[STATEMENT]
lemma Gen_Shleg_n_1 [simp]: "Gen_Shleg n 1 = (-1) ^ n * fact n"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. local.Gen_Shleg n 1 = (- 1) ^ n * fact n
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. local.Gen_Shleg n 1 = (- 1) ^ n * fact n
[PROOF STEP]
have "Gen_Shleg n 1 = (\<Sum>i\<le>n. (-1) ^ (n-i) * real (n choose i) *
        (real (pochhammer (Suc (n-i)) i) *
         real (pochhammer (Suc i) (n-i))) * 0 ^ i)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. local.Gen_Shleg n 1 = (\<Sum>i\<le>n. (- 1) ^ (n - i) * real (n choose i) * (real (pochhammer (Suc (n - i)) i) * real (pochhammer (Suc i) (n - i))) * 0 ^ i)
[PROOF STEP]
by (simp add: Gen_Shleg_altdef)
[PROOF STATE]
proof (state)
this:
local.Gen_Shleg n 1 = (\<Sum>i\<le>n. (- 1) ^ (n - i) * real (n choose i) * (real (pochhammer (Suc (n - i)) i) * real (pochhammer (Suc i) (n - i))) * 0 ^ i)

goal (1 subgoal):
 1. local.Gen_Shleg n 1 = (- 1) ^ n * fact n
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
local.Gen_Shleg n 1 = (\<Sum>i\<le>n. (- 1) ^ (n - i) * real (n choose i) * (real (pochhammer (Suc (n - i)) i) * real (pochhammer (Suc i) (n - i))) * 0 ^ i)

goal (1 subgoal):
 1. local.Gen_Shleg n 1 = (- 1) ^ n * fact n
[PROOF STEP]
have "\<dots> = (\<Sum>i\<in>{0}. (-1) ^ (n-i) * real (n choose i) *
        (real (pochhammer (Suc (n-i)) i) *
         real (pochhammer (Suc i) (n-i))) * 0 ^ i)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Sum>i\<le>n. (- 1) ^ (n - i) * real (n choose i) * (real (pochhammer (Suc (n - i)) i) * real (pochhammer (Suc i) (n - i))) * 0 ^ i) = (\<Sum>i\<in>{0}. (- 1) ^ (n - i) * real (n choose i) * (real (pochhammer (Suc (n - i)) i) * real (pochhammer (Suc i) (n - i))) * 0 ^ i)
[PROOF STEP]
by (intro sum.mono_neutral_right) auto
[PROOF STATE]
proof (state)
this:
(\<Sum>i\<le>n. (- 1) ^ (n - i) * real (n choose i) * (real (pochhammer (Suc (n - i)) i) * real (pochhammer (Suc i) (n - i))) * 0 ^ i) = (\<Sum>i\<in>{0}. (- 1) ^ (n - i) * real (n choose i) * (real (pochhammer (Suc (n - i)) i) * real (pochhammer (Suc i) (n - i))) * 0 ^ i)

goal (1 subgoal):
 1. local.Gen_Shleg n 1 = (- 1) ^ n * fact n
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(\<Sum>i\<le>n. (- 1) ^ (n - i) * real (n choose i) * (real (pochhammer (Suc (n - i)) i) * real (pochhammer (Suc i) (n - i))) * 0 ^ i) = (\<Sum>i\<in>{0}. (- 1) ^ (n - i) * real (n choose i) * (real (pochhammer (Suc (n - i)) i) * real (pochhammer (Suc i) (n - i))) * 0 ^ i)

goal (1 subgoal):
 1. local.Gen_Shleg n 1 = (- 1) ^ n * fact n
[PROOF STEP]
have "\<dots> = (-1) ^ n * fact n"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Sum>i\<in>{0}. (- 1) ^ (n - i) * real (n choose i) * (real (pochhammer (Suc (n - i)) i) * real (pochhammer (Suc i) (n - i))) * 0 ^ i) = (- 1) ^ n * fact n
[PROOF STEP]
by (simp add: pochhammer_fact flip: pochhammer_of_nat)
[PROOF STATE]
proof (state)
this:
(\<Sum>i\<in>{0}. (- 1) ^ (n - i) * real (n choose i) * (real (pochhammer (Suc (n - i)) i) * real (pochhammer (Suc i) (n - i))) * 0 ^ i) = (- 1) ^ n * fact n

goal (1 subgoal):
 1. local.Gen_Shleg n 1 = (- 1) ^ n * fact n
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
local.Gen_Shleg n 1 = (- 1) ^ n * fact n
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
local.Gen_Shleg n 1 = (- 1) ^ n * fact n

goal (1 subgoal):
 1. local.Gen_Shleg n 1 = (- 1) ^ n * fact n
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
local.Gen_Shleg n 1 = (- 1) ^ n * fact n

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma ent_conjE1: "\<lbrakk>A\<Longrightarrow>\<^sub>AC\<rbrakk> \<Longrightarrow> A\<and>\<^sub>AB\<Longrightarrow>\<^sub>AC"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. A \<Longrightarrow>\<^sub>A C \<Longrightarrow> A \<and>\<^sub>A B \<Longrightarrow>\<^sub>A C
[PROOF STEP]
unfolding entails_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>h. h \<Turnstile> A \<longrightarrow> h \<Turnstile> C \<Longrightarrow> \<forall>h. h \<Turnstile> A \<and>\<^sub>A B \<longrightarrow> h \<Turnstile> C
[PROOF STEP]
by (auto simp: mod_and_dist)


[STATEMENT]
lemma always_conj_distrib: "(\<box>(P \<^bold>\<and> Q)) = (\<box>P \<^bold>\<and> \<box>Q)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<box>(\<lambda>s. P s \<and> Q s) = (\<lambda>s. (\<box>P) s \<and> (\<box>Q) s)
[PROOF STEP]
unfolding defs
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lambda>\<sigma>. \<forall>i. P (\<sigma> |\<^sub>s i) \<and> Q (\<sigma> |\<^sub>s i)) = (\<lambda>s. (\<forall>i. P (s |\<^sub>s i)) \<and> (\<forall>i. Q (s |\<^sub>s i)))
[PROOF STEP]
by auto


[STATEMENT]
lemma proj_in_iff:
assumes "equivP P \<phi>"
shows "(P///\<phi>) (proj \<phi> x)  \<longleftrightarrow> P x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (P /// \<phi>) (proj \<phi> x) = P x
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
equivP P \<phi>

goal (1 subgoal):
 1. (P /// \<phi>) (proj \<phi> x) = P x
[PROOF STEP]
unfolding quotientP_def proj_def
[PROOF STATE]
proof (prove)
using this:
equivP P \<phi>

goal (1 subgoal):
 1. S2P (Collect P // P2R \<phi>) {y. \<phi> x y} = P x
[PROOF STEP]
by (metis (mono_tags) Collect_mem_eq Equiv_Relation2.proj_def
  Equiv_Relation2.proj_preserves S2P_Collect empty_Collect_eq equivP_def
  equiv_P2R in_quotient_imp_non_empty quotientP_def reflP_def)


[STATEMENT]
lemma mono_mult1:
  assumes "r \<subseteq> r'" shows "mult1 r \<subseteq> mult1 r'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mult1 r \<subseteq> mult1 r'
[PROOF STEP]
unfolding mult1_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {(N, M). \<exists>a M0 K. M = add_mset a M0 \<and> N = M0 + K \<and> (\<forall>b. b \<in># K \<longrightarrow> (b, a) \<in> r)} \<subseteq> {(N, M). \<exists>a M0 K. M = add_mset a M0 \<and> N = M0 + K \<and> (\<forall>b. b \<in># K \<longrightarrow> (b, a) \<in> r')}
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
r \<subseteq> r'

goal (1 subgoal):
 1. {(N, M). \<exists>a M0 K. M = add_mset a M0 \<and> N = M0 + K \<and> (\<forall>b. b \<in># K \<longrightarrow> (b, a) \<in> r)} \<subseteq> {(N, M). \<exists>a M0 K. M = add_mset a M0 \<and> N = M0 + K \<and> (\<forall>b. b \<in># K \<longrightarrow> (b, a) \<in> r')}
[PROOF STEP]
by blast


[STATEMENT]
lemma nat_term_compD1:
  assumes "nat_term_comp cmp" and "snd (rep_nat_term u) = snd (rep_nat_term v)" and "fst (rep_nat_term u) = 0"
  shows "cmp u v \<noteq> Gt"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. cmp u v \<noteq> Gt
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
nat_term_comp cmp
snd (rep_nat_term u) = snd (rep_nat_term v)
fst (rep_nat_term u) = 0

goal (1 subgoal):
 1. cmp u v \<noteq> Gt
[PROOF STEP]
unfolding nat_term_comp_def fst_conv
[PROOF STATE]
proof (prove)
using this:
(\<forall>u v. snd (rep_nat_term u) = snd (rep_nat_term v) \<longrightarrow> fst (rep_nat_term u) = 0 \<longrightarrow> cmp u v \<noteq> Gt) \<and> (\<forall>u v. fst (rep_nat_term u) = fst (rep_nat_term v) \<longrightarrow> snd (rep_nat_term u) < snd (rep_nat_term v) \<longrightarrow> cmp u v = Lt) \<and> (\<forall>t u v. cmp u v = Lt \<longrightarrow> cmp (splus t u) (splus t v) = Lt) \<and> (\<forall>u v a b. fst (rep_nat_term u) = fst (rep_nat_term a) \<longrightarrow> fst (rep_nat_term v) = fst (rep_nat_term b) \<longrightarrow> snd (rep_nat_term u) = snd (rep_nat_term v) \<longrightarrow> snd (rep_nat_term a) = snd (rep_nat_term b) \<longrightarrow> cmp a b = Lt \<longrightarrow> cmp u v = Lt)
snd (rep_nat_term u) = snd (rep_nat_term v)
fst (rep_nat_term u) = 0

goal (1 subgoal):
 1. cmp u v \<noteq> Gt
[PROOF STEP]
by blast


[STATEMENT]
lemma exphr_zero [simp]: "exphr 0 = 1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. exphr 0 = 1
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. exphr 0 = 1
[PROOF STEP]
have "\<forall>x>1. 1 = sumhr (0, 1, \<lambda>n. inverse (fact n) * 0 ^ n) + sumhr (1, x, \<lambda>n. inverse (fact n) * 0 ^ n)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>x>1. 1 = sumhr (0, 1, \<lambda>n. inverse (fact n) * 0 ^ n) + sumhr (1, x, \<lambda>n. inverse (fact n) * 0 ^ n)
[PROOF STEP]
unfolding sumhr_app
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>x>1. 1 = (*f2* (\<lambda>m n. \<Sum>n = m..<n. inverse (fact n) * 0 ^ n)) 0 1 + (*f2* (\<lambda>m n. \<Sum>n = m..<n. inverse (fact n) * 0 ^ n)) 1 x
[PROOF STEP]
by transfer (simp add: power_0_left)
[PROOF STATE]
proof (state)
this:
\<forall>x>1. 1 = sumhr (0, 1, \<lambda>n. inverse (fact n) * 0 ^ n) + sumhr (1, x, \<lambda>n. inverse (fact n) * 0 ^ n)

goal (1 subgoal):
 1. exphr 0 = 1
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<forall>x>1. 1 = sumhr (0, 1, \<lambda>n. inverse (fact n) * 0 ^ n) + sumhr (1, x, \<lambda>n. inverse (fact n) * 0 ^ n)
[PROOF STEP]
have "sumhr (0, 1, \<lambda>n. inverse (fact n) * 0 ^ n) + sumhr (1, whn, \<lambda>n. inverse (fact n) * 0 ^ n) \<approx> 1"
[PROOF STATE]
proof (prove)
using this:
\<forall>x>1. 1 = sumhr (0, 1, \<lambda>n. inverse (fact n) * 0 ^ n) + sumhr (1, x, \<lambda>n. inverse (fact n) * 0 ^ n)

goal (1 subgoal):
 1. sumhr (0, 1, \<lambda>n. inverse (fact n) * 0 ^ n) + sumhr (1, whn, \<lambda>n. inverse (fact n) * 0 ^ n) \<approx> 1
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
sumhr (0, 1, \<lambda>n. inverse (fact n) * 0 ^ n) + sumhr (1, whn, \<lambda>n. inverse (fact n) * 0 ^ n) \<approx> 1

goal (1 subgoal):
 1. exphr 0 = 1
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
sumhr (0, 1, \<lambda>n. inverse (fact n) * 0 ^ n) + sumhr (1, whn, \<lambda>n. inverse (fact n) * 0 ^ n) \<approx> 1
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
sumhr (0, 1, \<lambda>n. inverse (fact n) * 0 ^ n) + sumhr (1, whn, \<lambda>n. inverse (fact n) * 0 ^ n) \<approx> 1

goal (1 subgoal):
 1. exphr 0 = 1
[PROOF STEP]
unfolding exphr_def
[PROOF STATE]
proof (prove)
using this:
sumhr (0, 1, \<lambda>n. inverse (fact n) * 0 ^ n) + sumhr (1, whn, \<lambda>n. inverse (fact n) * 0 ^ n) \<approx> 1

goal (1 subgoal):
 1. st (sumhr (0, whn, \<lambda>n. inverse (fact n) * 0 ^ n)) = 1
[PROOF STEP]
using sumhr_split_add [OF hypnat_one_less_hypnat_omega] st_unique
[PROOF STATE]
proof (prove)
using this:
sumhr (0, 1, \<lambda>n. inverse (fact n) * 0 ^ n) + sumhr (1, whn, \<lambda>n. inverse (fact n) * 0 ^ n) \<approx> 1
sumhr (0, 1, ?f) + sumhr (1, whn, ?f) = sumhr (0, whn, ?f)
\<lbrakk>?r \<in> \<real>; ?r \<approx> ?x\<rbrakk> \<Longrightarrow> st ?x = ?r

goal (1 subgoal):
 1. st (sumhr (0, whn, \<lambda>n. inverse (fact n) * 0 ^ n)) = 1
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
exphr 0 = 1

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma LeadsETo_eq_leadsETo:
     "A LeadsTo[CC] B =
        {F. F \<in> (reachable F Int A) leadsTo[(%C. reachable F Int C) ` CC]
        (reachable F Int B)}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. A LeadsTo[CC] B = {F. F \<in> (reachable F \<inter> A) leadsTo[(\<inter>) (reachable F) ` CC] (reachable F \<inter> B)}
[PROOF STEP]
apply (unfold LeadsETo_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {F. F \<in> (reachable F \<inter> A) leadsTo[(\<inter>) (reachable F) ` CC] B} = {F. F \<in> (reachable F \<inter> A) leadsTo[(\<inter>) (reachable F) ` CC] (reachable F \<inter> B)}
[PROOF STEP]
apply (blast dest: e_psp_stable2 intro: leadsETo_weaken)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
theorem invertible_image_lemma:
  assumes "invertible a" "a \<in> M"
  shows "\<eta> a \<cdot>' \<eta> (inverse a) = \<one>'" and "\<eta> (inverse a) \<cdot>' \<eta> a = \<one>'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<eta> a \<cdot>' \<eta> (inverse a) = \<one>' &&& \<eta> (inverse a) \<cdot>' \<eta> a = \<one>'
[PROOF STEP]
using assms commutes_with_composition commutes_with_unit source.inverse_equality
[PROOF STATE]
proof (prove)
using this:
invertible a
a \<in> M
\<lbrakk>?x \<in> M; ?y \<in> M\<rbrakk> \<Longrightarrow> \<eta> (?x \<cdot> ?y) = \<eta> ?x \<cdot>' \<eta> ?y
\<eta> \<one> = \<one>'
\<lbrakk>?u \<cdot> ?v = \<one>; ?v \<cdot> ?u = \<one>; ?u \<in> M; ?v \<in> M\<rbrakk> \<Longrightarrow> inverse ?u = ?v

goal (1 subgoal):
 1. \<eta> a \<cdot>' \<eta> (inverse a) = \<one>' &&& \<eta> (inverse a) \<cdot>' \<eta> a = \<one>'
[PROOF STEP]
by auto (metis source.invertible_inverse_closed source.invertible_left_inverse)


[STATEMENT]
lemma \<omega>_sum_of_Cantor [simp]: "\<omega>_sum (\<omega>_of_Cantor \<alpha>s ms) = Cantor_sum \<alpha>s ms"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<omega>_sum (\<omega>_of_Cantor \<alpha>s ms) = Cantor_sum \<alpha>s ms
[PROOF STEP]
proof (induction \<alpha>s arbitrary: ms)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>ms. \<omega>_sum (\<omega>_of_Cantor [] ms) = Cantor_sum [] ms
 2. \<And>a \<alpha>s ms. (\<And>ms. \<omega>_sum (\<omega>_of_Cantor \<alpha>s ms) = Cantor_sum \<alpha>s ms) \<Longrightarrow> \<omega>_sum (\<omega>_of_Cantor (a # \<alpha>s) ms) = Cantor_sum (a # \<alpha>s) ms
[PROOF STEP]
case (Cons a \<alpha>s ms)
[PROOF STATE]
proof (state)
this:
\<omega>_sum (\<omega>_of_Cantor \<alpha>s ?ms) = Cantor_sum \<alpha>s ?ms

goal (2 subgoals):
 1. \<And>ms. \<omega>_sum (\<omega>_of_Cantor [] ms) = Cantor_sum [] ms
 2. \<And>a \<alpha>s ms. (\<And>ms. \<omega>_sum (\<omega>_of_Cantor \<alpha>s ms) = Cantor_sum \<alpha>s ms) \<Longrightarrow> \<omega>_sum (\<omega>_of_Cantor (a # \<alpha>s) ms) = Cantor_sum (a # \<alpha>s) ms
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<omega>_sum (\<omega>_of_Cantor \<alpha>s ?ms) = Cantor_sum \<alpha>s ?ms
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
\<omega>_sum (\<omega>_of_Cantor \<alpha>s ?ms) = Cantor_sum \<alpha>s ?ms

goal (1 subgoal):
 1. \<omega>_sum (\<omega>_of_Cantor (a # \<alpha>s) ms) = Cantor_sum (a # \<alpha>s) ms
[PROOF STEP]
by (cases ms) auto
[PROOF STATE]
proof (state)
this:
\<omega>_sum (\<omega>_of_Cantor (a # \<alpha>s) ms) = Cantor_sum (a # \<alpha>s) ms

goal (1 subgoal):
 1. \<And>ms. \<omega>_sum (\<omega>_of_Cantor [] ms) = Cantor_sum [] ms
[PROOF STEP]
qed auto


[STATEMENT]
lemma mod_subset_add:
   "\<lbrakk>(c1,c2) \<in> mod_subset p X; (d1,d2) \<in> mod_subset p X\<rbrakk> \<Longrightarrow> (c1+d1, c2+d2) \<in> mod_subset p X"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(c1, c2) \<in> mod_subset p X; (d1, d2) \<in> mod_subset p X\<rbrakk> \<Longrightarrow> (c1 + d1, c2 + d2) \<in> mod_subset p X
[PROOF STEP]
by (simp add: mod_subset_def add_diff_add singular_chain_add)


[STATEMENT]
lemma comm_semiring_ow: "class.comm_semiring = comm_semiring_ow UNIV"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. class.comm_semiring = comm_semiring_ow UNIV
[PROOF STEP]
unfolding
    class.comm_semiring_def comm_semiring_ow_def
    class.comm_semiring_axioms_def comm_semiring_ow_axioms_def
    ab_semigroup_add_ow ab_semigroup_mult_ow
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lambda>plus times. ab_semigroup_add_ow UNIV plus \<and> ab_semigroup_mult_ow UNIV times \<and> (\<forall>a b c. times (plus a b) c = plus (times a c) (times b c))) = (\<lambda>plus times. ab_semigroup_add_ow UNIV plus \<and> ab_semigroup_mult_ow UNIV times \<and> (\<forall>a b c. a \<in> UNIV \<longrightarrow> b \<in> UNIV \<longrightarrow> c \<in> UNIV \<longrightarrow> times (plus a b) c = plus (times a c) (times b c)))
[PROOF STEP]
by simp


[STATEMENT]
lemma empty_interior_affine_hull:
  fixes S :: "'a::euclidean_space set"
  assumes "finite S" and dim: "card S \<le> DIM ('a)"
    shows "interior(affine hull S) = {}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. interior (affine hull S) = {}
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
finite S
card S \<le> DIM('a)

goal (1 subgoal):
 1. interior (affine hull S) = {}
[PROOF STEP]
proof (induct S rule: finite_induct)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. card {} \<le> DIM('a) \<Longrightarrow> interior (affine hull {}) = {}
 2. \<And>x F. \<lbrakk>finite F; x \<notin> F; card F \<le> DIM('a) \<Longrightarrow> interior (affine hull F) = {}; card (insert x F) \<le> DIM('a)\<rbrakk> \<Longrightarrow> interior (affine hull insert x F) = {}
[PROOF STEP]
case (insert x S)
[PROOF STATE]
proof (state)
this:
finite S
x \<notin> S
card S \<le> DIM('a) \<Longrightarrow> interior (affine hull S) = {}
card (insert x S) \<le> DIM('a)

goal (2 subgoals):
 1. card {} \<le> DIM('a) \<Longrightarrow> interior (affine hull {}) = {}
 2. \<And>x F. \<lbrakk>finite F; x \<notin> F; card F \<le> DIM('a) \<Longrightarrow> interior (affine hull F) = {}; card (insert x F) \<le> DIM('a)\<rbrakk> \<Longrightarrow> interior (affine hull insert x F) = {}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
finite S
x \<notin> S
card S \<le> DIM('a) \<Longrightarrow> interior (affine hull S) = {}
card (insert x S) \<le> DIM('a)
[PROOF STEP]
have "dim (span ((\<lambda>y. y - x) ` S)) < DIM('a)"
[PROOF STATE]
proof (prove)
using this:
finite S
x \<notin> S
card S \<le> DIM('a) \<Longrightarrow> interior (affine hull S) = {}
card (insert x S) \<le> DIM('a)

goal (1 subgoal):
 1. dim (span ((\<lambda>y. y - x) ` S)) < DIM('a)
[PROOF STEP]
by (auto simp: Suc_le_lessD card_image_le dual_order.trans intro!: dim_le_card'[THEN le_less_trans])
[PROOF STATE]
proof (state)
this:
dim (span ((\<lambda>y. y - x) ` S)) < DIM('a)

goal (2 subgoals):
 1. card {} \<le> DIM('a) \<Longrightarrow> interior (affine hull {}) = {}
 2. \<And>x F. \<lbrakk>finite F; x \<notin> F; card F \<le> DIM('a) \<Longrightarrow> interior (affine hull F) = {}; card (insert x F) \<le> DIM('a)\<rbrakk> \<Longrightarrow> interior (affine hull insert x F) = {}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
dim (span ((\<lambda>y. y - x) ` S)) < DIM('a)
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
dim (span ((\<lambda>y. y - x) ` S)) < DIM('a)

goal (1 subgoal):
 1. interior (affine hull insert x S) = {}
[PROOF STEP]
by (simp add: empty_interior_lowdim affine_hull_insert_span_gen interior_translation)
[PROOF STATE]
proof (state)
this:
interior (affine hull insert x S) = {}

goal (1 subgoal):
 1. card {} \<le> DIM('a) \<Longrightarrow> interior (affine hull {}) = {}
[PROOF STEP]
qed auto


[STATEMENT]
lemma is_pos_neg_not_is_pos: "is_pos (- L) \<longleftrightarrow> \<not> is_pos L"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. is_pos (- L) = is_neg L
[PROOF STEP]
by (cases L) auto


[STATEMENT]
lemma RDirProd_list_hom1:
  "(\<lambda>(a, as). a # as) \<in> ring_hom (RDirProd R (RDirProd_list Rs)) (RDirProd_list (R # Rs))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lambda>(a, as). a # as) \<in> ring_hom (RDirProd R (RDirProd_list Rs)) (RDirProd_list (R # Rs))
[PROOF STEP]
using RDirProd_list_iso1
[PROOF STATE]
proof (prove)
using this:
(\<lambda>(a, as). a # as) \<in> ring_iso (RDirProd ?R (RDirProd_list ?Rs)) (RDirProd_list (?R # ?Rs))

goal (1 subgoal):
 1. (\<lambda>(a, as). a # as) \<in> ring_hom (RDirProd R (RDirProd_list Rs)) (RDirProd_list (R # Rs))
[PROOF STEP]
unfolding ring_iso_def
[PROOF STATE]
proof (prove)
using this:
(\<lambda>(a, as). a # as) \<in> {h \<in> ring_hom (RDirProd ?R (RDirProd_list ?Rs)) (RDirProd_list (?R # ?Rs)). bij_betw h (carrier (RDirProd ?R (RDirProd_list ?Rs))) (carrier (RDirProd_list (?R # ?Rs)))}

goal (1 subgoal):
 1. (\<lambda>(a, as). a # as) \<in> ring_hom (RDirProd R (RDirProd_list Rs)) (RDirProd_list (R # Rs))
[PROOF STEP]
by auto


[STATEMENT]
lemma pairwise_disjoint_diff:
  "pairwise (\<lambda>s t. disjnt ((\<lambda> x. {(a, b, c, d) | a b c d. a \<in> A \<and> b \<in> A \<and> c \<in> A \<and> d \<in> A \<and> additive_quadruple a b c d \<and> a \<ominus> c = x \<and> d \<ominus> b = x}) s)
    ((\<lambda> x. {(a, b, c, d) | a b c d. a \<in> A \<and> b \<in> A \<and> c \<in> A \<and> d \<in> A \<and> additive_quadruple a b c d \<and> a \<ominus> c = x \<and> d \<ominus> b = x}) t)) (differenceset A A)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pairwise (\<lambda>s t. disjnt {(a, b, c, d) |a b c d. a \<in> A \<and> b \<in> A \<and> c \<in> A \<and> d \<in> A \<and> additive_quadruple a b c d \<and> a \<ominus> c = s \<and> d \<ominus> b = s} {(a, b, c, d) |a b c d. a \<in> A \<and> b \<in> A \<and> c \<in> A \<and> d \<in> A \<and> additive_quadruple a b c d \<and> a \<ominus> c = t \<and> d \<ominus> b = t}) (differenceset A A)
[PROOF STEP]
unfolding disjnt_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pairwise (\<lambda>s t. {(a, b, c, d) |a b c d. a \<in> A \<and> b \<in> A \<and> c \<in> A \<and> d \<in> A \<and> additive_quadruple a b c d \<and> a \<ominus> c = s \<and> d \<ominus> b = s} \<inter> {(a, b, c, d) |a b c d. a \<in> A \<and> b \<in> A \<and> c \<in> A \<and> d \<in> A \<and> additive_quadruple a b c d \<and> a \<ominus> c = t \<and> d \<ominus> b = t} = {}) (differenceset A A)
[PROOF STEP]
by (intro pairwiseI) (auto)


[STATEMENT]
lemma count_pre_img:
  assumes "x \<in> (countable_preimages B Y) n"
  shows "Y x = (from_nat_into B) n"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Y x = from_nat_into B n
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. Y x = from_nat_into B n
[PROOF STEP]
have "x\<in> Y -` {(from_nat_into B) n}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x \<in> Y -` {from_nat_into B n}
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
x \<in> countable_preimages B Y n

goal (1 subgoal):
 1. x \<in> Y -` {from_nat_into B n}
[PROOF STEP]
unfolding countable_preimages_def
[PROOF STATE]
proof (prove)
using this:
x \<in> (if infinite B \<or> finite B \<and> n < card B then Y -` {from_nat_into B n} else {})

goal (1 subgoal):
 1. x \<in> Y -` {from_nat_into B n}
[PROOF STEP]
by (meson empty_iff)
[PROOF STATE]
proof (state)
this:
x \<in> Y -` {from_nat_into B n}

goal (1 subgoal):
 1. Y x = from_nat_into B n
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
x \<in> Y -` {from_nat_into B n}

goal (1 subgoal):
 1. Y x = from_nat_into B n
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
Y x = from_nat_into B n

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma phi_vec_length:
  assumes "state 1 \<phi>"
  shows "cmod(\<phi> $$ (0,0))^2 + cmod(\<phi> $$ (Suc 0,0))^2 = 1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (cmod (\<phi> $$ (0, 0)))\<^sup>2 + (cmod (\<phi> $$ (Suc 0, 0)))\<^sup>2 = 1
[PROOF STEP]
using set_2 assms state_def Matrix.col_def cpx_vec_length_def
[PROOF STATE]
proof (prove)
using this:
{..<2} = {0, 1}
state 1 \<phi>
state ?n ?v \<equiv> dim_col ?v = 1 \<and> dim_row ?v = 2 ^ ?n \<and> \<parallel>Matrix.col ?v 0\<parallel> = 1
Matrix.col ?A ?j = Matrix.vec (dim_row ?A) (\<lambda>i. ?A $$ (i, ?j))
\<parallel>?v\<parallel> \<equiv> sqrt (\<Sum>i<dim_vec ?v. (cmod (?v $ i))\<^sup>2)

goal (1 subgoal):
 1. (cmod (\<phi> $$ (0, 0)))\<^sup>2 + (cmod (\<phi> $$ (Suc 0, 0)))\<^sup>2 = 1
[PROOF STEP]
by(auto simp add: atLeast0LessThan)


[STATEMENT]
lemma wff_nonintDfmla[simp]: "wff nonintDfmla"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. wff nonintDfmla
[PROOF STEP]
unfolding nonintDfmla_def Fall2_def Fall_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. wff (Neg (Exi p0 (Neg (Neg (Exi p1 (Neg (Imp (Alw (EqButGH p0 p1)) (Alw (EqOnGL p0 p1)))))))))
[PROOF STEP]
by simp


[STATEMENT]
lemma ffact_add_diff_assoc:
  "(a - of_nat n) * ffact n a + of_nat n * ffact n a = a * ffact n a"
    for a :: "'a :: comm_ring_1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (a - of_nat n) * ffact n a + of_nat n * ffact n a = a * ffact n a
[PROOF STEP]
by (simp add: algebra_simps)


[STATEMENT]
lemma ffb_g_orbital_guard:
  assumes "H = (\<lambda>s. G s \<and> Q s)"
  shows "fb\<^sub>\<F> (x\<acute>= f & G on U S @ t\<^sub>0) {s. Q s} = fb\<^sub>\<F> (x\<acute>= f & G on U S @ t\<^sub>0) {s. H s}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fb\<^sub>\<F> x\<acute>=f & G on U S @ t\<^sub>0 {s. Q s} = fb\<^sub>\<F> x\<acute>=f & G on U S @ t\<^sub>0 {s. H s}
[PROOF STEP]
unfolding ffb_g_orbital
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {s. \<forall>X\<in>Sols f U S t\<^sub>0 s. \<forall>t\<in>U s. (\<forall>\<tau>\<in>down (U s) t. G (X \<tau>)) \<longrightarrow> s2p (Collect Q) (X t)} = {s. \<forall>X\<in>Sols f U S t\<^sub>0 s. \<forall>t\<in>U s. (\<forall>\<tau>\<in>down (U s) t. G (X \<tau>)) \<longrightarrow> s2p (Collect H) (X t)}
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
H = (\<lambda>s. G s \<and> Q s)

goal (1 subgoal):
 1. {s. \<forall>X\<in>Sols f U S t\<^sub>0 s. \<forall>t\<in>U s. (\<forall>\<tau>\<in>down (U s) t. G (X \<tau>)) \<longrightarrow> s2p (Collect Q) (X t)} = {s. \<forall>X\<in>Sols f U S t\<^sub>0 s. \<forall>t\<in>U s. (\<forall>\<tau>\<in>down (U s) t. G (X \<tau>)) \<longrightarrow> s2p (Collect H) (X t)}
[PROOF STEP]
by auto


[STATEMENT]
lemma of_complex_add [simp]: "of_complex (x + y) = of_complex x + of_complex y"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. of_complex (x + y) = of_complex x + of_complex y
[PROOF STEP]
by (simp add: of_complex_def scaleC_add_left)


[STATEMENT]
theorem routing_ipassmt_wi:
assumes vpfx: "valid_prefixes tbl"
  shows
  "output_iface (routing_table_semantics tbl k) = output_port \<longleftrightarrow>
    (\<exists>ip_range. k \<in> wordinterval_to_set ip_range \<and> (output_port, ip_range) \<in> set (routing_ipassmt_wi tbl))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (output_iface (routing_table_semantics tbl k) = output_port) = (\<exists>ip_range. k \<in> wordinterval_to_set ip_range \<and> (output_port, ip_range) \<in> set (routing_ipassmt_wi tbl))
[PROOF STEP]
proof (intro iffI, goal_cases)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. output_iface (routing_table_semantics tbl k) = output_port \<Longrightarrow> \<exists>ip_range. k \<in> wordinterval_to_set ip_range \<and> (output_port, ip_range) \<in> set (routing_ipassmt_wi tbl)
 2. \<exists>ip_range. k \<in> wordinterval_to_set ip_range \<and> (output_port, ip_range) \<in> set (routing_ipassmt_wi tbl) \<Longrightarrow> output_iface (routing_table_semantics tbl k) = output_port
[PROOF STEP]
case 2
[PROOF STATE]
proof (state)
this:
\<exists>ip_range. k \<in> wordinterval_to_set ip_range \<and> (output_port, ip_range) \<in> set (routing_ipassmt_wi tbl)

goal (2 subgoals):
 1. output_iface (routing_table_semantics tbl k) = output_port \<Longrightarrow> \<exists>ip_range. k \<in> wordinterval_to_set ip_range \<and> (output_port, ip_range) \<in> set (routing_ipassmt_wi tbl)
 2. \<exists>ip_range. k \<in> wordinterval_to_set ip_range \<and> (output_port, ip_range) \<in> set (routing_ipassmt_wi tbl) \<Longrightarrow> output_iface (routing_table_semantics tbl k) = output_port
[PROOF STEP]
with vpfx routing_ipassmt_wi_sound
[PROOF STATE]
proof (chain)
picking this:
valid_prefixes tbl
\<lbrakk>valid_prefixes ?tbl; (?ea, ?eb) \<in> set (routing_ipassmt_wi ?tbl); ?k \<in> wordinterval_to_set ?eb\<rbrakk> \<Longrightarrow> ?ea = output_iface (routing_table_semantics ?tbl ?k)
\<exists>ip_range. k \<in> wordinterval_to_set ip_range \<and> (output_port, ip_range) \<in> set (routing_ipassmt_wi tbl)
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
valid_prefixes tbl
\<lbrakk>valid_prefixes ?tbl; (?ea, ?eb) \<in> set (routing_ipassmt_wi ?tbl); ?k \<in> wordinterval_to_set ?eb\<rbrakk> \<Longrightarrow> ?ea = output_iface (routing_table_semantics ?tbl ?k)
\<exists>ip_range. k \<in> wordinterval_to_set ip_range \<and> (output_port, ip_range) \<in> set (routing_ipassmt_wi tbl)

goal (1 subgoal):
 1. output_iface (routing_table_semantics tbl k) = output_port
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
output_iface (routing_table_semantics tbl k) = output_port

goal (1 subgoal):
 1. output_iface (routing_table_semantics tbl k) = output_port \<Longrightarrow> \<exists>ip_range. k \<in> wordinterval_to_set ip_range \<and> (output_port, ip_range) \<in> set (routing_ipassmt_wi tbl)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. output_iface (routing_table_semantics tbl k) = output_port \<Longrightarrow> \<exists>ip_range. k \<in> wordinterval_to_set ip_range \<and> (output_port, ip_range) \<in> set (routing_ipassmt_wi tbl)
[PROOF STEP]
case 1
[PROOF STATE]
proof (state)
this:
output_iface (routing_table_semantics tbl k) = output_port

goal (1 subgoal):
 1. output_iface (routing_table_semantics tbl k) = output_port \<Longrightarrow> \<exists>ip_range. k \<in> wordinterval_to_set ip_range \<and> (output_port, ip_range) \<in> set (routing_ipassmt_wi tbl)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
output_iface (routing_table_semantics tbl k) = output_port
[PROOF STEP]
obtain ip_range where "(output_port, ip_range) \<in> set (routing_port_ranges tbl wordinterval_UNIV) \<and> k \<in> wordinterval_to_set ip_range"
[PROOF STATE]
proof (prove)
using this:
output_iface (routing_table_semantics tbl k) = output_port

goal (1 subgoal):
 1. (\<And>ip_range. (output_port, ip_range) \<in> set (routing_port_ranges tbl wordinterval_UNIV) \<and> k \<in> wordinterval_to_set ip_range \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using routing_port_rangesI[where wi = wordinterval_UNIV, OF vpfx]
[PROOF STATE]
proof (prove)
using this:
output_iface (routing_table_semantics tbl k) = output_port
\<lbrakk>output_iface (routing_table_semantics tbl ?k) = ?output_port; ?k \<in> wordinterval_to_set wordinterval_UNIV\<rbrakk> \<Longrightarrow> \<exists>ip_range. (?output_port, ip_range) \<in> set (routing_port_ranges tbl wordinterval_UNIV) \<and> ?k \<in> wordinterval_to_set ip_range

goal (1 subgoal):
 1. (\<And>ip_range. (output_port, ip_range) \<in> set (routing_port_ranges tbl wordinterval_UNIV) \<and> k \<in> wordinterval_to_set ip_range \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(output_port, ip_range) \<in> set (routing_port_ranges tbl wordinterval_UNIV) \<and> k \<in> wordinterval_to_set ip_range

goal (1 subgoal):
 1. output_iface (routing_table_semantics tbl k) = output_port \<Longrightarrow> \<exists>ip_range. k \<in> wordinterval_to_set ip_range \<and> (output_port, ip_range) \<in> set (routing_ipassmt_wi tbl)
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
(output_port, ip_range) \<in> set (routing_port_ranges tbl wordinterval_UNIV) \<and> k \<in> wordinterval_to_set ip_range

goal (1 subgoal):
 1. \<exists>ip_range. k \<in> wordinterval_to_set ip_range \<and> (output_port, ip_range) \<in> set (routing_ipassmt_wi tbl)
[PROOF STEP]
unfolding routing_ipassmt_wi_def reduce_range_destination_def
[PROOF STATE]
proof (prove)
using this:
(output_port, ip_range) \<in> set (routing_port_ranges tbl wordinterval_UNIV) \<and> k \<in> wordinterval_to_set ip_range

goal (1 subgoal):
 1. \<exists>ip_range. k \<in> wordinterval_to_set ip_range \<and> (output_port, ip_range) \<in> set (let ps = remdups (map fst (routing_port_ranges tbl wordinterval_UNIV)); c = \<lambda>s. (wordinterval_Union \<circ> map snd \<circ> filter ((=) s \<circ> fst)) (routing_port_ranges tbl wordinterval_UNIV) in map (\<lambda>p. (p, c p)) ps)
[PROOF STEP]
unfolding Let_def comp_def
[PROOF STATE]
proof (prove)
using this:
(output_port, ip_range) \<in> set (routing_port_ranges tbl wordinterval_UNIV) \<and> k \<in> wordinterval_to_set ip_range

goal (1 subgoal):
 1. \<exists>ip_range. k \<in> wordinterval_to_set ip_range \<and> (output_port, ip_range) \<in> set (map (\<lambda>p. (p, wordinterval_Union (map snd (filter (\<lambda>x. p = fst x) (routing_port_ranges tbl wordinterval_UNIV))))) (remdups (map fst (routing_port_ranges tbl wordinterval_UNIV))))
[PROOF STEP]
by(force simp add: Set.image_iff wordinterval_Union)
[PROOF STATE]
proof (state)
this:
\<exists>ip_range. k \<in> wordinterval_to_set ip_range \<and> (output_port, ip_range) \<in> set (routing_ipassmt_wi tbl)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma "(3::real) * x + 7 * a < 4 \<and> 3 < 2 * x \<Longrightarrow> a < 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 3 * x + 7 * a < 4 \<and> 3 < 2 * x \<Longrightarrow> a < 0
[PROOF STEP]
by sos


[STATEMENT]
theorem generate_valid_topology_sound:
      "\<lbrakk> valid_reqs M; wf_graph \<lparr>nodes = V, edges = E\<rparr> \<rbrakk> \<Longrightarrow>
      all_security_requirements_fulfilled M (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>valid_reqs M; wf_graph \<lparr>nodes = V, edges = E\<rparr>\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
proof(induction M arbitrary: V E)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>V E. \<lbrakk>valid_reqs []; wf_graph \<lparr>nodes = V, edges = E\<rparr>\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled [] (generate_valid_topology [] \<lparr>nodes = V, edges = E\<rparr>)
 2. \<And>a M V E. \<lbrakk>\<And>V E. \<lbrakk>valid_reqs M; wf_graph \<lparr>nodes = V, edges = E\<rparr>\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>); valid_reqs (a # M); wf_graph \<lparr>nodes = V, edges = E\<rparr>\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled (a # M) (generate_valid_topology (a # M) \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
case Nil
[PROOF STATE]
proof (state)
this:
valid_reqs []
wf_graph \<lparr>nodes = V, edges = E\<rparr>

goal (2 subgoals):
 1. \<And>V E. \<lbrakk>valid_reqs []; wf_graph \<lparr>nodes = V, edges = E\<rparr>\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled [] (generate_valid_topology [] \<lparr>nodes = V, edges = E\<rparr>)
 2. \<And>a M V E. \<lbrakk>\<And>V E. \<lbrakk>valid_reqs M; wf_graph \<lparr>nodes = V, edges = E\<rparr>\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>); valid_reqs (a # M); wf_graph \<lparr>nodes = V, edges = E\<rparr>\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled (a # M) (generate_valid_topology (a # M) \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
valid_reqs []
wf_graph \<lparr>nodes = V, edges = E\<rparr>

goal (1 subgoal):
 1. all_security_requirements_fulfilled [] (generate_valid_topology [] \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
by(simp add: all_security_requirements_fulfilled_def)
[PROOF STATE]
proof (state)
this:
all_security_requirements_fulfilled [] (generate_valid_topology [] \<lparr>nodes = V, edges = E\<rparr>)

goal (1 subgoal):
 1. \<And>a M V E. \<lbrakk>\<And>V E. \<lbrakk>valid_reqs M; wf_graph \<lparr>nodes = V, edges = E\<rparr>\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>); valid_reqs (a # M); wf_graph \<lparr>nodes = V, edges = E\<rparr>\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled (a # M) (generate_valid_topology (a # M) \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a M V E. \<lbrakk>\<And>V E. \<lbrakk>valid_reqs M; wf_graph \<lparr>nodes = V, edges = E\<rparr>\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>); valid_reqs (a # M); wf_graph \<lparr>nodes = V, edges = E\<rparr>\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled (a # M) (generate_valid_topology (a # M) \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
case (Cons m M)
[PROOF STATE]
proof (state)
this:
\<lbrakk>valid_reqs M; wf_graph \<lparr>nodes = ?V, edges = ?E\<rparr>\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology M \<lparr>nodes = ?V, edges = ?E\<rparr>)
valid_reqs (m # M)
wf_graph \<lparr>nodes = V, edges = E\<rparr>

goal (1 subgoal):
 1. \<And>a M V E. \<lbrakk>\<And>V E. \<lbrakk>valid_reqs M; wf_graph \<lparr>nodes = V, edges = E\<rparr>\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>); valid_reqs (a # M); wf_graph \<lparr>nodes = V, edges = E\<rparr>\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled (a # M) (generate_valid_topology (a # M) \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
from valid_reqs1[OF Cons(2)]
[PROOF STATE]
proof (chain)
picking this:
configured_SecurityInvariant m
[PROOF STEP]
have validReq: "configured_SecurityInvariant m"
[PROOF STATE]
proof (prove)
using this:
configured_SecurityInvariant m

goal (1 subgoal):
 1. configured_SecurityInvariant m
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
configured_SecurityInvariant m

goal (1 subgoal):
 1. \<And>a M V E. \<lbrakk>\<And>V E. \<lbrakk>valid_reqs M; wf_graph \<lparr>nodes = V, edges = E\<rparr>\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>); valid_reqs (a # M); wf_graph \<lparr>nodes = V, edges = E\<rparr>\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled (a # M) (generate_valid_topology (a # M) \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
from Cons(3)
[PROOF STATE]
proof (chain)
picking this:
wf_graph \<lparr>nodes = V, edges = E\<rparr>
[PROOF STEP]
have valid_rmUnOff: "wf_graph \<lparr>nodes = V, edges = E - \<Union>(c_offending_flows m \<lparr>nodes = V, edges = E\<rparr>) \<rparr>"
[PROOF STATE]
proof (prove)
using this:
wf_graph \<lparr>nodes = V, edges = E\<rparr>

goal (1 subgoal):
 1. wf_graph \<lparr>nodes = V, edges = E - \<Union> (c_offending_flows m \<lparr>nodes = V, edges = E\<rparr>)\<rparr>
[PROOF STEP]
by(simp add: wf_graph_remove_edges)
[PROOF STATE]
proof (state)
this:
wf_graph \<lparr>nodes = V, edges = E - \<Union> (c_offending_flows m \<lparr>nodes = V, edges = E\<rparr>)\<rparr>

goal (1 subgoal):
 1. \<And>a M V E. \<lbrakk>\<And>V E. \<lbrakk>valid_reqs M; wf_graph \<lparr>nodes = V, edges = E\<rparr>\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>); valid_reqs (a # M); wf_graph \<lparr>nodes = V, edges = E\<rparr>\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled (a # M) (generate_valid_topology (a # M) \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
from configured_SecurityInvariant.sinvar_valid_remove_flattened_offending_flows[OF validReq Cons(3)]
[PROOF STATE]
proof (chain)
picking this:
c_sinvar m \<lparr>nodes = V, edges = E - \<Union> (c_offending_flows m \<lparr>nodes = V, edges = E\<rparr>)\<rparr>
[PROOF STEP]
have valid_eval_rmUnOff: "c_sinvar m \<lparr>nodes = V, edges = E - \<Union>(c_offending_flows m \<lparr>nodes = V, edges = E\<rparr>) \<rparr>"
[PROOF STATE]
proof (prove)
using this:
c_sinvar m \<lparr>nodes = V, edges = E - \<Union> (c_offending_flows m \<lparr>nodes = V, edges = E\<rparr>)\<rparr>

goal (1 subgoal):
 1. c_sinvar m \<lparr>nodes = V, edges = E - \<Union> (c_offending_flows m \<lparr>nodes = V, edges = E\<rparr>)\<rparr>
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
c_sinvar m \<lparr>nodes = V, edges = E - \<Union> (c_offending_flows m \<lparr>nodes = V, edges = E\<rparr>)\<rparr>

goal (1 subgoal):
 1. \<And>a M V E. \<lbrakk>\<And>V E. \<lbrakk>valid_reqs M; wf_graph \<lparr>nodes = V, edges = E\<rparr>\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>); valid_reqs (a # M); wf_graph \<lparr>nodes = V, edges = E\<rparr>\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled (a # M) (generate_valid_topology (a # M) \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
from generate_valid_topology_subseteq_edges
[PROOF STATE]
proof (chain)
picking this:
edges (generate_valid_topology ?M ?G) \<subseteq> edges ?G
[PROOF STEP]
have edges_gentopo_subseteq:
            "edges (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>) - \<Union>(c_offending_flows m \<lparr>nodes = V, edges = E\<rparr>)
               \<subseteq>
            E - \<Union>(c_offending_flows m \<lparr>nodes = V, edges = E\<rparr>)"
[PROOF STATE]
proof (prove)
using this:
edges (generate_valid_topology ?M ?G) \<subseteq> edges ?G

goal (1 subgoal):
 1. edges (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>) - \<Union> (c_offending_flows m \<lparr>nodes = V, edges = E\<rparr>) \<subseteq> E - \<Union> (c_offending_flows m \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
edges (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>) - \<Union> (c_offending_flows m \<lparr>nodes = V, edges = E\<rparr>) \<subseteq> E - \<Union> (c_offending_flows m \<lparr>nodes = V, edges = E\<rparr>)

goal (1 subgoal):
 1. \<And>a M V E. \<lbrakk>\<And>V E. \<lbrakk>valid_reqs M; wf_graph \<lparr>nodes = V, edges = E\<rparr>\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>); valid_reqs (a # M); wf_graph \<lparr>nodes = V, edges = E\<rparr>\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled (a # M) (generate_valid_topology (a # M) \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
from configured_SecurityInvariant.mono_sinvar[OF validReq valid_rmUnOff edges_gentopo_subseteq valid_eval_rmUnOff]
[PROOF STATE]
proof (chain)
picking this:
c_sinvar m \<lparr>nodes = V, edges = edges (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>) - \<Union> (c_offending_flows m \<lparr>nodes = V, edges = E\<rparr>)\<rparr>
[PROOF STEP]
have "c_sinvar m \<lparr>nodes = V, edges = (edges (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>)) - \<Union>(c_offending_flows m \<lparr>nodes = V, edges = E\<rparr>) \<rparr>"
[PROOF STATE]
proof (prove)
using this:
c_sinvar m \<lparr>nodes = V, edges = edges (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>) - \<Union> (c_offending_flows m \<lparr>nodes = V, edges = E\<rparr>)\<rparr>

goal (1 subgoal):
 1. c_sinvar m \<lparr>nodes = V, edges = edges (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>) - \<Union> (c_offending_flows m \<lparr>nodes = V, edges = E\<rparr>)\<rparr>
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
c_sinvar m \<lparr>nodes = V, edges = edges (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>) - \<Union> (c_offending_flows m \<lparr>nodes = V, edges = E\<rparr>)\<rparr>

goal (1 subgoal):
 1. \<And>a M V E. \<lbrakk>\<And>V E. \<lbrakk>valid_reqs M; wf_graph \<lparr>nodes = V, edges = E\<rparr>\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>); valid_reqs (a # M); wf_graph \<lparr>nodes = V, edges = E\<rparr>\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled (a # M) (generate_valid_topology (a # M) \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
from this
[PROOF STATE]
proof (chain)
picking this:
c_sinvar m \<lparr>nodes = V, edges = edges (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>) - \<Union> (c_offending_flows m \<lparr>nodes = V, edges = E\<rparr>)\<rparr>
[PROOF STEP]
have goal1:
            "c_sinvar m (delete_edges (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>) (\<Union>(c_offending_flows m \<lparr>nodes = V, edges = E\<rparr>)))"
[PROOF STATE]
proof (prove)
using this:
c_sinvar m \<lparr>nodes = V, edges = edges (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>) - \<Union> (c_offending_flows m \<lparr>nodes = V, edges = E\<rparr>)\<rparr>

goal (1 subgoal):
 1. c_sinvar m (delete_edges (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>) (\<Union> (c_offending_flows m \<lparr>nodes = V, edges = E\<rparr>)))
[PROOF STEP]
by(simp add: delete_edges_simp2 generate_valid_topology_nodes)
[PROOF STATE]
proof (state)
this:
c_sinvar m (delete_edges (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>) (\<Union> (c_offending_flows m \<lparr>nodes = V, edges = E\<rparr>)))

goal (1 subgoal):
 1. \<And>a M V E. \<lbrakk>\<And>V E. \<lbrakk>valid_reqs M; wf_graph \<lparr>nodes = V, edges = E\<rparr>\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>); valid_reqs (a # M); wf_graph \<lparr>nodes = V, edges = E\<rparr>\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled (a # M) (generate_valid_topology (a # M) \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
from valid_reqs2[OF Cons(2)]
[PROOF STATE]
proof (chain)
picking this:
valid_reqs M
[PROOF STEP]
have "valid_reqs M"
[PROOF STATE]
proof (prove)
using this:
valid_reqs M

goal (1 subgoal):
 1. valid_reqs M
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
valid_reqs M

goal (1 subgoal):
 1. \<And>a M V E. \<lbrakk>\<And>V E. \<lbrakk>valid_reqs M; wf_graph \<lparr>nodes = V, edges = E\<rparr>\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>); valid_reqs (a # M); wf_graph \<lparr>nodes = V, edges = E\<rparr>\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled (a # M) (generate_valid_topology (a # M) \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
from Cons.IH[OF \<open>valid_reqs M\<close> Cons(3)]
[PROOF STATE]
proof (chain)
picking this:
all_security_requirements_fulfilled M (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
have IH:
            "all_security_requirements_fulfilled M (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>)"
[PROOF STATE]
proof (prove)
using this:
all_security_requirements_fulfilled M (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>)

goal (1 subgoal):
 1. all_security_requirements_fulfilled M (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
all_security_requirements_fulfilled M (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>)

goal (1 subgoal):
 1. \<And>a M V E. \<lbrakk>\<And>V E. \<lbrakk>valid_reqs M; wf_graph \<lparr>nodes = V, edges = E\<rparr>\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>); valid_reqs (a # M); wf_graph \<lparr>nodes = V, edges = E\<rparr>\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled (a # M) (generate_valid_topology (a # M) \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
have generate_valid_topology_EX_graph_record:
            "\<exists> hypE. (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>) = \<lparr>nodes = V, edges = hypE\<rparr> "
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>hypE. generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr> = \<lparr>nodes = V, edges = hypE\<rparr>
[PROOF STEP]
apply(induction M arbitrary: V E)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>V E. \<exists>hypE. generate_valid_topology [] \<lparr>nodes = V, edges = E\<rparr> = \<lparr>nodes = V, edges = hypE\<rparr>
 2. \<And>a M V E. (\<And>V E. \<exists>hypE. generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr> = \<lparr>nodes = V, edges = hypE\<rparr>) \<Longrightarrow> \<exists>hypE. generate_valid_topology (a # M) \<lparr>nodes = V, edges = E\<rparr> = \<lparr>nodes = V, edges = hypE\<rparr>
[PROOF STEP]
by(simp_all add: delete_edges_simp2 generate_valid_topology_nodes)
[PROOF STATE]
proof (state)
this:
\<exists>hypE. generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr> = \<lparr>nodes = V, edges = hypE\<rparr>

goal (1 subgoal):
 1. \<And>a M V E. \<lbrakk>\<And>V E. \<lbrakk>valid_reqs M; wf_graph \<lparr>nodes = V, edges = E\<rparr>\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>); valid_reqs (a # M); wf_graph \<lparr>nodes = V, edges = E\<rparr>\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled (a # M) (generate_valid_topology (a # M) \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
from generate_valid_topology_EX_graph_record
[PROOF STATE]
proof (chain)
picking this:
\<exists>hypE. generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr> = \<lparr>nodes = V, edges = hypE\<rparr>
[PROOF STEP]
obtain E_IH where  E_IH_prop:
            "(generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>) = \<lparr>nodes = V, edges = E_IH\<rparr>"
[PROOF STATE]
proof (prove)
using this:
\<exists>hypE. generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr> = \<lparr>nodes = V, edges = hypE\<rparr>

goal (1 subgoal):
 1. (\<And>E_IH. generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr> = \<lparr>nodes = V, edges = E_IH\<rparr> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr> = \<lparr>nodes = V, edges = E_IH\<rparr>

goal (1 subgoal):
 1. \<And>a M V E. \<lbrakk>\<And>V E. \<lbrakk>valid_reqs M; wf_graph \<lparr>nodes = V, edges = E\<rparr>\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>); valid_reqs (a # M); wf_graph \<lparr>nodes = V, edges = E\<rparr>\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled (a # M) (generate_valid_topology (a # M) \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
from wf_graph_generate_valid_topology[OF Cons(3)] E_IH_prop
[PROOF STATE]
proof (chain)
picking this:
wf_graph (generate_valid_topology ?M \<lparr>nodes = V, edges = E\<rparr>)
generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr> = \<lparr>nodes = V, edges = E_IH\<rparr>
[PROOF STEP]
have valid_G_E_IH: "wf_graph \<lparr>nodes = V, edges = E_IH\<rparr>"
[PROOF STATE]
proof (prove)
using this:
wf_graph (generate_valid_topology ?M \<lparr>nodes = V, edges = E\<rparr>)
generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr> = \<lparr>nodes = V, edges = E_IH\<rparr>

goal (1 subgoal):
 1. wf_graph \<lparr>nodes = V, edges = E_IH\<rparr>
[PROOF STEP]
by metis

          \<comment> \<open>@{thm IH[simplified E_IH_prop]}\<close>
          \<comment> \<open>@{thm all_security_requirements_fulfilled_mono[OF `valid_reqs M` _  valid_G_E_IH IH[simplified E_IH_prop]]}\<close>
[PROOF STATE]
proof (state)
this:
wf_graph \<lparr>nodes = V, edges = E_IH\<rparr>

goal (1 subgoal):
 1. \<And>a M V E. \<lbrakk>\<And>V E. \<lbrakk>valid_reqs M; wf_graph \<lparr>nodes = V, edges = E\<rparr>\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>); valid_reqs (a # M); wf_graph \<lparr>nodes = V, edges = E\<rparr>\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled (a # M) (generate_valid_topology (a # M) \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
from all_security_requirements_fulfilled_mono[OF \<open>valid_reqs M\<close> _  valid_G_E_IH IH[simplified E_IH_prop]]
[PROOF STATE]
proof (chain)
picking this:
?E' \<subseteq> E_IH \<Longrightarrow> all_security_requirements_fulfilled M \<lparr>nodes = V, edges = ?E'\<rparr>
[PROOF STEP]
have mono_rule:
            "\<And> E'. E' \<subseteq> E_IH \<Longrightarrow> all_security_requirements_fulfilled M \<lparr>nodes = V, edges = E'\<rparr>"
[PROOF STATE]
proof (prove)
using this:
?E' \<subseteq> E_IH \<Longrightarrow> all_security_requirements_fulfilled M \<lparr>nodes = V, edges = ?E'\<rparr>

goal (1 subgoal):
 1. \<And>E'. E' \<subseteq> E_IH \<Longrightarrow> all_security_requirements_fulfilled M \<lparr>nodes = V, edges = E'\<rparr>
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
?E' \<subseteq> E_IH \<Longrightarrow> all_security_requirements_fulfilled M \<lparr>nodes = V, edges = ?E'\<rparr>

goal (1 subgoal):
 1. \<And>a M V E. \<lbrakk>\<And>V E. \<lbrakk>valid_reqs M; wf_graph \<lparr>nodes = V, edges = E\<rparr>\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>); valid_reqs (a # M); wf_graph \<lparr>nodes = V, edges = E\<rparr>\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled (a # M) (generate_valid_topology (a # M) \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
have "all_security_requirements_fulfilled M
            (delete_edges (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>) (\<Union>(c_offending_flows m \<lparr>nodes = V, edges = E\<rparr>)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. all_security_requirements_fulfilled M (delete_edges (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>) (\<Union> (c_offending_flows m \<lparr>nodes = V, edges = E\<rparr>)))
[PROOF STEP]
apply(subst E_IH_prop)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. all_security_requirements_fulfilled M (delete_edges \<lparr>nodes = V, edges = E_IH\<rparr> (\<Union> (c_offending_flows m \<lparr>nodes = V, edges = E\<rparr>)))
[PROOF STEP]
apply(simp add: delete_edges_simp2)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. all_security_requirements_fulfilled M \<lparr>nodes = V, edges = E_IH - \<Union> (c_offending_flows m \<lparr>nodes = V, edges = E\<rparr>)\<rparr>
[PROOF STEP]
apply(rule mono_rule)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. E_IH - \<Union> (c_offending_flows m \<lparr>nodes = V, edges = E\<rparr>) \<subseteq> E_IH
[PROOF STEP]
by fast
[PROOF STATE]
proof (state)
this:
all_security_requirements_fulfilled M (delete_edges (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>) (\<Union> (c_offending_flows m \<lparr>nodes = V, edges = E\<rparr>)))

goal (1 subgoal):
 1. \<And>a M V E. \<lbrakk>\<And>V E. \<lbrakk>valid_reqs M; wf_graph \<lparr>nodes = V, edges = E\<rparr>\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>); valid_reqs (a # M); wf_graph \<lparr>nodes = V, edges = E\<rparr>\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled (a # M) (generate_valid_topology (a # M) \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
from this
[PROOF STATE]
proof (chain)
picking this:
all_security_requirements_fulfilled M (delete_edges (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>) (\<Union> (c_offending_flows m \<lparr>nodes = V, edges = E\<rparr>)))
[PROOF STEP]
have goal2:
            "(\<forall>ma\<in>set M.
            c_sinvar ma (delete_edges (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>) (\<Union>(c_offending_flows m \<lparr>nodes = V, edges = E\<rparr>))))"
[PROOF STATE]
proof (prove)
using this:
all_security_requirements_fulfilled M (delete_edges (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>) (\<Union> (c_offending_flows m \<lparr>nodes = V, edges = E\<rparr>)))

goal (1 subgoal):
 1. \<forall>ma\<in>set M. c_sinvar ma (delete_edges (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>) (\<Union> (c_offending_flows m \<lparr>nodes = V, edges = E\<rparr>)))
[PROOF STEP]
by(simp add: all_security_requirements_fulfilled_def)
[PROOF STATE]
proof (state)
this:
\<forall>ma\<in>set M. c_sinvar ma (delete_edges (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>) (\<Union> (c_offending_flows m \<lparr>nodes = V, edges = E\<rparr>)))

goal (1 subgoal):
 1. \<And>a M V E. \<lbrakk>\<And>V E. \<lbrakk>valid_reqs M; wf_graph \<lparr>nodes = V, edges = E\<rparr>\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>); valid_reqs (a # M); wf_graph \<lparr>nodes = V, edges = E\<rparr>\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled (a # M) (generate_valid_topology (a # M) \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
from goal1 goal2
[PROOF STATE]
proof (chain)
picking this:
c_sinvar m (delete_edges (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>) (\<Union> (c_offending_flows m \<lparr>nodes = V, edges = E\<rparr>)))
\<forall>ma\<in>set M. c_sinvar ma (delete_edges (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>) (\<Union> (c_offending_flows m \<lparr>nodes = V, edges = E\<rparr>)))
[PROOF STEP]
show  "all_security_requirements_fulfilled (m # M) (generate_valid_topology (m # M) \<lparr>nodes = V, edges = E\<rparr>)"
[PROOF STATE]
proof (prove)
using this:
c_sinvar m (delete_edges (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>) (\<Union> (c_offending_flows m \<lparr>nodes = V, edges = E\<rparr>)))
\<forall>ma\<in>set M. c_sinvar ma (delete_edges (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>) (\<Union> (c_offending_flows m \<lparr>nodes = V, edges = E\<rparr>)))

goal (1 subgoal):
 1. all_security_requirements_fulfilled (m # M) (generate_valid_topology (m # M) \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
by (simp add: all_security_requirements_fulfilled_def)
[PROOF STATE]
proof (state)
this:
all_security_requirements_fulfilled (m # M) (generate_valid_topology (m # M) \<lparr>nodes = V, edges = E\<rparr>)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma "2 * (x::nat) \<noteq> 1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 2 * x \<noteq> 1
[PROOF STEP]
by (smt (verit))


[STATEMENT]
lemma nd_fun_plus_assoc[nd_fun_ka]: "x + y + z = x + (y + z)"
  and nd_fun_plus_comm[nd_fun_ka]: "x + y = y + x"
  and nd_fun_plus_idem[nd_fun_ka]: "x + x = x" for x::"'a nd_fun"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x + y + z = x + (y + z) &&& x + y = y + x &&& x + x = x
[PROOF STEP]
unfolding plus_nd_fun_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (((x\<^sub>\<bullet> \<squnion> y\<^sub>\<bullet>)\<^sup>\<bullet>)\<^sub>\<bullet> \<squnion> z\<^sub>\<bullet>)\<^sup>\<bullet> = (x\<^sub>\<bullet> \<squnion> ((y\<^sub>\<bullet> \<squnion> z\<^sub>\<bullet>)\<^sup>\<bullet>)\<^sub>\<bullet>)\<^sup>\<bullet> &&& (x\<^sub>\<bullet> \<squnion> y\<^sub>\<bullet>)\<^sup>\<bullet> = (y\<^sub>\<bullet> \<squnion> x\<^sub>\<bullet>)\<^sup>\<bullet> &&& (x\<^sub>\<bullet> \<squnion> x\<^sub>\<bullet>)\<^sup>\<bullet> = x
[PROOF STEP]
by (simp add: ksup_assoc, simp_all add: ksup_comm)


[STATEMENT]
lemma height_node42:
  "height l > 0 \<Longrightarrow> height(node42 l a m b n c r) =
   max (height l) (max (height m) (max (height n) (height r))) + 1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 < height l \<Longrightarrow> height (node42 l a m b n c r) = max (height l) (max (height m) (max (height n) (height r))) + 1
[PROOF STEP]
by(induct l a m b n c r rule: node42.induct)(simp_all add: max_def)


[STATEMENT]
lemma "I = (\<lambda>x. x) \<Longrightarrow> Ex P = Ex (\<lambda>x. P (I x))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. I = (\<lambda>x. x) \<Longrightarrow> Ex P = (\<exists>x. P (I x))
[PROOF STEP]
nitpick [expect = none]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. I = (\<lambda>x. x) \<Longrightarrow> Ex P = (\<exists>x. P (I x))
[PROOF STEP]
by auto


[STATEMENT]
lemma (in group) generate_inv_eq:
  assumes "a \<in> carrier G"
  shows "generate G {a} = generate G {inv a}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. generate G {a} = generate G {inv a}
[PROOF STEP]
by (intro generate_eqI;
      use assms generate.inv[of a] generate.inv[of "inv a" "{inv a}" G] inv_inv[OF assms] in auto)


[STATEMENT]
lemma iso_incl_trans:
  assumes "A \<lesssim> B" and "B \<lesssim> C" shows "A \<lesssim> C"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. A \<lesssim> C
[PROOF STEP]
using ring_hom_trans[OF assms[THEN iso_incl_backwards]]
[PROOF STATE]
proof (prove)
using this:
id \<circ> id \<in> ring_hom A C

goal (1 subgoal):
 1. A \<lesssim> C
[PROOF STEP]
by auto


[STATEMENT]
lemma p_recurrence'':
  assumes k: "k > n"
  shows   "p k = -(\<Sum>i=1..n. (-1) ^ i * e i * p (k - i))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. p k = - (\<Sum>i = 1..n. (- 1) ^ i * e i * p (k - i))
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
n < k

goal (1 subgoal):
 1. p k = - (\<Sum>i = 1..n. (- 1) ^ i * e i * p (k - i))
[PROOF STEP]
unfolding e_altdef p_altdef
[PROOF STATE]
proof (prove)
using this:
n < k

goal (1 subgoal):
 1. insertion x (powsum_mpoly {..<n} k) = - (\<Sum>i = 1..n. (- 1) ^ i * insertion x (sym_mpoly {..<n} i) * insertion x (powsum_mpoly {..<n} (k - i)))
[PROOF STEP]
by (subst powsum_mpoly_recurrence')
     (auto simp: insertion_sum insertion_add insertion_mult insertion_diff
                 insertion_power insertion_sym_mpoly)


[STATEMENT]
lemma Max_le_iMin_conv_le: "
  \<lbrakk> finite A; A \<noteq> {}; B \<noteq> {} \<rbrakk> \<Longrightarrow> (Max A \<le> iMin B) = (\<forall>a\<in>A. \<forall>b\<in>B. a \<le> b)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>finite A; A \<noteq> {}; B \<noteq> {}\<rbrakk> \<Longrightarrow> (Max A \<le> iMin B) = (\<forall>a\<in>A. \<forall>b\<in>B. a \<le> b)
[PROOF STEP]
by (blast intro: Max_le_iMin_imp_le le_imp_Max_le_iMin)


[STATEMENT]
lemma Inf_pres_downset: "Inf_pres (\<down>::'a::complete_lattice_with_dual \<Rightarrow> 'a set)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Inf_pres \<down>
[PROOF STEP]
unfolding downset_prop fun_eq_iff
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>x. ((\<lambda>x. {y. y \<le> x}) \<circ> Inf) x = (\<Inter> \<circ> (`) (\<lambda>x. {y. y \<le> x})) x
[PROOF STEP]
by (safe, simp_all add: le_Inf_iff)


[STATEMENT]
lemma Float_mantissa_exponent: "Float (mantissa f) (exponent f) = f"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Float (mantissa f) (exponent f) = f
[PROOF STEP]
unfolding real_of_float_eq mantissa_exponent[of f]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. real_of_float (Float (mantissa f) (exponent f)) = real_of_int (mantissa f) * 2 powr real_of_int (exponent f)
[PROOF STEP]
by simp


[STATEMENT]
lemma stable_UN:
    "(!!i. i \<in> I ==> F \<in> stable (A i)) ==> F \<in> stable (\<Union>i \<in> I. A i)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>i. i \<in> I \<Longrightarrow> F \<in> UNITY.stable (A i)) \<Longrightarrow> F \<in> UNITY.stable (\<Union> (A ` I))
[PROOF STEP]
apply (unfold stable_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>i. i \<in> I \<Longrightarrow> F \<in> A i co A i) \<Longrightarrow> F \<in> \<Union> (A ` I) co \<Union> (A ` I)
[PROOF STEP]
apply (blast intro: constrains_UN)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma single_LeadsTo_I:
     "(!!s. s \<in> A ==> F \<in> {s} LeadsTo B) ==> F \<in> A LeadsTo B"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>s. s \<in> A \<Longrightarrow> F \<in> {s} \<longmapsto>w B) \<Longrightarrow> F \<in> A \<longmapsto>w B
[PROOF STEP]
by (subst UN_singleton [symmetric], rule LeadsTo_UN, blast)


[STATEMENT]
lemma disjuncts_nb:
  assumes "bound0 p"
  shows "\<forall>q \<in> set (disjuncts p). bound0 q"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>q\<in>set (disjuncts p). bound0 q
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<forall>q\<in>set (disjuncts p). bound0 q
[PROOF STEP]
from assms
[PROOF STATE]
proof (chain)
picking this:
bound0 p
[PROOF STEP]
have "list_all bound0 (disjuncts p)"
[PROOF STATE]
proof (prove)
using this:
bound0 p

goal (1 subgoal):
 1. list_all bound0 (disjuncts p)
[PROOF STEP]
by (induct p rule: disjuncts.induct) auto
[PROOF STATE]
proof (state)
this:
list_all bound0 (disjuncts p)

goal (1 subgoal):
 1. \<forall>q\<in>set (disjuncts p). bound0 q
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
list_all bound0 (disjuncts p)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
list_all bound0 (disjuncts p)

goal (1 subgoal):
 1. \<forall>q\<in>set (disjuncts p). bound0 q
[PROOF STEP]
by (simp only: list_all_iff)
[PROOF STATE]
proof (state)
this:
\<forall>q\<in>set (disjuncts p). bound0 q

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
theorem join_assoc: "(x \<squnion> y) \<squnion> z = x \<squnion> (y \<squnion> z)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x \<squnion> y \<squnion> z = x \<squnion> (y \<squnion> z)
[PROOF STEP]
proof (rule joinI)
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. x \<squnion> y \<sqsubseteq> x \<squnion> (y \<squnion> z)
 2. z \<sqsubseteq> x \<squnion> (y \<squnion> z)
 3. \<And>za. \<lbrakk>x \<squnion> y \<sqsubseteq> za; z \<sqsubseteq> za\<rbrakk> \<Longrightarrow> x \<squnion> (y \<squnion> z) \<sqsubseteq> za
[PROOF STEP]
show "x \<squnion> y \<sqsubseteq> x \<squnion> (y \<squnion> z)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x \<squnion> y \<sqsubseteq> x \<squnion> (y \<squnion> z)
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. x \<sqsubseteq> x \<squnion> (y \<squnion> z)
 2. y \<sqsubseteq> x \<squnion> (y \<squnion> z)
[PROOF STEP]
show "x \<sqsubseteq> x \<squnion> (y \<squnion> z)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x \<sqsubseteq> x \<squnion> (y \<squnion> z)
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
x \<sqsubseteq> x \<squnion> (y \<squnion> z)

goal (1 subgoal):
 1. y \<sqsubseteq> x \<squnion> (y \<squnion> z)
[PROOF STEP]
show "y \<sqsubseteq> x \<squnion> (y \<squnion> z)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. y \<sqsubseteq> x \<squnion> (y \<squnion> z)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. y \<sqsubseteq> x \<squnion> (y \<squnion> z)
[PROOF STEP]
have "y \<sqsubseteq> y \<squnion> z"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. y \<sqsubseteq> y \<squnion> z
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
y \<sqsubseteq> y \<squnion> z

goal (1 subgoal):
 1. y \<sqsubseteq> x \<squnion> (y \<squnion> z)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
y \<sqsubseteq> y \<squnion> z

goal (1 subgoal):
 1. y \<sqsubseteq> x \<squnion> (y \<squnion> z)
[PROOF STEP]
have "... \<sqsubseteq> x \<squnion> (y \<squnion> z)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. y \<squnion> z \<sqsubseteq> x \<squnion> (y \<squnion> z)
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
y \<squnion> z \<sqsubseteq> x \<squnion> (y \<squnion> z)

goal (1 subgoal):
 1. y \<sqsubseteq> x \<squnion> (y \<squnion> z)
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
y \<sqsubseteq> x \<squnion> (y \<squnion> z)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
y \<sqsubseteq> x \<squnion> (y \<squnion> z)

goal (1 subgoal):
 1. y \<sqsubseteq> x \<squnion> (y \<squnion> z)
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
y \<sqsubseteq> x \<squnion> (y \<squnion> z)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
y \<sqsubseteq> x \<squnion> (y \<squnion> z)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
x \<squnion> y \<sqsubseteq> x \<squnion> (y \<squnion> z)

goal (2 subgoals):
 1. z \<sqsubseteq> x \<squnion> (y \<squnion> z)
 2. \<And>za. \<lbrakk>x \<squnion> y \<sqsubseteq> za; z \<sqsubseteq> za\<rbrakk> \<Longrightarrow> x \<squnion> (y \<squnion> z) \<sqsubseteq> za
[PROOF STEP]
show "z \<sqsubseteq> x \<squnion> (y \<squnion> z)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. z \<sqsubseteq> x \<squnion> (y \<squnion> z)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. z \<sqsubseteq> x \<squnion> (y \<squnion> z)
[PROOF STEP]
have "z \<sqsubseteq> y \<squnion> z"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. z \<sqsubseteq> y \<squnion> z
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
z \<sqsubseteq> y \<squnion> z

goal (1 subgoal):
 1. z \<sqsubseteq> x \<squnion> (y \<squnion> z)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
z \<sqsubseteq> y \<squnion> z

goal (1 subgoal):
 1. z \<sqsubseteq> x \<squnion> (y \<squnion> z)
[PROOF STEP]
have "... \<sqsubseteq> x \<squnion> (y \<squnion> z)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. y \<squnion> z \<sqsubseteq> x \<squnion> (y \<squnion> z)
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
y \<squnion> z \<sqsubseteq> x \<squnion> (y \<squnion> z)

goal (1 subgoal):
 1. z \<sqsubseteq> x \<squnion> (y \<squnion> z)
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
z \<sqsubseteq> x \<squnion> (y \<squnion> z)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
z \<sqsubseteq> x \<squnion> (y \<squnion> z)

goal (1 subgoal):
 1. z \<sqsubseteq> x \<squnion> (y \<squnion> z)
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
z \<sqsubseteq> x \<squnion> (y \<squnion> z)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
z \<sqsubseteq> x \<squnion> (y \<squnion> z)

goal (1 subgoal):
 1. \<And>za. \<lbrakk>x \<squnion> y \<sqsubseteq> za; z \<sqsubseteq> za\<rbrakk> \<Longrightarrow> x \<squnion> (y \<squnion> z) \<sqsubseteq> za
[PROOF STEP]
fix w
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>za. \<lbrakk>x \<squnion> y \<sqsubseteq> za; z \<sqsubseteq> za\<rbrakk> \<Longrightarrow> x \<squnion> (y \<squnion> z) \<sqsubseteq> za
[PROOF STEP]
assume "x \<squnion> y \<sqsubseteq> w" and "z \<sqsubseteq> w"
[PROOF STATE]
proof (state)
this:
x \<squnion> y \<sqsubseteq> w
z \<sqsubseteq> w

goal (1 subgoal):
 1. \<And>za. \<lbrakk>x \<squnion> y \<sqsubseteq> za; z \<sqsubseteq> za\<rbrakk> \<Longrightarrow> x \<squnion> (y \<squnion> z) \<sqsubseteq> za
[PROOF STEP]
show "x \<squnion> (y \<squnion> z) \<sqsubseteq> w"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x \<squnion> (y \<squnion> z) \<sqsubseteq> w
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. x \<sqsubseteq> w
 2. y \<squnion> z \<sqsubseteq> w
[PROOF STEP]
show "x \<sqsubseteq> w"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x \<sqsubseteq> w
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. x \<sqsubseteq> w
[PROOF STEP]
have "x \<sqsubseteq> x \<squnion> y"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x \<sqsubseteq> x \<squnion> y
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
x \<sqsubseteq> x \<squnion> y

goal (1 subgoal):
 1. x \<sqsubseteq> w
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
x \<sqsubseteq> x \<squnion> y

goal (1 subgoal):
 1. x \<sqsubseteq> w
[PROOF STEP]
have "\<dots> \<sqsubseteq> w"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x \<squnion> y \<sqsubseteq> w
[PROOF STEP]
by fact
[PROOF STATE]
proof (state)
this:
x \<squnion> y \<sqsubseteq> w

goal (1 subgoal):
 1. x \<sqsubseteq> w
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
x \<sqsubseteq> w
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
x \<sqsubseteq> w

goal (1 subgoal):
 1. x \<sqsubseteq> w
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
x \<sqsubseteq> w

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
x \<sqsubseteq> w

goal (1 subgoal):
 1. y \<squnion> z \<sqsubseteq> w
[PROOF STEP]
show "y \<squnion> z \<sqsubseteq> w"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. y \<squnion> z \<sqsubseteq> w
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. y \<sqsubseteq> w
 2. z \<sqsubseteq> w
[PROOF STEP]
show "y \<sqsubseteq> w"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. y \<sqsubseteq> w
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. y \<sqsubseteq> w
[PROOF STEP]
have "y \<sqsubseteq> x \<squnion> y"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. y \<sqsubseteq> x \<squnion> y
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
y \<sqsubseteq> x \<squnion> y

goal (1 subgoal):
 1. y \<sqsubseteq> w
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
y \<sqsubseteq> x \<squnion> y

goal (1 subgoal):
 1. y \<sqsubseteq> w
[PROOF STEP]
have "... \<sqsubseteq> w"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x \<squnion> y \<sqsubseteq> w
[PROOF STEP]
by fact
[PROOF STATE]
proof (state)
this:
x \<squnion> y \<sqsubseteq> w

goal (1 subgoal):
 1. y \<sqsubseteq> w
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
y \<sqsubseteq> w
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
y \<sqsubseteq> w

goal (1 subgoal):
 1. y \<sqsubseteq> w
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
y \<sqsubseteq> w

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
y \<sqsubseteq> w

goal (1 subgoal):
 1. z \<sqsubseteq> w
[PROOF STEP]
show "z \<sqsubseteq> w"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. z \<sqsubseteq> w
[PROOF STEP]
by fact
[PROOF STATE]
proof (state)
this:
z \<sqsubseteq> w

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
y \<squnion> z \<sqsubseteq> w

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
x \<squnion> (y \<squnion> z) \<sqsubseteq> w

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma degree_diff_le: "degree p \<le> n \<Longrightarrow> degree q \<le> n \<Longrightarrow> degree (p - q) \<le> n"
  for p q :: "'a::ab_group_add poly"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>degree p \<le> n; degree q \<le> n\<rbrakk> \<Longrightarrow> degree (p - q) \<le> n
[PROOF STEP]
using degree_add_le [of p n "- q"]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>degree p \<le> n; degree (- q) \<le> n\<rbrakk> \<Longrightarrow> degree (p + - q) \<le> n

goal (1 subgoal):
 1. \<lbrakk>degree p \<le> n; degree q \<le> n\<rbrakk> \<Longrightarrow> degree (p - q) \<le> n
[PROOF STEP]
by simp


[STATEMENT]
lemma cong_square_alt:
  "prime p \<Longrightarrow> [a * a = 1] (mod p) \<Longrightarrow> [a = 1] (mod p) \<or> [a = p - 1] (mod p)"
  for a p :: nat
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>prime p; [a * a = 1] (mod p)\<rbrakk> \<Longrightarrow> [a = 1] (mod p) \<or> [a = p - 1] (mod p)
[PROOF STEP]
using cong_square_alt_int[of "int p" "int a"] prime_nat_int_transfer[of p] prime_gt_1_nat[of p]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>prime (int p); [int a * int a = 1] (mod int p)\<rbrakk> \<Longrightarrow> [int a = 1] (mod int p) \<or> [int a = int p - 1] (mod int p)
prime (int p) = prime p
prime p \<Longrightarrow> 1 < p

goal (1 subgoal):
 1. \<lbrakk>prime p; [a * a = 1] (mod p)\<rbrakk> \<Longrightarrow> [a = 1] (mod p) \<or> [a = p - 1] (mod p)
[PROOF STEP]
by (simp flip: cong_int_iff add: of_nat_diff)


[STATEMENT]
lemma irreflp_on_converse:
  "irreflp_on P A \<Longrightarrow> irreflp_on P\<inverse>\<inverse> A"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. irreflp_on P A \<Longrightarrow> irreflp_on P\<inverse>\<inverse> A
[PROOF STEP]
unfolding irreflp_on_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>a\<in>A. \<not> P a a \<Longrightarrow> \<forall>a\<in>A. \<not> P\<inverse>\<inverse> a a
[PROOF STEP]
by blast


[STATEMENT]
lemma pt_eqvt_fun2b:
  fixes f     :: "'a\<Rightarrow>'b"
  assumes pt1: "pt TYPE('a) TYPE('x)"
  and     pt2: "pt TYPE('b) TYPE('x)"
  and     at: "at TYPE('x)"
  assumes a: "\<forall>(pi::'x prm) (x::'a). pi\<bullet>(f x) = f(pi\<bullet>x)"
  shows "((supp f)::'x set)={}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. supp f = {}
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. supp f = {}
[PROOF STEP]
from a
[PROOF STATE]
proof (chain)
picking this:
\<forall>pi x. pi \<bullet> f x = f (pi \<bullet> x)
[PROOF STEP]
have "\<forall>(pi::'x prm). pi\<bullet>f = f"
[PROOF STATE]
proof (prove)
using this:
\<forall>pi x. pi \<bullet> f x = f (pi \<bullet> x)

goal (1 subgoal):
 1. \<forall>pi. pi \<bullet> f = f
[PROOF STEP]
by (simp add: pt_fun_eq[OF pt1, OF at, symmetric])
[PROOF STATE]
proof (state)
this:
\<forall>pi. pi \<bullet> f = f

goal (1 subgoal):
 1. supp f = {}
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
\<forall>pi. pi \<bullet> f = f

goal (1 subgoal):
 1. supp f = {}
[PROOF STEP]
by (simp add: supp_def)
[PROOF STATE]
proof (state)
this:
supp f = {}

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma Red_I_of_Inf_to_N:
  "\<iota> \<in> Inf \<Longrightarrow> concl_of \<iota> \<in> N \<Longrightarrow> \<iota> \<in> Red_I N"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<iota> \<in> Inf; concl_of \<iota> \<in> N\<rbrakk> \<Longrightarrow> \<iota> \<in> Red_I N
[PROOF STEP]
unfolding Red_I_conv
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<iota> \<in> Inf; concl_of \<iota> \<in> N\<rbrakk> \<Longrightarrow> \<iota> \<in> fin_std_red.Red_I N
[PROOF STEP]
by (rule fin_std_red.Red_I_of_Inf_to_N)


[STATEMENT]
lemma inner_diff_right: "inner x (y - z) = inner x y - inner x z"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. inner x (y - z) = inner x y - inner x z
[PROOF STEP]
using inner_diff_left [of y z x]
[PROOF STATE]
proof (prove)
using this:
inner (y - z) x = inner y x - inner z x

goal (1 subgoal):
 1. inner x (y - z) = inner x y - inner x z
[PROOF STEP]
by (metis add_uminus_conv_diff local.inner_add_right local.inner_minus_right)


[STATEMENT]
lemma sq_norm_poly_pCons [simp]:
  fixes a :: "'a :: conjugatable_ring"
  shows "\<parallel>pCons a p\<parallel>\<^sup>2 = \<parallel>a\<parallel>\<^sup>2 + \<parallel>p\<parallel>\<^sup>2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<parallel>pCons a p\<parallel>\<^sup>2 = sq_norm_conjugate a + \<parallel>p\<parallel>\<^sup>2
[PROOF STEP]
by (cases "p = 0"; cases "a = 0", auto simp: sq_norm_poly_def)


[STATEMENT]
lemma transpose_transpose[simp]: "transpose (transpose A) = A"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Square_Matrix.transpose (Square_Matrix.transpose A) = A
[PROOF STEP]
by transfer simp


[STATEMENT]
lemma Suc_llength: "enat (Suc n) < llength xs \<Longrightarrow> enat n < llength xs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. enat (Suc n) < llength xs \<Longrightarrow> enat n < llength xs
[PROOF STEP]
using dual_order.strict_trans enat_ord_simps(2)
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?b < ?a; ?c < ?b\<rbrakk> \<Longrightarrow> ?c < ?a
(enat ?m < enat ?n) = (?m < ?n)

goal (1 subgoal):
 1. enat (Suc n) < llength xs \<Longrightarrow> enat n < llength xs
[PROOF STEP]
by blast


[STATEMENT]
lemma divisors_pos_fun_int: "divisors_pos_fun divisors_int_pos"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. divisors_pos_fun divisors_int_pos
[PROOF STEP]
unfolding divisors_pos_fun_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<forall>x. x \<noteq> 0 \<longrightarrow> set (divisors_int_pos x) = {d. d dvd x \<and> 0 < d}) \<and> (\<forall>x. distinct (divisors_int_pos x))
[PROOF STEP]
using divisors_int_pos
[PROOF STATE]
proof (prove)
using this:
?x \<noteq> 0 \<Longrightarrow> set (divisors_int_pos ?x) = {i. i dvd ?x \<and> 0 < i}
distinct (divisors_int_pos ?x)
divisors_int_pos 0 = []

goal (1 subgoal):
 1. (\<forall>x. x \<noteq> 0 \<longrightarrow> set (divisors_int_pos x) = {d. d dvd x \<and> 0 < d}) \<and> (\<forall>x. distinct (divisors_int_pos x))
[PROOF STEP]
by auto


[STATEMENT]
lemma rangeC_eq_empty: "rangeC A = {} \<longleftrightarrow> A = {}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (rangeC A = {}) = (A = {})
[PROOF STEP]
by(auto simp add: rangeC_def)


[STATEMENT]
lemma r01_to_r01_r01_fst'in01:
  "\<And>n. r01_to_r01_r01_fst' r n \<in> {0,1}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>n. r01_to_r01_r01_fst' r n \<in> {0, 1}
[PROOF STEP]
using real01_binary_expansion'_0or1
[PROOF STATE]
proof (prove)
using this:
r01_binary_expansion' ?r ?n \<in> {0, 1}

goal (1 subgoal):
 1. \<And>n. r01_to_r01_r01_fst' r n \<in> {0, 1}
[PROOF STEP]
by (simp add: r01_to_r01_r01_fst'_def)


[STATEMENT]
lemma vec_to_iarray_matrix_matrix_mult[code_unfold]:
  fixes A::"'a::{semiring_1}^'m::{mod_type}^'n::{mod_type}" and x::"'a^'m::{mod_type}"
  shows "vec_to_iarray (A *v x) = (matrix_to_iarray A) *iv (vec_to_iarray x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vec_to_iarray (A *v x) = matrix_to_iarray A *iv vec_to_iarray x
[PROOF STEP]
unfolding matrix_vector_mult_iarray_def matrix_vector_mult_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vec_to_iarray (\<chi>i. \<Sum>j\<in>UNIV. A $ i $ j * x $ j) = IArray.of_fun (\<lambda>i. \<Sum>j = 0..<IArray.length (vec_to_iarray x). matrix_to_iarray A !! i !! j * vec_to_iarray x !! j) (nrows_iarray (matrix_to_iarray A))
[PROOF STEP]
unfolding o_def tabulate2_def nrows_iarray_def ncols_iarray_def matrix_to_iarray_def vec_to_iarray_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. IArray.of_fun (\<lambda>i. (\<chi>i. \<Sum>j\<in>UNIV. A $ i $ j * x $ j) $ mod_type_class.from_nat i) CARD('n) = IArray.of_fun (\<lambda>i. \<Sum>j = 0..<IArray.length (IArray.of_fun (\<lambda>i. x $ mod_type_class.from_nat i) CARD('m)). IArray (map (\<lambda>x. IArray.of_fun (\<lambda>i. A $ mod_type_class.from_nat x $ mod_type_class.from_nat i) CARD('m)) [0..<CARD('n)]) !! i !! j * IArray.of_fun (\<lambda>i. x $ mod_type_class.from_nat i) CARD('m) !! j) (IArray.length (IArray (map (\<lambda>x. IArray.of_fun (\<lambda>i. A $ mod_type_class.from_nat x $ mod_type_class.from_nat i) CARD('m)) [0..<CARD('n)])))
[PROOF STEP]
using sum.reindex_cong[of "from_nat::nat=>'m"]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>inj_on mod_type_class.from_nat ?B; ?A = mod_type_class.from_nat ` ?B; \<And>x. x \<in> ?B \<Longrightarrow> ?g (mod_type_class.from_nat x) = ?h x\<rbrakk> \<Longrightarrow> sum ?g ?A = sum ?h ?B

goal (1 subgoal):
 1. IArray.of_fun (\<lambda>i. (\<chi>i. \<Sum>j\<in>UNIV. A $ i $ j * x $ j) $ mod_type_class.from_nat i) CARD('n) = IArray.of_fun (\<lambda>i. \<Sum>j = 0..<IArray.length (IArray.of_fun (\<lambda>i. x $ mod_type_class.from_nat i) CARD('m)). IArray (map (\<lambda>x. IArray.of_fun (\<lambda>i. A $ mod_type_class.from_nat x $ mod_type_class.from_nat i) CARD('m)) [0..<CARD('n)]) !! i !! j * IArray.of_fun (\<lambda>i. x $ mod_type_class.from_nat i) CARD('m) !! j) (IArray.length (IArray (map (\<lambda>x. IArray.of_fun (\<lambda>i. A $ mod_type_class.from_nat x $ mod_type_class.from_nat i) CARD('m)) [0..<CARD('n)])))
[PROOF STEP]
using bij_from_nat
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>inj_on mod_type_class.from_nat ?B; ?A = mod_type_class.from_nat ` ?B; \<And>x. x \<in> ?B \<Longrightarrow> ?g (mod_type_class.from_nat x) = ?h x\<rbrakk> \<Longrightarrow> sum ?g ?A = sum ?h ?B
bij_betw mod_type_class.from_nat {0..<CARD(?'a)} UNIV

goal (1 subgoal):
 1. IArray.of_fun (\<lambda>i. (\<chi>i. \<Sum>j\<in>UNIV. A $ i $ j * x $ j) $ mod_type_class.from_nat i) CARD('n) = IArray.of_fun (\<lambda>i. \<Sum>j = 0..<IArray.length (IArray.of_fun (\<lambda>i. x $ mod_type_class.from_nat i) CARD('m)). IArray (map (\<lambda>x. IArray.of_fun (\<lambda>i. A $ mod_type_class.from_nat x $ mod_type_class.from_nat i) CARD('m)) [0..<CARD('n)]) !! i !! j * IArray.of_fun (\<lambda>i. x $ mod_type_class.from_nat i) CARD('m) !! j) (IArray.length (IArray (map (\<lambda>x. IArray.of_fun (\<lambda>i. A $ mod_type_class.from_nat x $ mod_type_class.from_nat i) CARD('m)) [0..<CARD('n)])))
[PROOF STEP]
unfolding bij_betw_def
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>inj_on mod_type_class.from_nat ?B; ?A = mod_type_class.from_nat ` ?B; \<And>x. x \<in> ?B \<Longrightarrow> ?g (mod_type_class.from_nat x) = ?h x\<rbrakk> \<Longrightarrow> sum ?g ?A = sum ?h ?B
inj_on mod_type_class.from_nat {0..<CARD(?'a)} \<and> mod_type_class.from_nat ` {0..<CARD(?'a)} = UNIV

goal (1 subgoal):
 1. IArray.of_fun (\<lambda>i. (\<chi>i. \<Sum>j\<in>UNIV. A $ i $ j * x $ j) $ mod_type_class.from_nat i) CARD('n) = IArray.of_fun (\<lambda>i. \<Sum>j = 0..<IArray.length (IArray.of_fun (\<lambda>i. x $ mod_type_class.from_nat i) CARD('m)). IArray (map (\<lambda>x. IArray.of_fun (\<lambda>i. A $ mod_type_class.from_nat x $ mod_type_class.from_nat i) CARD('m)) [0..<CARD('n)]) !! i !! j * IArray.of_fun (\<lambda>i. x $ mod_type_class.from_nat i) CARD('m) !! j) (IArray.length (IArray (map (\<lambda>x. IArray.of_fun (\<lambda>i. A $ mod_type_class.from_nat x $ mod_type_class.from_nat i) CARD('m)) [0..<CARD('n)])))
[PROOF STEP]
by fastforce


[STATEMENT]
lemma min_simps[simp]:
  "a<(b::'a::order) \<Longrightarrow> min a b = a"
  "b<(a::'a::order) \<Longrightarrow> min a b = b"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (a < b \<Longrightarrow> min a b = a) &&& (b < a \<Longrightarrow> min a b = b)
[PROOF STEP]
by (auto simp add: min_def dest: less_imp_le)


[STATEMENT]
lemma matrix_eqI:
  assumes "\<And>x. x \<in> Basis \<Longrightarrow> A *v x = B *v x"
  shows "(A::real^'n^'n) = B"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. A = B
[PROOF STEP]
apply vector
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>i ia. A $ i $ ia = B $ i $ ia
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
?x \<in> Basis \<Longrightarrow> A *v ?x = B *v ?x

goal (1 subgoal):
 1. \<forall>i ia. A $ i $ ia = B $ i $ ia
[PROOF STEP]
apply (auto simp: Basis_vec_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>i ia. (\<And>x. \<exists>xa. x = axis xa 1 \<Longrightarrow> A *v x = B *v x) \<Longrightarrow> A $ i $ ia = B $ i $ ia
[PROOF STEP]
by (metis cart_eq_inner_axis matrix_vector_mul_component)


[STATEMENT]
lemma backward_finite_path_root_terminating_or_cycle:
  "backward_finite_path_root r x \<longleftrightarrow> backward_terminating_path_root r x \<or> non_empty_cycle_root r x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. backward_finite_path_root r x = (backward_terminating_path_root r x \<or> non_empty_cycle_root r x)
[PROOF STEP]
using cycle_iff backward_finite_path_root_def
[PROOF STATE]
proof (prove)
using this:
point ?r \<Longrightarrow> (?x ; ?r \<noteq> 0) = (?r \<le> ?x\<^sup>T ; 1)
backward_finite_path_root ?r ?x \<equiv> connected_root ?r ?x \<and> is_inj ?x \<and> is_p_fun ?x \<and> point ?r

goal (1 subgoal):
 1. backward_finite_path_root r x = (backward_terminating_path_root r x \<or> non_empty_cycle_root r x)
[PROOF STEP]
by blast


[STATEMENT]
lemma agree_supset:"A \<supseteq> B \<Longrightarrow> Vagree \<nu> \<nu>' A \<Longrightarrow> Vagree \<nu> \<nu>' B"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>B \<subseteq> A; Vagree \<nu> \<nu>' A\<rbrakk> \<Longrightarrow> Vagree \<nu> \<nu>' B
[PROOF STEP]
by (auto simp add: Vagree_def)


[STATEMENT]
lemma inj_vrat_of_rat: "inj vrat_of_rat"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. inj vrat_of_rat
[PROOF STEP]
using inj_vreal_of_real
[PROOF STATE]
proof (prove)
using this:
inj vreal_of_real

goal (1 subgoal):
 1. inj vrat_of_rat
[PROOF STEP]
unfolding vrat_of_rat_def inj_def of_rat_eq_iff
[PROOF STATE]
proof (prove)
using this:
\<forall>x y. x\<^sub>\<real> = y\<^sub>\<real> \<longrightarrow> x = y

goal (1 subgoal):
 1. \<forall>x y. (real_of_rat x)\<^sub>\<real> = (real_of_rat y)\<^sub>\<real> \<longrightarrow> x = y
[PROOF STEP]
by force


[STATEMENT]
lemma NSLIMSEQ_inverse_real_of_nat_add_minus_mult:
  "(\<lambda>n. r * (1 + - inverse (real (Suc n)))) \<longlonglongrightarrow>\<^sub>N\<^sub>S r"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lambda>n. r * (1 + - inverse (real (Suc n)))) \<longlonglongrightarrow>\<^sub>N\<^sub>S r
[PROOF STEP]
using LIMSEQ_inverse_real_of_nat_add_minus_mult
[PROOF STATE]
proof (prove)
using this:
(\<lambda>n. ?r * (1 + - inverse (real (Suc n)))) \<longlonglongrightarrow> ?r

goal (1 subgoal):
 1. (\<lambda>n. r * (1 + - inverse (real (Suc n)))) \<longlonglongrightarrow>\<^sub>N\<^sub>S r
[PROOF STEP]
by (simp add: LIMSEQ_NSLIMSEQ_iff [symmetric])


[STATEMENT]
lemma homotopy_equivalence_relative_homology_group_isomorphisms:
  assumes contf: "continuous_map X Y f" and fim: "f ` S \<subseteq> T"
      and contg: "continuous_map Y X g" and gim: "g ` T \<subseteq> S"
      and gf: "homotopic_with (\<lambda>h. h ` S \<subseteq> S) X X (g \<circ> f) id"
      and fg: "homotopic_with (\<lambda>k. k ` T \<subseteq> T) Y Y (f \<circ> g) id"
    shows "group_isomorphisms (relative_homology_group p X S) (relative_homology_group p Y T)
                (hom_induced p X S Y T f) (hom_induced p Y T X S g)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. group_isomorphisms (relative_homology_group p X S) (relative_homology_group p Y T) (hom_induced p X S Y T f) (hom_induced p Y T X S g)
[PROOF STEP]
unfolding group_isomorphisms_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. hom_induced p X S Y T f \<in> hom (relative_homology_group p X S) (relative_homology_group p Y T) \<and> hom_induced p Y T X S g \<in> hom (relative_homology_group p Y T) (relative_homology_group p X S) \<and> (\<forall>x\<in>carrier (relative_homology_group p X S). hom_induced p Y T X S g (hom_induced p X S Y T f x) = x) \<and> (\<forall>y\<in>carrier (relative_homology_group p Y T). hom_induced p X S Y T f (hom_induced p Y T X S g y) = y)
[PROOF STEP]
proof (intro conjI ballI)
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. hom_induced p X S Y T f \<in> hom (relative_homology_group p X S) (relative_homology_group p Y T)
 2. hom_induced p Y T X S g \<in> hom (relative_homology_group p Y T) (relative_homology_group p X S)
 3. \<And>x. x \<in> carrier (relative_homology_group p X S) \<Longrightarrow> hom_induced p Y T X S g (hom_induced p X S Y T f x) = x
 4. \<And>y. y \<in> carrier (relative_homology_group p Y T) \<Longrightarrow> hom_induced p X S Y T f (hom_induced p Y T X S g y) = y
[PROOF STEP]
fix x
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. hom_induced p X S Y T f \<in> hom (relative_homology_group p X S) (relative_homology_group p Y T)
 2. hom_induced p Y T X S g \<in> hom (relative_homology_group p Y T) (relative_homology_group p X S)
 3. \<And>x. x \<in> carrier (relative_homology_group p X S) \<Longrightarrow> hom_induced p Y T X S g (hom_induced p X S Y T f x) = x
 4. \<And>y. y \<in> carrier (relative_homology_group p Y T) \<Longrightarrow> hom_induced p X S Y T f (hom_induced p Y T X S g y) = y
[PROOF STEP]
assume x: "x \<in> carrier (relative_homology_group p X S)"
[PROOF STATE]
proof (state)
this:
x \<in> carrier (relative_homology_group p X S)

goal (4 subgoals):
 1. hom_induced p X S Y T f \<in> hom (relative_homology_group p X S) (relative_homology_group p Y T)
 2. hom_induced p Y T X S g \<in> hom (relative_homology_group p Y T) (relative_homology_group p X S)
 3. \<And>x. x \<in> carrier (relative_homology_group p X S) \<Longrightarrow> hom_induced p Y T X S g (hom_induced p X S Y T f x) = x
 4. \<And>y. y \<in> carrier (relative_homology_group p Y T) \<Longrightarrow> hom_induced p X S Y T f (hom_induced p Y T X S g y) = y
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
x \<in> carrier (relative_homology_group p X S)
[PROOF STEP]
show "hom_induced p Y T X S g (hom_induced p X S Y T f x) = x"
[PROOF STATE]
proof (prove)
using this:
x \<in> carrier (relative_homology_group p X S)

goal (1 subgoal):
 1. hom_induced p Y T X S g (hom_induced p X S Y T f x) = x
[PROOF STEP]
using homology_homotopy_axiom [OF gf, of p]
[PROOF STATE]
proof (prove)
using this:
x \<in> carrier (relative_homology_group p X S)
hom_induced p X S X S (g \<circ> f) = hom_induced p X S X S id

goal (1 subgoal):
 1. hom_induced p Y T X S g (hom_induced p X S Y T f x) = x
[PROOF STEP]
apply (simp add: hom_induced_compose [OF contf fim contg gim])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>x \<in> carrier (relative_homology_group p X S); hom_induced p Y T X S g \<circ> hom_induced p X S Y T f = hom_induced p X S X S id\<rbrakk> \<Longrightarrow> hom_induced p Y T X S g (hom_induced p X S Y T f x) = x
[PROOF STEP]
apply (metis comp_apply hom_induced_id)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
hom_induced p Y T X S g (hom_induced p X S Y T f x) = x

goal (3 subgoals):
 1. hom_induced p X S Y T f \<in> hom (relative_homology_group p X S) (relative_homology_group p Y T)
 2. hom_induced p Y T X S g \<in> hom (relative_homology_group p Y T) (relative_homology_group p X S)
 3. \<And>y. y \<in> carrier (relative_homology_group p Y T) \<Longrightarrow> hom_induced p X S Y T f (hom_induced p Y T X S g y) = y
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. hom_induced p X S Y T f \<in> hom (relative_homology_group p X S) (relative_homology_group p Y T)
 2. hom_induced p Y T X S g \<in> hom (relative_homology_group p Y T) (relative_homology_group p X S)
 3. \<And>y. y \<in> carrier (relative_homology_group p Y T) \<Longrightarrow> hom_induced p X S Y T f (hom_induced p Y T X S g y) = y
[PROOF STEP]
fix y
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. hom_induced p X S Y T f \<in> hom (relative_homology_group p X S) (relative_homology_group p Y T)
 2. hom_induced p Y T X S g \<in> hom (relative_homology_group p Y T) (relative_homology_group p X S)
 3. \<And>y. y \<in> carrier (relative_homology_group p Y T) \<Longrightarrow> hom_induced p X S Y T f (hom_induced p Y T X S g y) = y
[PROOF STEP]
assume "y \<in> carrier (relative_homology_group p Y T)"
[PROOF STATE]
proof (state)
this:
y \<in> carrier (relative_homology_group p Y T)

goal (3 subgoals):
 1. hom_induced p X S Y T f \<in> hom (relative_homology_group p X S) (relative_homology_group p Y T)
 2. hom_induced p Y T X S g \<in> hom (relative_homology_group p Y T) (relative_homology_group p X S)
 3. \<And>y. y \<in> carrier (relative_homology_group p Y T) \<Longrightarrow> hom_induced p X S Y T f (hom_induced p Y T X S g y) = y
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
y \<in> carrier (relative_homology_group p Y T)
[PROOF STEP]
show "hom_induced p X S Y T f (hom_induced p Y T X S g y) = y"
[PROOF STATE]
proof (prove)
using this:
y \<in> carrier (relative_homology_group p Y T)

goal (1 subgoal):
 1. hom_induced p X S Y T f (hom_induced p Y T X S g y) = y
[PROOF STEP]
using homology_homotopy_axiom [OF fg, of p]
[PROOF STATE]
proof (prove)
using this:
y \<in> carrier (relative_homology_group p Y T)
hom_induced p Y T Y T (f \<circ> g) = hom_induced p Y T Y T id

goal (1 subgoal):
 1. hom_induced p X S Y T f (hom_induced p Y T X S g y) = y
[PROOF STEP]
apply (simp add: hom_induced_compose [OF contg gim contf fim])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>y \<in> carrier (relative_homology_group p Y T); hom_induced p X S Y T f \<circ> hom_induced p Y T X S g = hom_induced p Y T Y T id\<rbrakk> \<Longrightarrow> hom_induced p X S Y T f (hom_induced p Y T X S g y) = y
[PROOF STEP]
apply (metis comp_apply hom_induced_id)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
hom_induced p X S Y T f (hom_induced p Y T X S g y) = y

goal (2 subgoals):
 1. hom_induced p X S Y T f \<in> hom (relative_homology_group p X S) (relative_homology_group p Y T)
 2. hom_induced p Y T X S g \<in> hom (relative_homology_group p Y T) (relative_homology_group p X S)
[PROOF STEP]
qed (auto simp: hom_induced_hom)


[STATEMENT]
lemma identify_blocksD: assumes "k < n" and "(i,j) \<in> set (identify_blocks A k)"
  shows "i \<le> j" "j < k"
  "\<And> l. i \<le> l \<Longrightarrow> l < j \<Longrightarrow> A $$ (l, Suc l) = 1"
  "Suc j \<noteq> k \<Longrightarrow> A $$ (j, Suc j) \<noteq> 1"
  "i > 0 \<Longrightarrow> A $$ (i - 1, i - 1) \<noteq> A $$ (k,k) \<or> A $$ (i - 1, i) \<noteq> 1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (i \<le> j &&& j < k) &&& (\<And>l. \<lbrakk>i \<le> l; l < j\<rbrakk> \<Longrightarrow> A $$ (l, Suc l) = (1::'b)) &&& (Suc j \<noteq> k \<Longrightarrow> A $$ (j, Suc j) \<noteq> (1::'b)) &&& (0 < i \<Longrightarrow> A $$ (i - 1, i - 1) \<noteq> A $$ (k, k) \<or> A $$ (i - 1, i) \<noteq> (1::'b))
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
k < n
(i, j) \<in> set (identify_blocks A k)

goal (1 subgoal):
 1. (i \<le> j &&& j < k) &&& (\<And>l. \<lbrakk>i \<le> l; l < j\<rbrakk> \<Longrightarrow> A $$ (l, Suc l) = (1::'b)) &&& (Suc j \<noteq> k \<Longrightarrow> A $$ (j, Suc j) \<noteq> (1::'b)) &&& (0 < i \<Longrightarrow> A $$ (i - 1, i - 1) \<noteq> A $$ (k, k) \<or> A $$ (i - 1, i) \<noteq> (1::'b))
[PROOF STEP]
unfolding identify_blocks_iff[OF assms(1)]
[PROOF STATE]
proof (prove)
using this:
k < n
(i, j) \<in> {(i, j) |i j. i \<le> j \<and> j < k \<and> (\<forall>l\<ge>i. l < j \<longrightarrow> A $$ (l, Suc l) = (1::'b)) \<and> (Suc j \<noteq> k \<longrightarrow> A $$ (j, Suc j) \<noteq> (1::'b)) \<and> (0 < i \<longrightarrow> A $$ (i - 1, i) \<noteq> (1::'b))}

goal (1 subgoal):
 1. (i \<le> j &&& j < k) &&& (\<And>l. \<lbrakk>i \<le> l; l < j\<rbrakk> \<Longrightarrow> A $$ (l, Suc l) = (1::'b)) &&& (Suc j \<noteq> k \<Longrightarrow> A $$ (j, Suc j) \<noteq> (1::'b)) &&& (0 < i \<Longrightarrow> A $$ (i - 1, i - 1) \<noteq> A $$ (k, k) \<or> A $$ (i - 1, i) \<noteq> (1::'b))
[PROOF STEP]
by auto


[STATEMENT]
lemma sc_sim:
  fixes \<Gamma> \<Delta> :: "'a formula list" and G D :: "'a list"
  assumes "sc \<Gamma> A \<Delta> B = {}"
  shows "image_mset Atom (mset A) + mset \<Gamma> \<Rightarrow> image_mset Atom (mset B) + mset \<Delta>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. image_mset Atom (mset A) + mset \<Gamma> \<Rightarrow> image_mset Atom (mset B) + mset \<Delta>
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. image_mset Atom (mset A) + mset \<Gamma> \<Rightarrow> image_mset Atom (mset B) + mset \<Delta>
[PROOF STEP]
have *[simp]: "image_mset Atom (mset A) \<Rightarrow> image_mset Atom (mset B)" (is ?k) if "k \<in> set A" "k \<in> set B" for A B :: "'a list" and k
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. image_mset Atom (mset A) \<Rightarrow> image_mset Atom (mset B)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. image_mset Atom (mset A) \<Rightarrow> image_mset Atom (mset B)
[PROOF STEP]
from that
[PROOF STATE]
proof (chain)
picking this:
k \<in> set A
k \<in> set B
[PROOF STEP]
obtain a where "a \<in> set A" "a \<in> set B"
[PROOF STATE]
proof (prove)
using this:
k \<in> set A
k \<in> set B

goal (1 subgoal):
 1. (\<And>a. \<lbrakk>a \<in> set A; a \<in> set B\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
a \<in> set A
a \<in> set B

goal (1 subgoal):
 1. image_mset Atom (mset A) \<Rightarrow> image_mset Atom (mset B)
[PROOF STEP]
thus ?k
[PROOF STATE]
proof (prove)
using this:
a \<in> set A
a \<in> set B

goal (1 subgoal):
 1. image_mset Atom (mset A) \<Rightarrow> image_mset Atom (mset B)
[PROOF STEP]
by(force simp: in_image_mset intro: SCp.Ax[where k=a])
[PROOF STATE]
proof (state)
this:
image_mset Atom (mset A) \<Rightarrow> image_mset Atom (mset B)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>?k \<in> set ?A; ?k \<in> set ?B\<rbrakk> \<Longrightarrow> image_mset Atom (mset ?A) \<Rightarrow> image_mset Atom (mset ?B)

goal (1 subgoal):
 1. image_mset Atom (mset A) + mset \<Gamma> \<Rightarrow> image_mset Atom (mset B) + mset \<Delta>
[PROOF STEP]
from assms
[PROOF STATE]
proof (chain)
picking this:
sc \<Gamma> A \<Delta> B = {}
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
sc \<Gamma> A \<Delta> B = {}

goal (1 subgoal):
 1. image_mset Atom (mset A) + mset \<Gamma> \<Rightarrow> image_mset Atom (mset B) + mset \<Delta>
[PROOF STEP]
by(induction rule: sc.induct[where 'a='a]) (auto
        simp add: list_sequent_cost_def add.assoc Bot_delR_simp
        split: if_splits option.splits
        intro: SCp.intros(3-))
[PROOF STATE]
proof (state)
this:
image_mset Atom (mset A) + mset \<Gamma> \<Rightarrow> image_mset Atom (mset B) + mset \<Delta>

goal:
No subgoals!
[PROOF STEP]
qed