[STATEMENT]
lemma matrix_to_iarray_snd_Gauss_Jordan_det_P:
shows "matrix_to_iarray (snd (Gauss_Jordan_det_P A)) = snd (Gauss_Jordan_det_P_iarrays (matrix_to_iarray A))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. matrix_to_iarray (snd (Gauss_Jordan_det_P A)) = snd (Gauss_Jordan_det_P_iarrays (matrix_to_iarray A))
[PROOF STEP]
unfolding Gauss_Jordan_det_P_def Gauss_Jordan_det_P_iarrays_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. matrix_to_iarray (snd (Gauss_Jordan_upt_k_det_P A (ncols A - 1))) = snd (Gauss_Jordan_upt_k_det_P_iarrays (matrix_to_iarray A) (ncols_iarray (matrix_to_iarray A) - 1))
[PROOF STEP]
using matrix_to_iarray_snd_Gauss_Jordan_upt_k_det_P
[PROOF STATE]
proof (prove)
using this:
?k < ncols ?A \<Longrightarrow> matrix_to_iarray (snd (Gauss_Jordan_upt_k_det_P ?A ?k)) = snd (Gauss_Jordan_upt_k_det_P_iarrays (matrix_to_iarray ?A) ?k)

goal (1 subgoal):
 1. matrix_to_iarray (snd (Gauss_Jordan_upt_k_det_P A (ncols A - 1))) = snd (Gauss_Jordan_upt_k_det_P_iarrays (matrix_to_iarray A) (ncols_iarray (matrix_to_iarray A) - 1))
[PROOF STEP]
by (metis diff_less matrix_to_iarray_ncols ncols_not_0 neq0_conv zero_less_one)


[STATEMENT]
lemma prime_card_int: "prime (int (CARD('a)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. prime (int CARD('a))
[PROOF STEP]
using prime_card
[PROOF STATE]
proof (prove)
using this:
prime CARD('a)

goal (1 subgoal):
 1. prime (int CARD('a))
[PROOF STEP]
by auto


[STATEMENT]
lemma "((x::real) + z \<le> y + z) = (x \<le> y)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (x + z \<le> y + z) = (x \<le> y)
[PROOF STEP]
by arith


[STATEMENT]
lemma splitqsallg: "Strat \<noteq> [] \<Longrightarrow> a \<in> {x,y} \<Longrightarrow>
         t\<^sub>p [x, y] a (hd (Strat)) +
          (let L=step [x,y] a (hd (Strat))
              in T\<^sub>p L (rest1) (tl Strat)) =  T\<^sub>p [x, y] (a # rest1) Strat"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Strat \<noteq> []; a \<in> {x, y}\<rbrakk> \<Longrightarrow> t\<^sub>p [x, y] a (hd Strat) + (let L = step [x, y] a (hd Strat) in T\<^sub>p L rest1 (tl Strat)) = T\<^sub>p [x, y] (a # rest1) Strat
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>Strat \<noteq> []; a \<in> {x, y}\<rbrakk> \<Longrightarrow> t\<^sub>p [x, y] a (hd Strat) + (let L = step [x, y] a (hd Strat) in T\<^sub>p L rest1 (tl Strat)) = T\<^sub>p [x, y] (a # rest1) Strat
[PROOF STEP]
assume ne: "Strat \<noteq> []"
[PROOF STATE]
proof (state)
this:
Strat \<noteq> []

goal (1 subgoal):
 1. \<lbrakk>Strat \<noteq> []; a \<in> {x, y}\<rbrakk> \<Longrightarrow> t\<^sub>p [x, y] a (hd Strat) + (let L = step [x, y] a (hd Strat) in T\<^sub>p L rest1 (tl Strat)) = T\<^sub>p [x, y] (a # rest1) Strat
[PROOF STEP]
assume axy: "a \<in> {x,y}"
[PROOF STATE]
proof (state)
this:
a \<in> {x, y}

goal (1 subgoal):
 1. \<lbrakk>Strat \<noteq> []; a \<in> {x, y}\<rbrakk> \<Longrightarrow> t\<^sub>p [x, y] a (hd Strat) + (let L = step [x, y] a (hd Strat) in T\<^sub>p L rest1 (tl Strat)) = T\<^sub>p [x, y] (a # rest1) Strat
[PROOF STEP]
(* not needed *)
[PROOF STATE]
proof (state)
this:
a \<in> {x, y}

goal (1 subgoal):
 1. \<lbrakk>Strat \<noteq> []; a \<in> {x, y}\<rbrakk> \<Longrightarrow> t\<^sub>p [x, y] a (hd Strat) + (let L = step [x, y] a (hd Strat) in T\<^sub>p L rest1 (tl Strat)) = T\<^sub>p [x, y] (a # rest1) Strat
[PROOF STEP]
have "T\<^sub>p [x, y] (a # rest1) (Strat)
        = T\<^sub>p [x, y] (a # rest1) ((hd (Strat)) # (tl (Strat)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. T\<^sub>p [x, y] (a # rest1) Strat = T\<^sub>p [x, y] (a # rest1) (hd Strat # tl Strat)
[PROOF STEP]
by(simp only: List.list.collapse[OF ne])
[PROOF STATE]
proof (state)
this:
T\<^sub>p [x, y] (a # rest1) Strat = T\<^sub>p [x, y] (a # rest1) (hd Strat # tl Strat)

goal (1 subgoal):
 1. \<lbrakk>Strat \<noteq> []; a \<in> {x, y}\<rbrakk> \<Longrightarrow> t\<^sub>p [x, y] a (hd Strat) + (let L = step [x, y] a (hd Strat) in T\<^sub>p L rest1 (tl Strat)) = T\<^sub>p [x, y] (a # rest1) Strat
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
T\<^sub>p [x, y] (a # rest1) Strat = T\<^sub>p [x, y] (a # rest1) (hd Strat # tl Strat)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
T\<^sub>p [x, y] (a # rest1) Strat = T\<^sub>p [x, y] (a # rest1) (hd Strat # tl Strat)

goal (1 subgoal):
 1. t\<^sub>p [x, y] a (hd Strat) + (let L = step [x, y] a (hd Strat) in T\<^sub>p L rest1 (tl Strat)) = T\<^sub>p [x, y] (a # rest1) Strat
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
t\<^sub>p [x, y] a (hd Strat) + (let L = step [x, y] a (hd Strat) in T\<^sub>p L rest1 (tl Strat)) = T\<^sub>p [x, y] (a # rest1) Strat

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma is_semialg_map_closed':
  assumes "is_semialg_map m n f" "x \<in> carrier (Q\<^sub>p\<^bsup>m\<^esup>)"
  shows "f x \<in>  carrier (Q\<^sub>p\<^bsup>n\<^esup>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. f x \<in> carrier (Q\<^sub>p\<^bsup>n\<^esup>)
[PROOF STEP]
using is_semialg_map_def assms
[PROOF STATE]
proof (prove)
using this:
is_semialg_map ?m ?n ?f = (?f \<in> carrier (Q\<^sub>p\<^bsup>?m\<^esup>) \<rightarrow> carrier (Q\<^sub>p\<^bsup>?n\<^esup>) \<and> (\<forall>l\<ge>0. \<forall>S\<in>semialg_sets (?n + l). is_semialgebraic (?m + l) (map_partial_pullback ?m ?f l S)))
is_semialg_map m n f
x \<in> carrier (Q\<^sub>p\<^bsup>m\<^esup>)

goal (1 subgoal):
 1. f x \<in> carrier (Q\<^sub>p\<^bsup>n\<^esup>)
[PROOF STEP]
by blast


[STATEMENT]
lemma K_cfg_same_loc_iff:
  "(\<forall>cfg'\<in> K_cfg cfg. fst (state cfg') = fst (state cfg))
  \<longleftrightarrow> (\<forall>cfg'\<in> K_cfg (absc cfg). fst (state cfg') = fst (state (absc cfg)))"
  if "cfg \<in> valid_cfg"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<forall>cfg'\<in>set_pmf (K_cfg cfg). fst (state cfg') = fst (state cfg)) = (\<forall>cfg'\<in>set_pmf (K_cfg (absc cfg)). fst (state cfg') = fst (state (absc cfg)))
[PROOF STEP]
using that
[PROOF STATE]
proof (prove)
using this:
cfg \<in> MDP.valid_cfg

goal (1 subgoal):
 1. (\<forall>cfg'\<in>set_pmf (K_cfg cfg). fst (state cfg') = fst (state cfg)) = (\<forall>cfg'\<in>set_pmf (K_cfg (absc cfg)). fst (state cfg') = fst (state (absc cfg)))
[PROOF STEP]
by (auto simp: state_absc fst_abss K_cfg_map_absc)


[STATEMENT]
lemma SComplex_SReal_dense:
     "\<lbrakk>x \<in> SComplex; y \<in> SComplex; hcmod x < hcmod y
      \<rbrakk> \<Longrightarrow> \<exists>r \<in> Reals. hcmod x< r \<and> r < hcmod y"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>x \<in> SComplex; y \<in> SComplex; hcmod x < hcmod y\<rbrakk> \<Longrightarrow> \<exists>r\<in>\<real>. hcmod x < r \<and> r < hcmod y
[PROOF STEP]
by (simp add: SReal_dense SReal_hcmod_SComplex)


[STATEMENT]
lemma minus_rat_cancel [simp]: "Fract (- a) (- b) = Fract a b"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Fract (- a) (- b) = Fract a b
[PROOF STEP]
by (cases "b = 0") (simp_all add: eq_rat)


[STATEMENT]
lemma sum_vec_mset: "sum_vec v = (\<Sum> x \<in># (mset (list_of_vec v)) . x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. sum_vec v = (\<Sum>x\<in>#mset (list_of_vec v). x)
[PROOF STEP]
by (simp add: sum_vec_list)


[STATEMENT]
lemma to_fract_mult [simp]: "to_fract (x * y) = to_fract x * to_fract y"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. to_fract (x * y) = to_fract x * to_fract y
[PROOF STEP]
by (simp add: to_fract_def)


[STATEMENT]
lemma loop_semantics_kappa_mu_nu:
  "\<kappa> (\<lambda>x . y * x \<squnion> z) = (y\<^sup>\<omega> \<sqinter> L) \<squnion> y\<^sup>\<star> * z"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<kappa> (\<lambda>x. y * x \<squnion> z) = y\<^sup>\<omega> \<sqinter> L \<squnion> y\<^sup>\<star> * z
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<kappa> (\<lambda>x. y * x \<squnion> z) = y\<^sup>\<omega> \<sqinter> L \<squnion> y\<^sup>\<star> * z
[PROOF STEP]
have "\<kappa> (\<lambda>x . y * x \<squnion> z) = y\<^sup>\<star> * z \<squnion> ((y\<^sup>\<omega> \<squnion> y\<^sup>\<star> * z) \<sqinter> L)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<kappa> (\<lambda>x. y * x \<squnion> z) = y\<^sup>\<star> * z \<squnion> (y\<^sup>\<omega> \<squnion> y\<^sup>\<star> * z) \<sqinter> L
[PROOF STEP]
by (metis loop_semantics omega_loop_nu star_loop_mu)
[PROOF STATE]
proof (state)
this:
\<kappa> (\<lambda>x. y * x \<squnion> z) = y\<^sup>\<star> * z \<squnion> (y\<^sup>\<omega> \<squnion> y\<^sup>\<star> * z) \<sqinter> L

goal (1 subgoal):
 1. \<kappa> (\<lambda>x. y * x \<squnion> z) = y\<^sup>\<omega> \<sqinter> L \<squnion> y\<^sup>\<star> * z
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
\<kappa> (\<lambda>x. y * x \<squnion> z) = y\<^sup>\<star> * z \<squnion> (y\<^sup>\<omega> \<squnion> y\<^sup>\<star> * z) \<sqinter> L

goal (1 subgoal):
 1. \<kappa> (\<lambda>x. y * x \<squnion> z) = y\<^sup>\<omega> \<sqinter> L \<squnion> y\<^sup>\<star> * z
[PROOF STEP]
by (metis sup.absorb2 sup_commute sup_ge2 sup_inf_distrib1)
[PROOF STATE]
proof (state)
this:
\<kappa> (\<lambda>x. y * x \<squnion> z) = y\<^sup>\<omega> \<sqinter> L \<squnion> y\<^sup>\<star> * z

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma inter_guards_Seq:
  "(Seq a1 a2 \<inter>\<^sub>g c2) = Some c =
     (\<exists>b1 b2 d1 d2. c2=Seq b1 b2 \<and> (a1 \<inter>\<^sub>g b1) = Some d1 \<and>
        (a2 \<inter>\<^sub>g b2) = Some d2 \<and> c=Seq d1 d2)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((Seq a1 a2 \<inter>\<^sub>g c2) = Some c) = (\<exists>b1 b2 d1 d2. c2 = Seq b1 b2 \<and> (a1 \<inter>\<^sub>g b1) = Some d1 \<and> (a2 \<inter>\<^sub>g b2) = Some d2 \<and> c = Seq d1 d2)
[PROOF STEP]
by (cases c2) (auto split: option.splits)


[STATEMENT]
theorem A_trusts_NS2:
     "\<lbrakk>Says A  B (Crypt(pubEK B) \<lbrace>Nonce NA, Agent A\<rbrace>) \<in> set evs;
       Gets A (Crypt(pubEK A) \<lbrace>Nonce NA, Nonce NB\<rbrace>) \<in> set evs;
       A \<notin> bad;  B \<notin> bad;  evs \<in> ns_public\<rbrakk>
      \<Longrightarrow> Says B A (Crypt(pubEK A) \<lbrace>Nonce NA, Nonce NB\<rbrace>) \<in> set evs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Says A B (Crypt (pubK B) \<lbrace>Nonce NA, Agent A\<rbrace>) \<in> set evs; Gets A (Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB\<rbrace>) \<in> set evs; A \<notin> bad; B \<notin> bad; evs \<in> ns_public\<rbrakk> \<Longrightarrow> Says B A (Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB\<rbrace>) \<in> set evs
[PROOF STEP]
by (blast intro: A_trusts_NS2_lemma)


[STATEMENT]
lemma "(\<forall>x y. \<exists>z. \<forall>w. (P(x)\<and>Q(y)\<longrightarrow>R(z)\<and>S(w)))
    \<longrightarrow> (\<exists>x y. P(x) \<and> Q(y)) \<longrightarrow> (\<exists>z. R(z))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<forall>x y. \<exists>z. \<forall>w. P x \<and> Q y \<longrightarrow> R z \<and> S w) \<longrightarrow> (\<exists>x y. P x \<and> Q y) \<longrightarrow> (\<exists>z. R z)
[PROOF STEP]
by iprover


[STATEMENT]
lemma msubstltneg:
  assumes nz: "Ipoly vs c < 0"
    and l: "islin (Lt (CNP 0 a b))"
  shows "Ifm vs (x#bs) (msubstltneg c t a b) =
    Ifm vs (((Itm vs (x#bs) t /  Ipoly vs c ))#bs) (Lt (CNP 0 a b))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Ifm vs (x # bs) (msubstltneg c t a b) = Ifm vs (Itm vs (x # bs) t / \<lparr>c\<rparr>\<^sub>p\<^bsup>vs\<^esup> # bs) (Lt (CNP 0 a b))
[PROOF STEP]
using nz l tmbound0_I[of b vs x bs "Itm vs (x # bs) t / \<lparr>c\<rparr>\<^sub>p\<^bsup>vs\<^esup>", symmetric]
[PROOF STATE]
proof (prove)
using this:
\<lparr>c\<rparr>\<^sub>p\<^bsup>vs\<^esup> < (0::'a)
islin (Lt (CNP 0 a b))
tmbound0 b \<Longrightarrow> Itm vs (Itm vs (x # bs) t / \<lparr>c\<rparr>\<^sub>p\<^bsup>vs\<^esup> # bs) b = Itm vs (x # bs) b

goal (1 subgoal):
 1. Ifm vs (x # bs) (msubstltneg c t a b) = Ifm vs (Itm vs (x # bs) t / \<lparr>c\<rparr>\<^sub>p\<^bsup>vs\<^esup> # bs) (Lt (CNP 0 a b))
[PROOF STEP]
by (simp add: msubstltneg_def field_simps del: minus_add_distrib)


[STATEMENT]
lemma "(0 \<le> y + -1 * x \<or> \<not> 0 \<le> x \<or> 0 \<le> (x::int)) = (\<not> False)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (0 \<le> y + - 1 * x \<or> \<not> 0 \<le> x \<or> 0 \<le> x) = (\<not> False)
[PROOF STEP]
by (smt (verit))


[STATEMENT]
lemma angular_component_p_nat_pow:
"angular_component (\<pp> [^] (n::nat)) = \<one>\<^bsub>Z\<^sub>p\<^esub>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. angular_component (\<pp> [^] n) = \<one>\<^bsub>Z\<^sub>p\<^esub>
[PROOF STEP]
apply(induction n)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. angular_component (\<pp> [^] 0) = \<one>\<^bsub>Z\<^sub>p\<^esub>
 2. \<And>n. angular_component (\<pp> [^] n) = \<one>\<^bsub>Z\<^sub>p\<^esub> \<Longrightarrow> angular_component (\<pp> [^] Suc n) = \<one>\<^bsub>Z\<^sub>p\<^esub>
[PROOF STEP]
apply (simp add: angular_component_one)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>n. angular_component (\<pp> [^] n) = \<one>\<^bsub>Z\<^sub>p\<^esub> \<Longrightarrow> angular_component (\<pp> [^] Suc n) = \<one>\<^bsub>Z\<^sub>p\<^esub>
[PROOF STEP]
using angular_component_nat_pow angular_component_p nat_pow_one p_nonzero  Zp.nat_pow_one
[PROOF STATE]
proof (prove)
using this:
?a \<in> nonzero Q\<^sub>p \<Longrightarrow> angular_component (?a [^] ?k) = angular_component ?a [^]\<^bsub>Z\<^sub>p\<^esub> ?k
angular_component \<pp> = \<one>\<^bsub>Z\<^sub>p\<^esub>
\<one>\<^bsub>UP Q\<^sub>p\<^esub> [^]\<^bsub>UP Q\<^sub>p\<^esub> ?n = \<one>\<^bsub>UP Q\<^sub>p\<^esub>
\<pp> \<in> nonzero Q\<^sub>p
\<one>\<^bsub>Z\<^sub>p\<^esub> [^]\<^bsub>Z\<^sub>p\<^esub> ?n = \<one>\<^bsub>Z\<^sub>p\<^esub>

goal (1 subgoal):
 1. \<And>n. angular_component (\<pp> [^] n) = \<one>\<^bsub>Z\<^sub>p\<^esub> \<Longrightarrow> angular_component (\<pp> [^] Suc n) = \<one>\<^bsub>Z\<^sub>p\<^esub>
[PROOF STEP]
by presburger


[STATEMENT]
lemma real_of_rat_abs:
    "real_of_rat(abs a) = abs(of_rat a)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. real_of_rat \<bar>a\<bar> = \<bar>real_of_rat a\<bar>
[PROOF STEP]
by (simp add: abs_if of_rat_minus)


[STATEMENT]
lemma octo_of_real_times_commute: "octo_of_real r * q = q * octo_of_real r"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. octo_of_real r * q = q * octo_of_real r
[PROOF STEP]
using octo_of_real_def times_octo_def
[PROOF STATE]
proof (prove)
using this:
octo_of_real ?r = ?r *\<^sub>R 1
?a * ?b = (let t0 = Ree ?a * Ree ?b - Im1 ?a * Im1 ?b - Im2 ?a * Im2 ?b - Im3 ?a * Im3 ?b - Im4 ?a * Im4 ?b - Im5 ?a * Im5 ?b - Im6 ?a * Im6 ?b - Im7 ?a * Im7 ?b; t1 = Ree ?a * Im1 ?b + Im1 ?a * Ree ?b + Im2 ?a * Im4 ?b + Im3 ?a * Im7 ?b - Im4 ?a * Im2 ?b + Im5 ?a * Im6 ?b - Im6 ?a * Im5 ?b - Im7 ?a * Im3 ?b; t2 = Ree ?a * Im2 ?b - Im1 ?a * Im4 ?b + Im2 ?a * Ree ?b + Im3 ?a * Im5 ?b + Im4 ?a * Im1 ?b - Im5 ?a * Im3 ?b + Im6 ?a * Im7 ?b - Im7 ?a * Im6 ?b; t3 = Ree ?a * Im3 ?b - Im1 ?a * Im7 ?b - Im2 ?a * Im5 ?b + Im3 ?a * Ree ?b + Im4 ?a * Im6 ?b + Im5 ?a * Im2 ?b - Im6 ?a * Im4 ?b + Im7 ?a * Im1 ?b; t4 = Ree ?a * Im4 ?b + Im1 ?a * Im2 ?b - Im2 ?a * Im1 ?b - Im3 ?a * Im6 ?b + Im4 ?a * Ree ?b + Im5 ?a * Im7 ?b + Im6 ?a * Im3 ?b - Im7 ?a * Im5 ?b; t5 = Ree ?a * Im5 ?b - Im1 ?a * Im6 ?b + Im2 ?a * Im3 ?b - Im3 ?a * Im2 ?b - Im4 ?a * Im7 ?b + Im5 ?a * Ree ?b + Im6 ?a * Im1 ?b + Im7 ?a * Im4 ?b; t6 = Ree ?a * Im6 ?b + Im1 ?a * Im5 ?b - Im2 ?a * Im7 ?b + Im3 ?a * Im4 ?b - Im4 ?a * Im3 ?b - Im5 ?a * Im1 ?b + Im6 ?a * Ree ?b + Im7 ?a * Im2 ?b in Let (Ree ?a * Im7 ?b + Im1 ?a * Im3 ?b + Im2 ?a * Im6 ?b - Im3 ?a * Im1 ?b + Im4 ?a * Im5 ?b - Im5 ?a * Im4 ?b - Im6 ?a * Im2 ?b + Im7 ?a * Ree ?b) (Octo t0 t1 t2 t3 t4 t5 t6))

goal (1 subgoal):
 1. octo_of_real r * q = q * octo_of_real r
[PROOF STEP]
by simp


[STATEMENT]
lemma s_mul_ext_map: "(\<And>a b. a \<in> set as \<Longrightarrow> b \<in> set bs \<Longrightarrow> (a, b) \<in> S \<Longrightarrow> (f a, f b) \<in> S') \<Longrightarrow>
  (\<And>a b. a \<in> set as \<Longrightarrow> b \<in> set bs \<Longrightarrow> (a, b) \<in> NS \<Longrightarrow> (f a, f b) \<in> NS') \<Longrightarrow>
  (as, bs) \<in> {(as, bs). (mset as, mset bs) \<in> s_mul_ext NS S} \<Longrightarrow>
  (map f as, map f bs) \<in> {(as, bs). (mset as, mset bs) \<in> s_mul_ext NS' S'}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<And>a b. \<lbrakk>a \<in> set as; b \<in> set bs; (a, b) \<in> S\<rbrakk> \<Longrightarrow> (f a, f b) \<in> S'; \<And>a b. \<lbrakk>a \<in> set as; b \<in> set bs; (a, b) \<in> NS\<rbrakk> \<Longrightarrow> (f a, f b) \<in> NS'; (as, bs) \<in> {(as, bs). (mset as, mset bs) \<in> s_mul_ext NS S}\<rbrakk> \<Longrightarrow> (map f as, map f bs) \<in> {(as, bs). (mset as, mset bs) \<in> s_mul_ext NS' S'}
[PROOF STEP]
using mult2_alt_map[of _ _ "NS\<inverse>" f f "(NS')\<inverse>" "S\<inverse>" "S'\<inverse>" False]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<And>x y. \<lbrakk>x \<in># ?X; y \<in># ?Y; (x, y) \<in> NS\<inverse>\<rbrakk> \<Longrightarrow> (f x, f y) \<in> NS'\<inverse>; \<And>x y. \<lbrakk>x \<in># ?X; y \<in># ?Y; (x, y) \<in> S\<inverse>\<rbrakk> \<Longrightarrow> (f x, f y) \<in> S'\<inverse>; (?X, ?Y) \<in> mult2_alt_s (NS\<inverse>) (S\<inverse>)\<rbrakk> \<Longrightarrow> (image_mset f ?X, image_mset f ?Y) \<in> mult2_alt_s (NS'\<inverse>) (S'\<inverse>)

goal (1 subgoal):
 1. \<lbrakk>\<And>a b. \<lbrakk>a \<in> set as; b \<in> set bs; (a, b) \<in> S\<rbrakk> \<Longrightarrow> (f a, f b) \<in> S'; \<And>a b. \<lbrakk>a \<in> set as; b \<in> set bs; (a, b) \<in> NS\<rbrakk> \<Longrightarrow> (f a, f b) \<in> NS'; (as, bs) \<in> {(as, bs). (mset as, mset bs) \<in> s_mul_ext NS S}\<rbrakk> \<Longrightarrow> (map f as, map f bs) \<in> {(as, bs). (mset as, mset bs) \<in> s_mul_ext NS' S'}
[PROOF STEP]
unfolding s_mul_ext_def
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<And>x y. \<lbrakk>x \<in># ?X; y \<in># ?Y; (x, y) \<in> NS\<inverse>\<rbrakk> \<Longrightarrow> (f x, f y) \<in> NS'\<inverse>; \<And>x y. \<lbrakk>x \<in># ?X; y \<in># ?Y; (x, y) \<in> S\<inverse>\<rbrakk> \<Longrightarrow> (f x, f y) \<in> S'\<inverse>; (?X, ?Y) \<in> mult2_alt_s (NS\<inverse>) (S\<inverse>)\<rbrakk> \<Longrightarrow> (image_mset f ?X, image_mset f ?Y) \<in> mult2_alt_s (NS'\<inverse>) (S'\<inverse>)

goal (1 subgoal):
 1. \<lbrakk>\<And>a b. \<lbrakk>a \<in> set as; b \<in> set bs; (a, b) \<in> S\<rbrakk> \<Longrightarrow> (f a, f b) \<in> S'; \<And>a b. \<lbrakk>a \<in> set as; b \<in> set bs; (a, b) \<in> NS\<rbrakk> \<Longrightarrow> (f a, f b) \<in> NS'; (as, bs) \<in> {(as, bs). (mset as, mset bs) \<in> (mult2_alt_s (NS\<inverse>) (S\<inverse>))\<inverse>}\<rbrakk> \<Longrightarrow> (map f as, map f bs) \<in> {(as, bs). (mset as, mset bs) \<in> (mult2_alt_s (NS'\<inverse>) (S'\<inverse>))\<inverse>}
[PROOF STEP]
by fastforce


[STATEMENT]
lemma set_diff_diff_left: "A-B-C = A-(B\<union>C)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. A - B - C = A - (B \<union> C)
[PROOF STEP]
by auto


[STATEMENT]
lemma Hilbert: \<open>\<turnstile> (p \<rightarrow> p \<rightarrow> q) \<rightarrow> p \<rightarrow> q\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<turnstile> (p \<rightarrow> p \<rightarrow> q) \<rightarrow> p \<rightarrow> q
[PROOF STEP]
using MP MP Tran Tran Peirce
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<turnstile> ?p \<rightarrow> ?q; \<turnstile> ?p\<rbrakk> \<Longrightarrow> \<turnstile> ?q
\<lbrakk>\<turnstile> ?p \<rightarrow> ?q; \<turnstile> ?p\<rbrakk> \<Longrightarrow> \<turnstile> ?q
\<turnstile> (?p \<rightarrow> ?q) \<rightarrow> (?q \<rightarrow> ?r) \<rightarrow> ?p \<rightarrow> ?r
\<turnstile> (?p \<rightarrow> ?q) \<rightarrow> (?q \<rightarrow> ?r) \<rightarrow> ?p \<rightarrow> ?r
\<turnstile> ((?p \<rightarrow> ?q) \<rightarrow> ?p) \<rightarrow> ?p

goal (1 subgoal):
 1. \<turnstile> (p \<rightarrow> p \<rightarrow> q) \<rightarrow> p \<rightarrow> q
[PROOF STEP]
.


[STATEMENT]
lemma DF_subset: "A \<noteq> {} \<Longrightarrow> A \<subseteq> B \<Longrightarrow> DF B \<sqsubseteq>\<^sub>F\<^sub>D DF A"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>A \<noteq> {}; A \<subseteq> B\<rbrakk> \<Longrightarrow> DF B \<sqsubseteq>\<^sub>F\<^sub>D DF A
[PROOF STEP]
apply(subst DF_def, unfold failure_divergence_refine_def, rule fix_ind)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<lbrakk>A \<noteq> {}; A \<subseteq> B\<rbrakk> \<Longrightarrow> adm (\<lambda>a. a \<le> DF A)
 2. \<lbrakk>A \<noteq> {}; A \<subseteq> B\<rbrakk> \<Longrightarrow> \<bottom> \<le> DF A
 3. \<And>x. \<lbrakk>A \<noteq> {}; A \<subseteq> B; x \<le> DF A\<rbrakk> \<Longrightarrow> (\<Lambda> x. \<sqinter>xa\<in>B \<rightarrow>  x)\<cdot>x \<le> DF A
[PROOF STEP]
apply(rule le_adm, simp_all add:monofunI, subst DF_unfold)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>A \<noteq> {}; A \<subseteq> B; x \<le> DF A\<rbrakk> \<Longrightarrow> (\<sqinter>xa\<in>B \<rightarrow>  x) \<le> (\<sqinter>z\<in>A \<rightarrow>  DF A)
[PROOF STEP]
by (metis mndet_FD_subset mono_mndet_FD order.trans)


[STATEMENT]
lemma dagger_trans_eq [simp]: "x\<^sup>\<dagger> \<cdot> x\<^sup>\<dagger> = x\<^sup>\<dagger>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x\<^sup>\<dagger> \<cdot> x\<^sup>\<dagger> = x\<^sup>\<dagger>
[PROOF STEP]
by (metis dagger_unfoldr_eq local.dagger_denest local.join.sup.idem mult_assoc)


[STATEMENT]
lemma smooth_on_divide:"k-smooth_on S f \<Longrightarrow> k-smooth_on S g \<Longrightarrow> open S \<Longrightarrow>(\<And>x. x \<in> S \<Longrightarrow> g x \<noteq> 0) \<Longrightarrow>
  k-smooth_on S (\<lambda>x. f x / g x)"
  for f::"_\<Rightarrow>_::real_normed_field"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>k-smooth_on S f; k-smooth_on S g; open S; \<And>x. x \<in> S \<Longrightarrow> g x \<noteq> (0::'d)\<rbrakk> \<Longrightarrow> k-smooth_on S (\<lambda>x. f x / g x)
[PROOF STEP]
by (auto simp: smooth_on_def higher_differentiable_on_divide)


[STATEMENT]
lemma res_residual_iso: "residuated f \<Longrightarrow> x \<le> y \<Longrightarrow> residual f x \<le> residual f y"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>residuated f; x \<le> y\<rbrakk> \<Longrightarrow> residual f x \<le> residual f y
[PROOF STEP]
by (metis local.order.trans res_i1 residual_galois)


[STATEMENT]
lemma topological_tendstoD:
  "(f \<longlongrightarrow> l) F \<Longrightarrow> open S \<Longrightarrow> l \<in> S \<Longrightarrow> eventually (\<lambda>x. f x \<in> S) F"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(f \<longlongrightarrow> l) F; open S; l \<in> S\<rbrakk> \<Longrightarrow> \<forall>\<^sub>F x in F. f x \<in> S
[PROOF STEP]
by (auto simp: tendsto_def)


[STATEMENT]
lemma differentiable_on_diff [simp, derivative_intros]:
   "\<lbrakk>f differentiable_on S; g differentiable_on S\<rbrakk> \<Longrightarrow> (\<lambda>z. f z - g z) differentiable_on S"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>f differentiable_on S; g differentiable_on S\<rbrakk> \<Longrightarrow> (\<lambda>z. f z - g z) differentiable_on S
[PROOF STEP]
by (simp add: differentiable_on_def)


[STATEMENT]
lemma arcsin_bounded: "- 1 \<le> y \<Longrightarrow> y \<le> 1 \<Longrightarrow> - (pi/2) \<le> arcsin y \<and> arcsin y \<le> pi/2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>- 1 \<le> y; y \<le> 1\<rbrakk> \<Longrightarrow> - (pi / 2) \<le> arcsin y \<and> arcsin y \<le> pi / 2
[PROOF STEP]
by (blast dest: arcsin)


[STATEMENT]
lemma sum_list_triv_cong: assumes "length xs = n"
  and "\<And> x. x \<in> set xs \<Longrightarrow> f x = c"
shows "sum_list (map f xs) = n * c"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. sum_list (map f xs) = n * c
[PROOF STEP]
by (subst map_cong[OF refl, of _ _ "\<lambda> _ . c"], insert assms, auto simp: sum_list_triv)


[STATEMENT]
lemma inf_neq_0[simp]:"\<infinity> \<noteq> 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<infinity> \<noteq> 0
[PROOF STEP]
apply (cut_tac z_neq_inf[of "0"], frule not_sym)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ant 0 \<noteq> \<infinity>; \<infinity> \<noteq> ant 0\<rbrakk> \<Longrightarrow> \<infinity> \<noteq> 0
[PROOF STEP]
apply (simp add:ant_0)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma simple_match_port_alt: "simple_match_port m p \<longleftrightarrow> p \<in> wordinterval_to_set (uncurry WordInterval m)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. simple_match_port m p = (p \<in> wordinterval_to_set (uncurry WordInterval m))
[PROOF STEP]
by(simp split: uncurry_splits)


[STATEMENT]
lemma big_sum_in_bigo:
  assumes "\<And>x. x \<in> A \<Longrightarrow> f x \<in> O[F](g)"
  shows   "(\<lambda>x. sum (\<lambda>y. f y x) A) \<in> O[F](g)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lambda>x. \<Sum>y\<in>A. f y x) \<in> O[F](g)
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
?x \<in> A \<Longrightarrow> f ?x \<in> O[F](g)

goal (1 subgoal):
 1. (\<lambda>x. \<Sum>y\<in>A. f y x) \<in> O[F](g)
[PROOF STEP]
by (induction A rule: infinite_finite_induct) (auto intro: sum_in_bigo)


[STATEMENT]
lemma Red_I_limit_Sup: "chain (\<rhd>) Ns \<Longrightarrow> Red_I (Liminf_llist Ns) = Red_I (Sup_llist Ns)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. chain (\<rhd>) Ns \<Longrightarrow> Red_I (Liminf_llist Ns) = Red_I (Sup_llist Ns)
[PROOF STEP]
by (metis Liminf_llist_subset_Sup_llist Red_I_of_Red_F_subset Red_I_of_subset Red_in_Sup
      double_diff order_refl subset_antisym)


[STATEMENT]
lemma jordan_nf_matrix_poly_bound: fixes n_as :: "(nat \<times> 'a)list"
  assumes A: "A \<in> carrier_mat n n"
  and n_as: "\<And> n a. (n,a) \<in> set n_as \<Longrightarrow> n > 0 \<Longrightarrow> norm a \<le> 1"
  and N: "\<And> n a. (n,a) \<in> set n_as \<Longrightarrow> norm a = 1 \<Longrightarrow> n \<le> N"
  and jnf: "jordan_nf A n_as"
  shows "\<exists> c1 c2. \<forall> k. norm_bound (A ^\<^sub>m k) (c1 + c2 * of_nat k ^ (N - 1))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>c1 c2. \<forall>k. local.norm_bound (A ^\<^sub>m k) (c1 + c2 * real k ^ (N - 1))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<exists>c1 c2. \<forall>k. local.norm_bound (A ^\<^sub>m k) (c1 + c2 * real k ^ (N - 1))
[PROOF STEP]
let ?cp2 = "\<Prod>(n, a)\<leftarrow>n_as. [:- a, 1:] ^ n"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<exists>c1 c2. \<forall>k. local.norm_bound (A ^\<^sub>m k) (c1 + c2 * real k ^ (N - 1))
[PROOF STEP]
let ?J = "jordan_matrix n_as"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<exists>c1 c2. \<forall>k. local.norm_bound (A ^\<^sub>m k) (c1 + c2 * real k ^ (N - 1))
[PROOF STEP]
from jnf[unfolded jordan_nf_def]
[PROOF STATE]
proof (chain)
picking this:
0 \<notin> fst ` set n_as \<and> similar_mat A (jordan_matrix n_as)
[PROOF STEP]
have sim: "similar_mat A ?J"
[PROOF STATE]
proof (prove)
using this:
0 \<notin> fst ` set n_as \<and> similar_mat A (jordan_matrix n_as)

goal (1 subgoal):
 1. similar_mat A (jordan_matrix n_as)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
similar_mat A (jordan_matrix n_as)

goal (1 subgoal):
 1. \<exists>c1 c2. \<forall>k. local.norm_bound (A ^\<^sub>m k) (c1 + c2 * real k ^ (N - 1))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
similar_mat A (jordan_matrix n_as)
[PROOF STEP]
obtain P Q where sim_wit: "similar_mat_wit A ?J P Q"
[PROOF STATE]
proof (prove)
using this:
similar_mat A (jordan_matrix n_as)

goal (1 subgoal):
 1. (\<And>P Q. similar_mat_wit A (jordan_matrix n_as) P Q \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
unfolding similar_mat_def
[PROOF STATE]
proof (prove)
using this:
\<exists>P. Ex (similar_mat_wit A (jordan_matrix n_as) P)

goal (1 subgoal):
 1. (\<And>P Q. similar_mat_wit A (jordan_matrix n_as) P Q \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
similar_mat_wit A (jordan_matrix n_as) P Q

goal (1 subgoal):
 1. \<exists>c1 c2. \<forall>k. local.norm_bound (A ^\<^sub>m k) (c1 + c2 * real k ^ (N - 1))
[PROOF STEP]
from similar_mat_wit_pow_id[OF this]
[PROOF STATE]
proof (chain)
picking this:
A ^\<^sub>m ?k = P * jordan_matrix n_as ^\<^sub>m ?k * Q
[PROOF STEP]
have pow: "\<And> k. A ^\<^sub>m k = P * ?J ^\<^sub>m k * Q"
[PROOF STATE]
proof (prove)
using this:
A ^\<^sub>m ?k = P * jordan_matrix n_as ^\<^sub>m ?k * Q

goal (1 subgoal):
 1. \<And>k. A ^\<^sub>m k = P * jordan_matrix n_as ^\<^sub>m k * Q
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
A ^\<^sub>m ?k = P * jordan_matrix n_as ^\<^sub>m ?k * Q

goal (1 subgoal):
 1. \<exists>c1 c2. \<forall>k. local.norm_bound (A ^\<^sub>m k) (c1 + c2 * real k ^ (N - 1))
[PROOF STEP]
from sim_wit[unfolded similar_mat_wit_def Let_def] A
[PROOF STATE]
proof (chain)
picking this:
{A, jordan_matrix n_as, P, Q} \<subseteq> carrier_mat (dim_row A) (dim_row A) \<and> P * Q = 1\<^sub>m (dim_row A) \<and> Q * P = 1\<^sub>m (dim_row A) \<and> A = P * jordan_matrix n_as * Q
A \<in> carrier_mat n n
[PROOF STEP]
have J: "?J \<in> carrier_mat n n" and P: "P \<in> carrier_mat n n" and Q: "Q \<in> carrier_mat n n"
[PROOF STATE]
proof (prove)
using this:
{A, jordan_matrix n_as, P, Q} \<subseteq> carrier_mat (dim_row A) (dim_row A) \<and> P * Q = 1\<^sub>m (dim_row A) \<and> Q * P = 1\<^sub>m (dim_row A) \<and> A = P * jordan_matrix n_as * Q
A \<in> carrier_mat n n

goal (1 subgoal):
 1. jordan_matrix n_as \<in> carrier_mat n n &&& P \<in> carrier_mat n n &&& Q \<in> carrier_mat n n
[PROOF STEP]
unfolding carrier_mat_def
[PROOF STATE]
proof (prove)
using this:
{A, jordan_matrix n_as, P, Q} \<subseteq> {m. dim_row m = dim_row A \<and> dim_col m = dim_row A} \<and> P * Q = 1\<^sub>m (dim_row A) \<and> Q * P = 1\<^sub>m (dim_row A) \<and> A = P * jordan_matrix n_as * Q
A \<in> {m. dim_row m = n \<and> dim_col m = n}

goal (1 subgoal):
 1. jordan_matrix n_as \<in> {m. dim_row m = n \<and> dim_col m = n} &&& P \<in> {m. dim_row m = n \<and> dim_col m = n} &&& Q \<in> {m. dim_row m = n \<and> dim_col m = n}
[PROOF STEP]
by force+
[PROOF STATE]
proof (state)
this:
jordan_matrix n_as \<in> carrier_mat n n
P \<in> carrier_mat n n
Q \<in> carrier_mat n n

goal (1 subgoal):
 1. \<exists>c1 c2. \<forall>k. local.norm_bound (A ^\<^sub>m k) (c1 + c2 * real k ^ (N - 1))
[PROOF STEP]
have "\<exists>c1. \<forall> k. norm_bound (?J ^\<^sub>m k) (c1 + of_nat k ^ (N - 1))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>c1. \<forall>k. local.norm_bound (jordan_matrix n_as ^\<^sub>m k) (c1 + real k ^ (N - 1))
[PROOF STEP]
by (rule jordan_matrix_poly_bound[OF n_as N])
[PROOF STATE]
proof (state)
this:
\<exists>c1. \<forall>k. local.norm_bound (jordan_matrix n_as ^\<^sub>m k) (c1 + real k ^ (N - 1))

goal (1 subgoal):
 1. \<exists>c1 c2. \<forall>k. local.norm_bound (A ^\<^sub>m k) (c1 + c2 * real k ^ (N - 1))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<exists>c1. \<forall>k. local.norm_bound (jordan_matrix n_as ^\<^sub>m k) (c1 + real k ^ (N - 1))
[PROOF STEP]
obtain c1 where
    bound_pow: "\<And> k. norm_bound ((?J ^\<^sub>m k)) (c1 + of_nat k ^ (N - 1))"
[PROOF STATE]
proof (prove)
using this:
\<exists>c1. \<forall>k. local.norm_bound (jordan_matrix n_as ^\<^sub>m k) (c1 + real k ^ (N - 1))

goal (1 subgoal):
 1. (\<And>c1. (\<And>k. local.norm_bound (jordan_matrix n_as ^\<^sub>m k) (c1 + real k ^ (N - 1))) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
local.norm_bound (jordan_matrix n_as ^\<^sub>m ?k) (c1 + real ?k ^ (N - 1))

goal (1 subgoal):
 1. \<exists>c1 c2. \<forall>k. local.norm_bound (A ^\<^sub>m k) (c1 + c2 * real k ^ (N - 1))
[PROOF STEP]
obtain bP where bP: "norm_bound P bP"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>bP. local.norm_bound P bP \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using norm_bound_max[of P]
[PROOF STATE]
proof (prove)
using this:
local.norm_bound P (Max {norm (P $$ (i, j)) |i j. i < dim_row P \<and> j < dim_col P})

goal (1 subgoal):
 1. (\<And>bP. local.norm_bound P bP \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
local.norm_bound P bP

goal (1 subgoal):
 1. \<exists>c1 c2. \<forall>k. local.norm_bound (A ^\<^sub>m k) (c1 + c2 * real k ^ (N - 1))
[PROOF STEP]
obtain bQ where bQ: "norm_bound Q bQ"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>bQ. local.norm_bound Q bQ \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using norm_bound_max[of Q]
[PROOF STATE]
proof (prove)
using this:
local.norm_bound Q (Max {norm (Q $$ (i, j)) |i j. i < dim_row Q \<and> j < dim_col Q})

goal (1 subgoal):
 1. (\<And>bQ. local.norm_bound Q bQ \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
local.norm_bound Q bQ

goal (1 subgoal):
 1. \<exists>c1 c2. \<forall>k. local.norm_bound (A ^\<^sub>m k) (c1 + c2 * real k ^ (N - 1))
[PROOF STEP]
let ?n = "of_nat n :: real"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<exists>c1 c2. \<forall>k. local.norm_bound (A ^\<^sub>m k) (c1 + c2 * real k ^ (N - 1))
[PROOF STEP]
let ?c2 = "bP * ?n * bQ * ?n"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<exists>c1 c2. \<forall>k. local.norm_bound (A ^\<^sub>m k) (c1 + c2 * real k ^ (N - 1))
[PROOF STEP]
let ?c1 = "?c2 * c1"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<exists>c1 c2. \<forall>k. local.norm_bound (A ^\<^sub>m k) (c1 + c2 * real k ^ (N - 1))
[PROOF STEP]
{
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<exists>c1 c2. \<forall>k. local.norm_bound (A ^\<^sub>m k) (c1 + c2 * real k ^ (N - 1))
[PROOF STEP]
fix k
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<exists>c1 c2. \<forall>k. local.norm_bound (A ^\<^sub>m k) (c1 + c2 * real k ^ (N - 1))
[PROOF STEP]
have Jk: "?J ^\<^sub>m k \<in> carrier_mat n n"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. jordan_matrix n_as ^\<^sub>m k \<in> carrier_mat n n
[PROOF STEP]
using J
[PROOF STATE]
proof (prove)
using this:
jordan_matrix n_as \<in> carrier_mat n n

goal (1 subgoal):
 1. jordan_matrix n_as ^\<^sub>m k \<in> carrier_mat n n
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
jordan_matrix n_as ^\<^sub>m k \<in> carrier_mat n n

goal (1 subgoal):
 1. \<exists>c1 c2. \<forall>k. local.norm_bound (A ^\<^sub>m k) (c1 + c2 * real k ^ (N - 1))
[PROOF STEP]
from norm_bound_mult[OF mult_carrier_mat[OF P Jk] Q
      norm_bound_mult[OF P Jk bP bound_pow] bQ, folded pow]
[PROOF STATE]
proof (chain)
picking this:
local.norm_bound (A ^\<^sub>m k) (bP * (c1 + real k ^ (N - 1)) * real n * bQ * real n)
[PROOF STEP]
have "norm_bound (A ^\<^sub>m k) (?c1 + ?c2 * of_nat k ^ (N - 1))"  (is "norm_bound _ ?exp")
[PROOF STATE]
proof (prove)
using this:
local.norm_bound (A ^\<^sub>m k) (bP * (c1 + real k ^ (N - 1)) * real n * bQ * real n)

goal (1 subgoal):
 1. local.norm_bound (A ^\<^sub>m k) (bP * real n * bQ * real n * c1 + bP * real n * bQ * real n * real k ^ (N - 1))
[PROOF STEP]
by (simp add: field_simps)
[PROOF STATE]
proof (state)
this:
local.norm_bound (A ^\<^sub>m k) (bP * real n * bQ * real n * c1 + bP * real n * bQ * real n * real k ^ (N - 1))

goal (1 subgoal):
 1. \<exists>c1 c2. \<forall>k. local.norm_bound (A ^\<^sub>m k) (c1 + c2 * real k ^ (N - 1))
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
local.norm_bound (A ^\<^sub>m ?k2) (bP * real n * bQ * real n * c1 + bP * real n * bQ * real n * real ?k2 ^ (N - 1))

goal (1 subgoal):
 1. \<exists>c1 c2. \<forall>k. local.norm_bound (A ^\<^sub>m k) (c1 + c2 * real k ^ (N - 1))
[PROOF STEP]
note main = this
[PROOF STATE]
proof (state)
this:
local.norm_bound (A ^\<^sub>m ?k2) (bP * real n * bQ * real n * c1 + bP * real n * bQ * real n * real ?k2 ^ (N - 1))

goal (1 subgoal):
 1. \<exists>c1 c2. \<forall>k. local.norm_bound (A ^\<^sub>m k) (c1 + c2 * real k ^ (N - 1))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>c1 c2. \<forall>k. local.norm_bound (A ^\<^sub>m k) (c1 + c2 * real k ^ (N - 1))
[PROOF STEP]
by (intro exI allI, rule main)
[PROOF STATE]
proof (state)
this:
\<exists>c1 c2. \<forall>k. local.norm_bound (A ^\<^sub>m k) (c1 + c2 * real k ^ (N - 1))

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma height_over_subtree_less :
  assumes "m x = Some t'"
  and     "x \<in> list.set xs"
shows "height_over xs t' < height_over xs (PT m)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. height_over xs t' < height_over xs (PT m)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. height_over xs t' < height_over xs (PT m)
[PROOF STEP]
define xs' where "xs' = xs"
[PROOF STATE]
proof (state)
this:
xs' = xs

goal (1 subgoal):
 1. height_over xs t' < height_over xs (PT m)
[PROOF STEP]
have "height_over xs' t' \<le> foldr (\<lambda> x maxH . case m x of Some t' \<Rightarrow> max (height_over xs' t') maxH | None \<Rightarrow> maxH) xs 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. height_over xs' t' \<le> foldr (\<lambda>x maxH. case m x of None \<Rightarrow> maxH | Some t' \<Rightarrow> max (height_over xs' t') maxH) xs 0
[PROOF STEP]
using assms(2)
[PROOF STATE]
proof (prove)
using this:
x \<in> list.set xs

goal (1 subgoal):
 1. height_over xs' t' \<le> foldr (\<lambda>x maxH. case m x of None \<Rightarrow> maxH | Some t' \<Rightarrow> max (height_over xs' t') maxH) xs 0
[PROOF STEP]
proof (induction xs)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. x \<in> list.set [] \<Longrightarrow> height_over xs' t' \<le> foldr (\<lambda>x maxH. case m x of None \<Rightarrow> maxH | Some t' \<Rightarrow> max (height_over xs' t') maxH) [] 0
 2. \<And>a xs. \<lbrakk>x \<in> list.set xs \<Longrightarrow> height_over xs' t' \<le> foldr (\<lambda>x maxH. case m x of None \<Rightarrow> maxH | Some t' \<Rightarrow> max (height_over xs' t') maxH) xs 0; x \<in> list.set (a # xs)\<rbrakk> \<Longrightarrow> height_over xs' t' \<le> foldr (\<lambda>x maxH. case m x of None \<Rightarrow> maxH | Some t' \<Rightarrow> max (height_over xs' t') maxH) (a # xs) 0
[PROOF STEP]
case Nil
[PROOF STATE]
proof (state)
this:
x \<in> list.set []

goal (2 subgoals):
 1. x \<in> list.set [] \<Longrightarrow> height_over xs' t' \<le> foldr (\<lambda>x maxH. case m x of None \<Rightarrow> maxH | Some t' \<Rightarrow> max (height_over xs' t') maxH) [] 0
 2. \<And>a xs. \<lbrakk>x \<in> list.set xs \<Longrightarrow> height_over xs' t' \<le> foldr (\<lambda>x maxH. case m x of None \<Rightarrow> maxH | Some t' \<Rightarrow> max (height_over xs' t') maxH) xs 0; x \<in> list.set (a # xs)\<rbrakk> \<Longrightarrow> height_over xs' t' \<le> foldr (\<lambda>x maxH. case m x of None \<Rightarrow> maxH | Some t' \<Rightarrow> max (height_over xs' t') maxH) (a # xs) 0
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
x \<in> list.set []
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
x \<in> list.set []

goal (1 subgoal):
 1. height_over xs' t' \<le> foldr (\<lambda>x maxH. case m x of None \<Rightarrow> maxH | Some t' \<Rightarrow> max (height_over xs' t') maxH) [] 0
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
height_over xs' t' \<le> foldr (\<lambda>x maxH. case m x of None \<Rightarrow> maxH | Some t' \<Rightarrow> max (height_over xs' t') maxH) [] 0

goal (1 subgoal):
 1. \<And>a xs. \<lbrakk>x \<in> list.set xs \<Longrightarrow> height_over xs' t' \<le> foldr (\<lambda>x maxH. case m x of None \<Rightarrow> maxH | Some t' \<Rightarrow> max (height_over xs' t') maxH) xs 0; x \<in> list.set (a # xs)\<rbrakk> \<Longrightarrow> height_over xs' t' \<le> foldr (\<lambda>x maxH. case m x of None \<Rightarrow> maxH | Some t' \<Rightarrow> max (height_over xs' t') maxH) (a # xs) 0
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a xs. \<lbrakk>x \<in> list.set xs \<Longrightarrow> height_over xs' t' \<le> foldr (\<lambda>x maxH. case m x of None \<Rightarrow> maxH | Some t' \<Rightarrow> max (height_over xs' t') maxH) xs 0; x \<in> list.set (a # xs)\<rbrakk> \<Longrightarrow> height_over xs' t' \<le> foldr (\<lambda>x maxH. case m x of None \<Rightarrow> maxH | Some t' \<Rightarrow> max (height_over xs' t') maxH) (a # xs) 0
[PROOF STEP]
case (Cons x' xs)
[PROOF STATE]
proof (state)
this:
x \<in> list.set xs \<Longrightarrow> height_over xs' t' \<le> foldr (\<lambda>x maxH. case m x of None \<Rightarrow> maxH | Some t' \<Rightarrow> max (height_over xs' t') maxH) xs 0
x \<in> list.set (x' # xs)

goal (1 subgoal):
 1. \<And>a xs. \<lbrakk>x \<in> list.set xs \<Longrightarrow> height_over xs' t' \<le> foldr (\<lambda>x maxH. case m x of None \<Rightarrow> maxH | Some t' \<Rightarrow> max (height_over xs' t') maxH) xs 0; x \<in> list.set (a # xs)\<rbrakk> \<Longrightarrow> height_over xs' t' \<le> foldr (\<lambda>x maxH. case m x of None \<Rightarrow> maxH | Some t' \<Rightarrow> max (height_over xs' t') maxH) (a # xs) 0
[PROOF STEP]
define f where "f = foldr (\<lambda> x maxH . case m x of Some t' \<Rightarrow> max (height_over xs' t') maxH | None \<Rightarrow> maxH) xs 0"
[PROOF STATE]
proof (state)
this:
f = foldr (\<lambda>x maxH. case m x of None \<Rightarrow> maxH | Some t' \<Rightarrow> max (height_over xs' t') maxH) xs 0

goal (1 subgoal):
 1. \<And>a xs. \<lbrakk>x \<in> list.set xs \<Longrightarrow> height_over xs' t' \<le> foldr (\<lambda>x maxH. case m x of None \<Rightarrow> maxH | Some t' \<Rightarrow> max (height_over xs' t') maxH) xs 0; x \<in> list.set (a # xs)\<rbrakk> \<Longrightarrow> height_over xs' t' \<le> foldr (\<lambda>x maxH. case m x of None \<Rightarrow> maxH | Some t' \<Rightarrow> max (height_over xs' t') maxH) (a # xs) 0
[PROOF STEP]
have *: "foldr (\<lambda> x maxH . case m x of Some t' \<Rightarrow> max (height_over xs' t') maxH | None \<Rightarrow> maxH) (x'#xs) 0
              = (case m x' of Some t' \<Rightarrow> max (height_over xs' t') f | None \<Rightarrow> f)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. foldr (\<lambda>x maxH. case m x of None \<Rightarrow> maxH | Some t' \<Rightarrow> max (height_over xs' t') maxH) (x' # xs) 0 = (case m x' of None \<Rightarrow> f | Some t' \<Rightarrow> max (height_over xs' t') f)
[PROOF STEP]
unfolding f_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. foldr (\<lambda>x maxH. case m x of None \<Rightarrow> maxH | Some t' \<Rightarrow> max (height_over xs' t') maxH) (x' # xs) 0 = (case m x' of None \<Rightarrow> foldr (\<lambda>x maxH. case m x of None \<Rightarrow> maxH | Some t' \<Rightarrow> max (height_over xs' t') maxH) xs 0 | Some t' \<Rightarrow> max (height_over xs' t') (foldr (\<lambda>x maxH. case m x of None \<Rightarrow> maxH | Some t' \<Rightarrow> max (height_over xs' t') maxH) xs 0))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
foldr (\<lambda>x maxH. case m x of None \<Rightarrow> maxH | Some t' \<Rightarrow> max (height_over xs' t') maxH) (x' # xs) 0 = (case m x' of None \<Rightarrow> f | Some t' \<Rightarrow> max (height_over xs' t') f)

goal (1 subgoal):
 1. \<And>a xs. \<lbrakk>x \<in> list.set xs \<Longrightarrow> height_over xs' t' \<le> foldr (\<lambda>x maxH. case m x of None \<Rightarrow> maxH | Some t' \<Rightarrow> max (height_over xs' t') maxH) xs 0; x \<in> list.set (a # xs)\<rbrakk> \<Longrightarrow> height_over xs' t' \<le> foldr (\<lambda>x maxH. case m x of None \<Rightarrow> maxH | Some t' \<Rightarrow> max (height_over xs' t') maxH) (a # xs) 0
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. height_over xs' t' \<le> foldr (\<lambda>x maxH. case m x of None \<Rightarrow> maxH | Some t' \<Rightarrow> max (height_over xs' t') maxH) (x' # xs) 0
[PROOF STEP]
proof (cases "x=x'")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. x = x' \<Longrightarrow> height_over xs' t' \<le> foldr (\<lambda>x maxH. case m x of None \<Rightarrow> maxH | Some t' \<Rightarrow> max (height_over xs' t') maxH) (x' # xs) 0
 2. x \<noteq> x' \<Longrightarrow> height_over xs' t' \<le> foldr (\<lambda>x maxH. case m x of None \<Rightarrow> maxH | Some t' \<Rightarrow> max (height_over xs' t') maxH) (x' # xs) 0
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
x = x'

goal (2 subgoals):
 1. x = x' \<Longrightarrow> height_over xs' t' \<le> foldr (\<lambda>x maxH. case m x of None \<Rightarrow> maxH | Some t' \<Rightarrow> max (height_over xs' t') maxH) (x' # xs) 0
 2. x \<noteq> x' \<Longrightarrow> height_over xs' t' \<le> foldr (\<lambda>x maxH. case m x of None \<Rightarrow> maxH | Some t' \<Rightarrow> max (height_over xs' t') maxH) (x' # xs) 0
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. height_over xs' t' \<le> foldr (\<lambda>x maxH. case m x of None \<Rightarrow> maxH | Some t' \<Rightarrow> max (height_over xs' t') maxH) (x' # xs) 0
[PROOF STEP]
using \<open>m x = Some t'\<close>
[PROOF STATE]
proof (prove)
using this:
m x = Some t'

goal (1 subgoal):
 1. height_over xs' t' \<le> foldr (\<lambda>x maxH. case m x of None \<Rightarrow> maxH | Some t' \<Rightarrow> max (height_over xs' t') maxH) (x' # xs) 0
[PROOF STEP]
unfolding * True
[PROOF STATE]
proof (prove)
using this:
m x' = Some t'

goal (1 subgoal):
 1. height_over xs' t' \<le> (case m x' of None \<Rightarrow> f | Some t' \<Rightarrow> max (height_over xs' t') f)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
height_over xs' t' \<le> foldr (\<lambda>x maxH. case m x of None \<Rightarrow> maxH | Some t' \<Rightarrow> max (height_over xs' t') maxH) (x' # xs) 0

goal (1 subgoal):
 1. x \<noteq> x' \<Longrightarrow> height_over xs' t' \<le> foldr (\<lambda>x maxH. case m x of None \<Rightarrow> maxH | Some t' \<Rightarrow> max (height_over xs' t') maxH) (x' # xs) 0
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. x \<noteq> x' \<Longrightarrow> height_over xs' t' \<le> foldr (\<lambda>x maxH. case m x of None \<Rightarrow> maxH | Some t' \<Rightarrow> max (height_over xs' t') maxH) (x' # xs) 0
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
x \<noteq> x'

goal (1 subgoal):
 1. x \<noteq> x' \<Longrightarrow> height_over xs' t' \<le> foldr (\<lambda>x maxH. case m x of None \<Rightarrow> maxH | Some t' \<Rightarrow> max (height_over xs' t') maxH) (x' # xs) 0
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
x \<noteq> x'
[PROOF STEP]
have "x \<in> list.set xs"
[PROOF STATE]
proof (prove)
using this:
x \<noteq> x'

goal (1 subgoal):
 1. x \<in> list.set xs
[PROOF STEP]
using Cons.prems(1)
[PROOF STATE]
proof (prove)
using this:
x \<noteq> x'
x \<in> list.set (x' # xs)

goal (1 subgoal):
 1. x \<in> list.set xs
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
x \<in> list.set xs

goal (1 subgoal):
 1. x \<noteq> x' \<Longrightarrow> height_over xs' t' \<le> foldr (\<lambda>x maxH. case m x of None \<Rightarrow> maxH | Some t' \<Rightarrow> max (height_over xs' t') maxH) (x' # xs) 0
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. height_over xs' t' \<le> foldr (\<lambda>x maxH. case m x of None \<Rightarrow> maxH | Some t' \<Rightarrow> max (height_over xs' t') maxH) (x' # xs) 0
[PROOF STEP]
using Cons.IH[OF \<open>x \<in> list.set xs\<close>]
[PROOF STATE]
proof (prove)
using this:
height_over xs' t' \<le> foldr (\<lambda>x maxH. case m x of None \<Rightarrow> maxH | Some t' \<Rightarrow> max (height_over xs' t') maxH) xs 0

goal (1 subgoal):
 1. height_over xs' t' \<le> foldr (\<lambda>x maxH. case m x of None \<Rightarrow> maxH | Some t' \<Rightarrow> max (height_over xs' t') maxH) (x' # xs) 0
[PROOF STEP]
unfolding * f_def[symmetric]
[PROOF STATE]
proof (prove)
using this:
height_over xs' t' \<le> f

goal (1 subgoal):
 1. height_over xs' t' \<le> (case m x' of None \<Rightarrow> f | Some t' \<Rightarrow> max (height_over xs' t') f)
[PROOF STEP]
by (cases "m x'"; auto)
[PROOF STATE]
proof (state)
this:
height_over xs' t' \<le> foldr (\<lambda>x maxH. case m x of None \<Rightarrow> maxH | Some t' \<Rightarrow> max (height_over xs' t') maxH) (x' # xs) 0

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
height_over xs' t' \<le> foldr (\<lambda>x maxH. case m x of None \<Rightarrow> maxH | Some t' \<Rightarrow> max (height_over xs' t') maxH) (x' # xs) 0

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
height_over xs' t' \<le> foldr (\<lambda>x maxH. case m x of None \<Rightarrow> maxH | Some t' \<Rightarrow> max (height_over xs' t') maxH) xs 0

goal (1 subgoal):
 1. height_over xs t' < height_over xs (PT m)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
height_over xs' t' \<le> foldr (\<lambda>x maxH. case m x of None \<Rightarrow> maxH | Some t' \<Rightarrow> max (height_over xs' t') maxH) xs 0
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
height_over xs' t' \<le> foldr (\<lambda>x maxH. case m x of None \<Rightarrow> maxH | Some t' \<Rightarrow> max (height_over xs' t') maxH) xs 0

goal (1 subgoal):
 1. height_over xs t' < height_over xs (PT m)
[PROOF STEP]
unfolding xs'_def
[PROOF STATE]
proof (prove)
using this:
height_over xs t' \<le> foldr (\<lambda>x maxH. case m x of None \<Rightarrow> maxH | Some t' \<Rightarrow> max (height_over xs t') maxH) xs 0

goal (1 subgoal):
 1. height_over xs t' < height_over xs (PT m)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
height_over xs t' < height_over xs (PT m)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma set_mono_prefix: "prefix xs ys \<Longrightarrow> set xs \<subseteq> set ys"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. prefix xs ys \<Longrightarrow> set xs \<subseteq> set ys
[PROOF STEP]
by (auto simp add: prefix_def)


[STATEMENT]
lemma [code]: "Multiset.is_empty (mset xs) \<longleftrightarrow> List.null xs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Multiset.is_empty (mset xs) = List.null xs
[PROOF STEP]
by (simp add: Multiset.is_empty_def List.null_def)


[STATEMENT]
lemma sd_distl_aux: "Y \<noteq> {} \<Longrightarrow> p \<squnion> (\<Squnion>y \<in> Y. \<alpha> x (snd y)) = (\<Squnion>y \<in> Y. p \<squnion> \<alpha> x (snd y))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Y \<noteq> {} \<Longrightarrow> p \<squnion> (\<Squnion>y\<in>Y. \<alpha> x (snd y)) = (\<Squnion>y\<in>Y. p \<squnion> \<alpha> x (snd y))
[PROOF STEP]
apply (rule antisym)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. Y \<noteq> {} \<Longrightarrow> p \<squnion> (\<Squnion>y\<in>Y. \<alpha> x (snd y)) \<le> (\<Squnion>y\<in>Y. p \<squnion> \<alpha> x (snd y))
 2. Y \<noteq> {} \<Longrightarrow> (\<Squnion>y\<in>Y. p \<squnion> \<alpha> x (snd y)) \<le> p \<squnion> (\<Squnion>y\<in>Y. \<alpha> x (snd y))
[PROOF STEP]
apply (rule sup_least, metis SUP_bot_conv(2) SUP_const SUP_upper2 sup_ge1)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. Y \<noteq> {} \<Longrightarrow> (\<Squnion>y\<in>Y. \<alpha> x (snd y)) \<le> (\<Squnion>y\<in>Y. p \<squnion> \<alpha> x (snd y))
 2. Y \<noteq> {} \<Longrightarrow> (\<Squnion>y\<in>Y. p \<squnion> \<alpha> x (snd y)) \<le> p \<squnion> (\<Squnion>y\<in>Y. \<alpha> x (snd y))
[PROOF STEP]
apply (rule Sup_least, force simp: SUP_upper2 image_iff)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Y \<noteq> {} \<Longrightarrow> (\<Squnion>y\<in>Y. p \<squnion> \<alpha> x (snd y)) \<le> p \<squnion> (\<Squnion>y\<in>Y. \<alpha> x (snd y))
[PROOF STEP]
by (rule Sup_least, safe, metis Sup_upper image_iff sup.idem sup.mono sup_ge2)


[STATEMENT]
lemma val_pos: "val (pos x) = x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. val (pos x) = x
[PROOF STEP]
unfolding val_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. inv pos (pos x) = x
[PROOF STEP]
using inj_pos
[PROOF STATE]
proof (prove)
using this:
inj pos

goal (1 subgoal):
 1. inv pos (pos x) = x
[PROOF STEP]
by (rule inv_f_f)


[STATEMENT]
lemma containsNotTerminal':
  "\<lbrakk> branch subs gamma f; !n . ~proofTree (tree subs (f n)); contains f iA n \<rbrakk> \<Longrightarrow> ~ (terminal subs (f n))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>branch subs gamma f; \<forall>n. \<not> proofTree (tree subs (f n)); contains f iA n\<rbrakk> \<Longrightarrow> \<not> terminal subs (f n)
[PROOF STEP]
apply (rule containsNotTerminal, auto)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma "fmap f (fmap g xs) = fmap (f \<circ> g) xs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fmap f (fmap g xs) = fmap (f \<circ> g) xs
[PROOF STEP]
using map_map [Transfer.transferred]
[PROOF STATE]
proof (prove)
using this:
fmap ?f (fmap ?g ?xs) = fmap (?f \<circ> ?g) ?xs

goal (1 subgoal):
 1. fmap f (fmap g xs) = fmap (f \<circ> g) xs
[PROOF STEP]
.


[STATEMENT]
lemma sin_eq_1: "sin x = 1 \<longleftrightarrow> (\<exists>n::int. x = (2 * n + 1 / 2) * pi)"
                (is "_ = ?rhs")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (sin x = 1) = (\<exists>xa. x = (2 * real_of_int xa + 1 / 2) * pi)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (sin x = 1) = (\<exists>xa. x = (2 * real_of_int xa + 1 / 2) * pi)
[PROOF STEP]
have "sin x = 1 \<longleftrightarrow> sin (complex_of_real x) = 1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (sin x = 1) = (sin (complex_of_real x) = 1)
[PROOF STEP]
by (metis of_real_1 one_complex.simps(1) real_sin_eq sin_of_real)
[PROOF STATE]
proof (state)
this:
(sin x = 1) = (sin (complex_of_real x) = 1)

goal (1 subgoal):
 1. (sin x = 1) = (\<exists>xa. x = (2 * real_of_int xa + 1 / 2) * pi)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(sin x = 1) = (sin (complex_of_real x) = 1)

goal (1 subgoal):
 1. (sin x = 1) = (\<exists>xa. x = (2 * real_of_int xa + 1 / 2) * pi)
[PROOF STEP]
have "\<dots> \<longleftrightarrow> (\<exists>n::int. complex_of_real x = of_real(2 * n * pi) + of_real pi/2)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (sin (complex_of_real x) = 1) = (\<exists>xa. complex_of_real x = complex_of_real (2 * real_of_int xa * pi) + complex_of_real pi / 2)
[PROOF STEP]
by (simp only: csin_eq_1)
[PROOF STATE]
proof (state)
this:
(sin (complex_of_real x) = 1) = (\<exists>xa. complex_of_real x = complex_of_real (2 * real_of_int xa * pi) + complex_of_real pi / 2)

goal (1 subgoal):
 1. (sin x = 1) = (\<exists>xa. x = (2 * real_of_int xa + 1 / 2) * pi)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(sin (complex_of_real x) = 1) = (\<exists>xa. complex_of_real x = complex_of_real (2 * real_of_int xa * pi) + complex_of_real pi / 2)

goal (1 subgoal):
 1. (sin x = 1) = (\<exists>xa. x = (2 * real_of_int xa + 1 / 2) * pi)
[PROOF STEP]
have "\<dots> \<longleftrightarrow> (\<exists>n::int. x = of_real(2 * n * pi) + of_real pi/2)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<exists>xa. complex_of_real x = complex_of_real (2 * real_of_int xa * pi) + complex_of_real pi / 2) = (\<exists>xa. x = of_real (2 * real_of_int xa * pi) + of_real pi / 2)
[PROOF STEP]
by (rule iff_exI) (auto simp: algebra_simps intro: injD [OF inj_of_real [where 'a = complex]])
[PROOF STATE]
proof (state)
this:
(\<exists>xa. complex_of_real x = complex_of_real (2 * real_of_int xa * pi) + complex_of_real pi / 2) = (\<exists>xa. x = of_real (2 * real_of_int xa * pi) + of_real pi / 2)

goal (1 subgoal):
 1. (sin x = 1) = (\<exists>xa. x = (2 * real_of_int xa + 1 / 2) * pi)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(\<exists>xa. complex_of_real x = complex_of_real (2 * real_of_int xa * pi) + complex_of_real pi / 2) = (\<exists>xa. x = of_real (2 * real_of_int xa * pi) + of_real pi / 2)

goal (1 subgoal):
 1. (sin x = 1) = (\<exists>xa. x = (2 * real_of_int xa + 1 / 2) * pi)
[PROOF STEP]
have "\<dots> = ?rhs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<exists>xa. x = of_real (2 * real_of_int xa * pi) + of_real pi / 2) = (\<exists>xa. x = (2 * real_of_int xa + 1 / 2) * pi)
[PROOF STEP]
by (auto simp: algebra_simps)
[PROOF STATE]
proof (state)
this:
(\<exists>xa. x = of_real (2 * real_of_int xa * pi) + of_real pi / 2) = (\<exists>xa. x = (2 * real_of_int xa + 1 / 2) * pi)

goal (1 subgoal):
 1. (sin x = 1) = (\<exists>xa. x = (2 * real_of_int xa + 1 / 2) * pi)
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
(sin x = 1) = (\<exists>xa. x = (2 * real_of_int xa + 1 / 2) * pi)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
(sin x = 1) = (\<exists>xa. x = (2 * real_of_int xa + 1 / 2) * pi)

goal (1 subgoal):
 1. (sin x = 1) = (\<exists>xa. x = (2 * real_of_int xa + 1 / 2) * pi)
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
(sin x = 1) = (\<exists>xa. x = (2 * real_of_int xa + 1 / 2) * pi)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma in_sources_iff:
    assumes "Arr T"
    shows "A \<in> sources T \<longleftrightarrow> A \<^sup>*\<sim>\<^sup>* [\<Lambda>.Src (hd T)]"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (A \<in> sources T) = (A \<^sup>*\<sim>\<^sup>* [\<Lambda>.Src (hd T)])
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
Arr T

goal (1 subgoal):
 1. (A \<in> sources T) = (A \<^sup>*\<sim>\<^sup>* [\<Lambda>.Src (hd T)])
[PROOF STEP]
by (meson single_Src_hd_in_sources sources_are_cong sources_cong_closed)


[STATEMENT]
lemma reflect_poly_at_0_eq_0_iff [simp]: "poly (reflect_poly p) 0 = 0 \<longleftrightarrow> p = 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (poly (reflect_poly p) (0::'a) = (0::'a)) = (p = 0)
[PROOF STEP]
by (simp add: coeff_reflect_poly poly_0_coeff_0)


[STATEMENT]
lemma SubsetTrans:
  assumes "(subset a b)" and "(subset b c)"
  shows "(subset a c)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. HOLZF.subset a c
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. HOLZF.subset a c
[PROOF STEP]
have "(subset a b) \<and> (subset b c) \<longrightarrow> (subset a c)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. HOLZF.subset a b \<and> HOLZF.subset b c \<longrightarrow> HOLZF.subset a c
[PROOF STEP]
by ((subst subset_def)+, simp)
[PROOF STATE]
proof (state)
this:
HOLZF.subset a b \<and> HOLZF.subset b c \<longrightarrow> HOLZF.subset a c

goal (1 subgoal):
 1. HOLZF.subset a c
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
HOLZF.subset a b \<and> HOLZF.subset b c \<longrightarrow> HOLZF.subset a c

goal (1 subgoal):
 1. HOLZF.subset a c
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
HOLZF.subset a b \<and> HOLZF.subset b c \<longrightarrow> HOLZF.subset a c
HOLZF.subset a b
HOLZF.subset b c

goal (1 subgoal):
 1. HOLZF.subset a c
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
HOLZF.subset a c

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma finite_spEdges[simp, intro]: "finite (spEdges)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. finite spEdges
[PROOF STEP]
using finite_subset[OF spEdges_ss_E]
[PROOF STATE]
proof (prove)
using this:
finite E \<Longrightarrow> finite spEdges

goal (1 subgoal):
 1. finite spEdges
[PROOF STEP]
by blast


[STATEMENT]
theorem close_closed: \<open>subset_closed (close C)\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. subset_closed (close C)
[PROOF STEP]
unfolding close_def subset_closed_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>S'\<in>{S. Bex C ((\<subseteq>) S)}. \<forall>S\<subseteq>S'. S \<in> {S. Bex C ((\<subseteq>) S)}
[PROOF STEP]
by blast


[STATEMENT]
lemma HFinite_mult: "x \<in> HFinite \<Longrightarrow> y \<in> HFinite \<Longrightarrow> x * y \<in> HFinite"
  for x y :: "'a::real_normed_algebra star"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>x \<in> HFinite; y \<in> HFinite\<rbrakk> \<Longrightarrow> x * y \<in> HFinite
[PROOF STEP]
unfolding HFinite_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>x \<in> {x. Bex \<real> ((<) (hnorm x))}; y \<in> {x. Bex \<real> ((<) (hnorm x))}\<rbrakk> \<Longrightarrow> x * y \<in> {x. Bex \<real> ((<) (hnorm x))}
[PROOF STEP]
by (blast intro!: Reals_mult hnorm_mult_less)


[STATEMENT]
lemma dims_tensors_from_net:
assumes "T \<in> set\<^sub>v (tensors_from_net m)"
shows "Tensor.dims T = input_sizes m"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. dims T = input_sizes m
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
T \<in> set\<^sub>v (tensors_from_net m)

goal (1 subgoal):
 1. dims T = input_sizes m
[PROOF STEP]
proof (induction m arbitrary:T)
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>x T. T \<in> set\<^sub>v (tensors_from_net (Input x)) \<Longrightarrow> dims T = input_sizes (Input x)
 2. \<And>x1a m T. \<lbrakk>\<And>T. T \<in> set\<^sub>v (tensors_from_net m) \<Longrightarrow> dims T = input_sizes m; T \<in> set\<^sub>v (tensors_from_net (Conv x1a m))\<rbrakk> \<Longrightarrow> dims T = input_sizes (Conv x1a m)
 3. \<And>m1 m2 T. \<lbrakk>\<And>T. T \<in> set\<^sub>v (tensors_from_net m1) \<Longrightarrow> dims T = input_sizes m1; \<And>T. T \<in> set\<^sub>v (tensors_from_net m2) \<Longrightarrow> dims T = input_sizes m2; T \<in> set\<^sub>v (tensors_from_net (Pool m1 m2))\<rbrakk> \<Longrightarrow> dims T = input_sizes (Pool m1 m2)
[PROOF STEP]
case (Input M)
[PROOF STATE]
proof (state)
this:
T \<in> set\<^sub>v (tensors_from_net (Input M))

goal (3 subgoals):
 1. \<And>x T. T \<in> set\<^sub>v (tensors_from_net (Input x)) \<Longrightarrow> dims T = input_sizes (Input x)
 2. \<And>x1a m T. \<lbrakk>\<And>T. T \<in> set\<^sub>v (tensors_from_net m) \<Longrightarrow> dims T = input_sizes m; T \<in> set\<^sub>v (tensors_from_net (Conv x1a m))\<rbrakk> \<Longrightarrow> dims T = input_sizes (Conv x1a m)
 3. \<And>m1 m2 T. \<lbrakk>\<And>T. T \<in> set\<^sub>v (tensors_from_net m1) \<Longrightarrow> dims T = input_sizes m1; \<And>T. T \<in> set\<^sub>v (tensors_from_net m2) \<Longrightarrow> dims T = input_sizes m2; T \<in> set\<^sub>v (tensors_from_net (Pool m1 m2))\<rbrakk> \<Longrightarrow> dims T = input_sizes (Pool m1 m2)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
T \<in> set\<^sub>v (tensors_from_net (Input M))
[PROOF STEP]
obtain j where "T = unit_vec M j"
[PROOF STATE]
proof (prove)
using this:
T \<in> set\<^sub>v (tensors_from_net (Input M))

goal (1 subgoal):
 1. (\<And>j. T = unit_vec M j \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using vec_setE tensors_from_net.simps(1)
[PROOF STATE]
proof (prove)
using this:
T \<in> set\<^sub>v (tensors_from_net (Input M))
\<lbrakk>?a \<in> set\<^sub>v ?v; \<And>i. \<lbrakk>?v $ i = ?a; i < dim_vec ?v\<rbrakk> \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis
tensors_from_net (Input ?M) = Matrix.vec ?M (unit_vec ?M)

goal (1 subgoal):
 1. (\<And>j. T = unit_vec M j \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (metis dim_vec index_vec)
[PROOF STATE]
proof (state)
this:
T = unit_vec M j

goal (3 subgoals):
 1. \<And>x T. T \<in> set\<^sub>v (tensors_from_net (Input x)) \<Longrightarrow> dims T = input_sizes (Input x)
 2. \<And>x1a m T. \<lbrakk>\<And>T. T \<in> set\<^sub>v (tensors_from_net m) \<Longrightarrow> dims T = input_sizes m; T \<in> set\<^sub>v (tensors_from_net (Conv x1a m))\<rbrakk> \<Longrightarrow> dims T = input_sizes (Conv x1a m)
 3. \<And>m1 m2 T. \<lbrakk>\<And>T. T \<in> set\<^sub>v (tensors_from_net m1) \<Longrightarrow> dims T = input_sizes m1; \<And>T. T \<in> set\<^sub>v (tensors_from_net m2) \<Longrightarrow> dims T = input_sizes m2; T \<in> set\<^sub>v (tensors_from_net (Pool m1 m2))\<rbrakk> \<Longrightarrow> dims T = input_sizes (Pool m1 m2)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
T = unit_vec M j
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
T = unit_vec M j

goal (1 subgoal):
 1. dims T = input_sizes (Input M)
[PROOF STEP]
by (simp add: dims_unit_vec)
[PROOF STATE]
proof (state)
this:
dims T = input_sizes (Input M)

goal (2 subgoals):
 1. \<And>x1a m T. \<lbrakk>\<And>T. T \<in> set\<^sub>v (tensors_from_net m) \<Longrightarrow> dims T = input_sizes m; T \<in> set\<^sub>v (tensors_from_net (Conv x1a m))\<rbrakk> \<Longrightarrow> dims T = input_sizes (Conv x1a m)
 2. \<And>m1 m2 T. \<lbrakk>\<And>T. T \<in> set\<^sub>v (tensors_from_net m1) \<Longrightarrow> dims T = input_sizes m1; \<And>T. T \<in> set\<^sub>v (tensors_from_net m2) \<Longrightarrow> dims T = input_sizes m2; T \<in> set\<^sub>v (tensors_from_net (Pool m1 m2))\<rbrakk> \<Longrightarrow> dims T = input_sizes (Pool m1 m2)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>x1a m T. \<lbrakk>\<And>T. T \<in> set\<^sub>v (tensors_from_net m) \<Longrightarrow> dims T = input_sizes m; T \<in> set\<^sub>v (tensors_from_net (Conv x1a m))\<rbrakk> \<Longrightarrow> dims T = input_sizes (Conv x1a m)
 2. \<And>m1 m2 T. \<lbrakk>\<And>T. T \<in> set\<^sub>v (tensors_from_net m1) \<Longrightarrow> dims T = input_sizes m1; \<And>T. T \<in> set\<^sub>v (tensors_from_net m2) \<Longrightarrow> dims T = input_sizes m2; T \<in> set\<^sub>v (tensors_from_net (Pool m1 m2))\<rbrakk> \<Longrightarrow> dims T = input_sizes (Pool m1 m2)
[PROOF STEP]
case (Conv A m)
[PROOF STATE]
proof (state)
this:
?T \<in> set\<^sub>v (tensors_from_net m) \<Longrightarrow> dims ?T = input_sizes m
T \<in> set\<^sub>v (tensors_from_net (Conv A m))

goal (2 subgoals):
 1. \<And>x1a m T. \<lbrakk>\<And>T. T \<in> set\<^sub>v (tensors_from_net m) \<Longrightarrow> dims T = input_sizes m; T \<in> set\<^sub>v (tensors_from_net (Conv x1a m))\<rbrakk> \<Longrightarrow> dims T = input_sizes (Conv x1a m)
 2. \<And>m1 m2 T. \<lbrakk>\<And>T. T \<in> set\<^sub>v (tensors_from_net m1) \<Longrightarrow> dims T = input_sizes m1; \<And>T. T \<in> set\<^sub>v (tensors_from_net m2) \<Longrightarrow> dims T = input_sizes m2; T \<in> set\<^sub>v (tensors_from_net (Pool m1 m2))\<rbrakk> \<Longrightarrow> dims T = input_sizes (Pool m1 m2)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
?T \<in> set\<^sub>v (tensors_from_net m) \<Longrightarrow> dims ?T = input_sizes m
T \<in> set\<^sub>v (tensors_from_net (Conv A m))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
?T \<in> set\<^sub>v (tensors_from_net m) \<Longrightarrow> dims ?T = input_sizes m
T \<in> set\<^sub>v (tensors_from_net (Conv A m))

goal (1 subgoal):
 1. dims T = input_sizes (Conv A m)
[PROOF STEP]
unfolding remove_weights.simps input_sizes.simps
[PROOF STATE]
proof (prove)
using this:
?T \<in> set\<^sub>v (tensors_from_net m) \<Longrightarrow> dims ?T = input_sizes m
T \<in> set\<^sub>v (tensors_from_net (Conv A m))

goal (1 subgoal):
 1. dims T = input_sizes m
[PROOF STEP]
using dims_mat_tensorlist_mult
[PROOF STATE]
proof (prove)
using this:
?T \<in> set\<^sub>v (tensors_from_net m) \<Longrightarrow> dims ?T = input_sizes m
T \<in> set\<^sub>v (tensors_from_net (Conv A m))
?T \<in> set\<^sub>v (mat_tensorlist_mult ?A ?Ts ?ds) \<Longrightarrow> dims ?T = ?ds

goal (1 subgoal):
 1. dims T = input_sizes m
[PROOF STEP]
by (simp add: input_sizes_remove_weights)
[PROOF STATE]
proof (state)
this:
dims T = input_sizes (Conv A m)

goal (1 subgoal):
 1. \<And>m1 m2 T. \<lbrakk>\<And>T. T \<in> set\<^sub>v (tensors_from_net m1) \<Longrightarrow> dims T = input_sizes m1; \<And>T. T \<in> set\<^sub>v (tensors_from_net m2) \<Longrightarrow> dims T = input_sizes m2; T \<in> set\<^sub>v (tensors_from_net (Pool m1 m2))\<rbrakk> \<Longrightarrow> dims T = input_sizes (Pool m1 m2)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>m1 m2 T. \<lbrakk>\<And>T. T \<in> set\<^sub>v (tensors_from_net m1) \<Longrightarrow> dims T = input_sizes m1; \<And>T. T \<in> set\<^sub>v (tensors_from_net m2) \<Longrightarrow> dims T = input_sizes m2; T \<in> set\<^sub>v (tensors_from_net (Pool m1 m2))\<rbrakk> \<Longrightarrow> dims T = input_sizes (Pool m1 m2)
[PROOF STEP]
case (Pool m1 m2 T)
[PROOF STATE]
proof (state)
this:
?T \<in> set\<^sub>v (tensors_from_net m1) \<Longrightarrow> dims ?T = input_sizes m1
?T \<in> set\<^sub>v (tensors_from_net m2) \<Longrightarrow> dims ?T = input_sizes m2
T \<in> set\<^sub>v (tensors_from_net (Pool m1 m2))

goal (1 subgoal):
 1. \<And>m1 m2 T. \<lbrakk>\<And>T. T \<in> set\<^sub>v (tensors_from_net m1) \<Longrightarrow> dims T = input_sizes m1; \<And>T. T \<in> set\<^sub>v (tensors_from_net m2) \<Longrightarrow> dims T = input_sizes m2; T \<in> set\<^sub>v (tensors_from_net (Pool m1 m2))\<rbrakk> \<Longrightarrow> dims T = input_sizes (Pool m1 m2)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
?T \<in> set\<^sub>v (tensors_from_net m1) \<Longrightarrow> dims ?T = input_sizes m1
?T \<in> set\<^sub>v (tensors_from_net m2) \<Longrightarrow> dims ?T = input_sizes m2
T \<in> set\<^sub>v (tensors_from_net (Pool m1 m2))
[PROOF STEP]
obtain i where
    "component_mult (tensors_from_net m1) (tensors_from_net m2) $ i = T"
    "i < dim_vec (tensors_from_net m1)" "i < dim_vec (tensors_from_net m2)"
[PROOF STATE]
proof (prove)
using this:
?T \<in> set\<^sub>v (tensors_from_net m1) \<Longrightarrow> dims ?T = input_sizes m1
?T \<in> set\<^sub>v (tensors_from_net m2) \<Longrightarrow> dims ?T = input_sizes m2
T \<in> set\<^sub>v (tensors_from_net (Pool m1 m2))

goal (1 subgoal):
 1. (\<And>i. \<lbrakk>component_mult (tensors_from_net m1) (tensors_from_net m2) $ i = T; i < dim_vec (tensors_from_net m1); i < dim_vec (tensors_from_net m2)\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using tensors_from_net.simps vec_setE dim_component_mult
[PROOF STATE]
proof (prove)
using this:
?T \<in> set\<^sub>v (tensors_from_net m1) \<Longrightarrow> dims ?T = input_sizes m1
?T \<in> set\<^sub>v (tensors_from_net m2) \<Longrightarrow> dims ?T = input_sizes m2
T \<in> set\<^sub>v (tensors_from_net (Pool m1 m2))
tensors_from_net (Input ?M) = Matrix.vec ?M (unit_vec ?M)
tensors_from_net (Conv ?A ?m) = mat_tensorlist_mult ?A (tensors_from_net ?m) (input_sizes ?m)
tensors_from_net (Pool ?m1.0 ?m2.0) = component_mult (tensors_from_net ?m1.0) (tensors_from_net ?m2.0)
\<lbrakk>?a \<in> set\<^sub>v ?v; \<And>i. \<lbrakk>?v $ i = ?a; i < dim_vec ?v\<rbrakk> \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis
dim_vec (component_mult ?v ?w) = min (dim_vec ?v) (dim_vec ?w)

goal (1 subgoal):
 1. (\<And>i. \<lbrakk>component_mult (tensors_from_net m1) (tensors_from_net m2) $ i = T; i < dim_vec (tensors_from_net m1); i < dim_vec (tensors_from_net m2)\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (metis min.strict_boundedE)
[PROOF STATE]
proof (state)
this:
component_mult (tensors_from_net m1) (tensors_from_net m2) $ i = T
i < dim_vec (tensors_from_net m1)
i < dim_vec (tensors_from_net m2)

goal (1 subgoal):
 1. \<And>m1 m2 T. \<lbrakk>\<And>T. T \<in> set\<^sub>v (tensors_from_net m1) \<Longrightarrow> dims T = input_sizes m1; \<And>T. T \<in> set\<^sub>v (tensors_from_net m2) \<Longrightarrow> dims T = input_sizes m2; T \<in> set\<^sub>v (tensors_from_net (Pool m1 m2))\<rbrakk> \<Longrightarrow> dims T = input_sizes (Pool m1 m2)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
component_mult (tensors_from_net m1) (tensors_from_net m2) $ i = T
i < dim_vec (tensors_from_net m1)
i < dim_vec (tensors_from_net m2)
[PROOF STEP]
obtain T1 T2 where "T = T1 \<otimes> T2" "T1 \<in> set\<^sub>v (tensors_from_net m1)" "T2 \<in> set\<^sub>v (tensors_from_net m2)"
[PROOF STATE]
proof (prove)
using this:
component_mult (tensors_from_net m1) (tensors_from_net m2) $ i = T
i < dim_vec (tensors_from_net m1)
i < dim_vec (tensors_from_net m2)

goal (1 subgoal):
 1. (\<And>T1 T2. \<lbrakk>T = T1 \<otimes> T2; T1 \<in> set\<^sub>v (tensors_from_net m1); T2 \<in> set\<^sub>v (tensors_from_net m2)\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using vec_setI
[PROOF STATE]
proof (prove)
using this:
component_mult (tensors_from_net m1) (tensors_from_net m2) $ i = T
i < dim_vec (tensors_from_net m1)
i < dim_vec (tensors_from_net m2)
\<lbrakk>?v $ ?i = ?a; ?i < dim_vec ?v\<rbrakk> \<Longrightarrow> ?a \<in> set\<^sub>v ?v

goal (1 subgoal):
 1. (\<And>T1 T2. \<lbrakk>T = T1 \<otimes> T2; T1 \<in> set\<^sub>v (tensors_from_net m1); T2 \<in> set\<^sub>v (tensors_from_net m2)\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (metis index_component_mult)
[PROOF STATE]
proof (state)
this:
T = T1 \<otimes> T2
T1 \<in> set\<^sub>v (tensors_from_net m1)
T2 \<in> set\<^sub>v (tensors_from_net m2)

goal (1 subgoal):
 1. \<And>m1 m2 T. \<lbrakk>\<And>T. T \<in> set\<^sub>v (tensors_from_net m1) \<Longrightarrow> dims T = input_sizes m1; \<And>T. T \<in> set\<^sub>v (tensors_from_net m2) \<Longrightarrow> dims T = input_sizes m2; T \<in> set\<^sub>v (tensors_from_net (Pool m1 m2))\<rbrakk> \<Longrightarrow> dims T = input_sizes (Pool m1 m2)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
T = T1 \<otimes> T2
T1 \<in> set\<^sub>v (tensors_from_net m1)
T2 \<in> set\<^sub>v (tensors_from_net m2)
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
T = T1 \<otimes> T2
T1 \<in> set\<^sub>v (tensors_from_net m1)
T2 \<in> set\<^sub>v (tensors_from_net m2)

goal (1 subgoal):
 1. dims T = input_sizes (Pool m1 m2)
[PROOF STEP]
unfolding remove_weights.simps input_sizes.simps
[PROOF STATE]
proof (prove)
using this:
T = T1 \<otimes> T2
T1 \<in> set\<^sub>v (tensors_from_net m1)
T2 \<in> set\<^sub>v (tensors_from_net m2)

goal (1 subgoal):
 1. dims T = input_sizes m1 @ input_sizes m2
[PROOF STEP]
by (simp add: Pool.IH(1) Pool.IH(2))
[PROOF STATE]
proof (state)
this:
dims T = input_sizes (Pool m1 m2)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma mksynlr_Inf: "unsynlr (Inf A) = Inf (unsynlr ` A)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. unsynlr (Inf A) = \<Inter> (unsynlr ` A)
[PROOF STEP]
unfolding Inf_synlr_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. unsynlr (mksynlr (\<Inter> (unsynlr ` A))) = \<Inter> (unsynlr ` A)
[PROOF STEP]
by (simp add: admS_def synlr_def)


[STATEMENT]
lemma isCont_add [simp]: "isCont f a \<Longrightarrow> isCont g a \<Longrightarrow> isCont (\<lambda>x. f x + g x) a"
  for f :: "'a::t2_space \<Rightarrow> 'b::topological_monoid_add"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>isCont f a; isCont g a\<rbrakk> \<Longrightarrow> isCont (\<lambda>x. f x + g x) a
[PROOF STEP]
by (fact continuous_add)


[STATEMENT]
lemma bigo_const3: "c \<noteq> 0 \<Longrightarrow> (\<lambda>x. 1) \<in> O(\<lambda>x. c)"
  for c :: "'a::linordered_field"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. c \<noteq> (0::'a) \<Longrightarrow> (\<lambda>x. 1::'a) \<in> O(\<lambda>x. c)
[PROOF STEP]
apply (simp add: bigo_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. c \<noteq> (0::'a) \<Longrightarrow> \<exists>ca. (1::'a) \<le> ca * \<bar>c\<bar>
[PROOF STEP]
apply (rule_tac x = "\<bar>inverse c\<bar>" in exI)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. c \<noteq> (0::'a) \<Longrightarrow> (1::'a) \<le> \<bar>inverse c\<bar> * \<bar>c\<bar>
[PROOF STEP]
apply (simp flip: abs_mult)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma inj_on_invT : "inj_on invT H"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. inj_on invT H
[PROOF STEP]
using     bijective bij_betw_imp_inj_on[of T G] ImG inj_on_the_inv_into[of T]
[PROOF STATE]
proof (prove)
using this:
bij_betw T G H
bij_betw T G ?B \<Longrightarrow> inj_on T G
ImG = H
inj_on T ?A \<Longrightarrow> inj_on (the_inv_into ?A T) (T ` ?A)

goal (1 subgoal):
 1. inj_on invT H
[PROOF STEP]
unfolding inj_on_def
[PROOF STATE]
proof (prove)
using this:
bij_betw T G H
bij_betw T G ?B \<Longrightarrow> \<forall>x\<in>G. \<forall>y\<in>G. T x = T y \<longrightarrow> x = y
ImG = H
\<forall>x\<in>?A. \<forall>y\<in>?A. T x = T y \<longrightarrow> x = y \<Longrightarrow> \<forall>x\<in>T ` ?A. \<forall>y\<in>T ` ?A. the_inv_into ?A T x = the_inv_into ?A T y \<longrightarrow> x = y

goal (1 subgoal):
 1. \<forall>x\<in>H. \<forall>y\<in>H. invT x = invT y \<longrightarrow> x = y
[PROOF STEP]
by        force


[STATEMENT]
lemma temp_dyn_up_real_arith:
  assumes "a > 0" and Thyps: "Tmin \<le> T" "T \<le> Tmax" "Tmax < (L::real)"
    and thyps: "0 \<le> t" "\<forall>\<tau>\<in>{0..t}. \<tau> \<le> - (ln ((L - Tmax) / (L - T)) / a) "
  shows "L - Tmax \<le> exp (-(a * t)) * (L - T)"
    and "L - exp (-(a * t)) * (L - T) \<le> Tmax"
    and "Tmin \<le> L - exp (-(a * t)) * (L - T)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L - Tmax \<le> exp (- (a \<cdot> t)) \<cdot> (L - T) &&& L - exp (- (a \<cdot> t)) \<cdot> (L - T) \<le> Tmax &&& Tmin \<le> L - exp (- (a \<cdot> t)) \<cdot> (L - T)
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. L - Tmax \<le> exp (- (a \<cdot> t)) \<cdot> (L - T)
 2. L - exp (- (a \<cdot> t)) \<cdot> (L - T) \<le> Tmax
 3. Tmin \<le> L - exp (- (a \<cdot> t)) \<cdot> (L - T)
[PROOF STEP]
have "0 \<le> t \<and> t \<le> - (ln ((L - Tmax) / (L - T)) / a)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 \<le> t \<and> t \<le> - (ln ((L - Tmax) / (L - T)) / a)
[PROOF STEP]
using thyps
[PROOF STATE]
proof (prove)
using this:
0 \<le> t
\<forall>\<tau>\<in>{0..t}. \<tau> \<le> - (ln ((L - Tmax) / (L - T)) / a)

goal (1 subgoal):
 1. 0 \<le> t \<and> t \<le> - (ln ((L - Tmax) / (L - T)) / a)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
0 \<le> t \<and> t \<le> - (ln ((L - Tmax) / (L - T)) / a)

goal (3 subgoals):
 1. L - Tmax \<le> exp (- (a \<cdot> t)) \<cdot> (L - T)
 2. L - exp (- (a \<cdot> t)) \<cdot> (L - T) \<le> Tmax
 3. Tmin \<le> L - exp (- (a \<cdot> t)) \<cdot> (L - T)
[PROOF STEP]
hence "ln ((L - Tmax) / (L - T)) \<le> - a * t \<and> - a * t \<le> 0"
[PROOF STATE]
proof (prove)
using this:
0 \<le> t \<and> t \<le> - (ln ((L - Tmax) / (L - T)) / a)

goal (1 subgoal):
 1. ln ((L - Tmax) / (L - T)) \<le> - a \<cdot> t \<and> - a \<cdot> t \<le> 0
[PROOF STEP]
using assms(1) divide_le_cancel
[PROOF STATE]
proof (prove)
using this:
0 \<le> t \<and> t \<le> - (ln ((L - Tmax) / (L - T)) / a)
0 < a
(?a / ?c \<le> ?b / ?c) = (((0::?'a) < ?c \<longrightarrow> ?a \<le> ?b) \<and> (?c < (0::?'a) \<longrightarrow> ?b \<le> ?a))

goal (1 subgoal):
 1. ln ((L - Tmax) / (L - T)) \<le> - a \<cdot> t \<and> - a \<cdot> t \<le> 0
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
ln ((L - Tmax) / (L - T)) \<le> - a \<cdot> t \<and> - a \<cdot> t \<le> 0

goal (3 subgoals):
 1. L - Tmax \<le> exp (- (a \<cdot> t)) \<cdot> (L - T)
 2. L - exp (- (a \<cdot> t)) \<cdot> (L - T) \<le> Tmax
 3. Tmin \<le> L - exp (- (a \<cdot> t)) \<cdot> (L - T)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
ln ((L - Tmax) / (L - T)) \<le> - a \<cdot> t \<and> - a \<cdot> t \<le> 0

goal (3 subgoals):
 1. L - Tmax \<le> exp (- (a \<cdot> t)) \<cdot> (L - T)
 2. L - exp (- (a \<cdot> t)) \<cdot> (L - T) \<le> Tmax
 3. Tmin \<le> L - exp (- (a \<cdot> t)) \<cdot> (L - T)
[PROOF STEP]
have "(L - Tmax) / (L - T) > 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 < (L - Tmax) / (L - T)
[PROOF STEP]
using Thyps
[PROOF STATE]
proof (prove)
using this:
Tmin \<le> T
T \<le> Tmax
Tmax < L

goal (1 subgoal):
 1. 0 < (L - Tmax) / (L - T)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
0 < (L - Tmax) / (L - T)

goal (3 subgoals):
 1. L - Tmax \<le> exp (- (a \<cdot> t)) \<cdot> (L - T)
 2. L - exp (- (a \<cdot> t)) \<cdot> (L - T) \<le> Tmax
 3. Tmin \<le> L - exp (- (a \<cdot> t)) \<cdot> (L - T)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
ln ((L - Tmax) / (L - T)) \<le> - a \<cdot> t \<and> - a \<cdot> t \<le> 0
0 < (L - Tmax) / (L - T)
[PROOF STEP]
have "(L - Tmax) / (L - T) \<le> exp (-a * t) \<and> exp (-a * t) \<le> 1"
[PROOF STATE]
proof (prove)
using this:
ln ((L - Tmax) / (L - T)) \<le> - a \<cdot> t \<and> - a \<cdot> t \<le> 0
0 < (L - Tmax) / (L - T)

goal (1 subgoal):
 1. (L - Tmax) / (L - T) \<le> exp (- a \<cdot> t) \<and> exp (- a \<cdot> t) \<le> 1
[PROOF STEP]
using exp_ln exp_le_one_iff
[PROOF STATE]
proof (prove)
using this:
ln ((L - Tmax) / (L - T)) \<le> - a \<cdot> t \<and> - a \<cdot> t \<le> 0
0 < (L - Tmax) / (L - T)
0 < ?x \<Longrightarrow> exp (ln ?x) = ?x
(exp ?x \<le> 1) = (?x \<le> 0)

goal (1 subgoal):
 1. (L - Tmax) / (L - T) \<le> exp (- a \<cdot> t) \<and> exp (- a \<cdot> t) \<le> 1
[PROOF STEP]
by (metis exp_less_cancel_iff not_less)
[PROOF STATE]
proof (state)
this:
(L - Tmax) / (L - T) \<le> exp (- a \<cdot> t) \<and> exp (- a \<cdot> t) \<le> 1

goal (3 subgoals):
 1. L - Tmax \<le> exp (- (a \<cdot> t)) \<cdot> (L - T)
 2. L - exp (- (a \<cdot> t)) \<cdot> (L - T) \<le> Tmax
 3. Tmin \<le> L - exp (- (a \<cdot> t)) \<cdot> (L - T)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(L - Tmax) / (L - T) \<le> exp (- a \<cdot> t) \<and> exp (- a \<cdot> t) \<le> 1

goal (3 subgoals):
 1. L - Tmax \<le> exp (- (a \<cdot> t)) \<cdot> (L - T)
 2. L - exp (- (a \<cdot> t)) \<cdot> (L - T) \<le> Tmax
 3. Tmin \<le> L - exp (- (a \<cdot> t)) \<cdot> (L - T)
[PROOF STEP]
have "L - T > 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 < L - T
[PROOF STEP]
using Thyps
[PROOF STATE]
proof (prove)
using this:
Tmin \<le> T
T \<le> Tmax
Tmax < L

goal (1 subgoal):
 1. 0 < L - T
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
0 < L - T

goal (3 subgoals):
 1. L - Tmax \<le> exp (- (a \<cdot> t)) \<cdot> (L - T)
 2. L - exp (- (a \<cdot> t)) \<cdot> (L - T) \<le> Tmax
 3. Tmin \<le> L - exp (- (a \<cdot> t)) \<cdot> (L - T)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
(L - Tmax) / (L - T) \<le> exp (- a \<cdot> t) \<and> exp (- a \<cdot> t) \<le> 1
0 < L - T
[PROOF STEP]
have obs: "(L - Tmax) \<le> exp (-a * t) * (L - T) \<and> exp (-a * t) * (L - T) \<le> (L - T)"
[PROOF STATE]
proof (prove)
using this:
(L - Tmax) / (L - T) \<le> exp (- a \<cdot> t) \<and> exp (- a \<cdot> t) \<le> 1
0 < L - T

goal (1 subgoal):
 1. L - Tmax \<le> exp (- a \<cdot> t) \<cdot> (L - T) \<and> exp (- a \<cdot> t) \<cdot> (L - T) \<le> L - T
[PROOF STEP]
by (simp add: pos_divide_le_eq)
[PROOF STATE]
proof (state)
this:
L - Tmax \<le> exp (- a \<cdot> t) \<cdot> (L - T) \<and> exp (- a \<cdot> t) \<cdot> (L - T) \<le> L - T

goal (3 subgoals):
 1. L - Tmax \<le> exp (- (a \<cdot> t)) \<cdot> (L - T)
 2. L - exp (- (a \<cdot> t)) \<cdot> (L - T) \<le> Tmax
 3. Tmin \<le> L - exp (- (a \<cdot> t)) \<cdot> (L - T)
[PROOF STEP]
thus "(L - Tmax) \<le> exp (-(a * t)) * (L - T)"
[PROOF STATE]
proof (prove)
using this:
L - Tmax \<le> exp (- a \<cdot> t) \<cdot> (L - T) \<and> exp (- a \<cdot> t) \<cdot> (L - T) \<le> L - T

goal (1 subgoal):
 1. L - Tmax \<le> exp (- (a \<cdot> t)) \<cdot> (L - T)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
L - Tmax \<le> exp (- (a \<cdot> t)) \<cdot> (L - T)

goal (2 subgoals):
 1. L - exp (- (a \<cdot> t)) \<cdot> (L - T) \<le> Tmax
 2. Tmin \<le> L - exp (- (a \<cdot> t)) \<cdot> (L - T)
[PROOF STEP]
thus "L - exp (-(a * t)) * (L - T) \<le> Tmax"
[PROOF STATE]
proof (prove)
using this:
L - Tmax \<le> exp (- (a \<cdot> t)) \<cdot> (L - T)

goal (1 subgoal):
 1. L - exp (- (a \<cdot> t)) \<cdot> (L - T) \<le> Tmax
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
L - exp (- (a \<cdot> t)) \<cdot> (L - T) \<le> Tmax

goal (1 subgoal):
 1. Tmin \<le> L - exp (- (a \<cdot> t)) \<cdot> (L - T)
[PROOF STEP]
show "Tmin \<le> L - exp (-(a * t)) * (L - T)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Tmin \<le> L - exp (- (a \<cdot> t)) \<cdot> (L - T)
[PROOF STEP]
using Thyps and obs
[PROOF STATE]
proof (prove)
using this:
Tmin \<le> T
T \<le> Tmax
Tmax < L
L - Tmax \<le> exp (- a \<cdot> t) \<cdot> (L - T) \<and> exp (- a \<cdot> t) \<cdot> (L - T) \<le> L - T

goal (1 subgoal):
 1. Tmin \<le> L - exp (- (a \<cdot> t)) \<cdot> (L - T)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Tmin \<le> L - exp (- (a \<cdot> t)) \<cdot> (L - T)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma bi_unique_vimage2p [simp]:
  "\<lbrakk> bi_unique P; inj f; inj g \<rbrakk> \<Longrightarrow> bi_unique (BNF_Def.vimage2p f g P)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>bi_unique P; inj f; inj g\<rbrakk> \<Longrightarrow> bi_unique (BNF_Def.vimage2p f g P)
[PROOF STEP]
unfolding bi_unique_alt_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>left_unique P \<and> right_unique P; inj f; inj g\<rbrakk> \<Longrightarrow> left_unique (BNF_Def.vimage2p f g P) \<and> right_unique (BNF_Def.vimage2p f g P)
[PROOF STEP]
by simp


[STATEMENT]
lemma valid_dbm_pos:
  assumes "valid_dbm M n"
  shows "[M]\<^bsub>v,n\<^esub> \<subseteq> {u. \<forall> c. v c \<le> n \<longrightarrow> u c \<ge> 0}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. [M]\<^bsub>v,n\<^esub> \<subseteq> {u. \<forall>c. v c \<le> n \<longrightarrow> (0::'a) \<le> u c}
[PROOF STEP]
using dbm_positive assms
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?M 0 (?v ?c) \<le> \<one>; ?v ?c \<le> ?n; ?u \<turnstile>\<^bsub>?v,?n\<^esub> ?M\<rbrakk> \<Longrightarrow> (0::?'a) \<le> ?u ?c
valid_dbm M n

goal (1 subgoal):
 1. [M]\<^bsub>v,n\<^esub> \<subseteq> {u. \<forall>c. v c \<le> n \<longrightarrow> (0::'a) \<le> u c}
[PROOF STEP]
unfolding valid_dbm_def
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?M 0 (?v ?c) \<le> \<one>; ?v ?c \<le> ?n; ?u \<turnstile>\<^bsub>?v,?n\<^esub> ?M\<rbrakk> \<Longrightarrow> (0::?'a) \<le> ?u ?c
dbm_int M n \<and> (\<forall>i\<le>n. M 0 i \<le> \<one>)

goal (1 subgoal):
 1. [M]\<^bsub>v,n\<^esub> \<subseteq> {u. \<forall>c. v c \<le> n \<longrightarrow> (0::'a) \<le> u c}
[PROOF STEP]
unfolding DBM_zone_repr_def
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?M 0 (?v ?c) \<le> \<one>; ?v ?c \<le> ?n; ?u \<turnstile>\<^bsub>?v,?n\<^esub> ?M\<rbrakk> \<Longrightarrow> (0::?'a) \<le> ?u ?c
dbm_int M n \<and> (\<forall>i\<le>n. M 0 i \<le> \<one>)

goal (1 subgoal):
 1. {u. u \<turnstile>\<^bsub>v,n\<^esub> M} \<subseteq> {u. \<forall>c. v c \<le> n \<longrightarrow> (0::'a) \<le> u c}
[PROOF STEP]
by fast


[STATEMENT]
lemma "set(merge xs ys) = set xs \<union> set ys"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. set (merge xs ys) = set xs \<union> set ys
[PROOF STEP]
by(induction xs ys rule: merge.induct) (auto)


[STATEMENT]
lemma smcf_cn_cov_comp_ArrMap_vsv[smc_cn_cs_intros]:
  assumes "\<GG> : \<BB> \<^sub>S\<^sub>M\<^sub>C\<mapsto>\<mapsto>\<^bsub>\<alpha>\<^esub> \<CC>" and "\<FF> : \<AA> \<mapsto>\<mapsto>\<^sub>S\<^sub>M\<^sub>C\<^bsub>\<alpha>\<^esub> \<BB>"
  shows "vsv ((\<GG> \<^sub>S\<^sub>M\<^sub>C\<^sub>F\<circ> \<FF>)\<lparr>ArrMap\<rparr>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vsv ((\<GG> \<^sub>S\<^sub>M\<^sub>C\<^sub>F\<circ> \<FF>)\<lparr>ArrMap\<rparr>)
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. vsv ((\<GG> \<^sub>S\<^sub>M\<^sub>C\<^sub>F\<circ> \<FF>)\<lparr>ArrMap\<rparr>)
[PROOF STEP]
interpret L: is_semifunctor \<alpha> \<open>op_smc \<BB>\<close> \<CC> \<GG>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<GG> : op_smc \<BB> \<mapsto>\<mapsto>\<^sub>S\<^sub>M\<^sub>C\<^bsub>\<alpha>\<^esub> \<CC>
[PROOF STEP]
by (rule assms(1))
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. vsv ((\<GG> \<^sub>S\<^sub>M\<^sub>C\<^sub>F\<circ> \<FF>)\<lparr>ArrMap\<rparr>)
[PROOF STEP]
interpret R: is_semifunctor \<alpha> \<AA> \<BB> \<FF>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<FF> : \<AA> \<mapsto>\<mapsto>\<^sub>S\<^sub>M\<^sub>C\<^bsub>\<alpha>\<^esub> \<BB>
[PROOF STEP]
by (rule assms(2))
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. vsv ((\<GG> \<^sub>S\<^sub>M\<^sub>C\<^sub>F\<circ> \<FF>)\<lparr>ArrMap\<rparr>)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vsv ((\<GG> \<^sub>S\<^sub>M\<^sub>C\<^sub>F\<circ> \<FF>)\<lparr>ArrMap\<rparr>)
[PROOF STEP]
by
      (
        rule dghm_cn_cov_comp_ArrMap_vsv
          [
            OF
              L.smcf_is_dghm[unfolded slicing_commute[symmetric]]
              R.smcf_is_dghm[unfolded slicing_commute[symmetric]],
            unfolded slicing_commute slicing_simps
          ]
      )
[PROOF STATE]
proof (state)
this:
vsv ((\<GG> \<^sub>S\<^sub>M\<^sub>C\<^sub>F\<circ> \<FF>)\<lparr>ArrMap\<rparr>)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma (in category) cf_lcomp_Hom_ArrMap_vrange:
  assumes "\<FF> : \<BB> \<mapsto>\<mapsto>\<^sub>C\<^bsub>\<alpha>\<^esub> \<CC>"
  shows "\<R>\<^sub>\<circ> (Hom\<^sub>O\<^sub>.\<^sub>C\<^bsub>\<alpha>\<^esub>\<CC>(\<FF>-,-)\<lparr>ArrMap\<rparr>) \<subseteq>\<^sub>\<circ> cat_Set \<alpha>\<lparr>Arr\<rparr>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<R>\<^sub>\<circ> (Hom\<^sub>O\<^sub>.\<^sub>C\<^bsub>\<alpha>\<^esub>\<CC>(\<FF>-,-)\<lparr>ArrMap\<rparr>) \<subseteq>\<^sub>\<circ> cat_Set \<alpha>\<lparr>Arr\<rparr>
[PROOF STEP]
using category_axioms assms
[PROOF STATE]
proof (prove)
using this:
category \<alpha> \<CC>
\<FF> : \<BB> \<mapsto>\<mapsto>\<^sub>C\<^bsub>\<alpha>\<^esub> \<CC>

goal (1 subgoal):
 1. \<R>\<^sub>\<circ> (Hom\<^sub>O\<^sub>.\<^sub>C\<^bsub>\<alpha>\<^esub>\<CC>(\<FF>-,-)\<lparr>ArrMap\<rparr>) \<subseteq>\<^sub>\<circ> cat_Set \<alpha>\<lparr>Arr\<rparr>
[PROOF STEP]
unfolding cf_lcomp_Hom_def
[PROOF STATE]
proof (prove)
using this:
category \<alpha> \<CC>
\<FF> : \<BB> \<mapsto>\<mapsto>\<^sub>C\<^bsub>\<alpha>\<^esub> \<CC>

goal (1 subgoal):
 1. \<R>\<^sub>\<circ> (cf_cn_cov_lcomp \<CC> Hom\<^sub>O\<^sub>.\<^sub>C\<^bsub>\<alpha>\<^esub>\<CC>(-,-) \<FF>\<lparr>ArrMap\<rparr>) \<subseteq>\<^sub>\<circ> cat_Set \<alpha>\<lparr>Arr\<rparr>
[PROOF STEP]
by (intro cf_cn_cov_lcomp_ArrMap_vrange)
    (cs_concl cs_shallow cs_simp: cat_cs_simps cs_intro: cat_cs_intros)


[STATEMENT]
lemma infinite_disjoint_family_imp_infinite_UNION:
  assumes "\<not>finite A" "\<And>x. x \<in> A \<Longrightarrow> f x \<noteq> {}" "disjoint_family_on f A"
  shows   "\<not>finite (\<Union>(f ` A))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. infinite (\<Union> (f ` A))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. infinite (\<Union> (f ` A))
[PROOF STEP]
define g where "g x = (SOME y. y \<in> f x)" for x
[PROOF STATE]
proof (state)
this:
g ?x = (SOME y. y \<in> f ?x)

goal (1 subgoal):
 1. infinite (\<Union> (f ` A))
[PROOF STEP]
have g: "g x \<in> f x" if "x \<in> A" for x
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. g x \<in> f x
[PROOF STEP]
unfolding g_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (SOME y. y \<in> f x) \<in> f x
[PROOF STEP]
by (rule someI_ex, insert assms(2) that) blast
[PROOF STATE]
proof (state)
this:
?x \<in> A \<Longrightarrow> g ?x \<in> f ?x

goal (1 subgoal):
 1. infinite (\<Union> (f ` A))
[PROOF STEP]
have inj_on_g: "inj_on g A"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. inj_on g A
[PROOF STEP]
proof (rule inj_onI, rule ccontr)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x y. \<lbrakk>x \<in> A; y \<in> A; g x = g y; x \<noteq> y\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
fix x y
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x y. \<lbrakk>x \<in> A; y \<in> A; g x = g y; x \<noteq> y\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
assume A: "x \<in> A" "y \<in> A" "g x = g y" "x \<noteq> y"
[PROOF STATE]
proof (state)
this:
x \<in> A
y \<in> A
g x = g y
x \<noteq> y

goal (1 subgoal):
 1. \<And>x y. \<lbrakk>x \<in> A; y \<in> A; g x = g y; x \<noteq> y\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
with g[of x] g[of y]
[PROOF STATE]
proof (chain)
picking this:
x \<in> A \<Longrightarrow> g x \<in> f x
y \<in> A \<Longrightarrow> g y \<in> f y
x \<in> A
y \<in> A
g x = g y
x \<noteq> y
[PROOF STEP]
have "g x \<in> f x" "g x \<in> f y"
[PROOF STATE]
proof (prove)
using this:
x \<in> A \<Longrightarrow> g x \<in> f x
y \<in> A \<Longrightarrow> g y \<in> f y
x \<in> A
y \<in> A
g x = g y
x \<noteq> y

goal (1 subgoal):
 1. g x \<in> f x &&& g x \<in> f y
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
g x \<in> f x
g x \<in> f y

goal (1 subgoal):
 1. \<And>x y. \<lbrakk>x \<in> A; y \<in> A; g x = g y; x \<noteq> y\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
with A \<open>x \<noteq> y\<close> assms
[PROOF STATE]
proof (chain)
picking this:
x \<in> A
y \<in> A
g x = g y
x \<noteq> y
x \<noteq> y
infinite A
?x \<in> A \<Longrightarrow> f ?x \<noteq> {}
disjoint_family_on f A
g x \<in> f x
g x \<in> f y
[PROOF STEP]
show False
[PROOF STATE]
proof (prove)
using this:
x \<in> A
y \<in> A
g x = g y
x \<noteq> y
x \<noteq> y
infinite A
?x \<in> A \<Longrightarrow> f ?x \<noteq> {}
disjoint_family_on f A
g x \<in> f x
g x \<in> f y

goal (1 subgoal):
 1. False
[PROOF STEP]
by (auto simp: disjoint_family_on_def inj_on_def)
[PROOF STATE]
proof (state)
this:
False

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
inj_on g A

goal (1 subgoal):
 1. infinite (\<Union> (f ` A))
[PROOF STEP]
from g
[PROOF STATE]
proof (chain)
picking this:
?x \<in> A \<Longrightarrow> g ?x \<in> f ?x
[PROOF STEP]
have "g ` A \<subseteq> \<Union>(f ` A)"
[PROOF STATE]
proof (prove)
using this:
?x \<in> A \<Longrightarrow> g ?x \<in> f ?x

goal (1 subgoal):
 1. g ` A \<subseteq> \<Union> (f ` A)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
g ` A \<subseteq> \<Union> (f ` A)

goal (1 subgoal):
 1. infinite (\<Union> (f ` A))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
g ` A \<subseteq> \<Union> (f ` A)

goal (1 subgoal):
 1. infinite (\<Union> (f ` A))
[PROOF STEP]
from inj_on_g \<open>\<not>finite A\<close>
[PROOF STATE]
proof (chain)
picking this:
inj_on g A
infinite A
[PROOF STEP]
have "\<not>finite (g ` A)"
[PROOF STATE]
proof (prove)
using this:
inj_on g A
infinite A

goal (1 subgoal):
 1. infinite (g ` A)
[PROOF STEP]
using finite_imageD
[PROOF STATE]
proof (prove)
using this:
inj_on g A
infinite A
\<lbrakk>finite (?f ` ?A); inj_on ?f ?A\<rbrakk> \<Longrightarrow> finite ?A

goal (1 subgoal):
 1. infinite (g ` A)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
infinite (g ` A)

goal (1 subgoal):
 1. infinite (\<Union> (f ` A))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
g ` A \<subseteq> \<Union> (f ` A)
infinite (g ` A)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
g ` A \<subseteq> \<Union> (f ` A)
infinite (g ` A)

goal (1 subgoal):
 1. infinite (\<Union> (f ` A))
[PROOF STEP]
using finite_subset
[PROOF STATE]
proof (prove)
using this:
g ` A \<subseteq> \<Union> (f ` A)
infinite (g ` A)
\<lbrakk>?A \<subseteq> ?B; finite ?B\<rbrakk> \<Longrightarrow> finite ?A

goal (1 subgoal):
 1. infinite (\<Union> (f ` A))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
infinite (\<Union> (f ` A))

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma isPath_tail:
  "isPath u (p@[e]) v \<longleftrightarrow> isPath u p (fst e) \<and> e \<in> E \<and> snd e = v"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. isPath u (p @ [e]) v = (isPath u p (fst e) \<and> e \<in> E \<and> snd e = v)
[PROOF STEP]
by (induction p) (auto simp: isPath_append isPath_head)


[STATEMENT]
lemma ext_funcset_to_sing_iff [simp]: "A \<rightarrow>\<^sub>E {a} = {\<lambda>x\<in>A. a}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. A \<rightarrow>\<^sub>E {a} = {\<lambda>x\<in>A. a}
[PROOF STEP]
by (auto simp: PiE_def Pi_iff extensionalityI)


[STATEMENT]
lemma stirling_code [code]:
  "stirling n k =
    (if k = 0 then (if n = 0 then 1 else 0)
     else if k > n then 0
     else if k = n then 1
     else stirling_row n ! k)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. stirling n k = (if k = 0 then if n = 0 then 1 else 0 else if n < k then 0 else if k = n then 1 else stirling_row n ! k)
[PROOF STEP]
by (simp add: nth_stirling_row)


[STATEMENT]
lemma vimageE[elim]:
  assumes "x \<in>\<^sub>\<circ> vimage (R \<times>\<^sub>\<circ> X)"
  obtains r A where "x = \<langle>\<langle>r, A\<rangle>, r `\<^sub>\<circ> A\<rangle>" and "r \<in>\<^sub>\<circ> R" and "A \<in>\<^sub>\<circ> X"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>r A. \<lbrakk>x = \<langle>\<langle>r, A\<rangle>, r `\<^sub>\<circ> A\<rangle>; r \<in>\<^sub>\<circ> R; A \<in>\<^sub>\<circ> X\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
x \<in>\<^sub>\<circ> CZH_Sets_BRelations.vimage (R \<times>\<^sub>\<circ> X)

goal (1 subgoal):
 1. (\<And>r A. \<lbrakk>x = \<langle>\<langle>r, A\<rangle>, r `\<^sub>\<circ> A\<rangle>; r \<in>\<^sub>\<circ> R; A \<in>\<^sub>\<circ> X\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
unfolding vimage_def
[PROOF STATE]
proof (prove)
using this:
x \<in>\<^sub>\<circ> (\<lambda>\<langle>r, A\<rangle>\<in>\<^sub>\<circ>R \<times>\<^sub>\<circ> X. \<R>\<^sub>\<circ> (r \<restriction>\<^sup>l\<^sub>\<circ> A))

goal (1 subgoal):
 1. (\<And>r A. \<lbrakk>x = \<langle>\<langle>r, A\<rangle>, (\<lambda>\<langle>r, A\<rangle>\<in>\<^sub>\<circ>set {\<langle>r, A\<rangle>}. \<R>\<^sub>\<circ> (r \<restriction>\<^sup>l\<^sub>\<circ> A))\<lparr>\<langle>r, A\<rangle>\<rparr>\<rangle>; r \<in>\<^sub>\<circ> R; A \<in>\<^sub>\<circ> X\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto


[STATEMENT]
lemma zmset_of_inject[simp]: "zmset_of M = zmset_of N \<longleftrightarrow> M = N"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (zmset_of M = zmset_of N) = (M = N)
[PROOF STEP]
by (simp add: zmset_of_def, transfer, auto simp: equiv_zmset_def)


[STATEMENT]
lemma DERIV_cmult:
  "(f has_field_derivative D) (at x within s) \<Longrightarrow>
    ((\<lambda>x. c * f x) has_field_derivative c * D) (at x within s)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (f has_field_derivative D) (at x within s) \<Longrightarrow> ((\<lambda>x. c * f x) has_field_derivative c * D) (at x within s)
[PROOF STEP]
by (drule DERIV_mult' [OF DERIV_const]) simp


[STATEMENT]
lemma if_unfold_right: "(d = (if a then b else c)) = ((a \<longrightarrow> d = b) \<and> (\<not> a \<longrightarrow> d = c))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (d = (if a then b else c)) = ((a \<longrightarrow> d = b) \<and> (\<not> a \<longrightarrow> d = c))
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma lub_option_upper:
  assumes "Complete_Partial_Order.chain (ord_option ord) Y" "x \<in> Y"
  and lub_upper: "\<And>Y x. \<lbrakk> Complete_Partial_Order.chain ord Y; x \<in> Y \<rbrakk> \<Longrightarrow> ord x (lub Y)"
  shows "ord_option ord x (lub_option lub Y)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ord_option ord x (lub_option lub Y)
[PROOF STEP]
using assms(1-2)
[PROOF STATE]
proof (prove)
using this:
Complete_Partial_Order.chain (ord_option ord) Y
x \<in> Y

goal (1 subgoal):
 1. ord_option ord x (lub_option lub Y)
[PROOF STEP]
by(cases x)(auto simp add: lub_option_def intro: lub_upper[OF ord_option_chainD])


[STATEMENT]
lemma product_nodes_finite[intro]:
      assumes "list_all (finite \<circ> a.nodes) AA"
      shows "finite (b.nodes (product AA))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. finite (b.nodes' (product AA))
[PROOF STEP]
using list.pred_map product_nodes assms
[PROOF STATE]
proof (prove)
using this:
list_all ?Q (map ?f ?x) = list_all (?Q \<circ> ?f) ?x
b.nodes' (product ?AA) \<subseteq> listset (map a.nodes' ?AA)
list_all (finite \<circ> a.nodes') AA

goal (1 subgoal):
 1. finite (b.nodes' (product AA))
[PROOF STEP]
by (blast dest: finite_subset)


[STATEMENT]
lemma (in finite_measure) finite_measure_mono:
  assumes "A \<subseteq> B" "B \<in> sets M" shows "measure M A \<le> measure M B"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Sigma_Algebra.measure M A \<le> Sigma_Algebra.measure M B
[PROOF STEP]
using emeasure_mono[OF assms] emeasure_real[of A] emeasure_real[of B]
[PROOF STATE]
proof (prove)
using this:
emeasure M A \<le> emeasure M B
\<exists>r\<ge>0. emeasure M A = ennreal r
\<exists>r\<ge>0. emeasure M B = ennreal r

goal (1 subgoal):
 1. Sigma_Algebra.measure M A \<le> Sigma_Algebra.measure M B
[PROOF STEP]
by (auto simp: measure_def)