[STATEMENT]
lemma set_bset_to_set_bset: "|A| <o natLeq +c |UNIV :: 'k set| \<Longrightarrow>
  set_bset (the_inv set_bset A :: 'a set['k]) = A"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. |A| <o natLeq +c |UNIV| \<Longrightarrow> set_bset (the_inv set_bset A) = A
[PROOF STEP]
apply (rule f_the_inv_into_f[unfolded inj_on_def])
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. |A| <o natLeq +c |UNIV| \<Longrightarrow> \<forall>x\<in>UNIV. \<forall>y\<in>UNIV. set_bset x = set_bset y \<longrightarrow> x = y
 2. |A| <o natLeq +c |UNIV| \<Longrightarrow> A \<in> range set_bset
[PROOF STEP]
apply (simp add: set_bset_inject range_eqI Abs_bset_inverse[symmetric])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. |A| <o natLeq +c |UNIV| \<Longrightarrow> A \<in> range set_bset
[PROOF STEP]
apply (rule range_eqI Abs_bset_inverse[symmetric] CollectI)+
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. |A| <o natLeq +c |UNIV| \<Longrightarrow> |A| <o natLeq +c |UNIV|
[PROOF STEP]
.


[STATEMENT]
theorem HFail_HInv4c:
  "\<lbrakk> HFail s s' p; HInv4c s q\<rbrakk> \<Longrightarrow> HInv4c s' q"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>HFail s s' p; HInv4c s q\<rbrakk> \<Longrightarrow> HInv4c s' q
[PROOF STEP]
by(blast dest: HFail_HInv4c_p HFail_HInv4c_q)


[STATEMENT]
lemma map_ds_prop:
  fixes f :: "'a::complete_lattice \<Rightarrow> 'b::complete_lattice"
  shows "map_ds f \<circ> ds = ds \<circ> f"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. map_ds f \<circ> ds = ds \<circ> f
[PROOF STEP]
unfolding map_ds_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ds \<circ> f \<circ> SSup \<circ> ds = ds \<circ> f
[PROOF STEP]
by (simp add: SSup_ds_inv comp_assoc)


[STATEMENT]
lemma sum_leaves: "\<lbrakk> inorder t = [i..j];  i \<le> j+1 \<rbrakk> \<Longrightarrow>
  (\<Sum>x\<in>leaves i t. (f(fst x) :: nat)) = sum f {i..j+1}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>inorder t = [i..j]; i \<le> j + 1\<rbrakk> \<Longrightarrow> (\<Sum>x\<in>leaves i t. f (fst x)) = sum f {i..j + 1}
[PROOF STEP]
proof(induction t arbitrary: i j)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>i j. \<lbrakk>inorder \<langle>\<rangle> = [i..j]; i \<le> j + 1\<rbrakk> \<Longrightarrow> (\<Sum>x\<in>leaves i \<langle>\<rangle>. f (fst x)) = sum f {i..j + 1}
 2. \<And>t1 x2 t2 i j. \<lbrakk>\<And>i j. \<lbrakk>inorder t1 = [i..j]; i \<le> j + 1\<rbrakk> \<Longrightarrow> (\<Sum>x\<in>leaves i t1. f (fst x)) = sum f {i..j + 1}; \<And>i j. \<lbrakk>inorder t2 = [i..j]; i \<le> j + 1\<rbrakk> \<Longrightarrow> (\<Sum>x\<in>leaves i t2. f (fst x)) = sum f {i..j + 1}; inorder \<langle>t1, x2, t2\<rangle> = [i..j]; i \<le> j + 1\<rbrakk> \<Longrightarrow> (\<Sum>x\<in>leaves i \<langle>t1, x2, t2\<rangle>. f (fst x)) = sum f {i..j + 1}
[PROOF STEP]
case Leaf
[PROOF STATE]
proof (state)
this:
inorder \<langle>\<rangle> = [i..j]
i \<le> j + 1

goal (2 subgoals):
 1. \<And>i j. \<lbrakk>inorder \<langle>\<rangle> = [i..j]; i \<le> j + 1\<rbrakk> \<Longrightarrow> (\<Sum>x\<in>leaves i \<langle>\<rangle>. f (fst x)) = sum f {i..j + 1}
 2. \<And>t1 x2 t2 i j. \<lbrakk>\<And>i j. \<lbrakk>inorder t1 = [i..j]; i \<le> j + 1\<rbrakk> \<Longrightarrow> (\<Sum>x\<in>leaves i t1. f (fst x)) = sum f {i..j + 1}; \<And>i j. \<lbrakk>inorder t2 = [i..j]; i \<le> j + 1\<rbrakk> \<Longrightarrow> (\<Sum>x\<in>leaves i t2. f (fst x)) = sum f {i..j + 1}; inorder \<langle>t1, x2, t2\<rangle> = [i..j]; i \<le> j + 1\<rbrakk> \<Longrightarrow> (\<Sum>x\<in>leaves i \<langle>t1, x2, t2\<rangle>. f (fst x)) = sum f {i..j + 1}
[PROOF STEP]
hence "i = j+1"
[PROOF STATE]
proof (prove)
using this:
inorder \<langle>\<rangle> = [i..j]
i \<le> j + 1

goal (1 subgoal):
 1. i = j + 1
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
i = j + 1

goal (2 subgoals):
 1. \<And>i j. \<lbrakk>inorder \<langle>\<rangle> = [i..j]; i \<le> j + 1\<rbrakk> \<Longrightarrow> (\<Sum>x\<in>leaves i \<langle>\<rangle>. f (fst x)) = sum f {i..j + 1}
 2. \<And>t1 x2 t2 i j. \<lbrakk>\<And>i j. \<lbrakk>inorder t1 = [i..j]; i \<le> j + 1\<rbrakk> \<Longrightarrow> (\<Sum>x\<in>leaves i t1. f (fst x)) = sum f {i..j + 1}; \<And>i j. \<lbrakk>inorder t2 = [i..j]; i \<le> j + 1\<rbrakk> \<Longrightarrow> (\<Sum>x\<in>leaves i t2. f (fst x)) = sum f {i..j + 1}; inorder \<langle>t1, x2, t2\<rangle> = [i..j]; i \<le> j + 1\<rbrakk> \<Longrightarrow> (\<Sum>x\<in>leaves i \<langle>t1, x2, t2\<rangle>. f (fst x)) = sum f {i..j + 1}
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
i = j + 1

goal (1 subgoal):
 1. (\<Sum>x\<in>leaves i \<langle>\<rangle>. f (fst x)) = sum f {i..j + 1}
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
(\<Sum>x\<in>leaves i \<langle>\<rangle>. f (fst x)) = sum f {i..j + 1}

goal (1 subgoal):
 1. \<And>t1 x2 t2 i j. \<lbrakk>\<And>i j. \<lbrakk>inorder t1 = [i..j]; i \<le> j + 1\<rbrakk> \<Longrightarrow> (\<Sum>x\<in>leaves i t1. f (fst x)) = sum f {i..j + 1}; \<And>i j. \<lbrakk>inorder t2 = [i..j]; i \<le> j + 1\<rbrakk> \<Longrightarrow> (\<Sum>x\<in>leaves i t2. f (fst x)) = sum f {i..j + 1}; inorder \<langle>t1, x2, t2\<rangle> = [i..j]; i \<le> j + 1\<rbrakk> \<Longrightarrow> (\<Sum>x\<in>leaves i \<langle>t1, x2, t2\<rangle>. f (fst x)) = sum f {i..j + 1}
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>t1 x2 t2 i j. \<lbrakk>\<And>i j. \<lbrakk>inorder t1 = [i..j]; i \<le> j + 1\<rbrakk> \<Longrightarrow> (\<Sum>x\<in>leaves i t1. f (fst x)) = sum f {i..j + 1}; \<And>i j. \<lbrakk>inorder t2 = [i..j]; i \<le> j + 1\<rbrakk> \<Longrightarrow> (\<Sum>x\<in>leaves i t2. f (fst x)) = sum f {i..j + 1}; inorder \<langle>t1, x2, t2\<rangle> = [i..j]; i \<le> j + 1\<rbrakk> \<Longrightarrow> (\<Sum>x\<in>leaves i \<langle>t1, x2, t2\<rangle>. f (fst x)) = sum f {i..j + 1}
[PROOF STEP]
case (Node l k r)
[PROOF STATE]
proof (state)
this:
\<lbrakk>inorder l = [?i..?j]; ?i \<le> ?j + 1\<rbrakk> \<Longrightarrow> (\<Sum>x\<in>leaves ?i l. f (fst x)) = sum f {?i..?j + 1}
\<lbrakk>inorder r = [?i..?j]; ?i \<le> ?j + 1\<rbrakk> \<Longrightarrow> (\<Sum>x\<in>leaves ?i r. f (fst x)) = sum f {?i..?j + 1}
inorder \<langle>l, k, r\<rangle> = [i..j]
i \<le> j + 1

goal (1 subgoal):
 1. \<And>t1 x2 t2 i j. \<lbrakk>\<And>i j. \<lbrakk>inorder t1 = [i..j]; i \<le> j + 1\<rbrakk> \<Longrightarrow> (\<Sum>x\<in>leaves i t1. f (fst x)) = sum f {i..j + 1}; \<And>i j. \<lbrakk>inorder t2 = [i..j]; i \<le> j + 1\<rbrakk> \<Longrightarrow> (\<Sum>x\<in>leaves i t2. f (fst x)) = sum f {i..j + 1}; inorder \<langle>t1, x2, t2\<rangle> = [i..j]; i \<le> j + 1\<rbrakk> \<Longrightarrow> (\<Sum>x\<in>leaves i \<langle>t1, x2, t2\<rangle>. f (fst x)) = sum f {i..j + 1}
[PROOF STEP]
note inorder = inorder_upto_split[OF Node.prems(1)]
[PROOF STATE]
proof (state)
this:
inorder l = [i..k - 1]
inorder r = [k + 1..j]
i \<le> k
k \<le> j

goal (1 subgoal):
 1. \<And>t1 x2 t2 i j. \<lbrakk>\<And>i j. \<lbrakk>inorder t1 = [i..j]; i \<le> j + 1\<rbrakk> \<Longrightarrow> (\<Sum>x\<in>leaves i t1. f (fst x)) = sum f {i..j + 1}; \<And>i j. \<lbrakk>inorder t2 = [i..j]; i \<le> j + 1\<rbrakk> \<Longrightarrow> (\<Sum>x\<in>leaves i t2. f (fst x)) = sum f {i..j + 1}; inorder \<langle>t1, x2, t2\<rangle> = [i..j]; i \<le> j + 1\<rbrakk> \<Longrightarrow> (\<Sum>x\<in>leaves i \<langle>t1, x2, t2\<rangle>. f (fst x)) = sum f {i..j + 1}
[PROOF STEP]
let ?Ll = "leaves i l"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>t1 x2 t2 i j. \<lbrakk>\<And>i j. \<lbrakk>inorder t1 = [i..j]; i \<le> j + 1\<rbrakk> \<Longrightarrow> (\<Sum>x\<in>leaves i t1. f (fst x)) = sum f {i..j + 1}; \<And>i j. \<lbrakk>inorder t2 = [i..j]; i \<le> j + 1\<rbrakk> \<Longrightarrow> (\<Sum>x\<in>leaves i t2. f (fst x)) = sum f {i..j + 1}; inorder \<langle>t1, x2, t2\<rangle> = [i..j]; i \<le> j + 1\<rbrakk> \<Longrightarrow> (\<Sum>x\<in>leaves i \<langle>t1, x2, t2\<rangle>. f (fst x)) = sum f {i..j + 1}
[PROOF STEP]
let ?Lr = "leaves (k+1) r"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>t1 x2 t2 i j. \<lbrakk>\<And>i j. \<lbrakk>inorder t1 = [i..j]; i \<le> j + 1\<rbrakk> \<Longrightarrow> (\<Sum>x\<in>leaves i t1. f (fst x)) = sum f {i..j + 1}; \<And>i j. \<lbrakk>inorder t2 = [i..j]; i \<le> j + 1\<rbrakk> \<Longrightarrow> (\<Sum>x\<in>leaves i t2. f (fst x)) = sum f {i..j + 1}; inorder \<langle>t1, x2, t2\<rangle> = [i..j]; i \<le> j + 1\<rbrakk> \<Longrightarrow> (\<Sum>x\<in>leaves i \<langle>t1, x2, t2\<rangle>. f (fst x)) = sum f {i..j + 1}
[PROOF STEP]
let ?L = "?Ll \<union> ?Lr"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>t1 x2 t2 i j. \<lbrakk>\<And>i j. \<lbrakk>inorder t1 = [i..j]; i \<le> j + 1\<rbrakk> \<Longrightarrow> (\<Sum>x\<in>leaves i t1. f (fst x)) = sum f {i..j + 1}; \<And>i j. \<lbrakk>inorder t2 = [i..j]; i \<le> j + 1\<rbrakk> \<Longrightarrow> (\<Sum>x\<in>leaves i t2. f (fst x)) = sum f {i..j + 1}; inorder \<langle>t1, x2, t2\<rangle> = [i..j]; i \<le> j + 1\<rbrakk> \<Longrightarrow> (\<Sum>x\<in>leaves i \<langle>t1, x2, t2\<rangle>. f (fst x)) = sum f {i..j + 1}
[PROOF STEP]
have "fst ` ?Ll \<inter> fst ` ?Lr = {}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fst ` leaves i l \<inter> fst ` leaves (k + 1) r = {}
[PROOF STEP]
using inorder
[PROOF STATE]
proof (prove)
using this:
inorder l = [i..k - 1]
inorder r = [k + 1..j]
i \<le> k
k \<le> j

goal (1 subgoal):
 1. fst ` leaves i l \<inter> fst ` leaves (k + 1) r = {}
[PROOF STEP]
by(simp add: fst_leaves del: set_inorder add: set_inorder[symmetric])
[PROOF STATE]
proof (state)
this:
fst ` leaves i l \<inter> fst ` leaves (k + 1) r = {}

goal (1 subgoal):
 1. \<And>t1 x2 t2 i j. \<lbrakk>\<And>i j. \<lbrakk>inorder t1 = [i..j]; i \<le> j + 1\<rbrakk> \<Longrightarrow> (\<Sum>x\<in>leaves i t1. f (fst x)) = sum f {i..j + 1}; \<And>i j. \<lbrakk>inorder t2 = [i..j]; i \<le> j + 1\<rbrakk> \<Longrightarrow> (\<Sum>x\<in>leaves i t2. f (fst x)) = sum f {i..j + 1}; inorder \<langle>t1, x2, t2\<rangle> = [i..j]; i \<le> j + 1\<rbrakk> \<Longrightarrow> (\<Sum>x\<in>leaves i \<langle>t1, x2, t2\<rangle>. f (fst x)) = sum f {i..j + 1}
[PROOF STEP]
hence l0: "?Ll \<inter> ?Lr = {}"
[PROOF STATE]
proof (prove)
using this:
fst ` leaves i l \<inter> fst ` leaves (k + 1) r = {}

goal (1 subgoal):
 1. leaves i l \<inter> leaves (k + 1) r = {}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
leaves i l \<inter> leaves (k + 1) r = {}

goal (1 subgoal):
 1. \<And>t1 x2 t2 i j. \<lbrakk>\<And>i j. \<lbrakk>inorder t1 = [i..j]; i \<le> j + 1\<rbrakk> \<Longrightarrow> (\<Sum>x\<in>leaves i t1. f (fst x)) = sum f {i..j + 1}; \<And>i j. \<lbrakk>inorder t2 = [i..j]; i \<le> j + 1\<rbrakk> \<Longrightarrow> (\<Sum>x\<in>leaves i t2. f (fst x)) = sum f {i..j + 1}; inorder \<langle>t1, x2, t2\<rangle> = [i..j]; i \<le> j + 1\<rbrakk> \<Longrightarrow> (\<Sum>x\<in>leaves i \<langle>t1, x2, t2\<rangle>. f (fst x)) = sum f {i..j + 1}
[PROOF STEP]
have "{i..j+1} = {i..k} \<union> {k+1..j+1}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {i..j + 1} = {i..k} \<union> {k + 1..j + 1}
[PROOF STEP]
using inorder(3,4)
[PROOF STATE]
proof (prove)
using this:
i \<le> k
k \<le> j

goal (1 subgoal):
 1. {i..j + 1} = {i..k} \<union> {k + 1..j + 1}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
{i..j + 1} = {i..k} \<union> {k + 1..j + 1}

goal (1 subgoal):
 1. \<And>t1 x2 t2 i j. \<lbrakk>\<And>i j. \<lbrakk>inorder t1 = [i..j]; i \<le> j + 1\<rbrakk> \<Longrightarrow> (\<Sum>x\<in>leaves i t1. f (fst x)) = sum f {i..j + 1}; \<And>i j. \<lbrakk>inorder t2 = [i..j]; i \<le> j + 1\<rbrakk> \<Longrightarrow> (\<Sum>x\<in>leaves i t2. f (fst x)) = sum f {i..j + 1}; inorder \<langle>t1, x2, t2\<rangle> = [i..j]; i \<le> j + 1\<rbrakk> \<Longrightarrow> (\<Sum>x\<in>leaves i \<langle>t1, x2, t2\<rangle>. f (fst x)) = sum f {i..j + 1}
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
{i..j + 1} = {i..k} \<union> {k + 1..j + 1}

goal (1 subgoal):
 1. (\<Sum>x\<in>leaves i \<langle>l, k, r\<rangle>. f (fst x)) = sum f {i..j + 1}
[PROOF STEP]
using Node.IH(1)[OF inorder(1)] Node.IH(2)[OF inorder(2)] inorder(3,4) Node.prems(2)
[PROOF STATE]
proof (prove)
using this:
{i..j + 1} = {i..k} \<union> {k + 1..j + 1}
i \<le> k - 1 + 1 \<Longrightarrow> (\<Sum>x\<in>leaves i l. f (fst x)) = sum f {i..k - 1 + 1}
k + 1 \<le> j + 1 \<Longrightarrow> (\<Sum>x\<in>leaves (k + 1) r. f (fst x)) = sum f {k + 1..j + 1}
i \<le> k
k \<le> j
i \<le> j + 1

goal (1 subgoal):
 1. (\<Sum>x\<in>leaves i \<langle>l, k, r\<rangle>. f (fst x)) = sum f {i..j + 1}
[PROOF STEP]
by(simp add: sum_incr2 sum_Un_nat finite_leaves l0)
[PROOF STATE]
proof (state)
this:
(\<Sum>x\<in>leaves i \<langle>l, k, r\<rangle>. f (fst x)) = sum f {i..j + 1}

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma smult_minus_right [simp]: "smult a (- p) = - smult a p"
  for a :: "'a::comm_ring"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. smult a (- p) = - smult a p
[PROOF STEP]
by (rule poly_eqI) simp


[STATEMENT]
lemma eval_member:
  "member xq = eval (pred_of_seq xq)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. member xq = eval (pred_of_seq xq)
[PROOF STEP]
proof (induct xq)
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. member Empty = eval (pred_of_seq Empty)
 2. \<And>x1 x2. member (Insert x1 x2) = eval (pred_of_seq (Insert x1 x2))
 3. \<And>x1 xq. member xq = eval (pred_of_seq xq) \<Longrightarrow> member (Join x1 xq) = eval (pred_of_seq (Join x1 xq))
[PROOF STEP]
case Empty
[PROOF STATE]
proof (state)
this:

goal (3 subgoals):
 1. member Empty = eval (pred_of_seq Empty)
 2. \<And>x1 x2. member (Insert x1 x2) = eval (pred_of_seq (Insert x1 x2))
 3. \<And>x1 xq. member xq = eval (pred_of_seq xq) \<Longrightarrow> member (Join x1 xq) = eval (pred_of_seq (Join x1 xq))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. member Empty = eval (pred_of_seq Empty)
[PROOF STEP]
by (auto simp add: fun_eq_iff elim: botE)
[PROOF STATE]
proof (state)
this:
member Empty = eval (pred_of_seq Empty)

goal (2 subgoals):
 1. \<And>x1 x2. member (Insert x1 x2) = eval (pred_of_seq (Insert x1 x2))
 2. \<And>x1 xq. member xq = eval (pred_of_seq xq) \<Longrightarrow> member (Join x1 xq) = eval (pred_of_seq (Join x1 xq))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>x1 x2. member (Insert x1 x2) = eval (pred_of_seq (Insert x1 x2))
 2. \<And>x1 xq. member xq = eval (pred_of_seq xq) \<Longrightarrow> member (Join x1 xq) = eval (pred_of_seq (Join x1 xq))
[PROOF STEP]
case Insert
[PROOF STATE]
proof (state)
this:

goal (2 subgoals):
 1. \<And>x1 x2. member (Insert x1 x2) = eval (pred_of_seq (Insert x1 x2))
 2. \<And>x1 xq. member xq = eval (pred_of_seq xq) \<Longrightarrow> member (Join x1 xq) = eval (pred_of_seq (Join x1 xq))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. member (Insert x1_ x2_) = eval (pred_of_seq (Insert x1_ x2_))
[PROOF STEP]
by (auto simp add: fun_eq_iff elim: supE singleE intro: supI1 supI2 singleI)
[PROOF STATE]
proof (state)
this:
member (Insert x1_ x2_) = eval (pred_of_seq (Insert x1_ x2_))

goal (1 subgoal):
 1. \<And>x1 xq. member xq = eval (pred_of_seq xq) \<Longrightarrow> member (Join x1 xq) = eval (pred_of_seq (Join x1 xq))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x1 xq. member xq = eval (pred_of_seq xq) \<Longrightarrow> member (Join x1 xq) = eval (pred_of_seq (Join x1 xq))
[PROOF STEP]
case Join
[PROOF STATE]
proof (state)
this:
member xq_ = eval (pred_of_seq xq_)

goal (1 subgoal):
 1. \<And>x1 xq. member xq = eval (pred_of_seq xq) \<Longrightarrow> member (Join x1 xq) = eval (pred_of_seq (Join x1 xq))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
member xq_ = eval (pred_of_seq xq_)
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
member xq_ = eval (pred_of_seq xq_)

goal (1 subgoal):
 1. member (Join x1_ xq_) = eval (pred_of_seq (Join x1_ xq_))
[PROOF STEP]
by (auto simp add: fun_eq_iff elim: supE intro: supI1 supI2)
[PROOF STATE]
proof (state)
this:
member (Join x1_ xq_) = eval (pred_of_seq (Join x1_ xq_))

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma iIN_append_union: "
  [n\<dots>,d] \<union> [n + d\<dots>,d'] = [n\<dots>,d + d']"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. [n\<dots>,d] \<union> [n + d\<dots>,d'] = [n\<dots>,d + d']
[PROOF STEP]
by (simp add: iIN_union)


[STATEMENT]
lemma nrows_Diagonal_to_Smith_row_i[simp]: "nrows (Diagonal_to_Smith_row_i A i bezout) = nrows A"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. nrows (Diagonal_to_Smith_row_i A i bezout) = nrows A
[PROOF STEP]
unfolding Diagonal_to_Smith_row_i_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. nrows (diagonal_to_Smith_i [i + 1..<min (nrows A) (ncols A)] A i bezout) = nrows A
[PROOF STEP]
by auto


[STATEMENT]
lemma incseq_rat_le_real:
      "\<lbrakk> incseq s;  (\<lambda>n. of_rat (s n)) \<longlonglongrightarrow> x \<rbrakk> \<Longrightarrow> of_rat (s n) \<le> (x::real)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>incseq s; (\<lambda>n. real_of_rat (s n)) \<longlonglongrightarrow> x\<rbrakk> \<Longrightarrow> real_of_rat (s n) \<le> x
[PROOF STEP]
by (auto intro: incseq_le incseq_of_rat)


[STATEMENT]
lemma (in term_powerprod) monomial_1_in_pmdlI:
  assumes "(f::_ \<Rightarrow>\<^sub>0 'b::field) \<in> pmdl F" and "keys f = {t}"
  shows "monomial 1 t \<in> pmdl F"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. monomial (1::'b) t \<in> pmdl F
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. monomial (1::'b) t \<in> pmdl F
[PROOF STEP]
define c where "c \<equiv> lookup f t"
[PROOF STATE]
proof (state)
this:
c \<equiv> lookup f t

goal (1 subgoal):
 1. monomial (1::'b) t \<in> pmdl F
[PROOF STEP]
from assms(2)
[PROOF STATE]
proof (chain)
picking this:
keys f = {t}
[PROOF STEP]
have f_eq: "f = monomial c t"
[PROOF STATE]
proof (prove)
using this:
keys f = {t}

goal (1 subgoal):
 1. f = monomial c t
[PROOF STEP]
unfolding c_def
[PROOF STATE]
proof (prove)
using this:
keys f = {t}

goal (1 subgoal):
 1. f = monomial (lookup f t) t
[PROOF STEP]
by (metis (mono_tags, lifting) Diff_insert_absorb cancel_comm_monoid_add_class.add_cancel_right_right
        plus_except insert_absorb insert_not_empty keys_eq_empty keys_except)
[PROOF STATE]
proof (state)
this:
f = monomial c t

goal (1 subgoal):
 1. monomial (1::'b) t \<in> pmdl F
[PROOF STEP]
from assms(2)
[PROOF STATE]
proof (chain)
picking this:
keys f = {t}
[PROOF STEP]
have "c \<noteq> 0"
[PROOF STATE]
proof (prove)
using this:
keys f = {t}

goal (1 subgoal):
 1. c \<noteq> (0::'b)
[PROOF STEP]
unfolding c_def
[PROOF STATE]
proof (prove)
using this:
keys f = {t}

goal (1 subgoal):
 1. lookup f t \<noteq> (0::'b)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
c \<noteq> (0::'b)

goal (1 subgoal):
 1. monomial (1::'b) t \<in> pmdl F
[PROOF STEP]
hence "monomial 1 t = monom_mult (1 / c) 0 f"
[PROOF STATE]
proof (prove)
using this:
c \<noteq> (0::'b)

goal (1 subgoal):
 1. monomial (1::'b) t = monom_mult ((1::'b) / c) (0::'a) f
[PROOF STEP]
by (simp add: f_eq monom_mult_monomial term_simps)
[PROOF STATE]
proof (state)
this:
monomial (1::'b) t = monom_mult ((1::'b) / c) (0::'a) f

goal (1 subgoal):
 1. monomial (1::'b) t \<in> pmdl F
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
monomial (1::'b) t = monom_mult ((1::'b) / c) (0::'a) f

goal (1 subgoal):
 1. monomial (1::'b) t \<in> pmdl F
[PROOF STEP]
from assms(1)
[PROOF STATE]
proof (chain)
picking this:
f \<in> pmdl F
[PROOF STEP]
have "... \<in> pmdl F"
[PROOF STATE]
proof (prove)
using this:
f \<in> pmdl F

goal (1 subgoal):
 1. monom_mult ((1::'b) / c) (0::'a) f \<in> pmdl F
[PROOF STEP]
by (rule pmdl_closed_monom_mult)
[PROOF STATE]
proof (state)
this:
monom_mult ((1::'b) / c) (0::'a) f \<in> pmdl F

goal (1 subgoal):
 1. monomial (1::'b) t \<in> pmdl F
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
monomial (1::'b) t \<in> pmdl F
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
monomial (1::'b) t \<in> pmdl F

goal (1 subgoal):
 1. monomial (1::'b) t \<in> pmdl F
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
monomial (1::'b) t \<in> pmdl F

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma canon_ang_sum:
  shows "\<downharpoonright>\<alpha> + \<beta>\<downharpoonleft> = \<downharpoonright>\<downharpoonright>\<alpha>\<downharpoonleft> + \<downharpoonright>\<beta>\<downharpoonleft>\<downharpoonleft>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<downharpoonright>\<alpha> + \<beta>\<downharpoonleft> = \<downharpoonright>\<downharpoonright>\<alpha>\<downharpoonleft> + \<downharpoonright>\<beta>\<downharpoonleft>\<downharpoonleft>
[PROOF STEP]
proof (rule canon_ang_eq)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<exists>x. \<alpha> + \<beta> - (\<downharpoonright>\<alpha>\<downharpoonleft> + \<downharpoonright>\<beta>\<downharpoonleft>) = 2 * real_of_int x * pi
[PROOF STEP]
show "\<exists>x::int. \<alpha> + \<beta> - (\<downharpoonright>\<alpha>\<downharpoonleft> + \<downharpoonright>\<beta>\<downharpoonleft>) = 2 * x * pi"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>x. \<alpha> + \<beta> - (\<downharpoonright>\<alpha>\<downharpoonleft> + \<downharpoonright>\<beta>\<downharpoonleft>) = 2 * real_of_int x * pi
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<exists>x. \<alpha> + \<beta> - (\<downharpoonright>\<alpha>\<downharpoonleft> + \<downharpoonright>\<beta>\<downharpoonleft>) = 2 * real_of_int x * pi
[PROOF STEP]
obtain k1::int where "\<alpha> - \<downharpoonright>\<alpha>\<downharpoonleft> = 2*k1*pi"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>k1. \<alpha> - \<downharpoonright>\<alpha>\<downharpoonleft> = real_of_int (2 * k1) * pi \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using canon_ang(3)
[PROOF STATE]
proof (prove)
using this:
\<exists>x. ?\<alpha> - \<downharpoonright>?\<alpha>\<downharpoonleft> = 2 * real_of_int x * pi

goal (1 subgoal):
 1. (\<And>k1. \<alpha> - \<downharpoonright>\<alpha>\<downharpoonleft> = real_of_int (2 * k1) * pi \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<alpha> - \<downharpoonright>\<alpha>\<downharpoonleft> = real_of_int (2 * k1) * pi

goal (1 subgoal):
 1. \<exists>x. \<alpha> + \<beta> - (\<downharpoonright>\<alpha>\<downharpoonleft> + \<downharpoonright>\<beta>\<downharpoonleft>) = 2 * real_of_int x * pi
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<alpha> - \<downharpoonright>\<alpha>\<downharpoonleft> = real_of_int (2 * k1) * pi

goal (1 subgoal):
 1. \<exists>x. \<alpha> + \<beta> - (\<downharpoonright>\<alpha>\<downharpoonleft> + \<downharpoonright>\<beta>\<downharpoonleft>) = 2 * real_of_int x * pi
[PROOF STEP]
obtain k2::int where "\<beta> - \<downharpoonright>\<beta>\<downharpoonleft> = 2*k2*pi"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>k2. \<beta> - \<downharpoonright>\<beta>\<downharpoonleft> = real_of_int (2 * k2) * pi \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using canon_ang(3)
[PROOF STATE]
proof (prove)
using this:
\<exists>x. ?\<alpha> - \<downharpoonright>?\<alpha>\<downharpoonleft> = 2 * real_of_int x * pi

goal (1 subgoal):
 1. (\<And>k2. \<beta> - \<downharpoonright>\<beta>\<downharpoonleft> = real_of_int (2 * k2) * pi \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<beta> - \<downharpoonright>\<beta>\<downharpoonleft> = real_of_int (2 * k2) * pi

goal (1 subgoal):
 1. \<exists>x. \<alpha> + \<beta> - (\<downharpoonright>\<alpha>\<downharpoonleft> + \<downharpoonright>\<beta>\<downharpoonleft>) = 2 * real_of_int x * pi
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<alpha> - \<downharpoonright>\<alpha>\<downharpoonleft> = real_of_int (2 * k1) * pi
\<beta> - \<downharpoonright>\<beta>\<downharpoonleft> = real_of_int (2 * k2) * pi
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<alpha> - \<downharpoonright>\<alpha>\<downharpoonleft> = real_of_int (2 * k1) * pi
\<beta> - \<downharpoonright>\<beta>\<downharpoonleft> = real_of_int (2 * k2) * pi

goal (1 subgoal):
 1. \<exists>x. \<alpha> + \<beta> - (\<downharpoonright>\<alpha>\<downharpoonleft> + \<downharpoonright>\<beta>\<downharpoonleft>) = 2 * real_of_int x * pi
[PROOF STEP]
by (rule_tac x="k1 + k2" in exI) (auto simp add: field_simps)
[PROOF STATE]
proof (state)
this:
\<exists>x. \<alpha> + \<beta> - (\<downharpoonright>\<alpha>\<downharpoonleft> + \<downharpoonright>\<beta>\<downharpoonleft>) = 2 * real_of_int x * pi

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<exists>x. \<alpha> + \<beta> - (\<downharpoonright>\<alpha>\<downharpoonleft> + \<downharpoonright>\<beta>\<downharpoonleft>) = 2 * real_of_int x * pi

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma Utrans_P_is_tensor_P1:
  "Utrans_P vars1 A = Utrans (tensor_P A (1\<^sub>m K))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Utrans_P vars1 A = Utrans (tensor_P A (1\<^sub>m K))
[PROOF STEP]
unfolding Utrans_P_def ps2_P.ptensor_mat_def partial_state.mat_extension_def
    partial_state.d2_def partial_state.dims2_def ps2_P.nths_vars2'[simplified ps2_P_dims0 ps2_P_vars1']
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Utrans (tensor_mat dims vars1 A (1\<^sub>m (prod_list ps2_P.dims2))) = Utrans (ps_P.tensor_mat A (1\<^sub>m K))
[PROOF STEP]
using ps2_P_d2
[PROOF STATE]
proof (prove)
using this:
ps2_P.d2 = K

goal (1 subgoal):
 1. Utrans (tensor_mat dims vars1 A (1\<^sub>m (prod_list ps2_P.dims2))) = Utrans (ps_P.tensor_mat A (1\<^sub>m K))
[PROOF STEP]
unfolding ps2_P.d2_def
[PROOF STATE]
proof (prove)
using this:
prod_list ps2_P.dims2 = K

goal (1 subgoal):
 1. Utrans (tensor_mat dims vars1 A (1\<^sub>m (prod_list ps2_P.dims2))) = Utrans (ps_P.tensor_mat A (1\<^sub>m K))
[PROOF STEP]
using ps2_P_dims0 ps2_P_vars1'
[PROOF STATE]
proof (prove)
using this:
prod_list ps2_P.dims2 = K
ps2_P.dims0 = dims
ps2_P.vars1' = vars1

goal (1 subgoal):
 1. Utrans (tensor_mat dims vars1 A (1\<^sub>m (prod_list ps2_P.dims2))) = Utrans (ps_P.tensor_mat A (1\<^sub>m K))
[PROOF STEP]
by auto


[STATEMENT]
lemma connected_iff_reachable:
  "connected G \<longleftrightarrow> ((\<forall>x\<in>verts G. \<forall>y\<in>verts G. x \<rightarrow>\<^sup>* y) \<and> verts G \<noteq> {})"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Digraph_Component.connected G = ((\<forall>x\<in>verts G. \<forall>y\<in>verts G. x \<rightarrow>\<^sup>* y) \<and> verts G \<noteq> {})
[PROOF STEP]
using symmetric_connected_imp_strongly_connected strongly_connected_def verts_reachable_connected
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>symmetric G; Digraph_Component.connected G\<rbrakk> \<Longrightarrow> strongly_connected G
strongly_connected ?G \<equiv> verts ?G \<noteq> {} \<and> (\<forall>u\<in>verts ?G. \<forall>v\<in>verts ?G. u \<rightarrow>\<^sup>*\<^bsub>?G\<^esub> v)
\<lbrakk>verts G \<noteq> {}; \<forall>x\<in>verts G. \<forall>y\<in>verts G. x \<rightarrow>\<^sup>* y\<rbrakk> \<Longrightarrow> Digraph_Component.connected G

goal (1 subgoal):
 1. Digraph_Component.connected G = ((\<forall>x\<in>verts G. \<forall>y\<in>verts G. x \<rightarrow>\<^sup>* y) \<and> verts G \<noteq> {})
[PROOF STEP]
by(blast)


[STATEMENT]
lemma ipoly_complex_interval_tendsto:
  assumes "C \<longlonglongrightarrow>\<^sub>c c"
  shows "(\<lambda>i. ipoly_complex_interval p (C i)) \<longlonglongrightarrow>\<^sub>c ipoly p c"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lambda>i. ipoly_complex_interval p (C i)) \<longlonglongrightarrow>\<^sub>c ipoly p c
[PROOF STEP]
proof(induct p)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. (\<lambda>i. ipoly_complex_interval 0 (C i)) \<longlonglongrightarrow>\<^sub>c ipoly 0 c
 2. \<And>a p. \<lbrakk>a \<noteq> 0 \<or> p \<noteq> 0; (\<lambda>i. ipoly_complex_interval p (C i)) \<longlonglongrightarrow>\<^sub>c ipoly p c\<rbrakk> \<Longrightarrow> (\<lambda>i. ipoly_complex_interval (pCons a p) (C i)) \<longlonglongrightarrow>\<^sub>c ipoly (pCons a p) c
[PROOF STEP]
case 0
[PROOF STATE]
proof (state)
this:

goal (2 subgoals):
 1. (\<lambda>i. ipoly_complex_interval 0 (C i)) \<longlonglongrightarrow>\<^sub>c ipoly 0 c
 2. \<And>a p. \<lbrakk>a \<noteq> 0 \<or> p \<noteq> 0; (\<lambda>i. ipoly_complex_interval p (C i)) \<longlonglongrightarrow>\<^sub>c ipoly p c\<rbrakk> \<Longrightarrow> (\<lambda>i. ipoly_complex_interval (pCons a p) (C i)) \<longlonglongrightarrow>\<^sub>c ipoly (pCons a p) c
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lambda>i. ipoly_complex_interval 0 (C i)) \<longlonglongrightarrow>\<^sub>c ipoly 0 c
[PROOF STEP]
by (auto simp: o_def zero_complex_interval_def zero_interval_def complex_interval_tendsto_def)
[PROOF STATE]
proof (state)
this:
(\<lambda>i. ipoly_complex_interval 0 (C i)) \<longlonglongrightarrow>\<^sub>c ipoly 0 c

goal (1 subgoal):
 1. \<And>a p. \<lbrakk>a \<noteq> 0 \<or> p \<noteq> 0; (\<lambda>i. ipoly_complex_interval p (C i)) \<longlonglongrightarrow>\<^sub>c ipoly p c\<rbrakk> \<Longrightarrow> (\<lambda>i. ipoly_complex_interval (pCons a p) (C i)) \<longlonglongrightarrow>\<^sub>c ipoly (pCons a p) c
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a p. \<lbrakk>a \<noteq> 0 \<or> p \<noteq> 0; (\<lambda>i. ipoly_complex_interval p (C i)) \<longlonglongrightarrow>\<^sub>c ipoly p c\<rbrakk> \<Longrightarrow> (\<lambda>i. ipoly_complex_interval (pCons a p) (C i)) \<longlonglongrightarrow>\<^sub>c ipoly (pCons a p) c
[PROOF STEP]
case (pCons a p)
[PROOF STATE]
proof (state)
this:
a \<noteq> 0 \<or> p \<noteq> 0
(\<lambda>i. ipoly_complex_interval p (C i)) \<longlonglongrightarrow>\<^sub>c ipoly p c

goal (1 subgoal):
 1. \<And>a p. \<lbrakk>a \<noteq> 0 \<or> p \<noteq> 0; (\<lambda>i. ipoly_complex_interval p (C i)) \<longlonglongrightarrow>\<^sub>c ipoly p c\<rbrakk> \<Longrightarrow> (\<lambda>i. ipoly_complex_interval (pCons a p) (C i)) \<longlonglongrightarrow>\<^sub>c ipoly (pCons a p) c
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lambda>i. ipoly_complex_interval (pCons a p) (C i)) \<longlonglongrightarrow>\<^sub>c ipoly (pCons a p) c
[PROOF STEP]
apply (unfold ipoly_complex_interval_pCons of_int_hom.map_poly_pCons_hom poly_pCons)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lambda>i. of_int_complex_interval a + C i * ipoly_complex_interval p (C i)) \<longlonglongrightarrow>\<^sub>c of_int a + c * ipoly p c
[PROOF STEP]
apply (intro plus_complex_interval_tendsto times_complex_interval_tendsto assms pCons of_int_complex_interval_tendsto)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
(\<lambda>i. ipoly_complex_interval (pCons a p) (C i)) \<longlonglongrightarrow>\<^sub>c ipoly (pCons a p) c

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma holomorphic_on_compose:
  "f holomorphic_on s \<Longrightarrow> g holomorphic_on (f ` s) \<Longrightarrow> (g o f) holomorphic_on s"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>f holomorphic_on s; g holomorphic_on f ` s\<rbrakk> \<Longrightarrow> g \<circ> f holomorphic_on s
[PROOF STEP]
using field_differentiable_compose_within[of f _ s g]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>f field_differentiable at ?a within s; g field_differentiable at (f ?a) within f ` s\<rbrakk> \<Longrightarrow> g \<circ> f field_differentiable at ?a within s

goal (1 subgoal):
 1. \<lbrakk>f holomorphic_on s; g holomorphic_on f ` s\<rbrakk> \<Longrightarrow> g \<circ> f holomorphic_on s
[PROOF STEP]
by (auto simp: holomorphic_on_def)


[STATEMENT]
lemma positively_invariant_left_inter:
  assumes "positively_invariant C"
  assumes "\<forall>x \<in> C \<inter> D. trapped_forward x D"
  shows "positively_invariant (C \<inter> D)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. positively_invariant (C \<inter> D)
[PROOF STEP]
using assms positively_invariant_def trapped_forward_def
[PROOF STATE]
proof (prove)
using this:
positively_invariant C
\<forall>x\<in>C \<inter> D. trapped_forward x D
positively_invariant ?M = (\<forall>x\<in>?M. trapped_forward x ?M)
trapped_forward ?x ?K = (flow0 ?x ` (existence_ivl0 ?x \<inter> {0..}) \<subseteq> ?K)

goal (1 subgoal):
 1. positively_invariant (C \<inter> D)
[PROOF STEP]
by auto


[STATEMENT]
lemma nxt_wait_least:
assumes ev: "ev \<phi> xs" and nxt: "(nxt ^^ n) \<phi> xs"  shows "wait \<phi> xs \<le> n"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. wait \<phi> xs \<le> n
[PROOF STEP]
unfolding wait_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (LEAST n. (nxt ^^ n) \<phi> xs) \<le> n
[PROOF STEP]
using ev_ex_nxt[OF ev]
[PROOF STATE]
proof (prove)
using this:
\<exists>n. (nxt ^^ n) \<phi> xs

goal (1 subgoal):
 1. (LEAST n. (nxt ^^ n) \<phi> xs) \<le> n
[PROOF STEP]
by (metis Least_le nxt)


[STATEMENT]
lemma LL_UR_pos:
  "0 < snd (mediant m) \<Longrightarrow> 0 < snd (mediant (m \<otimes> LL))"
  "0 < snd (mediant m) \<Longrightarrow> 0 < snd (mediant (m \<otimes> UR))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (0 < snd (mediant m) \<Longrightarrow> 0 < snd (mediant (m \<otimes> LL))) &&& (0 < snd (mediant m) \<Longrightarrow> 0 < snd (mediant (m \<otimes> UR)))
[PROOF STEP]
by (cases m) (simp_all add: LL_def UR_def times_matrix_def split_def field_simps mediant_def)


[STATEMENT]
lemma perm_contr: assumes perm: "! xs ys. mset xs = mset ys --> (P xs = P ys)"
  and contr': "! x xs. P(x#x#xs) = P (x#xs)"
  shows "(P xs = P (remdups xs))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P xs = P (remdups xs)
[PROOF STEP]
apply(rule perm_contr'[OF perm contr', rule_format])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. length xs = ?n
[PROOF STEP]
by force


[STATEMENT]
lemma is_map_fst_inj: "is_map S \<Longrightarrow> inj_on fst S"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. is_map S \<Longrightarrow> inj_on fst S
[PROOF STEP]
by (fastforce intro: inj_onI dest: is_mapD)


[STATEMENT]
lemma lq_len: "r \<le>p s \<Longrightarrow> \<^bold>|r\<^bold>| +  \<^bold>|r\<inverse>\<^sup>>s\<^bold>| = \<^bold>|s\<^bold>|"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. r \<le>p s \<Longrightarrow> \<^bold>|r\<^bold>| + \<^bold>|r\<inverse>\<^sup>>s\<^bold>| = \<^bold>|s\<^bold>|
[PROOF STEP]
by (auto simp add: prefix_def)


[STATEMENT]
lemma all2_neq_Inr_ex_eq_Inl[dest]: "(\<forall>a b. x \<noteq> Inr (a, b)) \<Longrightarrow> (\<exists>l. x = Inl l)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>a b. x \<noteq> Inr (a, b) \<Longrightarrow> \<exists>l. x = Inl l
[PROOF STEP]
by (cases x) auto


[STATEMENT]
lemma iT_Minus_Plus_empty: "k < n \<Longrightarrow> k \<ominus> (I \<oplus> n) = {}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. k < n \<Longrightarrow> k \<ominus> (I \<oplus> n) = {}
[PROOF STEP]
apply (case_tac "I = {}")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>k < n; I = {}\<rbrakk> \<Longrightarrow> k \<ominus> (I \<oplus> n) = {}
 2. \<lbrakk>k < n; I \<noteq> {}\<rbrakk> \<Longrightarrow> k \<ominus> (I \<oplus> n) = {}
[PROOF STEP]
apply (simp add: iT_Plus_empty iT_Minus_empty)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>k < n; I \<noteq> {}\<rbrakk> \<Longrightarrow> k \<ominus> (I \<oplus> n) = {}
[PROOF STEP]
apply (simp add: iT_Minus_empty_iff iT_Plus_empty_iff iT_Plus_Min)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma Gcd_remove0_nat: "finite M \<Longrightarrow> Gcd M = Gcd (M - {0})"
  for M :: "nat set"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. finite M \<Longrightarrow> Gcd M = Gcd (M - {0})
[PROOF STEP]
proof (induct pred: finite)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. Gcd {} = Gcd ({} - {0})
 2. \<And>x F. \<lbrakk>finite F; x \<notin> F; Gcd F = Gcd (F - {0})\<rbrakk> \<Longrightarrow> Gcd (insert x F) = Gcd (insert x F - {0})
[PROOF STEP]
case (insert x M)
[PROOF STATE]
proof (state)
this:
finite M
x \<notin> M
Gcd M = Gcd (M - {0})

goal (2 subgoals):
 1. Gcd {} = Gcd ({} - {0})
 2. \<And>x F. \<lbrakk>finite F; x \<notin> F; Gcd F = Gcd (F - {0})\<rbrakk> \<Longrightarrow> Gcd (insert x F) = Gcd (insert x F - {0})
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
finite M
x \<notin> M
Gcd M = Gcd (M - {0})
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
finite M
x \<notin> M
Gcd M = Gcd (M - {0})

goal (1 subgoal):
 1. Gcd (insert x M) = Gcd (insert x M - {0})
[PROOF STEP]
by (simp add: insert_Diff_if)
[PROOF STATE]
proof (state)
this:
Gcd (insert x M) = Gcd (insert x M - {0})

goal (1 subgoal):
 1. Gcd {} = Gcd ({} - {0})
[PROOF STEP]
qed auto


[STATEMENT]
lemma (in lgroup) less_eq_inf_2: "(x \<le> y) = (inf y x = x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (x \<le> y) = (y \<sqinter> x = x)
[PROOF STEP]
by (simp add: le_iff_inf inf_commute)


[STATEMENT]
lemma Im_stereographic:
  shows "Im (2 * z / (1 + z * cnj z)) = 2 * Im z / (1 + (cmod z)\<^sup>2)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Im (2 * z / (1 + z * cnj z)) = 2 * Im z / (1 + (cmod z)\<^sup>2)
[PROOF STEP]
using one_plus_square_neq_zero
[PROOF STATE]
proof (prove)
using this:
1 + (cor ?x)\<^sup>2 \<noteq> 0

goal (1 subgoal):
 1. Im (2 * z / (1 + z * cnj z)) = 2 * Im z / (1 + (cmod z)\<^sup>2)
[PROOF STEP]
by (subst complex_mult_cnj_cmod, subst Im_divide_real) (auto simp add: power2_eq_square)


[STATEMENT]
lemma subset_fimage_iff: "(B |\<subseteq>| f|`|A) = (\<exists> AA. AA |\<subseteq>| A \<and> B = f|`|AA)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (B |\<subseteq>| f |`| A) = (\<exists>AA. AA |\<subseteq>| A \<and> B = f |`| AA)
[PROOF STEP]
by transfer (metis mem_Collect_eq rev_finite_subset subset_image_iff)


[STATEMENT]
lemma foldr_scene_union_add_tail:
  "\<lbrakk> pairwise (##\<^sub>S) (set xs); \<forall> x\<in>set xs. x ##\<^sub>S b \<rbrakk> \<Longrightarrow> \<Squnion>\<^sub>S xs \<squnion>\<^sub>S b = foldr (\<squnion>\<^sub>S) xs b"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>pairwise (##\<^sub>S) (set xs); \<forall>x\<in>set xs. x ##\<^sub>S b\<rbrakk> \<Longrightarrow> \<Squnion>\<^sub>S xs \<squnion>\<^sub>S b = foldr (\<squnion>\<^sub>S) xs b
[PROOF STEP]
apply (induct xs)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>pairwise (##\<^sub>S) (set []); \<forall>x\<in>set []. x ##\<^sub>S b\<rbrakk> \<Longrightarrow> \<Squnion>\<^sub>S [] \<squnion>\<^sub>S b = foldr (\<squnion>\<^sub>S) [] b
 2. \<And>a xs. \<lbrakk>\<lbrakk>pairwise (##\<^sub>S) (set xs); \<forall>x\<in>set xs. x ##\<^sub>S b\<rbrakk> \<Longrightarrow> \<Squnion>\<^sub>S xs \<squnion>\<^sub>S b = foldr (\<squnion>\<^sub>S) xs b; pairwise (##\<^sub>S) (set (a # xs)); \<forall>x\<in>set (a # xs). x ##\<^sub>S b\<rbrakk> \<Longrightarrow> \<Squnion>\<^sub>S (a # xs) \<squnion>\<^sub>S b = foldr (\<squnion>\<^sub>S) (a # xs) b
[PROOF STEP]
apply (simp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a xs. \<lbrakk>\<lbrakk>pairwise (##\<^sub>S) (set xs); \<forall>x\<in>set xs. x ##\<^sub>S b\<rbrakk> \<Longrightarrow> \<Squnion>\<^sub>S xs \<squnion>\<^sub>S b = foldr (\<squnion>\<^sub>S) xs b; pairwise (##\<^sub>S) (set (a # xs)); \<forall>x\<in>set (a # xs). x ##\<^sub>S b\<rbrakk> \<Longrightarrow> \<Squnion>\<^sub>S (a # xs) \<squnion>\<^sub>S b = foldr (\<squnion>\<^sub>S) (a # xs) b
[PROOF STEP]
apply (simp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a xs. \<lbrakk>pairwise (##\<^sub>S) (set xs) \<Longrightarrow> \<Squnion>\<^sub>S xs \<squnion>\<^sub>S b = foldr (\<squnion>\<^sub>S) xs b; pairwise (##\<^sub>S) (insert a (set xs)); a ##\<^sub>S b \<and> (\<forall>x\<in>set xs. x ##\<^sub>S b)\<rbrakk> \<Longrightarrow> a \<squnion>\<^sub>S \<Squnion>\<^sub>S xs \<squnion>\<^sub>S b = a \<squnion>\<^sub>S foldr (\<squnion>\<^sub>S) xs b
[PROOF STEP]
apply (subst scene_union_assoc[THEN sym])
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>a xs. \<lbrakk>pairwise (##\<^sub>S) (set xs) \<Longrightarrow> \<Squnion>\<^sub>S xs \<squnion>\<^sub>S b = foldr (\<squnion>\<^sub>S) xs b; pairwise (##\<^sub>S) (insert a (set xs)); a ##\<^sub>S b \<and> (\<forall>x\<in>set xs. x ##\<^sub>S b)\<rbrakk> \<Longrightarrow> a ##\<^sub>S \<Squnion>\<^sub>S xs
 2. \<And>a xs. \<lbrakk>pairwise (##\<^sub>S) (set xs) \<Longrightarrow> \<Squnion>\<^sub>S xs \<squnion>\<^sub>S b = foldr (\<squnion>\<^sub>S) xs b; pairwise (##\<^sub>S) (insert a (set xs)); a ##\<^sub>S b \<and> (\<forall>x\<in>set xs. x ##\<^sub>S b)\<rbrakk> \<Longrightarrow> a ##\<^sub>S b
 3. \<And>a xs. \<lbrakk>pairwise (##\<^sub>S) (set xs) \<Longrightarrow> \<Squnion>\<^sub>S xs \<squnion>\<^sub>S b = foldr (\<squnion>\<^sub>S) xs b; pairwise (##\<^sub>S) (insert a (set xs)); a ##\<^sub>S b \<and> (\<forall>x\<in>set xs. x ##\<^sub>S b)\<rbrakk> \<Longrightarrow> \<Squnion>\<^sub>S xs ##\<^sub>S b
 4. \<And>a xs. \<lbrakk>pairwise (##\<^sub>S) (set xs) \<Longrightarrow> \<Squnion>\<^sub>S xs \<squnion>\<^sub>S b = foldr (\<squnion>\<^sub>S) xs b; pairwise (##\<^sub>S) (insert a (set xs)); a ##\<^sub>S b \<and> (\<forall>x\<in>set xs. x ##\<^sub>S b)\<rbrakk> \<Longrightarrow> a \<squnion>\<^sub>S (\<Squnion>\<^sub>S xs \<squnion>\<^sub>S b) = a \<squnion>\<^sub>S foldr (\<squnion>\<^sub>S) xs b
[PROOF STEP]
apply (auto simp add: pairwise_insert)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>a xs. \<lbrakk>\<Squnion>\<^sub>S xs \<squnion>\<^sub>S b = foldr (\<squnion>\<^sub>S) xs b; \<forall>y. y \<in> set xs \<and> y \<noteq> a \<longrightarrow> a ##\<^sub>S y \<and> y ##\<^sub>S a; pairwise (##\<^sub>S) (set xs); a ##\<^sub>S b; \<forall>x\<in>set xs. x ##\<^sub>S b\<rbrakk> \<Longrightarrow> a ##\<^sub>S \<Squnion>\<^sub>S xs
 2. \<And>a xs. \<lbrakk>\<Squnion>\<^sub>S xs \<squnion>\<^sub>S b = foldr (\<squnion>\<^sub>S) xs b; \<forall>y. y \<in> set xs \<and> y \<noteq> a \<longrightarrow> a ##\<^sub>S y \<and> y ##\<^sub>S a; pairwise (##\<^sub>S) (set xs); a ##\<^sub>S b; \<forall>x\<in>set xs. x ##\<^sub>S b\<rbrakk> \<Longrightarrow> \<Squnion>\<^sub>S xs ##\<^sub>S b
[PROOF STEP]
using pairwise_compat_foldr scene_compat_refl
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>pairwise (##\<^sub>S) (set ?as); \<forall>b\<in>set ?as. ?a ##\<^sub>S b\<rbrakk> \<Longrightarrow> ?a ##\<^sub>S \<Squnion>\<^sub>S ?as
?X ##\<^sub>S ?X

goal (2 subgoals):
 1. \<And>a xs. \<lbrakk>\<Squnion>\<^sub>S xs \<squnion>\<^sub>S b = foldr (\<squnion>\<^sub>S) xs b; \<forall>y. y \<in> set xs \<and> y \<noteq> a \<longrightarrow> a ##\<^sub>S y \<and> y ##\<^sub>S a; pairwise (##\<^sub>S) (set xs); a ##\<^sub>S b; \<forall>x\<in>set xs. x ##\<^sub>S b\<rbrakk> \<Longrightarrow> a ##\<^sub>S \<Squnion>\<^sub>S xs
 2. \<And>a xs. \<lbrakk>\<Squnion>\<^sub>S xs \<squnion>\<^sub>S b = foldr (\<squnion>\<^sub>S) xs b; \<forall>y. y \<in> set xs \<and> y \<noteq> a \<longrightarrow> a ##\<^sub>S y \<and> y ##\<^sub>S a; pairwise (##\<^sub>S) (set xs); a ##\<^sub>S b; \<forall>x\<in>set xs. x ##\<^sub>S b\<rbrakk> \<Longrightarrow> \<Squnion>\<^sub>S xs ##\<^sub>S b
[PROOF STEP]
apply blast
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a xs. \<lbrakk>\<Squnion>\<^sub>S xs \<squnion>\<^sub>S b = foldr (\<squnion>\<^sub>S) xs b; \<forall>y. y \<in> set xs \<and> y \<noteq> a \<longrightarrow> a ##\<^sub>S y \<and> y ##\<^sub>S a; pairwise (##\<^sub>S) (set xs); a ##\<^sub>S b; \<forall>x\<in>set xs. x ##\<^sub>S b\<rbrakk> \<Longrightarrow> \<Squnion>\<^sub>S xs ##\<^sub>S b
[PROOF STEP]
apply (meson pairwise_compat_foldr scene_compat_sym)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma zmult_neg_neg:"\<lbrakk>i < (0::int); j < 0 \<rbrakk> \<Longrightarrow> 0 < i * j"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>i < 0; j < 0\<rbrakk> \<Longrightarrow> 0 < i * j
[PROOF STEP]
apply (frule zmult_zless_mono_neg[of "i" "0" "j"], assumption)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>i < 0; j < 0; 0 * j < i * j\<rbrakk> \<Longrightarrow> 0 < i * j
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma foldl_rule_aux_P:
  fixes I :: "'\<sigma> \<Rightarrow> 'a list \<Rightarrow> bool"
  assumes initial: "I \<sigma>0 l0"
  assumes step: "!!l1 l2 x \<sigma>. \<lbrakk> l0=l1@x#l2; I \<sigma> (x#l2) \<rbrakk> \<Longrightarrow> I (f \<sigma> x) l2"
  assumes final: "!!\<sigma>. I \<sigma> [] \<Longrightarrow> P \<sigma>"
  shows "P (foldl f \<sigma>0 l0)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P (foldl f \<sigma>0 l0)
[PROOF STEP]
using foldl_rule_aux[of I \<sigma>0 l0, OF initial, OF step] final
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<And>l1 l2 x \<sigma>. \<lbrakk>l0 = l1 @ x # l2; I \<sigma> (x # l2)\<rbrakk> \<Longrightarrow> l0 = ?l1.1 l1 l2 x \<sigma> @ ?x3 x \<sigma> # l2; \<And>l1 l2 x \<sigma>. \<lbrakk>l0 = l1 @ x # l2; I \<sigma> (x # l2)\<rbrakk> \<Longrightarrow> I (?\<sigma>2 x \<sigma>) (?x3 x \<sigma> # l2)\<rbrakk> \<Longrightarrow> I (foldl (\<lambda>\<sigma> x. f (?\<sigma>2 x \<sigma>) (?x3 x \<sigma>)) \<sigma>0 l0) []
I ?\<sigma> [] \<Longrightarrow> P ?\<sigma>

goal (1 subgoal):
 1. P (foldl f \<sigma>0 l0)
[PROOF STEP]
by simp


[STATEMENT]
lemma fst_mono: "x \<le> y \<Longrightarrow> fst x \<le> fst y"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x \<le> y \<Longrightarrow> fst x \<le> fst y
[PROOF STEP]
unfolding less_eq_prod_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fst x \<le> fst y \<and> snd x \<le> snd y \<Longrightarrow> fst x \<le> fst y
[PROOF STEP]
by simp


[STATEMENT]
lemma gt_minus_one_absI: "abs k < 1 \<Longrightarrow> - 1 < k" for k::real
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<bar>k\<bar> < 1 \<Longrightarrow> - 1 < k
[PROOF STEP]
by auto


[STATEMENT]
lemma cat_bintr [simp]: "(\<lambda>k n l. concat_bit n l k) a n ((take_bit :: nat \<Rightarrow> int \<Rightarrow> int) n b) = (\<lambda>k n l. concat_bit n l k) a n b"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. concat_bit n (take_bit n b) a = concat_bit n b a
[PROOF STEP]
by (simp add: bin_cat_eq_push_bit_add_take_bit)


[STATEMENT]
lemma Exists_iff_app: "Seq s d \<Longrightarrow> x \<^bold>\<in> d \<Longrightarrow> (\<exists>y. \<langle>x, y\<rangle> \<^bold>\<in> s \<and> P y) = P (app s x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Seq s d; x \<^bold>\<in> d\<rbrakk> \<Longrightarrow> (\<exists>y. \<langle>x, y\<rangle> \<^bold>\<in> s \<and> P y) = P (app s x)
[PROOF STEP]
by (metis Seq_iff_app)


[STATEMENT]
lemma sqr_ci: "in_carrier ls \<Longrightarrow> Ipol ls (sqr P) = Ipol ls P \<otimes> Ipol ls P"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. in_carrier ls \<Longrightarrow> Ipol ls (sqr P) = Ipol ls P \<otimes> Ipol ls P
[PROOF STEP]
by (induct P arbitrary: ls)
    (simp_all add: add_ci mkPinj_ci mkPX_ci mul_ci l_distr r_distr
       a_ac m_ac nat_pow_mult [symmetric] of_int_2)


[STATEMENT]
lemma measurable_Least[measurable]:
  assumes [measurable]: "(\<And>i::nat. (\<lambda>x. P i x) \<in> measurable M (count_space UNIV))"
  shows "(\<lambda>x. LEAST i. P i x) \<in> measurable M (count_space UNIV)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lambda>x. LEAST i. P i x) \<in> M \<rightarrow>\<^sub>M count_space UNIV
[PROOF STEP]
unfolding measurable_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lambda>x. LEAST i. P i x) \<in> {f \<in> space M \<rightarrow> space (count_space UNIV). \<forall>y\<in>sets (count_space UNIV). f -` y \<inter> space M \<in> sets M}
[PROOF STEP]
by (safe intro!: sets_Least) simp_all


[STATEMENT]
lemma vlrestriction_vintersection: "(r \<inter>\<^sub>\<circ> s) \<restriction>\<^sup>l\<^sub>\<circ> A = r \<restriction>\<^sup>l\<^sub>\<circ> A \<inter>\<^sub>\<circ> s \<restriction>\<^sup>l\<^sub>\<circ> A"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (r \<inter>\<^sub>\<circ> s) \<restriction>\<^sup>l\<^sub>\<circ> A = r \<restriction>\<^sup>l\<^sub>\<circ> A \<inter>\<^sub>\<circ> s \<restriction>\<^sup>l\<^sub>\<circ> A
[PROOF STEP]
by auto


[STATEMENT]
lemma eval_member:
  "member xq = eval (pred_of_seq xq)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. member xq = eval (pred_of_seq xq)
[PROOF STEP]
proof (induct xq)
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. member Empty = eval (pred_of_seq Empty)
 2. \<And>x1 x2. member (Insert x1 x2) = eval (pred_of_seq (Insert x1 x2))
 3. \<And>x1 xq. member xq = eval (pred_of_seq xq) \<Longrightarrow> member (Join x1 xq) = eval (pred_of_seq (Join x1 xq))
[PROOF STEP]
case Empty
[PROOF STATE]
proof (state)
this:

goal (3 subgoals):
 1. member Empty = eval (pred_of_seq Empty)
 2. \<And>x1 x2. member (Insert x1 x2) = eval (pred_of_seq (Insert x1 x2))
 3. \<And>x1 xq. member xq = eval (pred_of_seq xq) \<Longrightarrow> member (Join x1 xq) = eval (pred_of_seq (Join x1 xq))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. member Empty = eval (pred_of_seq Empty)
[PROOF STEP]
by (auto simp add: fun_eq_iff elim: botE)
[PROOF STATE]
proof (state)
this:
member Empty = eval (pred_of_seq Empty)

goal (2 subgoals):
 1. \<And>x1 x2. member (Insert x1 x2) = eval (pred_of_seq (Insert x1 x2))
 2. \<And>x1 xq. member xq = eval (pred_of_seq xq) \<Longrightarrow> member (Join x1 xq) = eval (pred_of_seq (Join x1 xq))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>x1 x2. member (Insert x1 x2) = eval (pred_of_seq (Insert x1 x2))
 2. \<And>x1 xq. member xq = eval (pred_of_seq xq) \<Longrightarrow> member (Join x1 xq) = eval (pred_of_seq (Join x1 xq))
[PROOF STEP]
case Insert
[PROOF STATE]
proof (state)
this:

goal (2 subgoals):
 1. \<And>x1 x2. member (Insert x1 x2) = eval (pred_of_seq (Insert x1 x2))
 2. \<And>x1 xq. member xq = eval (pred_of_seq xq) \<Longrightarrow> member (Join x1 xq) = eval (pred_of_seq (Join x1 xq))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. member (Insert x1_ x2_) = eval (pred_of_seq (Insert x1_ x2_))
[PROOF STEP]
by (auto simp add: fun_eq_iff elim: supE singleE intro: supI1 supI2 singleI)
[PROOF STATE]
proof (state)
this:
member (Insert x1_ x2_) = eval (pred_of_seq (Insert x1_ x2_))

goal (1 subgoal):
 1. \<And>x1 xq. member xq = eval (pred_of_seq xq) \<Longrightarrow> member (Join x1 xq) = eval (pred_of_seq (Join x1 xq))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x1 xq. member xq = eval (pred_of_seq xq) \<Longrightarrow> member (Join x1 xq) = eval (pred_of_seq (Join x1 xq))
[PROOF STEP]
case Join
[PROOF STATE]
proof (state)
this:
member xq_ = eval (pred_of_seq xq_)

goal (1 subgoal):
 1. \<And>x1 xq. member xq = eval (pred_of_seq xq) \<Longrightarrow> member (Join x1 xq) = eval (pred_of_seq (Join x1 xq))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
member xq_ = eval (pred_of_seq xq_)
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
member xq_ = eval (pred_of_seq xq_)

goal (1 subgoal):
 1. member (Join x1_ xq_) = eval (pred_of_seq (Join x1_ xq_))
[PROOF STEP]
by (auto simp add: fun_eq_iff elim: supE intro: supI1 supI2)
[PROOF STATE]
proof (state)
this:
member (Join x1_ xq_) = eval (pred_of_seq (Join x1_ xq_))

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
theorem wei_approx_min_degree_heuristic:
"VARS (S :: 'a set) (X :: 'a set) (x :: 'a) (r :: nat)
  { True }
  S := {};
  X := {};
  r := 0;
  WHILE X \<noteq> V
  INV { inv_approx S X r }
  DO x := (SOME x. x \<in> V - X \<and> vertex_heuristic X x);
     S := insert x S;
     r := max (card (neighbors x \<union> {x} - X)) r;
     X := X \<union> neighbors x \<union> {x}
  OD
  { approximation_miv r S }"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {True}
S := {}; X := {}; r := 0; WHILE X \<noteq> V INV {inv_approx S X r}  VAR {0}
DO x := (SOME x. x \<in> V - X \<and> vertex_heuristic X x); S := insert x S; r := max (card (neighbors x \<union> {x} - X)) r; X := X \<union> neighbors x \<union> {x} OD
{approximation_miv r S}
[PROOF STEP]
proof (vcg, goal_cases)
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>S X x r. True \<Longrightarrow> inv_approx {} {} 0
 2. \<And>S X x r. inv_approx S X r \<and> X \<noteq> V \<Longrightarrow> inv_approx (insert (SOME x. x \<in> V - X \<and> vertex_heuristic X x) S) (X \<union> neighbors (SOME x. x \<in> V - X \<and> vertex_heuristic X x) \<union> {SOME x. x \<in> V - X \<and> vertex_heuristic X x}) (max (card (neighbors (SOME x. x \<in> V - X \<and> vertex_heuristic X x) \<union> {SOME x. x \<in> V - X \<and> vertex_heuristic X x} - X)) r)
 3. \<And>S X x r. inv_approx S X r \<and> \<not> X \<noteq> V \<Longrightarrow> approximation_miv r S
[PROOF STEP]
case (1 S X x r)
[PROOF STATE]
proof (state)
this:
True

goal (3 subgoals):
 1. \<And>S X x r. True \<Longrightarrow> inv_approx {} {} 0
 2. \<And>S X x r. inv_approx S X r \<and> X \<noteq> V \<Longrightarrow> inv_approx (insert (SOME x. x \<in> V - X \<and> vertex_heuristic X x) S) (X \<union> neighbors (SOME x. x \<in> V - X \<and> vertex_heuristic X x) \<union> {SOME x. x \<in> V - X \<and> vertex_heuristic X x}) (max (card (neighbors (SOME x. x \<in> V - X \<and> vertex_heuristic X x) \<union> {SOME x. x \<in> V - X \<and> vertex_heuristic X x} - X)) r)
 3. \<And>S X x r. inv_approx S X r \<and> \<not> X \<noteq> V \<Longrightarrow> approximation_miv r S
[PROOF STEP]
(* invariant initially true *)
[PROOF STATE]
proof (state)
this:
True

goal (3 subgoals):
 1. \<And>S X x r. True \<Longrightarrow> inv_approx {} {} 0
 2. \<And>S X x r. inv_approx S X r \<and> X \<noteq> V \<Longrightarrow> inv_approx (insert (SOME x. x \<in> V - X \<and> vertex_heuristic X x) S) (X \<union> neighbors (SOME x. x \<in> V - X \<and> vertex_heuristic X x) \<union> {SOME x. x \<in> V - X \<and> vertex_heuristic X x}) (max (card (neighbors (SOME x. x \<in> V - X \<and> vertex_heuristic X x) \<union> {SOME x. x \<in> V - X \<and> vertex_heuristic X x} - X)) r)
 3. \<And>S X x r. inv_approx S X r \<and> \<not> X \<noteq> V \<Longrightarrow> approximation_miv r S
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
True
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
True

goal (1 subgoal):
 1. inv_approx {} {} 0
[PROOF STEP]
unfolding inv_approx_def inv_iv_def independent_vertices_def
[PROOF STATE]
proof (prove)
using this:
True

goal (1 subgoal):
 1. (({} \<subseteq> \<Union> E \<and> (\<forall>v1 v2. v1 \<in> {} \<and> v2 \<in> {} \<longrightarrow> {v1, v2} \<notin> E)) \<and> {} \<subseteq> V \<and> (\<forall>v1\<in>V - {}. \<forall>v2\<in>{}. {v1, v2} \<notin> E) \<and> {} \<subseteq> {}) \<and> card {} \<le> card {} * 0
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
inv_approx {} {} 0

goal (2 subgoals):
 1. \<And>S X x r. inv_approx S X r \<and> X \<noteq> V \<Longrightarrow> inv_approx (insert (SOME x. x \<in> V - X \<and> vertex_heuristic X x) S) (X \<union> neighbors (SOME x. x \<in> V - X \<and> vertex_heuristic X x) \<union> {SOME x. x \<in> V - X \<and> vertex_heuristic X x}) (max (card (neighbors (SOME x. x \<in> V - X \<and> vertex_heuristic X x) \<union> {SOME x. x \<in> V - X \<and> vertex_heuristic X x} - X)) r)
 2. \<And>S X x r. inv_approx S X r \<and> \<not> X \<noteq> V \<Longrightarrow> approximation_miv r S
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>S X x r. inv_approx S X r \<and> X \<noteq> V \<Longrightarrow> inv_approx (insert (SOME x. x \<in> V - X \<and> vertex_heuristic X x) S) (X \<union> neighbors (SOME x. x \<in> V - X \<and> vertex_heuristic X x) \<union> {SOME x. x \<in> V - X \<and> vertex_heuristic X x}) (max (card (neighbors (SOME x. x \<in> V - X \<and> vertex_heuristic X x) \<union> {SOME x. x \<in> V - X \<and> vertex_heuristic X x} - X)) r)
 2. \<And>S X x r. inv_approx S X r \<and> \<not> X \<noteq> V \<Longrightarrow> approximation_miv r S
[PROOF STEP]
case (2 S X x r)
[PROOF STATE]
proof (state)
this:
inv_approx S X r \<and> X \<noteq> V

goal (2 subgoals):
 1. \<And>S X x r. inv_approx S X r \<and> X \<noteq> V \<Longrightarrow> inv_approx (insert (SOME x. x \<in> V - X \<and> vertex_heuristic X x) S) (X \<union> neighbors (SOME x. x \<in> V - X \<and> vertex_heuristic X x) \<union> {SOME x. x \<in> V - X \<and> vertex_heuristic X x}) (max (card (neighbors (SOME x. x \<in> V - X \<and> vertex_heuristic X x) \<union> {SOME x. x \<in> V - X \<and> vertex_heuristic X x} - X)) r)
 2. \<And>S X x r. inv_approx S X r \<and> \<not> X \<noteq> V \<Longrightarrow> approximation_miv r S
[PROOF STEP]
(* invariant preserved by loop *)
  (* definedness of assignment *)
[PROOF STATE]
proof (state)
this:
inv_approx S X r \<and> X \<noteq> V

goal (2 subgoals):
 1. \<And>S X x r. inv_approx S X r \<and> X \<noteq> V \<Longrightarrow> inv_approx (insert (SOME x. x \<in> V - X \<and> vertex_heuristic X x) S) (X \<union> neighbors (SOME x. x \<in> V - X \<and> vertex_heuristic X x) \<union> {SOME x. x \<in> V - X \<and> vertex_heuristic X x}) (max (card (neighbors (SOME x. x \<in> V - X \<and> vertex_heuristic X x) \<union> {SOME x. x \<in> V - X \<and> vertex_heuristic X x} - X)) r)
 2. \<And>S X x r. inv_approx S X r \<and> \<not> X \<noteq> V \<Longrightarrow> approximation_miv r S
[PROOF STEP]
let ?x = "(SOME x. x \<in> V - X \<and> vertex_heuristic X x)"
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>S X x r. inv_approx S X r \<and> X \<noteq> V \<Longrightarrow> inv_approx (insert (SOME x. x \<in> V - X \<and> vertex_heuristic X x) S) (X \<union> neighbors (SOME x. x \<in> V - X \<and> vertex_heuristic X x) \<union> {SOME x. x \<in> V - X \<and> vertex_heuristic X x}) (max (card (neighbors (SOME x. x \<in> V - X \<and> vertex_heuristic X x) \<union> {SOME x. x \<in> V - X \<and> vertex_heuristic X x} - X)) r)
 2. \<And>S X x r. inv_approx S X r \<and> \<not> X \<noteq> V \<Longrightarrow> approximation_miv r S
[PROOF STEP]
have "V - X \<noteq> {}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. V - X \<noteq> {}
[PROOF STEP]
using 2
[PROOF STATE]
proof (prove)
using this:
inv_approx S X r \<and> X \<noteq> V

goal (1 subgoal):
 1. V - X \<noteq> {}
[PROOF STEP]
unfolding inv_approx_def inv_iv_def
[PROOF STATE]
proof (prove)
using this:
((independent_vertices E S \<and> X \<subseteq> V \<and> (\<forall>v1\<in>V - X. \<forall>v2\<in>S. {v1, v2} \<notin> E) \<and> S \<subseteq> X) \<and> card X \<le> card S * r) \<and> X \<noteq> V

goal (1 subgoal):
 1. V - X \<noteq> {}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
V - X \<noteq> {}

goal (2 subgoals):
 1. \<And>S X x r. inv_approx S X r \<and> X \<noteq> V \<Longrightarrow> inv_approx (insert (SOME x. x \<in> V - X \<and> vertex_heuristic X x) S) (X \<union> neighbors (SOME x. x \<in> V - X \<and> vertex_heuristic X x) \<union> {SOME x. x \<in> V - X \<and> vertex_heuristic X x}) (max (card (neighbors (SOME x. x \<in> V - X \<and> vertex_heuristic X x) \<union> {SOME x. x \<in> V - X \<and> vertex_heuristic X x} - X)) r)
 2. \<And>S X x r. inv_approx S X r \<and> \<not> X \<noteq> V \<Longrightarrow> approximation_miv r S
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
V - X \<noteq> {}

goal (2 subgoals):
 1. \<And>S X x r. inv_approx S X r \<and> X \<noteq> V \<Longrightarrow> inv_approx (insert (SOME x. x \<in> V - X \<and> vertex_heuristic X x) S) (X \<union> neighbors (SOME x. x \<in> V - X \<and> vertex_heuristic X x) \<union> {SOME x. x \<in> V - X \<and> vertex_heuristic X x}) (max (card (neighbors (SOME x. x \<in> V - X \<and> vertex_heuristic X x) \<union> {SOME x. x \<in> V - X \<and> vertex_heuristic X x} - X)) r)
 2. \<And>S X x r. inv_approx S X r \<and> \<not> X \<noteq> V \<Longrightarrow> approximation_miv r S
[PROOF STEP]
have "finite (V - X)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. finite (V - X)
[PROOF STEP]
using 2 and finite_V
[PROOF STATE]
proof (prove)
using this:
inv_approx S X r \<and> X \<noteq> V
finite V

goal (1 subgoal):
 1. finite (V - X)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
finite (V - X)

goal (2 subgoals):
 1. \<And>S X x r. inv_approx S X r \<and> X \<noteq> V \<Longrightarrow> inv_approx (insert (SOME x. x \<in> V - X \<and> vertex_heuristic X x) S) (X \<union> neighbors (SOME x. x \<in> V - X \<and> vertex_heuristic X x) \<union> {SOME x. x \<in> V - X \<and> vertex_heuristic X x}) (max (card (neighbors (SOME x. x \<in> V - X \<and> vertex_heuristic X x) \<union> {SOME x. x \<in> V - X \<and> vertex_heuristic X x} - X)) r)
 2. \<And>S X x r. inv_approx S X r \<and> \<not> X \<noteq> V \<Longrightarrow> approximation_miv r S
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
V - X \<noteq> {}
finite (V - X)
[PROOF STEP]
have "\<exists>x. x \<in> V - X \<and> vertex_heuristic X x"
[PROOF STATE]
proof (prove)
using this:
V - X \<noteq> {}
finite (V - X)

goal (1 subgoal):
 1. \<exists>x. x \<in> V - X \<and> vertex_heuristic X x
[PROOF STEP]
using ex_min_finite_set [where ?f = "\<lambda>x. card (neighbors x - X)"]
[PROOF STATE]
proof (prove)
using this:
V - X \<noteq> {}
finite (V - X)
\<lbrakk>finite ?S; ?S \<noteq> {}\<rbrakk> \<Longrightarrow> \<exists>x. x \<in> ?S \<and> (\<forall>y\<in>?S. card (neighbors x - X) \<le> card (neighbors y - X))

goal (1 subgoal):
 1. \<exists>x. x \<in> V - X \<and> vertex_heuristic X x
[PROOF STEP]
unfolding vertex_heuristic_def
[PROOF STATE]
proof (prove)
using this:
V - X \<noteq> {}
finite (V - X)
\<lbrakk>finite ?S; ?S \<noteq> {}\<rbrakk> \<Longrightarrow> \<exists>x. x \<in> ?S \<and> (\<forall>y\<in>?S. card (neighbors x - X) \<le> card (neighbors y - X))

goal (1 subgoal):
 1. \<exists>x. x \<in> V - X \<and> (\<forall>u\<in>V - X. card (neighbors x - X) \<le> card (neighbors u - X))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<exists>x. x \<in> V - X \<and> vertex_heuristic X x

goal (2 subgoals):
 1. \<And>S X x r. inv_approx S X r \<and> X \<noteq> V \<Longrightarrow> inv_approx (insert (SOME x. x \<in> V - X \<and> vertex_heuristic X x) S) (X \<union> neighbors (SOME x. x \<in> V - X \<and> vertex_heuristic X x) \<union> {SOME x. x \<in> V - X \<and> vertex_heuristic X x}) (max (card (neighbors (SOME x. x \<in> V - X \<and> vertex_heuristic X x) \<union> {SOME x. x \<in> V - X \<and> vertex_heuristic X x} - X)) r)
 2. \<And>S X x r. inv_approx S X r \<and> \<not> X \<noteq> V \<Longrightarrow> approximation_miv r S
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<exists>x. x \<in> V - X \<and> vertex_heuristic X x
[PROOF STEP]
have x_def: "?x \<in> V - X \<and> vertex_heuristic X ?x"
[PROOF STATE]
proof (prove)
using this:
\<exists>x. x \<in> V - X \<and> vertex_heuristic X x

goal (1 subgoal):
 1. (SOME x. x \<in> V - X \<and> vertex_heuristic X x) \<in> V - X \<and> vertex_heuristic X (SOME x. x \<in> V - X \<and> vertex_heuristic X x)
[PROOF STEP]
using someI_ex [where ?P = "\<lambda>x. x \<in> V - X \<and> vertex_heuristic X x"]
[PROOF STATE]
proof (prove)
using this:
\<exists>x. x \<in> V - X \<and> vertex_heuristic X x
\<exists>x. x \<in> V - X \<and> vertex_heuristic X x \<Longrightarrow> (SOME x. x \<in> V - X \<and> vertex_heuristic X x) \<in> V - X \<and> vertex_heuristic X (SOME x. x \<in> V - X \<and> vertex_heuristic X x)

goal (1 subgoal):
 1. (SOME x. x \<in> V - X \<and> vertex_heuristic X x) \<in> V - X \<and> vertex_heuristic X (SOME x. x \<in> V - X \<and> vertex_heuristic X x)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(SOME x. x \<in> V - X \<and> vertex_heuristic X x) \<in> V - X \<and> vertex_heuristic X (SOME x. x \<in> V - X \<and> vertex_heuristic X x)

goal (2 subgoals):
 1. \<And>S X x r. inv_approx S X r \<and> X \<noteq> V \<Longrightarrow> inv_approx (insert (SOME x. x \<in> V - X \<and> vertex_heuristic X x) S) (X \<union> neighbors (SOME x. x \<in> V - X \<and> vertex_heuristic X x) \<union> {SOME x. x \<in> V - X \<and> vertex_heuristic X x}) (max (card (neighbors (SOME x. x \<in> V - X \<and> vertex_heuristic X x) \<union> {SOME x. x \<in> V - X \<and> vertex_heuristic X x} - X)) r)
 2. \<And>S X x r. inv_approx S X r \<and> \<not> X \<noteq> V \<Longrightarrow> approximation_miv r S
[PROOF STEP]
with 2
[PROOF STATE]
proof (chain)
picking this:
inv_approx S X r \<and> X \<noteq> V
(SOME x. x \<in> V - X \<and> vertex_heuristic X x) \<in> V - X \<and> vertex_heuristic X (SOME x. x \<in> V - X \<and> vertex_heuristic X x)
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
inv_approx S X r \<and> X \<noteq> V
(SOME x. x \<in> V - X \<and> vertex_heuristic X x) \<in> V - X \<and> vertex_heuristic X (SOME x. x \<in> V - X \<and> vertex_heuristic X x)

goal (1 subgoal):
 1. inv_approx (insert (SOME x. x \<in> V - X \<and> vertex_heuristic X x) S) (X \<union> neighbors (SOME x. x \<in> V - X \<and> vertex_heuristic X x) \<union> {SOME x. x \<in> V - X \<and> vertex_heuristic X x}) (max (card (neighbors (SOME x. x \<in> V - X \<and> vertex_heuristic X x) \<union> {SOME x. x \<in> V - X \<and> vertex_heuristic X x} - X)) r)
[PROOF STEP]
using inv_approx_preserv2
[PROOF STATE]
proof (prove)
using this:
inv_approx S X r \<and> X \<noteq> V
(SOME x. x \<in> V - X \<and> vertex_heuristic X x) \<in> V - X \<and> vertex_heuristic X (SOME x. x \<in> V - X \<and> vertex_heuristic X x)
\<lbrakk>inv_approx ?S ?X ?s; ?x \<in> V - ?X\<rbrakk> \<Longrightarrow> inv_approx (insert ?x ?S) (?X \<union> neighbors ?x \<union> {?x}) (max (card (neighbors ?x \<union> {?x} - ?X)) ?s)

goal (1 subgoal):
 1. inv_approx (insert (SOME x. x \<in> V - X \<and> vertex_heuristic X x) S) (X \<union> neighbors (SOME x. x \<in> V - X \<and> vertex_heuristic X x) \<union> {SOME x. x \<in> V - X \<and> vertex_heuristic X x}) (max (card (neighbors (SOME x. x \<in> V - X \<and> vertex_heuristic X x) \<union> {SOME x. x \<in> V - X \<and> vertex_heuristic X x} - X)) r)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
inv_approx (insert (SOME x. x \<in> V - X \<and> vertex_heuristic X x) S) (X \<union> neighbors (SOME x. x \<in> V - X \<and> vertex_heuristic X x) \<union> {SOME x. x \<in> V - X \<and> vertex_heuristic X x}) (max (card (neighbors (SOME x. x \<in> V - X \<and> vertex_heuristic X x) \<union> {SOME x. x \<in> V - X \<and> vertex_heuristic X x} - X)) r)

goal (1 subgoal):
 1. \<And>S X x r. inv_approx S X r \<and> \<not> X \<noteq> V \<Longrightarrow> approximation_miv r S
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>S X x r. inv_approx S X r \<and> \<not> X \<noteq> V \<Longrightarrow> approximation_miv r S
[PROOF STEP]
case (3 S X x r)
[PROOF STATE]
proof (state)
this:
inv_approx S X r \<and> \<not> X \<noteq> V

goal (1 subgoal):
 1. \<And>S X x r. inv_approx S X r \<and> \<not> X \<noteq> V \<Longrightarrow> approximation_miv r S
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
inv_approx S X r \<and> \<not> X \<noteq> V
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
inv_approx S X r \<and> \<not> X \<noteq> V

goal (1 subgoal):
 1. approximation_miv r S
[PROOF STEP]
using inv_approx
[PROOF STATE]
proof (prove)
using this:
inv_approx S X r \<and> \<not> X \<noteq> V
\<lbrakk>independent_vertices E ?S; card V \<le> card ?S * ?r\<rbrakk> \<Longrightarrow> approximation_miv ?r ?S

goal (1 subgoal):
 1. approximation_miv r S
[PROOF STEP]
unfolding inv_approx_def inv_iv_def
[PROOF STATE]
proof (prove)
using this:
((independent_vertices E S \<and> X \<subseteq> V \<and> (\<forall>v1\<in>V - X. \<forall>v2\<in>S. {v1, v2} \<notin> E) \<and> S \<subseteq> X) \<and> card X \<le> card S * r) \<and> \<not> X \<noteq> V
\<lbrakk>independent_vertices E ?S; card V \<le> card ?S * ?r\<rbrakk> \<Longrightarrow> approximation_miv ?r ?S

goal (1 subgoal):
 1. approximation_miv r S
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
approximation_miv r S

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma conj_galois_1:
  assumes "is_conjugation f g"
  shows "f x \<le> y \<longleftrightarrow> x \<le> -g (-y)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (f x \<le> y) = (x \<le> - g (- y))
[PROOF STEP]
by (metis assms is_conjugation_def double_compl galois_aux)


[STATEMENT]
lemma finite_varposs: "finite (varposs s)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. finite (varposs s)
[PROOF STEP]
by (intro finite_subset[of "varposs s" "poss s"]) (auto simp: varposs_def finite_poss)


[STATEMENT]
lemma islimpt_UNIV_iff: "x islimpt UNIV \<longleftrightarrow> \<not> open {x}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x islimpt UNIV = (\<not> open {x})
[PROOF STEP]
unfolding islimpt_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<forall>T. x \<in> T \<longrightarrow> open T \<longrightarrow> (\<exists>y\<in>UNIV. y \<in> T \<and> y \<noteq> x)) = (\<not> open {x})
[PROOF STEP]
by (safe, fast, case_tac "T = {x}", fast, fast)


[STATEMENT]
lemma idiv_0: "0 div (a::enat) = 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 div a = 0
[PROOF STEP]
unfolding div_enat_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (case 0 of enat x \<Rightarrow> case a of enat y \<Rightarrow> enat (x div y) | \<infinity> \<Rightarrow> 0 | \<infinity> \<Rightarrow> case a of enat 0 \<Rightarrow> 0 | enat (Suc n) \<Rightarrow> \<infinity> | \<infinity> \<Rightarrow> \<infinity>) = 0
[PROOF STEP]
by (case_tac a, simp_all)


[STATEMENT]
lemma normalize_field:
  "normalize (x :: 'a :: {normalization_semidom,field}) = (if x = 0 then 0 else 1)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. normalize x = (if x = (0::'a) then 0::'a else (1::'a))
[PROOF STEP]
by (auto simp: normalize_1_iff dvd_field_iff)


[STATEMENT]
lemma to_state_close_from_state_eq[simp]: "wm_to_state (close_world (state_to_wm s)) = s"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. wm_to_state (close_world (state_to_wm s)) = s
[PROOF STEP]
by (auto simp: wm_to_state_def close_world_def
      state_to_wm_def image_def)


[STATEMENT]
lemma thermostat:
  assumes "a > 0" and "0 < Tmin" and "Tmax < L"
  shows "\<lceil>\<lambda>s. Tmin \<le> s$1 \<and> s$1 \<le> Tmax \<and> s$4 = 0\<rceil> \<le> wp
  (LOOP
    \<comment> \<open>control\<close>
    ((2 ::= (\<lambda>s. 0));(3 ::= (\<lambda>s. s$1));
    (IF (\<lambda>s. s$4 = 0 \<and> s$3 \<le> Tmin + 1) THEN (4 ::= (\<lambda>s.1)) ELSE
    (IF (\<lambda>s. s$4 = 1 \<and> s$3 \<ge> Tmax - 1) THEN (4 ::= (\<lambda>s.0)) ELSE skip));
    \<comment> \<open>dynamics\<close>
    (IF (\<lambda>s. s$4 = 0) THEN (x\<acute>= f a 0 & (\<lambda>s. s$2 \<le> - (ln (Tmin/s$3))/a))
    ELSE (x\<acute>= f a L & (\<lambda>s. s$2 \<le> - (ln ((L-Tmax)/(L-s$3)))/a))) )
  INV (\<lambda>s. Tmin \<le>s$1 \<and> s$1 \<le> Tmax \<and> (s$4 = 0 \<or> s$4 = 1)))
  \<lceil>\<lambda>s. Tmin \<le> s$1 \<and> s$1 \<le> Tmax\<rceil>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lceil>\<lambda>s. Tmin \<le> s $ 1 \<and> s $ 1 \<le> Tmax \<and> s $ 4 = 0\<rceil> \<subseteq> wp (LOOP (2 ::= (\<lambda>s. 0)) ; (3 ::= (\<lambda>s. s $ 1)) ; (IF (\<lambda>s. s $ 4 = 0 \<and> s $ 3 \<le> Tmin + 1) THEN (4 ::= (\<lambda>s. 1)) ELSE IF (\<lambda>s. s $ 4 = 1 \<and> Tmax - 1 \<le> s $ 3) THEN (4 ::= (\<lambda>s. 0)) ELSE skip) ; (IF (\<lambda>s. s $ 4 = 0) THEN x\<acute>=\<lambda>t. f a 0 & \<lambda>s. s $ 2 \<le> - ln (Tmin / s $ 3) / a on \<lambda>s. {t. 0 \<le> t} UNIV @ 0 ELSE x\<acute>=\<lambda>t. f a L & \<lambda>s. s $ 2 \<le> - ln ((L - Tmax) / (L - s $ 3)) / a on \<lambda>s. {t. 0 \<le> t} UNIV @ 0) INV (\<lambda>s. Tmin \<le> s $ 1 \<and> s $ 1 \<le> Tmax \<and> (s $ 4 = 0 \<or> s $ 4 = 1)) ) \<lceil>\<lambda>s. Tmin \<le> s $ 1 \<and> s $ 1 \<le> Tmax\<rceil>
[PROOF STEP]
apply(rule wp_loopI, simp_all add: fbox_temp_dyn[OF assms(1)])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>s. Tmin \<le> s $ 1 \<and> s $ 1 \<le> Tmax \<and> (s $ 4 = 0 \<or> s $ 4 = 1) \<longrightarrow> (s $ 4 = 0 \<longrightarrow> s $ 1 \<le> Tmin + 1 \<longrightarrow> (\<forall>t\<ge>0. (\<forall>\<tau>. 0 \<le> \<tau> \<and> \<tau> \<le> t \<longrightarrow> \<tau> \<le> - (ln ((L - Tmax) / (L - s $ 1)) / a)) \<longrightarrow> Tmin \<le> L - exp (- (a \<cdot> t)) \<cdot> (L - s $ 1) \<and> L - exp (- (a \<cdot> t)) \<cdot> (L - s $ 1) \<le> Tmax)) \<and> (s $ 4 = 0 \<and> s $ 1 \<le> Tmin + 1 \<or> (s $ 4 = 1 \<longrightarrow> Tmax - 1 \<le> s $ 1 \<longrightarrow> (\<forall>t\<ge>0. (\<forall>\<tau>. 0 \<le> \<tau> \<and> \<tau> \<le> t \<longrightarrow> \<tau> \<le> - (ln (Tmin / s $ 1) / a)) \<longrightarrow> Tmin \<le> exp (- (a \<cdot> t)) \<cdot> s $ 1 \<and> exp (- (a \<cdot> t)) \<cdot> s $ 1 \<le> Tmax)) \<and> (s $ 4 = 1 \<and> Tmax - 1 \<le> s $ 1 \<or> (s $ 4 = 0 \<longrightarrow> (\<forall>t\<ge>0. (\<forall>\<tau>. 0 \<le> \<tau> \<and> \<tau> \<le> t \<longrightarrow> \<tau> \<le> - (ln (Tmin / s $ 1) / a)) \<longrightarrow> Tmin \<le> exp (- (a \<cdot> t)) \<cdot> s $ 1 \<and> exp (- (a \<cdot> t)) \<cdot> s $ 1 \<le> Tmax)) \<and> (s $ 4 = 0 \<or> (\<forall>t\<ge>0. (\<forall>\<tau>. 0 \<le> \<tau> \<and> \<tau> \<le> t \<longrightarrow> \<tau> \<le> - (ln ((L - Tmax) / (L - s $ 1)) / a)) \<longrightarrow> Tmin \<le> L - exp (- (a \<cdot> t)) \<cdot> (L - s $ 1) \<and> L - exp (- (a \<cdot> t)) \<cdot> (L - s $ 1) \<le> Tmax))))
[PROOF STEP]
using temp_dyn_up_real_arith[OF assms(1) _ _ assms(3), of Tmin]
    and temp_dyn_down_real_arith[OF assms(1,2), of _ Tmax]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>Tmin \<le> ?T; ?T \<le> Tmax; 0 \<le> ?t; \<forall>\<tau>\<in>{0..?t}. \<tau> \<le> - (ln ((L - Tmax) / (L - ?T)) / a)\<rbrakk> \<Longrightarrow> L - Tmax \<le> exp (- (a \<cdot> ?t)) \<cdot> (L - ?T)
\<lbrakk>Tmin \<le> ?T; ?T \<le> Tmax; 0 \<le> ?t; \<forall>\<tau>\<in>{0..?t}. \<tau> \<le> - (ln ((L - Tmax) / (L - ?T)) / a)\<rbrakk> \<Longrightarrow> L - exp (- (a \<cdot> ?t)) \<cdot> (L - ?T) \<le> Tmax
\<lbrakk>Tmin \<le> ?T; ?T \<le> Tmax; 0 \<le> ?t; \<forall>\<tau>\<in>{0..?t}. \<tau> \<le> - (ln ((L - Tmax) / (L - ?T)) / a)\<rbrakk> \<Longrightarrow> Tmin \<le> L - exp (- (a \<cdot> ?t)) \<cdot> (L - ?T)
\<lbrakk>Tmin \<le> ?T; ?T \<le> Tmax; 0 \<le> ?t; \<forall>\<tau>\<in>{0..?t}. \<tau> \<le> - (ln (Tmin / ?T) / a)\<rbrakk> \<Longrightarrow> Tmin \<le> exp (- a \<cdot> ?t) \<cdot> ?T
\<lbrakk>Tmin \<le> ?T; ?T \<le> Tmax; 0 \<le> ?t; \<forall>\<tau>\<in>{0..?t}. \<tau> \<le> - (ln (Tmin / ?T) / a)\<rbrakk> \<Longrightarrow> exp (- a \<cdot> ?t) \<cdot> ?T \<le> Tmax

goal (1 subgoal):
 1. \<forall>s. Tmin \<le> s $ 1 \<and> s $ 1 \<le> Tmax \<and> (s $ 4 = 0 \<or> s $ 4 = 1) \<longrightarrow> (s $ 4 = 0 \<longrightarrow> s $ 1 \<le> Tmin + 1 \<longrightarrow> (\<forall>t\<ge>0. (\<forall>\<tau>. 0 \<le> \<tau> \<and> \<tau> \<le> t \<longrightarrow> \<tau> \<le> - (ln ((L - Tmax) / (L - s $ 1)) / a)) \<longrightarrow> Tmin \<le> L - exp (- (a \<cdot> t)) \<cdot> (L - s $ 1) \<and> L - exp (- (a \<cdot> t)) \<cdot> (L - s $ 1) \<le> Tmax)) \<and> (s $ 4 = 0 \<and> s $ 1 \<le> Tmin + 1 \<or> (s $ 4 = 1 \<longrightarrow> Tmax - 1 \<le> s $ 1 \<longrightarrow> (\<forall>t\<ge>0. (\<forall>\<tau>. 0 \<le> \<tau> \<and> \<tau> \<le> t \<longrightarrow> \<tau> \<le> - (ln (Tmin / s $ 1) / a)) \<longrightarrow> Tmin \<le> exp (- (a \<cdot> t)) \<cdot> s $ 1 \<and> exp (- (a \<cdot> t)) \<cdot> s $ 1 \<le> Tmax)) \<and> (s $ 4 = 1 \<and> Tmax - 1 \<le> s $ 1 \<or> (s $ 4 = 0 \<longrightarrow> (\<forall>t\<ge>0. (\<forall>\<tau>. 0 \<le> \<tau> \<and> \<tau> \<le> t \<longrightarrow> \<tau> \<le> - (ln (Tmin / s $ 1) / a)) \<longrightarrow> Tmin \<le> exp (- (a \<cdot> t)) \<cdot> s $ 1 \<and> exp (- (a \<cdot> t)) \<cdot> s $ 1 \<le> Tmax)) \<and> (s $ 4 = 0 \<or> (\<forall>t\<ge>0. (\<forall>\<tau>. 0 \<le> \<tau> \<and> \<tau> \<le> t \<longrightarrow> \<tau> \<le> - (ln ((L - Tmax) / (L - s $ 1)) / a)) \<longrightarrow> Tmin \<le> L - exp (- (a \<cdot> t)) \<cdot> (L - s $ 1) \<and> L - exp (- (a \<cdot> t)) \<cdot> (L - s $ 1) \<le> Tmax))))
[PROOF STEP]
by auto


[STATEMENT]
lemma llist_all2_inf_llist [simp]:
  "llist_all2 P (inf_llist f) (inf_llist g) \<longleftrightarrow> (\<forall>n. P (f n) (g n))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. llist_all2 P (inf_llist f) (inf_llist g) = (\<forall>n. P (f n) (g n))
[PROOF STEP]
by(simp add: llist_all2_conv_lzip)


[STATEMENT]
lemma nested_prop_atoms_finite:
  "finite {Abs \<psi> | \<psi>. nested_prop_atoms \<psi> \<subseteq> nested_prop_atoms \<phi>}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. finite {Abs \<psi> |\<psi>. nested_prop_atoms \<psi> \<subseteq> nested_prop_atoms \<phi>}
[PROOF STEP]
using equiv_finite'[OF Equivalence_Relations.nested_prop_atoms_finite]
[PROOF STATE]
proof (prove)
using this:
finite {Abs \<psi> |\<psi>. nested_prop_atoms \<psi> \<subseteq> nested_prop_atoms ?\<phi>1}

goal (1 subgoal):
 1. finite {Abs \<psi> |\<psi>. nested_prop_atoms \<psi> \<subseteq> nested_prop_atoms \<phi>}
[PROOF STEP]
.


[STATEMENT]
lemma mset_rev: "queue_to_multiset (rev q) = queue_to_multiset q"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. queue_to_multiset (rev q) = queue_to_multiset q
[PROOF STEP]
by (induct q) (auto simp add: union_ac)


[STATEMENT]
lemma sum_less_suminf: "summable f \<Longrightarrow> (\<And>m. m\<ge>n \<Longrightarrow> 0 < f m) \<Longrightarrow> sum f {..<n} < suminf f"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>summable f; \<And>m. n \<le> m \<Longrightarrow> (0::'a) < f m\<rbrakk> \<Longrightarrow> sum f {..<n} < suminf f
[PROOF STEP]
using sum_less_suminf2[of n n]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>summable f; \<And>m. n \<le> m \<Longrightarrow> (0::'a) \<le> f m; n \<le> n; (0::'a) < f n\<rbrakk> \<Longrightarrow> sum f {..<n} < suminf f

goal (1 subgoal):
 1. \<lbrakk>summable f; \<And>m. n \<le> m \<Longrightarrow> (0::'a) < f m\<rbrakk> \<Longrightarrow> sum f {..<n} < suminf f
[PROOF STEP]
by (simp add: less_imp_le)


[STATEMENT]
lemma isDERIV_inner_iff:
  assumes "length xs = length ys"
  shows "isDERIV i (inner_floatariths xs ys) vs \<longleftrightarrow>
    (\<forall>k < length xs. isDERIV i (xs ! k) vs) \<and> (\<forall>k < length ys. isDERIV i (ys ! k) vs)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. isDERIV i (inner_floatariths xs ys) vs = ((\<forall>k<length xs. isDERIV i (xs ! k) vs) \<and> (\<forall>k<length ys. isDERIV i (ys ! k) vs))
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
length xs = length ys

goal (1 subgoal):
 1. isDERIV i (inner_floatariths xs ys) vs = ((\<forall>k<length xs. isDERIV i (xs ! k) vs) \<and> (\<forall>k<length ys. isDERIV i (ys ! k) vs))
[PROOF STEP]
by (induction xs ys rule: list_induct2) (auto simp: nth_Cons split: nat.splits)


[STATEMENT]
theorem while_rule2:
  "[| P s;
      !!s. [| P s; b s  |] ==> P (c s) \<and> (c s, s) \<in> r;
      !!s. [| P s; \<not> b s  |] ==> Q s;
      wf r |] ==>
   Q (while b c s)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>P s; \<And>s. \<lbrakk>P s; b s\<rbrakk> \<Longrightarrow> P (c s) \<and> (c s, s) \<in> r; \<And>s. \<lbrakk>P s; \<not> b s\<rbrakk> \<Longrightarrow> Q s; wf r\<rbrakk> \<Longrightarrow> Q (while b c s)
[PROOF STEP]
using while_rule[of P]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>P ?s; \<And>s. \<lbrakk>P s; ?b s\<rbrakk> \<Longrightarrow> P (?c s); \<And>s. \<lbrakk>P s; \<not> ?b s\<rbrakk> \<Longrightarrow> ?Q s; wf ?r; \<And>s. \<lbrakk>P s; ?b s\<rbrakk> \<Longrightarrow> (?c s, s) \<in> ?r\<rbrakk> \<Longrightarrow> ?Q (while ?b ?c ?s)

goal (1 subgoal):
 1. \<lbrakk>P s; \<And>s. \<lbrakk>P s; b s\<rbrakk> \<Longrightarrow> P (c s) \<and> (c s, s) \<in> r; \<And>s. \<lbrakk>P s; \<not> b s\<rbrakk> \<Longrightarrow> Q s; wf r\<rbrakk> \<Longrightarrow> Q (while b c s)
[PROOF STEP]
by metis


[STATEMENT]
theorem HEndPhase0_valueChosen:
  assumes act: "HEndPhase0 s s' q"
  and vc: "valueChosen s v"
  and v_input: "v \<in> Inputs"
  and inv1: "Inv1 s"
  shows "valueChosen s' v"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. valueChosen s' v
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. valueChosen s' v
[PROOF STEP]
from vc
[PROOF STATE]
proof (chain)
picking this:
valueChosen s v
[PROOF STEP]
obtain b p D where
        asm1: "b \<in> (UN p. Ballot p)"
    and asm2: "D\<in>MajoritySet"
    and asm3: "maxBalInp s b v"
    and asm4: "\<forall>d\<in>D.  b \<le> bal(disk s d p)
                   \<and>(\<forall>q.(   phase s q = 1
                          \<and> b \<le>mbal(dblock s q)
                          \<and> hasRead s q d p
                         ) \<longrightarrow> (\<exists>br\<in>blocksRead s q d. b \<le> bal(block br)))"
[PROOF STATE]
proof (prove)
using this:
valueChosen s v

goal (1 subgoal):
 1. (\<And>b D p. \<lbrakk>b \<in> \<Union> (range Ballot); D \<in> MajoritySet; maxBalInp s b v; \<forall>d\<in>D. b \<le> bal (disk s d p) \<and> (\<forall>q. phase s q = 1 \<and> b \<le> mbal (dblock s q) \<and> hasRead s q d p \<longrightarrow> (\<exists>br\<in>blocksRead s q d. b \<le> bal (block br)))\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by(auto simp add: valueChosen_def)
[PROOF STATE]
proof (state)
this:
b \<in> \<Union> (range Ballot)
D \<in> MajoritySet
maxBalInp s b v
\<forall>d\<in>D. b \<le> bal (disk s d p) \<and> (\<forall>q. phase s q = 1 \<and> b \<le> mbal (dblock s q) \<and> hasRead s q d p \<longrightarrow> (\<exists>br\<in>blocksRead s q d. b \<le> bal (block br)))

goal (1 subgoal):
 1. valueChosen s' v
[PROOF STEP]
from HEndPhase0_maxBalInp[OF act asm3 inv1]
[PROOF STATE]
proof (chain)
picking this:
maxBalInp s' b v
[PROOF STEP]
have "maxBalInp s' b v"
[PROOF STATE]
proof (prove)
using this:
maxBalInp s' b v

goal (1 subgoal):
 1. maxBalInp s' b v
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
maxBalInp s' b v

goal (1 subgoal):
 1. valueChosen s' v
[PROOF STEP]
with HEndPhase0_valueChosen2[OF act asm4] asm1 asm2
[PROOF STATE]
proof (chain)
picking this:
\<forall>d\<in>D. b \<le> bal (disk s' d p) \<and> (\<forall>q. phase s' q = 1 \<and> b \<le> mbal (dblock s' q) \<and> hasRead s' q d p \<longrightarrow> (\<exists>br\<in>blocksRead s' q d. b \<le> bal (block br)))
b \<in> \<Union> (range Ballot)
D \<in> MajoritySet
maxBalInp s' b v
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<forall>d\<in>D. b \<le> bal (disk s' d p) \<and> (\<forall>q. phase s' q = 1 \<and> b \<le> mbal (dblock s' q) \<and> hasRead s' q d p \<longrightarrow> (\<exists>br\<in>blocksRead s' q d. b \<le> bal (block br)))
b \<in> \<Union> (range Ballot)
D \<in> MajoritySet
maxBalInp s' b v

goal (1 subgoal):
 1. valueChosen s' v
[PROOF STEP]
by(auto simp add: valueChosen_def)
[PROOF STATE]
proof (state)
this:
valueChosen s' v

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma distinct_rels_alt':
  "distinct_relations t \<longleftrightarrow> (let multi=relations_mset t in \<forall>x\<in># multi. count multi x = 1)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. distinct_relations t = (let multi = relations_mset t in \<forall>x\<in>#multi. count multi x = 1)
[PROOF STEP]
using distinct_relations_def inorder_eq_mset distinct_alt
[PROOF STATE]
proof (prove)
using this:
distinct_relations ?t = distinct (inorder ?t)
mset (inorder ?t) = relations_mset ?t
(\<forall>x\<in>#mset ?xs. count (mset ?xs) x = 1) = distinct ?xs

goal (1 subgoal):
 1. distinct_relations t = (let multi = relations_mset t in \<forall>x\<in>#multi. count multi x = 1)
[PROOF STEP]
by metis


[STATEMENT]
lemma UINF_alt_def:
  "(\<Sqinter> i | A(i) \<bullet> P(i)) = (\<Sqinter> i \<bullet> A(i) \<and> P(i))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. UINF A P = (\<Sqinter> i \<bullet> A i \<and> P i)
[PROOF STEP]
by (rel_auto)


[STATEMENT]
lemma gather_start [no_atp]: "(\<exists>x. P x) \<equiv> (\<exists>x. (\<forall>y \<in> {}. y < x) \<and> (\<forall>y\<in> {}. x < y) \<and> P x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>x. P x \<equiv> \<exists>x. (\<forall>y\<in>{}. y < x) \<and> (\<forall>y\<in>{}. x < y) \<and> P x
[PROOF STEP]
by simp


[STATEMENT]
lemma dghm_dag_Rel_ArrMap_app_vrange[dg_cs_simps]:
  assumes "T : A \<mapsto>\<^bsub>dg_Rel \<alpha>\<^esub> B"
  shows "\<R>\<^sub>\<circ> (\<dagger>\<^sub>D\<^sub>G\<^sub>.\<^sub>R\<^sub>e\<^sub>l \<alpha>\<lparr>ArrMap\<rparr>\<lparr>T\<rparr>\<lparr>ArrVal\<rparr>) = \<D>\<^sub>\<circ> (T\<lparr>ArrVal\<rparr>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<R>\<^sub>\<circ> (\<dagger>\<^sub>D\<^sub>G\<^sub>.\<^sub>R\<^sub>e\<^sub>l \<alpha>\<lparr>ArrMap\<rparr>\<lparr>T\<rparr>\<lparr>ArrVal\<rparr>) = \<D>\<^sub>\<circ> (T\<lparr>ArrVal\<rparr>)
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<R>\<^sub>\<circ> (\<dagger>\<^sub>D\<^sub>G\<^sub>.\<^sub>R\<^sub>e\<^sub>l \<alpha>\<lparr>ArrMap\<rparr>\<lparr>T\<rparr>\<lparr>ArrVal\<rparr>) = \<D>\<^sub>\<circ> (T\<lparr>ArrVal\<rparr>)
[PROOF STEP]
from assms
[PROOF STATE]
proof (chain)
picking this:
T : A \<mapsto>\<^bsub>dg_Rel \<alpha>\<^esub> B
[PROOF STEP]
interpret T: arr_Rel \<alpha> T
[PROOF STATE]
proof (prove)
using this:
T : A \<mapsto>\<^bsub>dg_Rel \<alpha>\<^esub> B

goal (1 subgoal):
 1. arr_Rel \<alpha> T
[PROOF STEP]
by (simp add: dg_Rel_is_arrD)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<R>\<^sub>\<circ> (\<dagger>\<^sub>D\<^sub>G\<^sub>.\<^sub>R\<^sub>e\<^sub>l \<alpha>\<lparr>ArrMap\<rparr>\<lparr>T\<rparr>\<lparr>ArrVal\<rparr>) = \<D>\<^sub>\<circ> (T\<lparr>ArrVal\<rparr>)
[PROOF STEP]
from dg_Rel_is_arrD(1)[OF assms]
[PROOF STATE]
proof (chain)
picking this:
arr_Rel \<alpha> T
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
arr_Rel \<alpha> T

goal (1 subgoal):
 1. \<R>\<^sub>\<circ> (\<dagger>\<^sub>D\<^sub>G\<^sub>.\<^sub>R\<^sub>e\<^sub>l \<alpha>\<lparr>ArrMap\<rparr>\<lparr>T\<rparr>\<lparr>ArrVal\<rparr>) = \<D>\<^sub>\<circ> (T\<lparr>ArrVal\<rparr>)
[PROOF STEP]
by (cs_concl cs_simp: dg_Rel_cs_simps V_cs_simps converse_Rel_components(1))
[PROOF STATE]
proof (state)
this:
\<R>\<^sub>\<circ> (\<dagger>\<^sub>D\<^sub>G\<^sub>.\<^sub>R\<^sub>e\<^sub>l \<alpha>\<lparr>ArrMap\<rparr>\<lparr>T\<rparr>\<lparr>ArrVal\<rparr>) = \<D>\<^sub>\<circ> (T\<lparr>ArrVal\<rparr>)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma Re_stereographic:
  shows "Re (2 * z / (1 + z * cnj z)) = 2 * Re z / (1 + (cmod z)\<^sup>2)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Re (2 * z / (1 + z * cnj z)) = 2 * Re z / (1 + (cmod z)\<^sup>2)
[PROOF STEP]
using one_plus_square_neq_zero
[PROOF STATE]
proof (prove)
using this:
1 + (cor ?x)\<^sup>2 \<noteq> 0

goal (1 subgoal):
 1. Re (2 * z / (1 + z * cnj z)) = 2 * Re z / (1 + (cmod z)\<^sup>2)
[PROOF STEP]
by (subst complex_mult_cnj_cmod, subst Re_divide_real) (auto simp add: power2_eq_square)


[STATEMENT]
lemma Joints_imp_length_eq: "xs \<in> Joints XS \<Longrightarrow> length xs = length XS"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. xs \<in> Joints XS \<Longrightarrow> length xs = length XS
[PROOF STEP]
by (auto simp: Joints_def valuate_def)


[STATEMENT]
lemma exp_fdiffs:
  "diffs (\<lambda>n. inverse (fact n)) = (\<lambda>n. inverse (fact n :: 'a::{real_normed_field,banach}))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. diffs (\<lambda>n. inverse (fact n)) = (\<lambda>n. inverse (fact n))
[PROOF STEP]
by (simp add: diffs_def mult_ac nonzero_inverse_mult_distrib nonzero_of_real_inverse
      del: mult_Suc of_nat_Suc)


[STATEMENT]
lemma finite_vars_of_a_eq :
  assumes "finite (Aexp.vars e1)"
  assumes "finite (Aexp.vars e2)"
  shows   "finite (vars (\<lambda> \<sigma>. e1 \<sigma> = e2 \<sigma>))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. finite (Bexp.vars (\<lambda>\<sigma>. e1 \<sigma> = e2 \<sigma>))
[PROOF STEP]
using assms vars_of_eq_a[of e1 e2]
[PROOF STATE]
proof (prove)
using this:
finite (Aexp.vars e1)
finite (Aexp.vars e2)
Bexp.vars (\<lambda>\<sigma>. e1 \<sigma> = e2 \<sigma>) \<subseteq> Aexp.vars e1 \<union> Aexp.vars e2

goal (1 subgoal):
 1. finite (Bexp.vars (\<lambda>\<sigma>. e1 \<sigma> = e2 \<sigma>))
[PROOF STEP]
by (rule_tac rev_finite_subset, auto)


[STATEMENT]
lemma sort_mergesort_by_rel:
  "sort = mergesort_by_rel (\<le>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. sort = mergesort_by_rel (\<le>)
[PROOF STEP]
apply (rule ext, rule properties_for_sort)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>x. mset (mergesort_by_rel (\<le>) x) = mset x
 2. \<And>x. sorted (mergesort_by_rel (\<le>) x)
[PROOF STEP]
apply(simp_all add: sorted_mergesort_by_rel)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma suc_not_zero:
  assumes "to_nat a + 1 \<noteq> CARD('a)"
  shows "a+1 \<noteq> 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. a + (1::'a) \<noteq> (0::'a)
[PROOF STEP]
proof (rule ccontr, simp)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. a + (1::'a) = (0::'a) \<Longrightarrow> False
[PROOF STEP]
assume a_plus_one_zero: "a + 1 = 0"
[PROOF STATE]
proof (state)
this:
a + (1::'a) = (0::'a)

goal (1 subgoal):
 1. a + (1::'a) = (0::'a) \<Longrightarrow> False
[PROOF STEP]
hence rep_eq_card: "Rep a + 1 = CARD('a)"
[PROOF STATE]
proof (prove)
using this:
a + (1::'a) = (0::'a)

goal (1 subgoal):
 1. Rep a + 1 = int CARD('a)
[PROOF STEP]
using assms to_nat_0 Suc_eq_plus1 Suc_lessI Zero_not_Suc to_nat_less_card to_nat_suc
[PROOF STATE]
proof (prove)
using this:
a + (1::'a) = (0::'a)
mod_type_class.to_nat a + 1 \<noteq> CARD('a)
mod_type_class.to_nat (0::'a) = 0
Suc ?n = ?n + 1
\<lbrakk>?m < ?n; Suc ?m \<noteq> ?n\<rbrakk> \<Longrightarrow> Suc ?m < ?n
0 \<noteq> Suc ?m
mod_type_class.to_nat ?j < CARD('a)
mod_type_class.to_nat ?x + 1 < CARD('a) \<Longrightarrow> mod_type_class.to_nat (?x + (1::'a)) = mod_type_class.to_nat ?x + 1

goal (1 subgoal):
 1. Rep a + 1 = int CARD('a)
[PROOF STEP]
by (metis (opaque_lifting, mono_tags))
[PROOF STATE]
proof (state)
this:
Rep a + 1 = int CARD('a)

goal (1 subgoal):
 1. a + (1::'a) = (0::'a) \<Longrightarrow> False
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
Rep a + 1 = int CARD('a)

goal (1 subgoal):
 1. a + (1::'a) = (0::'a) \<Longrightarrow> False
[PROOF STEP]
have "Rep a + 1 < CARD('a)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Rep a + 1 < int CARD('a)
[PROOF STEP]
using Abs'_0 Rep_1 Suc_eq_plus1 Suc_lessI Suc_neq_Zero add_def' assms
    rep_eq_card to_nat_0 to_nat_less_card to_nat_suc
[PROOF STATE]
proof (prove)
using this:
Abs' (int CARD('a)) = (0::'a)
Rep (1::'a) = 1
Suc ?n = ?n + 1
\<lbrakk>?m < ?n; Suc ?m \<noteq> ?n\<rbrakk> \<Longrightarrow> Suc ?m < ?n
Suc ?m = 0 \<Longrightarrow> ?R
?x + ?y = Abs' (Rep ?x + Rep ?y)
mod_type_class.to_nat a + 1 \<noteq> CARD('a)
Rep a + 1 = int CARD('a)
mod_type_class.to_nat (0::'a) = 0
mod_type_class.to_nat ?j < CARD('a)
mod_type_class.to_nat ?x + 1 < CARD('a) \<Longrightarrow> mod_type_class.to_nat (?x + (1::'a)) = mod_type_class.to_nat ?x + 1

goal (1 subgoal):
 1. Rep a + 1 < int CARD('a)
[PROOF STEP]
by (metis (opaque_lifting, mono_tags))
[PROOF STATE]
proof (state)
this:
Rep a + 1 < int CARD('a)

goal (1 subgoal):
 1. a + (1::'a) = (0::'a) \<Longrightarrow> False
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
Rep a + 1 = int CARD('a)
Rep a + 1 < int CARD('a)
[PROOF STEP]
show False
[PROOF STATE]
proof (prove)
using this:
Rep a + 1 = int CARD('a)
Rep a + 1 < int CARD('a)

goal (1 subgoal):
 1. False
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
False

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma map_plus[simp]: "map (plus n) [i ..< j] = [i + n ..< j + n]"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. map ((+) n) [i..<j] = [i + n..<j + n]
[PROOF STEP]
proof (induct n)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. map ((+) 0) [i..<j] = [i + 0..<j + 0]
 2. \<And>n. map ((+) n) [i..<j] = [i + n..<j + n] \<Longrightarrow> map ((+) (Suc n)) [i..<j] = [i + Suc n..<j + Suc n]
[PROOF STEP]
case 0
[PROOF STATE]
proof (state)
this:

goal (2 subgoals):
 1. map ((+) 0) [i..<j] = [i + 0..<j + 0]
 2. \<And>n. map ((+) n) [i..<j] = [i + n..<j + n] \<Longrightarrow> map ((+) (Suc n)) [i..<j] = [i + Suc n..<j + Suc n]
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. map ((+) 0) [i..<j] = [i + 0..<j + 0]
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
map ((+) 0) [i..<j] = [i + 0..<j + 0]

goal (1 subgoal):
 1. \<And>n. map ((+) n) [i..<j] = [i + n..<j + n] \<Longrightarrow> map ((+) (Suc n)) [i..<j] = [i + Suc n..<j + Suc n]
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>n. map ((+) n) [i..<j] = [i + n..<j + n] \<Longrightarrow> map ((+) (Suc n)) [i..<j] = [i + Suc n..<j + Suc n]
[PROOF STEP]
case (Suc n)
[PROOF STATE]
proof (state)
this:
map ((+) n) [i..<j] = [i + n..<j + n]

goal (1 subgoal):
 1. \<And>n. map ((+) n) [i..<j] = [i + n..<j + n] \<Longrightarrow> map ((+) (Suc n)) [i..<j] = [i + Suc n..<j + Suc n]
[PROOF STEP]
have "map (plus (Suc n)) [i ..< j] = map (Suc \<circ> plus n) [i ..< j]"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. map ((+) (Suc n)) [i..<j] = map (Suc \<circ> (+) n) [i..<j]
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
map ((+) (Suc n)) [i..<j] = map (Suc \<circ> (+) n) [i..<j]

goal (1 subgoal):
 1. \<And>n. map ((+) n) [i..<j] = [i + n..<j + n] \<Longrightarrow> map ((+) (Suc n)) [i..<j] = [i + Suc n..<j + Suc n]
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
map ((+) (Suc n)) [i..<j] = map (Suc \<circ> (+) n) [i..<j]

goal (1 subgoal):
 1. \<And>n. map ((+) n) [i..<j] = [i + n..<j + n] \<Longrightarrow> map ((+) (Suc n)) [i..<j] = [i + Suc n..<j + Suc n]
[PROOF STEP]
have "\<dots> = (map Suc \<circ> map (plus n)) [i ..< j]"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. map (Suc \<circ> (+) n) [i..<j] = (map Suc \<circ> map ((+) n)) [i..<j]
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
map (Suc \<circ> (+) n) [i..<j] = (map Suc \<circ> map ((+) n)) [i..<j]

goal (1 subgoal):
 1. \<And>n. map ((+) n) [i..<j] = [i + n..<j + n] \<Longrightarrow> map ((+) (Suc n)) [i..<j] = [i + Suc n..<j + Suc n]
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
map (Suc \<circ> (+) n) [i..<j] = (map Suc \<circ> map ((+) n)) [i..<j]

goal (1 subgoal):
 1. \<And>n. map ((+) n) [i..<j] = [i + n..<j + n] \<Longrightarrow> map ((+) (Suc n)) [i..<j] = [i + Suc n..<j + Suc n]
[PROOF STEP]
have "\<dots> = map Suc (map (plus n) [i ..< j])"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (map Suc \<circ> map ((+) n)) [i..<j] = map Suc (map ((+) n) [i..<j])
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
(map Suc \<circ> map ((+) n)) [i..<j] = map Suc (map ((+) n) [i..<j])

goal (1 subgoal):
 1. \<And>n. map ((+) n) [i..<j] = [i + n..<j + n] \<Longrightarrow> map ((+) (Suc n)) [i..<j] = [i + Suc n..<j + Suc n]
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(map Suc \<circ> map ((+) n)) [i..<j] = map Suc (map ((+) n) [i..<j])

goal (1 subgoal):
 1. \<And>n. map ((+) n) [i..<j] = [i + n..<j + n] \<Longrightarrow> map ((+) (Suc n)) [i..<j] = [i + Suc n..<j + Suc n]
[PROOF STEP]
have "\<dots> = map Suc [i + n ..< j + n]"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. map Suc (map ((+) n) [i..<j]) = map Suc [i + n..<j + n]
[PROOF STEP]
unfolding Suc
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. map Suc [i + n..<j + n] = map Suc [i + n..<j + n]
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
map Suc (map ((+) n) [i..<j]) = map Suc [i + n..<j + n]

goal (1 subgoal):
 1. \<And>n. map ((+) n) [i..<j] = [i + n..<j + n] \<Longrightarrow> map ((+) (Suc n)) [i..<j] = [i + Suc n..<j + Suc n]
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
map Suc (map ((+) n) [i..<j]) = map Suc [i + n..<j + n]

goal (1 subgoal):
 1. \<And>n. map ((+) n) [i..<j] = [i + n..<j + n] \<Longrightarrow> map ((+) (Suc n)) [i..<j] = [i + Suc n..<j + Suc n]
[PROOF STEP]
have "\<dots> = [Suc (i + n) ..< Suc (j + n)]"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. map Suc [i + n..<j + n] = [Suc (i + n)..<Suc (j + n)]
[PROOF STEP]
unfolding map_Suc_upt
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. [Suc (i + n)..<Suc (j + n)] = [Suc (i + n)..<Suc (j + n)]
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
map Suc [i + n..<j + n] = [Suc (i + n)..<Suc (j + n)]

goal (1 subgoal):
 1. \<And>n. map ((+) n) [i..<j] = [i + n..<j + n] \<Longrightarrow> map ((+) (Suc n)) [i..<j] = [i + Suc n..<j + Suc n]
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
map Suc [i + n..<j + n] = [Suc (i + n)..<Suc (j + n)]

goal (1 subgoal):
 1. \<And>n. map ((+) n) [i..<j] = [i + n..<j + n] \<Longrightarrow> map ((+) (Suc n)) [i..<j] = [i + Suc n..<j + Suc n]
[PROOF STEP]
have "\<dots> = [i + Suc n ..< j + Suc n]"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. [Suc (i + n)..<Suc (j + n)] = [i + Suc n..<j + Suc n]
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
[Suc (i + n)..<Suc (j + n)] = [i + Suc n..<j + Suc n]

goal (1 subgoal):
 1. \<And>n. map ((+) n) [i..<j] = [i + n..<j + n] \<Longrightarrow> map ((+) (Suc n)) [i..<j] = [i + Suc n..<j + Suc n]
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
map ((+) (Suc n)) [i..<j] = [i + Suc n..<j + Suc n]
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
map ((+) (Suc n)) [i..<j] = [i + Suc n..<j + Suc n]

goal (1 subgoal):
 1. map ((+) (Suc n)) [i..<j] = [i + Suc n..<j + Suc n]
[PROOF STEP]
by this
[PROOF STATE]
proof (state)
this:
map ((+) (Suc n)) [i..<j] = [i + Suc n..<j + Suc n]

goal:
No subgoals!
[PROOF STEP]
qed