[STATEMENT]
lemma unifiers_Fun [simp]:
  "\<sigma> \<in> unifiers {(Fun f ss, Fun g ts)} \<longleftrightarrow>
    length ss = length ts \<and> f = g \<and> \<sigma> \<in> unifiers (set (zip ss ts))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<sigma> \<in> unifiers {(Fun f ss, Fun g ts)}) = (length ss = length ts \<and> f = g \<and> \<sigma> \<in> unifiers (set (zip ss ts)))
[PROOF STEP]
by (auto simp: unifiers_def dest: map_eq_imp_length_eq)
    (induct ss ts rule: list_induct2, simp_all)


[STATEMENT]
lemma fset_states_to_list_states_observable :
  assumes "observable M"
  shows "observable (fset_states_to_list_states M)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. observable (fset_states_to_list_states M)
[PROOF STEP]
using rename_states_observable[OF linorder_fset_list_bij assms]
[PROOF STATE]
proof (prove)
using this:
observable (FSM.rename_states M sorted_list_of_fset)

goal (1 subgoal):
 1. observable (fset_states_to_list_states M)
[PROOF STEP]
unfolding fset_states_to_list_states_def
[PROOF STATE]
proof (prove)
using this:
observable (FSM.rename_states M sorted_list_of_fset)

goal (1 subgoal):
 1. observable (FSM.rename_states M sorted_list_of_fset)
[PROOF STEP]
.


[STATEMENT]
lemma sort_append:
  assumes "\<forall>x\<in>set xs. \<forall>y\<in>set ys. x \<le> y"
  shows   "sort (xs @ ys) = sort xs @ sort ys"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. sort (xs @ ys) = sort xs @ sort ys
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
\<forall>x\<in>set xs. \<forall>y\<in>set ys. x \<le> y

goal (1 subgoal):
 1. sort (xs @ ys) = sort xs @ sort ys
[PROOF STEP]
by (intro properties_for_sort) (auto simp: sorted_append)


[STATEMENT]
lemma filterlim_times_pos:
  "LIM x F1. c * f x :> at_right l"
  if "filterlim f (at_right p) F1" "0 < c" "l = c * p"
  for c::"'a::{linordered_field, linorder_topology}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. LIM x F1. c * f x :> at_right l
[PROOF STEP]
unfolding filterlim_iff
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>P. eventually P (at_right l) \<longrightarrow> (\<forall>\<^sub>F x in F1. P (c * f x))
[PROOF STEP]
proof safe
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>P. eventually P (at_right l) \<Longrightarrow> \<forall>\<^sub>F x in F1. P (c * f x)
[PROOF STEP]
fix P
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>P. eventually P (at_right l) \<Longrightarrow> \<forall>\<^sub>F x in F1. P (c * f x)
[PROOF STEP]
assume "\<forall>\<^sub>F x in at_right l. P x"
[PROOF STATE]
proof (state)
this:
eventually P (at_right l)

goal (1 subgoal):
 1. \<And>P. eventually P (at_right l) \<Longrightarrow> \<forall>\<^sub>F x in F1. P (c * f x)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
eventually P (at_right l)
[PROOF STEP]
obtain d where "c * p < d" "\<And>y. y > c * p \<Longrightarrow> y < d \<Longrightarrow> P y"
[PROOF STATE]
proof (prove)
using this:
eventually P (at_right l)

goal (1 subgoal):
 1. (\<And>d. \<lbrakk>c * p < d; \<And>y. \<lbrakk>c * p < y; y < d\<rbrakk> \<Longrightarrow> P y\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
unfolding \<open>l = _ \<close> eventually_at_right_field
[PROOF STATE]
proof (prove)
using this:
\<exists>b>c * p. \<forall>y>c * p. y < b \<longrightarrow> P y

goal (1 subgoal):
 1. (\<And>d. \<lbrakk>c * p < d; \<And>y. \<lbrakk>c * p < y; y < d\<rbrakk> \<Longrightarrow> P y\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
c * p < d
\<lbrakk>c * p < ?y; ?y < d\<rbrakk> \<Longrightarrow> P ?y

goal (1 subgoal):
 1. \<And>P. eventually P (at_right l) \<Longrightarrow> \<forall>\<^sub>F x in F1. P (c * f x)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
c * p < d
\<lbrakk>c * p < ?y; ?y < d\<rbrakk> \<Longrightarrow> P ?y
[PROOF STEP]
have "\<forall>\<^sub>F a in at_right p. P (c * a)"
[PROOF STATE]
proof (prove)
using this:
c * p < d
\<lbrakk>c * p < ?y; ?y < d\<rbrakk> \<Longrightarrow> P ?y

goal (1 subgoal):
 1. \<forall>\<^sub>F a in at_right p. P (c * a)
[PROOF STEP]
by (auto simp: eventually_at_right_field \<open>0 < c\<close> field_simps intro!: exI[where x="d/c"])
[PROOF STATE]
proof (state)
this:
\<forall>\<^sub>F a in at_right p. P (c * a)

goal (1 subgoal):
 1. \<And>P. eventually P (at_right l) \<Longrightarrow> \<forall>\<^sub>F x in F1. P (c * f x)
[PROOF STEP]
from that(1)[unfolded filterlim_iff, rule_format, OF this]
[PROOF STATE]
proof (chain)
picking this:
\<forall>\<^sub>F x in F1. P (c * f x)
[PROOF STEP]
show "\<forall>\<^sub>F x in F1. P (c * f x)"
[PROOF STATE]
proof (prove)
using this:
\<forall>\<^sub>F x in F1. P (c * f x)

goal (1 subgoal):
 1. \<forall>\<^sub>F x in F1. P (c * f x)
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
\<forall>\<^sub>F x in F1. P (c * f x)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
theorem Class_is_Block:
  assumes "a \<in> S" shows "Class a = Block a"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Class a = Block a
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. Class a = Block a
[PROOF STEP]
from \<open>a \<in> S\<close> and block_exists
[PROOF STATE]
proof (chain)
picking this:
a \<in> S
?a \<in> S \<Longrightarrow> \<exists>A. ?a \<in> A \<and> A \<in> P
[PROOF STEP]
obtain A where block: "a \<in> A \<and> A \<in> P"
[PROOF STATE]
proof (prove)
using this:
a \<in> S
?a \<in> S \<Longrightarrow> \<exists>A. ?a \<in> A \<and> A \<in> P

goal (1 subgoal):
 1. (\<And>A. a \<in> A \<and> A \<in> P \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
a \<in> A \<and> A \<in> P

goal (1 subgoal):
 1. Class a = Block a
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Class a = Block a
[PROOF STEP]
apply (simp add: Block_def Class_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. a \<in> S \<longrightarrow> {b \<in> S. (b, a) \<in> Equivalence} = (THE A. a \<in> A \<and> A \<in> P)
[PROOF STEP]
apply (rule theI2)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. a \<in> ?a6 \<and> ?a6 \<in> P
 2. \<And>x. a \<in> x \<and> x \<in> P \<Longrightarrow> x = ?a6
 3. \<And>x. a \<in> x \<and> x \<in> P \<Longrightarrow> a \<in> S \<longrightarrow> {b \<in> S. (b, a) \<in> Equivalence} = x
[PROOF STEP]
apply (rule block)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>x. a \<in> x \<and> x \<in> P \<Longrightarrow> x = A
 2. \<And>x. a \<in> x \<and> x \<in> P \<Longrightarrow> a \<in> S \<longrightarrow> {b \<in> S. (b, a) \<in> Equivalence} = x
[PROOF STEP]
apply (metis block block_unique)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. a \<in> x \<and> x \<in> P \<Longrightarrow> a \<in> S \<longrightarrow> {b \<in> S. (b, a) \<in> Equivalence} = x
[PROOF STEP]
apply (auto dest: block_unique simp: Equivalence_def)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
Class a = Block a

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma f_Exec_Stream_nth_0: "
  0 < length xs \<Longrightarrow> (f_Exec_Comp_Stream trans_fun xs c) ! 0= trans_fun (xs ! 0) c"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 < length xs \<Longrightarrow> f_Exec_Comp_Stream trans_fun xs c ! 0 = trans_fun (xs ! 0) c
[PROOF STEP]
by (case_tac xs, simp+)


[STATEMENT]
lemma nop_v11I[intro]:
  assumes "v11 f"
    and "n \<in>\<^sub>\<circ> \<omega>"
    and "\<D>\<^sub>\<circ> f = A ^\<^sub>\<times> n"
    and "\<R>\<^sub>\<circ> f \<subseteq>\<^sub>\<circ> A"
  shows "nop_v11 A n f"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. nop_v11 A n f
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
v11 f
n \<in>\<^sub>\<circ> \<omega>
\<D>\<^sub>\<circ> f = A ^\<^sub>\<times> n
\<R>\<^sub>\<circ> f \<subseteq>\<^sub>\<circ> A

goal (1 subgoal):
 1. nop_v11 A n f
[PROOF STEP]
unfolding nop_v11_def nop_v11_axioms_def
[PROOF STATE]
proof (prove)
using this:
v11 f
n \<in>\<^sub>\<circ> \<omega>
\<D>\<^sub>\<circ> f = A ^\<^sub>\<times> n
\<R>\<^sub>\<circ> f \<subseteq>\<^sub>\<circ> A

goal (1 subgoal):
 1. v11 f \<and> n \<in>\<^sub>\<circ> \<omega> \<and> \<D>\<^sub>\<circ> f = A ^\<^sub>\<times> n \<and> \<R>\<^sub>\<circ> f \<subseteq>\<^sub>\<circ> A
[PROOF STEP]
by blast


[STATEMENT]
lemma lynch_6_16_c:
  assumes commR: "EIG_commPerRd (HOs (length_lbl l)) (SHOs (length_lbl l))"
                 (is "EIG_commPerRd (HOs ?r) _")
      and l: "\<not>(is_leaf l)"
  shows "card {l' \<in> children l. last_lbl l' \<in> SKr (HOs ?r) (SHOs ?r)}
         > card (children l) div 2"
    (is "card ?lhs > _")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. card (children l) div 2 < card {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))}
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. card (children l) div 2 < card {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))}
[PROOF STEP]
let ?skr = "SKr (HOs ?r) (SHOs ?r)"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. card (children l) div 2 < card {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))}
[PROOF STEP]
have "last_lbl ` ?lhs = ?skr - set_lbl l"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. last_lbl ` {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))} = SKr (HOs (length_lbl l)) (SHOs (length_lbl l)) - set_lbl l
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. last_lbl ` {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))} \<subseteq> SKr (HOs (length_lbl l)) (SHOs (length_lbl l)) - set_lbl l
 2. SKr (HOs (length_lbl l)) (SHOs (length_lbl l)) - set_lbl l \<subseteq> last_lbl ` {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))}
[PROOF STEP]
from children_last_set[OF l]
[PROOF STATE]
proof (chain)
picking this:
last_lbl ` children l = UNIV - set_lbl l
[PROOF STEP]
show "last_lbl ` ?lhs \<subseteq> ?skr - set_lbl l"
[PROOF STATE]
proof (prove)
using this:
last_lbl ` children l = UNIV - set_lbl l

goal (1 subgoal):
 1. last_lbl ` {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))} \<subseteq> SKr (HOs (length_lbl l)) (SHOs (length_lbl l)) - set_lbl l
[PROOF STEP]
by (auto simp: children_length)
[PROOF STATE]
proof (state)
this:
last_lbl ` {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))} \<subseteq> SKr (HOs (length_lbl l)) (SHOs (length_lbl l)) - set_lbl l

goal (1 subgoal):
 1. SKr (HOs (length_lbl l)) (SHOs (length_lbl l)) - set_lbl l \<subseteq> last_lbl ` {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))}
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. SKr (HOs (length_lbl l)) (SHOs (length_lbl l)) - set_lbl l \<subseteq> last_lbl ` {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))}
[PROOF STEP]
{
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. SKr (HOs (length_lbl l)) (SHOs (length_lbl l)) - set_lbl l \<subseteq> last_lbl ` {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))}
[PROOF STEP]
fix p
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. SKr (HOs (length_lbl l)) (SHOs (length_lbl l)) - set_lbl l \<subseteq> last_lbl ` {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))}
[PROOF STEP]
assume p: "p \<in> ?skr" "p \<notin> set_lbl l"
[PROOF STATE]
proof (state)
this:
p \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))
p \<notin> set_lbl l

goal (1 subgoal):
 1. SKr (HOs (length_lbl l)) (SHOs (length_lbl l)) - set_lbl l \<subseteq> last_lbl ` {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))}
[PROOF STEP]
with  children_last_set[OF l]
[PROOF STATE]
proof (chain)
picking this:
last_lbl ` children l = UNIV - set_lbl l
p \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))
p \<notin> set_lbl l
[PROOF STEP]
have "p \<in> last_lbl ` children l"
[PROOF STATE]
proof (prove)
using this:
last_lbl ` children l = UNIV - set_lbl l
p \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))
p \<notin> set_lbl l

goal (1 subgoal):
 1. p \<in> last_lbl ` children l
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
p \<in> last_lbl ` children l

goal (1 subgoal):
 1. SKr (HOs (length_lbl l)) (SHOs (length_lbl l)) - set_lbl l \<subseteq> last_lbl ` {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))}
[PROOF STEP]
with p
[PROOF STATE]
proof (chain)
picking this:
p \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))
p \<notin> set_lbl l
p \<in> last_lbl ` children l
[PROOF STEP]
have "p \<in> last_lbl ` ?lhs"
[PROOF STATE]
proof (prove)
using this:
p \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))
p \<notin> set_lbl l
p \<in> last_lbl ` children l

goal (1 subgoal):
 1. p \<in> last_lbl ` {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))}
[PROOF STEP]
by (auto simp: image_def children_length)
[PROOF STATE]
proof (state)
this:
p \<in> last_lbl ` {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))}

goal (1 subgoal):
 1. SKr (HOs (length_lbl l)) (SHOs (length_lbl l)) - set_lbl l \<subseteq> last_lbl ` {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))}
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
\<lbrakk>?p3 \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l)); ?p3 \<notin> set_lbl l\<rbrakk> \<Longrightarrow> ?p3 \<in> last_lbl ` {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))}

goal (1 subgoal):
 1. SKr (HOs (length_lbl l)) (SHOs (length_lbl l)) - set_lbl l \<subseteq> last_lbl ` {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))}
[PROOF STEP]
thus "?skr - set_lbl l \<subseteq> last_lbl ` ?lhs"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?p3 \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l)); ?p3 \<notin> set_lbl l\<rbrakk> \<Longrightarrow> ?p3 \<in> last_lbl ` {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))}

goal (1 subgoal):
 1. SKr (HOs (length_lbl l)) (SHOs (length_lbl l)) - set_lbl l \<subseteq> last_lbl ` {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
SKr (HOs (length_lbl l)) (SHOs (length_lbl l)) - set_lbl l \<subseteq> last_lbl ` {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))}

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
last_lbl ` {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))} = SKr (HOs (length_lbl l)) (SHOs (length_lbl l)) - set_lbl l

goal (1 subgoal):
 1. card (children l) div 2 < card {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))}
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
last_lbl ` {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))} = SKr (HOs (length_lbl l)) (SHOs (length_lbl l)) - set_lbl l

goal (1 subgoal):
 1. card (children l) div 2 < card {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))}
[PROOF STEP]
from last_lbl_inj_on_children[of l]
[PROOF STATE]
proof (chain)
picking this:
inj_on last_lbl (children l)
[PROOF STEP]
have "inj_on last_lbl ?lhs"
[PROOF STATE]
proof (prove)
using this:
inj_on last_lbl (children l)

goal (1 subgoal):
 1. inj_on last_lbl {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))}
[PROOF STEP]
by (auto simp: inj_on_def)
[PROOF STATE]
proof (state)
this:
inj_on last_lbl {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))}

goal (1 subgoal):
 1. card (children l) div 2 < card {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))}
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
last_lbl ` {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))} = SKr (HOs (length_lbl l)) (SHOs (length_lbl l)) - set_lbl l
inj_on last_lbl {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))}
[PROOF STEP]
have "card ?lhs = card (?skr - set_lbl l)"
[PROOF STATE]
proof (prove)
using this:
last_lbl ` {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))} = SKr (HOs (length_lbl l)) (SHOs (length_lbl l)) - set_lbl l
inj_on last_lbl {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))}

goal (1 subgoal):
 1. card {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))} = card (SKr (HOs (length_lbl l)) (SHOs (length_lbl l)) - set_lbl l)
[PROOF STEP]
by (auto dest: card_image)
[PROOF STATE]
proof (state)
this:
card {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))} = card (SKr (HOs (length_lbl l)) (SHOs (length_lbl l)) - set_lbl l)

goal (1 subgoal):
 1. card (children l) div 2 < card {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))}
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
card {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))} = card (SKr (HOs (length_lbl l)) (SHOs (length_lbl l)) - set_lbl l)

goal (1 subgoal):
 1. card (children l) div 2 < card {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))}
[PROOF STEP]
have "\<dots> \<ge> (card ?skr) - (card (set_lbl l))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. card (SKr (HOs (length_lbl l)) (SHOs (length_lbl l))) - card (set_lbl l) \<le> card (SKr (HOs (length_lbl l)) (SHOs (length_lbl l)) - set_lbl l)
[PROOF STEP]
by (simp add: diff_card_le_card_Diff)
[PROOF STATE]
proof (state)
this:
card (SKr (HOs (length_lbl l)) (SHOs (length_lbl l))) - card (set_lbl l) \<le> card (SKr (HOs (length_lbl l)) (SHOs (length_lbl l)) - set_lbl l)

goal (1 subgoal):
 1. card (children l) div 2 < card {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))}
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
card (SKr (HOs (length_lbl l)) (SHOs (length_lbl l))) - card (set_lbl l) \<le> card {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))}
[PROOF STEP]
have "card ?lhs \<ge> (card ?skr) - ?r"
[PROOF STATE]
proof (prove)
using this:
card (SKr (HOs (length_lbl l)) (SHOs (length_lbl l))) - card (set_lbl l) \<le> card {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))}

goal (1 subgoal):
 1. card (SKr (HOs (length_lbl l)) (SHOs (length_lbl l))) - length_lbl l \<le> card {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))}
[PROOF STEP]
using card_set_lbl[of l]
[PROOF STATE]
proof (prove)
using this:
card (SKr (HOs (length_lbl l)) (SHOs (length_lbl l))) - card (set_lbl l) \<le> card {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))}
card (set_lbl l) = length_lbl l

goal (1 subgoal):
 1. card (SKr (HOs (length_lbl l)) (SHOs (length_lbl l))) - length_lbl l \<le> card {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))}
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
card (SKr (HOs (length_lbl l)) (SHOs (length_lbl l))) - length_lbl l \<le> card {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))}

goal (1 subgoal):
 1. card (children l) div 2 < card {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))}
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
card (SKr (HOs (length_lbl l)) (SHOs (length_lbl l))) - length_lbl l \<le> card {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))}

goal (1 subgoal):
 1. card (children l) div 2 < card {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))}
[PROOF STEP]
from commR
[PROOF STATE]
proof (chain)
picking this:
EIG_commPerRd (HOs (length_lbl l)) (SHOs (length_lbl l))
[PROOF STEP]
have "card ?skr > (N + f) div 2"
[PROOF STATE]
proof (prove)
using this:
EIG_commPerRd (HOs (length_lbl l)) (SHOs (length_lbl l))

goal (1 subgoal):
 1. (N + f) div 2 < card (SKr (HOs (length_lbl l)) (SHOs (length_lbl l)))
[PROOF STEP]
by (auto simp: EIG_commPerRd_def)
[PROOF STATE]
proof (state)
this:
(N + f) div 2 < card (SKr (HOs (length_lbl l)) (SHOs (length_lbl l)))

goal (1 subgoal):
 1. card (children l) div 2 < card {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))}
[PROOF STEP]
with not_leaf_length[OF l] f
[PROOF STATE]
proof (chain)
picking this:
length_lbl l \<le> f
f < N
(N + f) div 2 < card (SKr (HOs (length_lbl l)) (SHOs (length_lbl l)))
[PROOF STEP]
have "(card ?skr) - ?r > (N - ?r) div 2"
[PROOF STATE]
proof (prove)
using this:
length_lbl l \<le> f
f < N
(N + f) div 2 < card (SKr (HOs (length_lbl l)) (SHOs (length_lbl l)))

goal (1 subgoal):
 1. (N - length_lbl l) div 2 < card (SKr (HOs (length_lbl l)) (SHOs (length_lbl l))) - length_lbl l
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(N - length_lbl l) div 2 < card (SKr (HOs (length_lbl l)) (SHOs (length_lbl l))) - length_lbl l

goal (1 subgoal):
 1. card (children l) div 2 < card {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))}
[PROOF STEP]
with card_children[OF l]
[PROOF STATE]
proof (chain)
picking this:
card (children l) = N - length_lbl l
(N - length_lbl l) div 2 < card (SKr (HOs (length_lbl l)) (SHOs (length_lbl l))) - length_lbl l
[PROOF STEP]
have "(card ?skr) - ?r > card (children l) div 2"
[PROOF STATE]
proof (prove)
using this:
card (children l) = N - length_lbl l
(N - length_lbl l) div 2 < card (SKr (HOs (length_lbl l)) (SHOs (length_lbl l))) - length_lbl l

goal (1 subgoal):
 1. card (children l) div 2 < card (SKr (HOs (length_lbl l)) (SHOs (length_lbl l))) - length_lbl l
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
card (children l) div 2 < card (SKr (HOs (length_lbl l)) (SHOs (length_lbl l))) - length_lbl l

goal (1 subgoal):
 1. card (children l) div 2 < card {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))}
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
card (SKr (HOs (length_lbl l)) (SHOs (length_lbl l))) - length_lbl l \<le> card {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))}
card (children l) div 2 < card (SKr (HOs (length_lbl l)) (SHOs (length_lbl l))) - length_lbl l
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
card (SKr (HOs (length_lbl l)) (SHOs (length_lbl l))) - length_lbl l \<le> card {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))}
card (children l) div 2 < card (SKr (HOs (length_lbl l)) (SHOs (length_lbl l))) - length_lbl l

goal (1 subgoal):
 1. card (children l) div 2 < card {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))}
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
card (children l) div 2 < card {l' \<in> children l. last_lbl l' \<in> SKr (HOs (length_lbl l)) (SHOs (length_lbl l))}

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma butlast_upt: "butlast [m..<n] = [m..<n - 1]"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. butlast [m..<n] = [m..<n - 1]
[PROOF STEP]
apply (cases "m<n")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. m < n \<Longrightarrow> butlast [m..<n] = [m..<n - 1]
 2. \<not> m < n \<Longrightarrow> butlast [m..<n] = [m..<n - 1]
[PROOF STEP]
apply (cases n)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<lbrakk>m < n; n = 0\<rbrakk> \<Longrightarrow> butlast [m..<n] = [m..<n - 1]
 2. \<And>nat. \<lbrakk>m < n; n = Suc nat\<rbrakk> \<Longrightarrow> butlast [m..<n] = [m..<n - 1]
 3. \<not> m < n \<Longrightarrow> butlast [m..<n] = [m..<n - 1]
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>nat. \<lbrakk>m < n; n = Suc nat\<rbrakk> \<Longrightarrow> butlast [m..<n] = [m..<n - 1]
 2. \<not> m < n \<Longrightarrow> butlast [m..<n] = [m..<n - 1]
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> m < n \<Longrightarrow> butlast [m..<n] = [m..<n - 1]
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
theorem know_composition_neg_ine_s:
assumes "\<not> know P (sKS secret)"
       and "\<not> know Q (sKS secret)"
       and "subcomponents PQ = {P,Q}"
       and "correctCompositionIn PQ"
shows    "\<not> (ine PQ (sE secret))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> ine PQ (sE secret)
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
\<not> know P (sKS secret)
\<not> know Q (sKS secret)
subcomponents PQ = {P, Q}
correctCompositionIn PQ

goal (1 subgoal):
 1. \<not> ine PQ (sE secret)
[PROOF STEP]
by (metis TBtheorem3a not_know_s_not_ine)


[STATEMENT]
lemma master2_1_automation:
  assumes "g \<in> \<Theta>(MASTER_BOUND' p p')" "p' < -1"
  shows   "f \<in> \<Theta>(MASTER_BOUND p 0 0)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. f \<in> \<Theta>(MASTER_BOUND p 0 0)
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. f \<in> \<Theta>(MASTER_BOUND p 0 0)
[PROOF STEP]
have A: "MASTER_BOUND p 0 0 \<in> \<Theta>(\<lambda>x::nat. x powr p)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. MASTER_BOUND p 0 0 \<in> \<Theta>(\<lambda>x. real x powr p)
[PROOF STEP]
unfolding MASTER_BOUND_def[abs_def]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lambda>x. real x powr p * ln (real x) powr 0 * ln (ln (real x)) powr 0) \<in> \<Theta>(\<lambda>x. real x powr p)
[PROOF STEP]
by (intro landau_real_nat_transfer bigthetaI_cong
          eventually_mono[OF eventually_ge_at_top[of "3::real"]]) (auto dest!: ln_1_imp_less_3)
[PROOF STATE]
proof (state)
this:
MASTER_BOUND p 0 0 \<in> \<Theta>(\<lambda>x. real x powr p)

goal (1 subgoal):
 1. f \<in> \<Theta>(MASTER_BOUND p 0 0)
[PROOF STEP]
have B: "\<Theta>(MASTER_BOUND' p p') = \<Theta>(\<lambda>x::nat. real x powr p * ln (real x) powr p')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<Theta>(MASTER_BOUND' p p') = \<Theta>(\<lambda>x. real x powr p * ln (real x) powr p')
[PROOF STEP]
by (subst CLAMP, (subst MASTER_BOUND_postproc MASTER_BOUND_UNCLAMP)+, simp only: UNCLAMP)
[PROOF STATE]
proof (state)
this:
\<Theta>(MASTER_BOUND' p p') = \<Theta>(\<lambda>x. real x powr p * ln (real x) powr p')

goal (1 subgoal):
 1. f \<in> \<Theta>(MASTER_BOUND p 0 0)
[PROOF STEP]
from landau_theta.cong_bigtheta[OF A] B assms(1) master2_1[OF _ assms(2-)]
[PROOF STATE]
proof (chain)
picking this:
\<Theta>(MASTER_BOUND p 0 0) = \<Theta>(\<lambda>x. real x powr p)
\<Theta>(MASTER_BOUND' p p') = \<Theta>(\<lambda>x. real x powr p * ln (real x) powr p')
g \<in> \<Theta>(MASTER_BOUND' p p')
g \<in> \<Theta>(\<lambda>x. real x powr p * ln (real x) powr p') \<Longrightarrow> f \<in> \<Theta>(\<lambda>x. real x powr p)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<Theta>(MASTER_BOUND p 0 0) = \<Theta>(\<lambda>x. real x powr p)
\<Theta>(MASTER_BOUND' p p') = \<Theta>(\<lambda>x. real x powr p * ln (real x) powr p')
g \<in> \<Theta>(MASTER_BOUND' p p')
g \<in> \<Theta>(\<lambda>x. real x powr p * ln (real x) powr p') \<Longrightarrow> f \<in> \<Theta>(\<lambda>x. real x powr p)

goal (1 subgoal):
 1. f \<in> \<Theta>(MASTER_BOUND p 0 0)
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
f \<in> \<Theta>(MASTER_BOUND p 0 0)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma "is_scc E U \<longleftrightarrow> U \<in> UNIV // (E\<^sup>* \<inter> (E\<inverse>)\<^sup>*)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. is_scc E U = (U \<in> UNIV // (E\<^sup>* \<inter> (E\<inverse>)\<^sup>*))
[PROOF STEP]
unfolding is_scc_mconn_eqclasses mconn_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (U \<in> UNIV // (E\<^sup>* \<inter> (E\<inverse>)\<^sup>*)) = (U \<in> UNIV // (E\<^sup>* \<inter> (E\<inverse>)\<^sup>*))
[PROOF STEP]
by simp


[STATEMENT]
lemma spmf_map: "spmf (map_spmf f p) x = measure (measure_spmf p) (f -` {x})"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. spmf (map_spmf f p) x = Sigma_Algebra.measure (measure_spmf p) (f -` {x})
[PROOF STEP]
using ennreal_spmf_map[of f p x]
[PROOF STATE]
proof (prove)
using this:
ennreal (spmf (map_spmf f p) x) = emeasure (measure_spmf p) (f -` {x})

goal (1 subgoal):
 1. spmf (map_spmf f p) x = Sigma_Algebra.measure (measure_spmf p) (f -` {x})
[PROOF STEP]
by(simp add: measure_spmf.emeasure_eq_measure)


[STATEMENT]
lemma stationary_distribution_implies_pmf_of_st_vec:
  assumes "stationary_distribution N"
  shows "\<exists> x. N = pmf_of_st_vec x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>x. N = pmf_of_st_vec x
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<exists>x. N = pmf_of_st_vec x
[PROOF STEP]
from assms[unfolded stationary_distribution_alt_def]
[PROOF STATE]
proof (chain)
picking this:
N = pmf_of_st_vec (A *st st_vec_of_pmf N)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
N = pmf_of_st_vec (A *st st_vec_of_pmf N)

goal (1 subgoal):
 1. \<exists>x. N = pmf_of_st_vec x
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<exists>x. N = pmf_of_st_vec x

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma monotone_max_enat1: "monotone (\<le>) (\<le>) (\<lambda>x. max x y :: enat)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mono (\<lambda>x. max x y)
[PROOF STEP]
by(auto intro!: monotoneI simp add: max_def)


[STATEMENT]
lemma rfd_rbd_conjugation: "((fd\<^sub>\<R> R X) \<inter> Y = {}) = (X \<inter> (bd\<^sub>\<R> R Y) = {})"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (fd\<^sub>\<R> R X \<inter> Y = {}) = (X \<inter> bd\<^sub>\<R> R Y = {})
[PROOF STEP]
by (simp add: rbd_def rfd_def ffd_fbd_conjugation)


[STATEMENT]
lemma retract_of_space_section_map:
   "S retract_of_space X \<longleftrightarrow> S \<subseteq> topspace X \<and> section_map (subtopology X S) X id"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (S retract_of_space X) = (S \<subseteq> topspace X \<and> section_map (subtopology X S) X id)
[PROOF STEP]
unfolding retract_of_space_def retraction_maps_def section_map_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (S \<subseteq> topspace X \<and> (\<exists>r. continuous_map X (subtopology X S) r \<and> (\<forall>x\<in>S. r x = x))) = (S \<subseteq> topspace X \<and> (\<exists>g. continuous_map X (subtopology X S) g \<and> continuous_map (subtopology X S) X id \<and> (\<forall>x\<in>topspace (subtopology X S). g (id x) = x)))
[PROOF STEP]
by (auto simp: continuous_map_from_subtopology)


[STATEMENT]
lemma cspan_Times: \<open>cspan (S \<times> T) = cspan S \<times> cspan T\<close> if \<open>0 \<in> S\<close> and \<open>0 \<in> T\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. cspan (S \<times> T) = cspan S \<times> cspan T
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. cspan (S \<times> T) \<subseteq> cspan S \<times> cspan T
 2. cspan S \<times> cspan T \<subseteq> cspan (S \<times> T)
[PROOF STEP]
have \<open>fst ` cspan (S \<times> T) \<subseteq> cspan S\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fst ` cspan (S \<times> T) \<subseteq> cspan S
[PROOF STEP]
apply (subst complex_vector.linear_span_image[symmetric])
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. clinear fst
 2. cspan (fst ` (S \<times> T)) \<subseteq> cspan S
[PROOF STEP]
using that complex_vector.module_hom_fst
[PROOF STATE]
proof (prove)
using this:
(0::'a) \<in> S
(0::'b) \<in> T
clinear fst

goal (2 subgoals):
 1. clinear fst
 2. cspan (fst ` (S \<times> T)) \<subseteq> cspan S
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fst ` cspan (S \<times> T) \<subseteq> cspan S

goal (2 subgoals):
 1. cspan (S \<times> T) \<subseteq> cspan S \<times> cspan T
 2. cspan S \<times> cspan T \<subseteq> cspan (S \<times> T)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
fst ` cspan (S \<times> T) \<subseteq> cspan S

goal (2 subgoals):
 1. cspan (S \<times> T) \<subseteq> cspan S \<times> cspan T
 2. cspan S \<times> cspan T \<subseteq> cspan (S \<times> T)
[PROOF STEP]
have \<open>snd ` cspan (S \<times> T) \<subseteq> cspan T\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. snd ` cspan (S \<times> T) \<subseteq> cspan T
[PROOF STEP]
apply (subst complex_vector.linear_span_image[symmetric])
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. clinear snd
 2. cspan (snd ` (S \<times> T)) \<subseteq> cspan T
[PROOF STEP]
using that complex_vector.module_hom_snd
[PROOF STATE]
proof (prove)
using this:
(0::'a) \<in> S
(0::'b) \<in> T
clinear snd

goal (2 subgoals):
 1. clinear snd
 2. cspan (snd ` (S \<times> T)) \<subseteq> cspan T
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
snd ` cspan (S \<times> T) \<subseteq> cspan T

goal (2 subgoals):
 1. cspan (S \<times> T) \<subseteq> cspan S \<times> cspan T
 2. cspan S \<times> cspan T \<subseteq> cspan (S \<times> T)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
fst ` cspan (S \<times> T) \<subseteq> cspan S
snd ` cspan (S \<times> T) \<subseteq> cspan T
[PROOF STEP]
show \<open>cspan (S \<times> T) \<subseteq> cspan S \<times> cspan T\<close>
[PROOF STATE]
proof (prove)
using this:
fst ` cspan (S \<times> T) \<subseteq> cspan S
snd ` cspan (S \<times> T) \<subseteq> cspan T

goal (1 subgoal):
 1. cspan (S \<times> T) \<subseteq> cspan S \<times> cspan T
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
cspan (S \<times> T) \<subseteq> cspan S \<times> cspan T

goal (1 subgoal):
 1. cspan S \<times> cspan T \<subseteq> cspan (S \<times> T)
[PROOF STEP]
show \<open>cspan S \<times> cspan T \<subseteq> cspan (S \<times> T)\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. cspan S \<times> cspan T \<subseteq> cspan (S \<times> T)
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x. x \<in> cspan S \<times> cspan T \<Longrightarrow> x \<in> cspan (S \<times> T)
[PROOF STEP]
fix x
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x. x \<in> cspan S \<times> cspan T \<Longrightarrow> x \<in> cspan (S \<times> T)
[PROOF STEP]
assume assm: \<open>x \<in> cspan S \<times> cspan T\<close>
[PROOF STATE]
proof (state)
this:
x \<in> cspan S \<times> cspan T

goal (1 subgoal):
 1. \<And>x. x \<in> cspan S \<times> cspan T \<Longrightarrow> x \<in> cspan (S \<times> T)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
x \<in> cspan S \<times> cspan T
[PROOF STEP]
have \<open>fst x \<in> cspan S\<close>
[PROOF STATE]
proof (prove)
using this:
x \<in> cspan S \<times> cspan T

goal (1 subgoal):
 1. fst x \<in> cspan S
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fst x \<in> cspan S

goal (1 subgoal):
 1. \<And>x. x \<in> cspan S \<times> cspan T \<Longrightarrow> x \<in> cspan (S \<times> T)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
fst x \<in> cspan S
[PROOF STEP]
obtain t1 r1 where fst_x: \<open>fst x = (\<Sum>a\<in>t1. r1 a *\<^sub>C a)\<close> and [simp]: \<open>finite t1\<close> and \<open>t1 \<subseteq> S\<close>
[PROOF STATE]
proof (prove)
using this:
fst x \<in> cspan S

goal (1 subgoal):
 1. (\<And>r1 t1. \<lbrakk>fst x = (\<Sum>a\<in>t1. r1 a *\<^sub>C a); finite t1; t1 \<subseteq> S\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (auto simp add: complex_vector.span_explicit)
[PROOF STATE]
proof (state)
this:
fst x = (\<Sum>a\<in>t1. r1 a *\<^sub>C a)
finite t1
t1 \<subseteq> S

goal (1 subgoal):
 1. \<And>x. x \<in> cspan S \<times> cspan T \<Longrightarrow> x \<in> cspan (S \<times> T)
[PROOF STEP]
from assm
[PROOF STATE]
proof (chain)
picking this:
x \<in> cspan S \<times> cspan T
[PROOF STEP]
have \<open>snd x \<in> cspan T\<close>
[PROOF STATE]
proof (prove)
using this:
x \<in> cspan S \<times> cspan T

goal (1 subgoal):
 1. snd x \<in> cspan T
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
snd x \<in> cspan T

goal (1 subgoal):
 1. \<And>x. x \<in> cspan S \<times> cspan T \<Longrightarrow> x \<in> cspan (S \<times> T)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
snd x \<in> cspan T
[PROOF STEP]
obtain t2 r2 where snd_x: \<open>snd x = (\<Sum>a\<in>t2. r2 a *\<^sub>C a)\<close> and [simp]: \<open>finite t2\<close> and \<open>t2 \<subseteq> T\<close>
[PROOF STATE]
proof (prove)
using this:
snd x \<in> cspan T

goal (1 subgoal):
 1. (\<And>r2 t2. \<lbrakk>snd x = (\<Sum>a\<in>t2. r2 a *\<^sub>C a); finite t2; t2 \<subseteq> T\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (auto simp add: complex_vector.span_explicit)
[PROOF STATE]
proof (state)
this:
snd x = (\<Sum>a\<in>t2. r2 a *\<^sub>C a)
finite t2
t2 \<subseteq> T

goal (1 subgoal):
 1. \<And>x. x \<in> cspan S \<times> cspan T \<Longrightarrow> x \<in> cspan (S \<times> T)
[PROOF STEP]
define t :: \<open>('a+'b) set\<close> and r :: \<open>('a+'b) \<Rightarrow> complex\<close> and f :: \<open>('a+'b) \<Rightarrow> ('a\<times>'b)\<close>
      where \<open>t = t1 <+> t2\<close>
      and \<open>r a = (case a of Inl a1 \<Rightarrow> r1 a1 | Inr a2 \<Rightarrow> r2 a2)\<close>
      and \<open>f a = (case a of Inl a1 \<Rightarrow> (a1,0) | Inr a2 \<Rightarrow> (0,a2))\<close>
    for a
[PROOF STATE]
proof (state)
this:
t = t1 <+> t2
r ?a = (case ?a of Inl a1 \<Rightarrow> r1 a1 | Inr a2 \<Rightarrow> r2 a2)
f ?a = (case ?a of Inl a1 \<Rightarrow> (a1, 0::'b) | Inr a2 \<Rightarrow> (0::'a, a2))

goal (1 subgoal):
 1. \<And>x. x \<in> cspan S \<times> cspan T \<Longrightarrow> x \<in> cspan (S \<times> T)
[PROOF STEP]
have \<open>finite t\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. finite t
[PROOF STEP]
by (simp add: t_def)
[PROOF STATE]
proof (state)
this:
finite t

goal (1 subgoal):
 1. \<And>x. x \<in> cspan S \<times> cspan T \<Longrightarrow> x \<in> cspan (S \<times> T)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
finite t

goal (1 subgoal):
 1. \<And>x. x \<in> cspan S \<times> cspan T \<Longrightarrow> x \<in> cspan (S \<times> T)
[PROOF STEP]
have \<open>f ` t \<subseteq> S \<times> T\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. f ` t \<subseteq> S \<times> T
[PROOF STEP]
using  \<open>t1 \<subseteq> S\<close> \<open>t2 \<subseteq> T\<close> that
[PROOF STATE]
proof (prove)
using this:
t1 \<subseteq> S
t2 \<subseteq> T
(0::'a) \<in> S
(0::'b) \<in> T

goal (1 subgoal):
 1. f ` t \<subseteq> S \<times> T
[PROOF STEP]
by (auto simp: f_def t_def)
[PROOF STATE]
proof (state)
this:
f ` t \<subseteq> S \<times> T

goal (1 subgoal):
 1. \<And>x. x \<in> cspan S \<times> cspan T \<Longrightarrow> x \<in> cspan (S \<times> T)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
f ` t \<subseteq> S \<times> T

goal (1 subgoal):
 1. \<And>x. x \<in> cspan S \<times> cspan T \<Longrightarrow> x \<in> cspan (S \<times> T)
[PROOF STEP]
have \<open>(fst x, snd x) = (\<Sum>a\<in>t. r a *\<^sub>C f a)\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (fst x, snd x) = (\<Sum>a\<in>t. r a *\<^sub>C f a)
[PROOF STEP]
apply (simp only: fst_x snd_x)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Sum>a\<in>t1. r1 a *\<^sub>C a, \<Sum>a\<in>t2. r2 a *\<^sub>C a) = (\<Sum>a\<in>t. r a *\<^sub>C f a)
[PROOF STEP]
by (auto simp: t_def sum.Plus r_def f_def sum_prod)
[PROOF STATE]
proof (state)
this:
(fst x, snd x) = (\<Sum>a\<in>t. r a *\<^sub>C f a)

goal (1 subgoal):
 1. \<And>x. x \<in> cspan S \<times> cspan T \<Longrightarrow> x \<in> cspan (S \<times> T)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
finite t
f ` t \<subseteq> S \<times> T
(fst x, snd x) = (\<Sum>a\<in>t. r a *\<^sub>C f a)
[PROOF STEP]
show \<open>x \<in> cspan (S \<times> T)\<close>
[PROOF STATE]
proof (prove)
using this:
finite t
f ` t \<subseteq> S \<times> T
(fst x, snd x) = (\<Sum>a\<in>t. r a *\<^sub>C f a)

goal (1 subgoal):
 1. x \<in> cspan (S \<times> T)
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>finite t; f ` t \<subseteq> S \<times> T; x = (\<Sum>a\<in>t. r a *\<^sub>C f a)\<rbrakk> \<Longrightarrow> (\<Sum>a\<in>t. r a *\<^sub>C f a) \<in> cspan (S \<times> T)
[PROOF STEP]
by (smt (verit, best) complex_vector.span_scale complex_vector.span_sum complex_vector.span_superset image_subset_iff subset_iff)
[PROOF STATE]
proof (state)
this:
x \<in> cspan (S \<times> T)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
cspan S \<times> cspan T \<subseteq> cspan (S \<times> T)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma cf_cn_cov_lcomp_ObjMap_vdomain[cat_cs_simps]:
  assumes "category \<alpha> \<CC>" and "\<FF> : \<AA> \<mapsto>\<mapsto>\<^sub>C\<^bsub>\<alpha>\<^esub> \<BB>"
  shows "\<D>\<^sub>\<circ> (cf_cn_cov_lcomp \<CC> \<SS> \<FF>\<lparr>ObjMap\<rparr>) = (op_cat \<AA> \<times>\<^sub>C \<CC>)\<lparr>Obj\<rparr>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<D>\<^sub>\<circ> (cf_cn_cov_lcomp \<CC> \<SS> \<FF>\<lparr>ObjMap\<rparr>) = (op_cat \<AA> \<times>\<^sub>C \<CC>)\<lparr>Obj\<rparr>
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
category \<alpha> \<CC>
\<FF> : \<AA> \<mapsto>\<mapsto>\<^sub>C\<^bsub>\<alpha>\<^esub> \<BB>

goal (1 subgoal):
 1. \<D>\<^sub>\<circ> (cf_cn_cov_lcomp \<CC> \<SS> \<FF>\<lparr>ObjMap\<rparr>) = (op_cat \<AA> \<times>\<^sub>C \<CC>)\<lparr>Obj\<rparr>
[PROOF STEP]
unfolding cf_cn_cov_lcomp_def
[PROOF STATE]
proof (prove)
using this:
category \<alpha> \<CC>
\<FF> : \<AA> \<mapsto>\<mapsto>\<^sub>C\<^bsub>\<alpha>\<^esub> \<BB>

goal (1 subgoal):
 1. \<D>\<^sub>\<circ> (cf_cn_cov_bcomp \<SS> \<FF> (dghm_id \<CC>)\<lparr>ObjMap\<rparr>) = (op_cat \<AA> \<times>\<^sub>C \<CC>)\<lparr>Obj\<rparr>
[PROOF STEP]
by (cs_concl cs_simp: cat_cs_simps cs_intro: cat_cs_intros)


[STATEMENT]
lemma scalar_product_assoc:
  "scalar_product (A *v s) (r :: ('a qr, 'k) vec ) =
   scalar_product s (r v* A)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. scalar_product (A *v s) r = scalar_product s (r v* A)
[PROOF STEP]
unfolding scalar_product_def matrix_vector_mult_def
  vector_matrix_mult_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Sum>i\<in>UNIV. (\<chi>i. \<Sum>j\<in>UNIV. A $ i $ j * s $ j) $ i * r $ i) = (\<Sum>i\<in>UNIV. s $ i * (\<chi>j. \<Sum>i\<in>UNIV. A $ i $ j * r $ i) $ i)
[PROOF STEP]
proof auto
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (\<Sum>i\<in>UNIV. (\<Sum>j\<in>UNIV. A $ i $ j * s $ j) * r $ i) = (\<Sum>i\<in>UNIV. s $ i * (\<Sum>ia\<in>UNIV. A $ ia $ i * r $ ia))
[PROOF STEP]
have "(\<Sum>i\<in>UNIV. (\<Sum>j\<in>UNIV. (vec_nth (vec_nth A i) j) *
      (vec_nth s j)) * (vec_nth r i)) =
    (\<Sum>i\<in>UNIV. (\<Sum>j\<in>UNIV. (vec_nth (vec_nth A i) j) *
      (vec_nth s j) * (vec_nth r i)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Sum>i\<in>UNIV. (\<Sum>j\<in>UNIV. A $ i $ j * s $ j) * r $ i) = (\<Sum>i\<in>UNIV. \<Sum>j\<in>UNIV. A $ i $ j * s $ j * r $ i)
[PROOF STEP]
by (simp add: sum_distrib_right)
[PROOF STATE]
proof (state)
this:
(\<Sum>i\<in>UNIV. (\<Sum>j\<in>UNIV. A $ i $ j * s $ j) * r $ i) = (\<Sum>i\<in>UNIV. \<Sum>j\<in>UNIV. A $ i $ j * s $ j * r $ i)

goal (1 subgoal):
 1. (\<Sum>i\<in>UNIV. (\<Sum>j\<in>UNIV. A $ i $ j * s $ j) * r $ i) = (\<Sum>i\<in>UNIV. s $ i * (\<Sum>ia\<in>UNIV. A $ ia $ i * r $ ia))
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(\<Sum>i\<in>UNIV. (\<Sum>j\<in>UNIV. A $ i $ j * s $ j) * r $ i) = (\<Sum>i\<in>UNIV. \<Sum>j\<in>UNIV. A $ i $ j * s $ j * r $ i)

goal (1 subgoal):
 1. (\<Sum>i\<in>UNIV. (\<Sum>j\<in>UNIV. A $ i $ j * s $ j) * r $ i) = (\<Sum>i\<in>UNIV. s $ i * (\<Sum>ia\<in>UNIV. A $ ia $ i * r $ ia))
[PROOF STEP]
have "\<dots> = (\<Sum>j\<in>UNIV. (\<Sum>i\<in>UNIV. (vec_nth (vec_nth A i) j) *
    (vec_nth s j) * (vec_nth r i)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Sum>i\<in>UNIV. \<Sum>j\<in>UNIV. A $ i $ j * s $ j * r $ i) = (\<Sum>j\<in>UNIV. \<Sum>i\<in>UNIV. A $ i $ j * s $ j * r $ i)
[PROOF STEP]
using sum.swap
[PROOF STATE]
proof (prove)
using this:
(\<Sum>i\<in>?A. sum (?g i) ?B) = (\<Sum>j\<in>?B. \<Sum>i\<in>?A. ?g i j)

goal (1 subgoal):
 1. (\<Sum>i\<in>UNIV. \<Sum>j\<in>UNIV. A $ i $ j * s $ j * r $ i) = (\<Sum>j\<in>UNIV. \<Sum>i\<in>UNIV. A $ i $ j * s $ j * r $ i)
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
(\<Sum>i\<in>UNIV. \<Sum>j\<in>UNIV. A $ i $ j * s $ j * r $ i) = (\<Sum>j\<in>UNIV. \<Sum>i\<in>UNIV. A $ i $ j * s $ j * r $ i)

goal (1 subgoal):
 1. (\<Sum>i\<in>UNIV. (\<Sum>j\<in>UNIV. A $ i $ j * s $ j) * r $ i) = (\<Sum>i\<in>UNIV. s $ i * (\<Sum>ia\<in>UNIV. A $ ia $ i * r $ ia))
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(\<Sum>i\<in>UNIV. \<Sum>j\<in>UNIV. A $ i $ j * s $ j * r $ i) = (\<Sum>j\<in>UNIV. \<Sum>i\<in>UNIV. A $ i $ j * s $ j * r $ i)

goal (1 subgoal):
 1. (\<Sum>i\<in>UNIV. (\<Sum>j\<in>UNIV. A $ i $ j * s $ j) * r $ i) = (\<Sum>i\<in>UNIV. s $ i * (\<Sum>ia\<in>UNIV. A $ ia $ i * r $ ia))
[PROOF STEP]
have "\<dots> = (\<Sum>j\<in>UNIV. (\<Sum>i\<in>UNIV. (vec_nth s j) *
    (vec_nth (vec_nth A i) j) * (vec_nth r i)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Sum>j\<in>UNIV. \<Sum>i\<in>UNIV. A $ i $ j * s $ j * r $ i) = (\<Sum>j\<in>UNIV. \<Sum>i\<in>UNIV. s $ j * A $ i $ j * r $ i)
[PROOF STEP]
by (metis (no_types, lifting) mult_commute_abs sum.cong)
[PROOF STATE]
proof (state)
this:
(\<Sum>j\<in>UNIV. \<Sum>i\<in>UNIV. A $ i $ j * s $ j * r $ i) = (\<Sum>j\<in>UNIV. \<Sum>i\<in>UNIV. s $ j * A $ i $ j * r $ i)

goal (1 subgoal):
 1. (\<Sum>i\<in>UNIV. (\<Sum>j\<in>UNIV. A $ i $ j * s $ j) * r $ i) = (\<Sum>i\<in>UNIV. s $ i * (\<Sum>ia\<in>UNIV. A $ ia $ i * r $ ia))
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(\<Sum>j\<in>UNIV. \<Sum>i\<in>UNIV. A $ i $ j * s $ j * r $ i) = (\<Sum>j\<in>UNIV. \<Sum>i\<in>UNIV. s $ j * A $ i $ j * r $ i)

goal (1 subgoal):
 1. (\<Sum>i\<in>UNIV. (\<Sum>j\<in>UNIV. A $ i $ j * s $ j) * r $ i) = (\<Sum>i\<in>UNIV. s $ i * (\<Sum>ia\<in>UNIV. A $ ia $ i * r $ ia))
[PROOF STEP]
have "\<dots> = (\<Sum>j\<in>UNIV. (vec_nth s j) *
    (\<Sum>i\<in>UNIV. (vec_nth (vec_nth A i) j) * (vec_nth r i)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Sum>j\<in>UNIV. \<Sum>i\<in>UNIV. s $ j * A $ i $ j * r $ i) = (\<Sum>j\<in>UNIV. s $ j * (\<Sum>i\<in>UNIV. A $ i $ j * r $ i))
[PROOF STEP]
by (metis (no_types, lifting) mult.assoc sum.cong sum_distrib_left)
[PROOF STATE]
proof (state)
this:
(\<Sum>j\<in>UNIV. \<Sum>i\<in>UNIV. s $ j * A $ i $ j * r $ i) = (\<Sum>j\<in>UNIV. s $ j * (\<Sum>i\<in>UNIV. A $ i $ j * r $ i))

goal (1 subgoal):
 1. (\<Sum>i\<in>UNIV. (\<Sum>j\<in>UNIV. A $ i $ j * s $ j) * r $ i) = (\<Sum>i\<in>UNIV. s $ i * (\<Sum>ia\<in>UNIV. A $ ia $ i * r $ ia))
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
(\<Sum>i\<in>UNIV. (\<Sum>j\<in>UNIV. A $ i $ j * s $ j) * r $ i) = (\<Sum>j\<in>UNIV. s $ j * (\<Sum>i\<in>UNIV. A $ i $ j * r $ i))
[PROOF STEP]
show "(\<Sum>i\<in>UNIV. (\<Sum>j\<in>UNIV. (vec_nth (vec_nth A i) j) *
    (vec_nth s j)) * (vec_nth r i)) = (\<Sum>j\<in>UNIV. (vec_nth s j) *
    (\<Sum>i\<in>UNIV. (vec_nth (vec_nth A i) j) * (vec_nth r i)))"
[PROOF STATE]
proof (prove)
using this:
(\<Sum>i\<in>UNIV. (\<Sum>j\<in>UNIV. A $ i $ j * s $ j) * r $ i) = (\<Sum>j\<in>UNIV. s $ j * (\<Sum>i\<in>UNIV. A $ i $ j * r $ i))

goal (1 subgoal):
 1. (\<Sum>i\<in>UNIV. (\<Sum>j\<in>UNIV. A $ i $ j * s $ j) * r $ i) = (\<Sum>j\<in>UNIV. s $ j * (\<Sum>i\<in>UNIV. A $ i $ j * r $ i))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(\<Sum>i\<in>UNIV. (\<Sum>j\<in>UNIV. A $ i $ j * s $ j) * r $ i) = (\<Sum>j\<in>UNIV. s $ j * (\<Sum>i\<in>UNIV. A $ i $ j * r $ i))

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma scaleR_conv_octo_of_real: "scaleR r x = octo_of_real r * x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. r *\<^sub>R x = octo_of_real r * x
[PROOF STEP]
by (simp add: octo_eq_iff octo_mult_components octo_of_real_def)


[STATEMENT]
theorem P1_secure:
  assumes "x < q n" "y < q n"
  shows "sim_non_det_def.perfect_sec_P1 n x y"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. local.sim_non_det_def.perfect_sec_P1 n x y
[PROOF STEP]
by (metis P1_security assms)


[STATEMENT]
lemma max_reg_list_cons:
  "max_reg_list (a # G) = max (max_reg a) (max_reg_list G)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. max_reg_list (a # G) = max (GExp.max_reg a) (max_reg_list G)
[PROOF STEP]
apply (simp add: max_reg_list_def flip: Max.set_eq_fold)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Max (insert (GExp.max_reg a) (GExp.max_reg ` set G)) = max (GExp.max_reg a) (Max (insert None (GExp.max_reg ` set G)))
[PROOF STEP]
apply (metis List.finite_set Max_insert bot_option_def empty_not_insert finite_imageI finite_insert insert_commute max.commute max_bot2)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma subterms_subst_subterm:
  fixes \<theta>::"('a,'b) subst"
  assumes "\<forall>x \<in> fv a. (\<exists>f. \<theta> x = Fun f []) \<or> (\<exists>y. \<theta> x = Var y)"
    and "b \<in> subterms (a \<cdot> \<theta>)"
  shows "\<exists>c \<in> subterms a. c \<cdot> \<theta> = b"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>c\<in>subterms a. c \<cdot> \<theta> = b
[PROOF STEP]
using subterms_subst'[OF assms(1)] assms(2)
[PROOF STATE]
proof (prove)
using this:
subterms (a \<cdot> \<theta>) = subterms a \<cdot>\<^sub>s\<^sub>e\<^sub>t \<theta>
b \<sqsubseteq> a \<cdot> \<theta>

goal (1 subgoal):
 1. \<exists>c\<in>subterms a. c \<cdot> \<theta> = b
[PROOF STEP]
by auto


[STATEMENT]
lemma exists_small_list_elem7[simp]:
  "\<lbrakk>m \<noteq> n; p < length lm; lm ! p = 0; m < p; n < p; x < lm ! m\<rbrakk>
  \<Longrightarrow> \<exists>xa\<le>lm ! m. lm[m := Suc x, n := lm ! n + lm ! m,
                             p := lm ! m - Suc x]
               = lm[m := xa, n := lm ! n + lm ! m, p := lm ! m - xa]"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>m \<noteq> n; p < length lm; lm ! p = 0; m < p; n < p; x < lm ! m\<rbrakk> \<Longrightarrow> \<exists>xa\<le>lm ! m. lm[m := Suc x, n := lm ! n + lm ! m, p := lm ! m - Suc x] = lm[m := xa, n := lm ! n + lm ! m, p := lm ! m - xa]
[PROOF STEP]
apply(rule_tac x = "Suc x" in exI, simp)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma cnf_invert_singelton: "cnf_to_bool \<gamma> [invert a] \<longleftrightarrow> \<not> cnf_to_bool \<gamma> [a]"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. cnf_to_bool \<gamma> [invert a] = (\<not> cnf_to_bool \<gamma> [a])
[PROOF STEP]
by(cases a, simp_all)


[STATEMENT]
lemma four_block_mat_mult_vec:
  assumes A: "A : carrier_mat nr1 nc1"
      and B: "B : carrier_mat nr1 nc2"
      and C: "C : carrier_mat nr2 nc1"
      and D: "D : carrier_mat nr2 nc2"
      and a: "a : carrier_vec nc1"
      and d: "d : carrier_vec nc2"
  shows "four_block_mat A B C D *\<^sub>v (a @\<^sub>v d) = (A *\<^sub>v a + B *\<^sub>v d) @\<^sub>v (C *\<^sub>v a + D *\<^sub>v d)"
    (is "?ABCD *\<^sub>v _ = ?r")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. four_block_mat A B C D *\<^sub>v (a @\<^sub>v d) = (A *\<^sub>v a + B *\<^sub>v d) @\<^sub>v C *\<^sub>v a + D *\<^sub>v d
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>i. i < dim_vec ((A *\<^sub>v a + B *\<^sub>v d) @\<^sub>v C *\<^sub>v a + D *\<^sub>v d) \<Longrightarrow> (four_block_mat A B C D *\<^sub>v (a @\<^sub>v d)) $ i = ((A *\<^sub>v a + B *\<^sub>v d) @\<^sub>v C *\<^sub>v a + D *\<^sub>v d) $ i
 2. dim_vec (four_block_mat A B C D *\<^sub>v (a @\<^sub>v d)) = dim_vec ((A *\<^sub>v a + B *\<^sub>v d) @\<^sub>v C *\<^sub>v a + D *\<^sub>v d)
[PROOF STEP]
have ABCD: "?ABCD : carrier_mat (nr1+nr2) (nc1+nc2)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. four_block_mat A B C D \<in> carrier_mat (nr1 + nr2) (nc1 + nc2)
[PROOF STEP]
using four_block_carrier_mat[OF A D]
[PROOF STATE]
proof (prove)
using this:
four_block_mat A ?B ?C D \<in> carrier_mat (nr1 + nr2) (nc1 + nc2)

goal (1 subgoal):
 1. four_block_mat A B C D \<in> carrier_mat (nr1 + nr2) (nc1 + nc2)
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
four_block_mat A B C D \<in> carrier_mat (nr1 + nr2) (nc1 + nc2)

goal (2 subgoals):
 1. \<And>i. i < dim_vec ((A *\<^sub>v a + B *\<^sub>v d) @\<^sub>v C *\<^sub>v a + D *\<^sub>v d) \<Longrightarrow> (four_block_mat A B C D *\<^sub>v (a @\<^sub>v d)) $ i = ((A *\<^sub>v a + B *\<^sub>v d) @\<^sub>v C *\<^sub>v a + D *\<^sub>v d) $ i
 2. dim_vec (four_block_mat A B C D *\<^sub>v (a @\<^sub>v d)) = dim_vec ((A *\<^sub>v a + B *\<^sub>v d) @\<^sub>v C *\<^sub>v a + D *\<^sub>v d)
[PROOF STEP]
fix i
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>i. i < dim_vec ((A *\<^sub>v a + B *\<^sub>v d) @\<^sub>v C *\<^sub>v a + D *\<^sub>v d) \<Longrightarrow> (four_block_mat A B C D *\<^sub>v (a @\<^sub>v d)) $ i = ((A *\<^sub>v a + B *\<^sub>v d) @\<^sub>v C *\<^sub>v a + D *\<^sub>v d) $ i
 2. dim_vec (four_block_mat A B C D *\<^sub>v (a @\<^sub>v d)) = dim_vec ((A *\<^sub>v a + B *\<^sub>v d) @\<^sub>v C *\<^sub>v a + D *\<^sub>v d)
[PROOF STEP]
assume i: "i < dim_vec ?r"
[PROOF STATE]
proof (state)
this:
i < dim_vec ((A *\<^sub>v a + B *\<^sub>v d) @\<^sub>v C *\<^sub>v a + D *\<^sub>v d)

goal (2 subgoals):
 1. \<And>i. i < dim_vec ((A *\<^sub>v a + B *\<^sub>v d) @\<^sub>v C *\<^sub>v a + D *\<^sub>v d) \<Longrightarrow> (four_block_mat A B C D *\<^sub>v (a @\<^sub>v d)) $ i = ((A *\<^sub>v a + B *\<^sub>v d) @\<^sub>v C *\<^sub>v a + D *\<^sub>v d) $ i
 2. dim_vec (four_block_mat A B C D *\<^sub>v (a @\<^sub>v d)) = dim_vec ((A *\<^sub>v a + B *\<^sub>v d) @\<^sub>v C *\<^sub>v a + D *\<^sub>v d)
[PROOF STEP]
show "(?ABCD *\<^sub>v (a @\<^sub>v d)) $ i = ?r $ i" (is "?li = _")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (four_block_mat A B C D *\<^sub>v (a @\<^sub>v d)) $ i = ((A *\<^sub>v a + B *\<^sub>v d) @\<^sub>v C *\<^sub>v a + D *\<^sub>v d) $ i
[PROOF STEP]
proof (cases "i < nr1")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. i < nr1 \<Longrightarrow> (four_block_mat A B C D *\<^sub>v (a @\<^sub>v d)) $ i = ((A *\<^sub>v a + B *\<^sub>v d) @\<^sub>v C *\<^sub>v a + D *\<^sub>v d) $ i
 2. \<not> i < nr1 \<Longrightarrow> (four_block_mat A B C D *\<^sub>v (a @\<^sub>v d)) $ i = ((A *\<^sub>v a + B *\<^sub>v d) @\<^sub>v C *\<^sub>v a + D *\<^sub>v d) $ i
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
i < nr1

goal (2 subgoals):
 1. i < nr1 \<Longrightarrow> (four_block_mat A B C D *\<^sub>v (a @\<^sub>v d)) $ i = ((A *\<^sub>v a + B *\<^sub>v d) @\<^sub>v C *\<^sub>v a + D *\<^sub>v d) $ i
 2. \<not> i < nr1 \<Longrightarrow> (four_block_mat A B C D *\<^sub>v (a @\<^sub>v d)) $ i = ((A *\<^sub>v a + B *\<^sub>v d) @\<^sub>v C *\<^sub>v a + D *\<^sub>v d) $ i
[PROOF STEP]
have "?li = (row A i @\<^sub>v row B i) \<bullet> (a @\<^sub>v d)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (four_block_mat A B C D *\<^sub>v (a @\<^sub>v d)) $ i = (row A i @\<^sub>v row B i) \<bullet> (a @\<^sub>v d)
[PROOF STEP]
using A row_four_block_mat[OF A B C D] True
[PROOF STATE]
proof (prove)
using this:
A \<in> carrier_mat nr1 nc1
?i < nr1 \<Longrightarrow> row (four_block_mat A B C D) ?i = row A ?i @\<^sub>v row B ?i
\<lbrakk>\<not> ?i < nr1; ?i < nr1 + nr2\<rbrakk> \<Longrightarrow> row (four_block_mat A B C D) ?i = row C (?i - nr1) @\<^sub>v row D (?i - nr1)
i < nr1

goal (1 subgoal):
 1. (four_block_mat A B C D *\<^sub>v (a @\<^sub>v d)) $ i = (row A i @\<^sub>v row B i) \<bullet> (a @\<^sub>v d)
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
(four_block_mat A B C D *\<^sub>v (a @\<^sub>v d)) $ i = (row A i @\<^sub>v row B i) \<bullet> (a @\<^sub>v d)

goal (2 subgoals):
 1. i < nr1 \<Longrightarrow> (four_block_mat A B C D *\<^sub>v (a @\<^sub>v d)) $ i = ((A *\<^sub>v a + B *\<^sub>v d) @\<^sub>v C *\<^sub>v a + D *\<^sub>v d) $ i
 2. \<not> i < nr1 \<Longrightarrow> (four_block_mat A B C D *\<^sub>v (a @\<^sub>v d)) $ i = ((A *\<^sub>v a + B *\<^sub>v d) @\<^sub>v C *\<^sub>v a + D *\<^sub>v d) $ i
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(four_block_mat A B C D *\<^sub>v (a @\<^sub>v d)) $ i = (row A i @\<^sub>v row B i) \<bullet> (a @\<^sub>v d)

goal (2 subgoals):
 1. i < nr1 \<Longrightarrow> (four_block_mat A B C D *\<^sub>v (a @\<^sub>v d)) $ i = ((A *\<^sub>v a + B *\<^sub>v d) @\<^sub>v C *\<^sub>v a + D *\<^sub>v d) $ i
 2. \<not> i < nr1 \<Longrightarrow> (four_block_mat A B C D *\<^sub>v (a @\<^sub>v d)) $ i = ((A *\<^sub>v a + B *\<^sub>v d) @\<^sub>v C *\<^sub>v a + D *\<^sub>v d) $ i
[PROOF STEP]
have "... = row A i \<bullet> a + row B i \<bullet> d"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (row A i @\<^sub>v row B i) \<bullet> (a @\<^sub>v d) = row A i \<bullet> a + row B i \<bullet> d
[PROOF STEP]
apply (rule scalar_prod_append)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. row A i \<in> carrier_vec ?n1.0
 2. row B i \<in> carrier_vec ?n2.0
 3. a \<in> carrier_vec ?n1.0
 4. d \<in> carrier_vec ?n2.0
[PROOF STEP]
using A B D a d True
[PROOF STATE]
proof (prove)
using this:
A \<in> carrier_mat nr1 nc1
B \<in> carrier_mat nr1 nc2
D \<in> carrier_mat nr2 nc2
a \<in> carrier_vec nc1
d \<in> carrier_vec nc2
i < nr1

goal (4 subgoals):
 1. row A i \<in> carrier_vec ?n1.0
 2. row B i \<in> carrier_vec ?n2.0
 3. a \<in> carrier_vec ?n1.0
 4. d \<in> carrier_vec ?n2.0
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(row A i @\<^sub>v row B i) \<bullet> (a @\<^sub>v d) = row A i \<bullet> a + row B i \<bullet> d

goal (2 subgoals):
 1. i < nr1 \<Longrightarrow> (four_block_mat A B C D *\<^sub>v (a @\<^sub>v d)) $ i = ((A *\<^sub>v a + B *\<^sub>v d) @\<^sub>v C *\<^sub>v a + D *\<^sub>v d) $ i
 2. \<not> i < nr1 \<Longrightarrow> (four_block_mat A B C D *\<^sub>v (a @\<^sub>v d)) $ i = ((A *\<^sub>v a + B *\<^sub>v d) @\<^sub>v C *\<^sub>v a + D *\<^sub>v d) $ i
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
(four_block_mat A B C D *\<^sub>v (a @\<^sub>v d)) $ i = row A i \<bullet> a + row B i \<bullet> d
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
(four_block_mat A B C D *\<^sub>v (a @\<^sub>v d)) $ i = row A i \<bullet> a + row B i \<bullet> d

goal (1 subgoal):
 1. (four_block_mat A B C D *\<^sub>v (a @\<^sub>v d)) $ i = ((A *\<^sub>v a + B *\<^sub>v d) @\<^sub>v C *\<^sub>v a + D *\<^sub>v d) $ i
[PROOF STEP]
using A B True
[PROOF STATE]
proof (prove)
using this:
(four_block_mat A B C D *\<^sub>v (a @\<^sub>v d)) $ i = row A i \<bullet> a + row B i \<bullet> d
A \<in> carrier_mat nr1 nc1
B \<in> carrier_mat nr1 nc2
i < nr1

goal (1 subgoal):
 1. (four_block_mat A B C D *\<^sub>v (a @\<^sub>v d)) $ i = ((A *\<^sub>v a + B *\<^sub>v d) @\<^sub>v C *\<^sub>v a + D *\<^sub>v d) $ i
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(four_block_mat A B C D *\<^sub>v (a @\<^sub>v d)) $ i = ((A *\<^sub>v a + B *\<^sub>v d) @\<^sub>v C *\<^sub>v a + D *\<^sub>v d) $ i

goal (1 subgoal):
 1. \<not> i < nr1 \<Longrightarrow> (four_block_mat A B C D *\<^sub>v (a @\<^sub>v d)) $ i = ((A *\<^sub>v a + B *\<^sub>v d) @\<^sub>v C *\<^sub>v a + D *\<^sub>v d) $ i
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> i < nr1 \<Longrightarrow> (four_block_mat A B C D *\<^sub>v (a @\<^sub>v d)) $ i = ((A *\<^sub>v a + B *\<^sub>v d) @\<^sub>v C *\<^sub>v a + D *\<^sub>v d) $ i
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
\<not> i < nr1

goal (1 subgoal):
 1. \<not> i < nr1 \<Longrightarrow> (four_block_mat A B C D *\<^sub>v (a @\<^sub>v d)) $ i = ((A *\<^sub>v a + B *\<^sub>v d) @\<^sub>v C *\<^sub>v a + D *\<^sub>v d) $ i
[PROOF STEP]
let ?i = "i - nr1"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> i < nr1 \<Longrightarrow> (four_block_mat A B C D *\<^sub>v (a @\<^sub>v d)) $ i = ((A *\<^sub>v a + B *\<^sub>v d) @\<^sub>v C *\<^sub>v a + D *\<^sub>v d) $ i
[PROOF STEP]
have "?li = (row C ?i @\<^sub>v row D ?i) \<bullet> (a @\<^sub>v d)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (four_block_mat A B C D *\<^sub>v (a @\<^sub>v d)) $ i = (row C (i - nr1) @\<^sub>v row D (i - nr1)) \<bullet> (a @\<^sub>v d)
[PROOF STEP]
using i row_four_block_mat[OF A B C D] False A B C D
[PROOF STATE]
proof (prove)
using this:
i < dim_vec ((A *\<^sub>v a + B *\<^sub>v d) @\<^sub>v C *\<^sub>v a + D *\<^sub>v d)
?i < nr1 \<Longrightarrow> row (four_block_mat A B C D) ?i = row A ?i @\<^sub>v row B ?i
\<lbrakk>\<not> ?i < nr1; ?i < nr1 + nr2\<rbrakk> \<Longrightarrow> row (four_block_mat A B C D) ?i = row C (?i - nr1) @\<^sub>v row D (?i - nr1)
\<not> i < nr1
A \<in> carrier_mat nr1 nc1
B \<in> carrier_mat nr1 nc2
C \<in> carrier_mat nr2 nc1
D \<in> carrier_mat nr2 nc2

goal (1 subgoal):
 1. (four_block_mat A B C D *\<^sub>v (a @\<^sub>v d)) $ i = (row C (i - nr1) @\<^sub>v row D (i - nr1)) \<bullet> (a @\<^sub>v d)
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
(four_block_mat A B C D *\<^sub>v (a @\<^sub>v d)) $ i = (row C (i - nr1) @\<^sub>v row D (i - nr1)) \<bullet> (a @\<^sub>v d)

goal (1 subgoal):
 1. \<not> i < nr1 \<Longrightarrow> (four_block_mat A B C D *\<^sub>v (a @\<^sub>v d)) $ i = ((A *\<^sub>v a + B *\<^sub>v d) @\<^sub>v C *\<^sub>v a + D *\<^sub>v d) $ i
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(four_block_mat A B C D *\<^sub>v (a @\<^sub>v d)) $ i = (row C (i - nr1) @\<^sub>v row D (i - nr1)) \<bullet> (a @\<^sub>v d)

goal (1 subgoal):
 1. \<not> i < nr1 \<Longrightarrow> (four_block_mat A B C D *\<^sub>v (a @\<^sub>v d)) $ i = ((A *\<^sub>v a + B *\<^sub>v d) @\<^sub>v C *\<^sub>v a + D *\<^sub>v d) $ i
[PROOF STEP]
have "... = row C ?i \<bullet> a + row D ?i \<bullet> d"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (row C (i - nr1) @\<^sub>v row D (i - nr1)) \<bullet> (a @\<^sub>v d) = row C (i - nr1) \<bullet> a + row D (i - nr1) \<bullet> d
[PROOF STEP]
apply (rule scalar_prod_append)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. row C (i - nr1) \<in> carrier_vec ?n1.0
 2. row D (i - nr1) \<in> carrier_vec ?n2.0
 3. a \<in> carrier_vec ?n1.0
 4. d \<in> carrier_vec ?n2.0
[PROOF STEP]
using A B C D a d False
[PROOF STATE]
proof (prove)
using this:
A \<in> carrier_mat nr1 nc1
B \<in> carrier_mat nr1 nc2
C \<in> carrier_mat nr2 nc1
D \<in> carrier_mat nr2 nc2
a \<in> carrier_vec nc1
d \<in> carrier_vec nc2
\<not> i < nr1

goal (4 subgoals):
 1. row C (i - nr1) \<in> carrier_vec ?n1.0
 2. row D (i - nr1) \<in> carrier_vec ?n2.0
 3. a \<in> carrier_vec ?n1.0
 4. d \<in> carrier_vec ?n2.0
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(row C (i - nr1) @\<^sub>v row D (i - nr1)) \<bullet> (a @\<^sub>v d) = row C (i - nr1) \<bullet> a + row D (i - nr1) \<bullet> d

goal (1 subgoal):
 1. \<not> i < nr1 \<Longrightarrow> (four_block_mat A B C D *\<^sub>v (a @\<^sub>v d)) $ i = ((A *\<^sub>v a + B *\<^sub>v d) @\<^sub>v C *\<^sub>v a + D *\<^sub>v d) $ i
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
(four_block_mat A B C D *\<^sub>v (a @\<^sub>v d)) $ i = row C (i - nr1) \<bullet> a + row D (i - nr1) \<bullet> d
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
(four_block_mat A B C D *\<^sub>v (a @\<^sub>v d)) $ i = row C (i - nr1) \<bullet> a + row D (i - nr1) \<bullet> d

goal (1 subgoal):
 1. (four_block_mat A B C D *\<^sub>v (a @\<^sub>v d)) $ i = ((A *\<^sub>v a + B *\<^sub>v d) @\<^sub>v C *\<^sub>v a + D *\<^sub>v d) $ i
[PROOF STEP]
using A B C D False i
[PROOF STATE]
proof (prove)
using this:
(four_block_mat A B C D *\<^sub>v (a @\<^sub>v d)) $ i = row C (i - nr1) \<bullet> a + row D (i - nr1) \<bullet> d
A \<in> carrier_mat nr1 nc1
B \<in> carrier_mat nr1 nc2
C \<in> carrier_mat nr2 nc1
D \<in> carrier_mat nr2 nc2
\<not> i < nr1
i < dim_vec ((A *\<^sub>v a + B *\<^sub>v d) @\<^sub>v C *\<^sub>v a + D *\<^sub>v d)

goal (1 subgoal):
 1. (four_block_mat A B C D *\<^sub>v (a @\<^sub>v d)) $ i = ((A *\<^sub>v a + B *\<^sub>v d) @\<^sub>v C *\<^sub>v a + D *\<^sub>v d) $ i
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(four_block_mat A B C D *\<^sub>v (a @\<^sub>v d)) $ i = ((A *\<^sub>v a + B *\<^sub>v d) @\<^sub>v C *\<^sub>v a + D *\<^sub>v d) $ i

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
(four_block_mat A B C D *\<^sub>v (a @\<^sub>v d)) $ i = ((A *\<^sub>v a + B *\<^sub>v d) @\<^sub>v C *\<^sub>v a + D *\<^sub>v d) $ i

goal (1 subgoal):
 1. dim_vec (four_block_mat A B C D *\<^sub>v (a @\<^sub>v d)) = dim_vec ((A *\<^sub>v a + B *\<^sub>v d) @\<^sub>v C *\<^sub>v a + D *\<^sub>v d)
[PROOF STEP]
qed (insert A B, auto)


[STATEMENT]
lemma FVF_finite: "finite(FVF e)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. finite (FVF e)
[PROOF STEP]
using allvars_finite
[PROOF STATE]
proof (prove)
using this:
finite Denotational_Semantics.allvars

goal (1 subgoal):
 1. finite (FVF e)
[PROOF STEP]
by (metis finite_subset mem_Collect_eq subsetI)


[STATEMENT]
lemma bin_morph_lcp_short: "\<^bold>|\<alpha>\<^bold>| < \<^bold>|f [a]\<^bold>| + \<^bold>|f[1-a]\<^bold>|"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<^bold>|\<alpha>\<^bold>| < \<^bold>|f [a]\<^bold>| + \<^bold>|f [1 - a]\<^bold>|
[PROOF STEP]
using finite_2.exhaust[of a ?thesis] bin_lcp_short
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>a = bin0 \<Longrightarrow> \<^bold>|\<alpha>\<^bold>| < \<^bold>|f [a]\<^bold>| + \<^bold>|f [1 - a]\<^bold>|; a = bin1 \<Longrightarrow> \<^bold>|\<alpha>\<^bold>| < \<^bold>|f [a]\<^bold>| + \<^bold>|f [1 - a]\<^bold>|\<rbrakk> \<Longrightarrow> \<^bold>|\<alpha>\<^bold>| < \<^bold>|f [a]\<^bold>| + \<^bold>|f [1 - a]\<^bold>|
\<^bold>|\<alpha>\<^bold>| < \<^bold>|f \<zero>\<^bold>| + \<^bold>|f \<one>\<^bold>|

goal (1 subgoal):
 1. \<^bold>|\<alpha>\<^bold>| < \<^bold>|f [a]\<^bold>| + \<^bold>|f [1 - a]\<^bold>|
[PROOF STEP]
by force


[STATEMENT]
lemma vdomain_iff: "a \<in>\<^sub>\<circ> \<D>\<^sub>\<circ> r \<longleftrightarrow> (\<exists>y. \<langle>a, y\<rangle> \<in>\<^sub>\<circ> r)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (a \<in>\<^sub>\<circ> \<D>\<^sub>\<circ> r) = (\<exists>y. \<langle>a, y\<rangle> \<in>\<^sub>\<circ> r)
[PROOF STEP]
by auto


[STATEMENT]
lemma ntcf_vcomp_is_cat_cone[cat_cs_intros]:
  assumes "\<MM> : \<GG> \<mapsto>\<^sub>C\<^sub>F \<HH> : \<AA> \<mapsto>\<mapsto>\<^sub>C\<^bsub>\<alpha>\<^esub> \<BB>"
    and "\<NN> : a <\<^sub>C\<^sub>F\<^sub>.\<^sub>c\<^sub>o\<^sub>n\<^sub>e \<GG> : \<AA> \<mapsto>\<mapsto>\<^sub>C\<^bsub>\<alpha>\<^esub> \<BB>"
  shows "\<MM> \<bullet>\<^sub>N\<^sub>T\<^sub>C\<^sub>F \<NN> : a <\<^sub>C\<^sub>F\<^sub>.\<^sub>c\<^sub>o\<^sub>n\<^sub>e \<HH> : \<AA> \<mapsto>\<mapsto>\<^sub>C\<^bsub>\<alpha>\<^esub> \<BB>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<MM> \<bullet>\<^sub>N\<^sub>T\<^sub>S\<^sub>M\<^sub>C\<^sub>F \<NN> : a <\<^sub>C\<^sub>F\<^sub>.\<^sub>c\<^sub>o\<^sub>n\<^sub>e \<HH> : \<AA> \<mapsto>\<mapsto>\<^sub>C\<^bsub>\<alpha>\<^esub> \<BB>
[PROOF STEP]
by
    (
      intro is_cat_coneI ntcf_vcomp_is_ntcf, rule assms(1);
      rule is_cat_coneD[OF assms(2)]
    )


[STATEMENT]
lemma "rec_nat zero suc 0 = zero"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. rec_nat zero suc 0 = zero
[PROOF STEP]
refute [expect = none]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. rec_nat zero suc 0 = zero
[PROOF STEP]
by simp


[STATEMENT]
lemma less_add1: "(0::nat) < j \<Longrightarrow> i < i + j"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 < j \<Longrightarrow> i < i + j
[PROOF STEP]
by simp


[STATEMENT]
lemma DirProd_assoc_iso_set:
  shows "(\<lambda>(x,y,z). (x,(y,z))) \<in> iso (G \<times>\<times> H \<times>\<times> I) (G \<times>\<times> (H \<times>\<times> I))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lambda>(x, y, z). (x, y, z)) \<in> Group.iso (G \<times>\<times> H \<times>\<times> I) (G \<times>\<times> H \<times>\<times> I)
[PROOF STEP]
by (auto simp add: iso_def hom_def inj_on_def bij_betw_def)


[STATEMENT]
lemma equiv_PL:\<open>A \<turnstile> p .\<longleftrightarrow>. q \<longleftrightarrow> (A \<union> {p} \<turnstile> q \<and> A \<union> {q} \<turnstile> p)\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (A \<turnstile> p .\<longleftrightarrow>. q) = (A \<union> {p} \<turnstile> q \<and> A \<union> {q} \<turnstile> p)
[PROOF STEP]
using imp_PL equivE1_PL equivE2_PL equivI_PL
[PROOF STATE]
proof (prove)
using this:
(?A \<turnstile> ?p .\<longrightarrow>. ?q) = (?A \<union> {?p} \<turnstile> ?q)
?A \<turnstile> ?p .\<longleftrightarrow>. ?q \<Longrightarrow> ?A \<turnstile> ?p .\<longrightarrow>. ?q
?A \<turnstile> ?p .\<longleftrightarrow>. ?q \<Longrightarrow> ?A \<turnstile> ?q .\<longrightarrow>. ?p
\<lbrakk>?A \<turnstile> ?p .\<longrightarrow>. ?q; ?A \<turnstile> ?q .\<longrightarrow>. ?p\<rbrakk> \<Longrightarrow> ?A \<turnstile> ?p .\<longleftrightarrow>. ?q

goal (1 subgoal):
 1. (A \<turnstile> p .\<longleftrightarrow>. q) = (A \<union> {p} \<turnstile> q \<and> A \<union> {q} \<turnstile> p)
[PROOF STEP]
by blast


[STATEMENT]
lemma geometric_series_closed:
  assumes "a \<in> carrier R"
  assumes "b \<in> carrier R"
  shows "(geometric_series n a b) \<in> carrier R"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. geometric_series n a b \<in> carrier R
[PROOF STEP]
unfolding geometric_series_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. to_fun (UP_root_div (monom P \<one> (Suc n) \<ominus>\<^bsub>UP R\<^esub> monom P (b [^] Suc n) 0) b) a \<in> carrier R
[PROOF STEP]
using assms  P.minus_closed P_def UP_root_div_closed to_fun_closed monom_closed
[PROOF STATE]
proof (prove)
using this:
a \<in> carrier R
b \<in> carrier R
\<lbrakk>?x \<in> carrier P; ?y \<in> carrier P\<rbrakk> \<Longrightarrow> ?x \<ominus>\<^bsub>P\<^esub> ?y \<in> carrier P
P \<equiv> UP R
\<lbrakk>?f \<in> carrier P; ?a \<in> carrier R\<rbrakk> \<Longrightarrow> UP_root_div ?f ?a \<in> carrier P
\<lbrakk>?f \<in> carrier P; ?x \<in> carrier R\<rbrakk> \<Longrightarrow> to_fun ?f ?x \<in> carrier R
?a \<in> carrier R \<Longrightarrow> monom P ?a ?n \<in> carrier P

goal (1 subgoal):
 1. to_fun (UP_root_div (monom P \<one> (Suc n) \<ominus>\<^bsub>UP R\<^esub> monom P (b [^] Suc n) 0) b) a \<in> carrier R
[PROOF STEP]
by auto


[STATEMENT]
lemma (in is_functor) cf_umap_of_is_arr':
  assumes "category \<alpha> \<AA>"
    and "category \<alpha> \<BB>"
    and "r \<in>\<^sub>\<circ> \<AA>\<lparr>Obj\<rparr>"
    and "d \<in>\<^sub>\<circ> \<AA>\<lparr>Obj\<rparr>"
    and "u : c \<mapsto>\<^bsub>\<BB>\<^esub> \<FF>\<lparr>ObjMap\<rparr>\<lparr>r\<rparr>"
    and "A = Hom \<AA> r d"
    and "B = Hom \<BB> c (\<FF>\<lparr>ObjMap\<rparr>\<lparr>d\<rparr>)"
    and "\<CC> = cat_Set \<alpha>"
  shows "umap_of \<FF> c r u d : A \<mapsto>\<^bsub>\<CC>\<^esub> B"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. umap_of \<FF> c r u d : A \<mapsto>\<^bsub>\<CC>\<^esub> B
[PROOF STEP]
using assms(1-5)
[PROOF STATE]
proof (prove)
using this:
category \<alpha> \<AA>
category \<alpha> \<BB>
r \<in>\<^sub>\<circ> \<AA>\<lparr>Obj\<rparr>
d \<in>\<^sub>\<circ> \<AA>\<lparr>Obj\<rparr>
u : c \<mapsto>\<^bsub>\<BB>\<^esub> \<FF>\<lparr>ObjMap\<rparr>\<lparr>r\<rparr>

goal (1 subgoal):
 1. umap_of \<FF> c r u d : A \<mapsto>\<^bsub>\<CC>\<^esub> B
[PROOF STEP]
unfolding assms(6-8)
[PROOF STATE]
proof (prove)
using this:
category \<alpha> \<AA>
category \<alpha> \<BB>
r \<in>\<^sub>\<circ> \<AA>\<lparr>Obj\<rparr>
d \<in>\<^sub>\<circ> \<AA>\<lparr>Obj\<rparr>
u : c \<mapsto>\<^bsub>\<BB>\<^esub> \<FF>\<lparr>ObjMap\<rparr>\<lparr>r\<rparr>

goal (1 subgoal):
 1. umap_of \<FF> c r u d : Hom \<AA> r d \<mapsto>\<^bsub>cat_Set \<alpha>\<^esub> Hom \<BB> c (\<FF>\<lparr>ObjMap\<rparr>\<lparr>d\<rparr>)
[PROOF STEP]
by (rule cf_umap_of_is_arr)


[STATEMENT]
lemma pmf_prob_code [code]:
  "pmf_prob p (set xs) = (\<Sum>x\<in>set xs. pmf p x)"
  "pmf_prob p (List.coset xs) = 1 - (\<Sum>x\<in>set xs. pmf p x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pmf_prob p (set xs) = sum (pmf p) (set xs) &&& pmf_prob p (List.coset xs) = 1 - sum (pmf p) (set xs)
[PROOF STEP]
by (simp_all add: pmf_prob_code_alt_finite pmf_prob_compl)


[STATEMENT]
lemma is_derivation_0: "is_derivation 0 p"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. is_derivation 0 p
[PROOF STEP]
by (simp add: is_derivation_def diff_fun_space.linear_zero zero_fun_def)


[STATEMENT]
lemma vsubset_eq: "A \<subseteq>\<^sub>\<circ> B \<longleftrightarrow> (\<forall>x\<in>\<^sub>\<circ>A. x \<in>\<^sub>\<circ> B)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (A \<subseteq>\<^sub>\<circ> B) = (\<forall>x\<in>elts A. x \<in>\<^sub>\<circ> B)
[PROOF STEP]
by auto


[STATEMENT]
lemma vebt_insert_code[code]:
    "vebt_insert (Leaf a b) x = (if x=0 then Leaf True b else if x=1 then Leaf a True else Leaf a b)"
    "vebt_insert (Node info deg treeList summary) x = (
      if deg \<le> 1 then
        (Node info deg treeList summary)
      else ( case info of
        None \<Rightarrow>  (Node (Some (x,x)) deg  treeList summary)
      | Some mima \<Rightarrow> ( case mima of (mi, ma) \<Rightarrow> (
          let
            xn = (if x < mi then mi else x);
            minn = (if x< mi then x else mi);
            l= low xn (deg div 2); h = high xn (deg div 2)
          in (
            if h < length treeList \<and> \<not> (x = mi \<or> x = ma) then
              Node (Some (minn, max xn ma))
                   deg
                   (treeList[h:= vebt_insert (treeList ! h) l])
                   (if minNull (treeList ! h) then  vebt_insert summary h else summary)
            else Node (Some (mi, ma)) deg treeList summary)
      ))))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vebt_insert (Leaf a b) x = (if x = 0 then Leaf True b else if x = 1 then Leaf a True else Leaf a b) &&& vebt_insert (Node info deg treeList summary) x = (if deg \<le> 1 then Node info deg treeList summary else case info of None \<Rightarrow> Node (Some (x, x)) deg treeList summary | Some (mi, ma) \<Rightarrow> let xn = if x < mi then mi else x; minn = if x < mi then x else mi; l = low xn (deg div 2); h = high xn (deg div 2) in if h < length treeList \<and> \<not> (x = mi \<or> x = ma) then Node (Some (minn, max xn ma)) deg (treeList[h := vebt_insert (treeList ! h) l]) (if minNull (treeList ! h) then vebt_insert summary h else summary) else Node (Some (mi, ma)) deg treeList summary)
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vebt_insert (Node info deg treeList summary) x = (if deg \<le> 1 then Node info deg treeList summary else case info of None \<Rightarrow> Node (Some (x, x)) deg treeList summary | Some (mi, ma) \<Rightarrow> let xn = if x < mi then mi else x; minn = if x < mi then x else mi; l = low xn (deg div 2); h = high xn (deg div 2) in if h < length treeList \<and> \<not> (x = mi \<or> x = ma) then Node (Some (minn, max xn ma)) deg (treeList[h := vebt_insert (treeList ! h) l]) (if minNull (treeList ! h) then vebt_insert summary h else summary) else Node (Some (mi, ma)) deg treeList summary)
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (deg \<le> Suc 0 \<longrightarrow> vebt_insert (Node info deg treeList summary) x = Node info deg treeList summary) \<and> (\<not> deg \<le> Suc 0 \<longrightarrow> vebt_insert (Node info deg treeList summary) x = (case info of None \<Rightarrow> Node (Some (x, x)) deg treeList summary | Some (mi, ma) \<Rightarrow> let xn = if x < mi then mi else x; minn = if x < mi then x else mi; l = low xn (deg div 2); h = high xn (deg div 2) in if h < length treeList \<and> \<not> (x = mi \<or> x = ma) then Node (Some (minn, max xn ma)) deg (treeList[h := vebt_insert (treeList ! h) l]) (if minNull (treeList ! h) then vebt_insert summary h else summary) else Node (Some (mi, ma)) deg treeList summary))
[PROOF STEP]
proof(goal_cases)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (deg \<le> Suc 0 \<longrightarrow> vebt_insert (Node info deg treeList summary) x = Node info deg treeList summary) \<and> (\<not> deg \<le> Suc 0 \<longrightarrow> vebt_insert (Node info deg treeList summary) x = (case info of None \<Rightarrow> Node (Some (x, x)) deg treeList summary | Some (mi, ma) \<Rightarrow> let xn = if x < mi then mi else x; minn = if x < mi then x else mi; l = low xn (deg div 2); h = high xn (deg div 2) in if h < length treeList \<and> \<not> (x = mi \<or> x = ma) then Node (Some (minn, max xn ma)) deg (treeList[h := vebt_insert (treeList ! h) l]) (if minNull (treeList ! h) then vebt_insert summary h else summary) else Node (Some (mi, ma)) deg treeList summary))
[PROOF STEP]
case 1
[PROOF STATE]
proof (state)
this:

goal (1 subgoal):
 1. (deg \<le> Suc 0 \<longrightarrow> vebt_insert (Node info deg treeList summary) x = Node info deg treeList summary) \<and> (\<not> deg \<le> Suc 0 \<longrightarrow> vebt_insert (Node info deg treeList summary) x = (case info of None \<Rightarrow> Node (Some (x, x)) deg treeList summary | Some (mi, ma) \<Rightarrow> let xn = if x < mi then mi else x; minn = if x < mi then x else mi; l = low xn (deg div 2); h = high xn (deg div 2) in if h < length treeList \<and> \<not> (x = mi \<or> x = ma) then Node (Some (minn, max xn ma)) deg (treeList[h := vebt_insert (treeList ! h) l]) (if minNull (treeList ! h) then vebt_insert summary h else summary) else Node (Some (mi, ma)) deg treeList summary))
[PROOF STEP]
consider "deg = 0"| "deg = Suc 0"
      | n  where "deg = Suc (Suc n)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>deg = 0 \<Longrightarrow> thesis; deg = Suc 0 \<Longrightarrow> thesis; \<And>n. deg = Suc (Suc n) \<Longrightarrow> thesis\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
by (meson vebt_buildup.cases)
[PROOF STATE]
proof (state)
this:
\<lbrakk>deg = 0 \<Longrightarrow> ?thesis; deg = Suc 0 \<Longrightarrow> ?thesis; \<And>n. deg = Suc (Suc n) \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. (deg \<le> Suc 0 \<longrightarrow> vebt_insert (Node info deg treeList summary) x = Node info deg treeList summary) \<and> (\<not> deg \<le> Suc 0 \<longrightarrow> vebt_insert (Node info deg treeList summary) x = (case info of None \<Rightarrow> Node (Some (x, x)) deg treeList summary | Some (mi, ma) \<Rightarrow> let xn = if x < mi then mi else x; minn = if x < mi then x else mi; l = low xn (deg div 2); h = high xn (deg div 2) in if h < length treeList \<and> \<not> (x = mi \<or> x = ma) then Node (Some (minn, max xn ma)) deg (treeList[h := vebt_insert (treeList ! h) l]) (if minNull (treeList ! h) then vebt_insert summary h else summary) else Node (Some (mi, ma)) deg treeList summary))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>deg = 0 \<Longrightarrow> ?thesis; deg = Suc 0 \<Longrightarrow> ?thesis; \<And>n. deg = Suc (Suc n) \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>deg = 0 \<Longrightarrow> ?thesis; deg = Suc 0 \<Longrightarrow> ?thesis; \<And>n. deg = Suc (Suc n) \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. (deg \<le> Suc 0 \<longrightarrow> vebt_insert (Node info deg treeList summary) x = Node info deg treeList summary) \<and> (\<not> deg \<le> Suc 0 \<longrightarrow> vebt_insert (Node info deg treeList summary) x = (case info of None \<Rightarrow> Node (Some (x, x)) deg treeList summary | Some (mi, ma) \<Rightarrow> let xn = if x < mi then mi else x; minn = if x < mi then x else mi; l = low xn (deg div 2); h = high xn (deg div 2) in if h < length treeList \<and> \<not> (x = mi \<or> x = ma) then Node (Some (minn, max xn ma)) deg (treeList[h := vebt_insert (treeList ! h) l]) (if minNull (treeList ! h) then vebt_insert summary h else summary) else Node (Some (mi, ma)) deg treeList summary))
[PROOF STEP]
apply(cases)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. deg = 0 \<Longrightarrow> (deg \<le> Suc 0 \<longrightarrow> vebt_insert (Node info deg treeList summary) x = Node info deg treeList summary) \<and> (\<not> deg \<le> Suc 0 \<longrightarrow> vebt_insert (Node info deg treeList summary) x = (case info of None \<Rightarrow> Node (Some (x, x)) deg treeList summary | Some (mi, ma) \<Rightarrow> let xn = if x < mi then mi else x; minn = if x < mi then x else mi; l = low xn (deg div 2); h = high xn (deg div 2) in if h < length treeList \<and> \<not> (x = mi \<or> x = ma) then Node (Some (minn, max xn ma)) deg (treeList[h := vebt_insert (treeList ! h) l]) (if minNull (treeList ! h) then vebt_insert summary h else summary) else Node (Some (mi, ma)) deg treeList summary))
 2. deg = Suc 0 \<Longrightarrow> (deg \<le> Suc 0 \<longrightarrow> vebt_insert (Node info deg treeList summary) x = Node info deg treeList summary) \<and> (\<not> deg \<le> Suc 0 \<longrightarrow> vebt_insert (Node info deg treeList summary) x = (case info of None \<Rightarrow> Node (Some (x, x)) deg treeList summary | Some (mi, ma) \<Rightarrow> let xn = if x < mi then mi else x; minn = if x < mi then x else mi; l = low xn (deg div 2); h = high xn (deg div 2) in if h < length treeList \<and> \<not> (x = mi \<or> x = ma) then Node (Some (minn, max xn ma)) deg (treeList[h := vebt_insert (treeList ! h) l]) (if minNull (treeList ! h) then vebt_insert summary h else summary) else Node (Some (mi, ma)) deg treeList summary))
 3. \<And>n. deg = Suc (Suc n) \<Longrightarrow> (deg \<le> Suc 0 \<longrightarrow> vebt_insert (Node info deg treeList summary) x = Node info deg treeList summary) \<and> (\<not> deg \<le> Suc 0 \<longrightarrow> vebt_insert (Node info deg treeList summary) x = (case info of None \<Rightarrow> Node (Some (x, x)) deg treeList summary | Some (mi, ma) \<Rightarrow> let xn = if x < mi then mi else x; minn = if x < mi then x else mi; l = low xn (deg div 2); h = high xn (deg div 2) in if h < length treeList \<and> \<not> (x = mi \<or> x = ma) then Node (Some (minn, max xn ma)) deg (treeList[h := vebt_insert (treeList ! h) l]) (if minNull (treeList ! h) then vebt_insert summary h else summary) else Node (Some (mi, ma)) deg treeList summary))
[PROOF STEP]
apply simp+
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>n. deg = Suc (Suc n) \<Longrightarrow> vebt_insert (Node info (Suc (Suc n)) treeList summary) x = (case info of None \<Rightarrow> Node (Some (x, x)) deg treeList summary | Some (mi, ma) \<Rightarrow> let xn = if x < mi then mi else x; minn = if x < mi then x else mi; l = low xn (deg div 2); h = high xn (deg div 2) in if h < length treeList \<and> \<not> (x = mi \<or> x = ma) then Node (Some (minn, max xn ma)) deg (treeList[h := vebt_insert (treeList ! h) l]) (if minNull (treeList ! h) then vebt_insert summary h else summary) else Node (Some (mi, ma)) deg treeList summary)
[PROOF STEP]
apply(cases info)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>n. \<lbrakk>deg = Suc (Suc n); info = None\<rbrakk> \<Longrightarrow> vebt_insert (Node info (Suc (Suc n)) treeList summary) x = (case info of None \<Rightarrow> Node (Some (x, x)) deg treeList summary | Some (mi, ma) \<Rightarrow> let xn = if x < mi then mi else x; minn = if x < mi then x else mi; l = low xn (deg div 2); h = high xn (deg div 2) in if h < length treeList \<and> \<not> (x = mi \<or> x = ma) then Node (Some (minn, max xn ma)) deg (treeList[h := vebt_insert (treeList ! h) l]) (if minNull (treeList ! h) then vebt_insert summary h else summary) else Node (Some (mi, ma)) deg treeList summary)
 2. \<And>n a. \<lbrakk>deg = Suc (Suc n); info = Some a\<rbrakk> \<Longrightarrow> vebt_insert (Node info (Suc (Suc n)) treeList summary) x = (case info of None \<Rightarrow> Node (Some (x, x)) deg treeList summary | Some (mi, ma) \<Rightarrow> let xn = if x < mi then mi else x; minn = if x < mi then x else mi; l = low xn (deg div 2); h = high xn (deg div 2) in if h < length treeList \<and> \<not> (x = mi \<or> x = ma) then Node (Some (minn, max xn ma)) deg (treeList[h := vebt_insert (treeList ! h) l]) (if minNull (treeList ! h) then vebt_insert summary h else summary) else Node (Some (mi, ma)) deg treeList summary)
[PROOF STEP]
apply simp+
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>n a. \<lbrakk>deg = Suc (Suc n); info = Some a\<rbrakk> \<Longrightarrow> vebt_insert (Node (Some a) (Suc (Suc n)) treeList summary) x = (case a of (mi, ma) \<Rightarrow> let xn = if x < mi then mi else x; h = high xn (Suc (n div 2)) in if h < length treeList \<and> x \<noteq> mi \<and> x \<noteq> ma then Node (Some (if x < mi then x else mi, max xn ma)) deg (treeList[h := vebt_insert (treeList ! h) (low xn (Suc (n div 2)))]) (if minNull (treeList ! h) then vebt_insert summary h else summary) else Node (Some (mi, ma)) deg treeList summary)
[PROOF STEP]
apply(cases "the info")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>n a aa b. \<lbrakk>deg = Suc (Suc n); info = Some a; the info = (aa, b)\<rbrakk> \<Longrightarrow> vebt_insert (Node (Some a) (Suc (Suc n)) treeList summary) x = (case a of (mi, ma) \<Rightarrow> let xn = if x < mi then mi else x; h = high xn (Suc (n div 2)) in if h < length treeList \<and> x \<noteq> mi \<and> x \<noteq> ma then Node (Some (if x < mi then x else mi, max xn ma)) deg (treeList[h := vebt_insert (treeList ! h) (low xn (Suc (n div 2)))]) (if minNull (treeList ! h) then vebt_insert summary h else summary) else Node (Some (mi, ma)) deg treeList summary)
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>n a aa b. \<lbrakk>deg = Suc (Suc n); info = Some (aa, b); a = (aa, b)\<rbrakk> \<Longrightarrow> (x < aa \<longrightarrow> (let h = high aa (Suc (n div 2)) in if h < length treeList \<and> x \<noteq> b then Node (Some (x, max aa b)) (Suc (Suc n)) (treeList[h := vebt_insert (treeList ! h) (low aa (Suc (n div 2)))]) (if minNull (treeList ! h) then vebt_insert summary h else summary) else Node (Some (aa, b)) (Suc (Suc n)) treeList summary) = (let h = high aa (Suc (n div 2)) in if h < length treeList \<and> x \<noteq> b then Node (Some (x, max aa b)) deg (treeList[h := vebt_insert (treeList ! h) (low aa (Suc (n div 2)))]) (if minNull (treeList ! h) then vebt_insert summary h else summary) else Node (Some (aa, b)) deg treeList summary)) \<and> (\<not> x < aa \<longrightarrow> (let h = high x (Suc (n div 2)) in if h < length treeList \<and> x \<noteq> aa \<and> x \<noteq> b then Node (Some (aa, max x b)) (Suc (Suc n)) (treeList[h := vebt_insert (treeList ! h) (low x (Suc (n div 2)))]) (if minNull (treeList ! h) then vebt_insert summary h else summary) else Node (Some (aa, b)) (Suc (Suc n)) treeList summary) = (let h = high x (Suc (n div 2)) in if h < length treeList \<and> x \<noteq> aa \<and> x \<noteq> b then Node (Some (aa, max x b)) deg (treeList[h := vebt_insert (treeList ! h) (low x (Suc (n div 2)))]) (if minNull (treeList ! h) then vebt_insert summary h else summary) else Node (Some (aa, b)) deg treeList summary))
[PROOF STEP]
by meson
[PROOF STATE]
proof (state)
this:
(deg \<le> Suc 0 \<longrightarrow> vebt_insert (Node info deg treeList summary) x = Node info deg treeList summary) \<and> (\<not> deg \<le> Suc 0 \<longrightarrow> vebt_insert (Node info deg treeList summary) x = (case info of None \<Rightarrow> Node (Some (x, x)) deg treeList summary | Some (mi, ma) \<Rightarrow> let xn = if x < mi then mi else x; minn = if x < mi then x else mi; l = low xn (deg div 2); h = high xn (deg div 2) in if h < length treeList \<and> \<not> (x = mi \<or> x = ma) then Node (Some (minn, max xn ma)) deg (treeList[h := vebt_insert (treeList ! h) l]) (if minNull (treeList ! h) then vebt_insert summary h else summary) else Node (Some (mi, ma)) deg treeList summary))

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma (in infinite_coin_toss_space) nat_filtration_borel_measurable_integrable:
  assumes "f\<in> borel_measurable (nat_filtration n)"
  shows "integrable M f"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. integrable M f
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. integrable M f
[PROOF STEP]
have "simple_function M f"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. simple_function M f
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
f \<in> borel_measurable (nat_filtration n)

goal (1 subgoal):
 1. simple_function M f
[PROOF STEP]
by (simp add: nat_filtration_borel_measurable_simple)
[PROOF STATE]
proof (state)
this:
simple_function M f

goal (1 subgoal):
 1. integrable M f
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
simple_function M f

goal (1 subgoal):
 1. integrable M f
[PROOF STEP]
have "emeasure M {y \<in> space M. f y \<noteq> 0} \<noteq> \<infinity>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. emeasure M {y \<in> space M. f y \<noteq> (0::'a)} \<noteq> \<infinity>
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
emeasure M {y \<in> space M. f y \<noteq> (0::'a)} \<noteq> \<infinity>

goal (1 subgoal):
 1. integrable M f
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
simple_function M f
emeasure M {y \<in> space M. f y \<noteq> (0::'a)} \<noteq> \<infinity>
[PROOF STEP]
have "Bochner_Integration.simple_bochner_integrable M f"
[PROOF STATE]
proof (prove)
using this:
simple_function M f
emeasure M {y \<in> space M. f y \<noteq> (0::'a)} \<noteq> \<infinity>

goal (1 subgoal):
 1. Bochner_Integration.simple_bochner_integrable M f
[PROOF STEP]
using Bochner_Integration.simple_bochner_integrable.simps
[PROOF STATE]
proof (prove)
using this:
simple_function M f
emeasure M {y \<in> space M. f y \<noteq> (0::'a)} \<noteq> \<infinity>
Bochner_Integration.simple_bochner_integrable ?M ?f = (simple_function ?M ?f \<and> emeasure ?M {y \<in> space ?M. ?f y \<noteq> (0::?'b)} \<noteq> \<infinity>)

goal (1 subgoal):
 1. Bochner_Integration.simple_bochner_integrable M f
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
Bochner_Integration.simple_bochner_integrable M f

goal (1 subgoal):
 1. integrable M f
[PROOF STEP]
hence "has_bochner_integral M f (Bochner_Integration.simple_bochner_integral M f)"
[PROOF STATE]
proof (prove)
using this:
Bochner_Integration.simple_bochner_integrable M f

goal (1 subgoal):
 1. has_bochner_integral M f (Bochner_Integration.simple_bochner_integral M f)
[PROOF STEP]
using has_bochner_integral_simple_bochner_integrable
[PROOF STATE]
proof (prove)
using this:
Bochner_Integration.simple_bochner_integrable M f
Bochner_Integration.simple_bochner_integrable ?M ?f \<Longrightarrow> has_bochner_integral ?M ?f (Bochner_Integration.simple_bochner_integral ?M ?f)

goal (1 subgoal):
 1. has_bochner_integral M f (Bochner_Integration.simple_bochner_integral M f)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
has_bochner_integral M f (Bochner_Integration.simple_bochner_integral M f)

goal (1 subgoal):
 1. integrable M f
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
has_bochner_integral M f (Bochner_Integration.simple_bochner_integral M f)

goal (1 subgoal):
 1. integrable M f
[PROOF STEP]
using integrable.simps
[PROOF STATE]
proof (prove)
using this:
has_bochner_integral M f (Bochner_Integration.simple_bochner_integral M f)
integrable ?M ?f = (\<exists>x. has_bochner_integral ?M ?f x)

goal (1 subgoal):
 1. integrable M f
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
integrable M f

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma [z3_rule]:
  "0 + x = x"
  "x + 0 = x"
  "0 * x = 0"
  "1 * x = x"
  "-x = -1 * x"
  "x + y = y + x"
  for x y :: real
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (0 + x = x &&& x + 0 = x &&& 0 * x = 0) &&& 1 * x = x &&& - x = - 1 * x &&& x + y = y + x
[PROOF STEP]
by auto


[STATEMENT]
lemma cong_0_1_nat: "[0 = 1] (mod n) \<longleftrightarrow> n = 1"
  for n :: nat
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. [0 = 1] (mod n) = (n = 1)
[PROOF STEP]
by (auto simp: cong_def)


[STATEMENT]
lemma rtranclp_add_poly_p_polynomial_of_mset:
  \<open>add_poly_p\<^sup>*\<^sup>* (p, q, r) (p', q', r') \<Longrightarrow>
    polynomial_of_mset r + (polynomial_of_mset p + polynomial_of_mset q) =
    polynomial_of_mset r' + (polynomial_of_mset p' + polynomial_of_mset q')\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. add_poly_p\<^sup>*\<^sup>* (p, q, r) (p', q', r') \<Longrightarrow> polynomial_of_mset r + (polynomial_of_mset p + polynomial_of_mset q) = polynomial_of_mset r' + (polynomial_of_mset p' + polynomial_of_mset q')
[PROOF STEP]
by (induction rule: rtranclp_induct[of add_poly_p \<open>(_, _, _)\<close> \<open>(_, _, _)\<close>, split_format(complete), of for r])
    (auto dest: add_poly_p_polynomial_of_mset)


[STATEMENT]
lemma (in normal) oVeblen_oSuc:
"oVeblen F (oSuc x) = oDeriv (oVeblen F x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. oVeblen F (oSuc x) = oDeriv (oVeblen F x)
[PROOF STEP]
apply (unfold oVeblen_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. OrdinalVeblen.ordering (critical_set (range F) (oSuc x)) = oDeriv (OrdinalVeblen.ordering (critical_set (range F) x))
[PROOF STEP]
apply (subst critical_set_oSuc)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. normal_set (range F)
 2. OrdinalVeblen.ordering (range (oDeriv (OrdinalVeblen.ordering (critical_set (range F) x)))) = oDeriv (OrdinalVeblen.ordering (critical_set (range F) x))
[PROOF STEP]
apply (rule normal_set_range)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. OrdinalVeblen.ordering (range (oDeriv (OrdinalVeblen.ordering (critical_set (range F) x)))) = oDeriv (OrdinalVeblen.ordering (critical_set (range F) x))
[PROOF STEP]
apply (rule normal.ordering_range)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. normal (oDeriv (OrdinalVeblen.ordering (critical_set (range F) x)))
[PROOF STEP]
apply (rule normal_oDeriv)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma test_hoare_with_time: "\<lbrakk>\<forall>x\<in>set xs. x<2^n; n>0\<rbrakk> \<Longrightarrow>
    <emp> (test n xs ys) <\<lambda>r. \<up>(r = map (\<lambda>y. (GREATEST y'. y'\<in>insert 0 (set xs) \<and> y'\<le>y)) ys) * true >
    T[10 * 2 ^ n +
       (length (0 # xs) * (13 + 13 * nat \<lceil>log 2 (real n)\<rceil>) + 1 +
        (1 + length ys * (5 + 5 * nat \<lceil>log 2 (real n)\<rceil> + 9 + 7 * nat \<lceil>log 2 (real n)\<rceil>)))]"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<forall>x\<in>set xs. x < 2 ^ n; 0 < n\<rbrakk> \<Longrightarrow> <emp> test n xs ys <\<lambda>r. \<up> (r = map (\<lambda>y. GREATEST y'. y' \<in> insert 0 (set xs) \<and> y' \<le> y) ys) * true> T[10 * 2 ^ n + (length (0 # xs) * (13 + 13 * nat \<lceil>log 2 (real n)\<rceil>) + 1 + (1 + length ys * (5 + 5 * nat \<lceil>log 2 (real n)\<rceil> + 9 + 7 * nat \<lceil>log 2 (real n)\<rceil>)))]
[PROOF STEP]
apply(rule htt_intro, rule test_hoare, simp+)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<forall>x\<in>set xs. x < 2 ^ n; 0 < n\<rbrakk> \<Longrightarrow> \<section> emp \<section> TBOUND test n xs ys 10 * 2 ^ n + (15 + (13 * nat \<lceil>log 2 (real n)\<rceil> + (length xs * (13 + 13 * nat \<lceil>log 2 (real n)\<rceil>) + length ys * (12 * nat \<lceil>log 2 (real n)\<rceil> + 14))))
[PROOF STEP]
apply(rule cond_TBOUND_mono, rule cond_TBOUND_cons)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<lbrakk>\<forall>x\<in>set xs. x < 2 ^ n; 0 < n\<rbrakk> \<Longrightarrow> emp \<Longrightarrow>\<^sub>A ?Q9
 2. \<lbrakk>\<forall>x\<in>set xs. x < 2 ^ n; 0 < n\<rbrakk> \<Longrightarrow> \<section> ?Q9 \<section> TBOUND test n xs ys ?b6
 3. \<lbrakk>\<forall>x\<in>set xs. x < 2 ^ n; 0 < n\<rbrakk> \<Longrightarrow> ?b6 \<le> 10 * 2 ^ n + (15 + (13 * nat \<lceil>log 2 (real n)\<rceil> + (length xs * (13 + 13 * nat \<lceil>log 2 (real n)\<rceil>) + length ys * (12 * nat \<lceil>log 2 (real n)\<rceil> + 14))))
[PROOF STEP]
defer
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<lbrakk>\<forall>x\<in>set xs. x < 2 ^ n; 0 < n\<rbrakk> \<Longrightarrow> \<section> ?Q9 \<section> TBOUND test n xs ys ?b6
 2. \<lbrakk>\<forall>x\<in>set xs. x < 2 ^ n; 0 < n\<rbrakk> \<Longrightarrow> ?b6 \<le> 10 * 2 ^ n + (15 + (13 * nat \<lceil>log 2 (real n)\<rceil> + (length xs * (13 + 13 * nat \<lceil>log 2 (real n)\<rceil>) + length ys * (12 * nat \<lceil>log 2 (real n)\<rceil> + 14))))
 3. \<lbrakk>\<forall>x\<in>set xs. x < 2 ^ n; 0 < n\<rbrakk> \<Longrightarrow> emp \<Longrightarrow>\<^sub>A ?Q9
[PROOF STEP]
apply(rule TBOUND_test, simp+)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma prime_exp: "prime (p ^ n) \<longleftrightarrow> n = 1 \<and> prime p"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. prime (p ^ n) = (n = 1 \<and> prime p)
[PROOF STEP]
by auto2


[STATEMENT]
lemma star_of_sup [simp]: "star_of (sup x y) = sup (star_of x) (star_of y)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. star_of (sup x y) = sup (star_of x) (star_of y)
[PROOF STEP]
by transfer (rule refl)


[STATEMENT]
lemma pi_approx':
  fixes n :: nat assumes n: "even n" and "n > 0" and "k \<le> 13*n - 2"
  shows   "\<bar>pi - pi_approx n\<bar> \<le> inverse (2^k)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<bar>pi - pi_approx n\<bar> \<le> inverse (2 ^ k)
[PROOF STEP]
using assms(3)
[PROOF STATE]
proof (prove)
using this:
k \<le> 13 * n - 2

goal (1 subgoal):
 1. \<bar>pi - pi_approx n\<bar> \<le> inverse (2 ^ k)
[PROOF STEP]
by (intro order.trans[OF pi_approx[OF assms(1,2)]]) (simp_all add: field_simps)


[STATEMENT]
lemma least_max_arg_max_enum_correct2:
  assumes "X \<noteq> {}"
  shows "snd (least_max_arg_max_enum (f :: _ \<Rightarrow> (_ :: linorder)) X) = (MAX x \<in> X. f x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. snd (least_max_arg_max_enum f X) = Max (f ` X)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. snd (least_max_arg_max_enum f X) = Max (f ` X)
[PROOF STEP]
have *: "xs \<noteq> [] \<Longrightarrow> insert (hd xs) (set (tl xs)) = set xs" for xs
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. xs \<noteq> [] \<Longrightarrow> insert (hd xs) (set (tl xs)) = set xs
[PROOF STEP]
using list.exhaust_sel list.simps(15)
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?list = [] \<Longrightarrow> ?P; ?list = hd ?list # tl ?list \<Longrightarrow> ?P\<rbrakk> \<Longrightarrow> ?P
set (?x21.0 # ?x22.0) = insert ?x21.0 (set ?x22.0)

goal (1 subgoal):
 1. xs \<noteq> [] \<Longrightarrow> insert (hd xs) (set (tl xs)) = set xs
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
?xs1 \<noteq> [] \<Longrightarrow> insert (hd ?xs1) (set (tl ?xs1)) = set ?xs1

goal (1 subgoal):
 1. snd (least_max_arg_max_enum f X) = Max (f ` X)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. snd (least_max_arg_max_enum f X) = Max (f ` X)
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
X \<noteq> {}

goal (1 subgoal):
 1. snd (least_max_arg_max_enum f X) = Max (f ` X)
[PROOF STEP]
by (auto simp: least_max_arg_max_enum_def Let_def snd_least_max_arg_max_list *)
[PROOF STATE]
proof (state)
this:
snd (least_max_arg_max_enum f X) = Max (f ` X)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma open_UN [continuous_intros, intro]: "\<forall>x\<in>A. open (B x) \<Longrightarrow> open (\<Union>x\<in>A. B x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>x\<in>A. open (B x) \<Longrightarrow> open (\<Union> (B ` A))
[PROOF STEP]
using open_Union [of "B ` A"]
[PROOF STATE]
proof (prove)
using this:
Ball (B ` A) open \<Longrightarrow> open (\<Union> (B ` A))

goal (1 subgoal):
 1. \<forall>x\<in>A. open (B x) \<Longrightarrow> open (\<Union> (B ` A))
[PROOF STEP]
by simp