[STATEMENT]
lemma drai_param[param]:
    "(drai, drai) \<in> \<langle>L\<rangle> list_rel \<rightarrow> S \<rightarrow> (L \<rightarrow> S \<rightarrow> S) \<rightarrow>
      \<langle>rabin_rel S\<rangle> list_rel \<rightarrow> \<langle>L, S\<rangle> drai_rel"
    "(alphabeti, alphabeti) \<in> \<langle>L, S\<rangle> drai_rel \<rightarrow> \<langle>L\<rangle> list_rel"
    "(initiali, initiali) \<in> \<langle>L, S\<rangle> drai_rel \<rightarrow> S"
    "(transitioni, transitioni) \<in> \<langle>L, S\<rangle> drai_rel \<rightarrow> L \<rightarrow> S \<rightarrow> S"
    "(conditioni, conditioni) \<in> \<langle>L, S\<rangle> drai_rel \<rightarrow> \<langle>rabin_rel S\<rangle> list_rel"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((drai, drai) \<in> \<langle>L\<rangle>list_rel \<rightarrow> S \<rightarrow> (L \<rightarrow> S \<rightarrow> S) \<rightarrow> \<langle>(S \<rightarrow> bool_rel) \<times>\<^sub>r (S \<rightarrow> bool_rel)\<rangle>list_rel \<rightarrow> \<langle>L, S\<rangle>drai_rel &&& (alphabeti, alphabeti) \<in> \<langle>L, S\<rangle>drai_rel \<rightarrow> \<langle>L\<rangle>list_rel) &&& (initiali, initiali) \<in> \<langle>L, S\<rangle>drai_rel \<rightarrow> S &&& (transitioni, transitioni) \<in> \<langle>L, S\<rangle>drai_rel \<rightarrow> L \<rightarrow> S \<rightarrow> S &&& (conditioni, conditioni) \<in> \<langle>L, S\<rangle>drai_rel \<rightarrow> \<langle>(S \<rightarrow> bool_rel) \<times>\<^sub>r (S \<rightarrow> bool_rel)\<rangle>list_rel
[PROOF STEP]
unfolding drai_rel_def fun_rel_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((drai, drai) \<in> {(f, f'). \<forall>(a, a')\<in>\<langle>L\<rangle>list_rel. (f a, f' a') \<in> {(f, f'). \<forall>(a, a')\<in>S. (f a, f' a') \<in> {(f, f'). \<forall>(a, a')\<in>{(f, f'). \<forall>(a, a')\<in>L. (f a, f' a') \<in> {(f, f'). \<forall>(a, a')\<in>S. (f a, f' a') \<in> S}}. (f a, f' a') \<in> {(f, f'). \<forall>(a, a')\<in>\<langle>{(f, f'). \<forall>(a, a')\<in>S. (f a, f' a') \<in> bool_rel} \<times>\<^sub>r {(f, f'). \<forall>(a, a')\<in>S. (f a, f' a') \<in> bool_rel}\<rangle>list_rel. (f a, f' a') \<in> {(A\<^sub>1, A\<^sub>2). (alphabeti A\<^sub>1, alphabeti A\<^sub>2) \<in> \<langle>L\<rangle>list_rel \<and> (initiali A\<^sub>1, initiali A\<^sub>2) \<in> S \<and> (transitioni A\<^sub>1, transitioni A\<^sub>2) \<in> {(f, f'). \<forall>(a, a')\<in>L. (f a, f' a') \<in> {(f, f'). \<forall>(a, a')\<in>S. (f a, f' a') \<in> S}} \<and> (conditioni A\<^sub>1, conditioni A\<^sub>2) \<in> \<langle>{(f, f'). \<forall>(a, a')\<in>S. (f a, f' a') \<in> bool_rel} \<times>\<^sub>r {(f, f'). \<forall>(a, a')\<in>S. (f a, f' a') \<in> bool_rel}\<rangle>list_rel}}}}} &&& (alphabeti, alphabeti) \<in> {(f, f'). \<forall>(a, a')\<in>{(A\<^sub>1, A\<^sub>2). (alphabeti A\<^sub>1, alphabeti A\<^sub>2) \<in> \<langle>L\<rangle>list_rel \<and> (initiali A\<^sub>1, initiali A\<^sub>2) \<in> S \<and> (transitioni A\<^sub>1, transitioni A\<^sub>2) \<in> {(f, f'). \<forall>(a, a')\<in>L. (f a, f' a') \<in> {(f, f'). \<forall>(a, a')\<in>S. (f a, f' a') \<in> S}} \<and> (conditioni A\<^sub>1, conditioni A\<^sub>2) \<in> \<langle>{(f, f'). \<forall>(a, a')\<in>S. (f a, f' a') \<in> bool_rel} \<times>\<^sub>r {(f, f'). \<forall>(a, a')\<in>S. (f a, f' a') \<in> bool_rel}\<rangle>list_rel}. (f a, f' a') \<in> \<langle>L\<rangle>list_rel}) &&& (initiali, initiali) \<in> {(f, f'). \<forall>(a, a')\<in>{(A\<^sub>1, A\<^sub>2). (alphabeti A\<^sub>1, alphabeti A\<^sub>2) \<in> \<langle>L\<rangle>list_rel \<and> (initiali A\<^sub>1, initiali A\<^sub>2) \<in> S \<and> (transitioni A\<^sub>1, transitioni A\<^sub>2) \<in> {(f, f'). \<forall>(a, a')\<in>L. (f a, f' a') \<in> {(f, f'). \<forall>(a, a')\<in>S. (f a, f' a') \<in> S}} \<and> (conditioni A\<^sub>1, conditioni A\<^sub>2) \<in> \<langle>{(f, f'). \<forall>(a, a')\<in>S. (f a, f' a') \<in> bool_rel} \<times>\<^sub>r {(f, f'). \<forall>(a, a')\<in>S. (f a, f' a') \<in> bool_rel}\<rangle>list_rel}. (f a, f' a') \<in> S} &&& (transitioni, transitioni) \<in> {(f, f'). \<forall>(a, a')\<in>{(A\<^sub>1, A\<^sub>2). (alphabeti A\<^sub>1, alphabeti A\<^sub>2) \<in> \<langle>L\<rangle>list_rel \<and> (initiali A\<^sub>1, initiali A\<^sub>2) \<in> S \<and> (transitioni A\<^sub>1, transitioni A\<^sub>2) \<in> {(f, f'). \<forall>(a, a')\<in>L. (f a, f' a') \<in> {(f, f'). \<forall>(a, a')\<in>S. (f a, f' a') \<in> S}} \<and> (conditioni A\<^sub>1, conditioni A\<^sub>2) \<in> \<langle>{(f, f'). \<forall>(a, a')\<in>S. (f a, f' a') \<in> bool_rel} \<times>\<^sub>r {(f, f'). \<forall>(a, a')\<in>S. (f a, f' a') \<in> bool_rel}\<rangle>list_rel}. (f a, f' a') \<in> {(f, f'). \<forall>(a, a')\<in>L. (f a, f' a') \<in> {(f, f'). \<forall>(a, a')\<in>S. (f a, f' a') \<in> S}}} &&& (conditioni, conditioni) \<in> {(f, f'). \<forall>(a, a')\<in>{(A\<^sub>1, A\<^sub>2). (alphabeti A\<^sub>1, alphabeti A\<^sub>2) \<in> \<langle>L\<rangle>list_rel \<and> (initiali A\<^sub>1, initiali A\<^sub>2) \<in> S \<and> (transitioni A\<^sub>1, transitioni A\<^sub>2) \<in> {(f, f'). \<forall>(a, a')\<in>L. (f a, f' a') \<in> {(f, f'). \<forall>(a, a')\<in>S. (f a, f' a') \<in> S}} \<and> (conditioni A\<^sub>1, conditioni A\<^sub>2) \<in> \<langle>{(f, f'). \<forall>(a, a')\<in>S. (f a, f' a') \<in> bool_rel} \<times>\<^sub>r {(f, f'). \<forall>(a, a')\<in>S. (f a, f' a') \<in> bool_rel}\<rangle>list_rel}. (f a, f' a') \<in> \<langle>{(f, f'). \<forall>(a, a')\<in>S. (f a, f' a') \<in> bool_rel} \<times>\<^sub>r {(f, f'). \<forall>(a, a')\<in>S. (f a, f' a') \<in> bool_rel}\<rangle>list_rel}
[PROOF STEP]
by auto


[STATEMENT]
lemma if_mred_heap_read_typedD:
  "multithreaded_base.init_fin final_expr (J_heap_base.mred addr2thread_id thread_id2addr spurious_wakeups empty_heap allocate (\<lambda>_ :: 'heap. typeof_addr) (heap_base.heap_read_typed (\<lambda>_ :: 'heap. typeof_addr) heap_read P) heap_write P) t xh ta x'h' \<longleftrightarrow>
   if_heap_read_typed final_expr (J_heap_base.mred addr2thread_id thread_id2addr spurious_wakeups empty_heap allocate (\<lambda>_ :: 'heap. typeof_addr) heap_read heap_write P) typeof_addr P t xh ta x'h'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. multithreaded_base.init_fin final_expr (\<lambda>t ((e, l), h) ta ((e', l'), h'). J_heap_base.red (\<lambda>x. x) (\<lambda>x. x) spurious_wakeups empty_heap allocate (\<lambda>_. typeof_addr) (heap_base.heap_read_typed (\<lambda>_. typeof_addr) heap_read P) heap_write (extTA2J P) P t e (h, l) ta e' (h', l')) t xh ta x'h' = if_heap_read_typed final_expr (\<lambda>t ((e, l), h) ta ((e', l'), h'). J_heap_base.red (\<lambda>x. x) (\<lambda>x. x) spurious_wakeups empty_heap allocate (\<lambda>_. typeof_addr) heap_read heap_write (extTA2J P) P t e (h, l) ta e' (h', l')) typeof_addr P t xh ta x'h'
[PROOF STEP]
unfolding multithreaded_base.init_fin.simps
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<exists>tb x m taa x' m'. t = tb \<and> xh = ((Running, x), m) \<and> ta = convert_TA_initial (convert_obs_initial taa) \<and> x'h' = ((Running, x'), m') \<and> (case (x, m) of (x, xa) \<Rightarrow> (case x of (e, l) \<Rightarrow> \<lambda>h ta ((e', l'), h'). J_heap_base.red (\<lambda>x. x) (\<lambda>x. x) spurious_wakeups empty_heap allocate (\<lambda>_. typeof_addr) (heap_base.heap_read_typed (\<lambda>_. typeof_addr) heap_read P) heap_write (extTA2J P) P tb e (h, l) ta e' (h', l')) xa) taa (x', m')) \<or> (\<exists>tb x m. t = tb \<and> xh = ((PreStart, x), m) \<and> ta = \<lbrace>InitialThreadAction\<rbrace> \<and> x'h' = ((Running, x), m)) \<or> (\<exists>x tb m. t = tb \<and> xh = ((Running, x), m) \<and> ta = \<lbrace>ThreadFinishAction\<rbrace> \<and> x'h' = ((Finished, x), m) \<and> final_expr x)) = (((\<exists>tb x m taa x' m'. t = tb \<and> xh = ((Running, x), m) \<and> ta = convert_TA_initial (convert_obs_initial taa) \<and> x'h' = ((Running, x'), m') \<and> (case (x, m) of (x, xa) \<Rightarrow> (case x of (e, l) \<Rightarrow> \<lambda>h ta ((e', l'), h'). J_heap_base.red (\<lambda>x. x) (\<lambda>x. x) spurious_wakeups empty_heap allocate (\<lambda>_. typeof_addr) heap_read heap_write (extTA2J P) P tb e (h, l) ta e' (h', l')) xa) taa (x', m')) \<or> (\<exists>tb x m. t = tb \<and> xh = ((PreStart, x), m) \<and> ta = \<lbrace>InitialThreadAction\<rbrace> \<and> x'h' = ((Running, x), m)) \<or> (\<exists>x tb m. t = tb \<and> xh = ((Running, x), m) \<and> ta = \<lbrace>ThreadFinishAction\<rbrace> \<and> x'h' = ((Finished, x), m) \<and> final_expr x)) \<and> (\<forall>ad al v T. NormalAction (ReadMem ad al v) \<in> set \<lbrace>ta\<rbrace>\<^bsub>o\<^esub> \<longrightarrow> heap_base'.addr_loc_type TYPE('heap) typeof_addr P ad al T \<longrightarrow> heap_base'.conf TYPE('heap) typeof_addr P v T))
[PROOF STEP]
by(subst red_heap_read_typedD) fastforce


[STATEMENT]
lemma get_element_by_id_is_strongly_scdom_component_safe_step:
  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
  assumes "h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc"
  assumes "h \<turnstile> get_element_by_id ptr' idd \<rightarrow>\<^sub>r Some result"
  shows "cast result \<in> set sc \<longleftrightarrow> ptr' \<in> set sc"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (cast\<^sub>e\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r result \<in> set sc) = (ptr' \<in> set sc)
[PROOF STEP]
by (meson assms(1) assms(2) assms(3) assms(4) assms(5) contra_subsetD
      get_element_by_id_is_strongly_dom_component_safe_step get_scdom_component_contains_get_dom_component
      local.get_dom_component_ptr)


[STATEMENT]
lemma mem_val_w32_mod_state: "mem_val_w32 asi a s = mem_val_w32 asi a
(s\<lparr>cpu_reg := new_cpu_reg,
   user_reg := new_user_reg,
   dwrite := new_dwrite,
   state_var := new_state_var,
   traps := new_traps,
   undef := new_undef\<rparr>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mem_val_w32 asi a s = mem_val_w32 asi a (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg, dwrite := new_dwrite, state_var := new_state_var, traps := new_traps, undef := new_undef\<rparr>)
[PROOF STEP]
apply (simp add: mem_val_w32_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (let addr' = a AND 68719476732; r0 = mem_val_alt asi addr' s; r1 = mem_val_alt asi (addr' + 1) s; r2 = mem_val_alt asi (addr' + 2) s; r3 = mem_val_alt asi (addr' + 3) s in if r0 = None \<or> r1 = None \<or> r2 = None \<or> r3 = None then None else let byte0 = case r0 of Some v \<Rightarrow> v; byte1 = case r1 of Some v \<Rightarrow> v; byte2 = case r2 of Some v \<Rightarrow> v; byte3 = case r3 of Some v \<Rightarrow> v in Some ((((ucast byte0 << 24) OR (ucast byte1 << 16)) OR (ucast byte2 << 8)) OR ucast byte3)) = (let addr' = a AND 68719476732; r0 = mem_val_alt asi addr' (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg, dwrite := new_dwrite, state_var := new_state_var, traps := new_traps, undef := new_undef\<rparr>); r1 = mem_val_alt asi (addr' + 1) (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg, dwrite := new_dwrite, state_var := new_state_var, traps := new_traps, undef := new_undef\<rparr>); r2 = mem_val_alt asi (addr' + 2) (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg, dwrite := new_dwrite, state_var := new_state_var, traps := new_traps, undef := new_undef\<rparr>); r3 = mem_val_alt asi (addr' + 3) (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg, dwrite := new_dwrite, state_var := new_state_var, traps := new_traps, undef := new_undef\<rparr>) in if r0 = None \<or> r1 = None \<or> r2 = None \<or> r3 = None then None else let byte0 = case r0 of Some v \<Rightarrow> v; byte1 = case r1 of Some v \<Rightarrow> v; byte2 = case r2 of Some v \<Rightarrow> v; byte3 = case r3 of Some v \<Rightarrow> v in Some ((((ucast byte0 << 24) OR (ucast byte1 << 16)) OR (ucast byte2 << 8)) OR ucast byte3))
[PROOF STEP]
apply (simp add: Let_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (mem_val_alt asi (a AND 68719476732) s = None \<longrightarrow> mem_val_alt asi (a AND 68719476732) (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg, dwrite := new_dwrite, state_var := new_state_var, traps := new_traps, undef := new_undef\<rparr>) = None \<or> mem_val_alt asi ((a AND 68719476732) + 1) (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg, dwrite := new_dwrite, state_var := new_state_var, traps := new_traps, undef := new_undef\<rparr>) = None \<or> mem_val_alt asi ((a AND 68719476732) + 2) (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg, dwrite := new_dwrite, state_var := new_state_var, traps := new_traps, undef := new_undef\<rparr>) = None \<or> mem_val_alt asi ((a AND 68719476732) + 3) (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg, dwrite := new_dwrite, state_var := new_state_var, traps := new_traps, undef := new_undef\<rparr>) = None) \<and> (mem_val_alt asi ((a AND 68719476732) + 1) s = None \<longrightarrow> mem_val_alt asi (a AND 68719476732) (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg, dwrite := new_dwrite, state_var := new_state_var, traps := new_traps, undef := new_undef\<rparr>) = None \<or> mem_val_alt asi ((a AND 68719476732) + 1) (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg, dwrite := new_dwrite, state_var := new_state_var, traps := new_traps, undef := new_undef\<rparr>) = None \<or> mem_val_alt asi ((a AND 68719476732) + 2) (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg, dwrite := new_dwrite, state_var := new_state_var, traps := new_traps, undef := new_undef\<rparr>) = None \<or> mem_val_alt asi ((a AND 68719476732) + 3) (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg, dwrite := new_dwrite, state_var := new_state_var, traps := new_traps, undef := new_undef\<rparr>) = None) \<and> (mem_val_alt asi ((a AND 68719476732) + 2) s = None \<longrightarrow> mem_val_alt asi (a AND 68719476732) (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg, dwrite := new_dwrite, state_var := new_state_var, traps := new_traps, undef := new_undef\<rparr>) = None \<or> mem_val_alt asi ((a AND 68719476732) + 1) (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg, dwrite := new_dwrite, state_var := new_state_var, traps := new_traps, undef := new_undef\<rparr>) = None \<or> mem_val_alt asi ((a AND 68719476732) + 2) (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg, dwrite := new_dwrite, state_var := new_state_var, traps := new_traps, undef := new_undef\<rparr>) = None \<or> mem_val_alt asi ((a AND 68719476732) + 3) (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg, dwrite := new_dwrite, state_var := new_state_var, traps := new_traps, undef := new_undef\<rparr>) = None) \<and> (mem_val_alt asi ((a AND 68719476732) + 3) s = None \<longrightarrow> mem_val_alt asi (a AND 68719476732) (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg, dwrite := new_dwrite, state_var := new_state_var, traps := new_traps, undef := new_undef\<rparr>) = None \<or> mem_val_alt asi ((a AND 68719476732) + 1) (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg, dwrite := new_dwrite, state_var := new_state_var, traps := new_traps, undef := new_undef\<rparr>) = None \<or> mem_val_alt asi ((a AND 68719476732) + 2) (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg, dwrite := new_dwrite, state_var := new_state_var, traps := new_traps, undef := new_undef\<rparr>) = None \<or> mem_val_alt asi ((a AND 68719476732) + 3) (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg, dwrite := new_dwrite, state_var := new_state_var, traps := new_traps, undef := new_undef\<rparr>) = None) \<and> ((\<exists>y. mem_val_alt asi (a AND 68719476732) s = Some y) \<and> (\<exists>y. mem_val_alt asi ((a AND 68719476732) + 1) s = Some y) \<and> (\<exists>y. mem_val_alt asi ((a AND 68719476732) + 2) s = Some y) \<and> (\<exists>y. mem_val_alt asi ((a AND 68719476732) + 3) s = Some y) \<longrightarrow> (\<exists>y. mem_val_alt asi (a AND 68719476732) (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg, dwrite := new_dwrite, state_var := new_state_var, traps := new_traps, undef := new_undef\<rparr>) = Some y) \<and> (\<exists>y. mem_val_alt asi ((a AND 68719476732) + 1) (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg, dwrite := new_dwrite, state_var := new_state_var, traps := new_traps, undef := new_undef\<rparr>) = Some y) \<and> (\<exists>y. mem_val_alt asi ((a AND 68719476732) + 2) (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg, dwrite := new_dwrite, state_var := new_state_var, traps := new_traps, undef := new_undef\<rparr>) = Some y) \<and> (\<exists>y. mem_val_alt asi ((a AND 68719476732) + 3) (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg, dwrite := new_dwrite, state_var := new_state_var, traps := new_traps, undef := new_undef\<rparr>) = Some y) \<and> ((\<exists>y. mem_val_alt asi (a AND 68719476732) (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg, dwrite := new_dwrite, state_var := new_state_var, traps := new_traps, undef := new_undef\<rparr>) = Some y) \<and> (\<exists>y. mem_val_alt asi ((a AND 68719476732) + 1) (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg, dwrite := new_dwrite, state_var := new_state_var, traps := new_traps, undef := new_undef\<rparr>) = Some y) \<and> (\<exists>y. mem_val_alt asi ((a AND 68719476732) + 2) (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg, dwrite := new_dwrite, state_var := new_state_var, traps := new_traps, undef := new_undef\<rparr>) = Some y) \<and> (\<exists>y. mem_val_alt asi ((a AND 68719476732) + 3) (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg, dwrite := new_dwrite, state_var := new_state_var, traps := new_traps, undef := new_undef\<rparr>) = Some y) \<longrightarrow> (((ucast (case mem_val_alt asi (a AND 68719476732) s of Some v \<Rightarrow> v) << 24) OR (ucast (case mem_val_alt asi ((a AND 68719476732) + 1) s of Some v \<Rightarrow> v) << 16)) OR (ucast (case mem_val_alt asi ((a AND 68719476732) + 2) s of Some v \<Rightarrow> v) << 8)) OR ucast (case mem_val_alt asi ((a AND 68719476732) + 3) s of Some v \<Rightarrow> v) = (((ucast (case mem_val_alt asi (a AND 68719476732) (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg, dwrite := new_dwrite, state_var := new_state_var, traps := new_traps, undef := new_undef\<rparr>) of Some v \<Rightarrow> v) << 24) OR (ucast (case mem_val_alt asi ((a AND 68719476732) + 1) (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg, dwrite := new_dwrite, state_var := new_state_var, traps := new_traps, undef := new_undef\<rparr>) of Some v \<Rightarrow> v) << 16)) OR (ucast (case mem_val_alt asi ((a AND 68719476732) + 2) (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg, dwrite := new_dwrite, state_var := new_state_var, traps := new_traps, undef := new_undef\<rparr>) of Some v \<Rightarrow> v) << 8)) OR ucast (case mem_val_alt asi ((a AND 68719476732) + 3) (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg, dwrite := new_dwrite, state_var := new_state_var, traps := new_traps, undef := new_undef\<rparr>) of Some v \<Rightarrow> v)))
[PROOF STEP]
by (metis mem_val_mod_state)


[STATEMENT]
lemma get_shadow_root_new_shadow_root:
  "h \<turnstile> new\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_M \<rightarrow>\<^sub>r new_shadow_root_ptr \<Longrightarrow> h \<turnstile> new\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_M \<rightarrow>\<^sub>h h'
     \<Longrightarrow> r \<in> get_shadow_root_locs ptr' \<Longrightarrow> r h h'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>h \<turnstile> new\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_M \<rightarrow>\<^sub>r new_shadow_root_ptr; h \<turnstile> new\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_M \<rightarrow>\<^sub>h h'; r \<in> get_shadow_root_locs ptr'\<rbrakk> \<Longrightarrow> r h h'
[PROOF STEP]
by (auto simp add: get_shadow_root_locs_def new_shadow_root_get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t new_shadow_root_get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t
      split: prod.splits if_splits option.splits
      elim!: bind_returns_result_E bind_returns_heap_E intro: is_element_ptr_kind_obtains)


[STATEMENT]
lemma min_rvar_incdec_eq_None':
  assumes *: "dir = Positive \<or> dir = Negative"
    and min: "min_rvar_incdec_eq dir s eq = Inl is"
    and sub: "I = set is"
    and Iv: "(I,v) \<Turnstile>\<^sub>i\<^sub>b \<B>\<I> s"
  shows "le (lt dir) ((rhs eq) \<lbrace>v\<rbrace>) ((rhs eq) \<lbrace>\<langle>\<V> s\<rangle>\<rbrace>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. lt dir rhs eq \<lbrace> v \<rbrace> rhs eq \<lbrace> \<langle>\<V> s\<rangle> \<rbrace> \<or> rhs eq \<lbrace> v \<rbrace> = rhs eq \<lbrace> \<langle>\<V> s\<rangle> \<rbrace>
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. lt dir rhs eq \<lbrace> v \<rbrace> rhs eq \<lbrace> \<langle>\<V> s\<rangle> \<rbrace> \<or> rhs eq \<lbrace> v \<rbrace> = rhs eq \<lbrace> \<langle>\<V> s\<rangle> \<rbrace>
[PROOF STEP]
have "\<forall> x \<in> rvars_eq eq. \<not> reasable_var dir x eq s"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>x\<in>rvars_eq eq. \<not> (0 < coeff (rhs eq) x \<and> \<lhd>\<^sub>u\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x) (UB dir s x) \<or> coeff (rhs eq) x < 0 \<and> \<rhd>\<^sub>l\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x) (LB dir s x))
[PROOF STEP]
using min
[PROOF STATE]
proof (prove)
using this:
min_rvar_incdec_eq dir s eq = Inl is

goal (1 subgoal):
 1. \<forall>x\<in>rvars_eq eq. \<not> (0 < coeff (rhs eq) x \<and> \<lhd>\<^sub>u\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x) (UB dir s x) \<or> coeff (rhs eq) x < 0 \<and> \<rhd>\<^sub>l\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x) (LB dir s x))
[PROOF STEP]
using min_rvar_incdec_eq_None
[PROOF STATE]
proof (prove)
using this:
min_rvar_incdec_eq dir s eq = Inl is
min_rvar_incdec_eq ?dir ?s ?eq = Inl ?is \<Longrightarrow> (\<forall>x\<in>rvars_eq ?eq. \<not> (0 < coeff (rhs ?eq) x \<and> \<lhd>\<^sub>u\<^sub>b (lt ?dir) (\<langle>\<V> ?s\<rangle> x) (UB ?dir ?s x) \<or> coeff (rhs ?eq) x < 0 \<and> \<rhd>\<^sub>l\<^sub>b (lt ?dir) (\<langle>\<V> ?s\<rangle> x) (LB ?dir ?s x))) \<and> set ?is = {LI ?dir ?s (lhs ?eq)} \<union> {LI ?dir ?s x |x. x \<in> rvars_eq ?eq \<and> coeff (rhs ?eq) x < 0} \<union> {UI ?dir ?s x |x. x \<in> rvars_eq ?eq \<and> 0 < coeff (rhs ?eq) x} \<and> (?dir = Positive \<or> ?dir = Negative \<longrightarrow> LI ?dir ?s (lhs ?eq) \<in> indices_state ?s \<longrightarrow> set ?is \<subseteq> indices_state ?s)

goal (1 subgoal):
 1. \<forall>x\<in>rvars_eq eq. \<not> (0 < coeff (rhs eq) x \<and> \<lhd>\<^sub>u\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x) (UB dir s x) \<or> coeff (rhs eq) x < 0 \<and> \<rhd>\<^sub>l\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x) (LB dir s x))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<forall>x\<in>rvars_eq eq. \<not> (0 < coeff (rhs eq) x \<and> \<lhd>\<^sub>u\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x) (UB dir s x) \<or> coeff (rhs eq) x < 0 \<and> \<rhd>\<^sub>l\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x) (LB dir s x))

goal (1 subgoal):
 1. lt dir rhs eq \<lbrace> v \<rbrace> rhs eq \<lbrace> \<langle>\<V> s\<rangle> \<rbrace> \<or> rhs eq \<lbrace> v \<rbrace> = rhs eq \<lbrace> \<langle>\<V> s\<rangle> \<rbrace>
[PROOF STEP]
have "\<forall> x \<in> rvars_eq eq. (0 < coeff (rhs eq) x \<longrightarrow> le (lt dir) 0 (\<langle>\<V> s\<rangle> x - v x)) \<and> (coeff (rhs eq) x < 0 \<longrightarrow> le (lt dir) (\<langle>\<V> s\<rangle> x - v x) 0)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>x\<in>rvars_eq eq. (0 < coeff (rhs eq) x \<longrightarrow> lt dir (0::'a) (\<langle>\<V> s\<rangle> x - v x) \<or> (0::'a) = \<langle>\<V> s\<rangle> x - v x) \<and> (coeff (rhs eq) x < 0 \<longrightarrow> lt dir (\<langle>\<V> s\<rangle> x - v x) (0::'a) \<or> \<langle>\<V> s\<rangle> x - v x = (0::'a))
[PROOF STEP]
proof (safe)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>x \<in> rvars_eq eq; 0 < coeff (rhs eq) x; (0::'a) \<noteq> \<langle>\<V> s\<rangle> x - v x\<rbrakk> \<Longrightarrow> lt dir (0::'a) (\<langle>\<V> s\<rangle> x - v x)
 2. \<And>x. \<lbrakk>x \<in> rvars_eq eq; coeff (rhs eq) x < 0; \<langle>\<V> s\<rangle> x - v x \<noteq> (0::'a)\<rbrakk> \<Longrightarrow> lt dir (\<langle>\<V> s\<rangle> x - v x) (0::'a)
[PROOF STEP]
fix x
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>x \<in> rvars_eq eq; 0 < coeff (rhs eq) x; (0::'a) \<noteq> \<langle>\<V> s\<rangle> x - v x\<rbrakk> \<Longrightarrow> lt dir (0::'a) (\<langle>\<V> s\<rangle> x - v x)
 2. \<And>x. \<lbrakk>x \<in> rvars_eq eq; coeff (rhs eq) x < 0; \<langle>\<V> s\<rangle> x - v x \<noteq> (0::'a)\<rbrakk> \<Longrightarrow> lt dir (\<langle>\<V> s\<rangle> x - v x) (0::'a)
[PROOF STEP]
assume x: "x \<in> rvars_eq eq" "0 < coeff (rhs eq) x" "0 \<noteq> \<langle>\<V> s\<rangle> x - v x"
[PROOF STATE]
proof (state)
this:
x \<in> rvars_eq eq
0 < coeff (rhs eq) x
(0::'a) \<noteq> \<langle>\<V> s\<rangle> x - v x

goal (2 subgoals):
 1. \<And>x. \<lbrakk>x \<in> rvars_eq eq; 0 < coeff (rhs eq) x; (0::'a) \<noteq> \<langle>\<V> s\<rangle> x - v x\<rbrakk> \<Longrightarrow> lt dir (0::'a) (\<langle>\<V> s\<rangle> x - v x)
 2. \<And>x. \<lbrakk>x \<in> rvars_eq eq; coeff (rhs eq) x < 0; \<langle>\<V> s\<rangle> x - v x \<noteq> (0::'a)\<rbrakk> \<Longrightarrow> lt dir (\<langle>\<V> s\<rangle> x - v x) (0::'a)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
x \<in> rvars_eq eq
0 < coeff (rhs eq) x
(0::'a) \<noteq> \<langle>\<V> s\<rangle> x - v x
[PROOF STEP]
have "\<not> (\<lhd>\<^sub>u\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x) (UB dir s x))"
[PROOF STATE]
proof (prove)
using this:
x \<in> rvars_eq eq
0 < coeff (rhs eq) x
(0::'a) \<noteq> \<langle>\<V> s\<rangle> x - v x

goal (1 subgoal):
 1. \<not> \<lhd>\<^sub>u\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x) (UB dir s x)
[PROOF STEP]
using \<open>\<forall> x \<in> rvars_eq eq. \<not> reasable_var dir x eq s\<close>
[PROOF STATE]
proof (prove)
using this:
x \<in> rvars_eq eq
0 < coeff (rhs eq) x
(0::'a) \<noteq> \<langle>\<V> s\<rangle> x - v x
\<forall>x\<in>rvars_eq eq. \<not> (0 < coeff (rhs eq) x \<and> \<lhd>\<^sub>u\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x) (UB dir s x) \<or> coeff (rhs eq) x < 0 \<and> \<rhd>\<^sub>l\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x) (LB dir s x))

goal (1 subgoal):
 1. \<not> \<lhd>\<^sub>u\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x) (UB dir s x)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<not> \<lhd>\<^sub>u\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x) (UB dir s x)

goal (2 subgoals):
 1. \<And>x. \<lbrakk>x \<in> rvars_eq eq; 0 < coeff (rhs eq) x; (0::'a) \<noteq> \<langle>\<V> s\<rangle> x - v x\<rbrakk> \<Longrightarrow> lt dir (0::'a) (\<langle>\<V> s\<rangle> x - v x)
 2. \<And>x. \<lbrakk>x \<in> rvars_eq eq; coeff (rhs eq) x < 0; \<langle>\<V> s\<rangle> x - v x \<noteq> (0::'a)\<rbrakk> \<Longrightarrow> lt dir (\<langle>\<V> s\<rangle> x - v x) (0::'a)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<not> \<lhd>\<^sub>u\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x) (UB dir s x)
[PROOF STEP]
have "\<unrhd>\<^sub>u\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x) (UB dir s x)"
[PROOF STATE]
proof (prove)
using this:
\<not> \<lhd>\<^sub>u\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x) (UB dir s x)

goal (1 subgoal):
 1. \<unrhd>\<^sub>u\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x) (UB dir s x)
[PROOF STEP]
using *
[PROOF STATE]
proof (prove)
using this:
\<not> \<lhd>\<^sub>u\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x) (UB dir s x)
dir = Positive \<or> dir = Negative

goal (1 subgoal):
 1. \<unrhd>\<^sub>u\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x) (UB dir s x)
[PROOF STEP]
by (cases "UB dir s x") (auto simp add: bound_compare_defs)
[PROOF STATE]
proof (state)
this:
\<unrhd>\<^sub>u\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x) (UB dir s x)

goal (2 subgoals):
 1. \<And>x. \<lbrakk>x \<in> rvars_eq eq; 0 < coeff (rhs eq) x; (0::'a) \<noteq> \<langle>\<V> s\<rangle> x - v x\<rbrakk> \<Longrightarrow> lt dir (0::'a) (\<langle>\<V> s\<rangle> x - v x)
 2. \<And>x. \<lbrakk>x \<in> rvars_eq eq; coeff (rhs eq) x < 0; \<langle>\<V> s\<rangle> x - v x \<noteq> (0::'a)\<rbrakk> \<Longrightarrow> lt dir (\<langle>\<V> s\<rangle> x - v x) (0::'a)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<unrhd>\<^sub>u\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x) (UB dir s x)

goal (2 subgoals):
 1. \<And>x. \<lbrakk>x \<in> rvars_eq eq; 0 < coeff (rhs eq) x; (0::'a) \<noteq> \<langle>\<V> s\<rangle> x - v x\<rbrakk> \<Longrightarrow> lt dir (0::'a) (\<langle>\<V> s\<rangle> x - v x)
 2. \<And>x. \<lbrakk>x \<in> rvars_eq eq; coeff (rhs eq) x < 0; \<langle>\<V> s\<rangle> x - v x \<noteq> (0::'a)\<rbrakk> \<Longrightarrow> lt dir (\<langle>\<V> s\<rangle> x - v x) (0::'a)
[PROOF STEP]
from min_rvar_incdec_eq_None[OF min] x sub
[PROOF STATE]
proof (chain)
picking this:
(\<forall>x\<in>rvars_eq eq. \<not> (0 < coeff (rhs eq) x \<and> \<lhd>\<^sub>u\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x) (UB dir s x) \<or> coeff (rhs eq) x < 0 \<and> \<rhd>\<^sub>l\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x) (LB dir s x))) \<and> set is = {LI dir s (lhs eq)} \<union> {LI dir s x |x. x \<in> rvars_eq eq \<and> coeff (rhs eq) x < 0} \<union> {UI dir s x |x. x \<in> rvars_eq eq \<and> 0 < coeff (rhs eq) x} \<and> (dir = Positive \<or> dir = Negative \<longrightarrow> LI dir s (lhs eq) \<in> indices_state s \<longrightarrow> set is \<subseteq> indices_state s)
x \<in> rvars_eq eq
0 < coeff (rhs eq) x
(0::'a) \<noteq> \<langle>\<V> s\<rangle> x - v x
I = set is
[PROOF STEP]
have "UI dir s x \<in> I"
[PROOF STATE]
proof (prove)
using this:
(\<forall>x\<in>rvars_eq eq. \<not> (0 < coeff (rhs eq) x \<and> \<lhd>\<^sub>u\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x) (UB dir s x) \<or> coeff (rhs eq) x < 0 \<and> \<rhd>\<^sub>l\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x) (LB dir s x))) \<and> set is = {LI dir s (lhs eq)} \<union> {LI dir s x |x. x \<in> rvars_eq eq \<and> coeff (rhs eq) x < 0} \<union> {UI dir s x |x. x \<in> rvars_eq eq \<and> 0 < coeff (rhs eq) x} \<and> (dir = Positive \<or> dir = Negative \<longrightarrow> LI dir s (lhs eq) \<in> indices_state s \<longrightarrow> set is \<subseteq> indices_state s)
x \<in> rvars_eq eq
0 < coeff (rhs eq) x
(0::'a) \<noteq> \<langle>\<V> s\<rangle> x - v x
I = set is

goal (1 subgoal):
 1. UI dir s x \<in> I
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
UI dir s x \<in> I

goal (2 subgoals):
 1. \<And>x. \<lbrakk>x \<in> rvars_eq eq; 0 < coeff (rhs eq) x; (0::'a) \<noteq> \<langle>\<V> s\<rangle> x - v x\<rbrakk> \<Longrightarrow> lt dir (0::'a) (\<langle>\<V> s\<rangle> x - v x)
 2. \<And>x. \<lbrakk>x \<in> rvars_eq eq; coeff (rhs eq) x < 0; \<langle>\<V> s\<rangle> x - v x \<noteq> (0::'a)\<rbrakk> \<Longrightarrow> lt dir (\<langle>\<V> s\<rangle> x - v x) (0::'a)
[PROOF STEP]
from Iv * this
[PROOF STATE]
proof (chain)
picking this:
(I, v) \<Turnstile>\<^sub>i\<^sub>b \<B>\<I> s
dir = Positive \<or> dir = Negative
UI dir s x \<in> I
[PROOF STEP]
have "\<unlhd>\<^sub>u\<^sub>b (lt dir) (v x) (UB dir s x)"
[PROOF STATE]
proof (prove)
using this:
(I, v) \<Turnstile>\<^sub>i\<^sub>b \<B>\<I> s
dir = Positive \<or> dir = Negative
UI dir s x \<in> I

goal (1 subgoal):
 1. \<unlhd>\<^sub>u\<^sub>b (lt dir) (v x) (UB dir s x)
[PROOF STEP]
unfolding satisfies_bounds_index.simps
[PROOF STATE]
proof (prove)
using this:
(\<forall>x c. \<B>\<^sub>l s x = Some c \<longrightarrow> \<I>\<^sub>l s x \<in> I \<longrightarrow> c \<le> v x) \<and> (\<forall>x c. \<B>\<^sub>u s x = Some c \<longrightarrow> \<I>\<^sub>u s x \<in> I \<longrightarrow> v x \<le> c)
dir = Positive \<or> dir = Negative
UI dir s x \<in> I

goal (1 subgoal):
 1. \<unlhd>\<^sub>u\<^sub>b (lt dir) (v x) (UB dir s x)
[PROOF STEP]
by (cases "UB dir s x", auto simp: indexl_def indexu_def boundsl_def boundsu_def bound_compare'_defs)
        (fastforce)+
[PROOF STATE]
proof (state)
this:
\<unlhd>\<^sub>u\<^sub>b (lt dir) (v x) (UB dir s x)

goal (2 subgoals):
 1. \<And>x. \<lbrakk>x \<in> rvars_eq eq; 0 < coeff (rhs eq) x; (0::'a) \<noteq> \<langle>\<V> s\<rangle> x - v x\<rbrakk> \<Longrightarrow> lt dir (0::'a) (\<langle>\<V> s\<rangle> x - v x)
 2. \<And>x. \<lbrakk>x \<in> rvars_eq eq; coeff (rhs eq) x < 0; \<langle>\<V> s\<rangle> x - v x \<noteq> (0::'a)\<rbrakk> \<Longrightarrow> lt dir (\<langle>\<V> s\<rangle> x - v x) (0::'a)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<unrhd>\<^sub>u\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x) (UB dir s x)
\<unlhd>\<^sub>u\<^sub>b (lt dir) (v x) (UB dir s x)
[PROOF STEP]
have "le (lt dir) (v x) (\<langle>\<V> s\<rangle> x)"
[PROOF STATE]
proof (prove)
using this:
\<unrhd>\<^sub>u\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x) (UB dir s x)
\<unlhd>\<^sub>u\<^sub>b (lt dir) (v x) (UB dir s x)

goal (1 subgoal):
 1. lt dir (v x) (\<langle>\<V> s\<rangle> x) \<or> v x = \<langle>\<V> s\<rangle> x
[PROOF STEP]
using *
[PROOF STATE]
proof (prove)
using this:
\<unrhd>\<^sub>u\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x) (UB dir s x)
\<unlhd>\<^sub>u\<^sub>b (lt dir) (v x) (UB dir s x)
dir = Positive \<or> dir = Negative

goal (1 subgoal):
 1. lt dir (v x) (\<langle>\<V> s\<rangle> x) \<or> v x = \<langle>\<V> s\<rangle> x
[PROOF STEP]
by (cases "UB dir s x") (auto simp add: bound_compare_defs)
[PROOF STATE]
proof (state)
this:
lt dir (v x) (\<langle>\<V> s\<rangle> x) \<or> v x = \<langle>\<V> s\<rangle> x

goal (2 subgoals):
 1. \<And>x. \<lbrakk>x \<in> rvars_eq eq; 0 < coeff (rhs eq) x; (0::'a) \<noteq> \<langle>\<V> s\<rangle> x - v x\<rbrakk> \<Longrightarrow> lt dir (0::'a) (\<langle>\<V> s\<rangle> x - v x)
 2. \<And>x. \<lbrakk>x \<in> rvars_eq eq; coeff (rhs eq) x < 0; \<langle>\<V> s\<rangle> x - v x \<noteq> (0::'a)\<rbrakk> \<Longrightarrow> lt dir (\<langle>\<V> s\<rangle> x - v x) (0::'a)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
lt dir (v x) (\<langle>\<V> s\<rangle> x) \<or> v x = \<langle>\<V> s\<rangle> x
[PROOF STEP]
show "lt dir 0 (\<langle>\<V> s\<rangle> x - v x)"
[PROOF STATE]
proof (prove)
using this:
lt dir (v x) (\<langle>\<V> s\<rangle> x) \<or> v x = \<langle>\<V> s\<rangle> x

goal (1 subgoal):
 1. lt dir (0::'a) (\<langle>\<V> s\<rangle> x - v x)
[PROOF STEP]
using \<open>0 \<noteq> \<langle>\<V> s\<rangle> x - v x\<close> *
[PROOF STATE]
proof (prove)
using this:
lt dir (v x) (\<langle>\<V> s\<rangle> x) \<or> v x = \<langle>\<V> s\<rangle> x
(0::'a) \<noteq> \<langle>\<V> s\<rangle> x - v x
dir = Positive \<or> dir = Negative

goal (1 subgoal):
 1. lt dir (0::'a) (\<langle>\<V> s\<rangle> x - v x)
[PROOF STEP]
using minus_gt[of "v x" "\<langle>\<V> s\<rangle> x"] minus_lt[of "\<langle>\<V> s\<rangle> x" "v x"]
[PROOF STATE]
proof (prove)
using this:
lt dir (v x) (\<langle>\<V> s\<rangle> x) \<or> v x = \<langle>\<V> s\<rangle> x
(0::'a) \<noteq> \<langle>\<V> s\<rangle> x - v x
dir = Positive \<or> dir = Negative
(v x < \<langle>\<V> s\<rangle> x) = ((0::'a) < \<langle>\<V> s\<rangle> x - v x)
(\<langle>\<V> s\<rangle> x < v x) = (\<langle>\<V> s\<rangle> x - v x < (0::'a))

goal (1 subgoal):
 1. lt dir (0::'a) (\<langle>\<V> s\<rangle> x - v x)
[PROOF STEP]
by (auto simp del: Simplex.bounds_lg)
[PROOF STATE]
proof (state)
this:
lt dir (0::'a) (\<langle>\<V> s\<rangle> x - v x)

goal (1 subgoal):
 1. \<And>x. \<lbrakk>x \<in> rvars_eq eq; coeff (rhs eq) x < 0; \<langle>\<V> s\<rangle> x - v x \<noteq> (0::'a)\<rbrakk> \<Longrightarrow> lt dir (\<langle>\<V> s\<rangle> x - v x) (0::'a)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>x \<in> rvars_eq eq; coeff (rhs eq) x < 0; \<langle>\<V> s\<rangle> x - v x \<noteq> (0::'a)\<rbrakk> \<Longrightarrow> lt dir (\<langle>\<V> s\<rangle> x - v x) (0::'a)
[PROOF STEP]
fix x
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>x \<in> rvars_eq eq; coeff (rhs eq) x < 0; \<langle>\<V> s\<rangle> x - v x \<noteq> (0::'a)\<rbrakk> \<Longrightarrow> lt dir (\<langle>\<V> s\<rangle> x - v x) (0::'a)
[PROOF STEP]
assume x: "x \<in> rvars_eq eq" "0 > coeff (rhs eq) x" "\<langle>\<V> s\<rangle> x - v x \<noteq> 0"
[PROOF STATE]
proof (state)
this:
x \<in> rvars_eq eq
coeff (rhs eq) x < 0
\<langle>\<V> s\<rangle> x - v x \<noteq> (0::'a)

goal (1 subgoal):
 1. \<And>x. \<lbrakk>x \<in> rvars_eq eq; coeff (rhs eq) x < 0; \<langle>\<V> s\<rangle> x - v x \<noteq> (0::'a)\<rbrakk> \<Longrightarrow> lt dir (\<langle>\<V> s\<rangle> x - v x) (0::'a)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
x \<in> rvars_eq eq
coeff (rhs eq) x < 0
\<langle>\<V> s\<rangle> x - v x \<noteq> (0::'a)
[PROOF STEP]
have "\<not> (\<rhd>\<^sub>l\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x) (LB dir s x))"
[PROOF STATE]
proof (prove)
using this:
x \<in> rvars_eq eq
coeff (rhs eq) x < 0
\<langle>\<V> s\<rangle> x - v x \<noteq> (0::'a)

goal (1 subgoal):
 1. \<not> \<rhd>\<^sub>l\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x) (LB dir s x)
[PROOF STEP]
using \<open>\<forall> x \<in> rvars_eq eq. \<not> reasable_var dir x eq s\<close>
[PROOF STATE]
proof (prove)
using this:
x \<in> rvars_eq eq
coeff (rhs eq) x < 0
\<langle>\<V> s\<rangle> x - v x \<noteq> (0::'a)
\<forall>x\<in>rvars_eq eq. \<not> (0 < coeff (rhs eq) x \<and> \<lhd>\<^sub>u\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x) (UB dir s x) \<or> coeff (rhs eq) x < 0 \<and> \<rhd>\<^sub>l\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x) (LB dir s x))

goal (1 subgoal):
 1. \<not> \<rhd>\<^sub>l\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x) (LB dir s x)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<not> \<rhd>\<^sub>l\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x) (LB dir s x)

goal (1 subgoal):
 1. \<And>x. \<lbrakk>x \<in> rvars_eq eq; coeff (rhs eq) x < 0; \<langle>\<V> s\<rangle> x - v x \<noteq> (0::'a)\<rbrakk> \<Longrightarrow> lt dir (\<langle>\<V> s\<rangle> x - v x) (0::'a)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<not> \<rhd>\<^sub>l\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x) (LB dir s x)
[PROOF STEP]
have "\<unlhd>\<^sub>l\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x) (LB dir s x)"
[PROOF STATE]
proof (prove)
using this:
\<not> \<rhd>\<^sub>l\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x) (LB dir s x)

goal (1 subgoal):
 1. \<unlhd>\<^sub>l\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x) (LB dir s x)
[PROOF STEP]
using *
[PROOF STATE]
proof (prove)
using this:
\<not> \<rhd>\<^sub>l\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x) (LB dir s x)
dir = Positive \<or> dir = Negative

goal (1 subgoal):
 1. \<unlhd>\<^sub>l\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x) (LB dir s x)
[PROOF STEP]
by (cases "LB dir s x") (auto simp add: bound_compare_defs)
[PROOF STATE]
proof (state)
this:
\<unlhd>\<^sub>l\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x) (LB dir s x)

goal (1 subgoal):
 1. \<And>x. \<lbrakk>x \<in> rvars_eq eq; coeff (rhs eq) x < 0; \<langle>\<V> s\<rangle> x - v x \<noteq> (0::'a)\<rbrakk> \<Longrightarrow> lt dir (\<langle>\<V> s\<rangle> x - v x) (0::'a)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<unlhd>\<^sub>l\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x) (LB dir s x)

goal (1 subgoal):
 1. \<And>x. \<lbrakk>x \<in> rvars_eq eq; coeff (rhs eq) x < 0; \<langle>\<V> s\<rangle> x - v x \<noteq> (0::'a)\<rbrakk> \<Longrightarrow> lt dir (\<langle>\<V> s\<rangle> x - v x) (0::'a)
[PROOF STEP]
from min_rvar_incdec_eq_None[OF min] x sub
[PROOF STATE]
proof (chain)
picking this:
(\<forall>x\<in>rvars_eq eq. \<not> (0 < coeff (rhs eq) x \<and> \<lhd>\<^sub>u\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x) (UB dir s x) \<or> coeff (rhs eq) x < 0 \<and> \<rhd>\<^sub>l\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x) (LB dir s x))) \<and> set is = {LI dir s (lhs eq)} \<union> {LI dir s x |x. x \<in> rvars_eq eq \<and> coeff (rhs eq) x < 0} \<union> {UI dir s x |x. x \<in> rvars_eq eq \<and> 0 < coeff (rhs eq) x} \<and> (dir = Positive \<or> dir = Negative \<longrightarrow> LI dir s (lhs eq) \<in> indices_state s \<longrightarrow> set is \<subseteq> indices_state s)
x \<in> rvars_eq eq
coeff (rhs eq) x < 0
\<langle>\<V> s\<rangle> x - v x \<noteq> (0::'a)
I = set is
[PROOF STEP]
have "LI dir s x \<in> I"
[PROOF STATE]
proof (prove)
using this:
(\<forall>x\<in>rvars_eq eq. \<not> (0 < coeff (rhs eq) x \<and> \<lhd>\<^sub>u\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x) (UB dir s x) \<or> coeff (rhs eq) x < 0 \<and> \<rhd>\<^sub>l\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x) (LB dir s x))) \<and> set is = {LI dir s (lhs eq)} \<union> {LI dir s x |x. x \<in> rvars_eq eq \<and> coeff (rhs eq) x < 0} \<union> {UI dir s x |x. x \<in> rvars_eq eq \<and> 0 < coeff (rhs eq) x} \<and> (dir = Positive \<or> dir = Negative \<longrightarrow> LI dir s (lhs eq) \<in> indices_state s \<longrightarrow> set is \<subseteq> indices_state s)
x \<in> rvars_eq eq
coeff (rhs eq) x < 0
\<langle>\<V> s\<rangle> x - v x \<noteq> (0::'a)
I = set is

goal (1 subgoal):
 1. LI dir s x \<in> I
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
LI dir s x \<in> I

goal (1 subgoal):
 1. \<And>x. \<lbrakk>x \<in> rvars_eq eq; coeff (rhs eq) x < 0; \<langle>\<V> s\<rangle> x - v x \<noteq> (0::'a)\<rbrakk> \<Longrightarrow> lt dir (\<langle>\<V> s\<rangle> x - v x) (0::'a)
[PROOF STEP]
from Iv * this
[PROOF STATE]
proof (chain)
picking this:
(I, v) \<Turnstile>\<^sub>i\<^sub>b \<B>\<I> s
dir = Positive \<or> dir = Negative
LI dir s x \<in> I
[PROOF STEP]
have "\<unrhd>\<^sub>l\<^sub>b (lt dir) (v x) (LB dir s x)"
[PROOF STATE]
proof (prove)
using this:
(I, v) \<Turnstile>\<^sub>i\<^sub>b \<B>\<I> s
dir = Positive \<or> dir = Negative
LI dir s x \<in> I

goal (1 subgoal):
 1. \<unrhd>\<^sub>l\<^sub>b (lt dir) (v x) (LB dir s x)
[PROOF STEP]
unfolding satisfies_bounds_index.simps
[PROOF STATE]
proof (prove)
using this:
(\<forall>x c. \<B>\<^sub>l s x = Some c \<longrightarrow> \<I>\<^sub>l s x \<in> I \<longrightarrow> c \<le> v x) \<and> (\<forall>x c. \<B>\<^sub>u s x = Some c \<longrightarrow> \<I>\<^sub>u s x \<in> I \<longrightarrow> v x \<le> c)
dir = Positive \<or> dir = Negative
LI dir s x \<in> I

goal (1 subgoal):
 1. \<unrhd>\<^sub>l\<^sub>b (lt dir) (v x) (LB dir s x)
[PROOF STEP]
by (cases "LB dir s x", auto simp: indexl_def indexu_def boundsl_def boundsu_def bound_compare'_defs)
        (fastforce)+
[PROOF STATE]
proof (state)
this:
\<unrhd>\<^sub>l\<^sub>b (lt dir) (v x) (LB dir s x)

goal (1 subgoal):
 1. \<And>x. \<lbrakk>x \<in> rvars_eq eq; coeff (rhs eq) x < 0; \<langle>\<V> s\<rangle> x - v x \<noteq> (0::'a)\<rbrakk> \<Longrightarrow> lt dir (\<langle>\<V> s\<rangle> x - v x) (0::'a)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<unlhd>\<^sub>l\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x) (LB dir s x)
\<unrhd>\<^sub>l\<^sub>b (lt dir) (v x) (LB dir s x)
[PROOF STEP]
have "le (lt dir) (\<langle>\<V> s\<rangle> x) (v x)"
[PROOF STATE]
proof (prove)
using this:
\<unlhd>\<^sub>l\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x) (LB dir s x)
\<unrhd>\<^sub>l\<^sub>b (lt dir) (v x) (LB dir s x)

goal (1 subgoal):
 1. lt dir (\<langle>\<V> s\<rangle> x) (v x) \<or> \<langle>\<V> s\<rangle> x = v x
[PROOF STEP]
using *
[PROOF STATE]
proof (prove)
using this:
\<unlhd>\<^sub>l\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x) (LB dir s x)
\<unrhd>\<^sub>l\<^sub>b (lt dir) (v x) (LB dir s x)
dir = Positive \<or> dir = Negative

goal (1 subgoal):
 1. lt dir (\<langle>\<V> s\<rangle> x) (v x) \<or> \<langle>\<V> s\<rangle> x = v x
[PROOF STEP]
by (cases "LB dir s x") (auto simp add: bound_compare_defs)
[PROOF STATE]
proof (state)
this:
lt dir (\<langle>\<V> s\<rangle> x) (v x) \<or> \<langle>\<V> s\<rangle> x = v x

goal (1 subgoal):
 1. \<And>x. \<lbrakk>x \<in> rvars_eq eq; coeff (rhs eq) x < 0; \<langle>\<V> s\<rangle> x - v x \<noteq> (0::'a)\<rbrakk> \<Longrightarrow> lt dir (\<langle>\<V> s\<rangle> x - v x) (0::'a)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
lt dir (\<langle>\<V> s\<rangle> x) (v x) \<or> \<langle>\<V> s\<rangle> x = v x
[PROOF STEP]
show "lt dir (\<langle>\<V> s\<rangle> x - v x) 0"
[PROOF STATE]
proof (prove)
using this:
lt dir (\<langle>\<V> s\<rangle> x) (v x) \<or> \<langle>\<V> s\<rangle> x = v x

goal (1 subgoal):
 1. lt dir (\<langle>\<V> s\<rangle> x - v x) (0::'a)
[PROOF STEP]
using \<open>\<langle>\<V> s\<rangle> x - v x \<noteq> 0\<close> *
[PROOF STATE]
proof (prove)
using this:
lt dir (\<langle>\<V> s\<rangle> x) (v x) \<or> \<langle>\<V> s\<rangle> x = v x
\<langle>\<V> s\<rangle> x - v x \<noteq> (0::'a)
dir = Positive \<or> dir = Negative

goal (1 subgoal):
 1. lt dir (\<langle>\<V> s\<rangle> x - v x) (0::'a)
[PROOF STEP]
using minus_lt[of "\<langle>\<V> s\<rangle> x" "v x"] minus_gt[of "v x" "\<langle>\<V> s\<rangle> x"]
[PROOF STATE]
proof (prove)
using this:
lt dir (\<langle>\<V> s\<rangle> x) (v x) \<or> \<langle>\<V> s\<rangle> x = v x
\<langle>\<V> s\<rangle> x - v x \<noteq> (0::'a)
dir = Positive \<or> dir = Negative
(\<langle>\<V> s\<rangle> x < v x) = (\<langle>\<V> s\<rangle> x - v x < (0::'a))
(v x < \<langle>\<V> s\<rangle> x) = ((0::'a) < \<langle>\<V> s\<rangle> x - v x)

goal (1 subgoal):
 1. lt dir (\<langle>\<V> s\<rangle> x - v x) (0::'a)
[PROOF STEP]
by (auto simp del: Simplex.bounds_lg)
[PROOF STATE]
proof (state)
this:
lt dir (\<langle>\<V> s\<rangle> x - v x) (0::'a)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<forall>x\<in>rvars_eq eq. (0 < coeff (rhs eq) x \<longrightarrow> lt dir (0::'a) (\<langle>\<V> s\<rangle> x - v x) \<or> (0::'a) = \<langle>\<V> s\<rangle> x - v x) \<and> (coeff (rhs eq) x < 0 \<longrightarrow> lt dir (\<langle>\<V> s\<rangle> x - v x) (0::'a) \<or> \<langle>\<V> s\<rangle> x - v x = (0::'a))

goal (1 subgoal):
 1. lt dir rhs eq \<lbrace> v \<rbrace> rhs eq \<lbrace> \<langle>\<V> s\<rangle> \<rbrace> \<or> rhs eq \<lbrace> v \<rbrace> = rhs eq \<lbrace> \<langle>\<V> s\<rangle> \<rbrace>
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<forall>x\<in>rvars_eq eq. (0 < coeff (rhs eq) x \<longrightarrow> lt dir (0::'a) (\<langle>\<V> s\<rangle> x - v x) \<or> (0::'a) = \<langle>\<V> s\<rangle> x - v x) \<and> (coeff (rhs eq) x < 0 \<longrightarrow> lt dir (\<langle>\<V> s\<rangle> x - v x) (0::'a) \<or> \<langle>\<V> s\<rangle> x - v x = (0::'a))
[PROOF STEP]
have "le (lt dir) 0 (rhs eq \<lbrace> \<lambda> x. \<langle>\<V> s\<rangle> x - v x\<rbrace>)"
[PROOF STATE]
proof (prove)
using this:
\<forall>x\<in>rvars_eq eq. (0 < coeff (rhs eq) x \<longrightarrow> lt dir (0::'a) (\<langle>\<V> s\<rangle> x - v x) \<or> (0::'a) = \<langle>\<V> s\<rangle> x - v x) \<and> (coeff (rhs eq) x < 0 \<longrightarrow> lt dir (\<langle>\<V> s\<rangle> x - v x) (0::'a) \<or> \<langle>\<V> s\<rangle> x - v x = (0::'a))

goal (1 subgoal):
 1. lt dir (0::'a) rhs eq \<lbrace> \<lambda>x. \<langle>\<V> s\<rangle> x - v x \<rbrace> \<or> (0::'a) = rhs eq \<lbrace> \<lambda>x. \<langle>\<V> s\<rangle> x - v x \<rbrace>
[PROOF STEP]
using *
[PROOF STATE]
proof (prove)
using this:
\<forall>x\<in>rvars_eq eq. (0 < coeff (rhs eq) x \<longrightarrow> lt dir (0::'a) (\<langle>\<V> s\<rangle> x - v x) \<or> (0::'a) = \<langle>\<V> s\<rangle> x - v x) \<and> (coeff (rhs eq) x < 0 \<longrightarrow> lt dir (\<langle>\<V> s\<rangle> x - v x) (0::'a) \<or> \<langle>\<V> s\<rangle> x - v x = (0::'a))
dir = Positive \<or> dir = Negative

goal (1 subgoal):
 1. lt dir (0::'a) rhs eq \<lbrace> \<lambda>x. \<langle>\<V> s\<rangle> x - v x \<rbrace> \<or> (0::'a) = rhs eq \<lbrace> \<lambda>x. \<langle>\<V> s\<rangle> x - v x \<rbrace>
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>\<forall>x\<in>rvars_eq eq. (0 < coeff (rhs eq) x \<longrightarrow> (0::'a) < \<langle>\<V> s\<rangle> x - v x \<or> \<langle>\<V> s\<rangle> x = v x) \<and> (coeff (rhs eq) x < 0 \<longrightarrow> \<langle>\<V> s\<rangle> x - v x < (0::'a) \<or> \<langle>\<V> s\<rangle> x = v x); rhs eq \<lbrace> \<lambda>x. \<langle>\<V> s\<rangle> x - v x \<rbrace> \<noteq> (0::'a); dir = Direction (<) \<B>\<^sub>i\<^sub>l \<B>\<^sub>i\<^sub>u \<B>\<^sub>l \<B>\<^sub>u \<I>\<^sub>l \<I>\<^sub>u \<B>\<^sub>i\<^sub>u_update Leq Geq (\<le>)\<rbrakk> \<Longrightarrow> (0::'a) < rhs eq \<lbrace> \<lambda>x. \<langle>\<V> s\<rangle> x - v x \<rbrace>
 2. \<lbrakk>\<forall>x\<in>rvars_eq eq. (0 < coeff (rhs eq) x \<longrightarrow> \<langle>\<V> s\<rangle> x - v x < (0::'a) \<or> \<langle>\<V> s\<rangle> x = v x) \<and> (coeff (rhs eq) x < 0 \<longrightarrow> (0::'a) < \<langle>\<V> s\<rangle> x - v x \<or> \<langle>\<V> s\<rangle> x = v x); rhs eq \<lbrace> \<lambda>x. \<langle>\<V> s\<rangle> x - v x \<rbrace> \<noteq> (0::'a); dir = Direction (\<lambda>x y. y < x) \<B>\<^sub>i\<^sub>u \<B>\<^sub>i\<^sub>l \<B>\<^sub>u \<B>\<^sub>l \<I>\<^sub>u \<I>\<^sub>l \<B>\<^sub>i\<^sub>l_update Geq Leq (\<lambda>x y. y \<le> x)\<rbrakk> \<Longrightarrow> rhs eq \<lbrace> \<lambda>x. \<langle>\<V> s\<rangle> x - v x \<rbrace> < (0::'a)
[PROOF STEP]
using valuate_nonneg[of "rhs eq" "\<lambda>x. \<langle>\<V> s\<rangle> x - v x"]
[PROOF STATE]
proof (prove)
using this:
\<forall>x\<in>rvars_eq eq. (0 < coeff (rhs eq) x \<longrightarrow> (0::'a) \<le> \<langle>\<V> s\<rangle> x - v x) \<and> (coeff (rhs eq) x < 0 \<longrightarrow> \<langle>\<V> s\<rangle> x - v x \<le> (0::'a)) \<Longrightarrow> (0::'a) \<le> rhs eq \<lbrace> \<lambda>x. \<langle>\<V> s\<rangle> x - v x \<rbrace>

goal (2 subgoals):
 1. \<lbrakk>\<forall>x\<in>rvars_eq eq. (0 < coeff (rhs eq) x \<longrightarrow> (0::'a) < \<langle>\<V> s\<rangle> x - v x \<or> \<langle>\<V> s\<rangle> x = v x) \<and> (coeff (rhs eq) x < 0 \<longrightarrow> \<langle>\<V> s\<rangle> x - v x < (0::'a) \<or> \<langle>\<V> s\<rangle> x = v x); rhs eq \<lbrace> \<lambda>x. \<langle>\<V> s\<rangle> x - v x \<rbrace> \<noteq> (0::'a); dir = Direction (<) \<B>\<^sub>i\<^sub>l \<B>\<^sub>i\<^sub>u \<B>\<^sub>l \<B>\<^sub>u \<I>\<^sub>l \<I>\<^sub>u \<B>\<^sub>i\<^sub>u_update Leq Geq (\<le>)\<rbrakk> \<Longrightarrow> (0::'a) < rhs eq \<lbrace> \<lambda>x. \<langle>\<V> s\<rangle> x - v x \<rbrace>
 2. \<lbrakk>\<forall>x\<in>rvars_eq eq. (0 < coeff (rhs eq) x \<longrightarrow> \<langle>\<V> s\<rangle> x - v x < (0::'a) \<or> \<langle>\<V> s\<rangle> x = v x) \<and> (coeff (rhs eq) x < 0 \<longrightarrow> (0::'a) < \<langle>\<V> s\<rangle> x - v x \<or> \<langle>\<V> s\<rangle> x = v x); rhs eq \<lbrace> \<lambda>x. \<langle>\<V> s\<rangle> x - v x \<rbrace> \<noteq> (0::'a); dir = Direction (\<lambda>x y. y < x) \<B>\<^sub>i\<^sub>u \<B>\<^sub>i\<^sub>l \<B>\<^sub>u \<B>\<^sub>l \<I>\<^sub>u \<I>\<^sub>l \<B>\<^sub>i\<^sub>l_update Geq Leq (\<lambda>x y. y \<le> x)\<rbrakk> \<Longrightarrow> rhs eq \<lbrace> \<lambda>x. \<langle>\<V> s\<rangle> x - v x \<rbrace> < (0::'a)
[PROOF STEP]
apply (force simp del: Simplex.bounds_lg)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<forall>x\<in>rvars_eq eq. (0 < coeff (rhs eq) x \<longrightarrow> \<langle>\<V> s\<rangle> x - v x < (0::'a) \<or> \<langle>\<V> s\<rangle> x = v x) \<and> (coeff (rhs eq) x < 0 \<longrightarrow> (0::'a) < \<langle>\<V> s\<rangle> x - v x \<or> \<langle>\<V> s\<rangle> x = v x); rhs eq \<lbrace> \<lambda>x. \<langle>\<V> s\<rangle> x - v x \<rbrace> \<noteq> (0::'a); dir = Direction (\<lambda>x y. y < x) \<B>\<^sub>i\<^sub>u \<B>\<^sub>i\<^sub>l \<B>\<^sub>u \<B>\<^sub>l \<I>\<^sub>u \<I>\<^sub>l \<B>\<^sub>i\<^sub>l_update Geq Leq (\<lambda>x y. y \<le> x)\<rbrakk> \<Longrightarrow> rhs eq \<lbrace> \<lambda>x. \<langle>\<V> s\<rangle> x - v x \<rbrace> < (0::'a)
[PROOF STEP]
using valuate_nonpos[of "rhs eq" "\<lambda>x. \<langle>\<V> s\<rangle> x - v x"]
[PROOF STATE]
proof (prove)
using this:
\<forall>x\<in>rvars_eq eq. (0 < coeff (rhs eq) x \<longrightarrow> \<langle>\<V> s\<rangle> x - v x \<le> (0::'a)) \<and> (coeff (rhs eq) x < 0 \<longrightarrow> (0::'a) \<le> \<langle>\<V> s\<rangle> x - v x) \<Longrightarrow> rhs eq \<lbrace> \<lambda>x. \<langle>\<V> s\<rangle> x - v x \<rbrace> \<le> (0::'a)

goal (1 subgoal):
 1. \<lbrakk>\<forall>x\<in>rvars_eq eq. (0 < coeff (rhs eq) x \<longrightarrow> \<langle>\<V> s\<rangle> x - v x < (0::'a) \<or> \<langle>\<V> s\<rangle> x = v x) \<and> (coeff (rhs eq) x < 0 \<longrightarrow> (0::'a) < \<langle>\<V> s\<rangle> x - v x \<or> \<langle>\<V> s\<rangle> x = v x); rhs eq \<lbrace> \<lambda>x. \<langle>\<V> s\<rangle> x - v x \<rbrace> \<noteq> (0::'a); dir = Direction (\<lambda>x y. y < x) \<B>\<^sub>i\<^sub>u \<B>\<^sub>i\<^sub>l \<B>\<^sub>u \<B>\<^sub>l \<I>\<^sub>u \<I>\<^sub>l \<B>\<^sub>i\<^sub>l_update Geq Leq (\<lambda>x y. y \<le> x)\<rbrakk> \<Longrightarrow> rhs eq \<lbrace> \<lambda>x. \<langle>\<V> s\<rangle> x - v x \<rbrace> < (0::'a)
[PROOF STEP]
apply (force simp del: Simplex.bounds_lg)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
lt dir (0::'a) rhs eq \<lbrace> \<lambda>x. \<langle>\<V> s\<rangle> x - v x \<rbrace> \<or> (0::'a) = rhs eq \<lbrace> \<lambda>x. \<langle>\<V> s\<rangle> x - v x \<rbrace>

goal (1 subgoal):
 1. lt dir rhs eq \<lbrace> v \<rbrace> rhs eq \<lbrace> \<langle>\<V> s\<rangle> \<rbrace> \<or> rhs eq \<lbrace> v \<rbrace> = rhs eq \<lbrace> \<langle>\<V> s\<rangle> \<rbrace>
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
lt dir (0::'a) rhs eq \<lbrace> \<lambda>x. \<langle>\<V> s\<rangle> x - v x \<rbrace> \<or> (0::'a) = rhs eq \<lbrace> \<lambda>x. \<langle>\<V> s\<rangle> x - v x \<rbrace>
[PROOF STEP]
show "le (lt dir) rhs eq \<lbrace> v \<rbrace> rhs eq \<lbrace> \<langle>\<V> s\<rangle> \<rbrace>"
[PROOF STATE]
proof (prove)
using this:
lt dir (0::'a) rhs eq \<lbrace> \<lambda>x. \<langle>\<V> s\<rangle> x - v x \<rbrace> \<or> (0::'a) = rhs eq \<lbrace> \<lambda>x. \<langle>\<V> s\<rangle> x - v x \<rbrace>

goal (1 subgoal):
 1. lt dir rhs eq \<lbrace> v \<rbrace> rhs eq \<lbrace> \<langle>\<V> s\<rangle> \<rbrace> \<or> rhs eq \<lbrace> v \<rbrace> = rhs eq \<lbrace> \<langle>\<V> s\<rangle> \<rbrace>
[PROOF STEP]
using \<open>dir = Positive \<or> dir = Negative\<close>
[PROOF STATE]
proof (prove)
using this:
lt dir (0::'a) rhs eq \<lbrace> \<lambda>x. \<langle>\<V> s\<rangle> x - v x \<rbrace> \<or> (0::'a) = rhs eq \<lbrace> \<lambda>x. \<langle>\<V> s\<rangle> x - v x \<rbrace>
dir = Positive \<or> dir = Negative

goal (1 subgoal):
 1. lt dir rhs eq \<lbrace> v \<rbrace> rhs eq \<lbrace> \<langle>\<V> s\<rangle> \<rbrace> \<or> rhs eq \<lbrace> v \<rbrace> = rhs eq \<lbrace> \<langle>\<V> s\<rangle> \<rbrace>
[PROOF STEP]
using minus_gt[of "rhs eq \<lbrace> v \<rbrace>" "rhs eq \<lbrace> \<langle>\<V> s\<rangle> \<rbrace>"]
[PROOF STATE]
proof (prove)
using this:
lt dir (0::'a) rhs eq \<lbrace> \<lambda>x. \<langle>\<V> s\<rangle> x - v x \<rbrace> \<or> (0::'a) = rhs eq \<lbrace> \<lambda>x. \<langle>\<V> s\<rangle> x - v x \<rbrace>
dir = Positive \<or> dir = Negative
(rhs eq \<lbrace> v \<rbrace> < rhs eq \<lbrace> \<langle>\<V> s\<rangle> \<rbrace>) = ((0::'a) < rhs eq \<lbrace> \<langle>\<V> s\<rangle> \<rbrace> - rhs eq \<lbrace> v \<rbrace>)

goal (1 subgoal):
 1. lt dir rhs eq \<lbrace> v \<rbrace> rhs eq \<lbrace> \<langle>\<V> s\<rangle> \<rbrace> \<or> rhs eq \<lbrace> v \<rbrace> = rhs eq \<lbrace> \<langle>\<V> s\<rangle> \<rbrace>
[PROOF STEP]
by (auto simp add: valuate_diff[THEN sym] simp del: Simplex.bounds_lg)
[PROOF STATE]
proof (state)
this:
lt dir rhs eq \<lbrace> v \<rbrace> rhs eq \<lbrace> \<langle>\<V> s\<rangle> \<rbrace> \<or> rhs eq \<lbrace> v \<rbrace> = rhs eq \<lbrace> \<langle>\<V> s\<rangle> \<rbrace>

goal:
No subgoals!
[PROOF STEP]
qed