \<le> ab; bb \<le> bc\<rbrakk> \<Longrightarrow> plus_up prec (pprt b * pprt bb) (plus_up prec (pprt a * nprt bb) (plus_up prec (nprt b * pprt ab) (nprt a * nprt ab))) \<le> ?y
 2. \<lbrakk>a \<le> b; ab \<le> bb; aa \<le> a; b \<le> ba; ac \<le> ab; bb \<le> bc\<rbrakk> \<Longrightarrow> ?y \<le> plus_up prec (pprt ba * pprt bc) (plus_up prec (pprt aa * nprt bc) (plus_up prec (nprt ba * pprt ac) (nprt aa * nprt ac)))
[PROOF STEP]
apply (rule mono_rules | assumption)+
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<lbrakk>a \<le> b; ab \<le> bb; aa \<le> a; b \<le> ba; ac \<le> ab; bb \<le> bc\<rbrakk> \<Longrightarrow> pprt b * pprt bb \<le> ?c3
 2. \<lbrakk>a \<le> b; ab \<le> bb; aa \<le> a; b \<le> ba; ac \<le> ab; bb \<le> bc\<rbrakk> \<Longrightarrow> plus_up prec (pprt a * nprt bb) (plus_up prec (nprt b * pprt ab) (nprt a * nprt ab)) \<le> ?d3
 3. \<lbrakk>a \<le> b; ab \<le> bb; aa \<le> a; b \<le> ba; ac \<le> ab; bb \<le> bc\<rbrakk> \<Longrightarrow> plus_up prec ?c3 ?d3 \<le> plus_up prec (pprt ba * pprt bc) (plus_up prec (pprt aa * nprt bc) (plus_up prec (nprt ba * pprt ac) (nprt aa * nprt ac)))
[PROOF STEP]
apply (rule mult_mono)
[PROOF STATE]
proof (prove)
goal (6 subgoals):
 1. \<lbrakk>a \<le> b; ab \<le> bb; aa \<le> a; b \<le> ba; ac \<le> ab; bb \<le> bc\<rbrakk> \<Longrightarrow> pprt b \<le> ?b8
 2. \<lbrakk>a \<le> b; ab \<le> bb; aa \<le> a; b \<le> ba; ac \<le> ab; bb \<le> bc\<rbrakk> \<Longrightarrow> pprt bb \<le> ?d8
 3. \<lbrakk>a \<le> b; ab \<le> bb; aa \<le> a; b \<le> ba; ac \<le> ab; bb \<le> bc\<rbrakk> \<Longrightarrow> 0 \<le> ?b8
 4. \<lbrakk>a \<le> b; ab \<le> bb; aa \<le> a; b \<le> ba; ac \<le> ab; bb \<le> bc\<rbrakk> \<Longrightarrow> 0 \<le> pprt bb
 5. \<lbrakk>a \<le> b; ab \<le> bb; aa \<le> a; b \<le> ba; ac \<le> ab; bb \<le> bc\<rbrakk> \<Longrightarrow> plus_up prec (pprt a * nprt bb) (plus_up prec (nprt b * pprt ab) (nprt a * nprt ab)) \<le> ?d3
 6. \<lbrakk>a \<le> b; ab \<le> bb; aa \<le> a; b \<le> ba; ac \<le> ab; bb \<le> bc\<rbrakk> \<Longrightarrow> plus_up prec (?b8 * ?d8) ?d3 \<le> plus_up prec (pprt ba * pprt bc) (plus_up prec (pprt aa * nprt bc) (plus_up prec (nprt ba * pprt ac) (nprt aa * nprt ac)))
[PROOF STEP]
apply (rule mono_rules | assumption)+
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<lbrakk>a \<le> b; ab \<le> bb; aa \<le> a; b \<le> ba; ac \<le> ab; bb \<le> bc\<rbrakk> \<Longrightarrow> pprt a * nprt bb \<le> ?c19
 2. \<lbrakk>a \<le> b; ab \<le> bb; aa \<le> a; b \<le> ba; ac \<le> ab; bb \<le> bc\<rbrakk> \<Longrightarrow> plus_up prec (nprt b * pprt ab) (nprt a * nprt ab) \<le> ?d19
 3. \<lbrakk>a \<le> b; ab \<le> bb; aa \<le> a; b \<le> ba; ac \<le> ab; bb \<le> bc\<rbrakk> \<Longrightarrow> plus_up prec (pprt ba * pprt bc) (plus_up prec ?c19 ?d19) \<le> plus_up prec (pprt ba * pprt bc) (plus_up prec (pprt aa * nprt bc) (plus_up prec (nprt ba * pprt ac) (nprt aa * nprt ac)))
[PROOF STEP]
apply (rule mult_mono_nonneg_nonpos)
[PROOF STATE]
proof (prove)
goal (6 subgoals):
 1. \<lbrakk>a \<le> b; ab \<le> bb; aa \<le> a; b \<le> ba; ac \<le> ab; bb \<le> bc\<rbrakk> \<Longrightarrow> nprt bb \<le> ?c24
 2. \<lbrakk>a \<le> b; ab \<le> bb; aa \<le> a; b \<le> ba; ac \<le> ab; bb \<le> bc\<rbrakk> \<Longrightarrow> ?c24 \<le> 0
 3. \<lbrakk>a \<le> b; ab \<le> bb; aa \<le> a; b \<le> ba; ac \<le> ab; bb \<le> bc\<rbrakk> \<Longrightarrow> 0 \<le> ?d24
 4. \<lbrakk>a \<le> b; ab \<le> bb; aa \<le> a; b \<le> ba; ac \<le> ab; bb \<le> bc\<rbrakk> \<Longrightarrow> ?d24 \<le> pprt a
 5. \<lbrakk>a \<le> b; ab \<le> bb; aa \<le> a; b \<le> ba; ac \<le> ab; bb \<le> bc\<rbrakk> \<Longrightarrow> plus_up prec (nprt b * pprt ab) (nprt a * nprt ab) \<le> ?d19
 6. \<lbrakk>a \<le> b; ab \<le> bb; aa \<le> a; b \<le> ba; ac \<le> ab; bb \<le> bc\<rbrakk> \<Longrightarrow> plus_up prec (pprt ba * pprt bc) (plus_up prec (?d24 * ?c24) ?d19) \<le> plus_up prec (pprt ba * pprt bc) (plus_up prec (pprt aa * nprt bc) (plus_up prec (nprt ba * pprt ac) (nprt aa * nprt ac)))
[PROOF STEP]
apply (rule mono_rules | assumption)+
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<lbrakk>a \<le> b; ab \<le> bb; aa \<le> a; b \<le> ba; ac \<le> ab; bb \<le> bc\<rbrakk> \<Longrightarrow> nprt b * pprt ab \<le> ?c35
 2. \<lbrakk>a \<le> b; ab \<le> bb; aa \<le> a; b \<le> ba; ac \<le> ab; bb \<le> bc\<rbrakk> \<Longrightarrow> nprt a * nprt ab \<le> ?d35
 3. \<lbrakk>a \<le> b; ab \<le> bb; aa \<le> a; b \<le> ba; ac \<le> ab; bb \<le> bc\<rbrakk> \<Longrightarrow> plus_up prec (pprt ba * pprt bc) (plus_up prec (pprt aa * nprt bc) (plus_up prec ?c35 ?d35)) \<le> plus_up prec (pprt ba * pprt bc) (plus_up prec (pprt aa * nprt bc) (plus_up prec (nprt ba * pprt ac) (nprt aa * nprt ac)))
[PROOF STEP]
apply (rule mult_mono_nonpos_nonneg)
[PROOF STATE]
proof (prove)
goal (6 subgoals):
 1. \<lbrakk>a \<le> b; ab \<le> bb; aa \<le> a; b \<le> ba; ac \<le> ab; bb \<le> bc\<rbrakk> \<Longrightarrow> nprt b \<le> ?c40
 2. \<lbrakk>a \<le> b; ab \<le> bb; aa \<le> a; b \<le> ba; ac \<le> ab; bb \<le> bc\<rbrakk> \<Longrightarrow> nprt b \<le> 0
 3. \<lbrakk>a \<le> b; ab \<le> bb; aa \<le> a; b \<le> ba; ac \<le> ab; bb \<le> bc\<rbrakk> \<Longrightarrow> 0 \<le> ?d40
 4. \<lbrakk>a \<le> b; ab \<le> bb; aa \<le> a; b \<le> ba; ac \<le> ab; bb \<le> bc\<rbrakk> \<Longrightarrow> ?d40 \<le> pprt ab
 5. \<lbrakk>a \<le> b; ab \<le> bb; aa \<le> a; b \<le> ba; ac \<le> ab; bb \<le> bc\<rbrakk> \<Longrightarrow> nprt a * nprt ab \<le> ?d35
 6. \<lbrakk>a \<le> b; ab \<le> bb; aa \<le> a; b \<le> ba; ac \<le> ab; bb \<le> bc\<rbrakk> \<Longrightarrow> plus_up prec (pprt ba * pprt bc) (plus_up prec (pprt aa * nprt bc) (plus_up prec (?c40 * ?d40) ?d35)) \<le> plus_up prec (pprt ba * pprt bc) (plus_up prec (pprt aa * nprt bc) (plus_up prec (nprt ba * pprt ac) (nprt aa * nprt ac)))
[PROOF STEP]
apply (rule mono_rules | assumption)+
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>a \<le> b; ab \<le> bb; aa \<le> a; b \<le> ba; ac \<le> ab; bb \<le> bc\<rbrakk> \<Longrightarrow> nprt a * nprt ab \<le> ?d35
 2. \<lbrakk>a \<le> b; ab \<le> bb; aa \<le> a; b \<le> ba; ac \<le> ab; bb \<le> bc\<rbrakk> \<Longrightarrow> plus_up prec (pprt ba * pprt bc) (plus_up prec (pprt aa * nprt bc) (plus_up prec (nprt ba * pprt ac) ?d35)) \<le> plus_up prec (pprt ba * pprt bc) (plus_up prec (pprt aa * nprt bc) (plus_up prec (nprt ba * pprt ac) (nprt aa * nprt ac)))
[PROOF STEP]
apply (rule mult_mono_nonpos_nonpos)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<lbrakk>a \<le> b; ab \<le> bb; aa \<le> a; b \<le> ba; ac \<le> ab; bb \<le> bc\<rbrakk> \<Longrightarrow> ?c51 \<le> nprt a
 2. \<lbrakk>a \<le> b; ab \<le> bb; aa \<le> a; b \<le> ba; ac \<le> ab; bb \<le> bc\<rbrakk> \<Longrightarrow> nprt a \<le> 0
 3. \<lbrakk>a \<le> b; ab \<le> bb; aa \<le> a; b \<le> ba; ac \<le> ab; bb \<le> bc\<rbrakk> \<Longrightarrow> ?d51 \<le> nprt ab
 4. \<lbrakk>a \<le> b; ab \<le> bb; aa \<le> a; b \<le> ba; ac \<le> ab; bb \<le> bc\<rbrakk> \<Longrightarrow> ?d51 \<le> 0
 5. \<lbrakk>a \<le> b; ab \<le> bb; aa \<le> a; b \<le> ba; ac \<le> ab; bb \<le> bc\<rbrakk> \<Longrightarrow> plus_up prec (pprt ba * pprt bc) (plus_up prec (pprt aa * nprt bc) (plus_up prec (nprt ba * pprt ac) (?c51 * ?d51))) \<le> plus_up prec (pprt ba * pprt bc) (plus_up prec (pprt aa * nprt bc) (plus_up prec (nprt ba * pprt ac) (nprt aa * nprt ac)))
[PROOF STEP]
apply (rule mono_rules | assumption)+
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>a \<le> b; ab \<le> bb; aa \<le> a; b \<le> ba; ac \<le> ab; bb \<le> bc\<rbrakk> \<Longrightarrow> pprt ba * pprt bc \<le> pprt ba * pprt bc
 2. \<lbrakk>a \<le> b; ab \<le> bb; aa \<le> a; b \<le> ba; ac \<le> ab; bb \<le> bc\<rbrakk> \<Longrightarrow> plus_up prec (pprt aa * nprt bc) (plus_up prec (nprt ba * pprt ac) (nprt aa * nprt ac)) \<le> plus_up prec (pprt aa * nprt bc) (plus_up prec (nprt ba * pprt ac) (nprt aa * nprt ac))
[PROOF STEP]
by (rule order_refl)+


[STATEMENT]
lemma "\<forall>P. P"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>P. P
[PROOF STEP]
nitpick [expect = genuine]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>P. P
[PROOF STEP]
oops


[STATEMENT]
lemma "x \<in> {x. P x}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x \<in> {x. P x}
[PROOF STEP]
nitpick [expect = genuine]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x \<in> {x. P x}
[PROOF STEP]
oops