[STATEMENT]
lemma set_filter_all_possible_assignments_true_is:
  assumes "is_valid_problem_sas_plus \<Psi>"
  shows "set (filter (\<lambda>(v, a). s (v, a) = Some True)
      (all_possible_assignments_for \<Psi>))
    =  (\<Union>v \<in> set ((\<Psi>)\<^sub>\<V>\<^sub>+). Pair v ` { a \<in> \<R>\<^sub>+ \<Psi> v. s (v, a) = Some True })"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. set (filter (\<lambda>(v, a). s (v, a) = Some True) (all_possible_assignments_for \<Psi>)) = (\<Union>v\<in>set (\<Psi>\<^sub>\<V>\<^sub>+). Pair v ` {a \<in> \<R>\<^sub>+ \<Psi> v. s (v, a) = Some True})
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. set (filter (\<lambda>(v, a). s (v, a) = Some True) (all_possible_assignments_for \<Psi>)) = (\<Union>v\<in>set (\<Psi>\<^sub>\<V>\<^sub>+). Pair v ` {a \<in> \<R>\<^sub>+ \<Psi> v. s (v, a) = Some True})
[PROOF STEP]
let ?vs = "sas_plus_problem.variables_of \<Psi>"
    and ?P = "(\<lambda>(v, a). s (v, a) = Some True)"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. set (filter (\<lambda>(v, a). s (v, a) = Some True) (all_possible_assignments_for \<Psi>)) = (\<Union>v\<in>set (\<Psi>\<^sub>\<V>\<^sub>+). Pair v ` {a \<in> \<R>\<^sub>+ \<Psi> v. s (v, a) = Some True})
[PROOF STEP]
let ?l = "filter ?P (all_possible_assignments_for \<Psi>)"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. set (filter (\<lambda>(v, a). s (v, a) = Some True) (all_possible_assignments_for \<Psi>)) = (\<Union>v\<in>set (\<Psi>\<^sub>\<V>\<^sub>+). Pair v ` {a \<in> \<R>\<^sub>+ \<Psi> v. s (v, a) = Some True})
[PROOF STEP]
have "set ?l = set (concat (map (filter ?P) (map (possible_assignments_for \<Psi>) ?vs)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. set (filter (\<lambda>(v, a). s (v, a) = Some True) (all_possible_assignments_for \<Psi>)) = set (concat (map (filter (\<lambda>(v, a). s (v, a) = Some True)) (map (possible_assignments_for \<Psi>) (\<Psi>\<^sub>\<V>\<^sub>+))))
[PROOF STEP]
unfolding all_possible_assignments_for_def
      filter_concat[of ?P "map (possible_assignments_for \<Psi>) (sas_plus_problem.variables_of \<Psi>)"]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. set (concat (map (filter (\<lambda>(v, a). s (v, a) = Some True)) (map (possible_assignments_for \<Psi>) (\<Psi>\<^sub>\<V>\<^sub>+)))) = set (concat (map (filter (\<lambda>(v, a). s (v, a) = Some True)) (map (possible_assignments_for \<Psi>) (\<Psi>\<^sub>\<V>\<^sub>+))))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
set (filter (\<lambda>(v, a). s (v, a) = Some True) (all_possible_assignments_for \<Psi>)) = set (concat (map (filter (\<lambda>(v, a). s (v, a) = Some True)) (map (possible_assignments_for \<Psi>) (\<Psi>\<^sub>\<V>\<^sub>+))))

goal (1 subgoal):
 1. set (filter (\<lambda>(v, a). s (v, a) = Some True) (all_possible_assignments_for \<Psi>)) = (\<Union>v\<in>set (\<Psi>\<^sub>\<V>\<^sub>+). Pair v ` {a \<in> \<R>\<^sub>+ \<Psi> v. s (v, a) = Some True})
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
set (filter (\<lambda>(v, a). s (v, a) = Some True) (all_possible_assignments_for \<Psi>)) = set (concat (map (filter (\<lambda>(v, a). s (v, a) = Some True)) (map (possible_assignments_for \<Psi>) (\<Psi>\<^sub>\<V>\<^sub>+))))

goal (1 subgoal):
 1. set (filter (\<lambda>(v, a). s (v, a) = Some True) (all_possible_assignments_for \<Psi>)) = (\<Union>v\<in>set (\<Psi>\<^sub>\<V>\<^sub>+). Pair v ` {a \<in> \<R>\<^sub>+ \<Psi> v. s (v, a) = Some True})
[PROOF STEP]
have "\<dots> = set (concat (map (\<lambda>v. filter ?P (possible_assignments_for \<Psi> v)) ?vs))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. set (concat (map (filter (\<lambda>(v, a). s (v, a) = Some True)) (map (possible_assignments_for \<Psi>) (\<Psi>\<^sub>\<V>\<^sub>+)))) = set (concat (map (\<lambda>v. filter (\<lambda>(v, a). s (v, a) = Some True) (possible_assignments_for \<Psi> v)) (\<Psi>\<^sub>\<V>\<^sub>+)))
[PROOF STEP]
unfolding map_map comp_apply
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. set (concat (map (\<lambda>x. filter (\<lambda>(v, a). s (v, a) = Some True) (possible_assignments_for \<Psi> x)) (\<Psi>\<^sub>\<V>\<^sub>+))) = set (concat (map (\<lambda>v. filter (\<lambda>(v, a). s (v, a) = Some True) (possible_assignments_for \<Psi> v)) (\<Psi>\<^sub>\<V>\<^sub>+)))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
set (concat (map (filter (\<lambda>(v, a). s (v, a) = Some True)) (map (possible_assignments_for \<Psi>) (\<Psi>\<^sub>\<V>\<^sub>+)))) = set (concat (map (\<lambda>v. filter (\<lambda>(v, a). s (v, a) = Some True) (possible_assignments_for \<Psi> v)) (\<Psi>\<^sub>\<V>\<^sub>+)))

goal (1 subgoal):
 1. set (filter (\<lambda>(v, a). s (v, a) = Some True) (all_possible_assignments_for \<Psi>)) = (\<Union>v\<in>set (\<Psi>\<^sub>\<V>\<^sub>+). Pair v ` {a \<in> \<R>\<^sub>+ \<Psi> v. s (v, a) = Some True})
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
set (concat (map (filter (\<lambda>(v, a). s (v, a) = Some True)) (map (possible_assignments_for \<Psi>) (\<Psi>\<^sub>\<V>\<^sub>+)))) = set (concat (map (\<lambda>v. filter (\<lambda>(v, a). s (v, a) = Some True) (possible_assignments_for \<Psi> v)) (\<Psi>\<^sub>\<V>\<^sub>+)))

goal (1 subgoal):
 1. set (filter (\<lambda>(v, a). s (v, a) = Some True) (all_possible_assignments_for \<Psi>)) = (\<Union>v\<in>set (\<Psi>\<^sub>\<V>\<^sub>+). Pair v ` {a \<in> \<R>\<^sub>+ \<Psi> v. s (v, a) = Some True})
[PROOF STEP]
have "\<dots> = set (concat (map (\<lambda>v. map (Pair v)
    (filter (?P \<circ> Pair v) (the (range_of \<Psi> v)))) ?vs))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. set (concat (map (\<lambda>v. filter (\<lambda>(v, a). s (v, a) = Some True) (possible_assignments_for \<Psi> v)) (\<Psi>\<^sub>\<V>\<^sub>+))) = set (concat (map (\<lambda>v. map (Pair v) (filter ((\<lambda>(v, a). s (v, a) = Some True) \<circ> Pair v) (the (range_of \<Psi> v)))) (\<Psi>\<^sub>\<V>\<^sub>+)))
[PROOF STEP]
unfolding possible_assignments_for_def filter_map
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. set (concat (map (\<lambda>v. map (Pair v) (filter ((\<lambda>(v, a). s (v, a) = Some True) \<circ> Pair v) (the (range_of \<Psi> v)))) (\<Psi>\<^sub>\<V>\<^sub>+))) = set (concat (map (\<lambda>v. map (Pair v) (filter ((\<lambda>(v, a). s (v, a) = Some True) \<circ> Pair v) (the (range_of \<Psi> v)))) (\<Psi>\<^sub>\<V>\<^sub>+)))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
set (concat (map (\<lambda>v. filter (\<lambda>(v, a). s (v, a) = Some True) (possible_assignments_for \<Psi> v)) (\<Psi>\<^sub>\<V>\<^sub>+))) = set (concat (map (\<lambda>v. map (Pair v) (filter ((\<lambda>(v, a). s (v, a) = Some True) \<circ> Pair v) (the (range_of \<Psi> v)))) (\<Psi>\<^sub>\<V>\<^sub>+)))

goal (1 subgoal):
 1. set (filter (\<lambda>(v, a). s (v, a) = Some True) (all_possible_assignments_for \<Psi>)) = (\<Union>v\<in>set (\<Psi>\<^sub>\<V>\<^sub>+). Pair v ` {a \<in> \<R>\<^sub>+ \<Psi> v. s (v, a) = Some True})
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
set (concat (map (\<lambda>v. filter (\<lambda>(v, a). s (v, a) = Some True) (possible_assignments_for \<Psi> v)) (\<Psi>\<^sub>\<V>\<^sub>+))) = set (concat (map (\<lambda>v. map (Pair v) (filter ((\<lambda>(v, a). s (v, a) = Some True) \<circ> Pair v) (the (range_of \<Psi> v)))) (\<Psi>\<^sub>\<V>\<^sub>+)))

goal (1 subgoal):
 1. set (filter (\<lambda>(v, a). s (v, a) = Some True) (all_possible_assignments_for \<Psi>)) = (\<Union>v\<in>set (\<Psi>\<^sub>\<V>\<^sub>+). Pair v ` {a \<in> \<R>\<^sub>+ \<Psi> v. s (v, a) = Some True})
[PROOF STEP]
have "\<dots> = set (concat (map (\<lambda>v. map (Pair v) (filter (\<lambda>a. s (v, a) = Some True)
    (the (range_of \<Psi> v)))) ?vs))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. set (concat (map (\<lambda>v. map (Pair v) (filter ((\<lambda>(v, a). s (v, a) = Some True) \<circ> Pair v) (the (range_of \<Psi> v)))) (\<Psi>\<^sub>\<V>\<^sub>+))) = set (concat (map (\<lambda>v. map (Pair v) (filter (\<lambda>a. s (v, a) = Some True) (the (range_of \<Psi> v)))) (\<Psi>\<^sub>\<V>\<^sub>+)))
[PROOF STEP]
unfolding comp_apply
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. set (concat (map (\<lambda>v. map (Pair v) (filter (\<lambda>x. case (v, x) of (v, a) \<Rightarrow> s (v, a) = Some True) (the (range_of \<Psi> v)))) (\<Psi>\<^sub>\<V>\<^sub>+))) = set (concat (map (\<lambda>v. map (Pair v) (filter (\<lambda>a. s (v, a) = Some True) (the (range_of \<Psi> v)))) (\<Psi>\<^sub>\<V>\<^sub>+)))
[PROOF STEP]
by fast
[PROOF STATE]
proof (state)
this:
set (concat (map (\<lambda>v. map (Pair v) (filter ((\<lambda>(v, a). s (v, a) = Some True) \<circ> Pair v) (the (range_of \<Psi> v)))) (\<Psi>\<^sub>\<V>\<^sub>+))) = set (concat (map (\<lambda>v. map (Pair v) (filter (\<lambda>a. s (v, a) = Some True) (the (range_of \<Psi> v)))) (\<Psi>\<^sub>\<V>\<^sub>+)))

goal (1 subgoal):
 1. set (filter (\<lambda>(v, a). s (v, a) = Some True) (all_possible_assignments_for \<Psi>)) = (\<Union>v\<in>set (\<Psi>\<^sub>\<V>\<^sub>+). Pair v ` {a \<in> \<R>\<^sub>+ \<Psi> v. s (v, a) = Some True})
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
set (concat (map (\<lambda>v. map (Pair v) (filter ((\<lambda>(v, a). s (v, a) = Some True) \<circ> Pair v) (the (range_of \<Psi> v)))) (\<Psi>\<^sub>\<V>\<^sub>+))) = set (concat (map (\<lambda>v. map (Pair v) (filter (\<lambda>a. s (v, a) = Some True) (the (range_of \<Psi> v)))) (\<Psi>\<^sub>\<V>\<^sub>+)))

goal (1 subgoal):
 1. set (filter (\<lambda>(v, a). s (v, a) = Some True) (all_possible_assignments_for \<Psi>)) = (\<Union>v\<in>set (\<Psi>\<^sub>\<V>\<^sub>+). Pair v ` {a \<in> \<R>\<^sub>+ \<Psi> v. s (v, a) = Some True})
[PROOF STEP]
have "\<dots> = \<Union>(set ` ((\<lambda>v. map (Pair v) (filter (\<lambda>a. s (v, a) = Some True)
    (the (range_of \<Psi> v)))) ` set ?vs))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. set (concat (map (\<lambda>v. map (Pair v) (filter (\<lambda>a. s (v, a) = Some True) (the (range_of \<Psi> v)))) (\<Psi>\<^sub>\<V>\<^sub>+))) = \<Union> (set ` (\<lambda>v. map (Pair v) (filter (\<lambda>a. s (v, a) = Some True) (the (range_of \<Psi> v)))) ` set (\<Psi>\<^sub>\<V>\<^sub>+))
[PROOF STEP]
unfolding set_concat set_map
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<Union> (set ` (\<lambda>v. map (Pair v) (filter (\<lambda>a. s (v, a) = Some True) (the (range_of \<Psi> v)))) ` set (\<Psi>\<^sub>\<V>\<^sub>+)) = \<Union> (set ` (\<lambda>v. map (Pair v) (filter (\<lambda>a. s (v, a) = Some True) (the (range_of \<Psi> v)))) ` set (\<Psi>\<^sub>\<V>\<^sub>+))
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
set (concat (map (\<lambda>v. map (Pair v) (filter (\<lambda>a. s (v, a) = Some True) (the (range_of \<Psi> v)))) (\<Psi>\<^sub>\<V>\<^sub>+))) = \<Union> (set ` (\<lambda>v. map (Pair v) (filter (\<lambda>a. s (v, a) = Some True) (the (range_of \<Psi> v)))) ` set (\<Psi>\<^sub>\<V>\<^sub>+))

goal (1 subgoal):
 1. set (filter (\<lambda>(v, a). s (v, a) = Some True) (all_possible_assignments_for \<Psi>)) = (\<Union>v\<in>set (\<Psi>\<^sub>\<V>\<^sub>+). Pair v ` {a \<in> \<R>\<^sub>+ \<Psi> v. s (v, a) = Some True})
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
set (concat (map (\<lambda>v. map (Pair v) (filter (\<lambda>a. s (v, a) = Some True) (the (range_of \<Psi> v)))) (\<Psi>\<^sub>\<V>\<^sub>+))) = \<Union> (set ` (\<lambda>v. map (Pair v) (filter (\<lambda>a. s (v, a) = Some True) (the (range_of \<Psi> v)))) ` set (\<Psi>\<^sub>\<V>\<^sub>+))

goal (1 subgoal):
 1. set (filter (\<lambda>(v, a). s (v, a) = Some True) (all_possible_assignments_for \<Psi>)) = (\<Union>v\<in>set (\<Psi>\<^sub>\<V>\<^sub>+). Pair v ` {a \<in> \<R>\<^sub>+ \<Psi> v. s (v, a) = Some True})
[PROOF STEP]
have "\<dots> = (\<Union>v \<in> set ?vs. Pair v ` set (filter (\<lambda>a. s (v, a) = Some True)
    (the (range_of \<Psi> v))))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<Union> (set ` (\<lambda>v. map (Pair v) (filter (\<lambda>a. s (v, a) = Some True) (the (range_of \<Psi> v)))) ` set (\<Psi>\<^sub>\<V>\<^sub>+)) = (\<Union>v\<in>set (\<Psi>\<^sub>\<V>\<^sub>+). Pair v ` set (filter (\<lambda>a. s (v, a) = Some True) (the (range_of \<Psi> v))))
[PROOF STEP]
unfolding image_comp[of set] comp_apply set_map
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Union>x\<in>set (\<Psi>\<^sub>\<V>\<^sub>+). Pair x ` set (filter (\<lambda>a. s (x, a) = Some True) (the (range_of \<Psi> x)))) = (\<Union>v\<in>set (\<Psi>\<^sub>\<V>\<^sub>+). Pair v ` set (filter (\<lambda>a. s (v, a) = Some True) (the (range_of \<Psi> v))))
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
\<Union> (set ` (\<lambda>v. map (Pair v) (filter (\<lambda>a. s (v, a) = Some True) (the (range_of \<Psi> v)))) ` set (\<Psi>\<^sub>\<V>\<^sub>+)) = (\<Union>v\<in>set (\<Psi>\<^sub>\<V>\<^sub>+). Pair v ` set (filter (\<lambda>a. s (v, a) = Some True) (the (range_of \<Psi> v))))

goal (1 subgoal):
 1. set (filter (\<lambda>(v, a). s (v, a) = Some True) (all_possible_assignments_for \<Psi>)) = (\<Union>v\<in>set (\<Psi>\<^sub>\<V>\<^sub>+). Pair v ` {a \<in> \<R>\<^sub>+ \<Psi> v. s (v, a) = Some True})
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
\<Union> (set ` (\<lambda>v. map (Pair v) (filter (\<lambda>a. s (v, a) = Some True) (the (range_of \<Psi> v)))) ` set (\<Psi>\<^sub>\<V>\<^sub>+)) = (\<Union>v\<in>set (\<Psi>\<^sub>\<V>\<^sub>+). Pair v ` set (filter (\<lambda>a. s (v, a) = Some True) (the (range_of \<Psi> v))))

goal (1 subgoal):
 1. set (filter (\<lambda>(v, a). s (v, a) = Some True) (all_possible_assignments_for \<Psi>)) = (\<Union>v\<in>set (\<Psi>\<^sub>\<V>\<^sub>+). Pair v ` {a \<in> \<R>\<^sub>+ \<Psi> v. s (v, a) = Some True})
[PROOF STEP]
have "\<dots> = (\<Union>v \<in> set ?vs. Pair v
    ` { a \<in> set (the (range_of \<Psi> v)). s (v, a) = Some True })"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Union>v\<in>set (\<Psi>\<^sub>\<V>\<^sub>+). Pair v ` set (filter (\<lambda>a. s (v, a) = Some True) (the (range_of \<Psi> v)))) = (\<Union>v\<in>set (\<Psi>\<^sub>\<V>\<^sub>+). Pair v ` {a \<in> set (the (range_of \<Psi> v)). s (v, a) = Some True})
[PROOF STEP]
unfolding set_filter
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Union>v\<in>set (\<Psi>\<^sub>\<V>\<^sub>+). Pair v ` {x \<in> set (the (range_of \<Psi> v)). s (v, x) = Some True}) = (\<Union>v\<in>set (\<Psi>\<^sub>\<V>\<^sub>+). Pair v ` {a \<in> set (the (range_of \<Psi> v)). s (v, a) = Some True})
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
(\<Union>v\<in>set (\<Psi>\<^sub>\<V>\<^sub>+). Pair v ` set (filter (\<lambda>a. s (v, a) = Some True) (the (range_of \<Psi> v)))) = (\<Union>v\<in>set (\<Psi>\<^sub>\<V>\<^sub>+). Pair v ` {a \<in> set (the (range_of \<Psi> v)). s (v, a) = Some True})

goal (1 subgoal):
 1. set (filter (\<lambda>(v, a). s (v, a) = Some True) (all_possible_assignments_for \<Psi>)) = (\<Union>v\<in>set (\<Psi>\<^sub>\<V>\<^sub>+). Pair v ` {a \<in> \<R>\<^sub>+ \<Psi> v. s (v, a) = Some True})
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
set (filter (\<lambda>(v, a). s (v, a) = Some True) (all_possible_assignments_for \<Psi>)) = (\<Union>v\<in>set (\<Psi>\<^sub>\<V>\<^sub>+). Pair v ` {a \<in> set (the (range_of \<Psi> v)). s (v, a) = Some True})
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
set (filter (\<lambda>(v, a). s (v, a) = Some True) (all_possible_assignments_for \<Psi>)) = (\<Union>v\<in>set (\<Psi>\<^sub>\<V>\<^sub>+). Pair v ` {a \<in> set (the (range_of \<Psi> v)). s (v, a) = Some True})

goal (1 subgoal):
 1. set (filter (\<lambda>(v, a). s (v, a) = Some True) (all_possible_assignments_for \<Psi>)) = (\<Union>v\<in>set (\<Psi>\<^sub>\<V>\<^sub>+). Pair v ` {a \<in> \<R>\<^sub>+ \<Psi> v. s (v, a) = Some True})
[PROOF STEP]
using set_the_range_of_is_range_of_sas_plus_if[OF assms(1)]
[PROOF STATE]
proof (prove)
using this:
set (filter (\<lambda>(v, a). s (v, a) = Some True) (all_possible_assignments_for \<Psi>)) = (\<Union>v\<in>set (\<Psi>\<^sub>\<V>\<^sub>+). Pair v ` {a \<in> set (the (range_of \<Psi> v)). s (v, a) = Some True})
?v \<in> set (\<Psi>\<^sub>\<V>\<^sub>+) \<Longrightarrow> set (the (range_of \<Psi> ?v)) = \<R>\<^sub>+ \<Psi> ?v

goal (1 subgoal):
 1. set (filter (\<lambda>(v, a). s (v, a) = Some True) (all_possible_assignments_for \<Psi>)) = (\<Union>v\<in>set (\<Psi>\<^sub>\<V>\<^sub>+). Pair v ` {a \<in> \<R>\<^sub>+ \<Psi> v. s (v, a) = Some True})
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
set (filter (\<lambda>(v, a). s (v, a) = Some True) (all_possible_assignments_for \<Psi>)) = (\<Union>v\<in>set (\<Psi>\<^sub>\<V>\<^sub>+). Pair v ` {a \<in> \<R>\<^sub>+ \<Psi> v. s (v, a) = Some True})

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma iT_Plus_iprev: "iprev (n + k) (I \<oplus> k) = (iprev n I) + k"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. iprev (n + k) (I \<oplus> k) = iprev n I + k
[PROOF STEP]
by (unfold iT_Plus_def, rule iprev_image2[OF add_right_strict_mono])


[STATEMENT]
lemma cross7_zero_left [simp]:  "0 \<times>\<^sub>7 x = 0"
  and cross7_zero_right [simp]: "x \<times>\<^sub>7 0 = 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 \<times>\<^sub>7 x = 0 &&& x \<times>\<^sub>7 0 = 0
[PROOF STEP]
by (simp_all add: cross7_simps)


[STATEMENT]
lemma small_vint_le[simp]:
  "small {[a, b]\<^sub>\<circ> | a b. [a, b]\<^sub>\<circ> \<in>\<^sub>\<circ> \<int>\<^sub>\<circ> ^\<^sub>\<times> 2\<^sub>\<nat> \<and> int_of_vint a \<le> int_of_vint b}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. small {[a, b]\<^sub>\<circ> |a b. [a, b]\<^sub>\<circ> \<in>\<^sub>\<circ> \<int>\<^sub>\<circ> ^\<^sub>\<times> 2\<^sub>\<nat> \<and> int_of_vint a \<le> int_of_vint b}
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. small {[a, b]\<^sub>\<circ> |a b. [a, b]\<^sub>\<circ> \<in>\<^sub>\<circ> \<int>\<^sub>\<circ> ^\<^sub>\<times> 2\<^sub>\<nat> \<and> int_of_vint a \<le> int_of_vint b}
[PROOF STEP]
have small: "small {[a, b]\<^sub>\<circ> | a b. [a, b]\<^sub>\<circ> \<in>\<^sub>\<circ> \<int>\<^sub>\<circ> ^\<^sub>\<times> 2\<^sub>\<nat>}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. small {[a, b]\<^sub>\<circ> |a b. [a, b]\<^sub>\<circ> \<in>\<^sub>\<circ> \<int>\<^sub>\<circ> ^\<^sub>\<times> 2\<^sub>\<nat>}
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
small {[a, b]\<^sub>\<circ> |a b. [a, b]\<^sub>\<circ> \<in>\<^sub>\<circ> \<int>\<^sub>\<circ> ^\<^sub>\<times> 2\<^sub>\<nat>}

goal (1 subgoal):
 1. small {[a, b]\<^sub>\<circ> |a b. [a, b]\<^sub>\<circ> \<in>\<^sub>\<circ> \<int>\<^sub>\<circ> ^\<^sub>\<times> 2\<^sub>\<nat> \<and> int_of_vint a \<le> int_of_vint b}
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. small {[a, b]\<^sub>\<circ> |a b. [a, b]\<^sub>\<circ> \<in>\<^sub>\<circ> \<int>\<^sub>\<circ> ^\<^sub>\<times> 2\<^sub>\<nat> \<and> int_of_vint a \<le> int_of_vint b}
[PROOF STEP]
by (rule smaller_than_small[OF small]) auto
[PROOF STATE]
proof (state)
this:
small {[a, b]\<^sub>\<circ> |a b. [a, b]\<^sub>\<circ> \<in>\<^sub>\<circ> \<int>\<^sub>\<circ> ^\<^sub>\<times> 2\<^sub>\<nat> \<and> int_of_vint a \<le> int_of_vint b}

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma rel_restrict_trancl_sub:
  "(rel_restrict A R)\<^sup>+ \<subseteq> rel_restrict (A\<^sup>+) R"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (rel_restrict A R)\<^sup>+ \<subseteq> rel_restrict (A\<^sup>+) R
[PROOF STEP]
by (metis subrelI rel_restrict_trancl_mem)


[STATEMENT]
lemma Poly_append_replicate_0: "Poly (xs @ replicate n 0) = Poly xs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Poly (xs @ replicate n (0::'a)) = Poly xs
[PROOF STEP]
by (subst coeffs_eq_iff) (simp_all add: strip_while_def dropWhile_replicate_append)


[STATEMENT]
lemma interlaced_seq_even:
      "interlaced_seq r s (2*n) = s (interlaced_index r s (2*n))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. interlaced_seq r s (2 * n) = s (interlaced_index r s (2 * n))
[PROOF STEP]
by (simp add: interlaced_seq_def)


[STATEMENT]
theorem TBtheorem2b:
assumes "eoutM PQ M E"
       and "subcomponents PQ = {P,Q}"
       and "correctCompositionOut PQ"
shows    "eoutM P M E \<or> eoutM Q M E"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. eoutM P M E \<or> eoutM Q M E
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
eoutM PQ M E
subcomponents PQ = {P, Q}
correctCompositionOut PQ

goal (1 subgoal):
 1. eoutM P M E \<or> eoutM Q M E
[PROOF STEP]
by (simp add: eoutM_def correctCompositionOut_def, auto)


[STATEMENT]
lemma subspace_Int: "(\<And>i. i \<in> I \<Longrightarrow> subspace (s i)) \<Longrightarrow> subspace (\<Inter>i\<in>I. s i)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>i. i \<in> I \<Longrightarrow> subspace (s i)) \<Longrightarrow> subspace (\<Inter> (s ` I))
[PROOF STEP]
by (auto simp: subspace_def)


[STATEMENT]
lemma iMOD_mem_diff: "\<lbrakk> a \<in> [r, mod m]; b \<in> [r, mod m] \<rbrakk> \<Longrightarrow> (a - b) mod m = 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>a \<in> [ r, mod m ]; b \<in> [ r, mod m ]\<rbrakk> \<Longrightarrow> (a - b) mod m = 0
[PROOF STEP]
by (simp add: iMOD_iff mod_eq_imp_diff_mod_0)


[STATEMENT]
lemma i_aggregate_i_drop_mult: "
  i_aggregate (f \<Up> (n * k)) k ag = i_aggregate f k ag \<Up> n"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. i_aggregate (f \<Up> (n * k)) k ag = i_aggregate f k ag \<Up> n
[PROOF STEP]
by (simp add: ilist_eq_iff i_aggregate_nth add_mult_distrib)


[STATEMENT]
lemma unique_solution_closed_ivl:
  assumes xivp: "D X = (\<lambda>t. f t (X t)) on {t\<^sub>0--t}" "X t\<^sub>0 = s" "X \<in> {t\<^sub>0--t} \<rightarrow> S" and "t \<in> T"
    and yivp: "D Y = (\<lambda>t. f t (Y t)) on {t\<^sub>0--t}" "Y t\<^sub>0 = s" "Y \<in> {t\<^sub>0--t} \<rightarrow> S" and "s \<in> S"
  shows "X t = Y t"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. X t = Y t
[PROOF STEP]
apply(rule unique_solution[OF \<open>s \<in> S\<close>, of "{t\<^sub>0--t}"], simp_all add: assms)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {t\<^sub>0--t} \<subseteq> ex_ivl s
[PROOF STEP]
apply(unfold existence_ivl_def csols_eq ivp_sols_def, clarsimp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. x \<in> {t\<^sub>0--t} \<Longrightarrow> \<exists>a b. b \<in> T \<and> a \<in> {t\<^sub>0--b} \<rightarrow> S \<and>  D a = (\<lambda>x. f x (a x)) on {t\<^sub>0--b} \<and> a t\<^sub>0 = s \<and> x \<in> {t\<^sub>0--b}
[PROOF STEP]
using xivp \<open>t \<in> T\<close>
[PROOF STATE]
proof (prove)
using this:
 D X = (\<lambda>t. f t (X t)) on {t\<^sub>0--t}
X t\<^sub>0 = s
X \<in> {t\<^sub>0--t} \<rightarrow> S
t \<in> T

goal (1 subgoal):
 1. \<And>x. x \<in> {t\<^sub>0--t} \<Longrightarrow> \<exists>a b. b \<in> T \<and> a \<in> {t\<^sub>0--b} \<rightarrow> S \<and>  D a = (\<lambda>x. f x (a x)) on {t\<^sub>0--b} \<and> a t\<^sub>0 = s \<and> x \<in> {t\<^sub>0--b}
[PROOF STEP]
by blast


[STATEMENT]
theorem pure_universal_weak_until_simp:
  assumes "pure_universal \<phi>" and "pure_universal \<psi>"
  shows "w \<Turnstile>\<^sub>n \<phi> W\<^sub>n \<psi> \<longleftrightarrow> w \<Turnstile>\<^sub>n \<phi> or\<^sub>n \<psi>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. w \<Turnstile>\<^sub>n \<phi> W\<^sub>n \<psi> = w \<Turnstile>\<^sub>n \<phi> or\<^sub>n \<psi>
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. w \<Turnstile>\<^sub>n \<phi> W\<^sub>n \<psi> = w \<Turnstile>\<^sub>n \<phi> or\<^sub>n \<psi>
[PROOF STEP]
have "\<And>i. w \<Turnstile>\<^sub>n \<phi> \<Longrightarrow> suffix i w \<Turnstile>\<^sub>n \<phi>" and "\<And>i. w \<Turnstile>\<^sub>n \<psi> \<Longrightarrow> suffix i w \<Turnstile>\<^sub>n \<psi>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>i. w \<Turnstile>\<^sub>n \<phi> \<Longrightarrow> suffix i w \<Turnstile>\<^sub>n \<phi>) &&& (\<And>i. w \<Turnstile>\<^sub>n \<psi> \<Longrightarrow> suffix i w \<Turnstile>\<^sub>n \<psi>)
[PROOF STEP]
using assms pure_universal_suffix_closed prefix_suffix
[PROOF STATE]
proof (prove)
using this:
pure_universal \<phi>
pure_universal \<psi>
\<lbrakk>pure_universal ?\<nu>; (?u \<frown> ?w) \<Turnstile>\<^sub>n ?\<nu>\<rbrakk> \<Longrightarrow> ?w \<Turnstile>\<^sub>n ?\<nu>
?x = prefix ?n ?x \<frown> suffix ?n ?x

goal (1 subgoal):
 1. (\<And>i. w \<Turnstile>\<^sub>n \<phi> \<Longrightarrow> suffix i w \<Turnstile>\<^sub>n \<phi>) &&& (\<And>i. w \<Turnstile>\<^sub>n \<psi> \<Longrightarrow> suffix i w \<Turnstile>\<^sub>n \<psi>)
[PROOF STEP]
by metis+
[PROOF STATE]
proof (state)
this:
w \<Turnstile>\<^sub>n \<phi> \<Longrightarrow> suffix ?i w \<Turnstile>\<^sub>n \<phi>
w \<Turnstile>\<^sub>n \<psi> \<Longrightarrow> suffix ?i w \<Turnstile>\<^sub>n \<psi>

goal (1 subgoal):
 1. w \<Turnstile>\<^sub>n \<phi> W\<^sub>n \<psi> = w \<Turnstile>\<^sub>n \<phi> or\<^sub>n \<psi>
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
w \<Turnstile>\<^sub>n \<phi> \<Longrightarrow> suffix ?i w \<Turnstile>\<^sub>n \<phi>
w \<Turnstile>\<^sub>n \<psi> \<Longrightarrow> suffix ?i w \<Turnstile>\<^sub>n \<psi>

goal (1 subgoal):
 1. w \<Turnstile>\<^sub>n \<phi> W\<^sub>n \<psi> = w \<Turnstile>\<^sub>n \<phi> or\<^sub>n \<psi>
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
w \<Turnstile>\<^sub>n \<phi> W\<^sub>n \<psi> = w \<Turnstile>\<^sub>n \<phi> or\<^sub>n \<psi>

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma times_assoc_eqpoll: "(A \<times> B) \<times> C \<approx> A \<times> (B \<times> C)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (A \<times> B) \<times> C \<approx> A \<times> B \<times> C
[PROOF STEP]
unfolding eqpoll_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>f. bij_betw f ((A \<times> B) \<times> C) (A \<times> B \<times> C)
[PROOF STEP]
by (force intro: bij_betw_byWitness [where f = "\<lambda>((x,y),z). (x,(y,z))" and f' = "\<lambda>(x,(y,z)). ((x,y),z)"])


[STATEMENT]
lemma (in prob_space) indep_events_finite_index_events:
  "indep_events F I \<longleftrightarrow> (\<forall>J\<subseteq>I. J \<noteq> {} \<longrightarrow> finite J \<longrightarrow> indep_events F J)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. indep_events F I = (\<forall>J\<subseteq>I. J \<noteq> {} \<longrightarrow> finite J \<longrightarrow> indep_events F J)
[PROOF STEP]
by (auto simp: indep_events_def)


[STATEMENT]
lemma (in is_functor) cf_arr_cf_comma_ObjMap_app[cat_comma_cs_simps]:
  assumes "A = [a', b', f']\<^sub>\<circ>" and "A \<in>\<^sub>\<circ> c' \<down>\<^sub>C\<^sub>F \<FF>\<lparr>Obj\<rparr>" and "g : c \<mapsto>\<^bsub>\<BB>\<^esub> c'"
  shows "g \<^sub>A\<down>\<^sub>C\<^sub>F \<FF>\<lparr>ObjMap\<rparr>\<lparr>A\<rparr> = [a', b', f' \<circ>\<^sub>A\<^bsub>\<BB>\<^esub> g]\<^sub>\<circ>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. g \<^sub>A\<down>\<^sub>C\<^sub>F \<FF>\<lparr>ObjMap\<rparr>\<lparr>A\<rparr> = [a', b', f' \<circ>\<^sub>A\<^bsub>\<BB>\<^esub> g]\<^sub>\<circ>
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. g \<^sub>A\<down>\<^sub>C\<^sub>F \<FF>\<lparr>ObjMap\<rparr>\<lparr>A\<rparr> = [a', b', f' \<circ>\<^sub>A\<^bsub>\<BB>\<^esub> g]\<^sub>\<circ>
[PROOF STEP]
from assms
[PROOF STATE]
proof (chain)
picking this:
A = [a', b', f']\<^sub>\<circ>
A \<in>\<^sub>\<circ> c' \<down>\<^sub>C\<^sub>F \<FF>\<lparr>Obj\<rparr>
g : c \<mapsto>\<^bsub>\<BB>\<^esub> c'
[PROOF STEP]
have b': "b' \<in>\<^sub>\<circ> \<AA>\<lparr>Obj\<rparr>"
    and f: "f' : c' \<mapsto>\<^bsub>\<BB>\<^esub> \<FF>\<lparr>ObjMap\<rparr>\<lparr>b'\<rparr>"
    and a'_def: "a' = 0"
[PROOF STATE]
proof (prove)
using this:
A = [a', b', f']\<^sub>\<circ>
A \<in>\<^sub>\<circ> c' \<down>\<^sub>C\<^sub>F \<FF>\<lparr>Obj\<rparr>
g : c \<mapsto>\<^bsub>\<BB>\<^esub> c'

goal (1 subgoal):
 1. b' \<in>\<^sub>\<circ> \<AA>\<lparr>Obj\<rparr> &&& f' : c' \<mapsto>\<^bsub>\<BB>\<^esub> \<FF>\<lparr>ObjMap\<rparr>\<lparr>b'\<rparr> &&& a' = []\<^sub>\<circ>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
b' \<in>\<^sub>\<circ> \<AA>\<lparr>Obj\<rparr>
f' : c' \<mapsto>\<^bsub>\<BB>\<^esub> \<FF>\<lparr>ObjMap\<rparr>\<lparr>b'\<rparr>
a' = []\<^sub>\<circ>

goal (1 subgoal):
 1. g \<^sub>A\<down>\<^sub>C\<^sub>F \<FF>\<lparr>ObjMap\<rparr>\<lparr>A\<rparr> = [a', b', f' \<circ>\<^sub>A\<^bsub>\<BB>\<^esub> g]\<^sub>\<circ>
[PROOF STEP]
from assms(2)
[PROOF STATE]
proof (chain)
picking this:
A \<in>\<^sub>\<circ> c' \<down>\<^sub>C\<^sub>F \<FF>\<lparr>Obj\<rparr>
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
A \<in>\<^sub>\<circ> c' \<down>\<^sub>C\<^sub>F \<FF>\<lparr>Obj\<rparr>

goal (1 subgoal):
 1. g \<^sub>A\<down>\<^sub>C\<^sub>F \<FF>\<lparr>ObjMap\<rparr>\<lparr>A\<rparr> = [a', b', f' \<circ>\<^sub>A\<^bsub>\<BB>\<^esub> g]\<^sub>\<circ>
[PROOF STEP]
unfolding cf_arr_cf_comma_components'[OF assms(3)] assms(1)
[PROOF STATE]
proof (prove)
using this:
[a', b', f']\<^sub>\<circ> \<in>\<^sub>\<circ> c' \<down>\<^sub>C\<^sub>F \<FF>\<lparr>Obj\<rparr>

goal (1 subgoal):
 1. (\<lambda>A\<in>\<^sub>\<circ>c' \<down>\<^sub>C\<^sub>F \<FF>\<lparr>Obj\<rparr>. [[]\<^sub>\<circ>, A\<lparr>1\<^sub>\<nat>\<rparr>, A\<lparr>2\<^sub>\<nat>\<rparr> \<circ>\<^sub>A\<^bsub>\<BB>\<^esub> g]\<^sub>\<circ>) \<lparr>a', b', f'\<rparr>\<^sub>\<bullet> = [a', b', f' \<circ>\<^sub>A\<^bsub>\<BB>\<^esub> g]\<^sub>\<circ>
[PROOF STEP]
by (simp add: nat_omega_simps a'_def)
[PROOF STATE]
proof (state)
this:
g \<^sub>A\<down>\<^sub>C\<^sub>F \<FF>\<lparr>ObjMap\<rparr>\<lparr>A\<rparr> = [a', b', f' \<circ>\<^sub>A\<^bsub>\<BB>\<^esub> g]\<^sub>\<circ>

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma (in ring_hom_ring) inj_on_subgroup_iff_trivial_ker:
  assumes "subring K R"
  shows "inj_on h K \<longleftrightarrow> a_kernel (R \<lparr> carrier := K \<rparr>) S h = { \<zero> }"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. inj_on h K = (a_kernel (R\<lparr>carrier := K\<rparr>) S h = {\<zero>})
[PROOF STEP]
using ring_hom_ring.inj_iff_trivial_ker[OF induced_ring_hom[OF assms]]
[PROOF STATE]
proof (prove)
using this:
inj_on h (carrier (R\<lparr>carrier := K\<rparr>)) = (a_kernel (R\<lparr>carrier := K\<rparr>) S h = {\<zero>\<^bsub>R\<lparr>carrier := K\<rparr>\<^esub>})

goal (1 subgoal):
 1. inj_on h K = (a_kernel (R\<lparr>carrier := K\<rparr>) S h = {\<zero>})
[PROOF STEP]
by simp


[STATEMENT]
lemma sum_prod: "(\<Sum>x\<in>A. (f x, g x)) = (\<Sum>x\<in>A. f x, \<Sum>x\<in>A. g x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Sum>x\<in>A. (f x, g x)) = (sum f A, sum g A)
[PROOF STEP]
proof (cases "finite A")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. finite A \<Longrightarrow> (\<Sum>x\<in>A. (f x, g x)) = (sum f A, sum g A)
 2. infinite A \<Longrightarrow> (\<Sum>x\<in>A. (f x, g x)) = (sum f A, sum g A)
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
finite A

goal (2 subgoals):
 1. finite A \<Longrightarrow> (\<Sum>x\<in>A. (f x, g x)) = (sum f A, sum g A)
 2. infinite A \<Longrightarrow> (\<Sum>x\<in>A. (f x, g x)) = (sum f A, sum g A)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
finite A
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
finite A

goal (1 subgoal):
 1. (\<Sum>x\<in>A. (f x, g x)) = (sum f A, sum g A)
[PROOF STEP]
by induct (simp_all add: zero_prod_def)
[PROOF STATE]
proof (state)
this:
(\<Sum>x\<in>A. (f x, g x)) = (sum f A, sum g A)

goal (1 subgoal):
 1. infinite A \<Longrightarrow> (\<Sum>x\<in>A. (f x, g x)) = (sum f A, sum g A)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. infinite A \<Longrightarrow> (\<Sum>x\<in>A. (f x, g x)) = (sum f A, sum g A)
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
infinite A

goal (1 subgoal):
 1. infinite A \<Longrightarrow> (\<Sum>x\<in>A. (f x, g x)) = (sum f A, sum g A)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
infinite A
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
infinite A

goal (1 subgoal):
 1. (\<Sum>x\<in>A. (f x, g x)) = (sum f A, sum g A)
[PROOF STEP]
by (simp add: zero_prod_def)
[PROOF STATE]
proof (state)
this:
(\<Sum>x\<in>A. (f x, g x)) = (sum f A, sum g A)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma weight_0: "(\<Sum>(f, \<pi>) \<in> Z_not_inj. weight f \<pi>) = 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Sum>(x, y)\<in>Z_not_inj. weight x y) = (0::'a)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (\<Sum>(x, y)\<in>Z_not_inj. weight x y) = (0::'a)
[PROOF STEP]
let ?F="{f. (\<forall>i\<in>{0..<n}. f i \<in> {0..<m}) \<and> (\<forall>i. i \<notin> {0..<n} \<longrightarrow> f i = i)}"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (\<Sum>(x, y)\<in>Z_not_inj. weight x y) = (0::'a)
[PROOF STEP]
let ?Perm = "{\<pi>. \<pi> permutes {0..<n}}"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (\<Sum>(x, y)\<in>Z_not_inj. weight x y) = (0::'a)
[PROOF STEP]
have "(\<Sum>(f, \<pi>)\<in>Z_not_inj. weight f \<pi>)
    = (\<Sum>f \<in> F_not_inj. (\<Prod>i = 0..<n. A $$ (i, f i)) * det (mat\<^sub>r n n (\<lambda>i. row B (f i))))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Sum>(x, y)\<in>Z_not_inj. weight x y) = (\<Sum>f\<in>F_not_inj. (\<Prod>i = 0..<n. A $$ (i, f i)) * Determinant.det (mat\<^sub>r n n (\<lambda>i. Matrix.row B (f i))))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (\<Sum>(x, y)\<in>Z_not_inj. weight x y) = (\<Sum>f\<in>F_not_inj. (\<Prod>i = 0..<n. A $$ (i, f i)) * Determinant.det (mat\<^sub>r n n (\<lambda>i. Matrix.row B (f i))))
[PROOF STEP]
have dim_row_rw: "dim_row (mat\<^sub>r n n (\<lambda>i. col A (f i))) = n" for f
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. dim_row (mat\<^sub>r n n (\<lambda>i. col A (f i))) = n
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
dim_row (mat\<^sub>r n n (\<lambda>i. col A (?f i))) = n

goal (1 subgoal):
 1. (\<Sum>(x, y)\<in>Z_not_inj. weight x y) = (\<Sum>f\<in>F_not_inj. (\<Prod>i = 0..<n. A $$ (i, f i)) * Determinant.det (mat\<^sub>r n n (\<lambda>i. Matrix.row B (f i))))
[PROOF STEP]
have dim_row_rw2: "dim_row (mat\<^sub>r n n (\<lambda>i. Matrix.row B (f i))) = n" for f
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. dim_row (mat\<^sub>r n n (\<lambda>i. Matrix.row B (f i))) = n
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
dim_row (mat\<^sub>r n n (\<lambda>i. Matrix.row B (?f i))) = n

goal (1 subgoal):
 1. (\<Sum>(x, y)\<in>Z_not_inj. weight x y) = (\<Sum>f\<in>F_not_inj. (\<Prod>i = 0..<n. A $$ (i, f i)) * Determinant.det (mat\<^sub>r n n (\<lambda>i. Matrix.row B (f i))))
[PROOF STEP]
have prod_rw: "(\<Prod>i = 0..<n. B $$ (f i, \<pi> i)) =  (\<Prod>i = 0..<n. row B (f i) $v \<pi> i)"
      if f: "f \<in> F_not_inj" and pi: "\<pi> \<in> ?Perm" for f \<pi>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Prod>i = 0..<n. B $$ (f i, \<pi> i)) = (\<Prod>i = 0..<n. Matrix.row B (f i) $v \<pi> i)
[PROOF STEP]
proof (rule prod.cong, rule refl)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x. x \<in> {0..<n} \<Longrightarrow> B $$ (f x, \<pi> x) = Matrix.row B (f x) $v \<pi> x
[PROOF STEP]
fix x
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x. x \<in> {0..<n} \<Longrightarrow> B $$ (f x, \<pi> x) = Matrix.row B (f x) $v \<pi> x
[PROOF STEP]
assume x: "x \<in> {0..<n}"
[PROOF STATE]
proof (state)
this:
x \<in> {0..<n}

goal (1 subgoal):
 1. \<And>x. x \<in> {0..<n} \<Longrightarrow> B $$ (f x, \<pi> x) = Matrix.row B (f x) $v \<pi> x
[PROOF STEP]
have "f x < dim_row B"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. f x < dim_row B
[PROOF STEP]
using f B x
[PROOF STATE]
proof (prove)
using this:
f \<in> F_not_inj
B \<in> carrier_mat m n
x \<in> {0..<n}

goal (1 subgoal):
 1. f x < dim_row B
[PROOF STEP]
unfolding F_not_inj_def
[PROOF STATE]
proof (prove)
using this:
f \<in> {f \<in> {0..<n} \<rightarrow> {0..<m}. (\<forall>i. i \<notin> {0..<n} \<longrightarrow> f i = i) \<and> \<not> inj_on f {0..<n}}
B \<in> carrier_mat m n
x \<in> {0..<n}

goal (1 subgoal):
 1. f x < dim_row B
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
f x < dim_row B

goal (1 subgoal):
 1. \<And>x. x \<in> {0..<n} \<Longrightarrow> B $$ (f x, \<pi> x) = Matrix.row B (f x) $v \<pi> x
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
f x < dim_row B

goal (1 subgoal):
 1. \<And>x. x \<in> {0..<n} \<Longrightarrow> B $$ (f x, \<pi> x) = Matrix.row B (f x) $v \<pi> x
[PROOF STEP]
have "\<pi> x < dim_col B"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<pi> x < dim_col B
[PROOF STEP]
using x pi B
[PROOF STATE]
proof (prove)
using this:
x \<in> {0..<n}
\<pi> \<in> {\<pi>. \<pi> permutes {0..<n}}
B \<in> carrier_mat m n

goal (1 subgoal):
 1. \<pi> x < dim_col B
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<pi> x < dim_col B

goal (1 subgoal):
 1. \<And>x. x \<in> {0..<n} \<Longrightarrow> B $$ (f x, \<pi> x) = Matrix.row B (f x) $v \<pi> x
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
f x < dim_row B
\<pi> x < dim_col B
[PROOF STEP]
show "B $$ (f x, \<pi> x) = Matrix.row B (f x) $v \<pi> x"
[PROOF STATE]
proof (prove)
using this:
f x < dim_row B
\<pi> x < dim_col B

goal (1 subgoal):
 1. B $$ (f x, \<pi> x) = Matrix.row B (f x) $v \<pi> x
[PROOF STEP]
by (rule index_row[symmetric])
[PROOF STATE]
proof (state)
this:
B $$ (f x, \<pi> x) = Matrix.row B (f x) $v \<pi> x

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>?f \<in> F_not_inj; ?\<pi> \<in> {\<pi>. \<pi> permutes {0..<n}}\<rbrakk> \<Longrightarrow> (\<Prod>i = 0..<n. B $$ (?f i, ?\<pi> i)) = (\<Prod>i = 0..<n. Matrix.row B (?f i) $v ?\<pi> i)

goal (1 subgoal):
 1. (\<Sum>(x, y)\<in>Z_not_inj. weight x y) = (\<Sum>f\<in>F_not_inj. (\<Prod>i = 0..<n. A $$ (i, f i)) * Determinant.det (mat\<^sub>r n n (\<lambda>i. Matrix.row B (f i))))
[PROOF STEP]
have sum_rw: "(\<Sum>\<pi> | \<pi> permutes {0..<n}. signof \<pi> * (\<Prod>i = 0..<n. B $$ (f i, \<pi> i)))
      = det (mat\<^sub>r n n (\<lambda>i. row B (f i)))" if f: "f \<in> F_not_inj" for f
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Sum>\<pi> | \<pi> permutes {0..<n}. of_int (sign \<pi>) * (\<Prod>i = 0..<n. B $$ (f i, \<pi> i))) = Determinant.det (mat\<^sub>r n n (\<lambda>i. Matrix.row B (f i)))
[PROOF STEP]
unfolding Determinant.det_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Sum>\<pi> | \<pi> permutes {0..<n}. of_int (sign \<pi>) * (\<Prod>i = 0..<n. B $$ (f i, \<pi> i))) = (if dim_row (mat\<^sub>r n n (\<lambda>i. Matrix.row B (f i))) = dim_col (mat\<^sub>r n n (\<lambda>i. Matrix.row B (f i))) then \<Sum>p | p permutes {0..<dim_row (mat\<^sub>r n n (\<lambda>i. Matrix.row B (f i)))}. of_int (sign p) * (\<Prod>i = 0..<dim_row (mat\<^sub>r n n (\<lambda>i. Matrix.row B (f i))). mat\<^sub>r n n (\<lambda>i. Matrix.row B (f i)) $$ (i, p i)) else (0::'a))
[PROOF STEP]
using dim_row_rw2 prod_rw f
[PROOF STATE]
proof (prove)
using this:
dim_row (mat\<^sub>r n n (\<lambda>i. Matrix.row B (?f i))) = n
\<lbrakk>?f \<in> F_not_inj; ?\<pi> \<in> {\<pi>. \<pi> permutes {0..<n}}\<rbrakk> \<Longrightarrow> (\<Prod>i = 0..<n. B $$ (?f i, ?\<pi> i)) = (\<Prod>i = 0..<n. Matrix.row B (?f i) $v ?\<pi> i)
f \<in> F_not_inj

goal (1 subgoal):
 1. (\<Sum>\<pi> | \<pi> permutes {0..<n}. of_int (sign \<pi>) * (\<Prod>i = 0..<n. B $$ (f i, \<pi> i))) = (if dim_row (mat\<^sub>r n n (\<lambda>i. Matrix.row B (f i))) = dim_col (mat\<^sub>r n n (\<lambda>i. Matrix.row B (f i))) then \<Sum>p | p permutes {0..<dim_row (mat\<^sub>r n n (\<lambda>i. Matrix.row B (f i)))}. of_int (sign p) * (\<Prod>i = 0..<dim_row (mat\<^sub>r n n (\<lambda>i. Matrix.row B (f i))). mat\<^sub>r n n (\<lambda>i. Matrix.row B (f i)) $$ (i, p i)) else (0::'a))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
?f \<in> F_not_inj \<Longrightarrow> (\<Sum>\<pi> | \<pi> permutes {0..<n}. of_int (sign \<pi>) * (\<Prod>i = 0..<n. B $$ (?f i, \<pi> i))) = Determinant.det (mat\<^sub>r n n (\<lambda>i. Matrix.row B (?f i)))

goal (1 subgoal):
 1. (\<Sum>(x, y)\<in>Z_not_inj. weight x y) = (\<Sum>f\<in>F_not_inj. (\<Prod>i = 0..<n. A $$ (i, f i)) * Determinant.det (mat\<^sub>r n n (\<lambda>i. Matrix.row B (f i))))
[PROOF STEP]
have "(\<Sum>(f, \<pi>)\<in>Z_not_inj. weight f \<pi>) = (\<Sum>f\<in>F_not_inj.\<Sum>\<pi> \<in> ?Perm. weight f \<pi>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Sum>(x, y)\<in>Z_not_inj. weight x y) = (\<Sum>f\<in>F_not_inj. \<Sum>\<pi> | \<pi> permutes {0..<n}. weight f \<pi>)
[PROOF STEP]
unfolding Z_not_inj_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Sum>(x, y)\<in>{f \<in> {0..<n} \<rightarrow> {0..<m}. (\<forall>i. i \<notin> {0..<n} \<longrightarrow> f i = i) \<and> \<not> inj_on f {0..<n}} \<times> {\<pi>. \<pi> permutes {0..<n}}. weight x y) = (\<Sum>f\<in>F_not_inj. \<Sum>\<pi> | \<pi> permutes {0..<n}. weight f \<pi>)
[PROOF STEP]
unfolding sum.cartesian_product
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Sum>(x, y)\<in>{f \<in> {0..<n} \<rightarrow> {0..<m}. (\<forall>i. i \<notin> {0..<n} \<longrightarrow> f i = i) \<and> \<not> inj_on f {0..<n}} \<times> {\<pi>. \<pi> permutes {0..<n}}. weight x y) = (\<Sum>(x, y)\<in>F_not_inj \<times> {\<pi>. \<pi> permutes {0..<n}}. weight x y)
[PROOF STEP]
unfolding F_not_inj_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Sum>(x, y)\<in>{f \<in> {0..<n} \<rightarrow> {0..<m}. (\<forall>i. i \<notin> {0..<n} \<longrightarrow> f i = i) \<and> \<not> inj_on f {0..<n}} \<times> {\<pi>. \<pi> permutes {0..<n}}. weight x y) = (\<Sum>(x, y)\<in>{f \<in> {0..<n} \<rightarrow> {0..<m}. (\<forall>i. i \<notin> {0..<n} \<longrightarrow> f i = i) \<and> \<not> inj_on f {0..<n}} \<times> {\<pi>. \<pi> permutes {0..<n}}. weight x y)
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
(\<Sum>(x, y)\<in>Z_not_inj. weight x y) = (\<Sum>f\<in>F_not_inj. \<Sum>\<pi> | \<pi> permutes {0..<n}. weight f \<pi>)

goal (1 subgoal):
 1. (\<Sum>(x, y)\<in>Z_not_inj. weight x y) = (\<Sum>f\<in>F_not_inj. (\<Prod>i = 0..<n. A $$ (i, f i)) * Determinant.det (mat\<^sub>r n n (\<lambda>i. Matrix.row B (f i))))
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(\<Sum>(x, y)\<in>Z_not_inj. weight x y) = (\<Sum>f\<in>F_not_inj. \<Sum>\<pi> | \<pi> permutes {0..<n}. weight f \<pi>)

goal (1 subgoal):
 1. (\<Sum>(x, y)\<in>Z_not_inj. weight x y) = (\<Sum>f\<in>F_not_inj. (\<Prod>i = 0..<n. A $$ (i, f i)) * Determinant.det (mat\<^sub>r n n (\<lambda>i. Matrix.row B (f i))))
[PROOF STEP]
have "... = (\<Sum>f\<in>F_not_inj. \<Sum>\<pi> | \<pi> permutes {0..<n}. signof \<pi>
      * (\<Prod>i = 0..<n. A $$ (i, f i) * B $$ (f i, \<pi> i)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Sum>f\<in>F_not_inj. \<Sum>\<pi> | \<pi> permutes {0..<n}. weight f \<pi>) = (\<Sum>f\<in>F_not_inj. \<Sum>\<pi> | \<pi> permutes {0..<n}. of_int (sign \<pi>) * (\<Prod>i = 0..<n. A $$ (i, f i) * B $$ (f i, \<pi> i)))
[PROOF STEP]
unfolding weight_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Sum>f\<in>F_not_inj. \<Sum>\<pi> | \<pi> permutes {0..<n}. of_int (sign \<pi>) * (\<Prod>i = 0..<n. A $$ (i, f i) * B $$ (f i, \<pi> i))) = (\<Sum>f\<in>F_not_inj. \<Sum>\<pi> | \<pi> permutes {0..<n}. of_int (sign \<pi>) * (\<Prod>i = 0..<n. A $$ (i, f i) * B $$ (f i, \<pi> i)))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
(\<Sum>f\<in>F_not_inj. \<Sum>\<pi> | \<pi> permutes {0..<n}. weight f \<pi>) = (\<Sum>f\<in>F_not_inj. \<Sum>\<pi> | \<pi> permutes {0..<n}. of_int (sign \<pi>) * (\<Prod>i = 0..<n. A $$ (i, f i) * B $$ (f i, \<pi> i)))

goal (1 subgoal):
 1. (\<Sum>(x, y)\<in>Z_not_inj. weight x y) = (\<Sum>f\<in>F_not_inj. (\<Prod>i = 0..<n. A $$ (i, f i)) * Determinant.det (mat\<^sub>r n n (\<lambda>i. Matrix.row B (f i))))
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(\<Sum>f\<in>F_not_inj. \<Sum>\<pi> | \<pi> permutes {0..<n}. weight f \<pi>) = (\<Sum>f\<in>F_not_inj. \<Sum>\<pi> | \<pi> permutes {0..<n}. of_int (sign \<pi>) * (\<Prod>i = 0..<n. A $$ (i, f i) * B $$ (f i, \<pi> i)))

goal (1 subgoal):
 1. (\<Sum>(x, y)\<in>Z_not_inj. weight x y) = (\<Sum>f\<in>F_not_inj. (\<Prod>i = 0..<n. A $$ (i, f i)) * Determinant.det (mat\<^sub>r n n (\<lambda>i. Matrix.row B (f i))))
[PROOF STEP]
have "... = (\<Sum>f\<in>F_not_inj. (\<Prod>i = 0..<n. A $$ (i, f i))
      * (\<Sum>\<pi> | \<pi> permutes {0..<n}. signof \<pi> * (\<Prod>i = 0..<n. B $$ (f i, \<pi> i))))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Sum>f\<in>F_not_inj. \<Sum>\<pi> | \<pi> permutes {0..<n}. of_int (sign \<pi>) * (\<Prod>i = 0..<n. A $$ (i, f i) * B $$ (f i, \<pi> i))) = (\<Sum>f\<in>F_not_inj. (\<Prod>i = 0..<n. A $$ (i, f i)) * (\<Sum>\<pi> | \<pi> permutes {0..<n}. of_int (sign \<pi>) * (\<Prod>i = 0..<n. B $$ (f i, \<pi> i))))
[PROOF STEP]
by (rule sum.cong, rule refl, auto)
         (metis (no_types, lifting) mult.left_commute mult_hom.hom_sum sum.cong)
[PROOF STATE]
proof (state)
this:
(\<Sum>f\<in>F_not_inj. \<Sum>\<pi> | \<pi> permutes {0..<n}. of_int (sign \<pi>) * (\<Prod>i = 0..<n. A $$ (i, f i) * B $$ (f i, \<pi> i))) = (\<Sum>f\<in>F_not_inj. (\<Prod>i = 0..<n. A $$ (i, f i)) * (\<Sum>\<pi> | \<pi> permutes {0..<n}. of_int (sign \<pi>) * (\<Prod>i = 0..<n. B $$ (f i, \<pi> i))))

goal (1 subgoal):
 1. (\<Sum>(x, y)\<in>Z_not_inj. weight x y) = (\<Sum>f\<in>F_not_inj. (\<Prod>i = 0..<n. A $$ (i, f i)) * Determinant.det (mat\<^sub>r n n (\<lambda>i. Matrix.row B (f i))))
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(\<Sum>f\<in>F_not_inj. \<Sum>\<pi> | \<pi> permutes {0..<n}. of_int (sign \<pi>) * (\<Prod>i = 0..<n. A $$ (i, f i) * B $$ (f i, \<pi> i))) = (\<Sum>f\<in>F_not_inj. (\<Prod>i = 0..<n. A $$ (i, f i)) * (\<Sum>\<pi> | \<pi> permutes {0..<n}. of_int (sign \<pi>) * (\<Prod>i = 0..<n. B $$ (f i, \<pi> i))))

goal (1 subgoal):
 1. (\<Sum>(x, y)\<in>Z_not_inj. weight x y) = (\<Sum>f\<in>F_not_inj. (\<Prod>i = 0..<n. A $$ (i, f i)) * Determinant.det (mat\<^sub>r n n (\<lambda>i. Matrix.row B (f i))))
[PROOF STEP]
have "... = (\<Sum>f \<in> F_not_inj. (\<Prod>i = 0..<n. A $$ (i, f i))
      * det (mat\<^sub>r n n (\<lambda>i. row B (f i))))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Sum>f\<in>F_not_inj. (\<Prod>i = 0..<n. A $$ (i, f i)) * (\<Sum>\<pi> | \<pi> permutes {0..<n}. of_int (sign \<pi>) * (\<Prod>i = 0..<n. B $$ (f i, \<pi> i)))) = (\<Sum>f\<in>F_not_inj. (\<Prod>i = 0..<n. A $$ (i, f i)) * Determinant.det (mat\<^sub>r n n (\<lambda>i. Matrix.row B (f i))))
[PROOF STEP]
using sum_rw
[PROOF STATE]
proof (prove)
using this:
?f \<in> F_not_inj \<Longrightarrow> (\<Sum>\<pi> | \<pi> permutes {0..<n}. of_int (sign \<pi>) * (\<Prod>i = 0..<n. B $$ (?f i, \<pi> i))) = Determinant.det (mat\<^sub>r n n (\<lambda>i. Matrix.row B (?f i)))

goal (1 subgoal):
 1. (\<Sum>f\<in>F_not_inj. (\<Prod>i = 0..<n. A $$ (i, f i)) * (\<Sum>\<pi> | \<pi> permutes {0..<n}. of_int (sign \<pi>) * (\<Prod>i = 0..<n. B $$ (f i, \<pi> i)))) = (\<Sum>f\<in>F_not_inj. (\<Prod>i = 0..<n. A $$ (i, f i)) * Determinant.det (mat\<^sub>r n n (\<lambda>i. Matrix.row B (f i))))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<Sum>f\<in>F_not_inj. (\<Prod>i = 0..<n. A $$ (i, f i)) * (\<Sum>\<pi> | \<pi> permutes {0..<n}. of_int (sign \<pi>) * (\<Prod>i = 0..<n. B $$ (f i, \<pi> i)))) = (\<Sum>f\<in>F_not_inj. (\<Prod>i = 0..<n. A $$ (i, f i)) * Determinant.det (mat\<^sub>r n n (\<lambda>i. Matrix.row B (f i))))

goal (1 subgoal):
 1. (\<Sum>(x, y)\<in>Z_not_inj. weight x y) = (\<Sum>f\<in>F_not_inj. (\<Prod>i = 0..<n. A $$ (i, f i)) * Determinant.det (mat\<^sub>r n n (\<lambda>i. Matrix.row B (f i))))
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
(\<Sum>(x, y)\<in>Z_not_inj. weight x y) = (\<Sum>f\<in>F_not_inj. (\<Prod>i = 0..<n. A $$ (i, f i)) * Determinant.det (mat\<^sub>r n n (\<lambda>i. Matrix.row B (f i))))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
(\<Sum>(x, y)\<in>Z_not_inj. weight x y) = (\<Sum>f\<in>F_not_inj. (\<Prod>i = 0..<n. A $$ (i, f i)) * Determinant.det (mat\<^sub>r n n (\<lambda>i. Matrix.row B (f i))))

goal (1 subgoal):
 1. (\<Sum>(x, y)\<in>Z_not_inj. weight x y) = (\<Sum>f\<in>F_not_inj. (\<Prod>i = 0..<n. A $$ (i, f i)) * Determinant.det (mat\<^sub>r n n (\<lambda>i. Matrix.row B (f i))))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<Sum>(x, y)\<in>Z_not_inj. weight x y) = (\<Sum>f\<in>F_not_inj. (\<Prod>i = 0..<n. A $$ (i, f i)) * Determinant.det (mat\<^sub>r n n (\<lambda>i. Matrix.row B (f i))))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
(\<Sum>(x, y)\<in>Z_not_inj. weight x y) = (\<Sum>f\<in>F_not_inj. (\<Prod>i = 0..<n. A $$ (i, f i)) * Determinant.det (mat\<^sub>r n n (\<lambda>i. Matrix.row B (f i))))

goal (1 subgoal):
 1. (\<Sum>(x, y)\<in>Z_not_inj. weight x y) = (0::'a)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(\<Sum>(x, y)\<in>Z_not_inj. weight x y) = (\<Sum>f\<in>F_not_inj. (\<Prod>i = 0..<n. A $$ (i, f i)) * Determinant.det (mat\<^sub>r n n (\<lambda>i. Matrix.row B (f i))))

goal (1 subgoal):
 1. (\<Sum>(x, y)\<in>Z_not_inj. weight x y) = (0::'a)
[PROOF STEP]
have "... = 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Sum>f\<in>F_not_inj. (\<Prod>i = 0..<n. A $$ (i, f i)) * Determinant.det (mat\<^sub>r n n (\<lambda>i. Matrix.row B (f i)))) = (0::'a)
[PROOF STEP]
by (rule sum.neutral, insert det_not_inj_on[of _ n B], auto simp add: F_not_inj_def)
[PROOF STATE]
proof (state)
this:
(\<Sum>f\<in>F_not_inj. (\<Prod>i = 0..<n. A $$ (i, f i)) * Determinant.det (mat\<^sub>r n n (\<lambda>i. Matrix.row B (f i)))) = (0::'a)

goal (1 subgoal):
 1. (\<Sum>(x, y)\<in>Z_not_inj. weight x y) = (0::'a)
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
(\<Sum>(x, y)\<in>Z_not_inj. weight x y) = (0::'a)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
(\<Sum>(x, y)\<in>Z_not_inj. weight x y) = (0::'a)

goal (1 subgoal):
 1. (\<Sum>(x, y)\<in>Z_not_inj. weight x y) = (0::'a)
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
(\<Sum>(x, y)\<in>Z_not_inj. weight x y) = (0::'a)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma (in vec_space) rank_gt_minor:
assumes "A \<in> carrier_mat n nc"
assumes "det (submatrix A I J) \<noteq> 0"
shows "card {j. j < nc \<and> j \<in> J} \<le> rank A"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. card {j. j < nc \<and> j \<in> J} \<le> rank A
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. card {j. j < nc \<and> j \<in> J} \<le> rank A
[PROOF STEP]
have square:"dim_row (submatrix A I J) = dim_col (submatrix A I J)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. dim_row (submatrix A I J) = dim_col (submatrix A I J)
[PROOF STEP]
using det_def \<open>det (submatrix A I J) \<noteq> 0\<close>
[PROOF STATE]
proof (prove)
using this:
det ?A = (if dim_row ?A = dim_col ?A then \<Sum>p | p permutes {0..<dim_row ?A}. of_int (sign p) * (\<Prod>i = 0..<dim_row ?A. ?A $$ (i, p i)) else (0::?'a))
det (submatrix A I J) \<noteq> (0::'a)

goal (1 subgoal):
 1. dim_row (submatrix A I J) = dim_col (submatrix A I J)
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
dim_row (submatrix A I J) = dim_col (submatrix A I J)

goal (1 subgoal):
 1. card {j. j < nc \<and> j \<in> J} \<le> rank A
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
dim_row (submatrix A I J) = dim_col (submatrix A I J)
[PROOF STEP]
have full_rank:"vec_space.rank (dim_row (submatrix A I J)) (submatrix A I J) = dim_row (submatrix A I J)"
[PROOF STATE]
proof (prove)
using this:
dim_row (submatrix A I J) = dim_col (submatrix A I J)

goal (1 subgoal):
 1. vec_space.rank (dim_row (submatrix A I J)) (submatrix A I J) = dim_row (submatrix A I J)
[PROOF STEP]
using vec_space.low_rank_det_zero assms(2) carrier_matI
[PROOF STATE]
proof (prove)
using this:
dim_row (submatrix A I J) = dim_col (submatrix A I J)
\<lbrakk>?A \<in> carrier_mat ?n ?n; det ?A \<noteq> (0::?'a)\<rbrakk> \<Longrightarrow> vec_space.rank ?n ?A = ?n
det (submatrix A I J) \<noteq> (0::'a)
\<lbrakk>dim_row ?A = ?nr; dim_col ?A = ?nc\<rbrakk> \<Longrightarrow> ?A \<in> carrier_mat ?nr ?nc

goal (1 subgoal):
 1. vec_space.rank (dim_row (submatrix A I J)) (submatrix A I J) = dim_row (submatrix A I J)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
vec_space.rank (dim_row (submatrix A I J)) (submatrix A I J) = dim_row (submatrix A I J)

goal (1 subgoal):
 1. card {j. j < nc \<and> j \<in> J} \<le> rank A
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
vec_space.rank (dim_row (submatrix A I J)) (submatrix A I J) = dim_row (submatrix A I J)
[PROOF STEP]
have distinct:"distinct (cols (submatrix A I J))"
[PROOF STATE]
proof (prove)
using this:
vec_space.rank (dim_row (submatrix A I J)) (submatrix A I J) = dim_row (submatrix A I J)

goal (1 subgoal):
 1. distinct (cols (submatrix A I J))
[PROOF STEP]
using vec_space.non_distinct_low_rank square less_irrefl carrier_matI
[PROOF STATE]
proof (prove)
using this:
vec_space.rank (dim_row (submatrix A I J)) (submatrix A I J) = dim_row (submatrix A I J)
\<lbrakk>?A \<in> carrier_mat ?n ?n; \<not> distinct (cols ?A)\<rbrakk> \<Longrightarrow> vec_space.rank ?n ?A < ?n
dim_row (submatrix A I J) = dim_col (submatrix A I J)
\<not> ?x < ?x
\<lbrakk>dim_row ?A = ?nr; dim_col ?A = ?nc\<rbrakk> \<Longrightarrow> ?A \<in> carrier_mat ?nr ?nc

goal (1 subgoal):
 1. distinct (cols (submatrix A I J))
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
distinct (cols (submatrix A I J))

goal (1 subgoal):
 1. card {j. j < nc \<and> j \<in> J} \<le> rank A
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
distinct (cols (submatrix A I J))
[PROOF STEP]
have indpt:"LinearCombinations.module.lin_indpt class_ring (module_vec TYPE('a) (dim_row (submatrix A I J))) (set (cols (submatrix A I J)))"
[PROOF STATE]
proof (prove)
using this:
distinct (cols (submatrix A I J))

goal (1 subgoal):
 1. \<not> module.lin_dep class_ring (module_vec TYPE('a) (dim_row (submatrix A I J))) (set (cols (submatrix A I J)))
[PROOF STEP]
using vec_space.full_rank_lin_indpt[OF _ full_rank distinct] square
[PROOF STATE]
proof (prove)
using this:
distinct (cols (submatrix A I J))
submatrix A I J \<in> carrier_mat (dim_row (submatrix A I J)) (dim_row (submatrix A I J)) \<Longrightarrow> \<not> module.lin_dep class_ring (module_vec TYPE('a) (dim_row (submatrix A I J))) (set (cols (submatrix A I J)))
dim_row (submatrix A I J) = dim_col (submatrix A I J)

goal (1 subgoal):
 1. \<not> module.lin_dep class_ring (module_vec TYPE('a) (dim_row (submatrix A I J))) (set (cols (submatrix A I J)))
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
\<not> module.lin_dep class_ring (module_vec TYPE('a) (dim_row (submatrix A I J))) (set (cols (submatrix A I J)))

goal (1 subgoal):
 1. card {j. j < nc \<and> j \<in> J} \<le> rank A
[PROOF STEP]
have distinct2: "distinct (cols (submatrix (submatrix A UNIV J) I UNIV))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. distinct (cols (submatrix (submatrix A UNIV J) I UNIV))
[PROOF STEP]
using submatrix_split distinct
[PROOF STATE]
proof (prove)
using this:
submatrix ?A ?I ?J = submatrix (submatrix ?A UNIV ?J) ?I UNIV
distinct (cols (submatrix A I J))

goal (1 subgoal):
 1. distinct (cols (submatrix (submatrix A UNIV J) I UNIV))
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
distinct (cols (submatrix (submatrix A UNIV J) I UNIV))

goal (1 subgoal):
 1. card {j. j < nc \<and> j \<in> J} \<le> rank A
[PROOF STEP]
have indpt2:"LinearCombinations.module.lin_indpt class_ring (module_vec TYPE('a) (card {i. i < n \<and> i \<in> I})) (set (cols (submatrix (submatrix A UNIV J) I UNIV)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> module.lin_dep class_ring (module_vec TYPE('a) (card {i. i < n \<and> i \<in> I})) (set (cols (submatrix (submatrix A UNIV J) I UNIV)))
[PROOF STEP]
using submatrix_split dim_submatrix(1) indpt
[PROOF STATE]
proof (prove)
using this:
submatrix ?A ?I ?J = submatrix (submatrix ?A UNIV ?J) ?I UNIV
dim_row (submatrix ?A ?I ?J) = card {i. i < dim_row ?A \<and> i \<in> ?I}
\<not> module.lin_dep class_ring (module_vec TYPE('a) (dim_row (submatrix A I J))) (set (cols (submatrix A I J)))

goal (1 subgoal):
 1. \<not> module.lin_dep class_ring (module_vec TYPE('a) (card {i. i < n \<and> i \<in> I})) (set (cols (submatrix (submatrix A UNIV J) I UNIV)))
[PROOF STEP]
by (metis (full_types) assms(1) carrier_matD(1))
[PROOF STATE]
proof (state)
this:
\<not> module.lin_dep class_ring (module_vec TYPE('a) (card {i. i < n \<and> i \<in> I})) (set (cols (submatrix (submatrix A UNIV J) I UNIV)))

goal (1 subgoal):
 1. card {j. j < nc \<and> j \<in> J} \<le> rank A
[PROOF STEP]
have "submatrix A UNIV J \<in> carrier_mat n (dim_col (submatrix A UNIV J))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. submatrix A UNIV J \<in> carrier_mat n (dim_col (submatrix A UNIV J))
[PROOF STEP]
apply (rule carrier_matI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. dim_row (submatrix A UNIV J) = n
 2. dim_col (submatrix A UNIV J) = dim_col (submatrix A UNIV J)
[PROOF STEP]
unfolding dim_submatrix(1)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. card {i. i < dim_row A \<and> i \<in> UNIV} = n
 2. dim_col (submatrix A UNIV J) = dim_col (submatrix A UNIV J)
[PROOF STEP]
using \<open>A \<in> carrier_mat n nc\<close> carrier_matD
[PROOF STATE]
proof (prove)
using this:
A \<in> carrier_mat n nc
?A \<in> carrier_mat ?nr ?nc \<Longrightarrow> dim_row ?A = ?nr
?A \<in> carrier_mat ?nr ?nc \<Longrightarrow> dim_col ?A = ?nc

goal (2 subgoals):
 1. card {i. i < dim_row A \<and> i \<in> UNIV} = n
 2. dim_col (submatrix A UNIV J) = dim_col (submatrix A UNIV J)
[PROOF STEP]
by simp_all
[PROOF STATE]
proof (state)
this:
submatrix A UNIV J \<in> carrier_mat n (dim_col (submatrix A UNIV J))

goal (1 subgoal):
 1. card {j. j < nc \<and> j \<in> J} \<le> rank A
[PROOF STEP]
have "lin_indpt (set (cols (submatrix A UNIV J)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. lin_indpt (set (cols (submatrix A UNIV J)))
[PROOF STEP]
using indpt2 vec_space.lin_dep_submatrix_UNIV[OF \<open>submatrix A UNIV J \<in> carrier_mat n (dim_col (submatrix A UNIV J))\<close> _ distinct2]
[PROOF STATE]
proof (prove)
using this:
\<not> module.lin_dep class_ring (module_vec TYPE('a) (card {i. i < n \<and> i \<in> I})) (set (cols (submatrix (submatrix A UNIV J) I UNIV)))
lin_dep (set (cols (submatrix A UNIV J))) \<Longrightarrow> module.lin_dep class_ring (module_vec TYPE('a) (card {i. i < n \<and> i \<in> I})) (set (cols (submatrix (submatrix A UNIV J) I UNIV)))

goal (1 subgoal):
 1. lin_indpt (set (cols (submatrix A UNIV J)))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
lin_indpt (set (cols (submatrix A UNIV J)))

goal (1 subgoal):
 1. card {j. j < nc \<and> j \<in> J} \<le> rank A
[PROOF STEP]
have distinct3:"distinct (cols (submatrix A UNIV J))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. distinct (cols (submatrix A UNIV J))
[PROOF STEP]
by (metis distinct distinct_cols_submatrix_UNIV submatrix_split)
[PROOF STATE]
proof (state)
this:
distinct (cols (submatrix A UNIV J))

goal (1 subgoal):
 1. card {j. j < nc \<and> j \<in> J} \<le> rank A
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. card {j. j < nc \<and> j \<in> J} \<le> rank A
[PROOF STEP]
using
    rank_ge_card_indpt[OF \<open>A \<in> carrier_mat n nc\<close> cols_submatrix_subset \<open>lin_indpt (set (cols (submatrix A UNIV J)))\<close>,
    unfolded distinct_card[OF distinct3, unfolded cols_length dim_submatrix], unfolded carrier_matD(2)[OF \<open>A \<in> carrier_mat n nc\<close>]]
[PROOF STATE]
proof (prove)
using this:
card {j. j < nc \<and> j \<in> J} \<le> rank A

goal (1 subgoal):
 1. card {j. j < nc \<and> j \<in> J} \<le> rank A
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
card {j. j < nc \<and> j \<in> J} \<le> rank A

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma coeff_MPoly_monomial[simp]:
  \<open>(MPoly_Type.coeff (MPoly (monomial a m)) m) = a\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. MPoly_Type.coeff (MPoly (monomial a m)) m = a
[PROOF STEP]
by (metis MPoly_Type.coeff_def lookup_single_eq monom.abs_eq monom.rep_eq)


[STATEMENT]
lemma foldr_funion_fempty : "foldr (|\<union>|) xs fempty = ffUnion (fset_of_list xs)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. foldr (|\<union>|) xs {||} = ffUnion (fset_of_list xs)
[PROOF STEP]
by (induction xs; auto)


[STATEMENT]
lemma Qp_poly_mapE:
  assumes "is_poly_tuple n fs"
  assumes "length fs = m"
  assumes "as \<in> carrier (Q\<^sub>p\<^bsup>n\<^esup>)"
  assumes "j < m"
  shows "(poly_map n fs as)!j \<in> carrier Q\<^sub>p"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. poly_map n fs as ! j \<in> carrier Q\<^sub>p
[PROOF STEP]
using assms  poly_map_closed cartesian_power_car_memE'
[PROOF STATE]
proof (prove)
using this:
is_poly_tuple n fs
length fs = m
as \<in> carrier (Q\<^sub>p\<^bsup>n\<^esup>)
j < m
\<lbrakk>is_poly_tuple ?n ?fs; length ?fs = ?m; ?as \<in> carrier (Q\<^sub>p\<^bsup>?n\<^esup>)\<rbrakk> \<Longrightarrow> poly_map ?n ?fs ?as \<in> carrier (Q\<^sub>p\<^bsup>?m\<^esup>)
\<lbrakk>?as \<in> carrier (?R\<^bsup>?n\<^esup>); ?i < ?n\<rbrakk> \<Longrightarrow> ?as ! ?i \<in> carrier ?R

goal (1 subgoal):
 1. poly_map n fs as ! j \<in> carrier Q\<^sub>p
[PROOF STEP]
by blast


[STATEMENT]
lemma residue_primroot_is_generator:
  assumes "m > 1" and "residue_primroot m g"
  shows   "bij_betw (\<lambda>i. g ^ i mod m) {..<totient m} (totatives m)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. bij_betw (\<lambda>i. g ^ i mod m) {..<totient m} (totatives m)
[PROOF STEP]
unfolding bij_betw_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. inj_on (\<lambda>i. g ^ i mod m) {..<totient m} \<and> (\<lambda>i. g ^ i mod m) ` {..<totient m} = totatives m
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. inj_on (\<lambda>i. g ^ i mod m) {..<totient m}
 2. (\<lambda>i. g ^ i mod m) ` {..<totient m} = totatives m
[PROOF STEP]
from assms
[PROOF STATE]
proof (chain)
picking this:
1 < m
residue_primroot m g
[PROOF STEP]
have [simp]: "ord m g = totient m"
[PROOF STATE]
proof (prove)
using this:
1 < m
residue_primroot m g

goal (1 subgoal):
 1. ord m g = totient m
[PROOF STEP]
by (simp add: residue_primroot_def)
[PROOF STATE]
proof (state)
this:
ord m g = totient m

goal (2 subgoals):
 1. inj_on (\<lambda>i. g ^ i mod m) {..<totient m}
 2. (\<lambda>i. g ^ i mod m) ` {..<totient m} = totatives m
[PROOF STEP]
from assms
[PROOF STATE]
proof (chain)
picking this:
1 < m
residue_primroot m g
[PROOF STEP]
have "coprime m g"
[PROOF STATE]
proof (prove)
using this:
1 < m
residue_primroot m g

goal (1 subgoal):
 1. coprime m g
[PROOF STEP]
by (simp add: residue_primroot_def)
[PROOF STATE]
proof (state)
this:
coprime m g

goal (2 subgoals):
 1. inj_on (\<lambda>i. g ^ i mod m) {..<totient m}
 2. (\<lambda>i. g ^ i mod m) ` {..<totient m} = totatives m
[PROOF STEP]
hence "inj_on (\<lambda>i. g ^ i mod m) {..<ord m g}"
[PROOF STATE]
proof (prove)
using this:
coprime m g

goal (1 subgoal):
 1. inj_on (\<lambda>i. g ^ i mod m) {..<ord m g}
[PROOF STEP]
by (intro inj_power_mod)
[PROOF STATE]
proof (state)
this:
inj_on (\<lambda>i. g ^ i mod m) {..<ord m g}

goal (2 subgoals):
 1. inj_on (\<lambda>i. g ^ i mod m) {..<totient m}
 2. (\<lambda>i. g ^ i mod m) ` {..<totient m} = totatives m
[PROOF STEP]
thus inj: "inj_on (\<lambda>i. g ^ i mod m) {..<totient m}"
[PROOF STATE]
proof (prove)
using this:
inj_on (\<lambda>i. g ^ i mod m) {..<ord m g}

goal (1 subgoal):
 1. inj_on (\<lambda>i. g ^ i mod m) {..<totient m}
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
inj_on (\<lambda>i. g ^ i mod m) {..<totient m}

goal (1 subgoal):
 1. (\<lambda>i. g ^ i mod m) ` {..<totient m} = totatives m
[PROOF STEP]
show "(\<lambda>i. g ^ i mod m) ` {..<totient m} = totatives m"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lambda>i. g ^ i mod m) ` {..<totient m} = totatives m
[PROOF STEP]
proof (rule card_subset_eq)
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. finite (totatives m)
 2. (\<lambda>i. g ^ i mod m) ` {..<totient m} \<subseteq> totatives m
 3. card ((\<lambda>i. g ^ i mod m) ` {..<totient m}) = card (totatives m)
[PROOF STEP]
show "card ((\<lambda>i. g ^ i mod m) ` {..<totient m}) = card (totatives m)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. card ((\<lambda>i. g ^ i mod m) ` {..<totient m}) = card (totatives m)
[PROOF STEP]
using inj
[PROOF STATE]
proof (prove)
using this:
inj_on (\<lambda>i. g ^ i mod m) {..<totient m}

goal (1 subgoal):
 1. card ((\<lambda>i. g ^ i mod m) ` {..<totient m}) = card (totatives m)
[PROOF STEP]
by (subst card_image) (auto simp: totient_def)
[PROOF STATE]
proof (state)
this:
card ((\<lambda>i. g ^ i mod m) ` {..<totient m}) = card (totatives m)

goal (2 subgoals):
 1. finite (totatives m)
 2. (\<lambda>i. g ^ i mod m) ` {..<totient m} \<subseteq> totatives m
[PROOF STEP]
show "(\<lambda>i. g ^ i mod m) ` {..<totient m} \<subseteq> totatives m"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lambda>i. g ^ i mod m) ` {..<totient m} \<subseteq> totatives m
[PROOF STEP]
using \<open>m > 1\<close> \<open>coprime m g\<close> power_in_totatives[of m g]
[PROOF STATE]
proof (prove)
using this:
1 < m
coprime m g
\<lbrakk>1 < m; coprime m g\<rbrakk> \<Longrightarrow> g ^ ?i mod m \<in> totatives m

goal (1 subgoal):
 1. (\<lambda>i. g ^ i mod m) ` {..<totient m} \<subseteq> totatives m
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(\<lambda>i. g ^ i mod m) ` {..<totient m} \<subseteq> totatives m

goal (1 subgoal):
 1. finite (totatives m)
[PROOF STEP]
qed auto
[PROOF STATE]
proof (state)
this:
(\<lambda>i. g ^ i mod m) ` {..<totient m} = totatives m

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma has_integral_vec1_nth_cbox:
  fixes f :: "real \<Rightarrow> 'a::real_normed_vector"
  assumes "(f has_integral y) {a..b}"
  shows "((\<lambda>x::real^1. f(x$1)) has_integral y) (cbox (vec a) (vec b))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<lambda>x. f (x $ 1)) has_integral y) (cbox (vec a) (vec b))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. ((\<lambda>x. f (x $ 1)) has_integral y) (cbox (vec a) (vec b))
[PROOF STEP]
have "((\<lambda>x::real^1. f(x$1)) has_integral (1 / 1) *\<^sub>R y) (vec ` cbox a b)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<lambda>x. f (x $ 1)) has_integral (1 / 1) *\<^sub>R y) (vec ` cbox a b)
[PROOF STEP]
proof (rule has_integral_twiddle)
[PROOF STATE]
proof (state)
goal (8 subgoals):
 1. 0 < 1
 2. \<And>x. vec (x $ 1) = x
 3. \<And>x. vec x $ 1 = x
 4. \<And>x. isCont (\<lambda>x. x $ 1) x
 5. \<And>u v. \<exists>w z. (\<lambda>x. x $ 1) ` cbox u v = cbox w z
 6. \<And>u v. \<exists>w z. vec ` cbox u v = cbox w z
 7. \<And>u v. content ((\<lambda>x. x $ 1) ` cbox u v) = 1 * content (cbox u v)
 8. (f has_integral y) (cbox a b)
[PROOF STEP]
show "\<exists>w z::real. (\<lambda>x. x $ 1) ` cbox u v = cbox w z"
         "content ((\<lambda>x. x $ 1) ` cbox u v) = 1 * content (cbox u v)" for u v::"real^1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>w z. (\<lambda>x. x $ 1) ` cbox u v = cbox w z &&& content ((\<lambda>x. x $ 1) ` cbox u v) = 1 * content (cbox u v)
[PROOF STEP]
unfolding vec_cbox_1_eq
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>w z. (\<lambda>x. x $ 1) ` cbox u v = cbox w z &&& content ((\<lambda>x. x $ 1) ` cbox u v) = 1 * content (cbox u v)
[PROOF STEP]
by (auto simp: content_cbox_if_cart interval_eq_empty_cart)
[PROOF STATE]
proof (state)
this:
\<exists>w z. (\<lambda>x. x $ 1) ` cbox ?u ?v = cbox w z
content ((\<lambda>x. x $ 1) ` cbox ?u ?v) = 1 * content (cbox ?u ?v)

goal (6 subgoals):
 1. 0 < 1
 2. \<And>x. vec (x $ 1) = x
 3. \<And>x. vec x $ 1 = x
 4. \<And>x. isCont (\<lambda>x. x $ 1) x
 5. \<And>u v. \<exists>w z. vec ` cbox u v = cbox w z
 6. (f has_integral y) (cbox a b)
[PROOF STEP]
show "\<exists>w z::real^1. vec ` cbox u v = cbox w z" for u v :: "real"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>w z. vec ` cbox u v = cbox w z
[PROOF STEP]
using vec_cbox_1_eq
[PROOF STATE]
proof (prove)
using this:
vec ` cbox ?u ?v = cbox (vec ?u) (vec ?v)

goal (1 subgoal):
 1. \<exists>w z. vec ` cbox u v = cbox w z
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<exists>w z. vec ` cbox ?u ?v = cbox w z

goal (5 subgoals):
 1. 0 < 1
 2. \<And>x. vec (x $ 1) = x
 3. \<And>x. vec x $ 1 = x
 4. \<And>x. isCont (\<lambda>x. x $ 1) x
 5. (f has_integral y) (cbox a b)
[PROOF STEP]
qed (auto simp: continuous_vec assms)
[PROOF STATE]
proof (state)
this:
((\<lambda>x. f (x $ 1)) has_integral (1 / 1) *\<^sub>R y) (vec ` cbox a b)

goal (1 subgoal):
 1. ((\<lambda>x. f (x $ 1)) has_integral y) (cbox (vec a) (vec b))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
((\<lambda>x. f (x $ 1)) has_integral (1 / 1) *\<^sub>R y) (vec ` cbox a b)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
((\<lambda>x. f (x $ 1)) has_integral (1 / 1) *\<^sub>R y) (vec ` cbox a b)

goal (1 subgoal):
 1. ((\<lambda>x. f (x $ 1)) has_integral y) (cbox (vec a) (vec b))
[PROOF STEP]
using vec_cbox_1_eq
[PROOF STATE]
proof (prove)
using this:
((\<lambda>x. f (x $ 1)) has_integral (1 / 1) *\<^sub>R y) (vec ` cbox a b)
vec ` cbox ?u ?v = cbox (vec ?u) (vec ?v)

goal (1 subgoal):
 1. ((\<lambda>x. f (x $ 1)) has_integral y) (cbox (vec a) (vec b))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
((\<lambda>x. f (x $ 1)) has_integral y) (cbox (vec a) (vec b))

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma div_Suc: "
  0 < n \<Longrightarrow> Suc m div n = (if Suc (m mod n) = n then Suc (m div n) else m div n)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 < n \<Longrightarrow> Suc m div n = (if Suc (m mod n) = n then Suc (m div n) else m div n)
[PROOF STEP]
apply (drule Suc_leI, drule le_imp_less_or_eq)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Suc 0 < n \<or> Suc 0 = n \<Longrightarrow> Suc m div n = (if Suc (m mod n) = n then Suc (m div n) else m div n)
[PROOF STEP]
apply (case_tac "n = Suc 0", simp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Suc 0 < n \<or> Suc 0 = n; n \<noteq> Suc 0\<rbrakk> \<Longrightarrow> Suc m div n = (if Suc (m mod n) = n then Suc (m div n) else m div n)
[PROOF STEP]
apply (split if_split, intro conjI impI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>Suc 0 < n \<or> Suc 0 = n; n \<noteq> Suc 0; Suc (m mod n) = n\<rbrakk> \<Longrightarrow> Suc m div n = Suc (m div n)
 2. \<lbrakk>Suc 0 < n \<or> Suc 0 = n; n \<noteq> Suc 0; Suc (m mod n) \<noteq> n\<rbrakk> \<Longrightarrow> Suc m div n = m div n
[PROOF STEP]
apply (rule_tac t="Suc m" and s="m + 1" in subst, simp)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>Suc 0 < n \<or> Suc 0 = n; n \<noteq> Suc 0; Suc (m mod n) = n\<rbrakk> \<Longrightarrow> (m + 1) div n = Suc (m div n)
 2. \<lbrakk>Suc 0 < n \<or> Suc 0 = n; n \<noteq> Suc 0; Suc (m mod n) \<noteq> n\<rbrakk> \<Longrightarrow> Suc m div n = m div n
[PROOF STEP]
apply (subst div_add1_eq2, simp+)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Suc 0 < n; Suc (m mod n) \<noteq> n\<rbrakk> \<Longrightarrow> Suc m div n = m div n
[PROOF STEP]
apply (insert le_neq_trans[OF mod_less_divisor[THEN Suc_leI, of n m]], simp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Suc (m mod n) < n \<Longrightarrow> Suc m div n = m div n
[PROOF STEP]
apply (rule_tac t="Suc m" and s="m + 1" in subst, simp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Suc (m mod n) < n \<Longrightarrow> (m + 1) div n = m div n
[PROOF STEP]
apply (subst div_add1_eq1, simp+)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma insertion_Var [simp]: "insertion f (Var i) = f i"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. insertion f (Var i) = f i
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. insertion f (Var i) = f i
[PROOF STEP]
have "insertion f (Var i) = (\<Sum>m. (1 when m = Poly_Mapping.single i 1) *
                                       (\<Prod>i. f i ^ lookup m i))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. insertion f (Var i) = (\<Sum>m. ((1::'a) when m = Poly_Mapping.single i 1) * (\<Prod>i. f i ^ lookup m i))
[PROOF STEP]
by (simp add: insertion_altdef coeff_Var)
[PROOF STATE]
proof (state)
this:
insertion f (Var i) = (\<Sum>m. ((1::'a) when m = Poly_Mapping.single i 1) * (\<Prod>i. f i ^ lookup m i))

goal (1 subgoal):
 1. insertion f (Var i) = f i
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
insertion f (Var i) = (\<Sum>m. ((1::'a) when m = Poly_Mapping.single i 1) * (\<Prod>i. f i ^ lookup m i))

goal (1 subgoal):
 1. insertion f (Var i) = f i
[PROOF STEP]
have "\<dots> = (\<Prod>j. f j ^ lookup (Poly_Mapping.single i 1) j)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Sum>m. ((1::'a) when m = Poly_Mapping.single i 1) * (\<Prod>i. f i ^ lookup m i)) = (\<Prod>j. f j ^ lookup (Poly_Mapping.single i 1) j)
[PROOF STEP]
by (subst Sum_any.expand_superset[of "{Poly_Mapping.single i 1}"]) (auto simp: when_def)
[PROOF STATE]
proof (state)
this:
(\<Sum>m. ((1::'a) when m = Poly_Mapping.single i 1) * (\<Prod>i. f i ^ lookup m i)) = (\<Prod>j. f j ^ lookup (Poly_Mapping.single i 1) j)

goal (1 subgoal):
 1. insertion f (Var i) = f i
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(\<Sum>m. ((1::'a) when m = Poly_Mapping.single i 1) * (\<Prod>i. f i ^ lookup m i)) = (\<Prod>j. f j ^ lookup (Poly_Mapping.single i 1) j)

goal (1 subgoal):
 1. insertion f (Var i) = f i
[PROOF STEP]
have "\<dots> = f i"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Prod>j. f j ^ lookup (Poly_Mapping.single i 1) j) = f i
[PROOF STEP]
by (subst Prod_any.expand_superset[of "{i}"]) (auto simp: when_def lookup_single)
[PROOF STATE]
proof (state)
this:
(\<Prod>j. f j ^ lookup (Poly_Mapping.single i 1) j) = f i

goal (1 subgoal):
 1. insertion f (Var i) = f i
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
insertion f (Var i) = f i
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
insertion f (Var i) = f i

goal (1 subgoal):
 1. insertion f (Var i) = f i
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
insertion f (Var i) = f i

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma prod_in_Rats [intro]: "(\<And>x. x \<in> A \<Longrightarrow> f x \<in> \<rat>) \<Longrightarrow> prod f A \<in> \<rat>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>x. x \<in> A \<Longrightarrow> f x \<in> \<rat>) \<Longrightarrow> prod f A \<in> \<rat>
[PROOF STEP]
by (induction A rule: infinite_finite_induct) auto


[STATEMENT]
lemma i_f_join_length: "finite I \<Longrightarrow> length (f \<Join>\<^bsub>i-f\<^esub> I) = card I"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. finite I \<Longrightarrow> length (f \<Join>\<^sub> I) = card I
[PROOF STEP]
apply (simp add: i_f_join_def f_join_length)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. finite I \<Longrightarrow> card (I \<down>< Suc (Max I)) = card I
[PROOF STEP]
apply (simp add: nat_cut_le_less_conv[symmetric] cut_le_Max_all)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma (in comm_monoid) finprod_one':
  "(\<And> a. a \<in> A \<Longrightarrow> f a = \<one>) \<Longrightarrow> finprod G f A = \<one>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>a. a \<in> A \<Longrightarrow> f a = \<one>) \<Longrightarrow> finprod G f A = \<one>
[PROOF STEP]
by (induct A rule: infinite_finite_induct, auto)


[STATEMENT]
lemma const_in_smallo_const [simp]: "(\<lambda>_. b) \<in> o(\<lambda>_ :: _ :: linorder. c) \<longleftrightarrow> b = 0" (is "?lhs \<longleftrightarrow> ?rhs")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<lambda>_. b) \<in> o(\<lambda>_. c)) = (b = (0::'b))
[PROOF STEP]
by (cases "b = 0"; cases "c = 0") (simp_all add: landau_o.small_refl_iff)


[STATEMENT]
lemma gbinomial_index_swap:
  "((-1) ^ k) * ((- (of_nat n) - 1) gchoose k) = ((-1) ^ n) * ((- (of_nat k) - 1) gchoose n)"
  (is "?lhs = ?rhs")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (- (1::'a)) ^ k * (- of_nat n - (1::'a) gchoose k) = (- (1::'a)) ^ n * (- of_nat k - (1::'a) gchoose n)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (- (1::'a)) ^ k * (- of_nat n - (1::'a) gchoose k) = (- (1::'a)) ^ n * (- of_nat k - (1::'a) gchoose n)
[PROOF STEP]
have "?lhs = (of_nat (k + n) gchoose k)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (- (1::'a)) ^ k * (- of_nat n - (1::'a) gchoose k) = of_nat (k + n) gchoose k
[PROOF STEP]
by (subst gbinomial_negated_upper) (simp add: power_mult_distrib [symmetric])
[PROOF STATE]
proof (state)
this:
(- (1::'a)) ^ k * (- of_nat n - (1::'a) gchoose k) = of_nat (k + n) gchoose k

goal (1 subgoal):
 1. (- (1::'a)) ^ k * (- of_nat n - (1::'a) gchoose k) = (- (1::'a)) ^ n * (- of_nat k - (1::'a) gchoose n)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(- (1::'a)) ^ k * (- of_nat n - (1::'a) gchoose k) = of_nat (k + n) gchoose k

goal (1 subgoal):
 1. (- (1::'a)) ^ k * (- of_nat n - (1::'a) gchoose k) = (- (1::'a)) ^ n * (- of_nat k - (1::'a) gchoose n)
[PROOF STEP]
have "\<dots> = (of_nat (k + n) gchoose n)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. of_nat (k + n) gchoose k = of_nat (k + n) gchoose n
[PROOF STEP]
by (subst gbinomial_of_nat_symmetric) simp_all
[PROOF STATE]
proof (state)
this:
of_nat (k + n) gchoose k = of_nat (k + n) gchoose n

goal (1 subgoal):
 1. (- (1::'a)) ^ k * (- of_nat n - (1::'a) gchoose k) = (- (1::'a)) ^ n * (- of_nat k - (1::'a) gchoose n)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
of_nat (k + n) gchoose k = of_nat (k + n) gchoose n

goal (1 subgoal):
 1. (- (1::'a)) ^ k * (- of_nat n - (1::'a) gchoose k) = (- (1::'a)) ^ n * (- of_nat k - (1::'a) gchoose n)
[PROOF STEP]
have "\<dots> = ?rhs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. of_nat (k + n) gchoose n = (- (1::'a)) ^ n * (- of_nat k - (1::'a) gchoose n)
[PROOF STEP]
by (subst gbinomial_negated_upper) simp
[PROOF STATE]
proof (state)
this:
of_nat (k + n) gchoose n = (- (1::'a)) ^ n * (- of_nat k - (1::'a) gchoose n)

goal (1 subgoal):
 1. (- (1::'a)) ^ k * (- of_nat n - (1::'a) gchoose k) = (- (1::'a)) ^ n * (- of_nat k - (1::'a) gchoose n)
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
(- (1::'a)) ^ k * (- of_nat n - (1::'a) gchoose k) = (- (1::'a)) ^ n * (- of_nat k - (1::'a) gchoose n)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
(- (1::'a)) ^ k * (- of_nat n - (1::'a) gchoose k) = (- (1::'a)) ^ n * (- of_nat k - (1::'a) gchoose n)

goal (1 subgoal):
 1. (- (1::'a)) ^ k * (- of_nat n - (1::'a) gchoose k) = (- (1::'a)) ^ n * (- of_nat k - (1::'a) gchoose n)
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
(- (1::'a)) ^ k * (- of_nat n - (1::'a) gchoose k) = (- (1::'a)) ^ n * (- of_nat k - (1::'a) gchoose n)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma the_enat_eSuc: "n \<noteq> \<infinity> \<Longrightarrow> the_enat (eSuc n) = Suc (the_enat n)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. n \<noteq> \<infinity> \<Longrightarrow> the_enat (eSuc n) = Suc (the_enat n)
[PROOF STEP]
by(cases n)(simp_all add: eSuc_enat)


[STATEMENT]
lemma join_above2: "compatible x y \<Longrightarrow> y \<sqsubseteq> x \<squnion> y"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. compatible x y \<Longrightarrow> y \<sqsubseteq> x \<squnion> y
[PROOF STEP]
unfolding compatible_def join_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Ex ((<<|) {x, y}) \<Longrightarrow> y \<sqsubseteq> (if Ex ((<<|) {x, y}) then lub {x, y} else x)
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>xa. {x, y} <<| xa \<Longrightarrow> y \<sqsubseteq> lub {x, y}
[PROOF STEP]
by (metis is_lubD1 is_ub_insert lub_eqI)


[STATEMENT]
lemma qbs_integrable_sq[simp]:
  assumes "qbs_integrable s f"
      and "qbs_integrable s (\<lambda>x. (f x)\<^sup>2)"
    shows "qbs_integrable s (\<lambda>x. (f x - c)\<^sup>2)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. qbs_integrable s (\<lambda>x. (f x - c)\<^sup>2)
[PROOF STEP]
by(simp add: comm_ring_1_class.power2_diff,rule qbs_integrable_diff,rule qbs_integrable_add)
    (simp_all add: comm_semiring_1_class.semiring_normalization_rules(16)[of 2] assms)


[STATEMENT]
lemma right_associated_sum:
  "O w (x \<oplus> (y \<oplus> z)) \<longleftrightarrow> O w x \<or> (O w y \<or> O w z)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. O w (x \<oplus> (y \<oplus> z)) = (O w x \<or> O w y \<or> O w z)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. O w (x \<oplus> (y \<oplus> z)) = (O w x \<or> O w y \<or> O w z)
[PROOF STEP]
from sum_character
[PROOF STATE]
proof (chain)
picking this:
\<forall>w. O w (?x \<oplus> ?y) = (O w ?x \<or> O w ?y)
[PROOF STEP]
have "O w (y \<oplus> z) \<longleftrightarrow> O w y \<or> O w z"
[PROOF STATE]
proof (prove)
using this:
\<forall>w. O w (?x \<oplus> ?y) = (O w ?x \<or> O w ?y)

goal (1 subgoal):
 1. O w (y \<oplus> z) = (O w y \<or> O w z)
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
O w (y \<oplus> z) = (O w y \<or> O w z)

goal (1 subgoal):
 1. O w (x \<oplus> (y \<oplus> z)) = (O w x \<or> O w y \<or> O w z)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
O w (y \<oplus> z) = (O w y \<or> O w z)

goal (1 subgoal):
 1. O w (x \<oplus> (y \<oplus> z)) = (O w x \<or> O w y \<or> O w z)
[PROOF STEP]
from sum_character
[PROOF STATE]
proof (chain)
picking this:
\<forall>w. O w (?x \<oplus> ?y) = (O w ?x \<or> O w ?y)
[PROOF STEP]
have
    "O w (x \<oplus> (y \<oplus> z)) \<longleftrightarrow> (O w x \<or> O w (y \<oplus> z))"
[PROOF STATE]
proof (prove)
using this:
\<forall>w. O w (?x \<oplus> ?y) = (O w ?x \<or> O w ?y)

goal (1 subgoal):
 1. O w (x \<oplus> (y \<oplus> z)) = (O w x \<or> O w (y \<oplus> z))
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
O w (x \<oplus> (y \<oplus> z)) = (O w x \<or> O w (y \<oplus> z))

goal (1 subgoal):
 1. O w (x \<oplus> (y \<oplus> z)) = (O w x \<or> O w y \<or> O w z)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
O w (y \<oplus> z) = (O w y \<or> O w z)
O w (x \<oplus> (y \<oplus> z)) = (O w x \<or> O w (y \<oplus> z))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
O w (y \<oplus> z) = (O w y \<or> O w z)
O w (x \<oplus> (y \<oplus> z)) = (O w x \<or> O w (y \<oplus> z))

goal (1 subgoal):
 1. O w (x \<oplus> (y \<oplus> z)) = (O w x \<or> O w y \<or> O w z)
[PROOF STEP]
by (rule subst)
[PROOF STATE]
proof (state)
this:
O w (x \<oplus> (y \<oplus> z)) = (O w x \<or> O w y \<or> O w z)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma app_vimage_set_def: "r `\<^sub>\<circ> A = set {b. \<exists>a\<in>\<^sub>\<circ>A. \<langle>a, b\<rangle> \<in>\<^sub>\<circ> r}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. r `\<^sub>\<circ> A = set {b. \<exists>a\<in>elts A. \<langle>a, b\<rangle> \<in>\<^sub>\<circ> r}
[PROOF STEP]
unfolding vimage_def vrange_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lambda>\<langle>r, A\<rangle>\<in>\<^sub>\<circ>set {\<langle>r, A\<rangle>}. (\<lambda>r\<in>\<^sub>\<circ>set {r \<restriction>\<^sup>l\<^sub>\<circ> A}. set {b. \<exists>a. \<langle>a, b\<rangle> \<in>\<^sub>\<circ> r})\<lparr>r \<restriction>\<^sup>l\<^sub>\<circ> A\<rparr>)\<lparr>\<langle>r, A\<rangle>\<rparr> = set {b. \<exists>a\<in>elts A. \<langle>a, b\<rangle> \<in>\<^sub>\<circ> r}
[PROOF STEP]
by auto


[STATEMENT]
lemma sublist_split: \<open>lo \<le> hi \<Longrightarrow> lo < p \<Longrightarrow> p < hi \<Longrightarrow> hi < length xs \<Longrightarrow> sublist xs lo p @ sublist xs (p+1) hi = sublist xs lo hi\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>lo \<le> hi; lo < p; p < hi; hi < length xs\<rbrakk> \<Longrightarrow> WB_Sort.sublist xs lo p @ WB_Sort.sublist xs (p + 1) hi = WB_Sort.sublist xs lo hi
[PROOF STEP]
by (simp add: sublist_app)


[STATEMENT]
lemma bij_betw_exp_times_self_atLeastAtMost:
  fixes a b :: real
  assumes "a \<ge> -1" "a \<le> b"
  shows   "bij_betw (\<lambda>x. x * exp x) {a..b} {a * exp a..b * exp b}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. bij_betw (\<lambda>x. x * exp x) {a..b} {a * exp a..b * exp b}
[PROOF STEP]
unfolding bij_betw_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. inj_on (\<lambda>x. x * exp x) {a..b} \<and> (\<lambda>x. x * exp x) ` {a..b} = {a * exp a..b * exp b}
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. inj_on (\<lambda>x. x * exp x) {a..b}
 2. (\<lambda>x. x * exp x) ` {a..b} = {a * exp a..b * exp b}
[PROOF STEP]
show "inj_on (\<lambda>x. x * exp x) {a..b}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. inj_on (\<lambda>x. x * exp x) {a..b}
[PROOF STEP]
by (rule inj_on_subset[OF exp_times_self_inj]) (use assms in auto)
[PROOF STATE]
proof (state)
this:
inj_on (\<lambda>x. x * exp x) {a..b}

goal (1 subgoal):
 1. (\<lambda>x. x * exp x) ` {a..b} = {a * exp a..b * exp b}
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (\<lambda>x. x * exp x) ` {a..b} = {a * exp a..b * exp b}
[PROOF STEP]
show "(\<lambda>x. x * exp x) ` {a..b} = {a * exp a..b * exp b}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lambda>x. x * exp x) ` {a..b} = {a * exp a..b * exp b}
[PROOF STEP]
proof safe
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>x xa. xa \<in> {a..b} \<Longrightarrow> xa * exp xa \<in> {a * exp a..b * exp b}
 2. \<And>x. x \<in> {a * exp a..b * exp b} \<Longrightarrow> x \<in> (\<lambda>x. x * exp x) ` {a..b}
[PROOF STEP]
fix x
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>x xa. xa \<in> {a..b} \<Longrightarrow> xa * exp xa \<in> {a * exp a..b * exp b}
 2. \<And>x. x \<in> {a * exp a..b * exp b} \<Longrightarrow> x \<in> (\<lambda>x. x * exp x) ` {a..b}
[PROOF STEP]
assume "x \<in> {a..b}"
[PROOF STATE]
proof (state)
this:
x \<in> {a..b}

goal (2 subgoals):
 1. \<And>x xa. xa \<in> {a..b} \<Longrightarrow> xa * exp xa \<in> {a * exp a..b * exp b}
 2. \<And>x. x \<in> {a * exp a..b * exp b} \<Longrightarrow> x \<in> (\<lambda>x. x * exp x) ` {a..b}
[PROOF STEP]
thus "x * exp x \<in> {a * exp a..b * exp b}"
[PROOF STATE]
proof (prove)
using this:
x \<in> {a..b}

goal (1 subgoal):
 1. x * exp x \<in> {a * exp a..b * exp b}
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
x \<in> {a..b}
- 1 \<le> a
a \<le> b

goal (1 subgoal):
 1. x * exp x \<in> {a * exp a..b * exp b}
[PROOF STEP]
by (auto intro!: exp_times_self_mono)
[PROOF STATE]
proof (state)
this:
x * exp x \<in> {a * exp a..b * exp b}

goal (1 subgoal):
 1. \<And>x. x \<in> {a * exp a..b * exp b} \<Longrightarrow> x \<in> (\<lambda>x. x * exp x) ` {a..b}
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x. x \<in> {a * exp a..b * exp b} \<Longrightarrow> x \<in> (\<lambda>x. x * exp x) ` {a..b}
[PROOF STEP]
fix x
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x. x \<in> {a * exp a..b * exp b} \<Longrightarrow> x \<in> (\<lambda>x. x * exp x) ` {a..b}
[PROOF STEP]
assume x: "x \<in> {a * exp a..b * exp b}"
[PROOF STATE]
proof (state)
this:
x \<in> {a * exp a..b * exp b}

goal (1 subgoal):
 1. \<And>x. x \<in> {a * exp a..b * exp b} \<Longrightarrow> x \<in> (\<lambda>x. x * exp x) ` {a..b}
[PROOF STEP]
have "(-1) * exp (-1) \<le> a * exp a"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. - 1 * exp (- 1) \<le> a * exp a
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
- 1 \<le> a
a \<le> b

goal (1 subgoal):
 1. - 1 * exp (- 1) \<le> a * exp a
[PROOF STEP]
by (intro exp_times_self_mono) auto
[PROOF STATE]
proof (state)
this:
- 1 * exp (- 1) \<le> a * exp a

goal (1 subgoal):
 1. \<And>x. x \<in> {a * exp a..b * exp b} \<Longrightarrow> x \<in> (\<lambda>x. x * exp x) ` {a..b}
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
- 1 * exp (- 1) \<le> a * exp a

goal (1 subgoal):
 1. \<And>x. x \<in> {a * exp a..b * exp b} \<Longrightarrow> x \<in> (\<lambda>x. x * exp x) ` {a..b}
[PROOF STEP]
have "\<dots> \<le> x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. a * exp a \<le> x
[PROOF STEP]
using x
[PROOF STATE]
proof (prove)
using this:
x \<in> {a * exp a..b * exp b}

goal (1 subgoal):
 1. a * exp a \<le> x
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
a * exp a \<le> x

goal (1 subgoal):
 1. \<And>x. x \<in> {a * exp a..b * exp b} \<Longrightarrow> x \<in> (\<lambda>x. x * exp x) ` {a..b}
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
- 1 * exp (- 1) \<le> x
[PROOF STEP]
have "x \<ge> -exp (-1)"
[PROOF STATE]
proof (prove)
using this:
- 1 * exp (- 1) \<le> x

goal (1 subgoal):
 1. - exp (- 1) \<le> x
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
- exp (- 1) \<le> x

goal (1 subgoal):
 1. \<And>x. x \<in> {a * exp a..b * exp b} \<Longrightarrow> x \<in> (\<lambda>x. x * exp x) ` {a..b}
[PROOF STEP]
have "Lambert_W x \<in> {a..b}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Lambert_W x \<in> {a..b}
[PROOF STEP]
using x \<open>x \<ge> -exp (-1)\<close> assms
[PROOF STATE]
proof (prove)
using this:
x \<in> {a * exp a..b * exp b}
- exp (- 1) \<le> x
- 1 \<le> a
a \<le> b

goal (1 subgoal):
 1. Lambert_W x \<in> {a..b}
[PROOF STEP]
by (auto intro!: Lambert_W_geI Lambert_W_leI)
[PROOF STATE]
proof (state)
this:
Lambert_W x \<in> {a..b}

goal (1 subgoal):
 1. \<And>x. x \<in> {a * exp a..b * exp b} \<Longrightarrow> x \<in> (\<lambda>x. x * exp x) ` {a..b}
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
Lambert_W x \<in> {a..b}

goal (1 subgoal):
 1. \<And>x. x \<in> {a * exp a..b * exp b} \<Longrightarrow> x \<in> (\<lambda>x. x * exp x) ` {a..b}
[PROOF STEP]
have "Lambert_W x * exp (Lambert_W x) = x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Lambert_W x * exp (Lambert_W x) = x
[PROOF STEP]
using \<open>x \<ge> -exp (-1)\<close>
[PROOF STATE]
proof (prove)
using this:
- exp (- 1) \<le> x

goal (1 subgoal):
 1. Lambert_W x * exp (Lambert_W x) = x
[PROOF STEP]
by (simp add: Lambert_W_times_exp_self)
[PROOF STATE]
proof (state)
this:
Lambert_W x * exp (Lambert_W x) = x

goal (1 subgoal):
 1. \<And>x. x \<in> {a * exp a..b * exp b} \<Longrightarrow> x \<in> (\<lambda>x. x * exp x) ` {a..b}
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
Lambert_W x \<in> {a..b}
Lambert_W x * exp (Lambert_W x) = x
[PROOF STEP]
show "x \<in> (\<lambda>x. x * exp x) ` {a..b}"
[PROOF STATE]
proof (prove)
using this:
Lambert_W x \<in> {a..b}
Lambert_W x * exp (Lambert_W x) = x

goal (1 subgoal):
 1. x \<in> (\<lambda>x. x * exp x) ` {a..b}
[PROOF STEP]
unfolding image_iff
[PROOF STATE]
proof (prove)
using this:
Lambert_W x \<in> {a..b}
Lambert_W x * exp (Lambert_W x) = x

goal (1 subgoal):
 1. \<exists>xa\<in>{a..b}. x = xa * exp xa
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
x \<in> (\<lambda>x. x * exp x) ` {a..b}

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
(\<lambda>x. x * exp x) ` {a..b} = {a * exp a..b * exp b}

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma smallest_prime_beyond_eval:
  "prime n \<Longrightarrow> smallest_prime_beyond n = n"
  "\<not>prime n \<Longrightarrow> smallest_prime_beyond n = smallest_prime_beyond (Suc n)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (prime n \<Longrightarrow> smallest_prime_beyond n = n) &&& (\<not> prime n \<Longrightarrow> smallest_prime_beyond n = smallest_prime_beyond (Suc n))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. prime n \<Longrightarrow> smallest_prime_beyond n = n
 2. \<not> prime n \<Longrightarrow> smallest_prime_beyond n = smallest_prime_beyond (Suc n)
[PROOF STEP]
assume "prime n"
[PROOF STATE]
proof (state)
this:
prime n

goal (2 subgoals):
 1. prime n \<Longrightarrow> smallest_prime_beyond n = n
 2. \<not> prime n \<Longrightarrow> smallest_prime_beyond n = smallest_prime_beyond (Suc n)
[PROOF STEP]
thus "smallest_prime_beyond n = n"
[PROOF STATE]
proof (prove)
using this:
prime n

goal (1 subgoal):
 1. smallest_prime_beyond n = n
[PROOF STEP]
by (rule smallest_prime_beyond_eq) auto
[PROOF STATE]
proof (state)
this:
smallest_prime_beyond n = n

goal (1 subgoal):
 1. \<not> prime n \<Longrightarrow> smallest_prime_beyond n = smallest_prime_beyond (Suc n)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> prime n \<Longrightarrow> smallest_prime_beyond n = smallest_prime_beyond (Suc n)
[PROOF STEP]
assume "\<not>prime n"
[PROOF STATE]
proof (state)
this:
\<not> prime n

goal (1 subgoal):
 1. \<not> prime n \<Longrightarrow> smallest_prime_beyond n = smallest_prime_beyond (Suc n)
[PROOF STEP]
show "smallest_prime_beyond n = smallest_prime_beyond (Suc n)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. smallest_prime_beyond n = smallest_prime_beyond (Suc n)
[PROOF STEP]
proof (rule antisym)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. smallest_prime_beyond n \<le> smallest_prime_beyond (Suc n)
 2. smallest_prime_beyond (Suc n) \<le> smallest_prime_beyond n
[PROOF STEP]
show "smallest_prime_beyond n \<le> smallest_prime_beyond (Suc n)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. smallest_prime_beyond n \<le> smallest_prime_beyond (Suc n)
[PROOF STEP]
by (rule smallest_prime_beyond_smallest)
         (auto intro: order.trans[OF _ smallest_prime_beyond_le])
[PROOF STATE]
proof (state)
this:
smallest_prime_beyond n \<le> smallest_prime_beyond (Suc n)

goal (1 subgoal):
 1. smallest_prime_beyond (Suc n) \<le> smallest_prime_beyond n
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. smallest_prime_beyond (Suc n) \<le> smallest_prime_beyond n
[PROOF STEP]
have "smallest_prime_beyond n \<noteq> n"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. smallest_prime_beyond n \<noteq> n
[PROOF STEP]
using prime_smallest_prime_beyond[of n] \<open>\<not>prime n\<close>
[PROOF STATE]
proof (prove)
using this:
prime (smallest_prime_beyond n)
\<not> prime n

goal (1 subgoal):
 1. smallest_prime_beyond n \<noteq> n
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
smallest_prime_beyond n \<noteq> n

goal (1 subgoal):
 1. smallest_prime_beyond (Suc n) \<le> smallest_prime_beyond n
[PROOF STEP]
hence "smallest_prime_beyond n > n"
[PROOF STATE]
proof (prove)
using this:
smallest_prime_beyond n \<noteq> n

goal (1 subgoal):
 1. n < smallest_prime_beyond n
[PROOF STEP]
using smallest_prime_beyond_le[of n]
[PROOF STATE]
proof (prove)
using this:
smallest_prime_beyond n \<noteq> n
n \<le> smallest_prime_beyond n

goal (1 subgoal):
 1. n < smallest_prime_beyond n
[PROOF STEP]
by linarith
[PROOF STATE]
proof (state)
this:
n < smallest_prime_beyond n

goal (1 subgoal):
 1. smallest_prime_beyond (Suc n) \<le> smallest_prime_beyond n
[PROOF STEP]
thus "smallest_prime_beyond n \<ge> smallest_prime_beyond (Suc n)"
[PROOF STATE]
proof (prove)
using this:
n < smallest_prime_beyond n

goal (1 subgoal):
 1. smallest_prime_beyond (Suc n) \<le> smallest_prime_beyond n
[PROOF STEP]
by (intro smallest_prime_beyond_smallest) auto
[PROOF STATE]
proof (state)
this:
smallest_prime_beyond (Suc n) \<le> smallest_prime_beyond n

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
smallest_prime_beyond n = smallest_prime_beyond (Suc n)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma p_le_1: "s \<in> S \<Longrightarrow> p s \<le> 1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. s \<in> S \<Longrightarrow> p s \<le> 1
[PROOF STEP]
by (auto simp: p_eq_SUP_v intro!: SUP_least v_le_1 intro: valid_cfgI)


[STATEMENT]
lemma space_measure_pmf[simp]: "space (measure_pmf p) = UNIV"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. space (measure_pmf p) = UNIV
[PROOF STEP]
using sets_eq_imp_space_eq[of "measure_pmf p" "count_space UNIV"]
[PROOF STATE]
proof (prove)
using this:
measure_pmf.events p = sets (count_space UNIV) \<Longrightarrow> space (measure_pmf p) = space (count_space UNIV)

goal (1 subgoal):
 1. space (measure_pmf p) = UNIV
[PROOF STEP]
by simp


[STATEMENT]
lemma C1_differentiable_polynomial_function:
  fixes p :: "real \<Rightarrow> 'a::euclidean_space"
  shows "polynomial_function p \<Longrightarrow> p C1_differentiable_on S"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. polynomial_function p \<Longrightarrow> p C1_differentiable_on S
[PROOF STEP]
by (metis continuous_on_polymonial_function C1_differentiable_on_def  has_vector_derivative_polynomial_function)


[STATEMENT]
lemma fact_ge_power:
  fixes c :: nat
  assumes "fact n0 \<ge> c ^ n0" "c \<le> n0 + 1"
  assumes "n \<ge> n0"
  shows   "fact n \<ge> c ^ n"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. c ^ n \<le> fact n
[PROOF STEP]
using assms(3,1,2)
[PROOF STATE]
proof (prove)
using this:
n0 \<le> n
c ^ n0 \<le> fact n0
c \<le> n0 + 1

goal (1 subgoal):
 1. c ^ n \<le> fact n
[PROOF STEP]
proof (induction n rule: dec_induct)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<lbrakk>c ^ n0 \<le> fact n0; c \<le> n0 + 1\<rbrakk> \<Longrightarrow> c ^ n0 \<le> fact n0
 2. \<And>na. \<lbrakk>n0 \<le> na; na < n; \<lbrakk>c ^ n0 \<le> fact n0; c \<le> n0 + 1\<rbrakk> \<Longrightarrow> c ^ na \<le> fact na; c ^ n0 \<le> fact n0; c \<le> n0 + 1\<rbrakk> \<Longrightarrow> c ^ Suc na \<le> fact (Suc na)
[PROOF STEP]
case (step n)
[PROOF STATE]
proof (state)
this:
n0 \<le> n
n < n
\<lbrakk>c ^ n0 \<le> fact n0; c \<le> n0 + 1\<rbrakk> \<Longrightarrow> c ^ n \<le> fact n
c ^ n0 \<le> fact n0
c \<le> n0 + 1

goal (2 subgoals):
 1. \<lbrakk>c ^ n0 \<le> fact n0; c \<le> n0 + 1\<rbrakk> \<Longrightarrow> c ^ n0 \<le> fact n0
 2. \<And>na. \<lbrakk>n0 \<le> na; na < n; \<lbrakk>c ^ n0 \<le> fact n0; c \<le> n0 + 1\<rbrakk> \<Longrightarrow> c ^ na \<le> fact na; c ^ n0 \<le> fact n0; c \<le> n0 + 1\<rbrakk> \<Longrightarrow> c ^ Suc na \<le> fact (Suc na)
[PROOF STEP]
have "c * c ^ n \<le> Suc n * fact n"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. c * c ^ n \<le> Suc n * fact n
[PROOF STEP]
using step
[PROOF STATE]
proof (prove)
using this:
n0 \<le> n
n < n
\<lbrakk>c ^ n0 \<le> fact n0; c \<le> n0 + 1\<rbrakk> \<Longrightarrow> c ^ n \<le> fact n
c ^ n0 \<le> fact n0
c \<le> n0 + 1

goal (1 subgoal):
 1. c * c ^ n \<le> Suc n * fact n
[PROOF STEP]
by (intro mult_mono) auto
[PROOF STATE]
proof (state)
this:
c * c ^ n \<le> Suc n * fact n

goal (2 subgoals):
 1. \<lbrakk>c ^ n0 \<le> fact n0; c \<le> n0 + 1\<rbrakk> \<Longrightarrow> c ^ n0 \<le> fact n0
 2. \<And>na. \<lbrakk>n0 \<le> na; na < n; \<lbrakk>c ^ n0 \<le> fact n0; c \<le> n0 + 1\<rbrakk> \<Longrightarrow> c ^ na \<le> fact na; c ^ n0 \<le> fact n0; c \<le> n0 + 1\<rbrakk> \<Longrightarrow> c ^ Suc na \<le> fact (Suc na)
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
c * c ^ n \<le> Suc n * fact n

goal (1 subgoal):
 1. c ^ Suc n \<le> fact (Suc n)
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
c ^ Suc n \<le> fact (Suc n)

goal (1 subgoal):
 1. \<lbrakk>c ^ n0 \<le> fact n0; c \<le> n0 + 1\<rbrakk> \<Longrightarrow> c ^ n0 \<le> fact n0
[PROOF STEP]
qed auto


[STATEMENT]
lemma CollInt_iff: "{s. P s} \<inter> {s. Q s} = {s. P s \<and> Q s}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {s. P s} \<inter> {s. Q s} = {s. P s \<and> Q s}
[PROOF STEP]
by auto


[STATEMENT]
lemma btree_search_correct [hoare_triple]:
  "<btree t b * \<up>(tree_sorted t)>
   btree_search x b
   <\<lambda>r. btree t b * \<up>(r = tree_search t x)>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. <btree t b * \<up> (tree_sorted t)> btree_search x b <\<lambda>r. btree t b * \<up> (r = tree_search t x)>
[PROOF STEP]
@proof
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. <btree t b * \<up> (tree_sorted t)> btree_search x b <\<lambda>r. btree t b * \<up> (r = tree_search t x)>
[PROOF STEP]
@induct t arbitrary b
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. <btree t b * \<up> (tree_sorted t)> btree_search x b <\<lambda>r. btree t b * \<up> (r = tree_search t x)>
[PROOF STEP]
@qed