[STATEMENT]
lemma list_index_split_set:
  assumes "i < length xs"
shows "set xs = set ((xs ! i) # ((take i xs) @ (drop (Suc i) xs)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. set xs = set (xs ! i # take i xs @ drop (Suc i) xs)
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
i < length xs

goal (1 subgoal):
 1. set xs = set (xs ! i # take i xs @ drop (Suc i) xs)
[PROOF STEP]
proof (induction xs arbitrary: i)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>i. i < length [] \<Longrightarrow> set [] = set ([] ! i # take i [] @ drop (Suc i) [])
 2. \<And>a xs i. \<lbrakk>\<And>i. i < length xs \<Longrightarrow> set xs = set (xs ! i # take i xs @ drop (Suc i) xs); i < length (a # xs)\<rbrakk> \<Longrightarrow> set (a # xs) = set ((a # xs) ! i # take i (a # xs) @ drop (Suc i) (a # xs))
[PROOF STEP]
case Nil
[PROOF STATE]
proof (state)
this:
i < length []

goal (2 subgoals):
 1. \<And>i. i < length [] \<Longrightarrow> set [] = set ([] ! i # take i [] @ drop (Suc i) [])
 2. \<And>a xs i. \<lbrakk>\<And>i. i < length xs \<Longrightarrow> set xs = set (xs ! i # take i xs @ drop (Suc i) xs); i < length (a # xs)\<rbrakk> \<Longrightarrow> set (a # xs) = set ((a # xs) ! i # take i (a # xs) @ drop (Suc i) (a # xs))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
i < length []
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
i < length []

goal (1 subgoal):
 1. set [] = set ([] ! i # take i [] @ drop (Suc i) [])
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
set [] = set ([] ! i # take i [] @ drop (Suc i) [])

goal (1 subgoal):
 1. \<And>a xs i. \<lbrakk>\<And>i. i < length xs \<Longrightarrow> set xs = set (xs ! i # take i xs @ drop (Suc i) xs); i < length (a # xs)\<rbrakk> \<Longrightarrow> set (a # xs) = set ((a # xs) ! i # take i (a # xs) @ drop (Suc i) (a # xs))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a xs i. \<lbrakk>\<And>i. i < length xs \<Longrightarrow> set xs = set (xs ! i # take i xs @ drop (Suc i) xs); i < length (a # xs)\<rbrakk> \<Longrightarrow> set (a # xs) = set ((a # xs) ! i # take i (a # xs) @ drop (Suc i) (a # xs))
[PROOF STEP]
case (Cons x xs)
[PROOF STATE]
proof (state)
this:
?i < length xs \<Longrightarrow> set xs = set (xs ! ?i # take ?i xs @ drop (Suc ?i) xs)
i < length (x # xs)

goal (1 subgoal):
 1. \<And>a xs i. \<lbrakk>\<And>i. i < length xs \<Longrightarrow> set xs = set (xs ! i # take i xs @ drop (Suc i) xs); i < length (a # xs)\<rbrakk> \<Longrightarrow> set (a # xs) = set ((a # xs) ! i # take i (a # xs) @ drop (Suc i) (a # xs))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
?i < length xs \<Longrightarrow> set xs = set (xs ! ?i # take ?i xs @ drop (Suc ?i) xs)
i < length (x # xs)
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
?i < length xs \<Longrightarrow> set xs = set (xs ! ?i # take ?i xs @ drop (Suc ?i) xs)
i < length (x # xs)

goal (1 subgoal):
 1. set (x # xs) = set ((x # xs) ! i # take i (x # xs) @ drop (Suc i) (x # xs))
[PROOF STEP]
proof (cases i)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<lbrakk>\<And>i. i < length xs \<Longrightarrow> set xs = set (xs ! i # take i xs @ drop (Suc i) xs); i < length (x # xs); i = 0\<rbrakk> \<Longrightarrow> set (x # xs) = set ((x # xs) ! i # take i (x # xs) @ drop (Suc i) (x # xs))
 2. \<And>nat. \<lbrakk>\<And>i. i < length xs \<Longrightarrow> set xs = set (xs ! i # take i xs @ drop (Suc i) xs); i < length (x # xs); i = Suc nat\<rbrakk> \<Longrightarrow> set (x # xs) = set ((x # xs) ! i # take i (x # xs) @ drop (Suc i) (x # xs))
[PROOF STEP]
case 0
[PROOF STATE]
proof (state)
this:
i = 0

goal (2 subgoals):
 1. \<lbrakk>\<And>i. i < length xs \<Longrightarrow> set xs = set (xs ! i # take i xs @ drop (Suc i) xs); i < length (x # xs); i = 0\<rbrakk> \<Longrightarrow> set (x # xs) = set ((x # xs) ! i # take i (x # xs) @ drop (Suc i) (x # xs))
 2. \<And>nat. \<lbrakk>\<And>i. i < length xs \<Longrightarrow> set xs = set (xs ! i # take i xs @ drop (Suc i) xs); i < length (x # xs); i = Suc nat\<rbrakk> \<Longrightarrow> set (x # xs) = set ((x # xs) ! i # take i (x # xs) @ drop (Suc i) (x # xs))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
i = 0
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
i = 0

goal (1 subgoal):
 1. set (x # xs) = set ((x # xs) ! i # take i (x # xs) @ drop (Suc i) (x # xs))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
set (x # xs) = set ((x # xs) ! i # take i (x # xs) @ drop (Suc i) (x # xs))

goal (1 subgoal):
 1. \<And>nat. \<lbrakk>\<And>i. i < length xs \<Longrightarrow> set xs = set (xs ! i # take i xs @ drop (Suc i) xs); i < length (x # xs); i = Suc nat\<rbrakk> \<Longrightarrow> set (x # xs) = set ((x # xs) ! i # take i (x # xs) @ drop (Suc i) (x # xs))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>nat. \<lbrakk>\<And>i. i < length xs \<Longrightarrow> set xs = set (xs ! i # take i xs @ drop (Suc i) xs); i < length (x # xs); i = Suc nat\<rbrakk> \<Longrightarrow> set (x # xs) = set ((x # xs) ! i # take i (x # xs) @ drop (Suc i) (x # xs))
[PROOF STEP]
case (Suc j)
[PROOF STATE]
proof (state)
this:
i = Suc j

goal (1 subgoal):
 1. \<And>nat. \<lbrakk>\<And>i. i < length xs \<Longrightarrow> set xs = set (xs ! i # take i xs @ drop (Suc i) xs); i < length (x # xs); i = Suc nat\<rbrakk> \<Longrightarrow> set (x # xs) = set ((x # xs) ! i # take i (x # xs) @ drop (Suc i) (x # xs))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
i = Suc j
[PROOF STEP]
have "j < length xs"
[PROOF STATE]
proof (prove)
using this:
i = Suc j

goal (1 subgoal):
 1. j < length xs
[PROOF STEP]
using Cons.prems
[PROOF STATE]
proof (prove)
using this:
i = Suc j
i < length (x # xs)

goal (1 subgoal):
 1. j < length xs
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
j < length xs

goal (1 subgoal):
 1. \<And>nat. \<lbrakk>\<And>i. i < length xs \<Longrightarrow> set xs = set (xs ! i # take i xs @ drop (Suc i) xs); i < length (x # xs); i = Suc nat\<rbrakk> \<Longrightarrow> set (x # xs) = set ((x # xs) ! i # take i (x # xs) @ drop (Suc i) (x # xs))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
j < length xs
[PROOF STEP]
have "set xs = set ((xs ! j) # ((take j xs) @ (drop (Suc j) xs)))"
[PROOF STATE]
proof (prove)
using this:
j < length xs

goal (1 subgoal):
 1. set xs = set (xs ! j # take j xs @ drop (Suc j) xs)
[PROOF STEP]
using Cons.IH[of j]
[PROOF STATE]
proof (prove)
using this:
j < length xs
j < length xs \<Longrightarrow> set xs = set (xs ! j # take j xs @ drop (Suc j) xs)

goal (1 subgoal):
 1. set xs = set (xs ! j # take j xs @ drop (Suc j) xs)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
set xs = set (xs ! j # take j xs @ drop (Suc j) xs)

goal (1 subgoal):
 1. \<And>nat. \<lbrakk>\<And>i. i < length xs \<Longrightarrow> set xs = set (xs ! i # take i xs @ drop (Suc i) xs); i < length (x # xs); i = Suc nat\<rbrakk> \<Longrightarrow> set (x # xs) = set ((x # xs) ! i # take i (x # xs) @ drop (Suc i) (x # xs))
[PROOF STEP]
have *: "take (Suc j) (x#xs) = x#(take j xs)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. take (Suc j) (x # xs) = x # take j xs
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
take (Suc j) (x # xs) = x # take j xs

goal (1 subgoal):
 1. \<And>nat. \<lbrakk>\<And>i. i < length xs \<Longrightarrow> set xs = set (xs ! i # take i xs @ drop (Suc i) xs); i < length (x # xs); i = Suc nat\<rbrakk> \<Longrightarrow> set (x # xs) = set ((x # xs) ! i # take i (x # xs) @ drop (Suc i) (x # xs))
[PROOF STEP]
have **: "drop (Suc (Suc j)) (x#xs) = (drop (Suc j) xs)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. drop (Suc (Suc j)) (x # xs) = drop (Suc j) xs
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
drop (Suc (Suc j)) (x # xs) = drop (Suc j) xs

goal (1 subgoal):
 1. \<And>nat. \<lbrakk>\<And>i. i < length xs \<Longrightarrow> set xs = set (xs ! i # take i xs @ drop (Suc i) xs); i < length (x # xs); i = Suc nat\<rbrakk> \<Longrightarrow> set (x # xs) = set ((x # xs) ! i # take i (x # xs) @ drop (Suc i) (x # xs))
[PROOF STEP]
have ***: "(x # xs) ! Suc j = xs ! j"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (x # xs) ! Suc j = xs ! j
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(x # xs) ! Suc j = xs ! j

goal (1 subgoal):
 1. \<And>nat. \<lbrakk>\<And>i. i < length xs \<Longrightarrow> set xs = set (xs ! i # take i xs @ drop (Suc i) xs); i < length (x # xs); i = Suc nat\<rbrakk> \<Longrightarrow> set (x # xs) = set ((x # xs) ! i # take i (x # xs) @ drop (Suc i) (x # xs))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. set (x # xs) = set ((x # xs) ! i # take i (x # xs) @ drop (Suc i) (x # xs))
[PROOF STEP]
using \<open>set xs = set ((xs ! j) # ((take j xs) @ (drop (Suc j) xs)))\<close>
[PROOF STATE]
proof (prove)
using this:
set xs = set (xs ! j # take j xs @ drop (Suc j) xs)

goal (1 subgoal):
 1. set (x # xs) = set ((x # xs) ! i # take i (x # xs) @ drop (Suc i) (x # xs))
[PROOF STEP]
unfolding Suc * ** ***
[PROOF STATE]
proof (prove)
using this:
set xs = set (xs ! j # take j xs @ drop (Suc j) xs)

goal (1 subgoal):
 1. set (x # xs) = set (xs ! j # (x # take j xs) @ drop (Suc j) xs)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
set (x # xs) = set ((x # xs) ! i # take i (x # xs) @ drop (Suc i) (x # xs))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
set (x # xs) = set ((x # xs) ! i # take i (x # xs) @ drop (Suc i) (x # xs))

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma FINITE_ss_proj:
  fixes ss vs
  assumes "finite ss"
  shows "finite (ss_proj ss vs)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. finite (ss_proj ss vs)
[PROOF STEP]
unfolding ss_proj_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. finite (fmrestrict_set vs ` ss)
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
finite ss

goal (1 subgoal):
 1. finite (fmrestrict_set vs ` ss)
[PROOF STEP]
by simp


[STATEMENT]
lemma int_bit_count_1:
  assumes "abs n > 0"
  shows "bit_count (I\<^sub>e n) = 2 * \<lfloor>log 2 \<bar>n\<bar>\<rfloor> +3"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. bit_count (I\<^sub>e n) = ereal (real_of_int (2 * \<lfloor>log 2 (real_of_int \<bar>n\<bar>)\<rfloor> + 3))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. bit_count (I\<^sub>e n) = ereal (real_of_int (2 * \<lfloor>log 2 (real_of_int \<bar>n\<bar>)\<rfloor> + 3))
[PROOF STEP]
have a:"m > 0 \<Longrightarrow>
    \<lfloor>log (real 2) (real (2 * m))\<rfloor> = \<lfloor>log (real 2) (real (2 * m + 1))\<rfloor>"
    for m :: nat
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 < m \<Longrightarrow> \<lfloor>log (real 2) (real (2 * m))\<rfloor> = \<lfloor>log (real 2) (real (2 * m + 1))\<rfloor>
[PROOF STEP]
by (rule  floor_log_eq_if, auto)
[PROOF STATE]
proof (state)
this:
0 < ?m \<Longrightarrow> \<lfloor>log (real 2) (real (2 * ?m))\<rfloor> = \<lfloor>log (real 2) (real (2 * ?m + 1))\<rfloor>

goal (1 subgoal):
 1. bit_count (I\<^sub>e n) = ereal (real_of_int (2 * \<lfloor>log 2 (real_of_int \<bar>n\<bar>)\<rfloor> + 3))
[PROOF STEP]
have "n < 0 \<Longrightarrow>
    \<lfloor>log 2 (-2 * real_of_int n)\<rfloor> = \<lfloor>log 2 (1-2 * real_of_int n)\<rfloor>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. n < 0 \<Longrightarrow> \<lfloor>log 2 (- 2 * real_of_int n)\<rfloor> = \<lfloor>log 2 (1 - 2 * real_of_int n)\<rfloor>
[PROOF STEP]
using a[where m="nat (-n)"]
[PROOF STATE]
proof (prove)
using this:
0 < nat (- n) \<Longrightarrow> \<lfloor>log (real 2) (real (2 * nat (- n)))\<rfloor> = \<lfloor>log (real 2) (real (2 * nat (- n) + 1))\<rfloor>

goal (1 subgoal):
 1. n < 0 \<Longrightarrow> \<lfloor>log 2 (- 2 * real_of_int n)\<rfloor> = \<lfloor>log 2 (1 - 2 * real_of_int n)\<rfloor>
[PROOF STEP]
by (simp add:add.commute)
[PROOF STATE]
proof (state)
this:
n < 0 \<Longrightarrow> \<lfloor>log 2 (- 2 * real_of_int n)\<rfloor> = \<lfloor>log 2 (1 - 2 * real_of_int n)\<rfloor>

goal (1 subgoal):
 1. bit_count (I\<^sub>e n) = ereal (real_of_int (2 * \<lfloor>log 2 (real_of_int \<bar>n\<bar>)\<rfloor> + 3))
[PROOF STEP]
hence "bit_count (I\<^sub>e n) = 2 * \<lfloor>log 2 (2*real_of_int \<bar>n\<bar>)\<rfloor> +1"
[PROOF STATE]
proof (prove)
using this:
n < 0 \<Longrightarrow> \<lfloor>log 2 (- 2 * real_of_int n)\<rfloor> = \<lfloor>log 2 (1 - 2 * real_of_int n)\<rfloor>

goal (1 subgoal):
 1. bit_count (I\<^sub>e n) = ereal (real_of_int (2 * \<lfloor>log 2 (2 * real_of_int \<bar>n\<bar>)\<rfloor> + 1))
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
n < 0 \<Longrightarrow> \<lfloor>log 2 (- 2 * real_of_int n)\<rfloor> = \<lfloor>log 2 (1 - 2 * real_of_int n)\<rfloor>
0 < \<bar>n\<bar>

goal (1 subgoal):
 1. bit_count (I\<^sub>e n) = ereal (real_of_int (2 * \<lfloor>log 2 (2 * real_of_int \<bar>n\<bar>)\<rfloor> + 1))
[PROOF STEP]
by (simp add:I\<^sub>e_def exp_golomb_bit_count_exact floorlog_def)
[PROOF STATE]
proof (state)
this:
bit_count (I\<^sub>e n) = ereal (real_of_int (2 * \<lfloor>log 2 (2 * real_of_int \<bar>n\<bar>)\<rfloor> + 1))

goal (1 subgoal):
 1. bit_count (I\<^sub>e n) = ereal (real_of_int (2 * \<lfloor>log 2 (real_of_int \<bar>n\<bar>)\<rfloor> + 3))
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
bit_count (I\<^sub>e n) = ereal (real_of_int (2 * \<lfloor>log 2 (2 * real_of_int \<bar>n\<bar>)\<rfloor> + 1))

goal (1 subgoal):
 1. bit_count (I\<^sub>e n) = ereal (real_of_int (2 * \<lfloor>log 2 (real_of_int \<bar>n\<bar>)\<rfloor> + 3))
[PROOF STEP]
have "... = 2 * \<lfloor>log 2 \<bar>n\<bar>\<rfloor> + 3"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ereal (real_of_int (2 * \<lfloor>log 2 (2 * real_of_int \<bar>n\<bar>)\<rfloor> + 1)) = ereal (real_of_int (2 * \<lfloor>log 2 (real_of_int \<bar>n\<bar>)\<rfloor> + 3))
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
0 < \<bar>n\<bar>

goal (1 subgoal):
 1. ereal (real_of_int (2 * \<lfloor>log 2 (2 * real_of_int \<bar>n\<bar>)\<rfloor> + 1)) = ereal (real_of_int (2 * \<lfloor>log 2 (real_of_int \<bar>n\<bar>)\<rfloor> + 3))
[PROOF STEP]
by (subst log_mult, auto)
[PROOF STATE]
proof (state)
this:
ereal (real_of_int (2 * \<lfloor>log 2 (2 * real_of_int \<bar>n\<bar>)\<rfloor> + 1)) = ereal (real_of_int (2 * \<lfloor>log 2 (real_of_int \<bar>n\<bar>)\<rfloor> + 3))

goal (1 subgoal):
 1. bit_count (I\<^sub>e n) = ereal (real_of_int (2 * \<lfloor>log 2 (real_of_int \<bar>n\<bar>)\<rfloor> + 3))
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
bit_count (I\<^sub>e n) = ereal (real_of_int (2 * \<lfloor>log 2 (real_of_int \<bar>n\<bar>)\<rfloor> + 3))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
bit_count (I\<^sub>e n) = ereal (real_of_int (2 * \<lfloor>log 2 (real_of_int \<bar>n\<bar>)\<rfloor> + 3))

goal (1 subgoal):
 1. bit_count (I\<^sub>e n) = ereal (real_of_int (2 * \<lfloor>log 2 (real_of_int \<bar>n\<bar>)\<rfloor> + 3))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
bit_count (I\<^sub>e n) = ereal (real_of_int (2 * \<lfloor>log 2 (real_of_int \<bar>n\<bar>)\<rfloor> + 3))

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma halt_lemma2':
  "\<lbrakk>wf LE;  \<forall> n. ((\<not> P (f n) \<and> Q (f n)) \<longrightarrow>
    (Q (f (Suc n)) \<and> (f (Suc n), (f n)) \<in> LE)); Q (f 0)\<rbrakk>
      \<Longrightarrow> \<exists> n. P (f n)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>wf LE; \<forall>n. \<not> P (f n) \<and> Q (f n) \<longrightarrow> Q (f (Suc n)) \<and> (f (Suc n), f n) \<in> LE; Q (f 0)\<rbrakk> \<Longrightarrow> \<exists>n. P (f n)
[PROOF STEP]
apply(intro exCI, simp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>wf LE; \<forall>n. Q (f n) \<longrightarrow> Q (f (Suc n)) \<and> (f (Suc n), f n) \<in> LE; Q (f 0); \<forall>n. \<not> P (f n)\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply(subgoal_tac "\<forall> n. Q (f n)")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>wf LE; \<forall>n. Q (f n) \<longrightarrow> Q (f (Suc n)) \<and> (f (Suc n), f n) \<in> LE; Q (f 0); \<forall>n. \<not> P (f n); \<forall>n. Q (f n)\<rbrakk> \<Longrightarrow> False
 2. \<lbrakk>wf LE; \<forall>n. Q (f n) \<longrightarrow> Q (f (Suc n)) \<and> (f (Suc n), f n) \<in> LE; Q (f 0); \<forall>n. \<not> P (f n)\<rbrakk> \<Longrightarrow> \<forall>n. Q (f n)
[PROOF STEP]
apply(drule_tac f = f in wf_inv_image)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>\<forall>n. Q (f n) \<longrightarrow> Q (f (Suc n)) \<and> (f (Suc n), f n) \<in> LE; Q (f 0); \<forall>n. \<not> P (f n); \<forall>n. Q (f n); wf (inv_image LE f)\<rbrakk> \<Longrightarrow> False
 2. \<lbrakk>wf LE; \<forall>n. Q (f n) \<longrightarrow> Q (f (Suc n)) \<and> (f (Suc n), f n) \<in> LE; Q (f 0); \<forall>n. \<not> P (f n)\<rbrakk> \<Longrightarrow> \<forall>n. Q (f n)
[PROOF STEP]
apply(erule wf_induct)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>\<forall>n. Q (f n) \<longrightarrow> Q (f (Suc n)) \<and> (f (Suc n), f n) \<in> LE; Q (f 0); \<forall>n. \<not> P (f n); \<forall>n. Q (f n); \<forall>y. (y, x) \<in> inv_image LE f \<longrightarrow> False\<rbrakk> \<Longrightarrow> False
 2. \<lbrakk>wf LE; \<forall>n. Q (f n) \<longrightarrow> Q (f (Suc n)) \<and> (f (Suc n), f n) \<in> LE; Q (f 0); \<forall>n. \<not> P (f n)\<rbrakk> \<Longrightarrow> \<forall>n. Q (f n)
[PROOF STEP]
apply(auto)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>n. \<lbrakk>wf LE; \<forall>n. Q (f n) \<longrightarrow> Q (f (Suc n)) \<and> (f (Suc n), f n) \<in> LE; Q (f 0); \<forall>n. \<not> P (f n)\<rbrakk> \<Longrightarrow> Q (f n)
[PROOF STEP]
apply(rename_tac n,induct_tac n; simp)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma Extend_commute_safe[Presb_simps]: "\<lbrakk>j \<le> i; i < Suc (#\<^sub>V \<AA>)\<rbrakk> \<Longrightarrow>
  Extend k j (Extend k i \<AA> P) Q = Extend k (Suc i) (Extend k j \<AA> Q) P"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>j \<le> i; i < Suc (#\<^sub>V \<AA>)\<rbrakk> \<Longrightarrow> Extend k j (Extend k i \<AA> P) Q = Extend k (Suc i) (Extend k j \<AA> Q) P
[PROOF STEP]
by transfer (auto simp add: min_def take_Cons take_drop le_imp_diff_is_add split: nat.splits)


[STATEMENT]
lemma fls_decompose_reg_pr_parts:
  fixes   f :: "'a :: monoid_add fls"
  defines "R  \<equiv> fls_regpart_as_fls f"
  and     "P  \<equiv> fls_prpart_as_fls f"
  shows   "f = P + R"
  and     "f = R + P"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. f = P + R &&& f = R + P
[PROOF STEP]
using   fls_prpart_as_fls_nth[of f]
[PROOF STATE]
proof (prove)
using this:
fls_prpart_as_fls f $$ ?n = (if ?n < 0 then f $$ ?n else (0::'a))

goal (1 subgoal):
 1. f = P + R &&& f = R + P
[PROOF STEP]
by      (auto intro: fls_eqI simp add: assms)


[STATEMENT]
lemma flow_summation_aux:
  shows "(\<Sum>v\<in>E``{u}. f' (u,v))  - (\<Sum>v\<in>E``{u}. f' (v,u))
       = (\<Sum>v\<in>E\<inverse>``{u}. f' (v,u)) - (\<Sum>v\<in>E\<inverse>``{u}. f' (u,v))"
   (is "?LHS = ?RHS" is "?A - ?B = ?RHS")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Sum>v\<in>E `` {u}. f' (u, v)) - (\<Sum>v\<in>E `` {u}. f' (v, u)) = (\<Sum>v\<in>E\<inverse> `` {u}. f' (v, u)) - (\<Sum>v\<in>E\<inverse> `` {u}. f' (u, v))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (\<Sum>v\<in>E `` {u}. f' (u, v)) - (\<Sum>v\<in>E `` {u}. f' (v, u)) = (\<Sum>v\<in>E\<inverse> `` {u}. f' (v, u)) - (\<Sum>v\<in>E\<inverse> `` {u}. f' (u, v))
[PROOF STEP]
text \<open>The proof is by splitting the flows, and careful
    cancellation of the summands.\<close>
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (\<Sum>v\<in>E `` {u}. f' (u, v)) - (\<Sum>v\<in>E `` {u}. f' (v, u)) = (\<Sum>v\<in>E\<inverse> `` {u}. f' (v, u)) - (\<Sum>v\<in>E\<inverse> `` {u}. f' (u, v))
[PROOF STEP]
have "?A = (\<Sum>v\<in>cf.E``{u}. f' (u, v)) - (\<Sum>v\<in>E\<inverse>``{u}. f' (u, v))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Sum>v\<in>E `` {u}. f' (u, v)) = (\<Sum>v\<in>cf.E `` {u}. f' (u, v)) - (\<Sum>v\<in>E\<inverse> `` {u}. f' (u, v))
[PROOF STEP]
by (simp add: split_rflow_outgoing)
[PROOF STATE]
proof (state)
this:
(\<Sum>v\<in>E `` {u}. f' (u, v)) = (\<Sum>v\<in>cf.E `` {u}. f' (u, v)) - (\<Sum>v\<in>E\<inverse> `` {u}. f' (u, v))

goal (1 subgoal):
 1. (\<Sum>v\<in>E `` {u}. f' (u, v)) - (\<Sum>v\<in>E `` {u}. f' (v, u)) = (\<Sum>v\<in>E\<inverse> `` {u}. f' (v, u)) - (\<Sum>v\<in>E\<inverse> `` {u}. f' (u, v))
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(\<Sum>v\<in>E `` {u}. f' (u, v)) = (\<Sum>v\<in>cf.E `` {u}. f' (u, v)) - (\<Sum>v\<in>E\<inverse> `` {u}. f' (u, v))

goal (1 subgoal):
 1. (\<Sum>v\<in>E `` {u}. f' (u, v)) - (\<Sum>v\<in>E `` {u}. f' (v, u)) = (\<Sum>v\<in>E\<inverse> `` {u}. f' (v, u)) - (\<Sum>v\<in>E\<inverse> `` {u}. f' (u, v))
[PROOF STEP]
have "(\<Sum>v\<in>cf.E``{u}. f' (u, v)) = (\<Sum>v\<in>cf.E\<inverse>``{u}. f' (v, u))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Sum>v\<in>cf.E `` {u}. f' (u, v)) = (\<Sum>v\<in>cf.E\<inverse> `` {u}. f' (v, u))
[PROOF STEP]
using U_ASM
[PROOF STATE]
proof (prove)
using this:
u \<in> V - {s, t}

goal (1 subgoal):
 1. (\<Sum>v\<in>cf.E `` {u}. f' (u, v)) = (\<Sum>v\<in>cf.E\<inverse> `` {u}. f' (v, u))
[PROOF STEP]
by (simp add: f'.conservation_const_pointwise)
[PROOF STATE]
proof (state)
this:
(\<Sum>v\<in>cf.E `` {u}. f' (u, v)) = (\<Sum>v\<in>cf.E\<inverse> `` {u}. f' (v, u))

goal (1 subgoal):
 1. (\<Sum>v\<in>E `` {u}. f' (u, v)) - (\<Sum>v\<in>E `` {u}. f' (v, u)) = (\<Sum>v\<in>E\<inverse> `` {u}. f' (v, u)) - (\<Sum>v\<in>E\<inverse> `` {u}. f' (u, v))
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
(\<Sum>v\<in>E `` {u}. f' (u, v)) = (\<Sum>v\<in>cf.E\<inverse> `` {u}. f' (v, u)) - (\<Sum>v\<in>E\<inverse> `` {u}. f' (u, v))
[PROOF STEP]
have "?A = (\<Sum>v\<in>cf.E\<inverse>``{u}. f' (v, u)) - (\<Sum>v\<in>E\<inverse>``{u}. f' (u, v))"
[PROOF STATE]
proof (prove)
using this:
(\<Sum>v\<in>E `` {u}. f' (u, v)) = (\<Sum>v\<in>cf.E\<inverse> `` {u}. f' (v, u)) - (\<Sum>v\<in>E\<inverse> `` {u}. f' (u, v))

goal (1 subgoal):
 1. (\<Sum>v\<in>E `` {u}. f' (u, v)) = (\<Sum>v\<in>cf.E\<inverse> `` {u}. f' (v, u)) - (\<Sum>v\<in>E\<inverse> `` {u}. f' (u, v))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
(\<Sum>v\<in>E `` {u}. f' (u, v)) = (\<Sum>v\<in>cf.E\<inverse> `` {u}. f' (v, u)) - (\<Sum>v\<in>E\<inverse> `` {u}. f' (u, v))

goal (1 subgoal):
 1. (\<Sum>v\<in>E `` {u}. f' (u, v)) - (\<Sum>v\<in>E `` {u}. f' (v, u)) = (\<Sum>v\<in>E\<inverse> `` {u}. f' (v, u)) - (\<Sum>v\<in>E\<inverse> `` {u}. f' (u, v))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(\<Sum>v\<in>E `` {u}. f' (u, v)) = (\<Sum>v\<in>cf.E\<inverse> `` {u}. f' (v, u)) - (\<Sum>v\<in>E\<inverse> `` {u}. f' (u, v))

goal (1 subgoal):
 1. (\<Sum>v\<in>E `` {u}. f' (u, v)) - (\<Sum>v\<in>E `` {u}. f' (v, u)) = (\<Sum>v\<in>E\<inverse> `` {u}. f' (v, u)) - (\<Sum>v\<in>E\<inverse> `` {u}. f' (u, v))
[PROOF STEP]
have "?B = (\<Sum>v\<in>cf.E\<inverse>``{u}. f' (v, u)) - (\<Sum>v\<in>E\<inverse>``{u}. f' (v, u))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Sum>v\<in>E `` {u}. f' (v, u)) = (\<Sum>v\<in>cf.E\<inverse> `` {u}. f' (v, u)) - (\<Sum>v\<in>E\<inverse> `` {u}. f' (v, u))
[PROOF STEP]
by (simp add: split_rflow_incoming)
[PROOF STATE]
proof (state)
this:
(\<Sum>v\<in>E `` {u}. f' (v, u)) = (\<Sum>v\<in>cf.E\<inverse> `` {u}. f' (v, u)) - (\<Sum>v\<in>E\<inverse> `` {u}. f' (v, u))

goal (1 subgoal):
 1. (\<Sum>v\<in>E `` {u}. f' (u, v)) - (\<Sum>v\<in>E `` {u}. f' (v, u)) = (\<Sum>v\<in>E\<inverse> `` {u}. f' (v, u)) - (\<Sum>v\<in>E\<inverse> `` {u}. f' (u, v))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
(\<Sum>v\<in>E `` {u}. f' (u, v)) = (\<Sum>v\<in>cf.E\<inverse> `` {u}. f' (v, u)) - (\<Sum>v\<in>E\<inverse> `` {u}. f' (u, v))
(\<Sum>v\<in>E `` {u}. f' (v, u)) = (\<Sum>v\<in>cf.E\<inverse> `` {u}. f' (v, u)) - (\<Sum>v\<in>E\<inverse> `` {u}. f' (v, u))
[PROOF STEP]
show "?A - ?B = ?RHS"
[PROOF STATE]
proof (prove)
using this:
(\<Sum>v\<in>E `` {u}. f' (u, v)) = (\<Sum>v\<in>cf.E\<inverse> `` {u}. f' (v, u)) - (\<Sum>v\<in>E\<inverse> `` {u}. f' (u, v))
(\<Sum>v\<in>E `` {u}. f' (v, u)) = (\<Sum>v\<in>cf.E\<inverse> `` {u}. f' (v, u)) - (\<Sum>v\<in>E\<inverse> `` {u}. f' (v, u))

goal (1 subgoal):
 1. (\<Sum>v\<in>E `` {u}. f' (u, v)) - (\<Sum>v\<in>E `` {u}. f' (v, u)) = (\<Sum>v\<in>E\<inverse> `` {u}. f' (v, u)) - (\<Sum>v\<in>E\<inverse> `` {u}. f' (u, v))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
(\<Sum>v\<in>E `` {u}. f' (u, v)) - (\<Sum>v\<in>E `` {u}. f' (v, u)) = (\<Sum>v\<in>E\<inverse> `` {u}. f' (v, u)) - (\<Sum>v\<in>E\<inverse> `` {u}. f' (u, v))

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma quat_inner_i_right [simp]: "inner x \<i> = Im1 x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x \<bullet> \<i> = Im1 x
[PROOF STEP]
unfolding inner_quat_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. quat.Re x * quat.Re \<i> + Im1 x * Im1 \<i> + Im2 x * Im2 \<i> + Im3 x * Im3 \<i> = Im1 x
[PROOF STEP]
by simp


[STATEMENT]
lemma primitive_part_fract_0 [simp]: "primitive_part_fract 0 = 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. primitive_part_fract 0 = 0
[PROOF STEP]
by (simp add: primitive_part_fract_def)


[STATEMENT]
lemma subsetEqvt[eqvt]:
  fixes p :: "name prm"
  and   S :: "('a::pt_name) set"
  and   T :: "('a::pt_name) set"

  shows "(p \<bullet> (S \<subseteq> T)) = ((p \<bullet> S) \<subseteq> (p \<bullet> T))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. p \<bullet> (S \<subseteq> T) = (p \<bullet> S \<subseteq> p \<bullet> T)
[PROOF STEP]
by(rule pt_subseteq_eqvt[OF pt_name_inst, OF at_name_inst])


[STATEMENT]
lemma int_xor_minus1 [simp]: "-1 XOR x = NOT x"
  for x :: int
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. - 1 XOR x = NOT x
[PROOF STEP]
by (fact bit.xor_one_left)


[STATEMENT]
lemma gauss_jordan_compute_inverse:
  assumes A: "A \<in> carrier_mat n n"
  and res: "gauss_jordan A (1\<^sub>m n) = (1\<^sub>m n, B')"
  shows "A * B' = 1\<^sub>m n" "B' * A = 1\<^sub>m n" "B' \<in> carrier_mat n n"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. A * B' = 1\<^sub>m n &&& B' * A = 1\<^sub>m n &&& B' \<in> carrier_mat n n
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. A * B' = 1\<^sub>m n
 2. B' * A = 1\<^sub>m n
 3. B' \<in> carrier_mat n n
[PROOF STEP]
from gauss_jordan_inverse_one_direction(2)[OF A _ res refl, of n]
[PROOF STATE]
proof (chain)
picking this:
1\<^sub>m n \<in> carrier_mat n n \<Longrightarrow> A * B' = 1\<^sub>m n \<and> B' * A = 1\<^sub>m n
[PROOF STEP]
show "A * B' = 1\<^sub>m n" "B' * A = 1\<^sub>m n"
[PROOF STATE]
proof (prove)
using this:
1\<^sub>m n \<in> carrier_mat n n \<Longrightarrow> A * B' = 1\<^sub>m n \<and> B' * A = 1\<^sub>m n

goal (1 subgoal):
 1. A * B' = 1\<^sub>m n &&& B' * A = 1\<^sub>m n
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
A * B' = 1\<^sub>m n
B' * A = 1\<^sub>m n

goal (1 subgoal):
 1. B' \<in> carrier_mat n n
[PROOF STEP]
from gauss_jordan_carrier(2)[OF A _ res, of n]
[PROOF STATE]
proof (chain)
picking this:
1\<^sub>m n \<in> carrier_mat n n \<Longrightarrow> B' \<in> carrier_mat n n
[PROOF STEP]
show "B' \<in> carrier_mat n n"
[PROOF STATE]
proof (prove)
using this:
1\<^sub>m n \<in> carrier_mat n n \<Longrightarrow> B' \<in> carrier_mat n n

goal (1 subgoal):
 1. B' \<in> carrier_mat n n
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
B' \<in> carrier_mat n n

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
theorem ex_Sup: "\<exists>sup::'a::complete_lattice. is_Sup A sup"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>sup. is_Sup A sup
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<exists>sup. is_Sup A sup
[PROOF STEP]
from ex_Inf
[PROOF STATE]
proof (chain)
picking this:
\<exists>inf. is_Inf ?A inf
[PROOF STEP]
obtain sup where "is_Inf {b. \<forall>a\<in>A. a \<sqsubseteq> b} sup"
[PROOF STATE]
proof (prove)
using this:
\<exists>inf. is_Inf ?A inf

goal (1 subgoal):
 1. (\<And>sup. is_Inf {b. \<forall>a\<in>A. a \<sqsubseteq> b} sup \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
is_Inf {b. \<forall>a\<in>A. a \<sqsubseteq> b} sup

goal (1 subgoal):
 1. \<exists>sup. is_Sup A sup
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
is_Inf {b. \<forall>a\<in>A. a \<sqsubseteq> b} sup
[PROOF STEP]
have "is_Sup A sup"
[PROOF STATE]
proof (prove)
using this:
is_Inf {b. \<forall>a\<in>A. a \<sqsubseteq> b} sup

goal (1 subgoal):
 1. is_Sup A sup
[PROOF STEP]
by (rule Inf_Sup)
[PROOF STATE]
proof (state)
this:
is_Sup A sup

goal (1 subgoal):
 1. \<exists>sup. is_Sup A sup
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
is_Sup A sup
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
is_Sup A sup

goal (1 subgoal):
 1. \<exists>sup. is_Sup A sup
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
\<exists>sup. is_Sup A sup

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma real_is_int_sub[simp]: "real_is_int a \<Longrightarrow> real_is_int b \<Longrightarrow> real_is_int (a-b)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>real_is_int a; real_is_int b\<rbrakk> \<Longrightarrow> real_is_int (a - b)
[PROOF STEP]
apply (subst real_is_int_def2)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>real_is_int a; real_is_int b\<rbrakk> \<Longrightarrow> a - b = real_of_int (int_of_real (a - b))
[PROOF STEP]
apply (simp add: int_of_real_sub real_int_of_real)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma label_wrt_adjacent:
  assumes "label_wrt B f" "chamber C" "chamber D" "C\<sim>D" "v\<in>C-D" "w\<in>D-C"
  shows   "f v = f w"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. f v = f w
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. f v = f w
[PROOF STEP]
from assms(5)
[PROOF STATE]
proof (chain)
picking this:
v \<in> C - D
[PROOF STEP]
have "f`D = insert (f v) (f`(C\<inter>D))"
[PROOF STATE]
proof (prove)
using this:
v \<in> C - D

goal (1 subgoal):
 1. f ` D = insert (f v) (f ` (C \<inter> D))
[PROOF STEP]
using adjacent_conv_insert[OF assms(4), of v] label_wrtD'[OF assms(1,2)]
          label_wrtD'[OF assms(1,3)]
          bij_betw_imp_surj_on[of f]
[PROOF STATE]
proof (prove)
using this:
v \<in> C - D
v \<in> C - D \<Longrightarrow> C = insert v (C \<inter> D)
bij_betw f C B
bij_betw f D B
bij_betw f ?A ?B \<Longrightarrow> f ` ?A = ?B

goal (1 subgoal):
 1. f ` D = insert (f v) (f ` (C \<inter> D))
[PROOF STEP]
by    force
[PROOF STATE]
proof (state)
this:
f ` D = insert (f v) (f ` (C \<inter> D))

goal (1 subgoal):
 1. f v = f w
[PROOF STEP]
with assms(6)
[PROOF STATE]
proof (chain)
picking this:
w \<in> D - C
f ` D = insert (f v) (f ` (C \<inter> D))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
w \<in> D - C
f ` D = insert (f v) (f ` (C \<inter> D))

goal (1 subgoal):
 1. f v = f w
[PROOF STEP]
using adjacent_sym[OF assms(4)] adjacent_conv_insert[of D C]
          inj_on_insert[of f w "C\<inter>D"]
          bij_betw_imp_inj_on[OF label_wrtD', OF assms(1,3)]
[PROOF STATE]
proof (prove)
using this:
w \<in> D - C
f ` D = insert (f v) (f ` (C \<inter> D))
D \<sim> C
\<lbrakk>D \<sim> C; ?v \<in> D - C\<rbrakk> \<Longrightarrow> D = insert ?v (D \<inter> C)
inj_on f (insert w (C \<inter> D)) = (inj_on f (C \<inter> D) \<and> f w \<notin> f ` (C \<inter> D - {w}))
inj_on f D

goal (1 subgoal):
 1. f v = f w
[PROOF STEP]
by    (force simp add: Int_commute)
[PROOF STATE]
proof (state)
this:
f v = f w

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma i_zip_swap: "(\<lambda>(y, x). (x, y)) \<circ> i_zip g f = i_zip f g"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lambda>(y, x). (x, y)) \<circ> i_zip g f = i_zip f g
[PROOF STEP]
by (simp add: expand_ilist_eq i_zip_nth)


[STATEMENT]
lemma integrable_std_normal_moment_abs: "integrable lborel (\<lambda>x. std_normal_density x * \<bar>x\<bar>^k)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. integrable lborel (\<lambda>x. std_normal_density x * \<bar>x\<bar> ^ k)
[PROOF STEP]
using integrable_normal_moment_abs[of 1 0 k]
[PROOF STATE]
proof (prove)
using this:
0 < 1 \<Longrightarrow> integrable lborel (\<lambda>x. std_normal_density x * \<bar>x - 0\<bar> ^ k)

goal (1 subgoal):
 1. integrable lborel (\<lambda>x. std_normal_density x * \<bar>x\<bar> ^ k)
[PROOF STEP]
by simp


[STATEMENT]
lemma poly_tuple_evalE':
  shows "length (poly_tuple_eval fs as) = length fs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. length (poly_tuple_eval fs as) = length fs
[PROOF STEP]
unfolding poly_tuple_eval_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. length (map (eval_at_point R as) fs) = length fs
[PROOF STEP]
using length_map
[PROOF STATE]
proof (prove)
using this:
length (map ?f ?xs) = length ?xs

goal (1 subgoal):
 1. length (map (eval_at_point R as) fs) = length fs
[PROOF STEP]
by blast


[STATEMENT]
lemma div_poly_less:
  \<open>x div y = 0\<close> if \<open>degree x < degree y\<close> for x y :: \<open>'a::field poly\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x div y = 0
[PROOF STEP]
using that
[PROOF STATE]
proof (prove)
using this:
degree x < degree y

goal (1 subgoal):
 1. x div y = 0
[PROOF STEP]
by (simp add: div_poly_eq_0_iff)


[STATEMENT]
lemma inc_matrix_point_in_block_one: "i < length Vs \<Longrightarrow> j < length Bs \<Longrightarrow> Vs ! i \<in> Bs ! j
    \<Longrightarrow> (inc_mat_of Vs Bs) $$ (i, j) = 1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>i < length Vs; j < length Bs; Vs ! i \<in> Bs ! j\<rbrakk> \<Longrightarrow> inc_mat_of Vs Bs $$ (i, j) = (1::'b)
[PROOF STEP]
by (simp add: inc_mat_of_def)


[STATEMENT]
theorem max_border_max_suf: assumes "u \<le>b w" shows "u \<le>s max_border w"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. u \<le>s max_border w
[PROOF STEP]
using  max_borderP_D_max'[OF max_border_ex \<open>u \<le>b w\<close>]
[PROOF STATE]
proof (prove)
using this:
u \<le>s max_border w

goal (1 subgoal):
 1. u \<le>s max_border w
[PROOF STEP]
.


[STATEMENT]
lemma (in ring_hom_cring) hom_sub[simp]:
  assumes "x \<in> carrier R" "y \<in> carrier R"
  shows "h (x \<ominus> y) = h x \<ominus>\<^bsub>S\<^esub> h y"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. h (x \<ominus> y) = h x \<ominus>\<^bsub>S\<^esub> h y
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
x \<in> carrier R
y \<in> carrier R

goal (1 subgoal):
 1. h (x \<ominus> y) = h x \<ominus>\<^bsub>S\<^esub> h y
[PROOF STEP]
by (simp add: R.minus_eq S.minus_eq)


[STATEMENT]
lemma permutations_of_multiset_not_empty [simp]: "permutations_of_multiset A \<noteq> {}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. permutations_of_multiset A \<noteq> {}
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. permutations_of_multiset A \<noteq> {}
[PROOF STEP]
from ex_mset[of A]
[PROOF STATE]
proof (chain)
picking this:
\<exists>xs. mset xs = A
[PROOF STEP]
obtain xs where "mset xs = A"
[PROOF STATE]
proof (prove)
using this:
\<exists>xs. mset xs = A

goal (1 subgoal):
 1. (\<And>xs. mset xs = A \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
mset xs = A

goal (1 subgoal):
 1. permutations_of_multiset A \<noteq> {}
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
mset xs = A

goal (1 subgoal):
 1. permutations_of_multiset A \<noteq> {}
[PROOF STEP]
by (auto simp: permutations_of_multiset_def)
[PROOF STATE]
proof (state)
this:
permutations_of_multiset A \<noteq> {}

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma block_nempty_implies_all_zeros: "j < dim_col M \<Longrightarrow> map_col_to_block (col M j) = {} \<Longrightarrow>
    i < dim_row M \<Longrightarrow> col M j $ i = 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>j < dim_col M; map_col_to_block (col M j) = {}; i < dim_row M\<rbrakk> \<Longrightarrow> col M j $ i = (0::'b)
[PROOF STEP]
by (metis col_nth_0_or_1_iff dim_col one_implies_block_nempty vec_setI)


[STATEMENT]
lemma float_divl_pos_less1_bound:
  "0 < real_of_float x \<Longrightarrow> real_of_float x \<le> 1 \<Longrightarrow> prec \<ge> 1 \<Longrightarrow>
    1 \<le> real_of_float (float_divl prec 1 x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 < real_of_float x; real_of_float x \<le> 1; 1 \<le> prec\<rbrakk> \<Longrightarrow> 1 \<le> real_of_float (float_divl prec 1 x)
[PROOF STEP]
by transfer (rule real_divl_pos_less1_bound)


[STATEMENT]
lemma vars_replace_coeff:
assumes "f 0 = 0"
shows "vars (replace_coeff f p) \<subseteq> vars p"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vars (replace_coeff f p) \<subseteq> vars p
[PROOF STEP]
unfolding vars_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<Union> (keys ` keys (mapping_of (replace_coeff f p))) \<subseteq> \<Union> (keys ` keys (mapping_of p))
[PROOF STEP]
apply (rule subsetI)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. x \<in> \<Union> (keys ` keys (mapping_of (replace_coeff f p))) \<Longrightarrow> x \<in> \<Union> (keys ` keys (mapping_of p))
[PROOF STEP]
unfolding mem_simps(8) coeff_keys
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. \<exists>xa\<in>keys (mapping_of (replace_coeff f p)). x \<in> keys xa \<Longrightarrow> \<exists>xa\<in>keys (mapping_of p). x \<in> keys xa
[PROOF STEP]
using assms coeff_replace_coeff
[PROOF STATE]
proof (prove)
using this:
f (0::'b) = (0::'a)
?f (0::?'b) = (0::?'a) \<Longrightarrow> coeff (replace_coeff ?f ?p) ?m = ?f (coeff ?p ?m)

goal (1 subgoal):
 1. \<And>x. \<exists>xa\<in>keys (mapping_of (replace_coeff f p)). x \<in> keys xa \<Longrightarrow> \<exists>xa\<in>keys (mapping_of p). x \<in> keys xa
[PROOF STEP]
by (metis coeff_keys)


[STATEMENT]
lemma orthogonal_matrix_intro:
  fixes A::"real^'n^'n"
  assumes p: "(pairwise orthogonal (columns A))"
  and n: "\<forall>i. norm (column i A) = 1"
  and c: "card (columns A) = ncols A" (*We need that premise to avoid the case that column i A = column j A when i \<noteq> j*)
  shows "orthogonal_matrix A"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. orthogonal_matrix A
[PROOF STEP]
proof (unfold orthogonal_matrix vec_eq_iff, clarify, unfold mat_1_fun, auto)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>ia. (Finite_Cartesian_Product.transpose A ** A) $ ia $ ia = 1
 2. \<And>i ia. i \<noteq> ia \<Longrightarrow> (Finite_Cartesian_Product.transpose A ** A) $ i $ ia = 0
[PROOF STEP]
fix ia
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>ia. (Finite_Cartesian_Product.transpose A ** A) $ ia $ ia = 1
 2. \<And>i ia. i \<noteq> ia \<Longrightarrow> (Finite_Cartesian_Product.transpose A ** A) $ i $ ia = 0
[PROOF STEP]
have "(transpose A ** A) $ ia $ ia = column ia A \<bullet> column ia A"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (Finite_Cartesian_Product.transpose A ** A) $ ia $ ia = column ia A \<bullet> column ia A
[PROOF STEP]
unfolding matrix_matrix_mult_inner_mult
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. row ia (Finite_Cartesian_Product.transpose A) \<bullet> column ia A = column ia A \<bullet> column ia A
[PROOF STEP]
unfolding row_transpose
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. column ia A \<bullet> column ia A = column ia A \<bullet> column ia A
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
(Finite_Cartesian_Product.transpose A ** A) $ ia $ ia = column ia A \<bullet> column ia A

goal (2 subgoals):
 1. \<And>ia. (Finite_Cartesian_Product.transpose A ** A) $ ia $ ia = 1
 2. \<And>i ia. i \<noteq> ia \<Longrightarrow> (Finite_Cartesian_Product.transpose A ** A) $ i $ ia = 0
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(Finite_Cartesian_Product.transpose A ** A) $ ia $ ia = column ia A \<bullet> column ia A

goal (2 subgoals):
 1. \<And>ia. (Finite_Cartesian_Product.transpose A ** A) $ ia $ ia = 1
 2. \<And>i ia. i \<noteq> ia \<Longrightarrow> (Finite_Cartesian_Product.transpose A ** A) $ i $ ia = 0
[PROOF STEP]
have "... = 1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. column ia A \<bullet> column ia A = 1
[PROOF STEP]
using n norm_eq_1
[PROOF STATE]
proof (prove)
using this:
\<forall>i. norm (column i A) = 1
(norm ?x = 1) = (?x \<bullet> ?x = 1)

goal (1 subgoal):
 1. column ia A \<bullet> column ia A = 1
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
column ia A \<bullet> column ia A = 1

goal (2 subgoals):
 1. \<And>ia. (Finite_Cartesian_Product.transpose A ** A) $ ia $ ia = 1
 2. \<And>i ia. i \<noteq> ia \<Longrightarrow> (Finite_Cartesian_Product.transpose A ** A) $ i $ ia = 0
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
(Finite_Cartesian_Product.transpose A ** A) $ ia $ ia = 1
[PROOF STEP]
show "(transpose A ** A) $ ia $ ia = 1"
[PROOF STATE]
proof (prove)
using this:
(Finite_Cartesian_Product.transpose A ** A) $ ia $ ia = 1

goal (1 subgoal):
 1. (Finite_Cartesian_Product.transpose A ** A) $ ia $ ia = 1
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
(Finite_Cartesian_Product.transpose A ** A) $ ia $ ia = 1

goal (1 subgoal):
 1. \<And>i ia. i \<noteq> ia \<Longrightarrow> (Finite_Cartesian_Product.transpose A ** A) $ i $ ia = 0
[PROOF STEP]
fix i
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>i ia. i \<noteq> ia \<Longrightarrow> (Finite_Cartesian_Product.transpose A ** A) $ i $ ia = 0
[PROOF STEP]
assume i_not_ia: "i \<noteq> ia"
[PROOF STATE]
proof (state)
this:
i \<noteq> ia

goal (1 subgoal):
 1. \<And>i ia. i \<noteq> ia \<Longrightarrow> (Finite_Cartesian_Product.transpose A ** A) $ i $ ia = 0
[PROOF STEP]
have column_i_not_ia: "column i A \<noteq> column ia A"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. column i A \<noteq> column ia A
[PROOF STEP]
proof (rule ccontr, simp)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. column i A = column ia A \<Longrightarrow> False
[PROOF STEP]
assume col_i_ia: "column i A = column ia A"
[PROOF STATE]
proof (state)
this:
column i A = column ia A

goal (1 subgoal):
 1. column i A = column ia A \<Longrightarrow> False
[PROOF STEP]
have rw: "(\<lambda>i. column i A)` (UNIV-{ia}) = {column i A|i. i\<noteq>ia}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lambda>i. column i A) ` (UNIV - {ia}) = {column i A |i. i \<noteq> ia}
[PROOF STEP]
unfolding columns_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lambda>i. column i A) ` (UNIV - {ia}) = {column i A |i. i \<noteq> ia}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<lambda>i. column i A) ` (UNIV - {ia}) = {column i A |i. i \<noteq> ia}

goal (1 subgoal):
 1. column i A = column ia A \<Longrightarrow> False
[PROOF STEP]
have "card (columns A) = card ({column i A|i. i\<noteq>ia})"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. card (columns A) = card {column i A |i. i \<noteq> ia}
[PROOF STEP]
by (rule bij_betw_same_card[of id], unfold bij_betw_def columns_def)
         (auto, metis col_i_ia i_not_ia)
[PROOF STATE]
proof (state)
this:
card (columns A) = card {column i A |i. i \<noteq> ia}

goal (1 subgoal):
 1. column i A = column ia A \<Longrightarrow> False
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
card (columns A) = card {column i A |i. i \<noteq> ia}

goal (1 subgoal):
 1. column i A = column ia A \<Longrightarrow> False
[PROOF STEP]
have "... = card ((\<lambda>i. column i A)` (UNIV-{ia}))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. card {column i A |i. i \<noteq> ia} = card ((\<lambda>i. column i A) ` (UNIV - {ia}))
[PROOF STEP]
unfolding rw
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. card {column i A |i. i \<noteq> ia} = card {column i A |i. i \<noteq> ia}
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
card {column i A |i. i \<noteq> ia} = card ((\<lambda>i. column i A) ` (UNIV - {ia}))

goal (1 subgoal):
 1. column i A = column ia A \<Longrightarrow> False
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
card {column i A |i. i \<noteq> ia} = card ((\<lambda>i. column i A) ` (UNIV - {ia}))

goal (1 subgoal):
 1. column i A = column ia A \<Longrightarrow> False
[PROOF STEP]
have "... \<le> card (UNIV - {ia})"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. card ((\<lambda>i. column i A) ` (UNIV - {ia})) \<le> card (UNIV - {ia})
[PROOF STEP]
by (metis card_image_le finite_code)
[PROOF STATE]
proof (state)
this:
card ((\<lambda>i. column i A) ` (UNIV - {ia})) \<le> card (UNIV - {ia})

goal (1 subgoal):
 1. column i A = column ia A \<Longrightarrow> False
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
card ((\<lambda>i. column i A) ` (UNIV - {ia})) \<le> card (UNIV - {ia})

goal (1 subgoal):
 1. column i A = column ia A \<Longrightarrow> False
[PROOF STEP]
have "... < CARD ('n)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. card (UNIV - {ia}) < CARD('n)
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
card (UNIV - {ia}) < CARD('n)

goal (1 subgoal):
 1. column i A = column ia A \<Longrightarrow> False
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
card (columns A) < CARD('n)
[PROOF STEP]
show False
[PROOF STATE]
proof (prove)
using this:
card (columns A) < CARD('n)

goal (1 subgoal):
 1. False
[PROOF STEP]
using c
[PROOF STATE]
proof (prove)
using this:
card (columns A) < CARD('n)
card (columns A) = ncols A

goal (1 subgoal):
 1. False
[PROOF STEP]
unfolding ncols_def
[PROOF STATE]
proof (prove)
using this:
card (columns A) < CARD('n)
card (columns A) = CARD('n)

goal (1 subgoal):
 1. False
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
False

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
column i A \<noteq> column ia A

goal (1 subgoal):
 1. \<And>i ia. i \<noteq> ia \<Longrightarrow> (Finite_Cartesian_Product.transpose A ** A) $ i $ ia = 0
[PROOF STEP]
hence oia: "orthogonal (column i A) (column ia A)"
[PROOF STATE]
proof (prove)
using this:
column i A \<noteq> column ia A

goal (1 subgoal):
 1. orthogonal (column i A) (column ia A)
[PROOF STEP]
using p
[PROOF STATE]
proof (prove)
using this:
column i A \<noteq> column ia A
pairwise orthogonal (columns A)

goal (1 subgoal):
 1. orthogonal (column i A) (column ia A)
[PROOF STEP]
unfolding pairwise_def
[PROOF STATE]
proof (prove)
using this:
column i A \<noteq> column ia A
\<forall>x\<in>columns A. \<forall>y\<in>columns A. x \<noteq> y \<longrightarrow> orthogonal x y

goal (1 subgoal):
 1. orthogonal (column i A) (column ia A)
[PROOF STEP]
unfolding columns_def
[PROOF STATE]
proof (prove)
using this:
column i A \<noteq> column ia A
\<forall>x\<in>{column i A |i. i \<in> UNIV}. \<forall>y\<in>{column i A |i. i \<in> UNIV}. x \<noteq> y \<longrightarrow> orthogonal x y

goal (1 subgoal):
 1. orthogonal (column i A) (column ia A)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
orthogonal (column i A) (column ia A)

goal (1 subgoal):
 1. \<And>i ia. i \<noteq> ia \<Longrightarrow> (Finite_Cartesian_Product.transpose A ** A) $ i $ ia = 0
[PROOF STEP]
have "(transpose A ** A) $ i $ ia = column i A \<bullet> column ia A"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (Finite_Cartesian_Product.transpose A ** A) $ i $ ia = column i A \<bullet> column ia A
[PROOF STEP]
unfolding matrix_matrix_mult_inner_mult
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. row i (Finite_Cartesian_Product.transpose A) \<bullet> column ia A = column i A \<bullet> column ia A
[PROOF STEP]
unfolding row_transpose
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. column i A \<bullet> column ia A = column i A \<bullet> column ia A
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
(Finite_Cartesian_Product.transpose A ** A) $ i $ ia = column i A \<bullet> column ia A

goal (1 subgoal):
 1. \<And>i ia. i \<noteq> ia \<Longrightarrow> (Finite_Cartesian_Product.transpose A ** A) $ i $ ia = 0
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(Finite_Cartesian_Product.transpose A ** A) $ i $ ia = column i A \<bullet> column ia A

goal (1 subgoal):
 1. \<And>i ia. i \<noteq> ia \<Longrightarrow> (Finite_Cartesian_Product.transpose A ** A) $ i $ ia = 0
[PROOF STEP]
have "... = 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. column i A \<bullet> column ia A = 0
[PROOF STEP]
using oia
[PROOF STATE]
proof (prove)
using this:
orthogonal (column i A) (column ia A)

goal (1 subgoal):
 1. column i A \<bullet> column ia A = 0
[PROOF STEP]
unfolding orthogonal_def
[PROOF STATE]
proof (prove)
using this:
column i A \<bullet> column ia A = 0

goal (1 subgoal):
 1. column i A \<bullet> column ia A = 0
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
column i A \<bullet> column ia A = 0

goal (1 subgoal):
 1. \<And>i ia. i \<noteq> ia \<Longrightarrow> (Finite_Cartesian_Product.transpose A ** A) $ i $ ia = 0
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
(Finite_Cartesian_Product.transpose A ** A) $ i $ ia = 0
[PROOF STEP]
show "(transpose A ** A) $ i $ ia = 0"
[PROOF STATE]
proof (prove)
using this:
(Finite_Cartesian_Product.transpose A ** A) $ i $ ia = 0

goal (1 subgoal):
 1. (Finite_Cartesian_Product.transpose A ** A) $ i $ ia = 0
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
(Finite_Cartesian_Product.transpose A ** A) $ i $ ia = 0

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma construction_of_all_possible_states_lemma:
  fixes v X
  assumes "(v \<notin> X)"
  shows "({s. fmdom' s = insert v X}
    = ((\<lambda>s. fmupd v True s) ` {s. fmdom' s = X})
      \<union> ((\<lambda>s. fmupd v False s) ` {s. fmdom' s = X})
  )"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {s. fmdom' s = insert v X} = fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X}
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. {s. fmdom' s = insert v X} = fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X}
[PROOF STEP]
fix v X
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. {s. fmdom' s = insert v X} = fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X}
[PROOF STEP]
let ?A = "{s :: 'a state. fmdom' s = insert v X}"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. {s. fmdom' s = insert v X} = fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X}
[PROOF STEP]
let ?B = "
    ((\<lambda>s. fmupd v True s) ` {s :: 'a state. fmdom' s = X})
    \<union> ((\<lambda>s. fmupd v False s) ` {s :: 'a state. fmdom' s = X})
  "
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. {s. fmdom' s = insert v X} = fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X}
[PROOF STEP]
text \<open>Show the goal by mutual inclusion. The inclusion @{term "?B \<subseteq> ?A"} is trivial and can be solved by
    automation. For the complimentary proof @{term "?A \<subseteq> ?B"} however we need to do more work.
    In our case we choose a proof by contradiction and show that an @{term "s \<in> ?A"} which is not also in
    '?B' cannot exist.\<close>
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. {s. fmdom' s = insert v X} = fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X}
[PROOF STEP]
{
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. {s. fmdom' s = insert v X} = fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X}
[PROOF STEP]
have "?A \<subseteq> ?B"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {s. fmdom' s = insert v X} \<subseteq> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X}
[PROOF STEP]
proof(rule ccontr)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> {s. fmdom' s = insert v X} \<subseteq> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X} \<Longrightarrow> False
[PROOF STEP]
assume C: "\<not>(?A \<subseteq> ?B)"
[PROOF STATE]
proof (state)
this:
\<not> {s. fmdom' s = insert v X} \<subseteq> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X}

goal (1 subgoal):
 1. \<not> {s. fmdom' s = insert v X} \<subseteq> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X} \<Longrightarrow> False
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<not> {s. fmdom' s = insert v X} \<subseteq> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X}

goal (1 subgoal):
 1. \<not> {s. fmdom' s = insert v X} \<subseteq> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X} \<Longrightarrow> False
[PROOF STEP]
have "\<exists>s\<in>?A. s\<notin>?B"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>s\<in>{s. fmdom' s = insert v X}. s \<notin> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X}
[PROOF STEP]
using C
[PROOF STATE]
proof (prove)
using this:
\<not> {s. fmdom' s = insert v X} \<subseteq> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X}

goal (1 subgoal):
 1. \<exists>s\<in>{s. fmdom' s = insert v X}. s \<notin> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<exists>s\<in>{s. fmdom' s = insert v X}. s \<notin> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X}

goal (1 subgoal):
 1. \<not> {s. fmdom' s = insert v X} \<subseteq> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X} \<Longrightarrow> False
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<exists>s\<in>{s. fmdom' s = insert v X}. s \<notin> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X}

goal (1 subgoal):
 1. \<not> {s. fmdom' s = insert v X} \<subseteq> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X} \<Longrightarrow> False
[PROOF STEP]
obtain s where obtain_s: "s\<in>?A \<and> s\<notin>?B"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>s. s \<in> {s. fmdom' s = insert v X} \<and> s \<notin> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X} \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using calculation
[PROOF STATE]
proof (prove)
using this:
\<not> {s. fmdom' s = insert v X} \<subseteq> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X}
\<exists>s\<in>{s. fmdom' s = insert v X}. s \<notin> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X}

goal (1 subgoal):
 1. (\<And>s. s \<in> {s. fmdom' s = insert v X} \<and> s \<notin> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X} \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
s \<in> {s. fmdom' s = insert v X} \<and> s \<notin> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X}

goal (1 subgoal):
 1. \<not> {s. fmdom' s = insert v X} \<subseteq> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X} \<Longrightarrow> False
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
s \<in> {s. fmdom' s = insert v X} \<and> s \<notin> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X}

goal (1 subgoal):
 1. \<not> {s. fmdom' s = insert v X} \<subseteq> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X} \<Longrightarrow> False
[PROOF STEP]
have "s\<notin>?B"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. s \<notin> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X}
[PROOF STEP]
using obtain_s
[PROOF STATE]
proof (prove)
using this:
s \<in> {s. fmdom' s = insert v X} \<and> s \<notin> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X}

goal (1 subgoal):
 1. s \<notin> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
s \<notin> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X}

goal (1 subgoal):
 1. \<not> {s. fmdom' s = insert v X} \<subseteq> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X} \<Longrightarrow> False
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
s \<notin> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X}

goal (1 subgoal):
 1. \<not> {s. fmdom' s = insert v X} \<subseteq> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X} \<Longrightarrow> False
[PROOF STEP]
have "fmdom' s = X \<union> {v}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fmdom' s = X \<union> {v}
[PROOF STEP]
using obtain_s
[PROOF STATE]
proof (prove)
using this:
s \<in> {s. fmdom' s = insert v X} \<and> s \<notin> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X}

goal (1 subgoal):
 1. fmdom' s = X \<union> {v}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fmdom' s = X \<union> {v}

goal (1 subgoal):
 1. \<not> {s. fmdom' s = insert v X} \<subseteq> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X} \<Longrightarrow> False
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
fmdom' s = X \<union> {v}

goal (1 subgoal):
 1. \<not> {s. fmdom' s = insert v X} \<subseteq> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X} \<Longrightarrow> False
[PROOF STEP]
have "\<forall>s'\<in>?B. fmdom' s' = X \<union> {v}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>s'\<in>fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X}. fmdom' s' = X \<union> {v}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<forall>s'\<in>fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X}. fmdom' s' = X \<union> {v}

goal (1 subgoal):
 1. \<not> {s. fmdom' s = insert v X} \<subseteq> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X} \<Longrightarrow> False
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<forall>s'\<in>fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X}. fmdom' s' = X \<union> {v}

goal (1 subgoal):
 1. \<not> {s. fmdom' s = insert v X} \<subseteq> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X} \<Longrightarrow> False
[PROOF STEP]
have
        "(s \<notin> ((\<lambda>s. fmupd v True s) ` {s. fmdom' s = X}))"
        "(s \<notin> ((\<lambda>s. fmupd v False s) ` {s. fmdom' s = X}))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. s \<notin> fmupd v True ` {s. fmdom' s = X} &&& s \<notin> fmupd v False ` {s. fmdom' s = X}
[PROOF STEP]
using obtain_s
[PROOF STATE]
proof (prove)
using this:
s \<in> {s. fmdom' s = insert v X} \<and> s \<notin> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X}

goal (1 subgoal):
 1. s \<notin> fmupd v True ` {s. fmdom' s = X} &&& s \<notin> fmupd v False ` {s. fmdom' s = X}
[PROOF STEP]
by blast+
[PROOF STATE]
proof (state)
this:
s \<notin> fmupd v True ` {s. fmdom' s = X}
s \<notin> fmupd v False ` {s. fmdom' s = X}

goal (1 subgoal):
 1. \<not> {s. fmdom' s = insert v X} \<subseteq> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X} \<Longrightarrow> False
[PROOF STEP]
text \<open> Show that every state @{term "s \<in> ?A"} has been constructed from another state with domain
        'X'. \<close>
[PROOF STATE]
proof (state)
this:
s \<notin> fmupd v True ` {s. fmdom' s = X}
s \<notin> fmupd v False ` {s. fmdom' s = X}

goal (1 subgoal):
 1. \<not> {s. fmdom' s = insert v X} \<subseteq> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X} \<Longrightarrow> False
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
s \<notin> fmupd v True ` {s. fmdom' s = X}
s \<notin> fmupd v False ` {s. fmdom' s = X}

goal (1 subgoal):
 1. \<not> {s. fmdom' s = insert v X} \<subseteq> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X} \<Longrightarrow> False
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
s \<notin> fmupd v True ` {s. fmdom' s = X}
s \<notin> fmupd v False ` {s. fmdom' s = X}

goal (1 subgoal):
 1. \<not> {s. fmdom' s = insert v X} \<subseteq> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X} \<Longrightarrow> False
[PROOF STEP]
fix s :: "'a state"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> {s. fmdom' s = insert v X} \<subseteq> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X} \<Longrightarrow> False
[PROOF STEP]
assume 1: "s \<in> {s :: 'a state. fmdom' s = insert v X}"
[PROOF STATE]
proof (state)
this:
s \<in> {s. fmdom' s = insert v X}

goal (1 subgoal):
 1. \<not> {s. fmdom' s = insert v X} \<subseteq> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X} \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
s \<in> {s. fmdom' s = insert v X}
[PROOF STEP]
have "fmrestrict_set X s \<in> {s :: 'a state. fmdom' s = X}"
[PROOF STATE]
proof (prove)
using this:
s \<in> {s. fmdom' s = insert v X}

goal (1 subgoal):
 1. fmrestrict_set X s \<in> {s. fmdom' s = X}
[PROOF STEP]
using subset_insertI fmsubset_restrict_set
[PROOF STATE]
proof (prove)
using this:
s \<in> {s. fmdom' s = insert v X}
?B \<subseteq> insert ?a ?B
\<lbrakk>?X1.0 \<subseteq> ?X2.0; ?s \<in> {s. fmdom' s = ?X2.0}\<rbrakk> \<Longrightarrow> fmrestrict_set ?X1.0 ?s \<in> {s. fmdom' s = ?X1.0}

goal (1 subgoal):
 1. fmrestrict_set X s \<in> {s. fmdom' s = X}
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
fmrestrict_set X s \<in> {s. fmdom' s = X}

goal (1 subgoal):
 1. \<not> {s. fmdom' s = insert v X} \<subseteq> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X} \<Longrightarrow> False
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
fmrestrict_set X s \<in> {s. fmdom' s = X}

goal (1 subgoal):
 1. \<not> {s. fmdom' s = insert v X} \<subseteq> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X} \<Longrightarrow> False
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
fmrestrict_set X s \<in> {s. fmdom' s = X}

goal (1 subgoal):
 1. \<not> {s. fmdom' s = insert v X} \<subseteq> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X} \<Longrightarrow> False
[PROOF STEP]
assume "fmlookup s v = Some True"
[PROOF STATE]
proof (state)
this:
fmlookup s v = Some True

goal (1 subgoal):
 1. \<not> {s. fmdom' s = insert v X} \<subseteq> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X} \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
fmlookup s v = Some True
[PROOF STEP]
have "s = fmupd v True (fmrestrict_set X s)"
[PROOF STATE]
proof (prove)
using this:
fmlookup s v = Some True

goal (1 subgoal):
 1. s = fmupd v True (fmrestrict_set X s)
[PROOF STEP]
using 1 fmupd_fmsubset_restrict_set
[PROOF STATE]
proof (prove)
using this:
fmlookup s v = Some True
s \<in> {s. fmdom' s = insert v X}
\<lbrakk>?s \<in> {s. fmdom' s = insert ?v ?X}; fmlookup ?s ?v = Some ?x\<rbrakk> \<Longrightarrow> ?s = fmupd ?v ?x (fmrestrict_set ?X ?s)

goal (1 subgoal):
 1. s = fmupd v True (fmrestrict_set X s)
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
s = fmupd v True (fmrestrict_set X s)

goal (1 subgoal):
 1. \<not> {s. fmdom' s = insert v X} \<subseteq> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X} \<Longrightarrow> False
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
fmlookup s v = Some True \<Longrightarrow> s = fmupd v True (fmrestrict_set X s)

goal (1 subgoal):
 1. \<not> {s. fmdom' s = insert v X} \<subseteq> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X} \<Longrightarrow> False
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
fmlookup s v = Some True \<Longrightarrow> s = fmupd v True (fmrestrict_set X s)

goal (1 subgoal):
 1. \<not> {s. fmdom' s = insert v X} \<subseteq> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X} \<Longrightarrow> False
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
fmlookup s v = Some True \<Longrightarrow> s = fmupd v True (fmrestrict_set X s)

goal (1 subgoal):
 1. \<not> {s. fmdom' s = insert v X} \<subseteq> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X} \<Longrightarrow> False
[PROOF STEP]
assume "fmlookup s v = Some False"
[PROOF STATE]
proof (state)
this:
fmlookup s v = Some False

goal (1 subgoal):
 1. \<not> {s. fmdom' s = insert v X} \<subseteq> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X} \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
fmlookup s v = Some False
[PROOF STEP]
have "s = fmupd v False (fmrestrict_set X s)"
[PROOF STATE]
proof (prove)
using this:
fmlookup s v = Some False

goal (1 subgoal):
 1. s = fmupd v False (fmrestrict_set X s)
[PROOF STEP]
using 1 fmupd_fmsubset_restrict_set
[PROOF STATE]
proof (prove)
using this:
fmlookup s v = Some False
s \<in> {s. fmdom' s = insert v X}
\<lbrakk>?s \<in> {s. fmdom' s = insert ?v ?X}; fmlookup ?s ?v = Some ?x\<rbrakk> \<Longrightarrow> ?s = fmupd ?v ?x (fmrestrict_set ?X ?s)

goal (1 subgoal):
 1. s = fmupd v False (fmrestrict_set X s)
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
s = fmupd v False (fmrestrict_set X s)

goal (1 subgoal):
 1. \<not> {s. fmdom' s = insert v X} \<subseteq> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X} \<Longrightarrow> False
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
fmlookup s v = Some False \<Longrightarrow> s = fmupd v False (fmrestrict_set X s)

goal (1 subgoal):
 1. \<not> {s. fmdom' s = insert v X} \<subseteq> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X} \<Longrightarrow> False
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
fmlookup s v = Some False \<Longrightarrow> s = fmupd v False (fmrestrict_set X s)

goal (1 subgoal):
 1. \<not> {s. fmdom' s = insert v X} \<subseteq> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X} \<Longrightarrow> False
[PROOF STEP]
have "fmlookup s v \<noteq> None"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fmlookup s v \<noteq> None
[PROOF STEP]
using 1 fmdom'_notI
[PROOF STATE]
proof (prove)
using this:
s \<in> {s. fmdom' s = insert v X}
fmlookup ?m ?x = None \<Longrightarrow> ?x \<notin> fmdom' ?m

goal (1 subgoal):
 1. fmlookup s v \<noteq> None
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
fmlookup s v \<noteq> None

goal (1 subgoal):
 1. \<not> {s. fmdom' s = insert v X} \<subseteq> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X} \<Longrightarrow> False
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
fmrestrict_set X s \<in> {s. fmdom' s = X}
fmlookup s v = Some True \<Longrightarrow> s = fmupd v True (fmrestrict_set X s)
fmlookup s v = Some False \<Longrightarrow> s = fmupd v False (fmrestrict_set X s)
fmlookup s v \<noteq> None
[PROOF STEP]
have "
          (s \<in> ((\<lambda>s. fmupd v True s) ` {s. fmdom' s = X}))
          \<or> (s \<in> ((\<lambda>s. fmupd v False s) ` {s. fmdom' s = X}))
        "
[PROOF STATE]
proof (prove)
using this:
fmrestrict_set X s \<in> {s. fmdom' s = X}
fmlookup s v = Some True \<Longrightarrow> s = fmupd v True (fmrestrict_set X s)
fmlookup s v = Some False \<Longrightarrow> s = fmupd v False (fmrestrict_set X s)
fmlookup s v \<noteq> None

goal (1 subgoal):
 1. s \<in> fmupd v True ` {s. fmdom' s = X} \<or> s \<in> fmupd v False ` {s. fmdom' s = X}
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
s \<in> fmupd v True ` {s. fmdom' s = X} \<or> s \<in> fmupd v False ` {s. fmdom' s = X}

goal (1 subgoal):
 1. \<not> {s. fmdom' s = insert v X} \<subseteq> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X} \<Longrightarrow> False
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
?sa2 \<in> {s. fmdom' s = insert v X} \<Longrightarrow> ?sa2 \<in> fmupd v True ` {s. fmdom' s = X} \<or> ?sa2 \<in> fmupd v False ` {s. fmdom' s = X}

goal (1 subgoal):
 1. \<not> {s. fmdom' s = insert v X} \<subseteq> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X} \<Longrightarrow> False
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<not> {s. fmdom' s = insert v X} \<subseteq> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X}
\<exists>s\<in>{s. fmdom' s = insert v X}. s \<notin> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X}
s \<in> {s. fmdom' s = insert v X} \<and> s \<notin> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X}
s \<notin> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X}
fmdom' s = X \<union> {v}
\<forall>s'\<in>fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X}. fmdom' s' = X \<union> {v}
s \<notin> fmupd v True ` {s. fmdom' s = X}
s \<notin> fmupd v False ` {s. fmdom' s = X}
?sa2 \<in> {s. fmdom' s = insert v X} \<Longrightarrow> ?sa2 \<in> fmupd v True ` {s. fmdom' s = X} \<or> ?sa2 \<in> fmupd v False ` {s. fmdom' s = X}
[PROOF STEP]
show False
[PROOF STATE]
proof (prove)
using this:
\<not> {s. fmdom' s = insert v X} \<subseteq> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X}
\<exists>s\<in>{s. fmdom' s = insert v X}. s \<notin> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X}
s \<in> {s. fmdom' s = insert v X} \<and> s \<notin> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X}
s \<notin> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X}
fmdom' s = X \<union> {v}
\<forall>s'\<in>fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X}. fmdom' s' = X \<union> {v}
s \<notin> fmupd v True ` {s. fmdom' s = X}
s \<notin> fmupd v False ` {s. fmdom' s = X}
?sa2 \<in> {s. fmdom' s = insert v X} \<Longrightarrow> ?sa2 \<in> fmupd v True ` {s. fmdom' s = X} \<or> ?sa2 \<in> fmupd v False ` {s. fmdom' s = X}

goal (1 subgoal):
 1. False
[PROOF STEP]
by meson
[PROOF STATE]
proof (state)
this:
False

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
{s. fmdom' s = insert v X} \<subseteq> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X}

goal (1 subgoal):
 1. {s. fmdom' s = insert v X} = fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X}
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
{s. fmdom' s = insert v X} \<subseteq> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X}

goal (1 subgoal):
 1. {s. fmdom' s = insert v X} = fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X}
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
{s. fmdom' s = insert v X} \<subseteq> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X}

goal (1 subgoal):
 1. {s. fmdom' s = insert v X} = fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X}
[PROOF STEP]
have "?B \<subseteq> ?A"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X} \<subseteq> {s. fmdom' s = insert v X}
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X} \<subseteq> {s. fmdom' s = insert v X}

goal (1 subgoal):
 1. {s. fmdom' s = insert v X} = fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X}
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
{s. fmdom' s = insert v X} \<subseteq> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X}
fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X} \<subseteq> {s. fmdom' s = insert v X}
[PROOF STEP]
show "?A = ?B"
[PROOF STATE]
proof (prove)
using this:
{s. fmdom' s = insert v X} \<subseteq> fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X}
fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X} \<subseteq> {s. fmdom' s = insert v X}

goal (1 subgoal):
 1. {s. fmdom' s = insert v X} = fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
{s. fmdom' s = insert v X} = fmupd v True ` {s. fmdom' s = X} \<union> fmupd v False ` {s. fmdom' s = X}

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma set2list_prop:"\<lbrakk>finite A; A \<noteq> {}\<rbrakk> \<Longrightarrow>
  \<exists>xs. while (\<lambda>(Es,S). S \<noteq> {})
             (\<lambda>(Es,S). let x = pick S in (x#Es,S-{x}))
             ([],A) = (xs,{}) \<and> (set xs \<union> {} = A)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>finite A; A \<noteq> {}\<rbrakk> \<Longrightarrow> \<exists>xs. while (\<lambda>(Es, S). S \<noteq> {}) (\<lambda>(Es, S). let x = pick S in (x # Es, S - {x})) ([], A) = (xs, {}) \<and> set xs \<union> {} = A
[PROOF STEP]
apply(rule_tac P="(\<lambda>xs. (set(fst xs) \<union> snd xs = A))" and
               r="measure (card o snd)"  in while_rule)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<lbrakk>finite A; A \<noteq> {}\<rbrakk> \<Longrightarrow> set (fst ([], A)) \<union> snd ([], A) = A
 2. \<And>s. \<lbrakk>finite A; A \<noteq> {}; set (fst s) \<union> snd s = A; case s of (Es, S) \<Rightarrow> S \<noteq> {}\<rbrakk> \<Longrightarrow> set (fst (case s of (Es, S) \<Rightarrow> let x = pick S in (x # Es, S - {x}))) \<union> snd (case s of (Es, S) \<Rightarrow> let x = pick S in (x # Es, S - {x})) = A
 3. \<And>s. \<lbrakk>finite A; A \<noteq> {}; set (fst s) \<union> snd s = A; \<not> (case s of (Es, S) \<Rightarrow> S \<noteq> {})\<rbrakk> \<Longrightarrow> \<exists>xs. s = (xs, {}) \<and> set xs \<union> {} = A
 4. \<lbrakk>finite A; A \<noteq> {}\<rbrakk> \<Longrightarrow> wf (measure (card \<circ> snd))
 5. \<And>s. \<lbrakk>finite A; A \<noteq> {}; set (fst s) \<union> snd s = A; case s of (Es, S) \<Rightarrow> S \<noteq> {}\<rbrakk> \<Longrightarrow> (case s of (Es, S) \<Rightarrow> let x = pick S in (x # Es, S - {x}), s) \<in> measure (card \<circ> snd)
[PROOF STEP]
apply(auto dest:pick_is_element)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>a b x. \<lbrakk>A = set a \<union> b; \<not> card (b - {pick b}) < card b; finite b; x \<in> b\<rbrakk> \<Longrightarrow> a = []
 2. \<And>a b x xa. \<lbrakk>A = set a \<union> b; \<not> card (b - {pick b}) < card b; finite b; x \<in> b; xa \<in> b\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply(auto dest:card_pick simp:ex_in_conv measure_def inv_image_def)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma power_diff':
  assumes "b \<le> a"
  shows   "x ^ (a - b) = (if x = 0 \<and> a = b then 1 else x ^ a / (x::'a::field) ^ b)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x ^ (a - b) = (if x = (0::'a) \<and> a = b then 1::'a else x ^ a / x ^ b)
[PROOF STEP]
proof (cases "x = 0")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. x = (0::'a) \<Longrightarrow> x ^ (a - b) = (if x = (0::'a) \<and> a = b then 1::'a else x ^ a / x ^ b)
 2. x \<noteq> (0::'a) \<Longrightarrow> x ^ (a - b) = (if x = (0::'a) \<and> a = b then 1::'a else x ^ a / x ^ b)
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
x = (0::'a)

goal (2 subgoals):
 1. x = (0::'a) \<Longrightarrow> x ^ (a - b) = (if x = (0::'a) \<and> a = b then 1::'a else x ^ a / x ^ b)
 2. x \<noteq> (0::'a) \<Longrightarrow> x ^ (a - b) = (if x = (0::'a) \<and> a = b then 1::'a else x ^ a / x ^ b)
[PROOF STEP]
with assms
[PROOF STATE]
proof (chain)
picking this:
b \<le> a
x = (0::'a)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
b \<le> a
x = (0::'a)

goal (1 subgoal):
 1. x ^ (a - b) = (if x = (0::'a) \<and> a = b then 1::'a else x ^ a / x ^ b)
[PROOF STEP]
by (cases "a - b") simp_all
[PROOF STATE]
proof (state)
this:
x ^ (a - b) = (if x = (0::'a) \<and> a = b then 1::'a else x ^ a / x ^ b)

goal (1 subgoal):
 1. x \<noteq> (0::'a) \<Longrightarrow> x ^ (a - b) = (if x = (0::'a) \<and> a = b then 1::'a else x ^ a / x ^ b)
[PROOF STEP]
qed (insert assms, simp_all add: power_diff)


[STATEMENT]
lemma gcard_Union_le_cmult:
  assumes "small U" and \<kappa>: "\<And>x. x \<in> U \<Longrightarrow> gcard x \<le> \<kappa>" and sm: "\<And>x. x \<in> U \<Longrightarrow> small x"
  shows "gcard (\<Union>U) \<le> gcard U \<otimes> \<kappa>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. gcard (\<Union> U) \<le> gcard U \<otimes> \<kappa>
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. gcard (\<Union> U) \<le> gcard U \<otimes> \<kappa>
[PROOF STEP]
have "\<exists>f. f \<in> x \<rightarrow> elts \<kappa> \<and> inj_on f x" if "x \<in> U" for x
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>f. f \<in> x \<rightarrow> elts \<kappa> \<and> inj_on f x
[PROOF STEP]
using \<kappa> [OF that] gcard_le_lepoll
[PROOF STATE]
proof (prove)
using this:
gcard x \<le> \<kappa>
\<lbrakk>gcard ?A \<le> ?\<alpha>; small ?A\<rbrakk> \<Longrightarrow> ?A \<lesssim> elts ?\<alpha>

goal (1 subgoal):
 1. \<exists>f. f \<in> x \<rightarrow> elts \<kappa> \<and> inj_on f x
[PROOF STEP]
by (metis image_subset_iff_funcset lepoll_def sm that)
[PROOF STATE]
proof (state)
this:
?x \<in> U \<Longrightarrow> \<exists>f. f \<in> ?x \<rightarrow> elts \<kappa> \<and> inj_on f ?x

goal (1 subgoal):
 1. gcard (\<Union> U) \<le> gcard U \<otimes> \<kappa>
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
?x \<in> U \<Longrightarrow> \<exists>f. f \<in> ?x \<rightarrow> elts \<kappa> \<and> inj_on f ?x
[PROOF STEP]
obtain \<phi> where \<phi>: "\<And>x. x \<in> U \<Longrightarrow> (\<phi> x) \<in> x \<rightarrow> elts \<kappa> \<and> inj_on (\<phi> x) x"
[PROOF STATE]
proof (prove)
using this:
?x \<in> U \<Longrightarrow> \<exists>f. f \<in> ?x \<rightarrow> elts \<kappa> \<and> inj_on f ?x

goal (1 subgoal):
 1. (\<And>\<phi>. (\<And>x. x \<in> U \<Longrightarrow> \<phi> x \<in> x \<rightarrow> elts \<kappa> \<and> inj_on (\<phi> x) x) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
?x \<in> U \<Longrightarrow> \<phi> ?x \<in> ?x \<rightarrow> elts \<kappa> \<and> inj_on (\<phi> ?x) ?x

goal (1 subgoal):
 1. gcard (\<Union> U) \<le> gcard U \<otimes> \<kappa>
[PROOF STEP]
define u where "u \<equiv> \<lambda>y. @x. x \<in> U \<and> y \<in> x"
[PROOF STATE]
proof (state)
this:
u \<equiv> \<lambda>y. SOME x. x \<in> U \<and> y \<in> x

goal (1 subgoal):
 1. gcard (\<Union> U) \<le> gcard U \<otimes> \<kappa>
[PROOF STEP]
have u: "u y \<in> U \<and> y \<in>  (u y)" if "y \<in> \<Union>( U)" for y
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. u y \<in> U \<and> y \<in> u y
[PROOF STEP]
unfolding u_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (SOME x. x \<in> U \<and> y \<in> x) \<in> U \<and> y \<in> (SOME x. x \<in> U \<and> y \<in> x)
[PROOF STEP]
using that
[PROOF STATE]
proof (prove)
using this:
y \<in> \<Union> U

goal (1 subgoal):
 1. (SOME x. x \<in> U \<and> y \<in> x) \<in> U \<and> y \<in> (SOME x. x \<in> U \<and> y \<in> x)
[PROOF STEP]
by (fast intro!: someI2)
[PROOF STATE]
proof (state)
this:
?y \<in> \<Union> U \<Longrightarrow> u ?y \<in> U \<and> ?y \<in> u ?y

goal (1 subgoal):
 1. gcard (\<Union> U) \<le> gcard U \<otimes> \<kappa>
[PROOF STEP]
define \<psi> where "\<psi> \<equiv> \<lambda>y. (u y, \<phi> (u y) y)"
[PROOF STATE]
proof (state)
this:
\<psi> \<equiv> \<lambda>y. (u y, \<phi> (u y) y)

goal (1 subgoal):
 1. gcard (\<Union> U) \<le> gcard U \<otimes> \<kappa>
[PROOF STEP]
have U: "elts (gcard U) \<approx> U"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. elts (gcard U) \<approx> U
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
small U
?x \<in> U \<Longrightarrow> gcard ?x \<le> \<kappa>
?x \<in> U \<Longrightarrow> small ?x

goal (1 subgoal):
 1. elts (gcard U) \<approx> U
[PROOF STEP]
by (simp add: gcard_eqpoll)
[PROOF STATE]
proof (state)
this:
elts (gcard U) \<approx> U

goal (1 subgoal):
 1. gcard (\<Union> U) \<le> gcard U \<otimes> \<kappa>
[PROOF STEP]
have "\<Union>U \<lesssim> U \<times> elts \<kappa>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<Union> U \<lesssim> U \<times> elts \<kappa>
[PROOF STEP]
unfolding lepoll_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>f. inj_on f (\<Union> U) \<and> f ` \<Union> U \<subseteq> U \<times> elts \<kappa>
[PROOF STEP]
proof (intro exI conjI)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. inj_on ?f (\<Union> U)
 2. ?f ` \<Union> U \<subseteq> U \<times> elts \<kappa>
[PROOF STEP]
show "inj_on \<psi> (\<Union> U)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. inj_on \<psi> (\<Union> U)
[PROOF STEP]
using \<phi> u
[PROOF STATE]
proof (prove)
using this:
?x \<in> U \<Longrightarrow> \<phi> ?x \<in> ?x \<rightarrow> elts \<kappa> \<and> inj_on (\<phi> ?x) ?x
?y \<in> \<Union> U \<Longrightarrow> u ?y \<in> U \<and> ?y \<in> u ?y

goal (1 subgoal):
 1. inj_on \<psi> (\<Union> U)
[PROOF STEP]
by (smt (verit) \<psi>_def inj_on_def prod.inject)
[PROOF STATE]
proof (state)
this:
inj_on \<psi> (\<Union> U)

goal (1 subgoal):
 1. \<psi> ` \<Union> U \<subseteq> U \<times> elts \<kappa>
[PROOF STEP]
show "\<psi> ` \<Union> U \<subseteq> U \<times> elts \<kappa>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<psi> ` \<Union> U \<subseteq> U \<times> elts \<kappa>
[PROOF STEP]
using \<phi> u
[PROOF STATE]
proof (prove)
using this:
?x \<in> U \<Longrightarrow> \<phi> ?x \<in> ?x \<rightarrow> elts \<kappa> \<and> inj_on (\<phi> ?x) ?x
?y \<in> \<Union> U \<Longrightarrow> u ?y \<in> U \<and> ?y \<in> u ?y

goal (1 subgoal):
 1. \<psi> ` \<Union> U \<subseteq> U \<times> elts \<kappa>
[PROOF STEP]
by (auto simp: \<psi>_def)
[PROOF STATE]
proof (state)
this:
\<psi> ` \<Union> U \<subseteq> U \<times> elts \<kappa>

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<Union> U \<lesssim> U \<times> elts \<kappa>

goal (1 subgoal):
 1. gcard (\<Union> U) \<le> gcard U \<otimes> \<kappa>
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
\<Union> U \<lesssim> U \<times> elts \<kappa>

goal (1 subgoal):
 1. gcard (\<Union> U) \<le> gcard U \<otimes> \<kappa>
[PROOF STEP]
have "\<dots>  \<approx> elts (gcard U \<otimes> \<kappa>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. U \<times> elts \<kappa> \<approx> elts (gcard U \<otimes> \<kappa>)
[PROOF STEP]
using U elts_cmult eqpoll_sym eqpoll_trans times_eqpoll_cong
[PROOF STATE]
proof (prove)
using this:
elts (gcard U) \<approx> U
elts (?\<kappa>' \<otimes> ?\<kappa>) \<approx> elts ?\<kappa>' \<times> elts ?\<kappa>
?A \<approx> ?B \<Longrightarrow> ?B \<approx> ?A
\<lbrakk>?A \<approx> ?B; ?B \<approx> ?C\<rbrakk> \<Longrightarrow> ?A \<approx> ?C
\<lbrakk>?A \<approx> ?C; ?B \<approx> ?D\<rbrakk> \<Longrightarrow> ?A \<times> ?B \<approx> ?C \<times> ?D

goal (1 subgoal):
 1. U \<times> elts \<kappa> \<approx> elts (gcard U \<otimes> \<kappa>)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
U \<times> elts \<kappa> \<approx> elts (gcard U \<otimes> \<kappa>)

goal (1 subgoal):
 1. gcard (\<Union> U) \<le> gcard U \<otimes> \<kappa>
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
\<Union> U \<lesssim> elts (gcard U \<otimes> \<kappa>)
[PROOF STEP]
have " (\<Union>U) \<lesssim> elts (gcard U \<otimes> \<kappa>)"
[PROOF STATE]
proof (prove)
using this:
\<Union> U \<lesssim> elts (gcard U \<otimes> \<kappa>)

goal (1 subgoal):
 1. \<Union> U \<lesssim> elts (gcard U \<otimes> \<kappa>)
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
\<Union> U \<lesssim> elts (gcard U \<otimes> \<kappa>)

goal (1 subgoal):
 1. gcard (\<Union> U) \<le> gcard U \<otimes> \<kappa>
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<Union> U \<lesssim> elts (gcard U \<otimes> \<kappa>)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<Union> U \<lesssim> elts (gcard U \<otimes> \<kappa>)

goal (1 subgoal):
 1. gcard (\<Union> U) \<le> gcard U \<otimes> \<kappa>
[PROOF STEP]
by (metis cardinal_idem cmult_def gcard_eq_vcard lepoll_imp_gcard_le small_elts)
[PROOF STATE]
proof (state)
this:
gcard (\<Union> U) \<le> gcard U \<otimes> \<kappa>

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma division_ofI:
  assumes "finite s"
    and "\<And>K. K \<in> s \<Longrightarrow> K \<subseteq> i"
    and "\<And>K. K \<in> s \<Longrightarrow> K \<noteq> {}"
    and "\<And>K. K \<in> s \<Longrightarrow> \<exists>a b. K = cbox a b"
    and "\<And>K1 K2. K1 \<in> s \<Longrightarrow> K2 \<in> s \<Longrightarrow> K1 \<noteq> K2 \<Longrightarrow> interior K1 \<inter> interior K2 = {}"
    and "\<Union>s = i"
  shows "s division_of i"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. s division_of i
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
finite s
?K \<in> s \<Longrightarrow> ?K \<subseteq> i
?K \<in> s \<Longrightarrow> ?K \<noteq> {}
?K \<in> s \<Longrightarrow> \<exists>a b. ?K = cbox a b
\<lbrakk>?K1.0 \<in> s; ?K2.0 \<in> s; ?K1.0 \<noteq> ?K2.0\<rbrakk> \<Longrightarrow> interior ?K1.0 \<inter> interior ?K2.0 = {}
\<Union> s = i

goal (1 subgoal):
 1. s division_of i
[PROOF STEP]
unfolding division_of_def
[PROOF STATE]
proof (prove)
using this:
finite s
?K \<in> s \<Longrightarrow> ?K \<subseteq> i
?K \<in> s \<Longrightarrow> ?K \<noteq> {}
?K \<in> s \<Longrightarrow> \<exists>a b. ?K = cbox a b
\<lbrakk>?K1.0 \<in> s; ?K2.0 \<in> s; ?K1.0 \<noteq> ?K2.0\<rbrakk> \<Longrightarrow> interior ?K1.0 \<inter> interior ?K2.0 = {}
\<Union> s = i

goal (1 subgoal):
 1. finite s \<and> (\<forall>K\<in>s. K \<subseteq> i \<and> K \<noteq> {} \<and> (\<exists>a b. K = cbox a b)) \<and> (\<forall>K1\<in>s. \<forall>K2\<in>s. K1 \<noteq> K2 \<longrightarrow> interior K1 \<inter> interior K2 = {}) \<and> \<Union> s = i
[PROOF STEP]
by auto


[STATEMENT]
lemma norm_cblinfun_eqI:
  assumes "n \<le> norm (cblinfun_apply f x) / norm x"
  assumes "\<And>x. norm (cblinfun_apply f x) \<le> n * norm x"
  assumes "0 \<le> n"
  shows "norm f = n"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. norm f = n
[PROOF STEP]
by (auto simp: norm_cblinfun_def
      intro!: antisym onorm_bound assms order_trans[OF _ le_onorm] bounded_clinear.bounded_linear
      bounded_linear_intros)


[STATEMENT]
lemma upset_setp_downset_setp_dual: "downclosed_set \<circ> (`) \<partial> = upclosed_set"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. downclosed_set \<circ> (`) \<partial> = upclosed_set
[PROOF STEP]
by (metis comp_id downset_setp_upset_setp_dual image_dual o_assoc)


[STATEMENT]
lemma INF_prod_alt_def: \<^marker>\<open>contributor \<open>Alessandro Coglio\<close>\<close>
  "Inf (f ` A) = (Inf ((fst \<circ> f) ` A), Inf ((snd \<circ> f) ` A))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Inf (f ` A) = (Inf ((fst \<circ> f) ` A), Inf ((snd \<circ> f) ` A))
[PROOF STEP]
by (simp add: Inf_prod_def image_image)


[STATEMENT]
lemma Osum_Well_order:
assumes FLD: "Field r Int Field r' = {}" and
        WELL: "Well_order r" and WELL': "Well_order r'"
shows "Well_order (r Osum r')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Well_order (r \<union>o r')
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. Well_order (r \<union>o r')
[PROOF STEP]
have "Total r \<and> Total r'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Total r \<and> Total r'
[PROOF STEP]
using WELL WELL'
[PROOF STATE]
proof (prove)
using this:
Well_order r
Well_order r'

goal (1 subgoal):
 1. Total r \<and> Total r'
[PROOF STEP]
by (auto simp add: order_on_defs)
[PROOF STATE]
proof (state)
this:
Total r \<and> Total r'

goal (1 subgoal):
 1. Well_order (r \<union>o r')
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
Total r \<and> Total r'

goal (1 subgoal):
 1. Well_order (r \<union>o r')
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
Total r \<and> Total r'
Field r \<inter> Field r' = {}
Well_order r
Well_order r'

goal (1 subgoal):
 1. Well_order (r \<union>o r')
[PROOF STEP]
unfolding well_order_on_def
[PROOF STATE]
proof (prove)
using this:
Total r \<and> Total r'
Field r \<inter> Field r' = {}
Linear_order r \<and> wf (r - Id)
Linear_order r' \<and> wf (r' - Id)

goal (1 subgoal):
 1. Linear_order (r \<union>o r') \<and> wf ((r \<union>o r') - Id)
[PROOF STEP]
using Osum_Linear_order Osum_wf_Id
[PROOF STATE]
proof (prove)
using this:
Total r \<and> Total r'
Field r \<inter> Field r' = {}
Linear_order r \<and> wf (r - Id)
Linear_order r' \<and> wf (r' - Id)
\<lbrakk>Field ?r \<inter> Field ?r' = {}; Linear_order ?r; Linear_order ?r'\<rbrakk> \<Longrightarrow> Linear_order (?r \<union>o ?r')
\<lbrakk>Total ?r; Total ?r'; Field ?r \<inter> Field ?r' = {}; wf (?r - Id); wf (?r' - Id)\<rbrakk> \<Longrightarrow> wf ((?r \<union>o ?r') - Id)

goal (1 subgoal):
 1. Linear_order (r \<union>o r') \<and> wf ((r \<union>o r') - Id)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
Well_order (r \<union>o r')

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma sum_path_weights_take_le[simp, intro]: "sum_path_weights (take i xs) \<le> sum_path_weights xs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. sum_weights (map (\<lambda>(s, l, t). l) (take i xs)) \<le> sum_weights (map (\<lambda>(s, l, t). l) xs)
[PROOF STEP]
by (auto intro!: subseq_sum_path_weights_le)


[STATEMENT]
lemma borel_measurable_lebesgue_preimage_borel:
  fixes f :: "'a::euclidean_space \<Rightarrow> 'b::euclidean_space"
  shows "f \<in> borel_measurable lebesgue \<longleftrightarrow>
         (\<forall>T. T \<in> sets borel \<longrightarrow> {x. f x \<in> T} \<in> sets lebesgue)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (f \<in> borel_measurable lebesgue) = (\<forall>T. T \<in> sets borel \<longrightarrow> {x. f x \<in> T} \<in> sets lebesgue)
[PROOF STEP]
apply (intro iffI allI impI lebesgue_measurable_vimage_borel)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>T. \<lbrakk>f \<in> borel_measurable lebesgue; T \<in> sets borel\<rbrakk> \<Longrightarrow> f \<in> borel_measurable lebesgue
 2. \<And>T. \<lbrakk>f \<in> borel_measurable lebesgue; T \<in> sets borel\<rbrakk> \<Longrightarrow> T \<in> sets borel
 3. \<forall>T. T \<in> sets borel \<longrightarrow> {x. f x \<in> T} \<in> sets lebesgue \<Longrightarrow> f \<in> borel_measurable lebesgue
[PROOF STEP]
apply (auto simp: in_borel_measurable_borel vimage_def)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma union_code [code]: "mset xs + mset ys = mset (xs @ ys)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mset xs + mset ys = mset (xs @ ys)
[PROOF STEP]
by simp