[STATEMENT]
lemma radical_sqrt_line_line_intersection:
  assumes absA: "(abscissa (A)) \<in> radical_sqrt"
      and ordA: "(ordinate A) \<in> radical_sqrt"
      and absB: "(abscissa B) \<in> radical_sqrt"
      and ordB: "(ordinate B) \<in> radical_sqrt"
      and absC: "(abscissa C) \<in> radical_sqrt"
      and ordC: "(ordinate C) \<in> radical_sqrt"
      and absD: "(abscissa D) \<in> radical_sqrt"
      and ordD: "(ordinate D) \<in> radical_sqrt"
      and notParallel: "\<not> (parallel A B C D)"
      and isIntersec: "is_intersection X A B C D"
  shows "(abscissa X) \<in> radical_sqrt & (ordinate X) \<in> radical_sqrt"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. abscissa X \<in> radical_sqrt \<and> ordinate X \<in> radical_sqrt
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. abscissa X \<in> radical_sqrt \<and> ordinate X \<in> radical_sqrt
[PROOF STEP]
have l2: "(abscissa A - abscissa X) * (ordinate A - ordinate B) = (ordinate A - ordinate X) * (abscissa A - abscissa B) & (abscissa C - abscissa X) * (ordinate C - ordinate D) = (ordinate C - ordinate X) * (abscissa C - abscissa D)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (abscissa A - abscissa X) * (ordinate A - ordinate B) = (ordinate A - ordinate X) * (abscissa A - abscissa B) \<and> (abscissa C - abscissa X) * (ordinate C - ordinate D) = (ordinate C - ordinate X) * (abscissa C - abscissa D)
[PROOF STEP]
using isIntersec is_intersection_def collinear_def parallel_def
[PROOF STATE]
proof (prove)
using this:
is_intersection X A B C D
is_intersection ?M ?A ?B ?C ?D = (collinear ?A ?M ?B \<and> collinear ?C ?M ?D)
collinear ?A ?B ?C = parallel ?A ?B ?A ?C
parallel ?A ?B ?C ?D = ((abscissa ?A - abscissa ?B) * (ordinate ?C - ordinate ?D) = (ordinate ?A - ordinate ?B) * (abscissa ?C - abscissa ?D))

goal (1 subgoal):
 1. (abscissa A - abscissa X) * (ordinate A - ordinate B) = (ordinate A - ordinate X) * (abscissa A - abscissa B) \<and> (abscissa C - abscissa X) * (ordinate C - ordinate D) = (ordinate C - ordinate X) * (abscissa C - abscissa D)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(abscissa A - abscissa X) * (ordinate A - ordinate B) = (ordinate A - ordinate X) * (abscissa A - abscissa B) \<and> (abscissa C - abscissa X) * (ordinate C - ordinate D) = (ordinate C - ordinate X) * (abscissa C - abscissa D)

goal (1 subgoal):
 1. abscissa X \<in> radical_sqrt \<and> ordinate X \<in> radical_sqrt
[PROOF STEP]
hence l4: "(- (ordinate A - ordinate B)) * abscissa X + (abscissa A - abscissa B) * ordinate X = (- abscissa A * (ordinate A - ordinate B) + ordinate A * (abscissa A - abscissa B))"
[PROOF STATE]
proof (prove)
using this:
(abscissa A - abscissa X) * (ordinate A - ordinate B) = (ordinate A - ordinate X) * (abscissa A - abscissa B) \<and> (abscissa C - abscissa X) * (ordinate C - ordinate D) = (ordinate C - ordinate X) * (abscissa C - abscissa D)

goal (1 subgoal):
 1. - (ordinate A - ordinate B) * abscissa X + (abscissa A - abscissa B) * ordinate X = - abscissa A * (ordinate A - ordinate B) + ordinate A * (abscissa A - abscissa B)
[PROOF STEP]
by (simp add: algebra_simps)
[PROOF STATE]
proof (state)
this:
- (ordinate A - ordinate B) * abscissa X + (abscissa A - abscissa B) * ordinate X = - abscissa A * (ordinate A - ordinate B) + ordinate A * (abscissa A - abscissa B)

goal (1 subgoal):
 1. abscissa X \<in> radical_sqrt \<and> ordinate X \<in> radical_sqrt
[PROOF STEP]
have l6: "(- (ordinate C - ordinate D)) * abscissa X + (abscissa C - abscissa D) * ordinate X = (- abscissa C * (ordinate C - ordinate D) + ordinate C * (abscissa C - abscissa D))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. - (ordinate C - ordinate D) * abscissa X + (abscissa C - abscissa D) * ordinate X = - abscissa C * (ordinate C - ordinate D) + ordinate C * (abscissa C - abscissa D)
[PROOF STEP]
using l2
[PROOF STATE]
proof (prove)
using this:
(abscissa A - abscissa X) * (ordinate A - ordinate B) = (ordinate A - ordinate X) * (abscissa A - abscissa B) \<and> (abscissa C - abscissa X) * (ordinate C - ordinate D) = (ordinate C - ordinate X) * (abscissa C - abscissa D)

goal (1 subgoal):
 1. - (ordinate C - ordinate D) * abscissa X + (abscissa C - abscissa D) * ordinate X = - abscissa C * (ordinate C - ordinate D) + ordinate C * (abscissa C - abscissa D)
[PROOF STEP]
by (simp add: algebra_simps)
[PROOF STATE]
proof (state)
this:
- (ordinate C - ordinate D) * abscissa X + (abscissa C - abscissa D) * ordinate X = - abscissa C * (ordinate C - ordinate D) + ordinate C * (abscissa C - abscissa D)

goal (1 subgoal):
 1. abscissa X \<in> radical_sqrt \<and> ordinate X \<in> radical_sqrt
[PROOF STEP]
have sl1: "(- (ordinate A - ordinate B)) \<in> radical_sqrt"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. - (ordinate A - ordinate B) \<in> radical_sqrt
[PROOF STEP]
by (metis ordA ordB minus_diff_eq radical_sqrt_rule_subtraction)
[PROOF STATE]
proof (state)
this:
- (ordinate A - ordinate B) \<in> radical_sqrt

goal (1 subgoal):
 1. abscissa X \<in> radical_sqrt \<and> ordinate X \<in> radical_sqrt
[PROOF STEP]
have sl2: "(abscissa A - abscissa B) \<in> radical_sqrt"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. abscissa A - abscissa B \<in> radical_sqrt
[PROOF STEP]
by (metis absA absB radical_sqrt_rule_subtraction)
[PROOF STATE]
proof (state)
this:
abscissa A - abscissa B \<in> radical_sqrt

goal (1 subgoal):
 1. abscissa X \<in> radical_sqrt \<and> ordinate X \<in> radical_sqrt
[PROOF STEP]
have sl3: "(- abscissa A * (ordinate A - ordinate B) + ordinate A * (abscissa A - abscissa B)) \<in> radical_sqrt"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. - abscissa A * (ordinate A - ordinate B) + ordinate A * (abscissa A - abscissa B) \<in> radical_sqrt
[PROOF STEP]
using absA ordA ordB absB
[PROOF STATE]
proof (prove)
using this:
abscissa A \<in> radical_sqrt
ordinate A \<in> radical_sqrt
ordinate B \<in> radical_sqrt
abscissa B \<in> radical_sqrt

goal (1 subgoal):
 1. - abscissa A * (ordinate A - ordinate B) + ordinate A * (abscissa A - abscissa B) \<in> radical_sqrt
[PROOF STEP]
by (metis diff_conv_add_uminus radical_sqrt.intros(2) radical_sqrt.intros(4) radical_sqrt.intros(5))
[PROOF STATE]
proof (state)
this:
- abscissa A * (ordinate A - ordinate B) + ordinate A * (abscissa A - abscissa B) \<in> radical_sqrt

goal (1 subgoal):
 1. abscissa X \<in> radical_sqrt \<and> ordinate X \<in> radical_sqrt
[PROOF STEP]
have sl4: "(- (ordinate C - ordinate D)) \<in> radical_sqrt"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. - (ordinate C - ordinate D) \<in> radical_sqrt
[PROOF STEP]
by (metis ordC ordD minus_diff_eq radical_sqrt_rule_subtraction)
[PROOF STATE]
proof (state)
this:
- (ordinate C - ordinate D) \<in> radical_sqrt

goal (1 subgoal):
 1. abscissa X \<in> radical_sqrt \<and> ordinate X \<in> radical_sqrt
[PROOF STEP]
have sl5: "(abscissa C - abscissa D) \<in> radical_sqrt"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. abscissa C - abscissa D \<in> radical_sqrt
[PROOF STEP]
by (metis absC absD radical_sqrt_rule_subtraction)
[PROOF STATE]
proof (state)
this:
abscissa C - abscissa D \<in> radical_sqrt

goal (1 subgoal):
 1. abscissa X \<in> radical_sqrt \<and> ordinate X \<in> radical_sqrt
[PROOF STEP]
have sl6: "(- abscissa C * (ordinate C - ordinate D) + ordinate C * (abscissa C - abscissa D)) \<in> radical_sqrt"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. - abscissa C * (ordinate C - ordinate D) + ordinate C * (abscissa C - abscissa D) \<in> radical_sqrt
[PROOF STEP]
using absC ordC absD ordD
[PROOF STATE]
proof (prove)
using this:
abscissa C \<in> radical_sqrt
ordinate C \<in> radical_sqrt
abscissa D \<in> radical_sqrt
ordinate D \<in> radical_sqrt

goal (1 subgoal):
 1. - abscissa C * (ordinate C - ordinate D) + ordinate C * (abscissa C - abscissa D) \<in> radical_sqrt
[PROOF STEP]
by (metis diff_conv_add_uminus radical_sqrt.intros(2) radical_sqrt.intros(4) radical_sqrt.intros(5))
[PROOF STATE]
proof (state)
this:
- abscissa C * (ordinate C - ordinate D) + ordinate C * (abscissa C - abscissa D) \<in> radical_sqrt

goal (1 subgoal):
 1. abscissa X \<in> radical_sqrt \<and> ordinate X \<in> radical_sqrt
[PROOF STEP]
have "(- (ordinate A - ordinate B)) * (abscissa C - abscissa D) \<noteq> (abscissa A - abscissa B) * (- (ordinate C - ordinate D))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. - (ordinate A - ordinate B) * (abscissa C - abscissa D) \<noteq> (abscissa A - abscissa B) * - (ordinate C - ordinate D)
[PROOF STEP]
using notParallel parallel_def
[PROOF STATE]
proof (prove)
using this:
\<not> parallel A B C D
parallel ?A ?B ?C ?D = ((abscissa ?A - abscissa ?B) * (ordinate ?C - ordinate ?D) = (ordinate ?A - ordinate ?B) * (abscissa ?C - abscissa ?D))

goal (1 subgoal):
 1. - (ordinate A - ordinate B) * (abscissa C - abscissa D) \<noteq> (abscissa A - abscissa B) * - (ordinate C - ordinate D)
[PROOF STEP]
by (simp add: algebra_simps)
[PROOF STATE]
proof (state)
this:
- (ordinate A - ordinate B) * (abscissa C - abscissa D) \<noteq> (abscissa A - abscissa B) * - (ordinate C - ordinate D)

goal (1 subgoal):
 1. abscissa X \<in> radical_sqrt \<and> ordinate X \<in> radical_sqrt
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
- (ordinate A - ordinate B) * (abscissa C - abscissa D) \<noteq> (abscissa A - abscissa B) * - (ordinate C - ordinate D)

goal (1 subgoal):
 1. abscissa X \<in> radical_sqrt \<and> ordinate X \<in> radical_sqrt
[PROOF STEP]
using radical_sqrt_simultaneous_linear_equation [of "- (ordinate A - ordinate B)" "(abscissa A - abscissa B)" "- abscissa A * (ordinate A - ordinate B) + ordinate A * (abscissa A - abscissa B)" "- (ordinate C - ordinate D)" "abscissa C - abscissa D" "- abscissa C * (ordinate C - ordinate D) + ordinate C * (abscissa C - abscissa D)" "abscissa X" "ordinate X"] absA ordA absB ordB absC ordC absD ordD l4 sl1 sl2 sl3 sl4 sl5 sl6 l6
[PROOF STATE]
proof (prove)
using this:
- (ordinate A - ordinate B) * (abscissa C - abscissa D) \<noteq> (abscissa A - abscissa B) * - (ordinate C - ordinate D)
\<lbrakk>- (ordinate A - ordinate B) \<in> radical_sqrt; abscissa A - abscissa B \<in> radical_sqrt; - abscissa A * (ordinate A - ordinate B) + ordinate A * (abscissa A - abscissa B) \<in> radical_sqrt; - (ordinate C - ordinate D) \<in> radical_sqrt; abscissa C - abscissa D \<in> radical_sqrt; - abscissa C * (ordinate C - ordinate D) + ordinate C * (abscissa C - abscissa D) \<in> radical_sqrt; \<not> (- (ordinate A - ordinate B) * (abscissa C - abscissa D) - (abscissa A - abscissa B) * - (ordinate C - ordinate D) = 0 \<and> - (ordinate A - ordinate B) * (- abscissa C * (ordinate C - ordinate D) + ordinate C * (abscissa C - abscissa D)) - (- abscissa A * (ordinate A - ordinate B) + ordinate A * (abscissa A - abscissa B)) * - (ordinate C - ordinate D) = 0 \<and> (abscissa C - abscissa D) * (- abscissa A * (ordinate A - ordinate B) + ordinate A * (abscissa A - abscissa B)) = (abscissa A - abscissa B) * (- abscissa C * (ordinate C - ordinate D) + ordinate C * (abscissa C - abscissa D))); - (ordinate A - ordinate B) * abscissa X + (abscissa A - abscissa B) * ordinate X = - abscissa A * (ordinate A - ordinate B) + ordinate A * (abscissa A - abscissa B); - (ordinate C - ordinate D) * abscissa X + (abscissa C - abscissa D) * ordinate X = - abscissa C * (ordinate C - ordinate D) + ordinate C * (abscissa C - abscissa D)\<rbrakk> \<Longrightarrow> abscissa X \<in> radical_sqrt \<and> ordinate X \<in> radical_sqrt
abscissa A \<in> radical_sqrt
ordinate A \<in> radical_sqrt
abscissa B \<in> radical_sqrt
ordinate B \<in> radical_sqrt
abscissa C \<in> radical_sqrt
ordinate C \<in> radical_sqrt
abscissa D \<in> radical_sqrt
ordinate D \<in> radical_sqrt
- (ordinate A - ordinate B) * abscissa X + (abscissa A - abscissa B) * ordinate X = - abscissa A * (ordinate A - ordinate B) + ordinate A * (abscissa A - abscissa B)
- (ordinate A - ordinate B) \<in> radical_sqrt
abscissa A - abscissa B \<in> radical_sqrt
- abscissa A * (ordinate A - ordinate B) + ordinate A * (abscissa A - abscissa B) \<in> radical_sqrt
- (ordinate C - ordinate D) \<in> radical_sqrt
abscissa C - abscissa D \<in> radical_sqrt
- abscissa C * (ordinate C - ordinate D) + ordinate C * (abscissa C - abscissa D) \<in> radical_sqrt
- (ordinate C - ordinate D) * abscissa X + (abscissa C - abscissa D) * ordinate X = - abscissa C * (ordinate C - ordinate D) + ordinate C * (abscissa C - abscissa D)

goal (1 subgoal):
 1. abscissa X \<in> radical_sqrt \<and> ordinate X \<in> radical_sqrt
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
abscissa X \<in> radical_sqrt \<and> ordinate X \<in> radical_sqrt

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma of_complex_inner_1 [simp]:
  "cinner (of_complex x) (1 :: 'a :: {complex_inner, complex_normed_algebra_1}) = cnj x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. cinner (of_complex x) (1::'a) = cnj x
[PROOF STEP]
by (metis Complex_Inner_Product0.complex_inner_1_right cinner_complex_def cinner_mult_left complex_cnj_one norm_one of_complex_def power2_norm_eq_cinner scaleC_conv_of_complex)


[STATEMENT]
lemma nths_map: "nths (map f xs) I = map f (nths xs I)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. nths (map f xs) I = map f (nths xs I)
[PROOF STEP]
by(induction xs arbitrary: I) (simp_all add: nths_Cons)


[STATEMENT]
lemma sin_pi_minus [simp]: "sin (pi - x) = sin x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. sin (pi - x) = sin x
[PROOF STEP]
by (metis sin_minus sin_periodic_pi minus_minus uminus_add_conv_diff)


[STATEMENT]
lemma interval_integral_Ioc':
  "a \<le> b \<Longrightarrow> (LBINT x=a..b. f x) = (LBINT x : {x. a < ereal x \<and> ereal x \<le> b}. f x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. a \<le> b \<Longrightarrow> interval_lebesgue_integral lborel a b f = set_lebesgue_integral lborel {x. a < ereal x \<and> ereal x \<le> b} f
[PROOF STEP]
by (auto intro!: set_integral_discrete_difference[where X="{real_of_ereal a, real_of_ereal b}"]
           simp add: interval_lebesgue_integral_def einterval_iff)


[STATEMENT]
lemma Rep_minus[simp]: "Rep_matrix (-(A::_::group_add)) x y = - (Rep_matrix A x y)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Rep_matrix (- A) x y = - Rep_matrix A x y
[PROOF STEP]
by (simp add: minus_matrix_def)


[STATEMENT]
lemma real_of_nat_div3: "real n / real x - real (n div x) \<le> 1" for n x :: nat
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. real n / real x - real (n div x) \<le> 1
[PROOF STEP]
proof (cases "x = 0")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. x = 0 \<Longrightarrow> real n / real x - real (n div x) \<le> 1
 2. x \<noteq> 0 \<Longrightarrow> real n / real x - real (n div x) \<le> 1
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
x \<noteq> 0

goal (2 subgoals):
 1. x = 0 \<Longrightarrow> real n / real x - real (n div x) \<le> 1
 2. x \<noteq> 0 \<Longrightarrow> real n / real x - real (n div x) \<le> 1
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
x \<noteq> 0
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
x \<noteq> 0

goal (1 subgoal):
 1. real n / real x - real (n div x) \<le> 1
[PROOF STEP]
by (metis of_int_of_nat_eq real_of_int_div3 zdiv_int)
[PROOF STATE]
proof (state)
this:
real n / real x - real (n div x) \<le> 1

goal (1 subgoal):
 1. x = 0 \<Longrightarrow> real n / real x - real (n div x) \<le> 1
[PROOF STEP]
qed auto


[STATEMENT]
lemma starfun_ln_Infinitesimal_less_zero:
  "\<lbrakk>x \<in> Infinitesimal; 0 < x\<rbrakk> \<Longrightarrow> ( *f* real_ln) x < 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>x \<in> Infinitesimal; 0 < x\<rbrakk> \<Longrightarrow> (*f* real_ln) x < 0
[PROOF STEP]
by (auto intro!: starfun_ln_less_zero simp add: Infinitesimal_def)


[STATEMENT]
lemma convex_less_inS:
  fixes f :: "'a::euclidean_space \<Rightarrow> ereal"
  assumes "convex_on UNIV f"
  assumes "convex S" "S \<le> domain f"
  assumes "\<exists>x\<in>closure S. f x < a"
  shows "\<exists>x\<in>S. f x < a"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>x\<in>S. f x < a
[PROOF STEP]
using convex_less_in_riS[of f S a] rel_interior_subset[of S] assms
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>Lower_Semicontinuous.convex_on UNIV f; convex S; rel_interior S \<subseteq> domain f; \<exists>x\<in>closure S. f x < a\<rbrakk> \<Longrightarrow> \<exists>x\<in>rel_interior S. f x < a
rel_interior S \<subseteq> S
Lower_Semicontinuous.convex_on UNIV f
convex S
S \<subseteq> domain f
\<exists>x\<in>closure S. f x < a

goal (1 subgoal):
 1. \<exists>x\<in>S. f x < a
[PROOF STEP]
by auto


[STATEMENT]
lemma singleton_matrix_le[simp]: "(singleton_matrix j i a <= singleton_matrix j i b) = (a <= (b::_::order))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (singleton_matrix j i a \<le> singleton_matrix j i b) = (a \<le> b)
[PROOF STEP]
by (auto simp add: le_matrix_def)


[STATEMENT]
lemma nat_of_ord_0 [simp]: "nat_of_ord 0 = 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. nat_of_ord 0 = 0
[PROOF STEP]
by (metis (mono_tags) nat_of_ord_ord_of ord_of.simps(1))


[STATEMENT]
lemma face_of_Int_Int: "\<lbrakk>F face_of T; F' face_of t'\<rbrakk> \<Longrightarrow> (F \<inter> F') face_of (T \<inter> t')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>F face_of T; F' face_of t'\<rbrakk> \<Longrightarrow> F \<inter> F' face_of T \<inter> t'
[PROOF STEP]
unfolding face_of_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>F \<subseteq> T \<and> convex F \<and> (\<forall>a\<in>T. \<forall>b\<in>T. \<forall>x\<in>F. x \<in> open_segment a b \<longrightarrow> a \<in> F \<and> b \<in> F); F' \<subseteq> t' \<and> convex F' \<and> (\<forall>a\<in>t'. \<forall>b\<in>t'. \<forall>x\<in>F'. x \<in> open_segment a b \<longrightarrow> a \<in> F' \<and> b \<in> F')\<rbrakk> \<Longrightarrow> F \<inter> F' \<subseteq> T \<inter> t' \<and> convex (F \<inter> F') \<and> (\<forall>a\<in>T \<inter> t'. \<forall>b\<in>T \<inter> t'. \<forall>x\<in>F \<inter> F'. x \<in> open_segment a b \<longrightarrow> a \<in> F \<inter> F' \<and> b \<in> F \<inter> F')
[PROOF STEP]
by (blast intro: convex_Int)


[STATEMENT]
lemma divide_eq_eq_1 [simp]:
  "(b/a = 1) = ((a \<noteq> 0 & a = b))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (b / a = (1::'a)) = (a \<noteq> (0::'a) \<and> a = b)
[PROOF STEP]
by (auto simp add: divide_eq_eq)


[STATEMENT]
lemma rel: "wf rel"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. wf rel
[PROOF STEP]
unfolding rel_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. wf (\<Union> (rels ` {pointsTo. wf {(l, l'). pointsTo l' = Link l}}))
[PROOF STEP]
apply(rule wf_UN)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>i. i \<in> {pointsTo. wf {(l, l'). pointsTo l' = Link l}} \<Longrightarrow> wf (rels i)
 2. \<And>i j. \<lbrakk>i \<in> {pointsTo. wf {(l, l'). pointsTo l' = Link l}}; j \<in> {pointsTo. wf {(l, l'). pointsTo l' = Link l}}; rels i \<noteq> rels j\<rbrakk> \<Longrightarrow> Domain (rels i) \<inter> Range (rels j) = {}
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. i_ \<in> {pointsTo. wf {(l, l'). pointsTo l' = Link l}} \<Longrightarrow> wf (rels i_)
[PROOF STEP]
by (auto intro: wf_UN)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>i j. \<lbrakk>i \<in> {pointsTo. wf {(l, l'). pointsTo l' = Link l}}; j \<in> {pointsTo. wf {(l, l'). pointsTo l' = Link l}}; rels i \<noteq> rels j\<rbrakk> \<Longrightarrow> Domain (rels i) \<inter> Range (rels j) = {}
[PROOF STEP]
unfolding rels_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>i j. \<lbrakk>i \<in> {pointsTo. wf {(l, l'). pointsTo l' = Link l}}; j \<in> {pointsTo. wf {(l, l'). pointsTo l' = Link l}}; {((i, i l'), i, Link l') |l'. True} \<noteq> {((j, j l'), j, Link l') |l'. True}\<rbrakk> \<Longrightarrow> Domain {((i, i l'), i, Link l') |l'. True} \<inter> Range {((j, j l'), j, Link l') |l'. True} = {}
[PROOF STEP]
by auto


[STATEMENT]
lemma compact_rel_frontier:
  fixes S :: "'n::euclidean_space set"
  shows "compact S \<Longrightarrow> compact(rel_frontier S)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. compact S \<Longrightarrow> compact (rel_frontier S)
[PROOF STEP]
by (meson compact_eq_bounded_closed compact_rel_frontier_bounded)


[STATEMENT]
lemma iT_Minus_Un: "k \<ominus> (A \<union> B) = (k \<ominus> A) \<union> (k \<ominus> B)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. k \<ominus> A \<union> B = (k \<ominus> A) \<union> (k \<ominus> B)
[PROOF STEP]
by (fastforce simp: iT_Minus_def)


[STATEMENT]
lemma F_g_one [simp]: "F (\<lambda>x . g x \<^bold>* \<^bold>1) A = F g A"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. F (\<lambda>x. g x \<^bold>* \<^bold>1) A = F g A
[PROOF STEP]
apply (induct A rule: infinite_finite_induct)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>A. infinite A \<Longrightarrow> F (\<lambda>x. g x \<^bold>* \<^bold>1) A = F g A
 2. F (\<lambda>x. g x \<^bold>* \<^bold>1) {} = F g {}
 3. \<And>x Fa. \<lbrakk>finite Fa; x \<notin> Fa; F (\<lambda>x. g x \<^bold>* \<^bold>1) Fa = F g Fa\<rbrakk> \<Longrightarrow> F (\<lambda>x. g x \<^bold>* \<^bold>1) (insert x Fa) = F g (insert x Fa)
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. F (\<lambda>x. g x \<^bold>* \<^bold>1) {} = F g {}
 2. \<And>x Fa. \<lbrakk>finite Fa; x \<notin> Fa; F (\<lambda>x. g x \<^bold>* \<^bold>1) Fa = F g Fa\<rbrakk> \<Longrightarrow> F (\<lambda>x. g x \<^bold>* \<^bold>1) (insert x Fa) = F g (insert x Fa)
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x Fa. \<lbrakk>finite Fa; x \<notin> Fa; F (\<lambda>x. g x \<^bold>* \<^bold>1) Fa = F g Fa\<rbrakk> \<Longrightarrow> F (\<lambda>x. g x \<^bold>* \<^bold>1) (insert x Fa) = F g (insert x Fa)
[PROOF STEP]
by (metis one_F assoc insert)


[STATEMENT]
lemma "(2::int) < 3"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 2 < 3
[PROOF STEP]
by normalization


[STATEMENT]
theorem tailrec_transform:
    "m \<bind> REC (\<lambda>D s. sup (a s \<bind> D) (b s)) = lfp (\<lambda>x. sup m (bind x a)) \<bind> b"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. m \<bind> REC (\<lambda>D s. sup (a s \<bind> D) (b s)) = lfp (\<lambda>x. sup m (x \<bind> a)) \<bind> b
[PROOF STEP]
apply (rule antisym)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. m \<bind> REC (\<lambda>D s. sup (a s \<bind> D) (b s)) \<le> lfp (\<lambda>x. sup m (x \<bind> a)) \<bind> b
 2. lfp (\<lambda>x. sup m (x \<bind> a)) \<bind> b \<le> m \<bind> REC (\<lambda>D s. sup (a s \<bind> D) (b s))
[PROOF STEP]
apply (rule tailrec_transform1)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. lfp (\<lambda>x. sup m (x \<bind> a)) \<bind> b \<le> m \<bind> REC (\<lambda>D s. sup (a s \<bind> D) (b s))
[PROOF STEP]
apply (rule tailrec_transform2)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma "(\<forall>x. P \<or> Q(x))  =  (P \<or> (\<forall>x. Q(x)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<forall>x. P \<or> Q x) = (P \<or> (\<forall>x. Q x))
[PROOF STEP]
by blast


[STATEMENT]
lemma mset_append [simp]: "mset (xs @ ys) = mset xs + mset ys"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mset (xs @ ys) = mset xs + mset ys
[PROOF STEP]
by (induct xs arbitrary: ys) auto


[STATEMENT]
lemma store_cond:
  assumes "store h c val = Success h'"
  shows "\<exists> m. Mapping.lookup (heap_map h') (block_id c) = Some (Map m)
          \<and> offset c \<ge> fst (bounds m)
          \<and> offset c + |memval_type val|\<^sub>\<tau> \<le> snd (bounds m)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>m. Mapping.lookup (heap_map h') (block_id c) = Some (Map m) \<and> int (fst (bounds m)) \<le> offset c \<and> offset c + int |memval_type val|\<^sub>\<tau> \<le> int (snd (bounds m))
[PROOF STEP]
using store_cond_bytes[OF assms(1)] store_cond_cap[OF assms(1)]
[PROOF STATE]
proof (prove)
using this:
\<forall>x. val \<noteq> Cap_v x \<Longrightarrow> \<exists>m. Mapping.lookup (heap_map h') (block_id c) = Some (Map m) \<and> int (fst (bounds m)) \<le> offset c \<and> offset c + int |memval_type val|\<^sub>\<tau> \<le> int (snd (bounds m))
val = Cap_v ?v \<Longrightarrow> \<exists>m. Mapping.lookup (heap_map h') (block_id c) = Some (Map m) \<and> int (fst (bounds m)) \<le> offset c \<and> offset c + int |memval_type val|\<^sub>\<tau> \<le> int (snd (bounds m))

goal (1 subgoal):
 1. \<exists>m. Mapping.lookup (heap_map h') (block_id c) = Some (Map m) \<and> int (fst (bounds m)) \<le> offset c \<and> offset c + int |memval_type val|\<^sub>\<tau> \<le> int (snd (bounds m))
[PROOF STEP]
by blast


[STATEMENT]
lemma lhopital_left_at_top_at_bot:
  fixes f g :: "real \<Rightarrow> real"
  assumes f_0: "LIM x at_left a. f x :> at_top"
  assumes g_0: "LIM x at_left a. g x :> at_bot"
    and ev:
      "eventually (\<lambda>x. DERIV f x :> f' x) (at_left a)"
      "eventually (\<lambda>x. DERIV g x :> g' x) (at_left a)"
    and lim: "filterlim (\<lambda> x. (f' x / g' x)) at_bot (at_left a)"
  shows "filterlim (\<lambda> x. f x / g x) at_bot (at_left a)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. LIM x at_left a. f x / g x :> at_bot
[PROOF STEP]
by (insert assms, unfold eventually_at_left_to_right filterlim_at_left_to_right DERIV_mirror,
      rule lhopital_right_at_top_at_bot[where f'="\<lambda>x. - f' (- x)"])
     (insert assms, auto simp: DERIV_mirror)


[STATEMENT]
lemma to_int_mod_ring_plus: "to_int_mod_ring ((x :: 'a mod_ring) + y) = M (to_int_mod_ring x + to_int_mod_ring y)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. to_int_mod_ring (x + y) = M (to_int_mod_ring x + to_int_mod_ring y)
[PROOF STEP]
unfolding M_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. to_int_mod_ring (x + y) = (to_int_mod_ring x + to_int_mod_ring y) mod m
[PROOF STEP]
using m
[PROOF STATE]
proof (prove)
using this:
m = int CARD('a)

goal (1 subgoal):
 1. to_int_mod_ring (x + y) = (to_int_mod_ring x + to_int_mod_ring y) mod m
[PROOF STEP]
by (transfer, auto)


[STATEMENT]
lemma "(-x = -y) = (x = (y::real))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (- x = - y) = (x = y)
[PROOF STEP]
by arith


[STATEMENT]
lemma DERIV_pos_imp_increasing:
  fixes a b :: real and f :: "real \<Rightarrow> real"
  assumes "a < b"
    and der: "\<And>x. \<lbrakk>a \<le> x; x \<le> b\<rbrakk> \<Longrightarrow> \<exists>y. DERIV f x :> y \<and> y > 0"
  shows "f a < f b"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. f a < f b
[PROOF STEP]
by (metis less_le_not_le DERIV_atLeastAtMost_imp_continuous_on DERIV_pos_imp_increasing_open [OF \<open>a < b\<close>] der)


[STATEMENT]
lemma GS_rec_fun_inner_vec: "GS_rec_fun_inner v s a = GS_rec_step (d(s := a)) (vec_lambda v) $ s"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. GS_rec_fun_inner v s a = GS_rec_step (d(s := a)) (vec_lambda (apply_bfun v)) $ s
[PROOF STEP]
unfolding GS_rec_step_elem
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. GS_rec_fun_inner v s a = r (s, (d(s := a)) s) + l * ((\<Sum>s'<s. pmf (K (s, (d(s := a)) s)) s' * GS_rec (vec_lambda (apply_bfun v)) $ s') + (\<Sum>s'\<in>Collect ((\<le>) s). pmf (K (s, (d(s := a)) s)) s' * vec_lambda (apply_bfun v) $ s'))
[PROOF STEP]
by (auto simp: GS_rec_fun_inner_def GS_rec_def GS_rec_fun\<^sub>b.rep_eq vec_lambda_inverse)


[STATEMENT]
lemma GS_inv_blinfun_to_matrix: "((inv\<^sub>L (Q_GS d)) (r_det\<^sub>b d + R_GS d v)) = Bfun (vec_nth (GS_inv d (vec_lambda v)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. blinfun_apply (inv\<^sub>L (Q_GS d)) (r_det\<^sub>b d + blinfun_apply (R_GS d) v) = bfun.Bfun (($) (GS_inv d (vec_lambda (apply_bfun v))))
[PROOF STEP]
unfolding GS_inv_def plus_bfun_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. blinfun_apply (inv\<^sub>L (Q_GS d)) (map_fun apply_bfun (map_fun apply_bfun bfun.Bfun) (\<lambda>f g x. f x + g x) (r_det\<^sub>b d) (blinfun_apply (R_GS d) v)) = bfun.Bfun (($) (matrix_inv (Q_mat d) *v (r_vec d + R_mat d *v vec_lambda (apply_bfun v))))
[PROOF STEP]
by (auto simp: invertible_Q_GS blinfun_to_matrix_inverse(2)[symmetric] blinfun_to_matrix_mult'' apply_bfun_inverse )


[STATEMENT]
lemma imult_ile_mono: "\<lbrakk> (i::enat) \<le> j; k \<le> l \<rbrakk> \<Longrightarrow> i * k \<le> j * l"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>i \<le> j; k \<le> l\<rbrakk> \<Longrightarrow> i * k \<le> j * l
[PROOF STEP]
apply (case_tac i, case_tac j, case_tac k, case_tac l, simp_all add: mult_le_mono)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>nat. \<lbrakk>k \<le> l; i = enat nat; j = \<infinity>\<rbrakk> \<Longrightarrow> enat nat * k \<le> \<infinity> * l
 2. \<lbrakk>j = \<infinity>; k \<le> l; i = \<infinity>\<rbrakk> \<Longrightarrow> \<infinity> * k \<le> \<infinity> * l
[PROOF STEP]
apply (case_tac k, case_tac l, simp_all)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>j = \<infinity>; k \<le> l; i = \<infinity>\<rbrakk> \<Longrightarrow> \<infinity> * k \<le> \<infinity> * l
[PROOF STEP]
apply (case_tac k, case_tac l, simp_all)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma going_to_sup:
  "f going_to (sup F G) within A \<ge> sup (f going_to F within A) (f going_to G within A)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. sup (f going_to F within A) (f going_to G within A) \<le> f going_to sup F G within A
[PROOF STEP]
by (auto simp: going_to_within_def intro!: inf.coboundedI1 filtercomap_sup filtercomap_mono)


[STATEMENT]
lemma pred_spmf_of_set [simp]: "pred_spmf P (spmf_of_set A) = (finite A \<longrightarrow> Ball A P)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pred_spmf P (spmf_of_set A) = (finite A \<longrightarrow> Ball A P)
[PROOF STEP]
by(auto simp add: pred_spmf_def set_spmf_of_set)


[STATEMENT]
lemma fibfib: "fib' h + 1 = fib (Suc(Suc h))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fib' h + 1 = fib (Suc (Suc h))
[PROOF STEP]
by (induction h rule: fib_tree.induct) auto


[STATEMENT]
theorem reduce_system_sign_conditions_R:
  fixes p:: "real poly"
  fixes qs :: "real poly list"
  fixes subsets :: "(nat list*nat list) list"
  fixes signs :: "rat list list"
  assumes nonzero: "p \<noteq> 0"
  assumes welldefined_signs1: "well_def_signs (length qs) signs"
  assumes distinct_signs: "distinct signs"
  assumes all_info: "set (characterize_consistent_signs_at_roots p qs) \<subseteq> set(signs)"
  assumes match: "satisfy_equation_R p qs subsets signs"
  assumes invertible_mat: "invertible_mat (matrix_A_R signs subsets)"
  shows "set (get_signs_R (reduce_system_R p (qs, ((matrix_A_R signs subsets), (subsets, signs))))) = set (characterize_consistent_signs_at_roots p qs)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. set (get_signs_R (reduce_system_R p (qs, M_mat_R signs subsets, subsets, signs))) = set (characterize_consistent_signs_at_roots p qs)
[PROOF STEP]
unfolding get_signs_R_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. set (snd (snd (reduce_system_R p (qs, M_mat_R signs subsets, subsets, signs)))) = set (characterize_consistent_signs_at_roots p qs)
[PROOF STEP]
using reduction_deletes_bad_sign_conds_R[of p qs signs subsets]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>p \<noteq> 0; well_def_signs (length qs) signs; distinct signs; set (characterize_consistent_signs_at_roots p qs) \<subseteq> set signs; satisfy_equation_R p qs subsets signs; invertible_mat (M_mat_R signs subsets)\<rbrakk> \<Longrightarrow> set (characterize_consistent_signs_at_roots p qs) = set (reduction_signs_R p qs signs subsets (M_mat_R signs subsets))

goal (1 subgoal):
 1. set (snd (snd (reduce_system_R p (qs, M_mat_R signs subsets, subsets, signs)))) = set (characterize_consistent_signs_at_roots p qs)
[PROOF STEP]
apply (auto)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>\<lbrakk>p \<noteq> 0; well_def_signs (length qs) signs; distinct signs; set (characterize_consistent_signs_at_roots p qs) \<subseteq> set signs; satisfy_equation_R p qs subsets signs; invertible_mat (M_mat_R signs subsets)\<rbrakk> \<Longrightarrow> set (characterize_consistent_signs_at_roots p qs) = set (reduction_signs_R p qs signs subsets (M_mat_R signs subsets)); x \<in> set (snd (snd (let reduce_cols_A = take_cols_from_matrix (M_mat_R signs subsets) (find_nonzeros_from_input_vec (solve_for_lhs_R p qs subsets (M_mat_R signs subsets))); rows_keep = rows_to_keep reduce_cols_A in (take_rows_from_matrix reduce_cols_A rows_keep, take_indices subsets rows_keep, take_indices signs (find_nonzeros_from_input_vec (solve_for_lhs_R p qs subsets (M_mat_R signs subsets)))))))\<rbrakk> \<Longrightarrow> x \<in> set (characterize_consistent_signs_at_roots p qs)
 2. \<And>x. \<lbrakk>\<lbrakk>p \<noteq> 0; well_def_signs (length qs) signs; distinct signs; set (characterize_consistent_signs_at_roots p qs) \<subseteq> set signs; satisfy_equation_R p qs subsets signs; invertible_mat (M_mat_R signs subsets)\<rbrakk> \<Longrightarrow> set (characterize_consistent_signs_at_roots p qs) = set (reduction_signs_R p qs signs subsets (M_mat_R signs subsets)); x \<in> set (characterize_consistent_signs_at_roots p qs)\<rbrakk> \<Longrightarrow> x \<in> set (snd (snd (let reduce_cols_A = take_cols_from_matrix (M_mat_R signs subsets) (find_nonzeros_from_input_vec (solve_for_lhs_R p qs subsets (M_mat_R signs subsets))); rows_keep = rows_to_keep reduce_cols_A in (take_rows_from_matrix reduce_cols_A rows_keep, take_indices subsets rows_keep, take_indices signs (find_nonzeros_from_input_vec (solve_for_lhs_R p qs subsets (M_mat_R signs subsets)))))))
[PROOF STEP]
apply (simp add: all_info distinct_signs match nonzero reduction_signs_def welldefined_signs1)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>invertible_mat (M_mat_R signs subsets) \<Longrightarrow> set (characterize_consistent_signs_at_roots p qs) = set (reduction_signs_R p qs signs subsets (M_mat_R signs subsets)); x \<in> set (snd (snd (let reduce_cols_A = take_cols_from_matrix (M_mat_R signs subsets) (find_nonzeros_from_input_vec (solve_for_lhs_R p qs subsets (M_mat_R signs subsets))); rows_keep = rows_to_keep reduce_cols_A in (take_rows_from_matrix reduce_cols_A rows_keep, take_indices subsets rows_keep, take_indices signs (find_nonzeros_from_input_vec (solve_for_lhs_R p qs subsets (M_mat_R signs subsets)))))))\<rbrakk> \<Longrightarrow> x \<in> set (characterize_consistent_signs_at_roots p qs)
 2. \<And>x. \<lbrakk>\<lbrakk>p \<noteq> 0; well_def_signs (length qs) signs; distinct signs; set (characterize_consistent_signs_at_roots p qs) \<subseteq> set signs; satisfy_equation_R p qs subsets signs; invertible_mat (M_mat_R signs subsets)\<rbrakk> \<Longrightarrow> set (characterize_consistent_signs_at_roots p qs) = set (reduction_signs_R p qs signs subsets (M_mat_R signs subsets)); x \<in> set (characterize_consistent_signs_at_roots p qs)\<rbrakk> \<Longrightarrow> x \<in> set (snd (snd (let reduce_cols_A = take_cols_from_matrix (M_mat_R signs subsets) (find_nonzeros_from_input_vec (solve_for_lhs_R p qs subsets (M_mat_R signs subsets))); rows_keep = rows_to_keep reduce_cols_A in (take_rows_from_matrix reduce_cols_A rows_keep, take_indices subsets rows_keep, take_indices signs (find_nonzeros_from_input_vec (solve_for_lhs_R p qs subsets (M_mat_R signs subsets)))))))
[PROOF STEP]
using nonzero invertible_mat snd_conv
[PROOF STATE]
proof (prove)
using this:
p \<noteq> 0
invertible_mat (M_mat_R signs subsets)
snd (?x1.0, ?x2.0) = ?x2.0

goal (2 subgoals):
 1. \<And>x. \<lbrakk>invertible_mat (M_mat_R signs subsets) \<Longrightarrow> set (characterize_consistent_signs_at_roots p qs) = set (reduction_signs_R p qs signs subsets (M_mat_R signs subsets)); x \<in> set (snd (snd (let reduce_cols_A = take_cols_from_matrix (M_mat_R signs subsets) (find_nonzeros_from_input_vec (solve_for_lhs_R p qs subsets (M_mat_R signs subsets))); rows_keep = rows_to_keep reduce_cols_A in (take_rows_from_matrix reduce_cols_A rows_keep, take_indices subsets rows_keep, take_indices signs (find_nonzeros_from_input_vec (solve_for_lhs_R p qs subsets (M_mat_R signs subsets)))))))\<rbrakk> \<Longrightarrow> x \<in> set (characterize_consistent_signs_at_roots p qs)
 2. \<And>x. \<lbrakk>\<lbrakk>p \<noteq> 0; well_def_signs (length qs) signs; distinct signs; set (characterize_consistent_signs_at_roots p qs) \<subseteq> set signs; satisfy_equation_R p qs subsets signs; invertible_mat (M_mat_R signs subsets)\<rbrakk> \<Longrightarrow> set (characterize_consistent_signs_at_roots p qs) = set (reduction_signs_R p qs signs subsets (M_mat_R signs subsets)); x \<in> set (characterize_consistent_signs_at_roots p qs)\<rbrakk> \<Longrightarrow> x \<in> set (snd (snd (let reduce_cols_A = take_cols_from_matrix (M_mat_R signs subsets) (find_nonzeros_from_input_vec (solve_for_lhs_R p qs subsets (M_mat_R signs subsets))); rows_keep = rows_to_keep reduce_cols_A in (take_rows_from_matrix reduce_cols_A rows_keep, take_indices subsets rows_keep, take_indices signs (find_nonzeros_from_input_vec (solve_for_lhs_R p qs subsets (M_mat_R signs subsets)))))))
[PROOF STEP]
apply (metis reduction_signs_R_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>\<lbrakk>p \<noteq> 0; well_def_signs (length qs) signs; distinct signs; set (characterize_consistent_signs_at_roots p qs) \<subseteq> set signs; satisfy_equation_R p qs subsets signs; invertible_mat (M_mat_R signs subsets)\<rbrakk> \<Longrightarrow> set (characterize_consistent_signs_at_roots p qs) = set (reduction_signs_R p qs signs subsets (M_mat_R signs subsets)); x \<in> set (characterize_consistent_signs_at_roots p qs)\<rbrakk> \<Longrightarrow> x \<in> set (snd (snd (let reduce_cols_A = take_cols_from_matrix (M_mat_R signs subsets) (find_nonzeros_from_input_vec (solve_for_lhs_R p qs subsets (M_mat_R signs subsets))); rows_keep = rows_to_keep reduce_cols_A in (take_rows_from_matrix reduce_cols_A rows_keep, take_indices subsets rows_keep, take_indices signs (find_nonzeros_from_input_vec (solve_for_lhs_R p qs subsets (M_mat_R signs subsets)))))))
[PROOF STEP]
by (metis all_info distinct_signs invertible_mat match nonzero reduction_signs_R_def snd_conv welldefined_signs1)


[STATEMENT]
lemma nonEmptySet:
shows "A \<noteq> [] \<longrightarrow> (\<exists> a. a \<in> set A)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. A \<noteq> [] \<longrightarrow> (\<exists>a. a \<in> set A)
[PROOF STEP]
by (auto simp add:neq_Nil_conv)


[STATEMENT]
lemma inf_par_product: "(a \<sqinter> b) \<parallel> (c \<sqinter> d) = (a \<parallel> c) \<sqinter> (a \<parallel> d) \<sqinter> (b \<parallel> c) \<sqinter> (b \<parallel> d)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (a \<sqinter> b) \<parallel> (c \<sqinter> d) = a \<parallel> c \<sqinter> a \<parallel> d \<sqinter> b \<parallel> c \<sqinter> b \<parallel> d
variables:
a, b, c, d :: 'a
(\<parallel>) :: 'a \<Rightarrow> 'a \<Rightarrow> 'a
type variables:
'a :: refinement_lattice
[PROOF STEP]
by (simp add: inf_commute inf_par_distrib inf_par_distrib2 inf_sup_aci(3))


[STATEMENT]
lemma child_mdeg_gt1_if_sub_fcard_gt1:
  "\<lbrakk>is_subtree (Node r xs) (Node v ys); Node r xs \<noteq> Node v ys; fcard xs > 1\<rbrakk>
    \<Longrightarrow> \<exists>t1 e2. (t1,e2) \<in> fset ys \<and> max_deg t1 > 1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>is_subtree (Node r xs) (Node v ys); Node r xs \<noteq> Node v ys; 1 < fcard xs\<rbrakk> \<Longrightarrow> \<exists>t1 e2. (t1, e2) \<in> fset ys \<and> 1 < max_deg t1
[PROOF STEP]
using mdeg_ge_fcard[of xs] mdeg_ge_sub
[PROOF STATE]
proof (prove)
using this:
fcard xs \<le> max_deg (Node ?r xs)
is_subtree ?t1.0 ?t2.0 \<Longrightarrow> max_deg ?t1.0 \<le> max_deg ?t2.0

goal (1 subgoal):
 1. \<lbrakk>is_subtree (Node r xs) (Node v ys); Node r xs \<noteq> Node v ys; 1 < fcard xs\<rbrakk> \<Longrightarrow> \<exists>t1 e2. (t1, e2) \<in> fset ys \<and> 1 < max_deg t1
[PROOF STEP]
by force


[STATEMENT]
lemma effective_row_col_match: assumes "matrix_match A1 A2 B1 B2"
 shows "\<forall>i j. ((i<(row_length A1)*(row_length B1))\<and>(j<(length A2)*(length B2)))
       \<longrightarrow>length (row A1 (i div (row_length B1))) = length (col A2  (j div (length B2)))"
  "\<forall>i j. ((i<(row_length A1)*(row_length B1))\<and>(j<(length A2)*(length B2)))
           \<longrightarrow>length (row B1 (i mod (row_length B1))) = length (col B2 (j mod (length B2)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>i j. i < row_length A1 * row_length B1 \<and> j < length A2 * length B2 \<longrightarrow> length (row A1 (i div row_length B1)) = length (col A2 (j div length B2)) &&& \<forall>i j. i < row_length A1 * row_length B1 \<and> j < length A2 * length B2 \<longrightarrow> length (row B1 (i mod row_length B1)) = length (col B2 (j mod length B2))
[PROOF STEP]
using assms row_col_match
[PROOF STATE]
proof (prove)
using this:
matrix_match A1 A2 B1 B2
\<lbrakk>mat (row_length ?A1.0) (length ?A1.0) ?A1.0; mat (row_length ?A2.0) (length ?A2.0) ?A2.0; mat (row_length ?B1.0) (length ?B1.0) ?B1.0; mat (row_length ?B2.0) (length ?B2.0) ?B2.0; length ?A1.0 = row_length ?A2.0; length ?B1.0 = row_length ?B2.0; ?A1.0 \<noteq> [] \<and> ?A2.0 \<noteq> [] \<and> ?B1.0 \<noteq> [] \<and> ?B2.0 \<noteq> []; ?i < row_length ?A1.0 * row_length ?B1.0; ?j < length ?A2.0 * length ?B2.0\<rbrakk> \<Longrightarrow> length (row ?A1.0 (?i div row_length ?B1.0)) = length (col ?A2.0 (?j div length ?B2.0))
\<lbrakk>mat (row_length ?A1.0) (length ?A1.0) ?A1.0; mat (row_length ?A2.0) (length ?A2.0) ?A2.0; mat (row_length ?B1.0) (length ?B1.0) ?B1.0; mat (row_length ?B2.0) (length ?B2.0) ?B2.0; length ?A1.0 = row_length ?A2.0; length ?B1.0 = row_length ?B2.0; ?A1.0 \<noteq> [] \<and> ?A2.0 \<noteq> [] \<and> ?B1.0 \<noteq> [] \<and> ?B2.0 \<noteq> []; ?i < row_length ?A1.0 * row_length ?B1.0; ?j < length ?A2.0 * length ?B2.0\<rbrakk> \<Longrightarrow> length (row ?B1.0 (?i mod row_length ?B1.0)) = length (col ?B2.0 (?j mod length ?B2.0))

goal (1 subgoal):
 1. \<forall>i j. i < row_length A1 * row_length B1 \<and> j < length A2 * length B2 \<longrightarrow> length (row A1 (i div row_length B1)) = length (col A2 (j div length B2)) &&& \<forall>i j. i < row_length A1 * row_length B1 \<and> j < length A2 * length B2 \<longrightarrow> length (row B1 (i mod row_length B1)) = length (col B2 (j mod length B2))
[PROOF STEP]
unfolding matrix_match_def
[PROOF STATE]
proof (prove)
using this:
mat (row_length A1) (length A1) A1 \<and> mat (row_length A2) (length A2) A2 \<and> mat (row_length B1) (length B1) B1 \<and> mat (row_length B2) (length B2) B2 \<and> length A1 = row_length A2 \<and> length B1 = row_length B2 \<and> A1 \<noteq> [] \<and> A2 \<noteq> [] \<and> B1 \<noteq> [] \<and> B2 \<noteq> []
\<lbrakk>mat (row_length ?A1.0) (length ?A1.0) ?A1.0; mat (row_length ?A2.0) (length ?A2.0) ?A2.0; mat (row_length ?B1.0) (length ?B1.0) ?B1.0; mat (row_length ?B2.0) (length ?B2.0) ?B2.0; length ?A1.0 = row_length ?A2.0; length ?B1.0 = row_length ?B2.0; ?A1.0 \<noteq> [] \<and> ?A2.0 \<noteq> [] \<and> ?B1.0 \<noteq> [] \<and> ?B2.0 \<noteq> []; ?i < row_length ?A1.0 * row_length ?B1.0; ?j < length ?A2.0 * length ?B2.0\<rbrakk> \<Longrightarrow> length (row ?A1.0 (?i div row_length ?B1.0)) = length (col ?A2.0 (?j div length ?B2.0))
\<lbrakk>mat (row_length ?A1.0) (length ?A1.0) ?A1.0; mat (row_length ?A2.0) (length ?A2.0) ?A2.0; mat (row_length ?B1.0) (length ?B1.0) ?B1.0; mat (row_length ?B2.0) (length ?B2.0) ?B2.0; length ?A1.0 = row_length ?A2.0; length ?B1.0 = row_length ?B2.0; ?A1.0 \<noteq> [] \<and> ?A2.0 \<noteq> [] \<and> ?B1.0 \<noteq> [] \<and> ?B2.0 \<noteq> []; ?i < row_length ?A1.0 * row_length ?B1.0; ?j < length ?A2.0 * length ?B2.0\<rbrakk> \<Longrightarrow> length (row ?B1.0 (?i mod row_length ?B1.0)) = length (col ?B2.0 (?j mod length ?B2.0))

goal (1 subgoal):
 1. \<forall>i j. i < row_length A1 * row_length B1 \<and> j < length A2 * length B2 \<longrightarrow> length (row A1 (i div row_length B1)) = length (col A2 (j div length B2)) &&& \<forall>i j. i < row_length A1 * row_length B1 \<and> j < length A2 * length B2 \<longrightarrow> length (row B1 (i mod row_length B1)) = length (col B2 (j mod length B2))
[PROOF STEP]
by auto


[STATEMENT]
lemma prime_not_sqr :
  assumes "is_prime p"
  shows "p \<noteq> n\<^sup>2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. p \<noteq> n\<^sup>2
[PROOF STEP]
by (metis assms is_prime_def order_less_irrefl power2_eq_square prime_factors)


[STATEMENT]
lemma invertible_mat_mult_int:
  assumes "A = P * B"
    and "P \<in> carrier_mat n n"
    and "B \<in> carrier_mat n n"
    and "invertible_mat P"
    and "invertible_mat (map_mat rat_of_int B)"
  shows "invertible_mat (map_mat rat_of_int A)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. invertible_mat (of_int_hom.mat_hom A)
[PROOF STEP]
by (metis (no_types, opaque_lifting) assms dvd_field_iff
      invertible_iff_is_unit_JNF invertible_mult_JNF map_carrier_mat not_is_unit_0
      of_int_hom.hom_0 of_int_hom.hom_det of_int_hom.mat_hom_mult)


[STATEMENT]
lemma "map Suc [1 + 1] = [Suc 2]"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. map Suc [1 + 1] = [Suc 2]
[PROOF STEP]
by (metis_exhaust list.map nat_1_add_1)


[STATEMENT]
lemma ideal_points_poincare_line_conjugate [simp]:
  assumes"u \<in> unit_disc" "v \<in> unit_disc" "u \<noteq> v"
  assumes "ideal_points (poincare_line u v) = {i1, i2}"
  shows "ideal_points (poincare_line (conjugate u) (conjugate v)) = {conjugate i1, conjugate i2}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ideal_points (poincare_line (conjugate u) (conjugate v)) = {conjugate i1, conjugate i2}
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
u \<in> unit_disc
v \<in> unit_disc
u \<noteq> v
ideal_points (poincare_line u v) = {i1, i2}

goal (1 subgoal):
 1. ideal_points (poincare_line (conjugate u) (conjugate v)) = {conjugate i1, conjugate i2}
[PROOF STEP]
by auto


[STATEMENT]
lemma tranclp_eqvt[eqvt]: "\<pi> \<bullet> tranclp P v\<^sub>1 v\<^sub>2 = tranclp (\<pi> \<bullet> P) (\<pi> \<bullet> v\<^sub>1) (\<pi> \<bullet> v\<^sub>2)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<pi> \<bullet> P\<^sup>+\<^sup>+ v\<^sub>1 v\<^sub>2 = (\<pi> \<bullet> P)\<^sup>+\<^sup>+ (\<pi> \<bullet> v\<^sub>1) (\<pi> \<bullet> v\<^sub>2)
[PROOF STEP]
unfolding tranclp_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<pi> \<bullet> lfp (\<lambda>p x1 x2. (\<exists>a b. x1 = a \<and> x2 = b \<and> P a b) \<or> (\<exists>a b c. x1 = a \<and> x2 = c \<and> p a b \<and> P b c)) v\<^sub>1 v\<^sub>2 = lfp (\<lambda>p x1 x2. (\<exists>a b. x1 = a \<and> x2 = b \<and> (\<pi> \<bullet> P) a b) \<or> (\<exists>a b c. x1 = a \<and> x2 = c \<and> p a b \<and> (\<pi> \<bullet> P) b c)) (\<pi> \<bullet> v\<^sub>1) (\<pi> \<bullet> v\<^sub>2)
[PROOF STEP]
by perm_simp rule


[STATEMENT]
lemma max_Length_fMin[simp]: "x |\<in>| m1\<^bsup>\<AA>\<^esup>k \<Longrightarrow> max (Length \<AA>) (fMin (m1\<^bsup>\<AA>\<^esup>k)) = Length \<AA>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x |\<in>| m1\<^bsup>\<AA>\<^esup>k \<Longrightarrow> max (Length \<AA>) (fMin (m1\<^bsup>\<AA>\<^esup>k)) = Length \<AA>
[PROOF STEP]
using fMin_less_Length[of x m1 \<AA> k]
[PROOF STATE]
proof (prove)
using this:
x |\<in>| m1\<^bsup>\<AA>\<^esup>k \<Longrightarrow> fMin (m1\<^bsup>\<AA>\<^esup>k) < Length \<AA>

goal (1 subgoal):
 1. x |\<in>| m1\<^bsup>\<AA>\<^esup>k \<Longrightarrow> max (Length \<AA>) (fMin (m1\<^bsup>\<AA>\<^esup>k)) = Length \<AA>
[PROOF STEP]
unfolding fMin_def
[PROOF STATE]
proof (prove)
using this:
x |\<in>| m1\<^bsup>\<AA>\<^esup>k \<Longrightarrow> semilattice_fset.F min (m1\<^bsup>\<AA>\<^esup>k) < Length \<AA>

goal (1 subgoal):
 1. x |\<in>| m1\<^bsup>\<AA>\<^esup>k \<Longrightarrow> max (Length \<AA>) (semilattice_fset.F min (m1\<^bsup>\<AA>\<^esup>k)) = Length \<AA>
[PROOF STEP]
by auto


[STATEMENT]
theorem Crypt2_Nonce_neq_Nonce:
  shows "Crypt K (Crypt K' (Nonce M)) \<noteq> Nonce N"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Crypt K (Crypt K' (Nonce M)) \<noteq> Nonce N
[PROOF STEP]
by (descending) (auto dest: msgrel_imp_eq_freediscrim)


[STATEMENT]
lemma mtf2_forward_effect1:
  "q \<in> set xs \<Longrightarrow> distinct xs \<Longrightarrow> index xs q < i \<and> i < length xs
      \<Longrightarrow> index (mtf2 n q xs) (xs ! i) = index xs (xs ! i) \<and> index xs q < index (mtf2 n q xs) (xs ! i) \<and> index (mtf2 n q xs) (xs ! i) < length xs" and
  mtf2_forward_effect2: "q \<in> set xs \<Longrightarrow> distinct xs \<Longrightarrow> index xs q = i
      \<Longrightarrow> index (mtf2 n q xs) (xs!i) = index xs q - n \<and> index xs q - n = index (mtf2 n q xs) (xs!i)" and
  mtf2_forward_effect3: "q \<in> set xs \<Longrightarrow> distinct xs \<Longrightarrow> index xs q - n \<le> i \<and> i < index xs q
      \<Longrightarrow> index (mtf2 n q xs) (xs!i) = Suc (index xs (xs!i)) \<and> index xs q - n < index (mtf2 n q xs) (xs!i) \<and> index (mtf2 n q xs) (xs!i) \<le> index xs q" and
  mtf2_forward_effect4: "q \<in> set xs \<Longrightarrow> distinct xs \<Longrightarrow> i < index xs q - n
      \<Longrightarrow> index (mtf2 n q xs) (xs!i) = index xs (xs!i) \<and> index (mtf2 n q xs) (xs!i) < index xs q - n"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<lbrakk>q \<in> set xs; distinct xs; index xs q < i \<and> i < length xs\<rbrakk> \<Longrightarrow> index (mtf2 n q xs) (xs ! i) = index xs (xs ! i) \<and> index xs q < index (mtf2 n q xs) (xs ! i) \<and> index (mtf2 n q xs) (xs ! i) < length xs) &&& (\<lbrakk>q \<in> set xs; distinct xs; index xs q = i\<rbrakk> \<Longrightarrow> index (mtf2 n q xs) (xs ! i) = index xs q - n \<and> index xs q - n = index (mtf2 n q xs) (xs ! i))) &&& (\<lbrakk>q \<in> set xs; distinct xs; index xs q - n \<le> i \<and> i < index xs q\<rbrakk> \<Longrightarrow> index (mtf2 n q xs) (xs ! i) = Suc (index xs (xs ! i)) \<and> index xs q - n < index (mtf2 n q xs) (xs ! i) \<and> index (mtf2 n q xs) (xs ! i) \<le> index xs q) &&& (\<lbrakk>q \<in> set xs; distinct xs; i < index xs q - n\<rbrakk> \<Longrightarrow> index (mtf2 n q xs) (xs ! i) = index xs (xs ! i) \<and> index (mtf2 n q xs) (xs ! i) < index xs q - n)
[PROOF STEP]
apply(safe)
[PROOF STATE]
proof (prove)
goal (10 subgoals):
 1. \<lbrakk>q \<in> set xs; distinct xs; index xs q < i; i < length xs\<rbrakk> \<Longrightarrow> index (mtf2 n q xs) (xs ! i) = index xs (xs ! i)
 2. \<lbrakk>q \<in> set xs; distinct xs; index xs q < i; i < length xs\<rbrakk> \<Longrightarrow> index xs q < index (mtf2 n q xs) (xs ! i)
 3. \<lbrakk>q \<in> set xs; distinct xs; index xs q < i; i < length xs\<rbrakk> \<Longrightarrow> index (mtf2 n q xs) (xs ! i) < length xs
 4. \<lbrakk>q \<in> set xs; distinct xs; i = index xs q\<rbrakk> \<Longrightarrow> index (mtf2 n q xs) (xs ! index xs q) = index xs q - n
 5. \<lbrakk>q \<in> set xs; distinct xs; i = index xs q\<rbrakk> \<Longrightarrow> index xs q - n = index (mtf2 n q xs) (xs ! index xs q)
 6. \<lbrakk>q \<in> set xs; distinct xs; index xs q - n \<le> i; i < index xs q\<rbrakk> \<Longrightarrow> index (mtf2 n q xs) (xs ! i) = Suc (index xs (xs ! i))
 7. \<lbrakk>q \<in> set xs; distinct xs; index xs q - n \<le> i; i < index xs q\<rbrakk> \<Longrightarrow> index xs q - n < index (mtf2 n q xs) (xs ! i)
 8. \<lbrakk>q \<in> set xs; distinct xs; index xs q - n \<le> i; i < index xs q\<rbrakk> \<Longrightarrow> index (mtf2 n q xs) (xs ! i) \<le> index xs q
 9. \<lbrakk>q \<in> set xs; distinct xs; i < index xs q - n\<rbrakk> \<Longrightarrow> index (mtf2 n q xs) (xs ! i) = index xs (xs ! i)
 10. \<lbrakk>q \<in> set xs; distinct xs; i < index xs q - n\<rbrakk> \<Longrightarrow> index (mtf2 n q xs) (xs ! i) < index xs q - n
[PROOF STEP]
using mtf2_effect
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?q \<in> set ?xs; distinct ?xs\<rbrakk> \<Longrightarrow> (index ?xs ?q < ?i \<and> ?i < length ?xs \<longrightarrow> index (mtf2 ?n ?q ?xs) (?xs ! ?i) = index ?xs (?xs ! ?i) \<and> index ?xs ?q < index (mtf2 ?n ?q ?xs) (?xs ! ?i) \<and> index (mtf2 ?n ?q ?xs) (?xs ! ?i) < length ?xs) \<and> (index ?xs ?q = ?i \<longrightarrow> index (mtf2 ?n ?q ?xs) (?xs ! ?i) = index ?xs ?q - ?n \<and> index (mtf2 ?n ?q ?xs) (?xs ! ?i) = index ?xs ?q - ?n) \<and> (index ?xs ?q - ?n \<le> ?i \<and> ?i < index ?xs ?q \<longrightarrow> index (mtf2 ?n ?q ?xs) (?xs ! ?i) = Suc (index ?xs (?xs ! ?i)) \<and> index ?xs ?q - ?n < index (mtf2 ?n ?q ?xs) (?xs ! ?i) \<and> index (mtf2 ?n ?q ?xs) (?xs ! ?i) \<le> index ?xs ?q) \<and> (?i < index ?xs ?q - ?n \<longrightarrow> index (mtf2 ?n ?q ?xs) (?xs ! ?i) = index ?xs (?xs ! ?i) \<and> index (mtf2 ?n ?q ?xs) (?xs ! ?i) < index ?xs ?q - ?n)

goal (10 subgoals):
 1. \<lbrakk>q \<in> set xs; distinct xs; index xs q < i; i < length xs\<rbrakk> \<Longrightarrow> index (mtf2 n q xs) (xs ! i) = index xs (xs ! i)
 2. \<lbrakk>q \<in> set xs; distinct xs; index xs q < i; i < length xs\<rbrakk> \<Longrightarrow> index xs q < index (mtf2 n q xs) (xs ! i)
 3. \<lbrakk>q \<in> set xs; distinct xs; index xs q < i; i < length xs\<rbrakk> \<Longrightarrow> index (mtf2 n q xs) (xs ! i) < length xs
 4. \<lbrakk>q \<in> set xs; distinct xs; i = index xs q\<rbrakk> \<Longrightarrow> index (mtf2 n q xs) (xs ! index xs q) = index xs q - n
 5. \<lbrakk>q \<in> set xs; distinct xs; i = index xs q\<rbrakk> \<Longrightarrow> index xs q - n = index (mtf2 n q xs) (xs ! index xs q)
 6. \<lbrakk>q \<in> set xs; distinct xs; index xs q - n \<le> i; i < index xs q\<rbrakk> \<Longrightarrow> index (mtf2 n q xs) (xs ! i) = Suc (index xs (xs ! i))
 7. \<lbrakk>q \<in> set xs; distinct xs; index xs q - n \<le> i; i < index xs q\<rbrakk> \<Longrightarrow> index xs q - n < index (mtf2 n q xs) (xs ! i)
 8. \<lbrakk>q \<in> set xs; distinct xs; index xs q - n \<le> i; i < index xs q\<rbrakk> \<Longrightarrow> index (mtf2 n q xs) (xs ! i) \<le> index xs q
 9. \<lbrakk>q \<in> set xs; distinct xs; i < index xs q - n\<rbrakk> \<Longrightarrow> index (mtf2 n q xs) (xs ! i) = index xs (xs ! i)
 10. \<lbrakk>q \<in> set xs; distinct xs; i < index xs q - n\<rbrakk> \<Longrightarrow> index (mtf2 n q xs) (xs ! i) < index xs q - n
[PROOF STEP]
by metis+


[STATEMENT]
lemma isOpair: "isOpair (Opair x y) = True"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. isOpair (Opair x y) = True
[PROOF STEP]
by (auto simp add: isOpair_def)


[STATEMENT]
lemma nn_integral_PairVal:
  "f \<in> borel_measurable (PRODUCT t1 t2) \<Longrightarrow>
    (\<integral>\<^sup>+x. f x \<partial>PRODUCT t1 t2) = (\<integral>\<^sup>+x. f (PairVal (fst x) (snd x)) \<partial>(t1 \<Otimes>\<^sub>M t2))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. f \<in> borel_measurable (stock_measure (PRODUCT t1 t2)) \<Longrightarrow> integral\<^sup>N (stock_measure (PRODUCT t1 t2)) f = \<integral>\<^sup>+ x. f <|fst x, snd x|> \<partial>stock_measure t1 \<Otimes>\<^sub>M stock_measure t2
[PROOF STEP]
unfolding stock_measure.simps
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. f \<in> borel_measurable (embed_measure (stock_measure t1 \<Otimes>\<^sub>M stock_measure t2) (\<lambda>(x, y). <|x, y|>)) \<Longrightarrow> integral\<^sup>N (embed_measure (stock_measure t1 \<Otimes>\<^sub>M stock_measure t2) (\<lambda>(x, y). <|x, y|>)) f = \<integral>\<^sup>+ x. f <|fst x, snd x|> \<partial>stock_measure t1 \<Otimes>\<^sub>M stock_measure t2
[PROOF STEP]
by (subst nn_integral_embed_measure) (simp_all add: split_beta' inj_on_def)


[STATEMENT]
lemma "\<forall>x xa xb. \<not> 2 \<le> int xb \<longrightarrow> int xb + (2 * int xa - int x) = 1 \<longrightarrow>
  (\<forall>xb xc. \<not> 2 \<le> int xc \<longrightarrow> int xc + (2 * int xb - int x) = 0 \<longrightarrow> (\<exists>xa. 2 * int xa = int x) \<longrightarrow> xb = xa)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>x xa xb. \<not> 2 \<le> int xb \<longrightarrow> int xb + (2 * int xa - int x) = 1 \<longrightarrow> (\<forall>xb xc. \<not> 2 \<le> int xc \<longrightarrow> int xc + (2 * int xb - int x) = 0 \<longrightarrow> (\<exists>xa. 2 * int xa = int x) \<longrightarrow> xb = xa)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<forall>x xa xb. \<not> 2 \<le> int xb \<longrightarrow> int xb + (2 * int xa - int x) = 1 \<longrightarrow> (\<forall>xb xc. \<not> 2 \<le> int xc \<longrightarrow> int xc + (2 * int xb - int x) = 0 \<longrightarrow> (\<exists>xa. 2 * int xa = int x) \<longrightarrow> xb = xa)
[PROOF STEP]
have "?thesis = eval_pf (Forall (Forall (Forall (Imp (Neg (Le [-1] (- 2)))
    (Imp (Eq [1, 2, -1] 1) (Forall (Forall (Imp (Neg (Le [-1] (- 2)))
      (Imp (Eq [1, 2, 0, 0, -1] 0) (Imp (Exist (Eq [2, 0, 0, 0, 0, -1] 0)) (Eq [0, 1, 0, -1] 0))))))))))) []"
    (is "_ = eval_pf ?P []")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<forall>x xa xb. \<not> 2 \<le> int xb \<longrightarrow> int xb + (2 * int xa - int x) = 1 \<longrightarrow> (\<forall>xb xc. \<not> 2 \<le> int xc \<longrightarrow> int xc + (2 * int xb - int x) = 0 \<longrightarrow> (\<exists>xa. 2 * int xa = int x) \<longrightarrow> xb = xa)) = eval_pf (Forall (Forall (Forall (Imp (Neg (Le [- 1] (- 2))) (Imp (Eq [1, 2, - 1] 1) (Forall (Forall (Imp (Neg (Le [- 1] (- 2))) (Imp (Eq [1, 2, 0, 0, - 1] 0) (Imp (Exist (Eq [2, 0, 0, 0, 0, - 1] 0)) (Eq [0, 1, 0, - 1] 0))))))))))) []
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
(\<forall>x xa xb. \<not> 2 \<le> int xb \<longrightarrow> int xb + (2 * int xa - int x) = 1 \<longrightarrow> (\<forall>xb xc. \<not> 2 \<le> int xc \<longrightarrow> int xc + (2 * int xb - int x) = 0 \<longrightarrow> (\<exists>xa. 2 * int xa = int x) \<longrightarrow> xb = xa)) = eval_pf (Forall (Forall (Forall (Imp (Neg (Le [- 1] (- 2))) (Imp (Eq [1, 2, - 1] 1) (Forall (Forall (Imp (Neg (Le [- 1] (- 2))) (Imp (Eq [1, 2, 0, 0, - 1] 0) (Imp (Exist (Eq [2, 0, 0, 0, 0, - 1] 0)) (Eq [0, 1, 0, - 1] 0))))))))))) []

goal (1 subgoal):
 1. \<forall>x xa xb. \<not> 2 \<le> int xb \<longrightarrow> int xb + (2 * int xa - int x) = 1 \<longrightarrow> (\<forall>xb xc. \<not> 2 \<le> int xc \<longrightarrow> int xc + (2 * int xb - int x) = 0 \<longrightarrow> (\<exists>xa. 2 * int xa = int x) \<longrightarrow> xb = xa)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(\<forall>x xa xb. \<not> 2 \<le> int xb \<longrightarrow> int xb + (2 * int xa - int x) = 1 \<longrightarrow> (\<forall>xb xc. \<not> 2 \<le> int xc \<longrightarrow> int xc + (2 * int xb - int x) = 0 \<longrightarrow> (\<exists>xa. 2 * int xa = int x) \<longrightarrow> xb = xa)) = eval_pf (Forall (Forall (Forall (Imp (Neg (Le [- 1] (- 2))) (Imp (Eq [1, 2, - 1] 1) (Forall (Forall (Imp (Neg (Le [- 1] (- 2))) (Imp (Eq [1, 2, 0, 0, - 1] 0) (Imp (Exist (Eq [2, 0, 0, 0, 0, - 1] 0)) (Eq [0, 1, 0, - 1] 0))))))))))) []

goal (1 subgoal):
 1. \<forall>x xa xb. \<not> 2 \<le> int xb \<longrightarrow> int xb + (2 * int xa - int x) = 1 \<longrightarrow> (\<forall>xb xc. \<not> 2 \<le> int xc \<longrightarrow> int xc + (2 * int xb - int x) = 0 \<longrightarrow> (\<exists>xa. 2 * int xa = int x) \<longrightarrow> xb = xa)
[PROOF STEP]
have "\<dots> = dfa_accepts (dfa_of_pf 0 ?P) []"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. eval_pf (Forall (Forall (Forall (Imp (Neg (Le [- 1] (- 2))) (Imp (Eq [1, 2, - 1] 1) (Forall (Forall (Imp (Neg (Le [- 1] (- 2))) (Imp (Eq [1, 2, 0, 0, - 1] 0) (Imp (Exist (Eq [2, 0, 0, 0, 0, - 1] 0)) (Eq [0, 1, 0, - 1] 0))))))))))) [] = dfa_accepts (dfa_of_pf 0 (Forall (Forall (Forall (Imp (Neg (Le [- 1] (- 2))) (Imp (Eq [1, 2, - 1] 1) (Forall (Forall (Imp (Neg (Le [- 1] (- 2))) (Imp (Eq [1, 2, 0, 0, - 1] 0) (Imp (Exist (Eq [2, 0, 0, 0, 0, - 1] 0)) (Eq [0, 1, 0, - 1] 0)))))))))))) []
[PROOF STEP]
by (simp add: dfa_of_pf_correctness del: dfa_of_pf.simps)
[PROOF STATE]
proof (state)
this:
eval_pf (Forall (Forall (Forall (Imp (Neg (Le [- 1] (- 2))) (Imp (Eq [1, 2, - 1] 1) (Forall (Forall (Imp (Neg (Le [- 1] (- 2))) (Imp (Eq [1, 2, 0, 0, - 1] 0) (Imp (Exist (Eq [2, 0, 0, 0, 0, - 1] 0)) (Eq [0, 1, 0, - 1] 0))))))))))) [] = dfa_accepts (dfa_of_pf 0 (Forall (Forall (Forall (Imp (Neg (Le [- 1] (- 2))) (Imp (Eq [1, 2, - 1] 1) (Forall (Forall (Imp (Neg (Le [- 1] (- 2))) (Imp (Eq [1, 2, 0, 0, - 1] 0) (Imp (Exist (Eq [2, 0, 0, 0, 0, - 1] 0)) (Eq [0, 1, 0, - 1] 0)))))))))))) []

goal (1 subgoal):
 1. \<forall>x xa xb. \<not> 2 \<le> int xb \<longrightarrow> int xb + (2 * int xa - int x) = 1 \<longrightarrow> (\<forall>xb xc. \<not> 2 \<le> int xc \<longrightarrow> int xc + (2 * int xb - int x) = 0 \<longrightarrow> (\<exists>xa. 2 * int xa = int x) \<longrightarrow> xb = xa)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
eval_pf (Forall (Forall (Forall (Imp (Neg (Le [- 1] (- 2))) (Imp (Eq [1, 2, - 1] 1) (Forall (Forall (Imp (Neg (Le [- 1] (- 2))) (Imp (Eq [1, 2, 0, 0, - 1] 0) (Imp (Exist (Eq [2, 0, 0, 0, 0, - 1] 0)) (Eq [0, 1, 0, - 1] 0))))))))))) [] = dfa_accepts (dfa_of_pf 0 (Forall (Forall (Forall (Imp (Neg (Le [- 1] (- 2))) (Imp (Eq [1, 2, - 1] 1) (Forall (Forall (Imp (Neg (Le [- 1] (- 2))) (Imp (Eq [1, 2, 0, 0, - 1] 0) (Imp (Exist (Eq [2, 0, 0, 0, 0, - 1] 0)) (Eq [0, 1, 0, - 1] 0)))))))))))) []

goal (1 subgoal):
 1. \<forall>x xa xb. \<not> 2 \<le> int xb \<longrightarrow> int xb + (2 * int xa - int x) = 1 \<longrightarrow> (\<forall>xb xc. \<not> 2 \<le> int xc \<longrightarrow> int xc + (2 * int xb - int x) = 0 \<longrightarrow> (\<exists>xa. 2 * int xa = int x) \<longrightarrow> xb = xa)
[PROOF STEP]
have "\<dots>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. dfa_accepts (dfa_of_pf 0 (Forall (Forall (Forall (Imp (Neg (Le [- 1] (- 2))) (Imp (Eq [1, 2, - 1] 1) (Forall (Forall (Imp (Neg (Le [- 1] (- 2))) (Imp (Eq [1, 2, 0, 0, - 1] 0) (Imp (Exist (Eq [2, 0, 0, 0, 0, - 1] 0)) (Eq [0, 1, 0, - 1] 0)))))))))))) []
[PROOF STEP]
by eval
[PROOF STATE]
proof (state)
this:
dfa_accepts (dfa_of_pf 0 (Forall (Forall (Forall (Imp (Neg (Le [- 1] (- 2))) (Imp (Eq [1, 2, - 1] 1) (Forall (Forall (Imp (Neg (Le [- 1] (- 2))) (Imp (Eq [1, 2, 0, 0, - 1] 0) (Imp (Exist (Eq [2, 0, 0, 0, 0, - 1] 0)) (Eq [0, 1, 0, - 1] 0)))))))))))) []

goal (1 subgoal):
 1. \<forall>x xa xb. \<not> 2 \<le> int xb \<longrightarrow> int xb + (2 * int xa - int x) = 1 \<longrightarrow> (\<forall>xb xc. \<not> 2 \<le> int xc \<longrightarrow> int xc + (2 * int xb - int x) = 0 \<longrightarrow> (\<exists>xa. 2 * int xa = int x) \<longrightarrow> xb = xa)
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
\<forall>x xa xb. \<not> 2 \<le> int xb \<longrightarrow> int xb + (2 * int xa - int x) = 1 \<longrightarrow> (\<forall>xb xc. \<not> 2 \<le> int xc \<longrightarrow> int xc + (2 * int xb - int x) = 0 \<longrightarrow> (\<exists>xa. 2 * int xa = int x) \<longrightarrow> xb = xa)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<forall>x xa xb. \<not> 2 \<le> int xb \<longrightarrow> int xb + (2 * int xa - int x) = 1 \<longrightarrow> (\<forall>xb xc. \<not> 2 \<le> int xc \<longrightarrow> int xc + (2 * int xb - int x) = 0 \<longrightarrow> (\<exists>xa. 2 * int xa = int x) \<longrightarrow> xb = xa)

goal (1 subgoal):
 1. \<forall>x xa xb. \<not> 2 \<le> int xb \<longrightarrow> int xb + (2 * int xa - int x) = 1 \<longrightarrow> (\<forall>xb xc. \<not> 2 \<le> int xc \<longrightarrow> int xc + (2 * int xb - int x) = 0 \<longrightarrow> (\<exists>xa. 2 * int xa = int x) \<longrightarrow> xb = xa)
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
\<forall>x xa xb. \<not> 2 \<le> int xb \<longrightarrow> int xb + (2 * int xa - int x) = 1 \<longrightarrow> (\<forall>xb xc. \<not> 2 \<le> int xc \<longrightarrow> int xc + (2 * int xb - int x) = 0 \<longrightarrow> (\<exists>xa. 2 * int xa = int x) \<longrightarrow> xb = xa)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma shows
    reflp_extends: "reflp extends" and
    transp_extends: "transp extends" and
    antisymp_extends: "antisymp extends"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. reflp extends &&& transp extends &&& antisymp extends
[PROOF STEP]
unfolding extends_def reflp_def transp_def antisymp_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>x. x \<subseteq> x \<and> asym_factor x \<subseteq> asym_factor x &&& \<forall>x y z. y \<subseteq> x \<and> asym_factor y \<subseteq> asym_factor x \<longrightarrow> z \<subseteq> y \<and> asym_factor z \<subseteq> asym_factor y \<longrightarrow> z \<subseteq> x \<and> asym_factor z \<subseteq> asym_factor x &&& \<forall>x y. y \<subseteq> x \<and> asym_factor y \<subseteq> asym_factor x \<longrightarrow> x \<subseteq> y \<and> asym_factor x \<subseteq> asym_factor y \<longrightarrow> x = y
[PROOF STEP]
by auto


[STATEMENT]
lemma amor_Unbal:
  "\<lbrakk> ins3 n d x t = Unbal2 t' n' h';  bal_i n (height t + d) \<rbrakk> \<Longrightarrow>
  T_ins3 n d x t + \<Phi> t' - \<Phi> t \<le> 2*size1 t + (6*e + 1) * height t"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ins3 n d x t = Unbal2 t' n' h'; bal_i n (height t + d)\<rbrakk> \<Longrightarrow> real (T_ins3 n d x t) + \<Phi> t' - \<Phi> t \<le> real (2 * size1 t) + (6 * e + 1) * real (height t)
[PROOF STEP]
apply(frule (1) T_ins3_Unbal)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ins3 n d x t = Unbal2 t' n' h'; bal_i n (height t + d); T_ins3 n d x t \<le> 2 * size t + 1 + height t\<rbrakk> \<Longrightarrow> real (T_ins3 n d x t) + \<Phi> t' - \<Phi> t \<le> real (2 * size1 t) + (6 * e + 1) * real (height t)
[PROOF STEP]
apply(drule (1) Phi_diff_Unbal)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>bal_i n (height t + d); T_ins3 n d x t \<le> 2 * size t + 1 + height t; \<Phi> t' - \<Phi> t \<le> 6 * e * real (height t)\<rbrakk> \<Longrightarrow> real (T_ins3 n d x t) + \<Phi> t' - \<Phi> t \<le> real (2 * size1 t) + (6 * e + 1) * real (height t)
[PROOF STEP]
by(simp add: ring_distribs size1_size)


[STATEMENT]
lemma iMODb_append_union: "
  [r, mod m, c] \<union> [ r + m * c, mod m, c'] = [r, mod m, c + c']"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. [ r, mod m, c ] \<union> [ r + m * c, mod m, c' ] = [ r, mod m, c + c' ]
[PROOF STEP]
apply (insert iMODb_union[of r "r + m * c" m c c'])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lbrakk>r \<le> r + m * c; r mod m = (r + m * c) mod m; r + m * c \<le> r + m * c; r + m * c \<le> r + m * c + m * c'\<rbrakk> \<Longrightarrow> [ r, mod m, c ] \<union> [ r + m * c, mod m, c' ] = [ r, mod m, (r + m * c) div m - r div m + c' ]) \<Longrightarrow> [ r, mod m, c ] \<union> [ r + m * c, mod m, c' ] = [ r, mod m, c + c' ]
[PROOF STEP]
apply (case_tac "m = 0")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>\<lbrakk>r \<le> r + m * c; r mod m = (r + m * c) mod m; r + m * c \<le> r + m * c; r + m * c \<le> r + m * c + m * c'\<rbrakk> \<Longrightarrow> [ r, mod m, c ] \<union> [ r + m * c, mod m, c' ] = [ r, mod m, (r + m * c) div m - r div m + c' ]; m = 0\<rbrakk> \<Longrightarrow> [ r, mod m, c ] \<union> [ r + m * c, mod m, c' ] = [ r, mod m, c + c' ]
 2. \<lbrakk>\<lbrakk>r \<le> r + m * c; r mod m = (r + m * c) mod m; r + m * c \<le> r + m * c; r + m * c \<le> r + m * c + m * c'\<rbrakk> \<Longrightarrow> [ r, mod m, c ] \<union> [ r + m * c, mod m, c' ] = [ r, mod m, (r + m * c) div m - r div m + c' ]; m \<noteq> 0\<rbrakk> \<Longrightarrow> [ r, mod m, c ] \<union> [ r + m * c, mod m, c' ] = [ r, mod m, c + c' ]
[PROOF STEP]
apply (simp add: iMODb_mod_0)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<lbrakk>r \<le> r + m * c; r mod m = (r + m * c) mod m; r + m * c \<le> r + m * c; r + m * c \<le> r + m * c + m * c'\<rbrakk> \<Longrightarrow> [ r, mod m, c ] \<union> [ r + m * c, mod m, c' ] = [ r, mod m, (r + m * c) div m - r div m + c' ]; m \<noteq> 0\<rbrakk> \<Longrightarrow> [ r, mod m, c ] \<union> [ r + m * c, mod m, c' ] = [ r, mod m, c + c' ]
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma not_invertible_iff_proj2_set_Col:
  "\<not> invertible (vector [proj2_rep p, proj2_rep q, proj2_rep r] :: real^3^3)
  \<longleftrightarrow> proj2_set_Col {p,q,r}"
  (is "\<not> invertible ?M \<longleftrightarrow> _")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<not> invertible (vector [proj2_rep p, proj2_rep q, proj2_rep r])) = proj2_set_Col {p, q, r}
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (\<not> invertible (vector [proj2_rep p, proj2_rep q, proj2_rep r])) = proj2_set_Col {p, q, r}
[PROOF STEP]
from left_invertible_iff_invertible
[PROOF STATE]
proof (chain)
picking this:
(\<exists>N. N ** ?M = mat 1) = invertible ?M
[PROOF STEP]
have "\<not> invertible ?M  \<longleftrightarrow> \<not> (\<exists> M'. M' ** ?M = mat 1)"
[PROOF STATE]
proof (prove)
using this:
(\<exists>N. N ** ?M = mat 1) = invertible ?M

goal (1 subgoal):
 1. (\<not> invertible (vector [proj2_rep p, proj2_rep q, proj2_rep r])) = (\<nexists>M'. M' ** vector [proj2_rep p, proj2_rep q, proj2_rep r] = mat 1)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<not> invertible (vector [proj2_rep p, proj2_rep q, proj2_rep r])) = (\<nexists>M'. M' ** vector [proj2_rep p, proj2_rep q, proj2_rep r] = mat 1)

goal (1 subgoal):
 1. (\<not> invertible (vector [proj2_rep p, proj2_rep q, proj2_rep r])) = proj2_set_Col {p, q, r}
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(\<not> invertible (vector [proj2_rep p, proj2_rep q, proj2_rep r])) = (\<nexists>M'. M' ** vector [proj2_rep p, proj2_rep q, proj2_rep r] = mat 1)

goal (1 subgoal):
 1. (\<not> invertible (vector [proj2_rep p, proj2_rep q, proj2_rep r])) = proj2_set_Col {p, q, r}
[PROOF STEP]
from matrix_left_invertible_ker [of ?M]
[PROOF STATE]
proof (chain)
picking this:
(\<exists>B. B ** vector [proj2_rep p, proj2_rep q, proj2_rep r] = mat 1) = (\<forall>x. vector [proj2_rep p, proj2_rep q, proj2_rep r] *v x = 0 \<longrightarrow> x = 0)
[PROOF STEP]
have "\<dots> \<longleftrightarrow> (\<exists> y. y \<noteq> 0 \<and> ?M *v y = 0)"
[PROOF STATE]
proof (prove)
using this:
(\<exists>B. B ** vector [proj2_rep p, proj2_rep q, proj2_rep r] = mat 1) = (\<forall>x. vector [proj2_rep p, proj2_rep q, proj2_rep r] *v x = 0 \<longrightarrow> x = 0)

goal (1 subgoal):
 1. (\<nexists>M'. M' ** vector [proj2_rep p, proj2_rep q, proj2_rep r] = mat 1) = (\<exists>y. y \<noteq> 0 \<and> vector [proj2_rep p, proj2_rep q, proj2_rep r] *v y = 0)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<nexists>M'. M' ** vector [proj2_rep p, proj2_rep q, proj2_rep r] = mat 1) = (\<exists>y. y \<noteq> 0 \<and> vector [proj2_rep p, proj2_rep q, proj2_rep r] *v y = 0)

goal (1 subgoal):
 1. (\<not> invertible (vector [proj2_rep p, proj2_rep q, proj2_rep r])) = proj2_set_Col {p, q, r}
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(\<nexists>M'. M' ** vector [proj2_rep p, proj2_rep q, proj2_rep r] = mat 1) = (\<exists>y. y \<noteq> 0 \<and> vector [proj2_rep p, proj2_rep q, proj2_rep r] *v y = 0)

goal (1 subgoal):
 1. (\<not> invertible (vector [proj2_rep p, proj2_rep q, proj2_rep r])) = proj2_set_Col {p, q, r}
[PROOF STEP]
have "\<dots> \<longleftrightarrow> (\<exists> l. \<forall> s\<in>{p,q,r}. proj2_incident s l)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<exists>y. y \<noteq> 0 \<and> vector [proj2_rep p, proj2_rep q, proj2_rep r] *v y = 0) = (\<exists>l. \<forall>s\<in>{p, q, r}. proj2_incident s l)
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<exists>y. y \<noteq> 0 \<and> vector [proj2_rep p, proj2_rep q, proj2_rep r] *v y = 0 \<Longrightarrow> \<exists>l. \<forall>s\<in>{p, q, r}. proj2_incident s l
 2. \<exists>l. \<forall>s\<in>{p, q, r}. proj2_incident s l \<Longrightarrow> \<exists>y. y \<noteq> 0 \<and> vector [proj2_rep p, proj2_rep q, proj2_rep r] *v y = 0
[PROOF STEP]
assume "\<exists> y. y \<noteq> 0 \<and> ?M *v y = 0"
[PROOF STATE]
proof (state)
this:
\<exists>y. y \<noteq> 0 \<and> vector [proj2_rep p, proj2_rep q, proj2_rep r] *v y = 0

goal (2 subgoals):
 1. \<exists>y. y \<noteq> 0 \<and> vector [proj2_rep p, proj2_rep q, proj2_rep r] *v y = 0 \<Longrightarrow> \<exists>l. \<forall>s\<in>{p, q, r}. proj2_incident s l
 2. \<exists>l. \<forall>s\<in>{p, q, r}. proj2_incident s l \<Longrightarrow> \<exists>y. y \<noteq> 0 \<and> vector [proj2_rep p, proj2_rep q, proj2_rep r] *v y = 0
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<exists>y. y \<noteq> 0 \<and> vector [proj2_rep p, proj2_rep q, proj2_rep r] *v y = 0
[PROOF STEP]
obtain y where "y \<noteq> 0" and "?M *v y = 0"
[PROOF STATE]
proof (prove)
using this:
\<exists>y. y \<noteq> 0 \<and> vector [proj2_rep p, proj2_rep q, proj2_rep r] *v y = 0

goal (1 subgoal):
 1. (\<And>y. \<lbrakk>y \<noteq> 0; vector [proj2_rep p, proj2_rep q, proj2_rep r] *v y = 0\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
y \<noteq> 0
vector [proj2_rep p, proj2_rep q, proj2_rep r] *v y = 0

goal (2 subgoals):
 1. \<exists>y. y \<noteq> 0 \<and> vector [proj2_rep p, proj2_rep q, proj2_rep r] *v y = 0 \<Longrightarrow> \<exists>l. \<forall>s\<in>{p, q, r}. proj2_incident s l
 2. \<exists>l. \<forall>s\<in>{p, q, r}. proj2_incident s l \<Longrightarrow> \<exists>y. y \<noteq> 0 \<and> vector [proj2_rep p, proj2_rep q, proj2_rep r] *v y = 0
[PROOF STEP]
let ?l = "proj2_line_abs y"
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<exists>y. y \<noteq> 0 \<and> vector [proj2_rep p, proj2_rep q, proj2_rep r] *v y = 0 \<Longrightarrow> \<exists>l. \<forall>s\<in>{p, q, r}. proj2_incident s l
 2. \<exists>l. \<forall>s\<in>{p, q, r}. proj2_incident s l \<Longrightarrow> \<exists>y. y \<noteq> 0 \<and> vector [proj2_rep p, proj2_rep q, proj2_rep r] *v y = 0
[PROOF STEP]
from \<open>?M *v y = 0\<close>
[PROOF STATE]
proof (chain)
picking this:
vector [proj2_rep p, proj2_rep q, proj2_rep r] *v y = 0
[PROOF STEP]
have "\<forall> s\<in>{p,q,r}. proj2_rep s \<bullet> y = 0"
[PROOF STATE]
proof (prove)
using this:
vector [proj2_rep p, proj2_rep q, proj2_rep r] *v y = 0

goal (1 subgoal):
 1. \<forall>s\<in>{p, q, r}. proj2_rep s \<bullet> y = 0
[PROOF STEP]
unfolding vector_def
        and matrix_vector_mult_def
        and inner_vec_def
        and sum_3
[PROOF STATE]
proof (prove)
using this:
(\<chi>i. vec_lambda (foldr (\<lambda>x f n. (f (n + 1))(n := x)) [proj2_rep p, proj2_rep q, proj2_rep r] (\<lambda>n x. 0) 1) $ i $ 1 * y $ 1 + vec_lambda (foldr (\<lambda>x f n. (f (n + 1))(n := x)) [proj2_rep p, proj2_rep q, proj2_rep r] (\<lambda>n x. 0) 1) $ i $ 2 * y $ 2 + vec_lambda (foldr (\<lambda>x f n. (f (n + 1))(n := x)) [proj2_rep p, proj2_rep q, proj2_rep r] (\<lambda>n x. 0) 1) $ i $ 3 * y $ 3) = 0

goal (1 subgoal):
 1. \<forall>s\<in>{p, q, r}. proj2_rep s $ 1 \<bullet> y $ 1 + proj2_rep s $ 2 \<bullet> y $ 2 + proj2_rep s $ 3 \<bullet> y $ 3 = 0
[PROOF STEP]
by (simp add: vec_eq_iff forall_3)
[PROOF STATE]
proof (state)
this:
\<forall>s\<in>{p, q, r}. proj2_rep s \<bullet> y = 0

goal (2 subgoals):
 1. \<exists>y. y \<noteq> 0 \<and> vector [proj2_rep p, proj2_rep q, proj2_rep r] *v y = 0 \<Longrightarrow> \<exists>l. \<forall>s\<in>{p, q, r}. proj2_incident s l
 2. \<exists>l. \<forall>s\<in>{p, q, r}. proj2_incident s l \<Longrightarrow> \<exists>y. y \<noteq> 0 \<and> vector [proj2_rep p, proj2_rep q, proj2_rep r] *v y = 0
[PROOF STEP]
with \<open>y \<noteq> 0\<close> and proj2_incident_right_abs
[PROOF STATE]
proof (chain)
picking this:
y \<noteq> 0
?v \<noteq> 0 \<Longrightarrow> proj2_incident ?p (proj2_line_abs ?v) = (proj2_rep ?p \<bullet> ?v = 0)
\<forall>s\<in>{p, q, r}. proj2_rep s \<bullet> y = 0
[PROOF STEP]
have "\<forall> s\<in>{p,q,r}. proj2_incident s ?l"
[PROOF STATE]
proof (prove)
using this:
y \<noteq> 0
?v \<noteq> 0 \<Longrightarrow> proj2_incident ?p (proj2_line_abs ?v) = (proj2_rep ?p \<bullet> ?v = 0)
\<forall>s\<in>{p, q, r}. proj2_rep s \<bullet> y = 0

goal (1 subgoal):
 1. \<forall>s\<in>{p, q, r}. proj2_incident s (proj2_line_abs y)
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<forall>s\<in>{p, q, r}. proj2_incident s (proj2_line_abs y)

goal (2 subgoals):
 1. \<exists>y. y \<noteq> 0 \<and> vector [proj2_rep p, proj2_rep q, proj2_rep r] *v y = 0 \<Longrightarrow> \<exists>l. \<forall>s\<in>{p, q, r}. proj2_incident s l
 2. \<exists>l. \<forall>s\<in>{p, q, r}. proj2_incident s l \<Longrightarrow> \<exists>y. y \<noteq> 0 \<and> vector [proj2_rep p, proj2_rep q, proj2_rep r] *v y = 0
[PROOF STEP]
thus "\<exists> l. \<forall> s\<in>{p,q,r}. proj2_incident s l"
[PROOF STATE]
proof (prove)
using this:
\<forall>s\<in>{p, q, r}. proj2_incident s (proj2_line_abs y)

goal (1 subgoal):
 1. \<exists>l. \<forall>s\<in>{p, q, r}. proj2_incident s l
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
\<exists>l. \<forall>s\<in>{p, q, r}. proj2_incident s l

goal (1 subgoal):
 1. \<exists>l. \<forall>s\<in>{p, q, r}. proj2_incident s l \<Longrightarrow> \<exists>y. y \<noteq> 0 \<and> vector [proj2_rep p, proj2_rep q, proj2_rep r] *v y = 0
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<exists>l. \<forall>s\<in>{p, q, r}. proj2_incident s l \<Longrightarrow> \<exists>y. y \<noteq> 0 \<and> vector [proj2_rep p, proj2_rep q, proj2_rep r] *v y = 0
[PROOF STEP]
assume "\<exists> l. \<forall> s\<in>{p,q,r}. proj2_incident s l"
[PROOF STATE]
proof (state)
this:
\<exists>l. \<forall>s\<in>{p, q, r}. proj2_incident s l

goal (1 subgoal):
 1. \<exists>l. \<forall>s\<in>{p, q, r}. proj2_incident s l \<Longrightarrow> \<exists>y. y \<noteq> 0 \<and> vector [proj2_rep p, proj2_rep q, proj2_rep r] *v y = 0
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<exists>l. \<forall>s\<in>{p, q, r}. proj2_incident s l
[PROOF STEP]
obtain l where "\<forall> s\<in>{p,q,r}. proj2_incident s l"
[PROOF STATE]
proof (prove)
using this:
\<exists>l. \<forall>s\<in>{p, q, r}. proj2_incident s l

goal (1 subgoal):
 1. (\<And>l. \<forall>s\<in>{p, q, r}. proj2_incident s l \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
\<forall>s\<in>{p, q, r}. proj2_incident s l

goal (1 subgoal):
 1. \<exists>l. \<forall>s\<in>{p, q, r}. proj2_incident s l \<Longrightarrow> \<exists>y. y \<noteq> 0 \<and> vector [proj2_rep p, proj2_rep q, proj2_rep r] *v y = 0
[PROOF STEP]
let ?y = "proj2_line_rep l"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<exists>l. \<forall>s\<in>{p, q, r}. proj2_incident s l \<Longrightarrow> \<exists>y. y \<noteq> 0 \<and> vector [proj2_rep p, proj2_rep q, proj2_rep r] *v y = 0
[PROOF STEP]
have "?y \<noteq> 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. proj2_line_rep l \<noteq> 0
[PROOF STEP]
by (rule proj2_line_rep_non_zero)
[PROOF STATE]
proof (state)
this:
proj2_line_rep l \<noteq> 0

goal (1 subgoal):
 1. \<exists>l. \<forall>s\<in>{p, q, r}. proj2_incident s l \<Longrightarrow> \<exists>y. y \<noteq> 0 \<and> vector [proj2_rep p, proj2_rep q, proj2_rep r] *v y = 0
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
proj2_line_rep l \<noteq> 0

goal (1 subgoal):
 1. \<exists>l. \<forall>s\<in>{p, q, r}. proj2_incident s l \<Longrightarrow> \<exists>y. y \<noteq> 0 \<and> vector [proj2_rep p, proj2_rep q, proj2_rep r] *v y = 0
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
proj2_line_rep l \<noteq> 0

goal (1 subgoal):
 1. \<exists>l. \<forall>s\<in>{p, q, r}. proj2_incident s l \<Longrightarrow> \<exists>y. y \<noteq> 0 \<and> vector [proj2_rep p, proj2_rep q, proj2_rep r] *v y = 0
[PROOF STEP]
from \<open>\<forall> s\<in>{p,q,r}. proj2_incident s l\<close>
[PROOF STATE]
proof (chain)
picking this:
\<forall>s\<in>{p, q, r}. proj2_incident s l
[PROOF STEP]
have "?M *v ?y = 0"
[PROOF STATE]
proof (prove)
using this:
\<forall>s\<in>{p, q, r}. proj2_incident s l

goal (1 subgoal):
 1. vector [proj2_rep p, proj2_rep q, proj2_rep r] *v proj2_line_rep l = 0
[PROOF STEP]
unfolding vector_def
          and matrix_vector_mult_def
          and inner_vec_def
          and sum_3
          and proj2_incident_def
[PROOF STATE]
proof (prove)
using this:
\<forall>s\<in>{p, q, r}. proj2_rep s $ 1 \<bullet> proj2_line_rep l $ 1 + proj2_rep s $ 2 \<bullet> proj2_line_rep l $ 2 + proj2_rep s $ 3 \<bullet> proj2_line_rep l $ 3 = 0

goal (1 subgoal):
 1. (\<chi>i. vec_lambda (foldr (\<lambda>x f n. (f (n + 1))(n := x)) [proj2_rep p, proj2_rep q, proj2_rep r] (\<lambda>n x. 0) 1) $ i $ 1 * proj2_line_rep l $ 1 + vec_lambda (foldr (\<lambda>x f n. (f (n + 1))(n := x)) [proj2_rep p, proj2_rep q, proj2_rep r] (\<lambda>n x. 0) 1) $ i $ 2 * proj2_line_rep l $ 2 + vec_lambda (foldr (\<lambda>x f n. (f (n + 1))(n := x)) [proj2_rep p, proj2_rep q, proj2_rep r] (\<lambda>n x. 0) 1) $ i $ 3 * proj2_line_rep l $ 3) = 0
[PROOF STEP]
by (simp add: vec_eq_iff)
[PROOF STATE]
proof (state)
this:
vector [proj2_rep p, proj2_rep q, proj2_rep r] *v proj2_line_rep l = 0

goal (1 subgoal):
 1. \<exists>l. \<forall>s\<in>{p, q, r}. proj2_incident s l \<Longrightarrow> \<exists>y. y \<noteq> 0 \<and> vector [proj2_rep p, proj2_rep q, proj2_rep r] *v y = 0
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
vector [proj2_rep p, proj2_rep q, proj2_rep r] *v proj2_line_rep l = 0

goal (1 subgoal):
 1. \<exists>l. \<forall>s\<in>{p, q, r}. proj2_incident s l \<Longrightarrow> \<exists>y. y \<noteq> 0 \<and> vector [proj2_rep p, proj2_rep q, proj2_rep r] *v y = 0
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
proj2_line_rep l \<noteq> 0
vector [proj2_rep p, proj2_rep q, proj2_rep r] *v proj2_line_rep l = 0
[PROOF STEP]
show "\<exists> y. y \<noteq> 0 \<and> ?M *v y = 0"
[PROOF STATE]
proof (prove)
using this:
proj2_line_rep l \<noteq> 0
vector [proj2_rep p, proj2_rep q, proj2_rep r] *v proj2_line_rep l = 0

goal (1 subgoal):
 1. \<exists>y. y \<noteq> 0 \<and> vector [proj2_rep p, proj2_rep q, proj2_rep r] *v y = 0
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<exists>y. y \<noteq> 0 \<and> vector [proj2_rep p, proj2_rep q, proj2_rep r] *v y = 0

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
(\<exists>y. y \<noteq> 0 \<and> vector [proj2_rep p, proj2_rep q, proj2_rep r] *v y = 0) = (\<exists>l. \<forall>s\<in>{p, q, r}. proj2_incident s l)

goal (1 subgoal):
 1. (\<not> invertible (vector [proj2_rep p, proj2_rep q, proj2_rep r])) = proj2_set_Col {p, q, r}
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
(\<not> invertible (vector [proj2_rep p, proj2_rep q, proj2_rep r])) = (\<exists>l. \<forall>s\<in>{p, q, r}. proj2_incident s l)
[PROOF STEP]
show "\<not> invertible ?M \<longleftrightarrow> proj2_set_Col {p,q,r}"
[PROOF STATE]
proof (prove)
using this:
(\<not> invertible (vector [proj2_rep p, proj2_rep q, proj2_rep r])) = (\<exists>l. \<forall>s\<in>{p, q, r}. proj2_incident s l)

goal (1 subgoal):
 1. (\<not> invertible (vector [proj2_rep p, proj2_rep q, proj2_rep r])) = proj2_set_Col {p, q, r}
[PROOF STEP]
unfolding proj2_set_Col_def
[PROOF STATE]
proof (prove)
using this:
(\<not> invertible (vector [proj2_rep p, proj2_rep q, proj2_rep r])) = (\<exists>l. \<forall>s\<in>{p, q, r}. proj2_incident s l)

goal (1 subgoal):
 1. (\<not> invertible (vector [proj2_rep p, proj2_rep q, proj2_rep r])) = (\<exists>l. \<forall>p\<in>{p, q, r}. proj2_incident p l)
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
(\<not> invertible (vector [proj2_rep p, proj2_rep q, proj2_rep r])) = proj2_set_Col {p, q, r}

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma i_Exec_Stream_Pre_Post1: "
  \<lbrakk> c_n = (i_Exec_Comp_Stream trans_fun input c)\<^bsup>\<leftarrow> c\<^esup> n; x_n = input n \<rbrakk> \<Longrightarrow>
  (P1 x_n \<and> P2 c_n \<longrightarrow> Q (i_Exec_Comp_Stream trans_fun input c n)) =
  (P1 x_n \<and> P2 c_n \<longrightarrow> Q (trans_fun x_n c_n))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>c_n = (i_Exec_Comp_Stream trans_fun input c)\<^bsup>\<leftarrow> c\<^esup> n; x_n = input n\<rbrakk> \<Longrightarrow> (P1 x_n \<and> P2 c_n \<longrightarrow> Q (i_Exec_Comp_Stream trans_fun input c n)) = (P1 x_n \<and> P2 c_n \<longrightarrow> Q (trans_fun x_n c_n))
[PROOF STEP]
by (simp add: i_Exec_Stream_nth_calc_Previous)


[STATEMENT]
lemma inorder_node33: "height m > 0 \<Longrightarrow>
  inorder (tree\<^sub>d (node33 l a m b r')) = inorder l @ a # inorder m @ b # inorder (tree\<^sub>d r')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 < height m \<Longrightarrow> inorder (tree\<^sub>d (node33 l a m b r')) = inorder l @ a # inorder m @ b # inorder (tree\<^sub>d r')
[PROOF STEP]
by(induct l a m b r' rule: node33.induct) auto


[STATEMENT]
lemma "fconcat (fmap (\<lambda>x. fcons x fnil) xs) = xs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fconcat (fmap (\<lambda>x. {|x|}) xs) = xs
[PROOF STEP]
apply transfer
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>xs. list_eq (concat (map (\<lambda>x. [x]) xs)) xs
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma PO_refines_implies_R_image_trans:
  assumes "PO_refines R Ta Tc"
  shows "{R `` reach Ta} trans Tc {> R `` reach Ta}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {R `` reach Ta} TS.trans Tc {> R `` reach Ta}
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
PO_refines R Ta Tc

goal (1 subgoal):
 1. {R `` reach Ta} TS.trans Tc {> R `` reach Ta}
[PROOF STEP]
proof(unfold PO_hoare_def Image_def PO_refines_def PO_rhoare_def, safe)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x xa xb. \<lbrakk>PO_refines R Ta Tc; (xa, x) \<in> TS.trans Tc; xb \<in> reach Ta; (xb, xa) \<in> R; init Tc \<subseteq> {y. \<exists>x\<in>init Ta. (x, y) \<in> R}; R O TS.trans Tc \<subseteq> TS.trans Ta O R\<rbrakk> \<Longrightarrow> \<exists>xa\<in>reach Ta. (xa, x) \<in> R
[PROOF STEP]
fix sc sc' sa
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x xa xb. \<lbrakk>PO_refines R Ta Tc; (xa, x) \<in> TS.trans Tc; xb \<in> reach Ta; (xb, xa) \<in> R; init Tc \<subseteq> {y. \<exists>x\<in>init Ta. (x, y) \<in> R}; R O TS.trans Tc \<subseteq> TS.trans Ta O R\<rbrakk> \<Longrightarrow> \<exists>xa\<in>reach Ta. (xa, x) \<in> R
[PROOF STEP]
assume R: "(sa, sc) \<in> R"
    and step: "(sc, sc') \<in> TS.trans Tc"
    and sa_reach: "sa \<in> reach Ta"
    and trans_ref: "R O trans Tc \<subseteq> trans Ta O R"
[PROOF STATE]
proof (state)
this:
(sa, sc) \<in> R
(sc, sc') \<in> TS.trans Tc
sa \<in> reach Ta
R O TS.trans Tc \<subseteq> TS.trans Ta O R

goal (1 subgoal):
 1. \<And>x xa xb. \<lbrakk>PO_refines R Ta Tc; (xa, x) \<in> TS.trans Tc; xb \<in> reach Ta; (xb, xa) \<in> R; init Tc \<subseteq> {y. \<exists>x\<in>init Ta. (x, y) \<in> R}; R O TS.trans Tc \<subseteq> TS.trans Ta O R\<rbrakk> \<Longrightarrow> \<exists>xa\<in>reach Ta. (xa, x) \<in> R
[PROOF STEP]
from commute_dest[OF trans_ref R step] sa_reach
[PROOF STATE]
proof (chain)
picking this:
\<exists>sa'. (sa, sa') \<in> TS.trans Ta \<and> (sa', sc') \<in> R
sa \<in> reach Ta
[PROOF STEP]
show " \<exists>sa'\<in>reach Ta. (sa', sc') \<in> R"
[PROOF STATE]
proof (prove)
using this:
\<exists>sa'. (sa, sa') \<in> TS.trans Ta \<and> (sa', sc') \<in> R
sa \<in> reach Ta

goal (1 subgoal):
 1. \<exists>sa'\<in>reach Ta. (sa', sc') \<in> R
[PROOF STEP]
by(auto)
[PROOF STATE]
proof (state)
this:
\<exists>sa'\<in>reach Ta. (sa', sc') \<in> R

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma supremum_smaller_exists_unique:
  assumes "finite S"
  shows "\<exists>! p. supremum (smaller_subset (Some t) (Some ` S)) = Some p"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>!p. supremum (smaller_subset (Some t) (Some ` S)) = Some p
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
finite S

goal (1 subgoal):
 1. \<exists>!p. supremum (smaller_subset (Some t) (Some ` S)) = Some p
[PROOF STEP]
proof (induct)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<exists>!p. supremum (smaller_subset (Some t) (Some ` {})) = Some p
 2. \<And>x F. \<lbrakk>finite F; x \<notin> F; \<exists>!p. supremum (smaller_subset (Some t) (Some ` F)) = Some p\<rbrakk> \<Longrightarrow> \<exists>!p. supremum (smaller_subset (Some t) (Some ` insert x F)) = Some p
[PROOF STEP]
case (insert x F)
[PROOF STATE]
proof (state)
this:
finite F
x \<notin> F
\<exists>!p. supremum (smaller_subset (Some t) (Some ` F)) = Some p

goal (2 subgoals):
 1. \<exists>!p. supremum (smaller_subset (Some t) (Some ` {})) = Some p
 2. \<And>x F. \<lbrakk>finite F; x \<notin> F; \<exists>!p. supremum (smaller_subset (Some t) (Some ` F)) = Some p\<rbrakk> \<Longrightarrow> \<exists>!p. supremum (smaller_subset (Some t) (Some ` insert x F)) = Some p
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>!p. supremum (smaller_subset (Some t) (Some ` insert x F)) = Some p
[PROOF STEP]
proof (cases "lifted_less_eq (Some x) (Some t)")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. lifted_less_eq (Some x) (Some t) \<Longrightarrow> \<exists>!p. supremum (smaller_subset (Some t) (Some ` insert x F)) = Some p
 2. \<not> lifted_less_eq (Some x) (Some t) \<Longrightarrow> \<exists>!p. supremum (smaller_subset (Some t) (Some ` insert x F)) = Some p
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
lifted_less_eq (Some x) (Some t)

goal (2 subgoals):
 1. lifted_less_eq (Some x) (Some t) \<Longrightarrow> \<exists>!p. supremum (smaller_subset (Some t) (Some ` insert x F)) = Some p
 2. \<not> lifted_less_eq (Some x) (Some t) \<Longrightarrow> \<exists>!p. supremum (smaller_subset (Some t) (Some ` insert x F)) = Some p
[PROOF STEP]
obtain p where wit: "supremum (smaller_subset (Some t) (Some ` F)) = Some p"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>p. supremum (smaller_subset (Some t) (Some ` F)) = Some p \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using insert
[PROOF STATE]
proof (prove)
using this:
finite F
x \<notin> F
\<exists>!p. supremum (smaller_subset (Some t) (Some ` F)) = Some p

goal (1 subgoal):
 1. (\<And>p. supremum (smaller_subset (Some t) (Some ` F)) = Some p \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
supremum (smaller_subset (Some t) (Some ` F)) = Some p

goal (2 subgoals):
 1. lifted_less_eq (Some x) (Some t) \<Longrightarrow> \<exists>!p. supremum (smaller_subset (Some t) (Some ` insert x F)) = Some p
 2. \<not> lifted_less_eq (Some x) (Some t) \<Longrightarrow> \<exists>!p. supremum (smaller_subset (Some t) (Some ` insert x F)) = Some p
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
supremum (smaller_subset (Some t) (Some ` F)) = Some p
[PROOF STEP]
have pred: "less_eq p t" "less_eq x t"
[PROOF STATE]
proof (prove)
using this:
supremum (smaller_subset (Some t) (Some ` F)) = Some p

goal (1 subgoal):
 1. less_eq p t &&& less_eq x t
[PROOF STEP]
using True insert(1)
[PROOF STATE]
proof (prove)
using this:
supremum (smaller_subset (Some t) (Some ` F)) = Some p
lifted_less_eq (Some x) (Some t)
finite F

goal (1 subgoal):
 1. less_eq p t &&& less_eq x t
[PROOF STEP]
using lift_ord.supremum_smaller_subset
[PROOF STATE]
proof (prove)
using this:
supremum (smaller_subset (Some t) (Some ` F)) = Some p
lifted_less_eq (Some x) (Some t)
finite F
finite ?S \<Longrightarrow> lifted_less_eq (supremum (smaller_subset ?x ?S)) ?x

goal (1 subgoal):
 1. less_eq p t &&& less_eq x t
[PROOF STEP]
by auto (metis finite_imageI lift_less_eq_total.simps(3))
[PROOF STATE]
proof (state)
this:
less_eq p t
less_eq x t

goal (2 subgoals):
 1. lifted_less_eq (Some x) (Some t) \<Longrightarrow> \<exists>!p. supremum (smaller_subset (Some t) (Some ` insert x F)) = Some p
 2. \<not> lifted_less_eq (Some x) (Some t) \<Longrightarrow> \<exists>!p. supremum (smaller_subset (Some t) (Some ` insert x F)) = Some p
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>!p. supremum (smaller_subset (Some t) (Some ` insert x F)) = Some p
[PROOF STEP]
using insert pred wit pred_less
[PROOF STATE]
proof (prove)
using this:
finite F
x \<notin> F
\<exists>!p. supremum (smaller_subset (Some t) (Some ` F)) = Some p
less_eq p t
less_eq x t
supremum (smaller_subset (Some t) (Some ` F)) = Some p
\<lbrakk>less_eq ?x ?y; less_eq ?z ?y\<rbrakk> \<Longrightarrow> P ?x ?z

goal (1 subgoal):
 1. \<exists>!p. supremum (smaller_subset (Some t) (Some ` insert x F)) = Some p
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<exists>!p. supremum (smaller_subset (Some t) (Some ` insert x F)) = Some p

goal (1 subgoal):
 1. \<not> lifted_less_eq (Some x) (Some t) \<Longrightarrow> \<exists>!p. supremum (smaller_subset (Some t) (Some ` insert x F)) = Some p
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> lifted_less_eq (Some x) (Some t) \<Longrightarrow> \<exists>!p. supremum (smaller_subset (Some t) (Some ` insert x F)) = Some p
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
\<not> lifted_less_eq (Some x) (Some t)

goal (1 subgoal):
 1. \<not> lifted_less_eq (Some x) (Some t) \<Longrightarrow> \<exists>!p. supremum (smaller_subset (Some t) (Some ` insert x F)) = Some p
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<not> lifted_less_eq (Some x) (Some t)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<not> lifted_less_eq (Some x) (Some t)

goal (1 subgoal):
 1. \<exists>!p. supremum (smaller_subset (Some t) (Some ` insert x F)) = Some p
[PROOF STEP]
using insert
[PROOF STATE]
proof (prove)
using this:
\<not> lifted_less_eq (Some x) (Some t)
finite F
x \<notin> F
\<exists>!p. supremum (smaller_subset (Some t) (Some ` F)) = Some p

goal (1 subgoal):
 1. \<exists>!p. supremum (smaller_subset (Some t) (Some ` insert x F)) = Some p
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<exists>!p. supremum (smaller_subset (Some t) (Some ` insert x F)) = Some p

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<exists>!p. supremum (smaller_subset (Some t) (Some ` insert x F)) = Some p

goal (1 subgoal):
 1. \<exists>!p. supremum (smaller_subset (Some t) (Some ` {})) = Some p
[PROOF STEP]
qed auto


[STATEMENT]
lemma r2f_mono: "\<forall>f g. \<F> \<circ> f = \<F> \<circ> g \<longrightarrow> f = g"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>f g. \<F> \<circ> f = \<F> \<circ> g \<longrightarrow> f = g
[PROOF STEP]
by (force simp: fun_eq_iff r2f_def)


[STATEMENT]
lemma ereal_sqrt2:
  "ereal (sqrt 2) = esqrt 2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ereal (sqrt 2) = esqrt 2
[PROOF STEP]
using esqrt_ereal_ereal_sqrt[of 2]
[PROOF STATE]
proof (prove)
using this:
0 \<le> 2 \<Longrightarrow> esqrt (ereal 2) = ereal (sqrt 2)

goal (1 subgoal):
 1. ereal (sqrt 2) = esqrt 2
[PROOF STEP]
by auto


[STATEMENT]
lemma variety_of_map_indets: "\<V> (map_indets f ` F) = (\<lambda>a. a \<circ> f) -` \<V> F"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<V> (map_indets f ` F) = (\<lambda>a. a \<circ> f) -` \<V> F
[PROOF STEP]
by (auto simp: variety_of_def poly_eval_map_indets)


[STATEMENT]
lemma height_btree_sub:
  "height (Node ((sub,x)#ls) t) = max (height (Node ls t)) (Suc (height sub))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. height (Node ((sub, x) # ls) t) = max (height (Node ls t)) (Suc (height sub))
[PROOF STEP]
by simp


[STATEMENT]
lemma elements_mat_mat_of_row[simp]: "elements_mat (mat_of_row v) = vec_set v"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. elements_mat (mat_of_row v) = set\<^sub>v v
[PROOF STEP]
by (auto simp: mat_of_row_def elements_mat_def vec_set_def)


[STATEMENT]
lemma split_cartesian_product_memI':
  assumes "a \<in> A"
  assumes "b \<in> B"
  assumes "A \<subseteq> carrier (R\<^bsup>l1\<^esup>)"
  assumes "B \<subseteq> carrier (R\<^bsup>l2\<^esup>)"
  assumes "i \<le> l1"
  shows "(take i a)@b@(drop i a) \<in> split_cartesian_product l1 l2 i A B"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. take i a @ b @ drop i a \<in> split_cartesian_product l1 l2 i A B
[PROOF STEP]
using assms split_cartesian_product_memI[of "take i a" "drop i a" A b B R l1 l2 i]
[PROOF STATE]
proof (prove)
using this:
a \<in> A
b \<in> B
A \<subseteq> carrier (R\<^bsup>l1\<^esup>)
B \<subseteq> carrier (R\<^bsup>l2\<^esup>)
i \<le> l1
\<lbrakk>take i a @ drop i a \<in> A; b \<in> B; A \<subseteq> carrier (R\<^bsup>l1\<^esup>); B \<subseteq> carrier (R\<^bsup>l2\<^esup>); length (take i a) = i\<rbrakk> \<Longrightarrow> take i a @ b @ drop i a \<in> split_cartesian_product l1 l2 i A B

goal (1 subgoal):
 1. take i a @ b @ drop i a \<in> split_cartesian_product l1 l2 i A B
[PROOF STEP]
by (metis append_take_drop_id cartesian_power_car_memE length_take min.absorb2 subset_iff)


[STATEMENT]
lemma vars_mset_union [simp]:
  "vars_mset (A + B) = vars_mset A \<union> vars_mset B"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vars_mset (A + B) = vars_mset A \<union> vars_mset B
[PROOF STEP]
by (auto simp: vars_mset_def)


[STATEMENT]
lemma disjoint_var_sym: "disjoint_var P Q = disjoint_var Q P"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. disjoint_var P Q = disjoint_var Q P
[PROOF STEP]
unfolding disjoint_var_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (var_set P \<inter> var_set Q = {}) = (var_set Q \<inter> var_set P = {})
[PROOF STEP]
by auto


[STATEMENT]
lemma gkernTr1:"\<lbrakk>Group F; Group G; f \<in> gHom F G; x \<in> gker\<^bsub>F,G\<^esub> f\<rbrakk> \<Longrightarrow>                    x \<in> carrier F"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Group F; Group G; f \<in> gHom F G; x \<in> gker\<^bsub>F,G\<^esub> f\<rbrakk> \<Longrightarrow> x \<in> carrier F
[PROOF STEP]
apply (simp add: gkernel_def)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma add_top:
  fixes x :: "'a::{order_top, ordered_comm_monoid_add}"
  shows "0 \<le> x \<Longrightarrow> x + top = top"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (0::'a) \<le> x \<Longrightarrow> x + top = top
[PROOF STEP]
by (intro top_le add_increasing order_refl)


[STATEMENT]
lemma inv_join: "\<lbrakk> invc l; invh l; invc r; invh r \<rbrakk> \<Longrightarrow> invc(join l x r) \<and> invh(join l x r)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invc l; invh l; invc r; invh r\<rbrakk> \<Longrightarrow> invc (Set2_Join_RBT.join l x r) \<and> invh (Set2_Join_RBT.join l x r)
[PROOF STEP]
by (simp add: inv_joinL inv_joinR invh_paint join_def)


[STATEMENT]
lemma SuccI2:
  "\<R> = {region X I r | I r. valid_region X k I r} \<Longrightarrow> v \<in> R \<Longrightarrow> R \<in> \<R> \<Longrightarrow> t \<ge> 0 \<Longrightarrow> R' = [v \<oplus> t]\<^sub>\<R>
  \<Longrightarrow> R' \<in> Succ \<R> R"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<R> = {region X I r |I r. valid_region X k I r}; v \<in> R; R \<in> \<R>; 0 \<le> t; R' = [v \<oplus> t]\<^sub>\<R>\<rbrakk> \<Longrightarrow> R' \<in> Succ \<R> R
[PROOF STEP]
proof goal_cases
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>\<R> = {region X I r |I r. valid_region X k I r}; v \<in> R; R \<in> \<R>; 0 \<le> t; R' = [v \<oplus> t]\<^sub>\<R>\<rbrakk> \<Longrightarrow> R' \<in> Succ \<R> R
[PROOF STEP]
case A: 1
[PROOF STATE]
proof (state)
this:
\<R> = {region X I r |I r. valid_region X k I r}
v \<in> R
R \<in> \<R>
0 \<le> t
R' = [v \<oplus> t]\<^sub>\<R>

goal (1 subgoal):
 1. \<lbrakk>\<R> = {region X I r |I r. valid_region X k I r}; v \<in> R; R \<in> \<R>; 0 \<le> t; R' = [v \<oplus> t]\<^sub>\<R>\<rbrakk> \<Longrightarrow> R' \<in> Succ \<R> R
[PROOF STEP]
from Succ.intros[OF A(2) A(3) regions_closed[OF A(1,3,2,4)] A(4)] A(5)
[PROOF STATE]
proof (chain)
picking this:
[v \<oplus> t]\<^sub>\<R> = [v \<oplus> t]\<^sub>\<R> \<Longrightarrow> [v \<oplus> t]\<^sub>\<R> \<in> Succ \<R> R
R' = [v \<oplus> t]\<^sub>\<R>
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
[v \<oplus> t]\<^sub>\<R> = [v \<oplus> t]\<^sub>\<R> \<Longrightarrow> [v \<oplus> t]\<^sub>\<R> \<in> Succ \<R> R
R' = [v \<oplus> t]\<^sub>\<R>

goal (1 subgoal):
 1. R' \<in> Succ \<R> R
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
R' \<in> Succ \<R> R

goal:
No subgoals!
[PROOF STEP]
qed