[STATEMENT]
lemma interaction_bounded_by_inline [interaction_bound]:
  assumes p: "interaction_bounded_by consider' gpv p"
  and q: "\<And>s x. consider' x \<Longrightarrow> interaction_bounded_by consider (callee s x) q"
  and ignore: "\<And>s x. \<not> consider' x \<Longrightarrow> interaction_bounded_by consider (callee s x) 0"
  shows "interaction_bounded_by consider (inline callee gpv s) (p * q)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. interaction_bounded_by consider (inline callee gpv s) (p * q)
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. interaction_bound consider (inline callee gpv s) \<le> p * q
[PROOF STEP]
have "interaction_bounded_by consider' gpv p \<Longrightarrow> interaction_bound consider (inline callee gpv s) \<le> p * q"
    and "interaction_bound consider (bind_gpv gpv' f) \<le> interaction_bound consider gpv' + (SUP x\<in>results'_gpv gpv'. interaction_bound consider (f x))"
    for gpv' and f :: "'ret \<times> 's \<Rightarrow> ('a \<times> 's, 'call', 'ret') gpv"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (interaction_bounded_by consider' gpv p \<Longrightarrow> interaction_bound consider (inline callee gpv s) \<le> p * q) &&& interaction_bound consider (gpv' \<bind> f) \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. interaction_bound consider (f x))
[PROOF STEP]
proof(induction arbitrary: gpv s p gpv' f rule: interaction_bound_fixp_induct)
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. lfp.admissible (\<lambda>a. (\<forall>x xa xb. interaction_bounded_by consider' x xb \<longrightarrow> a (inline callee x xa) \<le> xb * q) \<and> (\<forall>x xa. a (x \<bind> xa) \<le> interaction_bound consider x + (\<Squnion>x\<in>results'_gpv x. a (xa x))))
 2. \<And>gpv s p. interaction_bounded_by consider' gpv p \<Longrightarrow> 0 \<le> p * q
 3. \<And>gpv' f. 0 \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. 0)
 4. \<And>interaction_bound' gpv s p. \<lbrakk>\<And>gpv s p. interaction_bounded_by consider' gpv p \<Longrightarrow> interaction_bound' (inline callee gpv s) \<le> p * q; \<And>gpv' f. interaction_bound' (gpv' \<bind> f) \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. interaction_bound' (f x)); \<And>gpv. interaction_bound' gpv \<le> interaction_bound consider gpv; \<And>gpv. interaction_bound' gpv \<le> \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv gpv)); interaction_bounded_by consider' gpv p\<rbrakk> \<Longrightarrow> \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv (inline callee gpv s))) \<le> p * q
 5. \<And>interaction_bound' gpv' f. \<lbrakk>\<And>gpv s p. interaction_bounded_by consider' gpv p \<Longrightarrow> interaction_bound' (inline callee gpv s) \<le> p * q; \<And>gpv' f. interaction_bound' (gpv' \<bind> f) \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. interaction_bound' (f x)); \<And>gpv. interaction_bound' gpv \<le> interaction_bound consider gpv; \<And>gpv. interaction_bound' gpv \<le> \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv gpv))\<rbrakk> \<Longrightarrow> \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv (gpv' \<bind> f))) \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv (f x))))
[PROOF STEP]
case adm
[PROOF STATE]
proof (state)
this:

goal (5 subgoals):
 1. lfp.admissible (\<lambda>a. (\<forall>x xa xb. interaction_bounded_by consider' x xb \<longrightarrow> a (inline callee x xa) \<le> xb * q) \<and> (\<forall>x xa. a (x \<bind> xa) \<le> interaction_bound consider x + (\<Squnion>x\<in>results'_gpv x. a (xa x))))
 2. \<And>gpv s p. interaction_bounded_by consider' gpv p \<Longrightarrow> 0 \<le> p * q
 3. \<And>gpv' f. 0 \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. 0)
 4. \<And>interaction_bound' gpv s p. \<lbrakk>\<And>gpv s p. interaction_bounded_by consider' gpv p \<Longrightarrow> interaction_bound' (inline callee gpv s) \<le> p * q; \<And>gpv' f. interaction_bound' (gpv' \<bind> f) \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. interaction_bound' (f x)); \<And>gpv. interaction_bound' gpv \<le> interaction_bound consider gpv; \<And>gpv. interaction_bound' gpv \<le> \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv gpv)); interaction_bounded_by consider' gpv p\<rbrakk> \<Longrightarrow> \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv (inline callee gpv s))) \<le> p * q
 5. \<And>interaction_bound' gpv' f. \<lbrakk>\<And>gpv s p. interaction_bounded_by consider' gpv p \<Longrightarrow> interaction_bound' (inline callee gpv s) \<le> p * q; \<And>gpv' f. interaction_bound' (gpv' \<bind> f) \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. interaction_bound' (f x)); \<And>gpv. interaction_bound' gpv \<le> interaction_bound consider gpv; \<And>gpv. interaction_bound' gpv \<le> \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv gpv))\<rbrakk> \<Longrightarrow> \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv (gpv' \<bind> f))) \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv (f x))))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. lfp.admissible (\<lambda>a. (\<forall>x xa xb. interaction_bounded_by consider' x xb \<longrightarrow> a (inline callee x xa) \<le> xb * q) \<and> (\<forall>x xa. a (x \<bind> xa) \<le> interaction_bound consider x + (\<Squnion>x\<in>results'_gpv x. a (xa x))))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
lfp.admissible (\<lambda>a. (\<forall>x xa xb. interaction_bounded_by consider' x xb \<longrightarrow> a (inline callee x xa) \<le> xb * q) \<and> (\<forall>x xa. a (x \<bind> xa) \<le> interaction_bound consider x + (\<Squnion>x\<in>results'_gpv x. a (xa x))))

goal (4 subgoals):
 1. \<And>gpv s p. interaction_bounded_by consider' gpv p \<Longrightarrow> 0 \<le> p * q
 2. \<And>gpv' f. 0 \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. 0)
 3. \<And>interaction_bound' gpv s p. \<lbrakk>\<And>gpv s p. interaction_bounded_by consider' gpv p \<Longrightarrow> interaction_bound' (inline callee gpv s) \<le> p * q; \<And>gpv' f. interaction_bound' (gpv' \<bind> f) \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. interaction_bound' (f x)); \<And>gpv. interaction_bound' gpv \<le> interaction_bound consider gpv; \<And>gpv. interaction_bound' gpv \<le> \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv gpv)); interaction_bounded_by consider' gpv p\<rbrakk> \<Longrightarrow> \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv (inline callee gpv s))) \<le> p * q
 4. \<And>interaction_bound' gpv' f. \<lbrakk>\<And>gpv s p. interaction_bounded_by consider' gpv p \<Longrightarrow> interaction_bound' (inline callee gpv s) \<le> p * q; \<And>gpv' f. interaction_bound' (gpv' \<bind> f) \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. interaction_bound' (f x)); \<And>gpv. interaction_bound' gpv \<le> interaction_bound consider gpv; \<And>gpv. interaction_bound' gpv \<le> \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv gpv))\<rbrakk> \<Longrightarrow> \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv (gpv' \<bind> f))) \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv (f x))))
[PROOF STEP]
case bottom
[PROOF STATE]
proof (state)
this:

goal (4 subgoals):
 1. \<And>gpv s p. interaction_bounded_by consider' gpv p \<Longrightarrow> 0 \<le> p * q
 2. \<And>gpv' f. 0 \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. 0)
 3. \<And>interaction_bound' gpv s p. \<lbrakk>\<And>gpv s p. interaction_bounded_by consider' gpv p \<Longrightarrow> interaction_bound' (inline callee gpv s) \<le> p * q; \<And>gpv' f. interaction_bound' (gpv' \<bind> f) \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. interaction_bound' (f x)); \<And>gpv. interaction_bound' gpv \<le> interaction_bound consider gpv; \<And>gpv. interaction_bound' gpv \<le> \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv gpv)); interaction_bounded_by consider' gpv p\<rbrakk> \<Longrightarrow> \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv (inline callee gpv s))) \<le> p * q
 4. \<And>interaction_bound' gpv' f. \<lbrakk>\<And>gpv s p. interaction_bounded_by consider' gpv p \<Longrightarrow> interaction_bound' (inline callee gpv s) \<le> p * q; \<And>gpv' f. interaction_bound' (gpv' \<bind> f) \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. interaction_bound' (f x)); \<And>gpv. interaction_bound' gpv \<le> interaction_bound consider gpv; \<And>gpv. interaction_bound' gpv \<le> \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv gpv))\<rbrakk> \<Longrightarrow> \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv (gpv' \<bind> f))) \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv (f x))))
[PROOF STEP]
case 1
[PROOF STATE]
proof (state)
this:
interaction_bounded_by consider' gpv p

goal (4 subgoals):
 1. \<And>gpv s p. interaction_bounded_by consider' gpv p \<Longrightarrow> 0 \<le> p * q
 2. \<And>gpv' f. 0 \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. 0)
 3. \<And>interaction_bound' gpv s p. \<lbrakk>\<And>gpv s p. interaction_bounded_by consider' gpv p \<Longrightarrow> interaction_bound' (inline callee gpv s) \<le> p * q; \<And>gpv' f. interaction_bound' (gpv' \<bind> f) \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. interaction_bound' (f x)); \<And>gpv. interaction_bound' gpv \<le> interaction_bound consider gpv; \<And>gpv. interaction_bound' gpv \<le> \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv gpv)); interaction_bounded_by consider' gpv p\<rbrakk> \<Longrightarrow> \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv (inline callee gpv s))) \<le> p * q
 4. \<And>interaction_bound' gpv' f. \<lbrakk>\<And>gpv s p. interaction_bounded_by consider' gpv p \<Longrightarrow> interaction_bound' (inline callee gpv s) \<le> p * q; \<And>gpv' f. interaction_bound' (gpv' \<bind> f) \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. interaction_bound' (f x)); \<And>gpv. interaction_bound' gpv \<le> interaction_bound consider gpv; \<And>gpv. interaction_bound' gpv \<le> \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv gpv))\<rbrakk> \<Longrightarrow> \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv (gpv' \<bind> f))) \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv (f x))))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 \<le> p * q
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
0 \<le> p * q

goal (3 subgoals):
 1. \<And>gpv' f. 0 \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. 0)
 2. \<And>interaction_bound' gpv s p. \<lbrakk>\<And>gpv s p. interaction_bounded_by consider' gpv p \<Longrightarrow> interaction_bound' (inline callee gpv s) \<le> p * q; \<And>gpv' f. interaction_bound' (gpv' \<bind> f) \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. interaction_bound' (f x)); \<And>gpv. interaction_bound' gpv \<le> interaction_bound consider gpv; \<And>gpv. interaction_bound' gpv \<le> \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv gpv)); interaction_bounded_by consider' gpv p\<rbrakk> \<Longrightarrow> \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv (inline callee gpv s))) \<le> p * q
 3. \<And>interaction_bound' gpv' f. \<lbrakk>\<And>gpv s p. interaction_bounded_by consider' gpv p \<Longrightarrow> interaction_bound' (inline callee gpv s) \<le> p * q; \<And>gpv' f. interaction_bound' (gpv' \<bind> f) \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. interaction_bound' (f x)); \<And>gpv. interaction_bound' gpv \<le> interaction_bound consider gpv; \<And>gpv. interaction_bound' gpv \<le> \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv gpv))\<rbrakk> \<Longrightarrow> \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv (gpv' \<bind> f))) \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv (f x))))
[PROOF STEP]
case (step interaction_bound')
[PROOF STATE]
proof (state)
this:
interaction_bounded_by consider' ?gpv1 ?p1 \<Longrightarrow> interaction_bound' (inline callee ?gpv1 ?s1) \<le> ?p1 * q
interaction_bound' (?gpv'1 \<bind> ?f1) \<le> interaction_bound consider ?gpv'1 + (\<Squnion>x\<in>results'_gpv ?gpv'1. interaction_bound' (?f1 x))
interaction_bound' ?gpv1 \<le> interaction_bound consider ?gpv1
interaction_bound' ?gpv1 \<le> (\<Squnion>generat\<in>set_spmf (the_gpv ?gpv1). case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input))

goal (3 subgoals):
 1. \<And>gpv' f. 0 \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. 0)
 2. \<And>interaction_bound' gpv s p. \<lbrakk>\<And>gpv s p. interaction_bounded_by consider' gpv p \<Longrightarrow> interaction_bound' (inline callee gpv s) \<le> p * q; \<And>gpv' f. interaction_bound' (gpv' \<bind> f) \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. interaction_bound' (f x)); \<And>gpv. interaction_bound' gpv \<le> interaction_bound consider gpv; \<And>gpv. interaction_bound' gpv \<le> \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv gpv)); interaction_bounded_by consider' gpv p\<rbrakk> \<Longrightarrow> \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv (inline callee gpv s))) \<le> p * q
 3. \<And>interaction_bound' gpv' f. \<lbrakk>\<And>gpv s p. interaction_bounded_by consider' gpv p \<Longrightarrow> interaction_bound' (inline callee gpv s) \<le> p * q; \<And>gpv' f. interaction_bound' (gpv' \<bind> f) \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. interaction_bound' (f x)); \<And>gpv. interaction_bound' gpv \<le> interaction_bound consider gpv; \<And>gpv. interaction_bound' gpv \<le> \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv gpv))\<rbrakk> \<Longrightarrow> \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv (gpv' \<bind> f))) \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv (f x))))
[PROOF STEP]
case step: 1
[PROOF STATE]
proof (state)
this:
interaction_bounded_by consider' gpv p

goal (3 subgoals):
 1. \<And>gpv' f. 0 \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. 0)
 2. \<And>interaction_bound' gpv s p. \<lbrakk>\<And>gpv s p. interaction_bounded_by consider' gpv p \<Longrightarrow> interaction_bound' (inline callee gpv s) \<le> p * q; \<And>gpv' f. interaction_bound' (gpv' \<bind> f) \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. interaction_bound' (f x)); \<And>gpv. interaction_bound' gpv \<le> interaction_bound consider gpv; \<And>gpv. interaction_bound' gpv \<le> \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv gpv)); interaction_bounded_by consider' gpv p\<rbrakk> \<Longrightarrow> \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv (inline callee gpv s))) \<le> p * q
 3. \<And>interaction_bound' gpv' f. \<lbrakk>\<And>gpv s p. interaction_bounded_by consider' gpv p \<Longrightarrow> interaction_bound' (inline callee gpv s) \<le> p * q; \<And>gpv' f. interaction_bound' (gpv' \<bind> f) \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. interaction_bound' (f x)); \<And>gpv. interaction_bound' gpv \<le> interaction_bound consider gpv; \<And>gpv. interaction_bound' gpv \<le> \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv gpv))\<rbrakk> \<Longrightarrow> \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv (gpv' \<bind> f))) \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv (f x))))
[PROOF STEP]
show ?case (is "(SUP generat\<in>?inline. ?lhs generat) \<le> ?rhs")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Squnion>generat\<in>set_spmf (the_gpv (inline callee gpv s)). case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
[PROOF STEP]
proof(rule SUP_least)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>generat. generat \<in> set_spmf (the_gpv (inline callee gpv s)) \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
[PROOF STEP]
fix generat
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>generat. generat \<in> set_spmf (the_gpv (inline callee gpv s)) \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
[PROOF STEP]
assume "generat \<in> ?inline"
[PROOF STATE]
proof (state)
this:
generat \<in> set_spmf (the_gpv (inline callee gpv s))

goal (1 subgoal):
 1. \<And>generat. generat \<in> set_spmf (the_gpv (inline callee gpv s)) \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
generat \<in> set_spmf (the_gpv (inline callee gpv s))
[PROOF STEP]
consider (Pure) ret s' where "generat = Pure (ret, s')"
          and "Inl (ret, s') \<in> set_spmf (inline1 callee gpv s)"
        | (IO) out c rpv where "generat = IO out (\<lambda>input. bind_gpv (c input) (\<lambda>(ret, s'). inline callee (rpv ret) s'))"
          and "Inr (out, c, rpv) \<in> set_spmf (inline1 callee gpv s)"
[PROOF STATE]
proof (prove)
using this:
generat \<in> set_spmf (the_gpv (inline callee gpv s))

goal (1 subgoal):
 1. \<lbrakk>\<And>ret s'. \<lbrakk>generat = Pure (ret, s'); Inl (ret, s') \<in> set_spmf (inline1 callee gpv s)\<rbrakk> \<Longrightarrow> thesis; \<And>out c rpv. \<lbrakk>generat = IO out (\<lambda>input. c input \<bind> (\<lambda>(ret, s'). inline callee (rpv ret) s')); Inr (out, c, rpv) \<in> set_spmf (inline1 callee gpv s)\<rbrakk> \<Longrightarrow> thesis\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
by(clarsimp simp add: inline_sel split: sum.split_asm)
[PROOF STATE]
proof (state)
this:
\<lbrakk>\<And>ret s'. \<lbrakk>generat = Pure (ret, s'); Inl (ret, s') \<in> set_spmf (inline1 callee gpv s)\<rbrakk> \<Longrightarrow> ?thesis1; \<And>out c rpv. \<lbrakk>generat = IO out (\<lambda>input. c input \<bind> (\<lambda>(ret, s'). inline callee (rpv ret) s')); Inr (out, c, rpv) \<in> set_spmf (inline1 callee gpv s)\<rbrakk> \<Longrightarrow> ?thesis1\<rbrakk> \<Longrightarrow> ?thesis1

goal (1 subgoal):
 1. \<And>generat. generat \<in> set_spmf (the_gpv (inline callee gpv s)) \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>\<And>ret s'. \<lbrakk>generat = Pure (ret, s'); Inl (ret, s') \<in> set_spmf (inline1 callee gpv s)\<rbrakk> \<Longrightarrow> ?thesis1; \<And>out c rpv. \<lbrakk>generat = IO out (\<lambda>input. c input \<bind> (\<lambda>(ret, s'). inline callee (rpv ret) s')); Inr (out, c, rpv) \<in> set_spmf (inline1 callee gpv s)\<rbrakk> \<Longrightarrow> ?thesis1\<rbrakk> \<Longrightarrow> ?thesis1
[PROOF STEP]
show "?lhs generat \<le> ?rhs"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<And>ret s'. \<lbrakk>generat = Pure (ret, s'); Inl (ret, s') \<in> set_spmf (inline1 callee gpv s)\<rbrakk> \<Longrightarrow> ?thesis1; \<And>out c rpv. \<lbrakk>generat = IO out (\<lambda>input. c input \<bind> (\<lambda>(ret, s'). inline callee (rpv ret) s')); Inr (out, c, rpv) \<in> set_spmf (inline1 callee gpv s)\<rbrakk> \<Longrightarrow> ?thesis1\<rbrakk> \<Longrightarrow> ?thesis1

goal (1 subgoal):
 1. (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
[PROOF STEP]
proof(cases)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>ret s'. \<lbrakk>generat = Pure (ret, s'); Inl (ret, s') \<in> set_spmf (inline1 callee gpv s)\<rbrakk> \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
 2. \<And>out c rpv. \<lbrakk>generat = IO out (\<lambda>input. c input \<bind> (\<lambda>(ret, s'). inline callee (rpv ret) s')); Inr (out, c, rpv) \<in> set_spmf (inline1 callee gpv s)\<rbrakk> \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
[PROOF STEP]
case Pure
[PROOF STATE]
proof (state)
this:
generat = Pure (ret, s')
Inl (ret, s') \<in> set_spmf (inline1 callee gpv s)

goal (2 subgoals):
 1. \<And>ret s'. \<lbrakk>generat = Pure (ret, s'); Inl (ret, s') \<in> set_spmf (inline1 callee gpv s)\<rbrakk> \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
 2. \<And>out c rpv. \<lbrakk>generat = IO out (\<lambda>input. c input \<bind> (\<lambda>(ret, s'). inline callee (rpv ret) s')); Inr (out, c, rpv) \<in> set_spmf (inline1 callee gpv s)\<rbrakk> \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
generat = Pure (ret, s')
Inl (ret, s') \<in> set_spmf (inline1 callee gpv s)

goal (1 subgoal):
 1. (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
(case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q

goal (1 subgoal):
 1. \<And>out c rpv. \<lbrakk>generat = IO out (\<lambda>input. c input \<bind> (\<lambda>(ret, s'). inline callee (rpv ret) s')); Inr (out, c, rpv) \<in> set_spmf (inline1 callee gpv s)\<rbrakk> \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>out c rpv. \<lbrakk>generat = IO out (\<lambda>input. c input \<bind> (\<lambda>(ret, s'). inline callee (rpv ret) s')); Inr (out, c, rpv) \<in> set_spmf (inline1 callee gpv s)\<rbrakk> \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
[PROOF STEP]
case IO
[PROOF STATE]
proof (state)
this:
generat = IO out (\<lambda>input. c input \<bind> (\<lambda>(ret, s'). inline callee (rpv ret) s'))
Inr (out, c, rpv) \<in> set_spmf (inline1 callee gpv s)

goal (1 subgoal):
 1. \<And>out c rpv. \<lbrakk>generat = IO out (\<lambda>input. c input \<bind> (\<lambda>(ret, s'). inline callee (rpv ret) s')); Inr (out, c, rpv) \<in> set_spmf (inline1 callee gpv s)\<rbrakk> \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
[PROOF STEP]
from IO(2)
[PROOF STATE]
proof (chain)
picking this:
Inr (out, c, rpv) \<in> set_spmf (inline1 callee gpv s)
[PROOF STEP]
obtain out' where out': "Inr (out', out, c, rpv) \<in> set_spmf (inline1' gpv s)"
[PROOF STATE]
proof (prove)
using this:
Inr (out, c, rpv) \<in> set_spmf (inline1 callee gpv s)

goal (1 subgoal):
 1. (\<And>out'. Inr (out', out, c, rpv) \<in> set_spmf (inline1' gpv s) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by(auto simp add: inline1_conv_inline1' Inr_eq_map_sum_iff)
[PROOF STATE]
proof (state)
this:
Inr (out', out, c, rpv) \<in> set_spmf (inline1' gpv s)

goal (1 subgoal):
 1. \<And>out c rpv. \<lbrakk>generat = IO out (\<lambda>input. c input \<bind> (\<lambda>(ret, s'). inline callee (rpv ret) s')); Inr (out, c, rpv) \<in> set_spmf (inline1 callee gpv s)\<rbrakk> \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
[PROOF STEP]
proof(cases "consider' out'")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. consider' out' \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
 2. \<not> consider' out' \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
consider' out'

goal (2 subgoals):
 1. consider' out' \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
 2. \<not> consider' out' \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
[PROOF STEP]
with interaction_bounded_by_inline1[OF out' step.prems q ignore]
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>\<And>s x. consider' x \<Longrightarrow> consider' x; \<And>s x. \<not> consider' x \<Longrightarrow> \<not> consider' x\<rbrakk> \<Longrightarrow> if consider' out' then (if consider out then q \<noteq> 0 \<and> interaction_bounded_by consider (c ?input) (q - 1) else interaction_bounded_by consider (c ?input) q) \<and> p \<noteq> 0 \<and> interaction_bounded_by consider' (rpv ?x) (p - 1) else \<not> consider out \<and> interaction_bounded_by consider (c ?input) 0 \<and> interaction_bounded_by consider' (rpv ?x) p
consider' out'
[PROOF STEP]
have p: "p \<noteq> 0" and rpv: "\<And>x. interaction_bounded_by consider' (rpv x) (p - 1)"
            and c: "\<And>input. if consider out then q \<noteq> 0 \<and> interaction_bounded_by consider (c input) (q - 1) else interaction_bounded_by consider (c input) q"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<And>s x. consider' x \<Longrightarrow> consider' x; \<And>s x. \<not> consider' x \<Longrightarrow> \<not> consider' x\<rbrakk> \<Longrightarrow> if consider' out' then (if consider out then q \<noteq> 0 \<and> interaction_bounded_by consider (c ?input) (q - 1) else interaction_bounded_by consider (c ?input) q) \<and> p \<noteq> 0 \<and> interaction_bounded_by consider' (rpv ?x) (p - 1) else \<not> consider out \<and> interaction_bounded_by consider (c ?input) 0 \<and> interaction_bounded_by consider' (rpv ?x) p
consider' out'

goal (1 subgoal):
 1. p \<noteq> 0 &&& (\<And>x. interaction_bounded_by consider' (rpv x) (p - 1)) &&& (\<And>input. if consider out then q \<noteq> 0 \<and> interaction_bounded_by consider (c input) (q - 1) else interaction_bounded_by consider (c input) q)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
p \<noteq> 0
interaction_bounded_by consider' (rpv ?x1) (p - 1)
if consider out then q \<noteq> 0 \<and> interaction_bounded_by consider (c ?input1) (q - 1) else interaction_bounded_by consider (c ?input1) q

goal (2 subgoals):
 1. consider' out' \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
 2. \<not> consider' out' \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
[PROOF STEP]
have "?lhs generat \<le> (if consider out then 1 else 0) + (SUP input. interaction_bound' (bind_gpv (c input) (\<lambda>(ret, s'). inline callee (rpv ret) s')))"
            (is "_ \<le> _ + ?sup")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> (if consider out then 1 else 0) + (\<Squnion>input. interaction_bound' (c input \<bind> (\<lambda>(ret, s'). inline callee (rpv ret) s')))
[PROOF STEP]
using IO(1)
[PROOF STATE]
proof (prove)
using this:
generat = IO out (\<lambda>input. c input \<bind> (\<lambda>(ret, s'). inline callee (rpv ret) s'))

goal (1 subgoal):
 1. (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> (if consider out then 1 else 0) + (\<Squnion>input. interaction_bound' (c input \<bind> (\<lambda>(ret, s'). inline callee (rpv ret) s')))
[PROOF STEP]
by(auto simp add: plus_1_eSuc)
[PROOF STATE]
proof (state)
this:
(case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> (if consider out then 1 else 0) + (\<Squnion>input. interaction_bound' (c input \<bind> (\<lambda>(ret, s'). inline callee (rpv ret) s')))

goal (2 subgoals):
 1. consider' out' \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
 2. \<not> consider' out' \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> (if consider out then 1 else 0) + (\<Squnion>input. interaction_bound' (c input \<bind> (\<lambda>(ret, s'). inline callee (rpv ret) s')))

goal (2 subgoals):
 1. consider' out' \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
 2. \<not> consider' out' \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
[PROOF STEP]
have "?sup \<le> (SUP input. interaction_bound consider (c input) + (SUP (ret, s') \<in> results'_gpv (c input). interaction_bound' (inline callee (rpv ret) s')))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Squnion>input. interaction_bound' (c input \<bind> (\<lambda>(ret, s'). inline callee (rpv ret) s'))) \<le> (\<Squnion>input. interaction_bound consider (c input) + (\<Squnion>(ret, s')\<in>results'_gpv (c input). interaction_bound' (inline callee (rpv ret) s')))
[PROOF STEP]
unfolding split_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Squnion>input. interaction_bound' (c input \<bind> (\<lambda>p. inline callee (rpv (fst p)) (snd p)))) \<le> (\<Squnion>input. interaction_bound consider (c input) + (\<Squnion>p\<in>results'_gpv (c input). interaction_bound' (inline callee (rpv (fst p)) (snd p))))
[PROOF STEP]
by(rule SUP_mono)(blast intro: step.IH)
[PROOF STATE]
proof (state)
this:
(\<Squnion>input. interaction_bound' (c input \<bind> (\<lambda>(ret, s'). inline callee (rpv ret) s'))) \<le> (\<Squnion>input. interaction_bound consider (c input) + (\<Squnion>(ret, s')\<in>results'_gpv (c input). interaction_bound' (inline callee (rpv ret) s')))

goal (2 subgoals):
 1. consider' out' \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
 2. \<not> consider' out' \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(\<Squnion>input. interaction_bound' (c input \<bind> (\<lambda>(ret, s'). inline callee (rpv ret) s'))) \<le> (\<Squnion>input. interaction_bound consider (c input) + (\<Squnion>(ret, s')\<in>results'_gpv (c input). interaction_bound' (inline callee (rpv ret) s')))

goal (2 subgoals):
 1. consider' out' \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
 2. \<not> consider' out' \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
[PROOF STEP]
have "\<dots> \<le> (SUP input. interaction_bound consider (c input) + (SUP (ret, s') \<in> results'_gpv (c input). (p - 1) * q))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Squnion>input. interaction_bound consider (c input) + (\<Squnion>(ret, s')\<in>results'_gpv (c input). interaction_bound' (inline callee (rpv ret) s'))) \<le> (\<Squnion>input. interaction_bound consider (c input) + (\<Squnion>(ret, s')\<in>results'_gpv (c input). (p - 1) * q))
[PROOF STEP]
using rpv
[PROOF STATE]
proof (prove)
using this:
interaction_bounded_by consider' (rpv ?x1) (p - 1)

goal (1 subgoal):
 1. (\<Squnion>input. interaction_bound consider (c input) + (\<Squnion>(ret, s')\<in>results'_gpv (c input). interaction_bound' (inline callee (rpv ret) s'))) \<le> (\<Squnion>input. interaction_bound consider (c input) + (\<Squnion>(ret, s')\<in>results'_gpv (c input). (p - 1) * q))
[PROOF STEP]
by(auto intro!: SUP_mono rev_bexI add_mono step.IH)
[PROOF STATE]
proof (state)
this:
(\<Squnion>input. interaction_bound consider (c input) + (\<Squnion>(ret, s')\<in>results'_gpv (c input). interaction_bound' (inline callee (rpv ret) s'))) \<le> (\<Squnion>input. interaction_bound consider (c input) + (\<Squnion>(ret, s')\<in>results'_gpv (c input). (p - 1) * q))

goal (2 subgoals):
 1. consider' out' \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
 2. \<not> consider' out' \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(\<Squnion>input. interaction_bound consider (c input) + (\<Squnion>(ret, s')\<in>results'_gpv (c input). interaction_bound' (inline callee (rpv ret) s'))) \<le> (\<Squnion>input. interaction_bound consider (c input) + (\<Squnion>(ret, s')\<in>results'_gpv (c input). (p - 1) * q))

goal (2 subgoals):
 1. consider' out' \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
 2. \<not> consider' out' \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
[PROOF STEP]
have "\<dots> \<le> (SUP input. interaction_bound consider (c input) + (p - 1) * q)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Squnion>input. interaction_bound consider (c input) + (\<Squnion>(ret, s')\<in>results'_gpv (c input). (p - 1) * q)) \<le> (\<Squnion>input. interaction_bound consider (c input) + (p - 1) * q)
[PROOF STEP]
apply(auto simp add: SUP_constant bot_enat_def intro!: SUP_mono)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>x. results'_gpv (c x) = {} \<Longrightarrow> \<exists>m. interaction_bound consider (c x) \<le> interaction_bound consider (c m) + (p - 1) * q
 2. \<And>x a b i. \<lbrakk>\<forall>m. \<not> interaction_bound consider (c x) \<le> interaction_bound consider (c m); (a, b) \<in> results'_gpv (c x); (p - 1) * q = enat i\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply(metis add.right_neutral add_mono i0_lb order_refl)+
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
(\<Squnion>input. interaction_bound consider (c input) + (\<Squnion>(ret, s')\<in>results'_gpv (c input). (p - 1) * q)) \<le> (\<Squnion>input. interaction_bound consider (c input) + (p - 1) * q)

goal (2 subgoals):
 1. consider' out' \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
 2. \<not> consider' out' \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(\<Squnion>input. interaction_bound consider (c input) + (\<Squnion>(ret, s')\<in>results'_gpv (c input). (p - 1) * q)) \<le> (\<Squnion>input. interaction_bound consider (c input) + (p - 1) * q)

goal (2 subgoals):
 1. consider' out' \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
 2. \<not> consider' out' \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
[PROOF STEP]
have "\<dots> \<le> (SUP input :: 'ret'. (if consider out then q - 1 else q) + (p - 1) * q)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Squnion>input. interaction_bound consider (c input) + (p - 1) * q) \<le> (\<Squnion>input. (if consider out then q - 1 else q) + (p - 1) * q)
[PROOF STEP]
apply(rule SUP_mono rev_bexI UNIV_I add_mono)+
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>input. input \<in> UNIV \<Longrightarrow> interaction_bound consider (c input) \<le> (if consider out then q - 1 else q)
 2. \<And>input. input \<in> UNIV \<Longrightarrow> (p - 1) * q \<le> (p - 1) * q
[PROOF STEP]
using c
[PROOF STATE]
proof (prove)
using this:
if consider out then q \<noteq> 0 \<and> interaction_bounded_by consider (c ?input1) (q - 1) else interaction_bounded_by consider (c ?input1) q

goal (2 subgoals):
 1. \<And>input. input \<in> UNIV \<Longrightarrow> interaction_bound consider (c input) \<le> (if consider out then q - 1 else q)
 2. \<And>input. input \<in> UNIV \<Longrightarrow> (p - 1) * q \<le> (p - 1) * q
[PROOF STEP]
apply(auto simp add: interaction_bounded_by.simps)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
(\<Squnion>input. interaction_bound consider (c input) + (p - 1) * q) \<le> (\<Squnion>input. (if consider out then q - 1 else q) + (p - 1) * q)

goal (2 subgoals):
 1. consider' out' \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
 2. \<not> consider' out' \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(\<Squnion>input. interaction_bound consider (c input) + (p - 1) * q) \<le> (\<Squnion>input. (if consider out then q - 1 else q) + (p - 1) * q)

goal (2 subgoals):
 1. consider' out' \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
 2. \<not> consider' out' \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
[PROOF STEP]
have "\<dots> = (if consider out then q - 1 else q) + (p - 1) * q"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Squnion>input. (if consider out then q - 1 else q) + (p - 1) * q) = (if consider out then q - 1 else q) + (p - 1) * q
[PROOF STEP]
by(simp add: SUP_constant)
[PROOF STATE]
proof (state)
this:
(\<Squnion>input. (if consider out then q - 1 else q) + (p - 1) * q) = (if consider out then q - 1 else q) + (p - 1) * q

goal (2 subgoals):
 1. consider' out' \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
 2. \<not> consider' out' \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>\<And>x y. x \<le> y \<Longrightarrow> (if consider out then 1 else 0) + x \<le> (if consider out then 1 else 0) + y; \<And>x y. x \<le> y \<Longrightarrow> (if consider out then 1 else 0) + x \<le> (if consider out then 1 else 0) + y; \<And>x y. x \<le> y \<Longrightarrow> (if consider out then 1 else 0) + x \<le> (if consider out then 1 else 0) + y; \<And>x y. x \<le> y \<Longrightarrow> (if consider out then 1 else 0) + x \<le> (if consider out then 1 else 0) + y\<rbrakk> \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> (if consider out then 1 else 0) + ((if consider out then q - 1 else q) + (p - 1) * q)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<And>x y. x \<le> y \<Longrightarrow> (if consider out then 1 else 0) + x \<le> (if consider out then 1 else 0) + y; \<And>x y. x \<le> y \<Longrightarrow> (if consider out then 1 else 0) + x \<le> (if consider out then 1 else 0) + y; \<And>x y. x \<le> y \<Longrightarrow> (if consider out then 1 else 0) + x \<le> (if consider out then 1 else 0) + y; \<And>x y. x \<le> y \<Longrightarrow> (if consider out then 1 else 0) + x \<le> (if consider out then 1 else 0) + y\<rbrakk> \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> (if consider out then 1 else 0) + ((if consider out then q - 1 else q) + (p - 1) * q)

goal (1 subgoal):
 1. (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
[PROOF STEP]
apply(rule order_trans)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>x y. x \<le> y \<Longrightarrow> (if consider out then 1 else 0) + x \<le> (if consider out then 1 else 0) + y
 2. \<And>x y. x \<le> y \<Longrightarrow> (if consider out then 1 else 0) + x \<le> (if consider out then 1 else 0) + y
 3. \<And>x y. x \<le> y \<Longrightarrow> (if consider out then 1 else 0) + x \<le> (if consider out then 1 else 0) + y
 4. \<And>x y. x \<le> y \<Longrightarrow> (if consider out then 1 else 0) + x \<le> (if consider out then 1 else 0) + y
 5. (if consider out then 1 else 0) + ((if consider out then q - 1 else q) + (p - 1) * q) \<le> p * q
[PROOF STEP]
prefer 5
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. (if consider out then 1 else 0) + ((if consider out then q - 1 else q) + (p - 1) * q) \<le> p * q
 2. \<And>x y. x \<le> y \<Longrightarrow> (if consider out then 1 else 0) + x \<le> (if consider out then 1 else 0) + y
 3. \<And>x y. x \<le> y \<Longrightarrow> (if consider out then 1 else 0) + x \<le> (if consider out then 1 else 0) + y
 4. \<And>x y. x \<le> y \<Longrightarrow> (if consider out then 1 else 0) + x \<le> (if consider out then 1 else 0) + y
 5. \<And>x y. x \<le> y \<Longrightarrow> (if consider out then 1 else 0) + x \<le> (if consider out then 1 else 0) + y
[PROOF STEP]
using p c
[PROOF STATE]
proof (prove)
using this:
p \<noteq> 0
if consider out then q \<noteq> 0 \<and> interaction_bounded_by consider (c ?input1) (q - 1) else interaction_bounded_by consider (c ?input1) q

goal (5 subgoals):
 1. (if consider out then 1 else 0) + ((if consider out then q - 1 else q) + (p - 1) * q) \<le> p * q
 2. \<And>x y. x \<le> y \<Longrightarrow> (if consider out then 1 else 0) + x \<le> (if consider out then 1 else 0) + y
 3. \<And>x y. x \<le> y \<Longrightarrow> (if consider out then 1 else 0) + x \<le> (if consider out then 1 else 0) + y
 4. \<And>x y. x \<le> y \<Longrightarrow> (if consider out then 1 else 0) + x \<le> (if consider out then 1 else 0) + y
 5. \<And>x y. x \<le> y \<Longrightarrow> (if consider out then 1 else 0) + x \<le> (if consider out then 1 else 0) + y
[PROOF STEP]
apply(cases p; cases q)
[PROOF STATE]
proof (prove)
goal (8 subgoals):
 1. \<And>nat nata. \<lbrakk>p \<noteq> 0; \<And>input. if consider out then q \<noteq> 0 \<and> interaction_bounded_by consider (c input) (q - 1) else interaction_bounded_by consider (c input) q; p = enat nat; p \<noteq> 0; \<And>input. if consider out then q \<noteq> 0 \<and> interaction_bounded_by consider (c input) (q - 1) else interaction_bounded_by consider (c input) q; q = enat nata\<rbrakk> \<Longrightarrow> (if consider out then 1 else 0) + ((if consider out then q - 1 else q) + (p - 1) * q) \<le> p * q
 2. \<And>nat. \<lbrakk>p \<noteq> 0; \<And>input. if consider out then q \<noteq> 0 \<and> interaction_bounded_by consider (c input) (q - 1) else interaction_bounded_by consider (c input) q; p = enat nat; p \<noteq> 0; \<And>input. if consider out then q \<noteq> 0 \<and> interaction_bounded_by consider (c input) (q - 1) else interaction_bounded_by consider (c input) q; q = \<infinity>\<rbrakk> \<Longrightarrow> (if consider out then 1 else 0) + ((if consider out then q - 1 else q) + (p - 1) * q) \<le> p * q
 3. \<And>nat. \<lbrakk>p \<noteq> 0; \<And>input. if consider out then q \<noteq> 0 \<and> interaction_bounded_by consider (c input) (q - 1) else interaction_bounded_by consider (c input) q; p = \<infinity>; p \<noteq> 0; \<And>input. if consider out then q \<noteq> 0 \<and> interaction_bounded_by consider (c input) (q - 1) else interaction_bounded_by consider (c input) q; q = enat nat\<rbrakk> \<Longrightarrow> (if consider out then 1 else 0) + ((if consider out then q - 1 else q) + (p - 1) * q) \<le> p * q
 4. \<lbrakk>p \<noteq> 0; \<And>input. if consider out then q \<noteq> 0 \<and> interaction_bounded_by consider (c input) (q - 1) else interaction_bounded_by consider (c input) q; p = \<infinity>; p \<noteq> 0; \<And>input. if consider out then q \<noteq> 0 \<and> interaction_bounded_by consider (c input) (q - 1) else interaction_bounded_by consider (c input) q; q = \<infinity>\<rbrakk> \<Longrightarrow> (if consider out then 1 else 0) + ((if consider out then q - 1 else q) + (p - 1) * q) \<le> p * q
 5. \<And>x y. x \<le> y \<Longrightarrow> (if consider out then 1 else 0) + x \<le> (if consider out then 1 else 0) + y
 6. \<And>x y. x \<le> y \<Longrightarrow> (if consider out then 1 else 0) + x \<le> (if consider out then 1 else 0) + y
 7. \<And>x y. x \<le> y \<Longrightarrow> (if consider out then 1 else 0) + x \<le> (if consider out then 1 else 0) + y
 8. \<And>x y. x \<le> y \<Longrightarrow> (if consider out then 1 else 0) + x \<le> (if consider out then 1 else 0) + y
[PROOF STEP]
apply(auto simp add: one_enat_def algebra_simps Suc_leI)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
(case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q

goal (1 subgoal):
 1. \<not> consider' out' \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> consider' out' \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
\<not> consider' out'

goal (1 subgoal):
 1. \<not> consider' out' \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
[PROOF STEP]
with interaction_bounded_by_inline1[OF out' step.prems q ignore]
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>\<And>s x. consider' x \<Longrightarrow> consider' x; \<And>s x. \<not> consider' x \<Longrightarrow> \<not> consider' x\<rbrakk> \<Longrightarrow> if consider' out' then (if consider out then q \<noteq> 0 \<and> interaction_bounded_by consider (c ?input) (q - 1) else interaction_bounded_by consider (c ?input) q) \<and> p \<noteq> 0 \<and> interaction_bounded_by consider' (rpv ?x) (p - 1) else \<not> consider out \<and> interaction_bounded_by consider (c ?input) 0 \<and> interaction_bounded_by consider' (rpv ?x) p
\<not> consider' out'
[PROOF STEP]
have out: "\<not> consider out" and zero: "\<And>input. interaction_bounded_by consider (c input) 0"
            and rpv: "\<And>x. interaction_bounded_by consider' (rpv x) p"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<And>s x. consider' x \<Longrightarrow> consider' x; \<And>s x. \<not> consider' x \<Longrightarrow> \<not> consider' x\<rbrakk> \<Longrightarrow> if consider' out' then (if consider out then q \<noteq> 0 \<and> interaction_bounded_by consider (c ?input) (q - 1) else interaction_bounded_by consider (c ?input) q) \<and> p \<noteq> 0 \<and> interaction_bounded_by consider' (rpv ?x) (p - 1) else \<not> consider out \<and> interaction_bounded_by consider (c ?input) 0 \<and> interaction_bounded_by consider' (rpv ?x) p
\<not> consider' out'

goal (1 subgoal):
 1. \<not> consider out &&& (\<And>input. interaction_bounded_by consider (c input) 0) &&& (\<And>x. interaction_bounded_by consider' (rpv x) p)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<not> consider out
interaction_bounded_by consider (c ?input1) 0
interaction_bounded_by consider' (rpv ?x1) p

goal (1 subgoal):
 1. \<not> consider' out' \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
[PROOF STEP]
have "?lhs generat \<le> (SUP input. interaction_bound' (bind_gpv (c input) (\<lambda>(ret, s'). inline callee (rpv ret) s')))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> (\<Squnion>input. interaction_bound' (c input \<bind> (\<lambda>(ret, s'). inline callee (rpv ret) s')))
[PROOF STEP]
using IO(1) out
[PROOF STATE]
proof (prove)
using this:
generat = IO out (\<lambda>input. c input \<bind> (\<lambda>(ret, s'). inline callee (rpv ret) s'))
\<not> consider out

goal (1 subgoal):
 1. (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> (\<Squnion>input. interaction_bound' (c input \<bind> (\<lambda>(ret, s'). inline callee (rpv ret) s')))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> (\<Squnion>input. interaction_bound' (c input \<bind> (\<lambda>(ret, s'). inline callee (rpv ret) s')))

goal (1 subgoal):
 1. \<not> consider' out' \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> (\<Squnion>input. interaction_bound' (c input \<bind> (\<lambda>(ret, s'). inline callee (rpv ret) s')))

goal (1 subgoal):
 1. \<not> consider' out' \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
[PROOF STEP]
have "\<dots> \<le> (SUP input. interaction_bound consider (c input) + (SUP (ret, s') \<in> results'_gpv (c input). interaction_bound' (inline callee (rpv ret) s')))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Squnion>input. interaction_bound' (c input \<bind> (\<lambda>(ret, s'). inline callee (rpv ret) s'))) \<le> (\<Squnion>input. interaction_bound consider (c input) + (\<Squnion>(ret, s')\<in>results'_gpv (c input). interaction_bound' (inline callee (rpv ret) s')))
[PROOF STEP]
unfolding split_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Squnion>input. interaction_bound' (c input \<bind> (\<lambda>p. inline callee (rpv (fst p)) (snd p)))) \<le> (\<Squnion>input. interaction_bound consider (c input) + (\<Squnion>p\<in>results'_gpv (c input). interaction_bound' (inline callee (rpv (fst p)) (snd p))))
[PROOF STEP]
by(rule SUP_mono)(blast intro: step.IH)
[PROOF STATE]
proof (state)
this:
(\<Squnion>input. interaction_bound' (c input \<bind> (\<lambda>(ret, s'). inline callee (rpv ret) s'))) \<le> (\<Squnion>input. interaction_bound consider (c input) + (\<Squnion>(ret, s')\<in>results'_gpv (c input). interaction_bound' (inline callee (rpv ret) s')))

goal (1 subgoal):
 1. \<not> consider' out' \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(\<Squnion>input. interaction_bound' (c input \<bind> (\<lambda>(ret, s'). inline callee (rpv ret) s'))) \<le> (\<Squnion>input. interaction_bound consider (c input) + (\<Squnion>(ret, s')\<in>results'_gpv (c input). interaction_bound' (inline callee (rpv ret) s')))

goal (1 subgoal):
 1. \<not> consider' out' \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
[PROOF STEP]
have "\<dots> \<le> (SUP input. (SUP (ret, s') \<in> results'_gpv (c input). p * q))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Squnion>input. interaction_bound consider (c input) + (\<Squnion>(ret, s')\<in>results'_gpv (c input). interaction_bound' (inline callee (rpv ret) s'))) \<le> (\<Squnion>input. \<Squnion>(ret, s')\<in>results'_gpv (c input). p * q)
[PROOF STEP]
using rpv zero
[PROOF STATE]
proof (prove)
using this:
interaction_bounded_by consider' (rpv ?x1) p
interaction_bounded_by consider (c ?input1) 0

goal (1 subgoal):
 1. (\<Squnion>input. interaction_bound consider (c input) + (\<Squnion>(ret, s')\<in>results'_gpv (c input). interaction_bound' (inline callee (rpv ret) s'))) \<le> (\<Squnion>input. \<Squnion>(ret, s')\<in>results'_gpv (c input). p * q)
[PROOF STEP]
by(auto intro!: SUP_mono rev_bexI add_mono step.IH simp add: interaction_bounded_by_0)
[PROOF STATE]
proof (state)
this:
(\<Squnion>input. interaction_bound consider (c input) + (\<Squnion>(ret, s')\<in>results'_gpv (c input). interaction_bound' (inline callee (rpv ret) s'))) \<le> (\<Squnion>input. \<Squnion>(ret, s')\<in>results'_gpv (c input). p * q)

goal (1 subgoal):
 1. \<not> consider' out' \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(\<Squnion>input. interaction_bound consider (c input) + (\<Squnion>(ret, s')\<in>results'_gpv (c input). interaction_bound' (inline callee (rpv ret) s'))) \<le> (\<Squnion>input. \<Squnion>(ret, s')\<in>results'_gpv (c input). p * q)

goal (1 subgoal):
 1. \<not> consider' out' \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
[PROOF STEP]
have "\<dots> \<le> (SUP input :: 'ret'. p * q)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Squnion>input. \<Squnion>(ret, s')\<in>results'_gpv (c input). p * q) \<le> (\<Squnion>input. p * q)
[PROOF STEP]
by(rule SUP_mono rev_bexI)+(auto simp add: SUP_constant)
[PROOF STATE]
proof (state)
this:
(\<Squnion>input. \<Squnion>(ret, s')\<in>results'_gpv (c input). p * q) \<le> (\<Squnion>input. p * q)

goal (1 subgoal):
 1. \<not> consider' out' \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(\<Squnion>input. \<Squnion>(ret, s')\<in>results'_gpv (c input). p * q) \<le> (\<Squnion>input. p * q)

goal (1 subgoal):
 1. \<not> consider' out' \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
[PROOF STEP]
have "\<dots> = p * q"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Squnion>input. p * q) = p * q
[PROOF STEP]
by(simp add: SUP_constant)
[PROOF STATE]
proof (state)
this:
(\<Squnion>input. p * q) = p * q

goal (1 subgoal):
 1. \<not> consider' out' \<Longrightarrow> (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
(case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
(case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q

goal (1 subgoal):
 1. (case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
(case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
(case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
(case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
(\<Squnion>generat\<in>set_spmf (the_gpv (inline callee gpv s)). case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) \<le> p * q

goal (2 subgoals):
 1. \<And>gpv' f. 0 \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. 0)
 2. \<And>interaction_bound' gpv' f. \<lbrakk>\<And>gpv s p. interaction_bounded_by consider' gpv p \<Longrightarrow> interaction_bound' (inline callee gpv s) \<le> p * q; \<And>gpv' f. interaction_bound' (gpv' \<bind> f) \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. interaction_bound' (f x)); \<And>gpv. interaction_bound' gpv \<le> interaction_bound consider gpv; \<And>gpv. interaction_bound' gpv \<le> \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv gpv))\<rbrakk> \<Longrightarrow> \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv (gpv' \<bind> f))) \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv (f x))))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>gpv' f. 0 \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. 0)
 2. \<And>interaction_bound' gpv' f. \<lbrakk>\<And>gpv s p. interaction_bounded_by consider' gpv p \<Longrightarrow> interaction_bound' (inline callee gpv s) \<le> p * q; \<And>gpv' f. interaction_bound' (gpv' \<bind> f) \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. interaction_bound' (f x)); \<And>gpv. interaction_bound' gpv \<le> interaction_bound consider gpv; \<And>gpv. interaction_bound' gpv \<le> \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv gpv))\<rbrakk> \<Longrightarrow> \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv (gpv' \<bind> f))) \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv (f x))))
[PROOF STEP]
case bottom
[PROOF STATE]
proof (state)
this:

goal (2 subgoals):
 1. \<And>gpv' f. 0 \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. 0)
 2. \<And>interaction_bound' gpv' f. \<lbrakk>\<And>gpv s p. interaction_bounded_by consider' gpv p \<Longrightarrow> interaction_bound' (inline callee gpv s) \<le> p * q; \<And>gpv' f. interaction_bound' (gpv' \<bind> f) \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. interaction_bound' (f x)); \<And>gpv. interaction_bound' gpv \<le> interaction_bound consider gpv; \<And>gpv. interaction_bound' gpv \<le> \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv gpv))\<rbrakk> \<Longrightarrow> \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv (gpv' \<bind> f))) \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv (f x))))
[PROOF STEP]
case 2
[PROOF STATE]
proof (state)
this:

goal (2 subgoals):
 1. \<And>gpv' f. 0 \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. 0)
 2. \<And>interaction_bound' gpv' f. \<lbrakk>\<And>gpv s p. interaction_bounded_by consider' gpv p \<Longrightarrow> interaction_bound' (inline callee gpv s) \<le> p * q; \<And>gpv' f. interaction_bound' (gpv' \<bind> f) \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. interaction_bound' (f x)); \<And>gpv. interaction_bound' gpv \<le> interaction_bound consider gpv; \<And>gpv. interaction_bound' gpv \<le> \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv gpv))\<rbrakk> \<Longrightarrow> \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv (gpv' \<bind> f))) \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv (f x))))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. 0)
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
0 \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. 0)

goal (1 subgoal):
 1. \<And>interaction_bound' gpv' f. \<lbrakk>\<And>gpv s p. interaction_bounded_by consider' gpv p \<Longrightarrow> interaction_bound' (inline callee gpv s) \<le> p * q; \<And>gpv' f. interaction_bound' (gpv' \<bind> f) \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. interaction_bound' (f x)); \<And>gpv. interaction_bound' gpv \<le> interaction_bound consider gpv; \<And>gpv. interaction_bound' gpv \<le> \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv gpv))\<rbrakk> \<Longrightarrow> \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv (gpv' \<bind> f))) \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv (f x))))
[PROOF STEP]
case step
[PROOF STATE]
proof (state)
this:
interaction_bounded_by consider' ?gpv1 ?p1 \<Longrightarrow> interaction_bound'_ (inline callee ?gpv1 ?s1) \<le> ?p1 * q
interaction_bound'_ (?gpv'1 \<bind> ?f1) \<le> interaction_bound consider ?gpv'1 + (\<Squnion>x\<in>results'_gpv ?gpv'1. interaction_bound'_ (?f1 x))
interaction_bound'_ ?gpv1 \<le> interaction_bound consider ?gpv1
interaction_bound'_ ?gpv1 \<le> (\<Squnion>generat\<in>set_spmf (the_gpv ?gpv1). case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound'_ (c input)) else \<Squnion>input. interaction_bound'_ (c input))

goal (1 subgoal):
 1. \<And>interaction_bound' gpv' f. \<lbrakk>\<And>gpv s p. interaction_bounded_by consider' gpv p \<Longrightarrow> interaction_bound' (inline callee gpv s) \<le> p * q; \<And>gpv' f. interaction_bound' (gpv' \<bind> f) \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. interaction_bound' (f x)); \<And>gpv. interaction_bound' gpv \<le> interaction_bound consider gpv; \<And>gpv. interaction_bound' gpv \<le> \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv gpv))\<rbrakk> \<Longrightarrow> \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv (gpv' \<bind> f))) \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv (f x))))
[PROOF STEP]
case 2
[PROOF STATE]
proof (state)
this:

goal (1 subgoal):
 1. \<And>interaction_bound' gpv' f. \<lbrakk>\<And>gpv s p. interaction_bounded_by consider' gpv p \<Longrightarrow> interaction_bound' (inline callee gpv s) \<le> p * q; \<And>gpv' f. interaction_bound' (gpv' \<bind> f) \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. interaction_bound' (f x)); \<And>gpv. interaction_bound' gpv \<le> interaction_bound consider gpv; \<And>gpv. interaction_bound' gpv \<le> \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv gpv))\<rbrakk> \<Longrightarrow> \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv (gpv' \<bind> f))) \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. \<Squnion> (case_generat (\<lambda>x. 0) (\<lambda>out c. if consider out then eSuc (\<Squnion>input. interaction_bound' (c input)) else \<Squnion>input. interaction_bound' (c input)) ` set_spmf (the_gpv (f x))))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Squnion>generat\<in>set_spmf (the_gpv (gpv' \<bind> f)). case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound'_ (c input)) else \<Squnion>input. interaction_bound'_ (c input)) \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. \<Squnion>generat\<in>set_spmf (the_gpv (f x)). case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound'_ (c input)) else \<Squnion>input. interaction_bound'_ (c input))
[PROOF STEP]
using step
[PROOF STATE]
proof (prove)
using this:
interaction_bounded_by consider' ?gpv1 ?p1 \<Longrightarrow> interaction_bound'_ (inline callee ?gpv1 ?s1) \<le> ?p1 * q
interaction_bound'_ (?gpv'1 \<bind> ?f1) \<le> interaction_bound consider ?gpv'1 + (\<Squnion>x\<in>results'_gpv ?gpv'1. interaction_bound'_ (?f1 x))
interaction_bound'_ ?gpv1 \<le> interaction_bound consider ?gpv1
interaction_bound'_ ?gpv1 \<le> (\<Squnion>generat\<in>set_spmf (the_gpv ?gpv1). case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound'_ (c input)) else \<Squnion>input. interaction_bound'_ (c input))

goal (1 subgoal):
 1. (\<Squnion>generat\<in>set_spmf (the_gpv (gpv' \<bind> f)). case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound'_ (c input)) else \<Squnion>input. interaction_bound'_ (c input)) \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. \<Squnion>generat\<in>set_spmf (the_gpv (f x)). case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound'_ (c input)) else \<Squnion>input. interaction_bound'_ (c input))
[PROOF STEP]
by -(rule interaction_bound_bind_step)
[PROOF STATE]
proof (state)
this:
(\<Squnion>generat\<in>set_spmf (the_gpv (gpv' \<bind> f)). case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound'_ (c input)) else \<Squnion>input. interaction_bound'_ (c input)) \<le> interaction_bound consider gpv' + (\<Squnion>x\<in>results'_gpv gpv'. \<Squnion>generat\<in>set_spmf (the_gpv (f x)). case generat of Pure x \<Rightarrow> 0 | IO out c \<Rightarrow> if consider out then eSuc (\<Squnion>input. interaction_bound'_ (c input)) else \<Squnion>input. interaction_bound'_ (c input))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
interaction_bounded_by consider' gpv p \<Longrightarrow> interaction_bound consider (inline callee gpv s) \<le> p * q
interaction_bound consider (?gpv'1 \<bind> ?f1) \<le> interaction_bound consider ?gpv'1 + (\<Squnion>x\<in>results'_gpv ?gpv'1. interaction_bound consider (?f1 x))

goal (1 subgoal):
 1. interaction_bound consider (inline callee gpv s) \<le> p * q
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
interaction_bounded_by consider' gpv p \<Longrightarrow> interaction_bound consider (inline callee gpv s) \<le> p * q
interaction_bound consider (?gpv'1 \<bind> ?f1) \<le> interaction_bound consider ?gpv'1 + (\<Squnion>x\<in>results'_gpv ?gpv'1. interaction_bound consider (?f1 x))
[PROOF STEP]
show "interaction_bound consider (inline callee gpv s) \<le> p * q"
[PROOF STATE]
proof (prove)
using this:
interaction_bounded_by consider' gpv p \<Longrightarrow> interaction_bound consider (inline callee gpv s) \<le> p * q
interaction_bound consider (?gpv'1 \<bind> ?f1) \<le> interaction_bound consider ?gpv'1 + (\<Squnion>x\<in>results'_gpv ?gpv'1. interaction_bound consider (?f1 x))

goal (1 subgoal):
 1. interaction_bound consider (inline callee gpv s) \<le> p * q
[PROOF STEP]
using p
[PROOF STATE]
proof (prove)
using this:
interaction_bounded_by consider' gpv p \<Longrightarrow> interaction_bound consider (inline callee gpv s) \<le> p * q
interaction_bound consider (?gpv'1 \<bind> ?f1) \<le> interaction_bound consider ?gpv'1 + (\<Squnion>x\<in>results'_gpv ?gpv'1. interaction_bound consider (?f1 x))
interaction_bounded_by consider' gpv p

goal (1 subgoal):
 1. interaction_bound consider (inline callee gpv s) \<le> p * q
[PROOF STEP]
by -
[PROOF STATE]
proof (state)
this:
interaction_bound consider (inline callee gpv s) \<le> p * q

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma A
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. A
[PROOF STEP]
apply (iff 1)?
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. A
[PROOF STEP]
oops