[STATEMENT]
theorem affine_unop:
  assumes x: "x \<in> aform_err e X"
  assumes f: "\<bar>f x - (a * x + b)\<bar> \<le> d"
    and e: "e \<in> UNIV \<rightarrow> {-1 .. 1}"
  shows "f x \<in> aform_err e (affine_unop p a b d X)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. f x \<in> aform_err e (affine_unop p a b d X)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. f x \<in> aform_err e (affine_unop p a b d X)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. f x \<in> aform_err e (affine_unop p a b d X)
[PROOF STEP]
unfolding affine_unop_def Let_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. f x \<in> aform_err e (case X of (x, xa) \<Rightarrow> (case x of (x, xs) \<Rightarrow> \<lambda>xe. case trunc_bound_eucl p (a * x) of (ax, axe) \<Rightarrow> case trunc_bound_eucl p (ax + b) of (y, ye) \<Rightarrow> case trunc_bound_pdevs p (scaleR_pdevs a xs) of (ys, yse) \<Rightarrow> ((y, ys), sum_list' p [truncate_up p (\<bar>a\<bar> * xe), axe, ye, yse, d])) xa)
[PROOF STEP]
apply (auto simp: split_beta')
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. f x \<in> aform_err e ((fst (trunc_bound_eucl p (fst (trunc_bound_eucl p (a * fst (fst X))) + b)), fst (trunc_bound_pdevs p (scaleR_pdevs a (snd (fst X))))), sum_list' p [truncate_up p (\<bar>a\<bar> * snd X), snd (trunc_bound_eucl p (a * fst (fst X))), snd (trunc_bound_eucl p (fst (trunc_bound_eucl p (a * fst (fst X))) + b)), snd (trunc_bound_pdevs p (scaleR_pdevs a (snd (fst X)))), d])
[PROOF STEP]
apply (rule aform_err_sum_list')
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. f x \<in> aform_err e ((fst (trunc_bound_eucl p (fst (trunc_bound_eucl p (a * fst (fst X))) + b)), fst (trunc_bound_pdevs p (scaleR_pdevs a (snd (fst X))))), sum_list [truncate_up p (\<bar>a\<bar> * snd X), snd (trunc_bound_eucl p (a * fst (fst X))), snd (trunc_bound_eucl p (fst (trunc_bound_eucl p (a * fst (fst X))) + b)), snd (trunc_bound_pdevs p (scaleR_pdevs a (snd (fst X)))), d])
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. f x \<in> aform_err e ((fst (trunc_bound_eucl p (fst (trunc_bound_eucl p (a * fst (fst X))) + b)), fst (trunc_bound_pdevs p (scaleR_pdevs a (snd (fst X))))), truncate_up p (\<bar>a\<bar> * snd X) + (snd (trunc_bound_eucl p (a * fst (fst X))) + (snd (trunc_bound_eucl p (fst (trunc_bound_eucl p (a * fst (fst X))) + b)) + (snd (trunc_bound_pdevs p (scaleR_pdevs a (snd (fst X)))) + d))))
[PROOF STEP]
apply (rule aform_err_eqI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. f x \<in> aform_err e ((fst (trunc_bound_eucl p (fst (trunc_bound_eucl p (a * fst (fst X))) + b)), fst (trunc_bound_pdevs p (scaleR_pdevs a (snd (fst X))))), ?d'2)
 2. ?d'2 = truncate_up p (\<bar>a\<bar> * snd X) + (snd (trunc_bound_eucl p (a * fst (fst X))) + (snd (trunc_bound_eucl p (fst (trunc_bound_eucl p (a * fst (fst X))) + b)) + (snd (trunc_bound_pdevs p (scaleR_pdevs a (snd (fst X)))) + d)))
[PROOF STEP]
apply (rule aform_err_trunc_bound_eucl)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. f x \<in> aform_err e ((fst (trunc_bound_eucl p (a * fst (fst X))) + b, fst (trunc_bound_pdevs p (scaleR_pdevs a (snd (fst X))))), ?d5)
 2. snd (trunc_bound_eucl p (fst (trunc_bound_eucl p (a * fst (fst X))) + b)) + ?d5 = truncate_up p (\<bar>a\<bar> * snd X) + (snd (trunc_bound_eucl p (a * fst (fst X))) + (snd (trunc_bound_eucl p (fst (trunc_bound_eucl p (a * fst (fst X))) + b)) + (snd (trunc_bound_pdevs p (scaleR_pdevs a (snd (fst X)))) + d)))
[PROOF STEP]
apply (rule aform_err_addI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. f x - b \<in> aform_err e ((fst (trunc_bound_eucl p (a * fst (fst X))), fst (trunc_bound_pdevs p (scaleR_pdevs a (snd (fst X))))), ?d5)
 2. snd (trunc_bound_eucl p (fst (trunc_bound_eucl p (a * fst (fst X))) + b)) + ?d5 = truncate_up p (\<bar>a\<bar> * snd X) + (snd (trunc_bound_eucl p (a * fst (fst X))) + (snd (trunc_bound_eucl p (fst (trunc_bound_eucl p (a * fst (fst X))) + b)) + (snd (trunc_bound_pdevs p (scaleR_pdevs a (snd (fst X)))) + d)))
[PROOF STEP]
apply (rule aform_err_trunc_bound_eucl)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. f x - b \<in> aform_err e ((a * fst (fst X), fst (trunc_bound_pdevs p (scaleR_pdevs a (snd (fst X))))), ?d9)
 2. snd (trunc_bound_eucl p (fst (trunc_bound_eucl p (a * fst (fst X))) + b)) + (snd (trunc_bound_eucl p (a * fst (fst X))) + ?d9) = truncate_up p (\<bar>a\<bar> * snd X) + (snd (trunc_bound_eucl p (a * fst (fst X))) + (snd (trunc_bound_eucl p (fst (trunc_bound_eucl p (a * fst (fst X))) + b)) + (snd (trunc_bound_pdevs p (scaleR_pdevs a (snd (fst X)))) + d)))
[PROOF STEP]
apply (rule aform_err_trunc_bound_pdevsI)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. f x - b \<in> aform_err e ((a * fst (fst X), scaleR_pdevs a (snd (fst X))), ?d11)
 2. e \<in> UNIV \<rightarrow> {- 1..1}
 3. snd (trunc_bound_eucl p (fst (trunc_bound_eucl p (a * fst (fst X))) + b)) + (snd (trunc_bound_eucl p (a * fst (fst X))) + (snd (trunc_bound_pdevs p (scaleR_pdevs a (snd (fst X)))) + ?d11)) = truncate_up p (\<bar>a\<bar> * snd X) + (snd (trunc_bound_eucl p (a * fst (fst X))) + (snd (trunc_bound_eucl p (fst (trunc_bound_eucl p (a * fst (fst X))) + b)) + (snd (trunc_bound_pdevs p (scaleR_pdevs a (snd (fst X)))) + d)))
[PROOF STEP]
using e
[PROOF STATE]
proof (prove)
using this:
e \<in> UNIV \<rightarrow> {- 1..1}

goal (3 subgoals):
 1. f x - b \<in> aform_err e ((a * fst (fst X), scaleR_pdevs a (snd (fst X))), ?d11)
 2. e \<in> UNIV \<rightarrow> {- 1..1}
 3. snd (trunc_bound_eucl p (fst (trunc_bound_eucl p (a * fst (fst X))) + b)) + (snd (trunc_bound_eucl p (a * fst (fst X))) + (snd (trunc_bound_pdevs p (scaleR_pdevs a (snd (fst X)))) + ?d11)) = truncate_up p (\<bar>a\<bar> * snd X) + (snd (trunc_bound_eucl p (a * fst (fst X))) + (snd (trunc_bound_eucl p (fst (trunc_bound_eucl p (a * fst (fst X))) + b)) + (snd (trunc_bound_pdevs p (scaleR_pdevs a (snd (fst X)))) + d)))
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. e \<in> UNIV \<rightarrow> {- 1..1} \<Longrightarrow> f x - b \<in> aform_err e ((a * fst (fst X), scaleR_pdevs a (snd (fst X))), truncate_up p (\<bar>a\<bar> * snd X) + d)
[PROOF STEP]
apply (rule aform_errI)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. e \<in> UNIV \<rightarrow> {- 1..1} \<Longrightarrow> \<bar>f x - b - aform_val e (fst ((a * fst (fst X), scaleR_pdevs a (snd (fst X))), truncate_up p (\<bar>a\<bar> * snd X) + d))\<bar> \<le> snd ((a * fst (fst X), scaleR_pdevs a (snd (fst X))), truncate_up p (\<bar>a\<bar> * snd X) + d)
[PROOF STEP]
apply (auto simp: aform_val_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. e \<in> UNIV \<rightarrow> {- 1..1} \<Longrightarrow> \<bar>f x - b - (a * fst (fst X) + a * pdevs_val e (snd (fst X)))\<bar> \<le> truncate_up p (\<bar>a\<bar> * snd X) + d
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. e \<in> UNIV \<rightarrow> {- 1..1} \<Longrightarrow> \<bar>f x - b - (a * fst (fst X) + a * pdevs_val e (snd (fst X)))\<bar> \<le> truncate_up p (\<bar>a\<bar> * snd X) + d
[PROOF STEP]
define x' where "x' = (fst (fst X) + pdevs_val e (snd (fst X)))"
[PROOF STATE]
proof (state)
this:
x' = fst (fst X) + pdevs_val e (snd (fst X))

goal (1 subgoal):
 1. e \<in> UNIV \<rightarrow> {- 1..1} \<Longrightarrow> \<bar>f x - b - (a * fst (fst X) + a * pdevs_val e (snd (fst X)))\<bar> \<le> truncate_up p (\<bar>a\<bar> * snd X) + d
[PROOF STEP]
have x_x': "\<bar>x - x'\<bar> \<le> snd X"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<bar>x - x'\<bar> \<le> snd X
[PROOF STEP]
using aform_errE[OF x]
[PROOF STATE]
proof (prove)
using this:
\<bar>x - aform_val e (fst X)\<bar> \<le> snd X

goal (1 subgoal):
 1. \<bar>x - x'\<bar> \<le> snd X
[PROOF STEP]
by (auto simp: x'_def aform_val_def)
[PROOF STATE]
proof (state)
this:
\<bar>x - x'\<bar> \<le> snd X

goal (1 subgoal):
 1. e \<in> UNIV \<rightarrow> {- 1..1} \<Longrightarrow> \<bar>f x - b - (a * fst (fst X) + a * pdevs_val e (snd (fst X)))\<bar> \<le> truncate_up p (\<bar>a\<bar> * snd X) + d
[PROOF STEP]
have "\<bar>f x - b - (a * fst (fst X) + a * pdevs_val e (snd (fst X)))\<bar> =
      \<bar>f x - (a * x + b) + a * (x - x')\<bar>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<bar>f x - b - (a * fst (fst X) + a * pdevs_val e (snd (fst X)))\<bar> = \<bar>f x - (a * x + b) + a * (x - x')\<bar>
[PROOF STEP]
by (simp add: algebra_simps x'_def)
[PROOF STATE]
proof (state)
this:
\<bar>f x - b - (a * fst (fst X) + a * pdevs_val e (snd (fst X)))\<bar> = \<bar>f x - (a * x + b) + a * (x - x')\<bar>

goal (1 subgoal):
 1. e \<in> UNIV \<rightarrow> {- 1..1} \<Longrightarrow> \<bar>f x - b - (a * fst (fst X) + a * pdevs_val e (snd (fst X)))\<bar> \<le> truncate_up p (\<bar>a\<bar> * snd X) + d
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
\<bar>f x - b - (a * fst (fst X) + a * pdevs_val e (snd (fst X)))\<bar> = \<bar>f x - (a * x + b) + a * (x - x')\<bar>

goal (1 subgoal):
 1. e \<in> UNIV \<rightarrow> {- 1..1} \<Longrightarrow> \<bar>f x - b - (a * fst (fst X) + a * pdevs_val e (snd (fst X)))\<bar> \<le> truncate_up p (\<bar>a\<bar> * snd X) + d
[PROOF STEP]
have "\<dots> \<le> \<bar>f x - (a * x + b)\<bar> + \<bar>a * (x - x')\<bar>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<bar>f x - (a * x + b) + a * (x - x')\<bar> \<le> \<bar>f x - (a * x + b)\<bar> + \<bar>a * (x - x')\<bar>
[PROOF STEP]
by (rule abs_triangle_ineq)
[PROOF STATE]
proof (state)
this:
\<bar>f x - (a * x + b) + a * (x - x')\<bar> \<le> \<bar>f x - (a * x + b)\<bar> + \<bar>a * (x - x')\<bar>

goal (1 subgoal):
 1. e \<in> UNIV \<rightarrow> {- 1..1} \<Longrightarrow> \<bar>f x - b - (a * fst (fst X) + a * pdevs_val e (snd (fst X)))\<bar> \<le> truncate_up p (\<bar>a\<bar> * snd X) + d
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
\<bar>f x - (a * x + b) + a * (x - x')\<bar> \<le> \<bar>f x - (a * x + b)\<bar> + \<bar>a * (x - x')\<bar>

goal (1 subgoal):
 1. e \<in> UNIV \<rightarrow> {- 1..1} \<Longrightarrow> \<bar>f x - b - (a * fst (fst X) + a * pdevs_val e (snd (fst X)))\<bar> \<le> truncate_up p (\<bar>a\<bar> * snd X) + d
[PROOF STEP]
note f
[PROOF STATE]
proof (state)
this:
\<bar>f x - (a * x + b)\<bar> \<le> d

goal (1 subgoal):
 1. e \<in> UNIV \<rightarrow> {- 1..1} \<Longrightarrow> \<bar>f x - b - (a * fst (fst X) + a * pdevs_val e (snd (fst X)))\<bar> \<le> truncate_up p (\<bar>a\<bar> * snd X) + d
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
\<bar>f x - (a * x + b)\<bar> \<le> d

goal (1 subgoal):
 1. e \<in> UNIV \<rightarrow> {- 1..1} \<Longrightarrow> \<bar>f x - b - (a * fst (fst X) + a * pdevs_val e (snd (fst X)))\<bar> \<le> truncate_up p (\<bar>a\<bar> * snd X) + d
[PROOF STEP]
have "\<bar>a * (x - x')\<bar> \<le> truncate_up p (\<bar>a\<bar> * snd X)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<bar>a * (x - x')\<bar> \<le> truncate_up p (\<bar>a\<bar> * snd X)
[PROOF STEP]
by (rule truncate_up_le)
        (auto simp: abs_mult intro!: mult_left_mono x_x')
[PROOF STATE]
proof (state)
this:
\<bar>a * (x - x')\<bar> \<le> truncate_up p (\<bar>a\<bar> * snd X)

goal (1 subgoal):
 1. e \<in> UNIV \<rightarrow> {- 1..1} \<Longrightarrow> \<bar>f x - b - (a * fst (fst X) + a * pdevs_val e (snd (fst X)))\<bar> \<le> truncate_up p (\<bar>a\<bar> * snd X) + d
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>\<And>xa y. xa \<le> y \<Longrightarrow> xa + \<bar>a * (x - x')\<bar> \<le> y + \<bar>a * (x - x')\<bar>; \<And>x y. x \<le> y \<Longrightarrow> d + x \<le> d + y\<rbrakk> \<Longrightarrow> \<bar>f x - b - (a * fst (fst X) + a * pdevs_val e (snd (fst X)))\<bar> \<le> d + truncate_up p (\<bar>a\<bar> * snd X)
[PROOF STEP]
show "\<bar>f x - b - (a * fst (fst X) + a * pdevs_val e (snd (fst X)))\<bar> \<le>
        truncate_up p (\<bar>a\<bar> * snd X) + d"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<And>xa y. xa \<le> y \<Longrightarrow> xa + \<bar>a * (x - x')\<bar> \<le> y + \<bar>a * (x - x')\<bar>; \<And>x y. x \<le> y \<Longrightarrow> d + x \<le> d + y\<rbrakk> \<Longrightarrow> \<bar>f x - b - (a * fst (fst X) + a * pdevs_val e (snd (fst X)))\<bar> \<le> d + truncate_up p (\<bar>a\<bar> * snd X)

goal (1 subgoal):
 1. \<bar>f x - b - (a * fst (fst X) + a * pdevs_val e (snd (fst X)))\<bar> \<le> truncate_up p (\<bar>a\<bar> * snd X) + d
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<bar>f x - b - (a * fst (fst X) + a * pdevs_val e (snd (fst X)))\<bar> \<le> truncate_up p (\<bar>a\<bar> * snd X) + d

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
f x \<in> aform_err e (affine_unop p a b d X)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma PO_m1_inv4_rfresh [iff]: "reach m1 \<subseteq> m1_inv4_rfresh"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. reach m1 \<subseteq> m1_inv4_rfresh
[PROOF STEP]
apply (rule_tac
         J="m1_inv3r_init \<inter> m1_inv2r_serv \<inter> m1_inv3_ifresh \<inter> m1_secrecy"
       in inv_rule_incr)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. init m1 \<subseteq> m1_inv4_rfresh
 2. {m1_inv4_rfresh \<inter> (m1_inv3r_init \<inter> m1_inv2r_serv \<inter> m1_inv3_ifresh \<inter> m1_secrecy)} TS.trans m1 {> m1_inv4_rfresh}
 3. reach m1 \<subseteq> m1_inv3r_init \<inter> m1_inv2r_serv \<inter> m1_inv3_ifresh \<inter> m1_secrecy
[PROOF STEP]
apply (auto simp add: Int_assoc del: subsetI)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma get_shadow_root_new_character_data:
  "h \<turnstile> new_character_data \<rightarrow>\<^sub>r new_character_data_ptr \<Longrightarrow> h \<turnstile> new_character_data \<rightarrow>\<^sub>h h'
     \<Longrightarrow> r \<in> get_shadow_root_locs ptr' \<Longrightarrow> r h h'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>h \<turnstile> new_character_data \<rightarrow>\<^sub>r new_character_data_ptr; h \<turnstile> new_character_data \<rightarrow>\<^sub>h h'; r \<in> get_shadow_root_locs ptr'\<rbrakk> \<Longrightarrow> r h h'
[PROOF STEP]
by (auto simp add: get_shadow_root_locs_def new_character_data_get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t new_character_data_get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t
      split: prod.splits if_splits option.splits
      elim!: bind_returns_result_E bind_returns_heap_E intro: is_element_ptr_kind_obtains)


[STATEMENT]
lemma heap_is_wellformed_children_disc_nodes: "heap_is_wellformed h \<Longrightarrow>
node_ptr |\<in>| node_ptr_kinds h \<Longrightarrow>  \<not>(\<exists>parent \<in> fset (object_ptr_kinds h).
node_ptr \<in> set |h \<turnstile> get_child_nodes parent|\<^sub>r) \<Longrightarrow> (\<exists>document_ptr \<in> fset (document_ptr_kinds h).
node_ptr \<in> set |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>heap_is_wellformed h; node_ptr |\<in>| node_ptr_kinds h; \<not> (\<exists>parent\<in>fset (object_ptr_kinds h). node_ptr \<in> set |h \<turnstile> get_child_nodes parent|\<^sub>r)\<rbrakk> \<Longrightarrow> \<exists>document_ptr\<in>fset (document_ptr_kinds h). node_ptr \<in> set |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r
[PROOF STEP]
using CD.heap_is_wellformed_children_disc_nodes local.heap_is_wellformed_def
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M ?h; ?node_ptr |\<in>| node_ptr_kinds ?h; \<not> (\<exists>parent\<in>fset (object_ptr_kinds ?h). ?node_ptr \<in> set |?h \<turnstile> get_child_nodes parent|\<^sub>r)\<rbrakk> \<Longrightarrow> \<exists>document_ptr\<in>fset (document_ptr_kinds ?h). ?node_ptr \<in> set |?h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r
heap_is_wellformed = (\<lambda>h. heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M h \<and> acyclic (parent_child_rel h \<union> local.a_host_shadow_root_rel h \<union> local.a_ptr_disconnected_node_rel h) \<and> local.a_all_ptrs_in_heap h \<and> local.a_distinct_lists h \<and> local.a_shadow_root_valid h)

goal (1 subgoal):
 1. \<lbrakk>heap_is_wellformed h; node_ptr |\<in>| node_ptr_kinds h; \<not> (\<exists>parent\<in>fset (object_ptr_kinds h). node_ptr \<in> set |h \<turnstile> get_child_nodes parent|\<^sub>r)\<rbrakk> \<Longrightarrow> \<exists>document_ptr\<in>fset (document_ptr_kinds h). node_ptr \<in> set |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r
[PROOF STEP]
by blast