[STATEMENT]
lemma extendLevel_Nsteps:
  "\<lbrakk>sset belowN = {\<phi>. max_depth \<phi> < n}; sset N = {\<phi>. max_depth \<phi> = n}\<rbrakk> \<Longrightarrow>
  \<exists>belowNext Next. (extendLevel ^^ m) (belowN, N) = (belowNext, Next) \<and>
     sset belowNext = {\<phi>. max_depth \<phi> < n + m} \<and> sset Next = {\<phi>. max_depth \<phi> = n + m}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>i.R belowN = {\<phi>. max_depth \<phi> < n}; i.R N = {\<phi>. max_depth \<phi> = n}\<rbrakk> \<Longrightarrow> \<exists>belowNext Next. (extendLevel ^^ m) (belowN, N) = (belowNext, Next) \<and> i.R belowNext = {\<phi>. max_depth \<phi> < n + m} \<and> i.R Next = {\<phi>. max_depth \<phi> = n + m}
[PROOF STEP]
proof (induction m arbitrary: belowN N n)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>belowN N n. \<lbrakk>i.R belowN = {\<phi>. max_depth \<phi> < n}; i.R N = {\<phi>. max_depth \<phi> = n}\<rbrakk> \<Longrightarrow> \<exists>belowNext Next. (extendLevel ^^ 0) (belowN, N) = (belowNext, Next) \<and> i.R belowNext = {\<phi>. max_depth \<phi> < n + 0} \<and> i.R Next = {\<phi>. max_depth \<phi> = n + 0}
 2. \<And>m belowN N n. \<lbrakk>\<And>belowN N n. \<lbrakk>i.R belowN = {\<phi>. max_depth \<phi> < n}; i.R N = {\<phi>. max_depth \<phi> = n}\<rbrakk> \<Longrightarrow> \<exists>belowNext Next. (extendLevel ^^ m) (belowN, N) = (belowNext, Next) \<and> i.R belowNext = {\<phi>. max_depth \<phi> < n + m} \<and> i.R Next = {\<phi>. max_depth \<phi> = n + m}; i.R belowN = {\<phi>. max_depth \<phi> < n}; i.R N = {\<phi>. max_depth \<phi> = n}\<rbrakk> \<Longrightarrow> \<exists>belowNext Next. (extendLevel ^^ Suc m) (belowN, N) = (belowNext, Next) \<and> i.R belowNext = {\<phi>. max_depth \<phi> < n + Suc m} \<and> i.R Next = {\<phi>. max_depth \<phi> = n + Suc m}
[PROOF STEP]
case (Suc m)
[PROOF STATE]
proof (state)
this:
\<lbrakk>i.R ?belowN = {\<phi>. max_depth \<phi> < ?n}; i.R ?N = {\<phi>. max_depth \<phi> = ?n}\<rbrakk> \<Longrightarrow> \<exists>belowNext Next. (extendLevel ^^ m) (?belowN, ?N) = (belowNext, Next) \<and> i.R belowNext = {\<phi>. max_depth \<phi> < ?n + m} \<and> i.R Next = {\<phi>. max_depth \<phi> = ?n + m}
i.R belowN = {\<phi>. max_depth \<phi> < n}
i.R N = {\<phi>. max_depth \<phi> = n}

goal (2 subgoals):
 1. \<And>belowN N n. \<lbrakk>i.R belowN = {\<phi>. max_depth \<phi> < n}; i.R N = {\<phi>. max_depth \<phi> = n}\<rbrakk> \<Longrightarrow> \<exists>belowNext Next. (extendLevel ^^ 0) (belowN, N) = (belowNext, Next) \<and> i.R belowNext = {\<phi>. max_depth \<phi> < n + 0} \<and> i.R Next = {\<phi>. max_depth \<phi> = n + 0}
 2. \<And>m belowN N n. \<lbrakk>\<And>belowN N n. \<lbrakk>i.R belowN = {\<phi>. max_depth \<phi> < n}; i.R N = {\<phi>. max_depth \<phi> = n}\<rbrakk> \<Longrightarrow> \<exists>belowNext Next. (extendLevel ^^ m) (belowN, N) = (belowNext, Next) \<and> i.R belowNext = {\<phi>. max_depth \<phi> < n + m} \<and> i.R Next = {\<phi>. max_depth \<phi> = n + m}; i.R belowN = {\<phi>. max_depth \<phi> < n}; i.R N = {\<phi>. max_depth \<phi> = n}\<rbrakk> \<Longrightarrow> \<exists>belowNext Next. (extendLevel ^^ Suc m) (belowN, N) = (belowNext, Next) \<and> i.R belowNext = {\<phi>. max_depth \<phi> < n + Suc m} \<and> i.R Next = {\<phi>. max_depth \<phi> = n + Suc m}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>i.R ?belowN = {\<phi>. max_depth \<phi> < ?n}; i.R ?N = {\<phi>. max_depth \<phi> = ?n}\<rbrakk> \<Longrightarrow> \<exists>belowNext Next. (extendLevel ^^ m) (?belowN, ?N) = (belowNext, Next) \<and> i.R belowNext = {\<phi>. max_depth \<phi> < ?n + m} \<and> i.R Next = {\<phi>. max_depth \<phi> = ?n + m}
i.R belowN = {\<phi>. max_depth \<phi> < n}
i.R N = {\<phi>. max_depth \<phi> = n}
[PROOF STEP]
obtain belowNext Next where "(extendLevel ^^ m) (belowN, N) = (belowNext, Next)"
    "sset belowNext = {\<phi>. max_depth \<phi> < n + m}" "sset Next = {\<phi>. max_depth \<phi> = n + m}"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>i.R ?belowN = {\<phi>. max_depth \<phi> < ?n}; i.R ?N = {\<phi>. max_depth \<phi> = ?n}\<rbrakk> \<Longrightarrow> \<exists>belowNext Next. (extendLevel ^^ m) (?belowN, ?N) = (belowNext, Next) \<and> i.R belowNext = {\<phi>. max_depth \<phi> < ?n + m} \<and> i.R Next = {\<phi>. max_depth \<phi> = ?n + m}
i.R belowN = {\<phi>. max_depth \<phi> < n}
i.R N = {\<phi>. max_depth \<phi> = n}

goal (1 subgoal):
 1. (\<And>belowNext Next. \<lbrakk>(extendLevel ^^ m) (belowN, N) = (belowNext, Next); i.R belowNext = {\<phi>. max_depth \<phi> < n + m}; i.R Next = {\<phi>. max_depth \<phi> = n + m}\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(extendLevel ^^ m) (belowN, N) = (belowNext, Next)
i.R belowNext = {\<phi>. max_depth \<phi> < n + m}
i.R Next = {\<phi>. max_depth \<phi> = n + m}

goal (2 subgoals):
 1. \<And>belowN N n. \<lbrakk>i.R belowN = {\<phi>. max_depth \<phi> < n}; i.R N = {\<phi>. max_depth \<phi> = n}\<rbrakk> \<Longrightarrow> \<exists>belowNext Next. (extendLevel ^^ 0) (belowN, N) = (belowNext, Next) \<and> i.R belowNext = {\<phi>. max_depth \<phi> < n + 0} \<and> i.R Next = {\<phi>. max_depth \<phi> = n + 0}
 2. \<And>m belowN N n. \<lbrakk>\<And>belowN N n. \<lbrakk>i.R belowN = {\<phi>. max_depth \<phi> < n}; i.R N = {\<phi>. max_depth \<phi> = n}\<rbrakk> \<Longrightarrow> \<exists>belowNext Next. (extendLevel ^^ m) (belowN, N) = (belowNext, Next) \<and> i.R belowNext = {\<phi>. max_depth \<phi> < n + m} \<and> i.R Next = {\<phi>. max_depth \<phi> = n + m}; i.R belowN = {\<phi>. max_depth \<phi> < n}; i.R N = {\<phi>. max_depth \<phi> = n}\<rbrakk> \<Longrightarrow> \<exists>belowNext Next. (extendLevel ^^ Suc m) (belowN, N) = (belowNext, Next) \<and> i.R belowNext = {\<phi>. max_depth \<phi> < n + Suc m} \<and> i.R Next = {\<phi>. max_depth \<phi> = n + Suc m}
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
(extendLevel ^^ m) (belowN, N) = (belowNext, Next)
i.R belowNext = {\<phi>. max_depth \<phi> < n + m}
i.R Next = {\<phi>. max_depth \<phi> = n + m}

goal (1 subgoal):
 1. \<exists>belowNext Next. (extendLevel ^^ Suc m) (belowN, N) = (belowNext, Next) \<and> i.R belowNext = {\<phi>. max_depth \<phi> < n + Suc m} \<and> i.R Next = {\<phi>. max_depth \<phi> = n + Suc m}
[PROOF STEP]
unfolding funpow.simps o_apply add_Suc_right
[PROOF STATE]
proof (prove)
using this:
(extendLevel ^^ m) (belowN, N) = (belowNext, Next)
i.R belowNext = {\<phi>. max_depth \<phi> < n + m}
i.R Next = {\<phi>. max_depth \<phi> = n + m}

goal (1 subgoal):
 1. \<exists>belowNext Next. extendLevel ((extendLevel ^^ m) (belowN, N)) = (belowNext, Next) \<and> i.R belowNext = {\<phi>. max_depth \<phi> < Suc (n + m)} \<and> i.R Next = {\<phi>. max_depth \<phi> = Suc (n + m)}
[PROOF STEP]
by (intro extendLevel_step[of belowNext _ Next])
[PROOF STATE]
proof (state)
this:
\<exists>belowNext Next. (extendLevel ^^ Suc m) (belowN, N) = (belowNext, Next) \<and> i.R belowNext = {\<phi>. max_depth \<phi> < n + Suc m} \<and> i.R Next = {\<phi>. max_depth \<phi> = n + Suc m}

goal (1 subgoal):
 1. \<And>belowN N n. \<lbrakk>i.R belowN = {\<phi>. max_depth \<phi> < n}; i.R N = {\<phi>. max_depth \<phi> = n}\<rbrakk> \<Longrightarrow> \<exists>belowNext Next. (extendLevel ^^ 0) (belowN, N) = (belowNext, Next) \<and> i.R belowNext = {\<phi>. max_depth \<phi> < n + 0} \<and> i.R Next = {\<phi>. max_depth \<phi> = n + 0}
[PROOF STEP]
qed simp


[STATEMENT]
theorem code_blue_dfs_correct':
  assumes G: "b_graph G" "finite ((g_E G)\<^sup>* `` g_V0 G)"
  assumes REL: "(Gi,G)\<in>bg_impl_rel_ext unit_rel Id"
  shows "case code_blue_dfs Gi of
      None \<Rightarrow> \<forall>prpl. \<not>b_graph.is_lasso_prpl G prpl
    | Some L \<Rightarrow> b_graph.is_lasso_prpl G L"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. case code_blue_dfs Gi of None \<Rightarrow> \<forall>prpl. \<not> b_graph.is_lasso_prpl G prpl | Some L \<Rightarrow> b_graph.is_lasso_prpl G L
[PROOF STEP]
using code_blue_dfs_correct[OF G REL]
[PROOF STATE]
proof (prove)
using this:
RETURN (code_blue_dfs Gi) \<le> SPEC (\<lambda>r. case r of None \<Rightarrow> \<forall>prpl. \<not> b_graph.is_lasso_prpl G prpl | Some L \<Rightarrow> b_graph.is_lasso_prpl G L)

goal (1 subgoal):
 1. case code_blue_dfs Gi of None \<Rightarrow> \<forall>prpl. \<not> b_graph.is_lasso_prpl G prpl | Some L \<Rightarrow> b_graph.is_lasso_prpl G L
[PROOF STEP]
by simp


[STATEMENT]
lemma cnj_of_int [simp]: "cnj (octo_of_int x) = octo_of_nat( x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Octonions.cnj (octo_of_int (int x)) = octo_of_nat x
[PROOF STEP]
using  octo_of_real_def  octo_of_real_of_int_eq  octo_of_int_def octo_of_nat_def
   cnj_of_real
[PROOF STATE]
proof (prove)
using this:
octo_of_real ?r = ?r *\<^sub>R 1
octo_of_real (real_of_int ?z) = octo_of_int ?z
octo_of_int ?r = real_of_int ?r *\<^sub>R 1
octo_of_nat ?r = real ?r *\<^sub>R 1
Octonions.cnj (octo_of_real ?x) = octo_of_real ?x

goal (1 subgoal):
 1. Octonions.cnj (octo_of_int (int x)) = octo_of_nat x
[PROOF STEP]
by auto


[STATEMENT]
lemma lemma0:
  assumes "i \<in> Basis"
    shows "content (cbox u v) / (interval_upperbound (cbox u v) \<bullet> i - interval_lowerbound (cbox u v) \<bullet> i) =
           (if content (cbox u v) = 0 then 0
            else \<Prod>j \<in> Basis - {i}. interval_upperbound (cbox u v) \<bullet> j - interval_lowerbound (cbox u v) \<bullet> j)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. content (cbox u v) / (interval_upperbound (cbox u v) \<bullet> i - interval_lowerbound (cbox u v) \<bullet> i) = (if content (cbox u v) = 0 then 0 else \<Prod>j\<in>Basis - {i}. interval_upperbound (cbox u v) \<bullet> j - interval_lowerbound (cbox u v) \<bullet> j)
[PROOF STEP]
proof (cases "content (cbox u v) = 0")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. content (cbox u v) = 0 \<Longrightarrow> content (cbox u v) / (interval_upperbound (cbox u v) \<bullet> i - interval_lowerbound (cbox u v) \<bullet> i) = (if content (cbox u v) = 0 then 0 else \<Prod>j\<in>Basis - {i}. interval_upperbound (cbox u v) \<bullet> j - interval_lowerbound (cbox u v) \<bullet> j)
 2. content (cbox u v) \<noteq> 0 \<Longrightarrow> content (cbox u v) / (interval_upperbound (cbox u v) \<bullet> i - interval_lowerbound (cbox u v) \<bullet> i) = (if content (cbox u v) = 0 then 0 else \<Prod>j\<in>Basis - {i}. interval_upperbound (cbox u v) \<bullet> j - interval_lowerbound (cbox u v) \<bullet> j)
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
content (cbox u v) = 0

goal (2 subgoals):
 1. content (cbox u v) = 0 \<Longrightarrow> content (cbox u v) / (interval_upperbound (cbox u v) \<bullet> i - interval_lowerbound (cbox u v) \<bullet> i) = (if content (cbox u v) = 0 then 0 else \<Prod>j\<in>Basis - {i}. interval_upperbound (cbox u v) \<bullet> j - interval_lowerbound (cbox u v) \<bullet> j)
 2. content (cbox u v) \<noteq> 0 \<Longrightarrow> content (cbox u v) / (interval_upperbound (cbox u v) \<bullet> i - interval_lowerbound (cbox u v) \<bullet> i) = (if content (cbox u v) = 0 then 0 else \<Prod>j\<in>Basis - {i}. interval_upperbound (cbox u v) \<bullet> j - interval_lowerbound (cbox u v) \<bullet> j)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
content (cbox u v) = 0
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
content (cbox u v) = 0

goal (1 subgoal):
 1. content (cbox u v) / (interval_upperbound (cbox u v) \<bullet> i - interval_lowerbound (cbox u v) \<bullet> i) = (if content (cbox u v) = 0 then 0 else \<Prod>j\<in>Basis - {i}. interval_upperbound (cbox u v) \<bullet> j - interval_lowerbound (cbox u v) \<bullet> j)
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
content (cbox u v) / (interval_upperbound (cbox u v) \<bullet> i - interval_lowerbound (cbox u v) \<bullet> i) = (if content (cbox u v) = 0 then 0 else \<Prod>j\<in>Basis - {i}. interval_upperbound (cbox u v) \<bullet> j - interval_lowerbound (cbox u v) \<bullet> j)

goal (1 subgoal):
 1. content (cbox u v) \<noteq> 0 \<Longrightarrow> content (cbox u v) / (interval_upperbound (cbox u v) \<bullet> i - interval_lowerbound (cbox u v) \<bullet> i) = (if content (cbox u v) = 0 then 0 else \<Prod>j\<in>Basis - {i}. interval_upperbound (cbox u v) \<bullet> j - interval_lowerbound (cbox u v) \<bullet> j)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. content (cbox u v) \<noteq> 0 \<Longrightarrow> content (cbox u v) / (interval_upperbound (cbox u v) \<bullet> i - interval_lowerbound (cbox u v) \<bullet> i) = (if content (cbox u v) = 0 then 0 else \<Prod>j\<in>Basis - {i}. interval_upperbound (cbox u v) \<bullet> j - interval_lowerbound (cbox u v) \<bullet> j)
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
content (cbox u v) \<noteq> 0

goal (1 subgoal):
 1. content (cbox u v) \<noteq> 0 \<Longrightarrow> content (cbox u v) / (interval_upperbound (cbox u v) \<bullet> i - interval_lowerbound (cbox u v) \<bullet> i) = (if content (cbox u v) = 0 then 0 else \<Prod>j\<in>Basis - {i}. interval_upperbound (cbox u v) \<bullet> j - interval_lowerbound (cbox u v) \<bullet> j)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
content (cbox u v) \<noteq> 0
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
content (cbox u v) \<noteq> 0

goal (1 subgoal):
 1. content (cbox u v) / (interval_upperbound (cbox u v) \<bullet> i - interval_lowerbound (cbox u v) \<bullet> i) = (if content (cbox u v) = 0 then 0 else \<Prod>j\<in>Basis - {i}. interval_upperbound (cbox u v) \<bullet> j - interval_lowerbound (cbox u v) \<bullet> j)
[PROOF STEP]
using prod.subset_diff [of "{i}" Basis] assms
[PROOF STATE]
proof (prove)
using this:
content (cbox u v) \<noteq> 0
\<lbrakk>{i} \<subseteq> Basis; finite Basis\<rbrakk> \<Longrightarrow> prod ?g Basis = prod ?g (Basis - {i}) * prod ?g {i}
i \<in> Basis

goal (1 subgoal):
 1. content (cbox u v) / (interval_upperbound (cbox u v) \<bullet> i - interval_lowerbound (cbox u v) \<bullet> i) = (if content (cbox u v) = 0 then 0 else \<Prod>j\<in>Basis - {i}. interval_upperbound (cbox u v) \<bullet> j - interval_lowerbound (cbox u v) \<bullet> j)
[PROOF STEP]
by (force simp: content_cbox_if divide_simps  split: if_split_asm)
[PROOF STATE]
proof (state)
this:
content (cbox u v) / (interval_upperbound (cbox u v) \<bullet> i - interval_lowerbound (cbox u v) \<bullet> i) = (if content (cbox u v) = 0 then 0 else \<Prod>j\<in>Basis - {i}. interval_upperbound (cbox u v) \<bullet> j - interval_lowerbound (cbox u v) \<bullet> j)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma (in Order) Iod_segment_segment:"a \<in> carrier (Iod D (segment D b)) \<Longrightarrow>
      Iod (Iod D (segment D b)) (segment (Iod D (segment D b)) a) =
      Iod D (segment D a)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. a \<in> carrier (Iod D (segment D b)) \<Longrightarrow> Iod (Iod D (segment D b)) (segment (Iod D (segment D b)) a) = Iod D (segment D a)
[PROOF STEP]
apply (case_tac "b \<in> carrier D")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>a \<in> carrier (Iod D (segment D b)); b \<in> carrier D\<rbrakk> \<Longrightarrow> Iod (Iod D (segment D b)) (segment (Iod D (segment D b)) a) = Iod D (segment D a)
 2. \<lbrakk>a \<in> carrier (Iod D (segment D b)); b \<notin> carrier D\<rbrakk> \<Longrightarrow> Iod (Iod D (segment D b)) (segment (Iod D (segment D b)) a) = Iod D (segment D a)
[PROOF STEP]
apply (cut_tac segment_sub[of "b"])
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>a \<in> carrier (Iod D (segment D b)); b \<in> carrier D; segment D b \<subseteq> carrier D\<rbrakk> \<Longrightarrow> Iod (Iod D (segment D b)) (segment (Iod D (segment D b)) a) = Iod D (segment D a)
 2. \<lbrakk>a \<in> carrier (Iod D (segment D b)); b \<notin> carrier D\<rbrakk> \<Longrightarrow> Iod (Iod D (segment D b)) (segment (Iod D (segment D b)) a) = Iod D (segment D a)
[PROOF STEP]
apply (simp add:Iod_carrier)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>a \<in> segment D b; b \<in> carrier D; segment D b \<subseteq> carrier D\<rbrakk> \<Longrightarrow> Iod (Iod D (segment D b)) (segment (Iod D (segment D b)) a) = Iod D (segment D a)
 2. \<lbrakk>a \<in> carrier (Iod D (segment D b)); b \<notin> carrier D\<rbrakk> \<Longrightarrow> Iod (Iod D (segment D b)) (segment (Iod D (segment D b)) a) = Iod D (segment D a)
[PROOF STEP]
apply (frule segment_inc_psub[of "a" "b"],
        frule psubset_imp_subset[of "segment D a" "segment D b"],
        thin_tac "segment D a \<subset> segment D b")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>a \<in> segment D b; b \<in> carrier D; segment D b \<subseteq> carrier D; segment D a \<subseteq> segment D b\<rbrakk> \<Longrightarrow> Iod (Iod D (segment D b)) (segment (Iod D (segment D b)) a) = Iod D (segment D a)
 2. \<lbrakk>a \<in> carrier (Iod D (segment D b)); b \<notin> carrier D\<rbrakk> \<Longrightarrow> Iod (Iod D (segment D b)) (segment (Iod D (segment D b)) a) = Iod D (segment D a)
[PROOF STEP]
apply (simp add:segment_segment[of "b" "a"])
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>a \<in> segment D b; b \<in> carrier D; segment D b \<subseteq> carrier D; segment D a \<subseteq> segment D b\<rbrakk> \<Longrightarrow> Iod (Iod D (segment D b)) (segment D a) = Iod D (segment D a)
 2. \<lbrakk>a \<in> carrier (Iod D (segment D b)); b \<notin> carrier D\<rbrakk> \<Longrightarrow> Iod (Iod D (segment D b)) (segment (Iod D (segment D b)) a) = Iod D (segment D a)
[PROOF STEP]
apply (simp add:Iod_sub_sub[of "segment D a" "segment D b"])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>a \<in> carrier (Iod D (segment D b)); b \<notin> carrier D\<rbrakk> \<Longrightarrow> Iod (Iod D (segment D b)) (segment (Iod D (segment D b)) a) = Iod D (segment D a)
[PROOF STEP]
apply (simp add:segment_def[of D b])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>a \<in> carrier (Iod D (carrier D)); b \<notin> carrier D\<rbrakk> \<Longrightarrow> Iod (Iod D (carrier D)) (segment (Iod D (carrier D)) a) = Iod D (segment D a)
[PROOF STEP]
apply (simp add:Iod_self[THEN sym])
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma nat_of_plus_sat [simp, code abstract]:
  "nat_of (x + y) = min (nat_of x + nat_of y) (LENGTH('a))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. nat_of (x + y) = min (nat_of x + nat_of y) LENGTH('a)
[PROOF STEP]
by (simp add: plus_sat_def)


[STATEMENT]
theorem "\<And>(y::int) (z::int) n. Suc n < 6 \<Longrightarrow> 3 dvd z \<Longrightarrow>
    2 dvd (y::int) \<Longrightarrow> (\<exists>(x::int).  2*x = y) \<and> (\<exists>(k::int). 3*k = z)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>y z n. \<lbrakk>Suc n < 6; 3 dvd z; even y\<rbrakk> \<Longrightarrow> (\<exists>x. 2 * x = y) \<and> (\<exists>k. 3 * k = z)
[PROOF STEP]
by cooper


[STATEMENT]
lemma If_tr: "(If b then t else e) = ((b andalso t) orelse (neg\<cdot>b andalso e))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. If b then t else e = (b andalso t orelse neg\<cdot>b andalso e)
[PROOF STEP]
by (cases b) simp_all


[STATEMENT]
lemma nth_concat_split':
  assumes "i < length (concat xs)"
  obtains j k where "j < length xs" "k < length (xs ! j)" "concat xs ! i = xs ! j ! k" "i = sum_list (map length (take j xs)) + k"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>j k. \<lbrakk>j < length xs; k < length (xs ! j); concat xs ! i = xs ! j ! k; i = sum_list (map length (take j xs)) + k\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using concat_index_split_less_length_concat[OF assms]
[PROOF STATE]
proof (prove)
using this:
concat_index_split (0, i) xs = (?m, ?n) \<Longrightarrow> i = sum_list (map length (take ?m xs)) + ?n
concat_index_split (0, i) xs = (?m, ?n) \<Longrightarrow> ?m < length xs
concat_index_split (0, i) xs = (?m, ?n) \<Longrightarrow> ?n < length (xs ! ?m)
concat_index_split (0, i) xs = (?m, ?n) \<Longrightarrow> concat xs ! i = xs ! ?m ! ?n

goal (1 subgoal):
 1. (\<And>j k. \<lbrakk>j < length xs; k < length (xs ! j); concat xs ! i = xs ! j ! k; i = sum_list (map length (take j xs)) + k\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (meson old.prod.exhaust)


[STATEMENT]
lemma lhospital_at_top_at_top:
  fixes f g :: "real \<Rightarrow> real"
  assumes g_0: "LIM x at_top. g x :> at_top"
    and g': "eventually (\<lambda>x. g' x \<noteq> 0) at_top"
    and Df: "eventually (\<lambda>x. DERIV f x :> f' x) at_top"
    and Dg: "eventually (\<lambda>x. DERIV g x :> g' x) at_top"
    and lim: "((\<lambda> x. (f' x / g' x)) \<longlongrightarrow> x) at_top"
  shows "((\<lambda> x. f x / g x) \<longlongrightarrow> x) at_top"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<lambda>x. f x / g x) \<longlongrightarrow> x) at_top
[PROOF STEP]
unfolding filterlim_at_top_to_right
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<lambda>x. f (inverse x) / g (inverse x)) \<longlongrightarrow> x) (at_right 0)
[PROOF STEP]
proof (rule lhopital_right_0_at_top)
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. LIM x at_right 0. g (inverse x) :> at_top
 2. \<forall>\<^sub>F x in at_right 0. ?g' x \<noteq> 0
 3. \<forall>\<^sub>F x in at_right 0. ((\<lambda>x. f (inverse x)) has_real_derivative ?f' x) (at x)
 4. \<forall>\<^sub>F x in at_right 0. ((\<lambda>x. g (inverse x)) has_real_derivative ?g' x) (at x)
 5. ((\<lambda>x. ?f' x / ?g' x) \<longlongrightarrow> x) (at_right 0)
[PROOF STEP]
let ?F = "\<lambda>x. f (inverse x)"
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. LIM x at_right 0. g (inverse x) :> at_top
 2. \<forall>\<^sub>F x in at_right 0. ?g' x \<noteq> 0
 3. \<forall>\<^sub>F x in at_right 0. ((\<lambda>x. f (inverse x)) has_real_derivative ?f' x) (at x)
 4. \<forall>\<^sub>F x in at_right 0. ((\<lambda>x. g (inverse x)) has_real_derivative ?g' x) (at x)
 5. ((\<lambda>x. ?f' x / ?g' x) \<longlongrightarrow> x) (at_right 0)
[PROOF STEP]
let ?G = "\<lambda>x. g (inverse x)"
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. LIM x at_right 0. g (inverse x) :> at_top
 2. \<forall>\<^sub>F x in at_right 0. ?g' x \<noteq> 0
 3. \<forall>\<^sub>F x in at_right 0. ((\<lambda>x. f (inverse x)) has_real_derivative ?f' x) (at x)
 4. \<forall>\<^sub>F x in at_right 0. ((\<lambda>x. g (inverse x)) has_real_derivative ?g' x) (at x)
 5. ((\<lambda>x. ?f' x / ?g' x) \<longlongrightarrow> x) (at_right 0)
[PROOF STEP]
let ?R = "at_right (0::real)"
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. LIM x at_right 0. g (inverse x) :> at_top
 2. \<forall>\<^sub>F x in at_right 0. ?g' x \<noteq> 0
 3. \<forall>\<^sub>F x in at_right 0. ((\<lambda>x. f (inverse x)) has_real_derivative ?f' x) (at x)
 4. \<forall>\<^sub>F x in at_right 0. ((\<lambda>x. g (inverse x)) has_real_derivative ?g' x) (at x)
 5. ((\<lambda>x. ?f' x / ?g' x) \<longlongrightarrow> x) (at_right 0)
[PROOF STEP]
let ?D = "\<lambda>f' x. f' (inverse x) * - (inverse x ^ Suc (Suc 0))"
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. LIM x at_right 0. g (inverse x) :> at_top
 2. \<forall>\<^sub>F x in at_right 0. ?g' x \<noteq> 0
 3. \<forall>\<^sub>F x in at_right 0. ((\<lambda>x. f (inverse x)) has_real_derivative ?f' x) (at x)
 4. \<forall>\<^sub>F x in at_right 0. ((\<lambda>x. g (inverse x)) has_real_derivative ?g' x) (at x)
 5. ((\<lambda>x. ?f' x / ?g' x) \<longlongrightarrow> x) (at_right 0)
[PROOF STEP]
show "LIM x ?R. ?G x :> at_top"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. LIM x at_right 0. g (inverse x) :> at_top
[PROOF STEP]
using g_0
[PROOF STATE]
proof (prove)
using this:
filterlim g at_top at_top

goal (1 subgoal):
 1. LIM x at_right 0. g (inverse x) :> at_top
[PROOF STEP]
unfolding filterlim_at_top_to_right
[PROOF STATE]
proof (prove)
using this:
LIM x at_right 0. g (inverse x) :> at_top

goal (1 subgoal):
 1. LIM x at_right 0. g (inverse x) :> at_top
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
LIM x at_right 0. g (inverse x) :> at_top

goal (4 subgoals):
 1. \<forall>\<^sub>F x in at_right 0. ?g' x \<noteq> 0
 2. \<forall>\<^sub>F x in at_right 0. ((\<lambda>x. f (inverse x)) has_real_derivative ?f' x) (at x)
 3. \<forall>\<^sub>F x in at_right 0. ((\<lambda>x. g (inverse x)) has_real_derivative ?g' x) (at x)
 4. ((\<lambda>x. ?f' x / ?g' x) \<longlongrightarrow> x) (at_right 0)
[PROOF STEP]
show "eventually (\<lambda>x. DERIV ?G x  :> ?D g' x) ?R"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>\<^sub>F x in at_right 0. ((\<lambda>x. g (inverse x)) has_real_derivative g' (inverse x) * - (inverse x ^ Suc (Suc 0))) (at x)
[PROOF STEP]
unfolding eventually_at_right_to_top
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>\<^sub>F x in at_top. ((\<lambda>x. g (inverse x)) has_real_derivative g' (inverse (inverse x)) * - (inverse (inverse x) ^ Suc (Suc 0))) (at (inverse x))
[PROOF STEP]
using Dg eventually_ge_at_top[where c=1]
[PROOF STATE]
proof (prove)
using this:
\<forall>\<^sub>F x in at_top. (g has_real_derivative g' x) (at x)
eventually ((\<le>) (1::?'a1)) at_top

goal (1 subgoal):
 1. \<forall>\<^sub>F x in at_top. ((\<lambda>x. g (inverse x)) has_real_derivative g' (inverse (inverse x)) * - (inverse (inverse x) ^ Suc (Suc 0))) (at (inverse x))
[PROOF STEP]
by eventually_elim (rule derivative_eq_intros DERIV_chain'[where f=inverse] | simp)+
[PROOF STATE]
proof (state)
this:
\<forall>\<^sub>F x in at_right 0. ((\<lambda>x. g (inverse x)) has_real_derivative g' (inverse x) * - (inverse x ^ Suc (Suc 0))) (at x)

goal (3 subgoals):
 1. \<forall>\<^sub>F x in at_right 0. g' (inverse x) * - (inverse x ^ Suc (Suc 0)) \<noteq> 0
 2. \<forall>\<^sub>F x in at_right 0. ((\<lambda>x. f (inverse x)) has_real_derivative ?f' x) (at x)
 3. ((\<lambda>x. ?f' x / (g' (inverse x) * - (inverse x ^ Suc (Suc 0)))) \<longlongrightarrow> x) (at_right 0)
[PROOF STEP]
show "eventually (\<lambda>x. DERIV ?F x  :> ?D f' x) ?R"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>\<^sub>F x in at_right 0. ((\<lambda>x. f (inverse x)) has_real_derivative f' (inverse x) * - (inverse x ^ Suc (Suc 0))) (at x)
[PROOF STEP]
unfolding eventually_at_right_to_top
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>\<^sub>F x in at_top. ((\<lambda>x. f (inverse x)) has_real_derivative f' (inverse (inverse x)) * - (inverse (inverse x) ^ Suc (Suc 0))) (at (inverse x))
[PROOF STEP]
using Df eventually_ge_at_top[where c=1]
[PROOF STATE]
proof (prove)
using this:
\<forall>\<^sub>F x in at_top. (f has_real_derivative f' x) (at x)
eventually ((\<le>) (1::?'a1)) at_top

goal (1 subgoal):
 1. \<forall>\<^sub>F x in at_top. ((\<lambda>x. f (inverse x)) has_real_derivative f' (inverse (inverse x)) * - (inverse (inverse x) ^ Suc (Suc 0))) (at (inverse x))
[PROOF STEP]
by eventually_elim (rule derivative_eq_intros DERIV_chain'[where f=inverse] | simp)+
[PROOF STATE]
proof (state)
this:
\<forall>\<^sub>F x in at_right 0. ((\<lambda>x. f (inverse x)) has_real_derivative f' (inverse x) * - (inverse x ^ Suc (Suc 0))) (at x)

goal (2 subgoals):
 1. \<forall>\<^sub>F x in at_right 0. g' (inverse x) * - (inverse x ^ Suc (Suc 0)) \<noteq> 0
 2. ((\<lambda>x. f' (inverse x) * - (inverse x ^ Suc (Suc 0)) / (g' (inverse x) * - (inverse x ^ Suc (Suc 0)))) \<longlongrightarrow> x) (at_right 0)
[PROOF STEP]
show "eventually (\<lambda>x. ?D g' x \<noteq> 0) ?R"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>\<^sub>F x in at_right 0. g' (inverse x) * - (inverse x ^ Suc (Suc 0)) \<noteq> 0
[PROOF STEP]
unfolding eventually_at_right_to_top
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>\<^sub>F x in at_top. g' (inverse (inverse x)) * - (inverse (inverse x) ^ Suc (Suc 0)) \<noteq> 0
[PROOF STEP]
using g' eventually_ge_at_top[where c=1]
[PROOF STATE]
proof (prove)
using this:
\<forall>\<^sub>F x in at_top. g' x \<noteq> 0
eventually ((\<le>) (1::?'a1)) at_top

goal (1 subgoal):
 1. \<forall>\<^sub>F x in at_top. g' (inverse (inverse x)) * - (inverse (inverse x) ^ Suc (Suc 0)) \<noteq> 0
[PROOF STEP]
by eventually_elim auto
[PROOF STATE]
proof (state)
this:
\<forall>\<^sub>F x in at_right 0. g' (inverse x) * - (inverse x ^ Suc (Suc 0)) \<noteq> 0

goal (1 subgoal):
 1. ((\<lambda>x. f' (inverse x) * - (inverse x ^ Suc (Suc 0)) / (g' (inverse x) * - (inverse x ^ Suc (Suc 0)))) \<longlongrightarrow> x) (at_right 0)
[PROOF STEP]
show "((\<lambda>x. ?D f' x / ?D g' x) \<longlongrightarrow> x) ?R"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<lambda>x. f' (inverse x) * - (inverse x ^ Suc (Suc 0)) / (g' (inverse x) * - (inverse x ^ Suc (Suc 0)))) \<longlongrightarrow> x) (at_right 0)
[PROOF STEP]
unfolding filterlim_at_right_to_top
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<lambda>x. f' (inverse (inverse x)) * - (inverse (inverse x) ^ Suc (Suc 0)) / (g' (inverse (inverse x)) * - (inverse (inverse x) ^ Suc (Suc 0)))) \<longlongrightarrow> x) at_top
[PROOF STEP]
apply (intro filterlim_cong[THEN iffD2, OF refl refl _ lim])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>\<^sub>F x in at_top. f' (inverse (inverse x)) * - (inverse (inverse x) ^ Suc (Suc 0)) / (g' (inverse (inverse x)) * - (inverse (inverse x) ^ Suc (Suc 0))) = f' x / g' x
[PROOF STEP]
using eventually_ge_at_top[where c=1]
[PROOF STATE]
proof (prove)
using this:
eventually ((\<le>) (1::?'a1)) at_top

goal (1 subgoal):
 1. \<forall>\<^sub>F x in at_top. f' (inverse (inverse x)) * - (inverse (inverse x) ^ Suc (Suc 0)) / (g' (inverse (inverse x)) * - (inverse (inverse x) ^ Suc (Suc 0))) = f' x / g' x
[PROOF STEP]
by eventually_elim simp
[PROOF STATE]
proof (state)
this:
((\<lambda>x. f' (inverse x) * - (inverse x ^ Suc (Suc 0)) / (g' (inverse x) * - (inverse x ^ Suc (Suc 0)))) \<longlongrightarrow> x) (at_right 0)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma u_NotexpiredSK_NotexpiredAK:
     "\<lbrakk> \<not> expiredSK Ts evs; servKlife + Ts \<le> authKlife + Ta \<rbrakk>
      \<Longrightarrow> \<not> expiredAK Ta evs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<not> expiredSK Ts evs; servKlife + Ts \<le> authKlife + Ta\<rbrakk> \<Longrightarrow> \<not> expiredAK Ta evs
[PROOF STEP]
by (blast dest: leI le_trans dest: leD)


[STATEMENT]
lemma bin_rest_neg_numeral_BitM [simp]:
  "(\<lambda>k::int. k div 2) (- numeral (Num.BitM w)) = - numeral w"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. - numeral (Num.BitM w) div 2 = - numeral w
[PROOF STEP]
by simp


[STATEMENT]
lemma foldr_plus_mono: "(n::'lbl) \<le> m \<Longrightarrow> foldr (+) xs n \<le> foldr (+) xs m"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. n \<le> m \<Longrightarrow> foldr (+) xs n \<le> foldr (+) xs m
[PROOF STEP]
by (induct xs) (auto simp: plus_mono)


[STATEMENT]
lemma diff_solve_rule2:
  fixes c::"'a::{heine_borel, banach}"
  assumes "\<forall>s. P s \<longrightarrow> (\<forall>t\<ge>0. (\<forall>\<tau>\<in>{0..t}. G (s + \<tau> *\<^sub>R c)) \<longrightarrow> Q (s + t *\<^sub>R c))"
  shows "\<^bold>{P\<^bold>} (x\<acute>=(\<lambda>s. c) & G) \<^bold>{Q\<^bold>}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<^bold>{P\<^bold>}x\<acute>= \<lambda>t s. c & G on \<lambda>s. {t. 0 \<le> t} UNIV @ 0\<^bold>{Q\<^bold>}
[PROOF STEP]
apply(subst local_flow.sH_g_ode_subset[where T=UNIV and \<phi>="(\<lambda> t x. x + t *\<^sub>R c)"])
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. local_flow (\<lambda>s. c) UNIV UNIV (\<lambda>t x. x + t *\<^sub>R c)
 2. \<And>s. s2p UNIV s \<Longrightarrow> s2p (Collect ((\<le>) 0)) 0 \<and> is_interval (Collect ((\<le>) 0)) \<and> Collect ((\<le>) 0) \<subseteq> UNIV
 3. \<forall>s\<in>UNIV. P s \<longrightarrow> (\<forall>t\<in>Collect ((\<le>) 0). (\<forall>\<tau>\<in>down (Collect ((\<le>) 0)) t. G (s + \<tau> *\<^sub>R c)) \<longrightarrow> Q (s + t *\<^sub>R c))
[PROOF STEP]
using line_is_local_flow assms
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>s2p ?T 0; is_interval ?T; open ?T\<rbrakk> \<Longrightarrow> local_flow (\<lambda>s. ?c) ?T UNIV (\<lambda>t s. s + t *\<^sub>R ?c)
\<forall>s. P s \<longrightarrow> (\<forall>t\<ge>0. (\<forall>\<tau>\<in>{0..t}. G (s + \<tau> *\<^sub>R c)) \<longrightarrow> Q (s + t *\<^sub>R c))

goal (3 subgoals):
 1. local_flow (\<lambda>s. c) UNIV UNIV (\<lambda>t x. x + t *\<^sub>R c)
 2. \<And>s. s2p UNIV s \<Longrightarrow> s2p (Collect ((\<le>) 0)) 0 \<and> is_interval (Collect ((\<le>) 0)) \<and> Collect ((\<le>) 0) \<subseteq> UNIV
 3. \<forall>s\<in>UNIV. P s \<longrightarrow> (\<forall>t\<in>Collect ((\<le>) 0). (\<forall>\<tau>\<in>down (Collect ((\<le>) 0)) t. G (s + \<tau> *\<^sub>R c)) \<longrightarrow> Q (s + t *\<^sub>R c))
[PROOF STEP]
by auto


[STATEMENT]
lemma lang_nPlus[simp]: "lang (nPlus r s) = lang (Plus r s)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. lang (nPlus r s) = lang (Plus r s)
[PROOF STEP]
by (induction r s rule: nPlus.induct) auto


[STATEMENT]
lemma Qp_diff_diff:
  assumes "x \<in> carrier Q\<^sub>p"
  assumes "c \<in> carrier Q\<^sub>p"
  assumes "d \<in> carrier Q\<^sub>p"
  shows "(x \<ominus> c) \<ominus> (d \<ominus> c) = x \<ominus> d "
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x \<ominus> c \<ominus> (d \<ominus> c) = x \<ominus> d
[PROOF STEP]
by (smt Qp.domain_axioms a_minus_def assms(1) assms(2) assms(3) cring.cring_simprules(10)
      cring.cring_simprules(19) cring.cring_simprules(3) cring.cring_simprules(4)
      cring.cring_simprules(7) domain.axioms(1))


[STATEMENT]
lemma ordinal_0_plus [simp]: "0 + x = (x::ordinal)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 + x = x
[PROOF STEP]
by (rule_tac a=x in oLimit_induct, simp_all)


[STATEMENT]
lemma word_of_power:
  \<open>word_of (p ^ n) = word_of p ^ n\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. word_of (p ^ n) = word_of p ^ n
[PROOF STEP]
by (induction n) (simp_all add: word_of_1 word_of_mult)


[STATEMENT]
lemma union_right_cancel: "M + K = N + K \<longleftrightarrow> M = (N::'a multiset)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (M + K = N + K) = (M = N)
[PROOF STEP]
by (fact add_right_cancel)


[STATEMENT]
lemma msb_conv_bin_sign:
  "msb x \<longleftrightarrow> bin_sign x = -1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. msb x = (bin_sign x = - 1)
[PROOF STEP]
by (simp add: bin_sign_def not_le msb_int_def)


[STATEMENT]
lemma Hyperdual_eq:
  fixes a b c d :: "'a :: ring_1"
  shows "Hyperdual a b c d = a *\<^sub>H ba + b *\<^sub>H e1 + c *\<^sub>H e2 + d *\<^sub>H e12"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Hyperdual a b c d = a *\<^sub>H ba + b *\<^sub>H e1 + c *\<^sub>H e2 + d *\<^sub>H e12
[PROOF STEP]
by (simp add: hyperdual_bases)


[STATEMENT]
lemma geodesic_segment_param [simp]:
  assumes "geodesic_segment_between G x y"
  shows "geodesic_segment_param G x 0 = x"
        "geodesic_segment_param G x (dist x y) = y"
        "t \<in> {0..dist x y} \<Longrightarrow> geodesic_segment_param G x t \<in> G"
        "isometry_on {0..dist x y} (geodesic_segment_param G x)"
        "(geodesic_segment_param G x)`{0..dist x y} = G"
        "t \<in> {0..dist x y} \<Longrightarrow> dist x (geodesic_segment_param G x t) = t"
        "s \<in> {0..dist x y} \<Longrightarrow> t \<in> {0..dist x y} \<Longrightarrow> dist (geodesic_segment_param G x s) (geodesic_segment_param G x t) = abs(s-t)"
        "z \<in> G \<Longrightarrow> z = geodesic_segment_param G x (dist x z)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((geodesic_segment_param G x 0 = x &&& geodesic_segment_param G x (dist x y) = y) &&& (t \<in> {0..dist x y} \<Longrightarrow> geodesic_segment_param G x t \<in> G) &&& isometry_on {0..dist x y} (geodesic_segment_param G x)) &&& (geodesic_segment_param G x ` {0..dist x y} = G &&& (t \<in> {0..dist x y} \<Longrightarrow> dist x (geodesic_segment_param G x t) = t)) &&& (\<lbrakk>s \<in> {0..dist x y}; t \<in> {0..dist x y}\<rbrakk> \<Longrightarrow> dist (geodesic_segment_param G x s) (geodesic_segment_param G x t) = \<bar>s - t\<bar>) &&& (z \<in> G \<Longrightarrow> z = geodesic_segment_param G x (dist x z))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (8 subgoals):
 1. geodesic_segment_param G x 0 = x
 2. geodesic_segment_param G x (dist x y) = y
 3. t \<in> {0..dist x y} \<Longrightarrow> geodesic_segment_param G x t \<in> G
 4. isometry_on {0..dist x y} (geodesic_segment_param G x)
 5. geodesic_segment_param G x ` {0..dist x y} = G
 6. t \<in> {0..dist x y} \<Longrightarrow> dist x (geodesic_segment_param G x t) = t
 7. \<lbrakk>s \<in> {0..dist x y}; t \<in> {0..dist x y}\<rbrakk> \<Longrightarrow> dist (geodesic_segment_param G x s) (geodesic_segment_param G x t) = \<bar>s - t\<bar>
 8. z \<in> G \<Longrightarrow> z = geodesic_segment_param G x (dist x z)
[PROOF STEP]
obtain g::"real\<Rightarrow>'a" where g: "g 0 = x" "g (dist x y) = y" "isometry_on {0..dist x y} g" "G = g`{0..dist x y}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>g. \<lbrakk>g 0 = x; g (dist x y) = y; isometry_on {0..dist x y} g; G = g ` {0..dist x y}\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (meson \<open>geodesic_segment_between G x y\<close> geodesic_segment_between_def)
[PROOF STATE]
proof (state)
this:
g 0 = x
g (dist x y) = y
isometry_on {0..dist x y} g
G = g ` {0..dist x y}

goal (8 subgoals):
 1. geodesic_segment_param G x 0 = x
 2. geodesic_segment_param G x (dist x y) = y
 3. t \<in> {0..dist x y} \<Longrightarrow> geodesic_segment_param G x t \<in> G
 4. isometry_on {0..dist x y} (geodesic_segment_param G x)
 5. geodesic_segment_param G x ` {0..dist x y} = G
 6. t \<in> {0..dist x y} \<Longrightarrow> dist x (geodesic_segment_param G x t) = t
 7. \<lbrakk>s \<in> {0..dist x y}; t \<in> {0..dist x y}\<rbrakk> \<Longrightarrow> dist (geodesic_segment_param G x s) (geodesic_segment_param G x t) = \<bar>s - t\<bar>
 8. z \<in> G \<Longrightarrow> z = geodesic_segment_param G x (dist x z)
[PROOF STEP]
have *: "g t \<in> G \<and> dist x (g t) = t" if "t \<in> {0..dist x y}" for t
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. g t \<in> G \<and> dist x (g t) = t
[PROOF STEP]
using isometry_onD[OF g(3), of 0 t] that g(1) g(4)
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>0 \<in> {0..dist x y}; t \<in> {0..dist x y}\<rbrakk> \<Longrightarrow> dist (g 0) (g t) = dist 0 t
t \<in> {0..dist x y}
g 0 = x
G = g ` {0..dist x y}

goal (1 subgoal):
 1. g t \<in> G \<and> dist x (g t) = t
[PROOF STEP]
unfolding dist_real_def
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>0 \<in> {0..dist x y}; t \<in> {0..dist x y}\<rbrakk> \<Longrightarrow> dist (g 0) (g t) = \<bar>0 - t\<bar>
t \<in> {0..dist x y}
g 0 = x
G = g ` {0..dist x y}

goal (1 subgoal):
 1. g t \<in> G \<and> dist x (g t) = t
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
?t \<in> {0..dist x y} \<Longrightarrow> g ?t \<in> G \<and> dist x (g ?t) = ?t

goal (8 subgoals):
 1. geodesic_segment_param G x 0 = x
 2. geodesic_segment_param G x (dist x y) = y
 3. t \<in> {0..dist x y} \<Longrightarrow> geodesic_segment_param G x t \<in> G
 4. isometry_on {0..dist x y} (geodesic_segment_param G x)
 5. geodesic_segment_param G x ` {0..dist x y} = G
 6. t \<in> {0..dist x y} \<Longrightarrow> dist x (geodesic_segment_param G x t) = t
 7. \<lbrakk>s \<in> {0..dist x y}; t \<in> {0..dist x y}\<rbrakk> \<Longrightarrow> dist (geodesic_segment_param G x s) (geodesic_segment_param G x t) = \<bar>s - t\<bar>
 8. z \<in> G \<Longrightarrow> z = geodesic_segment_param G x (dist x z)
[PROOF STEP]
have G: "geodesic_segment_param G x t = g t" if "t \<in> {0..dist x y}" for t
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. geodesic_segment_param G x t = g t
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. geodesic_segment_param G x t = g t
[PROOF STEP]
have A: "geodesic_segment_param G x t \<in> G \<and> dist x (geodesic_segment_param G x t) = t"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. geodesic_segment_param G x t \<in> G \<and> dist x (geodesic_segment_param G x t) = t
[PROOF STEP]
using *[OF that]
[PROOF STATE]
proof (prove)
using this:
g t \<in> G \<and> dist x (g t) = t

goal (1 subgoal):
 1. geodesic_segment_param G x t \<in> G \<and> dist x (geodesic_segment_param G x t) = t
[PROOF STEP]
unfolding geodesic_segment_param_def
[PROOF STATE]
proof (prove)
using this:
g t \<in> G \<and> dist x (g t) = t

goal (1 subgoal):
 1. (if \<exists>w. w \<in> G \<and> dist x w = t then SOME w. w \<in> G \<and> dist x w = t else SOME w. w \<in> G) \<in> G \<and> dist x (if \<exists>w. w \<in> G \<and> dist x w = t then SOME w. w \<in> G \<and> dist x w = t else SOME w. w \<in> G) = t
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>w. \<lbrakk>g (dist x w) \<in> G; dist x (g (dist x w)) = dist x w; w \<in> G; t = dist x w\<rbrakk> \<Longrightarrow> (SOME wa. wa \<in> G \<and> dist x wa = dist x w) \<in> G
 2. \<And>w. \<lbrakk>g (dist x w) \<in> G; dist x (g (dist x w)) = dist x w; w \<in> G; t = dist x w\<rbrakk> \<Longrightarrow> dist x (SOME wa. wa \<in> G \<and> dist x wa = dist x w) = dist x w
[PROOF STEP]
using *[OF that]
[PROOF STATE]
proof (prove)
using this:
g t \<in> G \<and> dist x (g t) = t

goal (2 subgoals):
 1. \<And>w. \<lbrakk>g (dist x w) \<in> G; dist x (g (dist x w)) = dist x w; w \<in> G; t = dist x w\<rbrakk> \<Longrightarrow> (SOME wa. wa \<in> G \<and> dist x wa = dist x w) \<in> G
 2. \<And>w. \<lbrakk>g (dist x w) \<in> G; dist x (g (dist x w)) = dist x w; w \<in> G; t = dist x w\<rbrakk> \<Longrightarrow> dist x (SOME wa. wa \<in> G \<and> dist x wa = dist x w) = dist x w
[PROOF STEP]
by (metis (mono_tags, lifting) someI)+
[PROOF STATE]
proof (state)
this:
geodesic_segment_param G x t \<in> G \<and> dist x (geodesic_segment_param G x t) = t

goal (1 subgoal):
 1. geodesic_segment_param G x t = g t
[PROOF STEP]
obtain s where s: "geodesic_segment_param G x t = g s" "s \<in> {0..dist x y}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>s. \<lbrakk>geodesic_segment_param G x t = g s; s \<in> {0..dist x y}\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using A g(4)
[PROOF STATE]
proof (prove)
using this:
geodesic_segment_param G x t \<in> G \<and> dist x (geodesic_segment_param G x t) = t
G = g ` {0..dist x y}

goal (1 subgoal):
 1. (\<And>s. \<lbrakk>geodesic_segment_param G x t = g s; s \<in> {0..dist x y}\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
geodesic_segment_param G x t = g s
s \<in> {0..dist x y}

goal (1 subgoal):
 1. geodesic_segment_param G x t = g t
[PROOF STEP]
have "s = t"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. s = t
[PROOF STEP]
using *[OF \<open>s \<in> {0..dist x y}\<close>] A
[PROOF STATE]
proof (prove)
using this:
g s \<in> G \<and> dist x (g s) = s
geodesic_segment_param G x t \<in> G \<and> dist x (geodesic_segment_param G x t) = t

goal (1 subgoal):
 1. s = t
[PROOF STEP]
unfolding s(1)
[PROOF STATE]
proof (prove)
using this:
g s \<in> G \<and> dist x (g s) = s
g s \<in> G \<and> dist x (g s) = t

goal (1 subgoal):
 1. s = t
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
s = t

goal (1 subgoal):
 1. geodesic_segment_param G x t = g t
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
s = t
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
s = t

goal (1 subgoal):
 1. geodesic_segment_param G x t = g t
[PROOF STEP]
using s
[PROOF STATE]
proof (prove)
using this:
s = t
geodesic_segment_param G x t = g s
s \<in> {0..dist x y}

goal (1 subgoal):
 1. geodesic_segment_param G x t = g t
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
geodesic_segment_param G x t = g t

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
?t \<in> {0..dist x y} \<Longrightarrow> geodesic_segment_param G x ?t = g ?t

goal (8 subgoals):
 1. geodesic_segment_param G x 0 = x
 2. geodesic_segment_param G x (dist x y) = y
 3. t \<in> {0..dist x y} \<Longrightarrow> geodesic_segment_param G x t \<in> G
 4. isometry_on {0..dist x y} (geodesic_segment_param G x)
 5. geodesic_segment_param G x ` {0..dist x y} = G
 6. t \<in> {0..dist x y} \<Longrightarrow> dist x (geodesic_segment_param G x t) = t
 7. \<lbrakk>s \<in> {0..dist x y}; t \<in> {0..dist x y}\<rbrakk> \<Longrightarrow> dist (geodesic_segment_param G x s) (geodesic_segment_param G x t) = \<bar>s - t\<bar>
 8. z \<in> G \<Longrightarrow> z = geodesic_segment_param G x (dist x z)
[PROOF STEP]
show "geodesic_segment_param G x 0 = x"
       "geodesic_segment_param G x (dist x y) = y"
       "t \<in> {0..dist x y} \<Longrightarrow> geodesic_segment_param G x t \<in> G"
       "isometry_on {0..dist x y} (geodesic_segment_param G x)"
       "(geodesic_segment_param G x)`{0..dist x y} = G"
       "t \<in> {0..dist x y} \<Longrightarrow> dist x (geodesic_segment_param G x t) = t"
       "s \<in> {0..dist x y} \<Longrightarrow> t \<in> {0..dist x y} \<Longrightarrow> dist (geodesic_segment_param G x s) (geodesic_segment_param G x t) = abs(s-t)"
       "z \<in> G \<Longrightarrow> z = geodesic_segment_param G x (dist x z)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((geodesic_segment_param G x 0 = x &&& geodesic_segment_param G x (dist x y) = y) &&& (t \<in> {0..dist x y} \<Longrightarrow> geodesic_segment_param G x t \<in> G) &&& isometry_on {0..dist x y} (geodesic_segment_param G x)) &&& (geodesic_segment_param G x ` {0..dist x y} = G &&& (t \<in> {0..dist x y} \<Longrightarrow> dist x (geodesic_segment_param G x t) = t)) &&& (\<lbrakk>s \<in> {0..dist x y}; t \<in> {0..dist x y}\<rbrakk> \<Longrightarrow> dist (geodesic_segment_param G x s) (geodesic_segment_param G x t) = \<bar>s - t\<bar>) &&& (z \<in> G \<Longrightarrow> z = geodesic_segment_param G x (dist x z))
[PROOF STEP]
using G g
[PROOF STATE]
proof (prove)
using this:
?t \<in> {0..dist x y} \<Longrightarrow> geodesic_segment_param G x ?t = g ?t
g 0 = x
g (dist x y) = y
isometry_on {0..dist x y} g
G = g ` {0..dist x y}

goal (1 subgoal):
 1. ((geodesic_segment_param G x 0 = x &&& geodesic_segment_param G x (dist x y) = y) &&& (t \<in> {0..dist x y} \<Longrightarrow> geodesic_segment_param G x t \<in> G) &&& isometry_on {0..dist x y} (geodesic_segment_param G x)) &&& (geodesic_segment_param G x ` {0..dist x y} = G &&& (t \<in> {0..dist x y} \<Longrightarrow> dist x (geodesic_segment_param G x t) = t)) &&& (\<lbrakk>s \<in> {0..dist x y}; t \<in> {0..dist x y}\<rbrakk> \<Longrightarrow> dist (geodesic_segment_param G x s) (geodesic_segment_param G x t) = \<bar>s - t\<bar>) &&& (z \<in> G \<Longrightarrow> z = geodesic_segment_param G x (dist x z))
[PROOF STEP]
apply (auto simp add: rev_image_eqI)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<lbrakk>\<And>t. 0 \<le> t \<and> t \<le> dist (g 0) y \<Longrightarrow> geodesic_segment_param (g ` {0..dist (g 0) y}) (g 0) t = g t; g (dist (g 0) y) = y; isometry_on {0..dist (g 0) y} g; G = g ` {0..dist (g 0) y}; x = g 0\<rbrakk> \<Longrightarrow> isometry_on {0..dist (g 0) y} (geodesic_segment_param (g ` {0..dist (g 0) y}) (g 0))
 2. \<lbrakk>\<And>t. 0 \<le> t \<and> t \<le> dist (g 0) y \<Longrightarrow> geodesic_segment_param (g ` {0..dist (g 0) y}) (g 0) t = g t; g (dist (g 0) y) = y; isometry_on {0..dist (g 0) y} g; G = g ` {0..dist (g 0) y}; x = g 0; 0 \<le> t; t \<le> dist (g 0) y\<rbrakk> \<Longrightarrow> dist (g 0) (g t) = t
 3. \<lbrakk>\<And>t. 0 \<le> t \<and> t \<le> dist (g 0) y \<Longrightarrow> geodesic_segment_param (g ` {0..dist (g 0) y}) (g 0) t = g t; g (dist (g 0) y) = y; isometry_on {0..dist (g 0) y} g; G = g ` {0..dist (g 0) y}; x = g 0; 0 \<le> s; s \<le> dist (g 0) y; 0 \<le> t; t \<le> dist (g 0) y\<rbrakk> \<Longrightarrow> dist (g s) (g t) = \<bar>s - t\<bar>
 4. \<And>xa. \<lbrakk>\<And>t. 0 \<le> t \<and> t \<le> dist (g 0) y \<Longrightarrow> geodesic_segment_param (g ` {0..dist (g 0) y}) (g 0) t = g t; g (dist (g 0) y) = y; isometry_on {0..dist (g 0) y} g; G = g ` {0..dist (g 0) y}; x = g 0; z = g xa; 0 \<le> xa; xa \<le> dist (g 0) y\<rbrakk> \<Longrightarrow> g xa = geodesic_segment_param (g ` {0..dist (g 0) y}) (g 0) (dist (g 0) (g xa))
[PROOF STEP]
using G isometry_on_cong * atLeastAtMost_iff
[PROOF STATE]
proof (prove)
using this:
?t \<in> {0..dist x y} \<Longrightarrow> geodesic_segment_param G x ?t = g ?t
\<lbrakk>isometry_on ?X ?f; \<And>x. x \<in> ?X \<Longrightarrow> ?g x = ?f x\<rbrakk> \<Longrightarrow> isometry_on ?X ?g
?t \<in> {0..dist x y} \<Longrightarrow> g ?t \<in> G \<and> dist x (g ?t) = ?t
(?i \<in> {?l..?u}) = (?l \<le> ?i \<and> ?i \<le> ?u)

goal (4 subgoals):
 1. \<lbrakk>\<And>t. 0 \<le> t \<and> t \<le> dist (g 0) y \<Longrightarrow> geodesic_segment_param (g ` {0..dist (g 0) y}) (g 0) t = g t; g (dist (g 0) y) = y; isometry_on {0..dist (g 0) y} g; G = g ` {0..dist (g 0) y}; x = g 0\<rbrakk> \<Longrightarrow> isometry_on {0..dist (g 0) y} (geodesic_segment_param (g ` {0..dist (g 0) y}) (g 0))
 2. \<lbrakk>\<And>t. 0 \<le> t \<and> t \<le> dist (g 0) y \<Longrightarrow> geodesic_segment_param (g ` {0..dist (g 0) y}) (g 0) t = g t; g (dist (g 0) y) = y; isometry_on {0..dist (g 0) y} g; G = g ` {0..dist (g 0) y}; x = g 0; 0 \<le> t; t \<le> dist (g 0) y\<rbrakk> \<Longrightarrow> dist (g 0) (g t) = t
 3. \<lbrakk>\<And>t. 0 \<le> t \<and> t \<le> dist (g 0) y \<Longrightarrow> geodesic_segment_param (g ` {0..dist (g 0) y}) (g 0) t = g t; g (dist (g 0) y) = y; isometry_on {0..dist (g 0) y} g; G = g ` {0..dist (g 0) y}; x = g 0; 0 \<le> s; s \<le> dist (g 0) y; 0 \<le> t; t \<le> dist (g 0) y\<rbrakk> \<Longrightarrow> dist (g s) (g t) = \<bar>s - t\<bar>
 4. \<And>xa. \<lbrakk>\<And>t. 0 \<le> t \<and> t \<le> dist (g 0) y \<Longrightarrow> geodesic_segment_param (g ` {0..dist (g 0) y}) (g 0) t = g t; g (dist (g 0) y) = y; isometry_on {0..dist (g 0) y} g; G = g ` {0..dist (g 0) y}; x = g 0; z = g xa; 0 \<le> xa; xa \<le> dist (g 0) y\<rbrakk> \<Longrightarrow> g xa = geodesic_segment_param (g ` {0..dist (g 0) y}) (g 0) (dist (g 0) (g xa))
[PROOF STEP]
apply blast
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<lbrakk>\<And>t. 0 \<le> t \<and> t \<le> dist (g 0) y \<Longrightarrow> geodesic_segment_param (g ` {0..dist (g 0) y}) (g 0) t = g t; g (dist (g 0) y) = y; isometry_on {0..dist (g 0) y} g; G = g ` {0..dist (g 0) y}; x = g 0; 0 \<le> t; t \<le> dist (g 0) y\<rbrakk> \<Longrightarrow> dist (g 0) (g t) = t
 2. \<lbrakk>\<And>t. 0 \<le> t \<and> t \<le> dist (g 0) y \<Longrightarrow> geodesic_segment_param (g ` {0..dist (g 0) y}) (g 0) t = g t; g (dist (g 0) y) = y; isometry_on {0..dist (g 0) y} g; G = g ` {0..dist (g 0) y}; x = g 0; 0 \<le> s; s \<le> dist (g 0) y; 0 \<le> t; t \<le> dist (g 0) y\<rbrakk> \<Longrightarrow> dist (g s) (g t) = \<bar>s - t\<bar>
 3. \<And>xa. \<lbrakk>\<And>t. 0 \<le> t \<and> t \<le> dist (g 0) y \<Longrightarrow> geodesic_segment_param (g ` {0..dist (g 0) y}) (g 0) t = g t; g (dist (g 0) y) = y; isometry_on {0..dist (g 0) y} g; G = g ` {0..dist (g 0) y}; x = g 0; z = g xa; 0 \<le> xa; xa \<le> dist (g 0) y\<rbrakk> \<Longrightarrow> g xa = geodesic_segment_param (g ` {0..dist (g 0) y}) (g 0) (dist (g 0) (g xa))
[PROOF STEP]
using G isometry_on_cong * atLeastAtMost_iff
[PROOF STATE]
proof (prove)
using this:
?t \<in> {0..dist x y} \<Longrightarrow> geodesic_segment_param G x ?t = g ?t
\<lbrakk>isometry_on ?X ?f; \<And>x. x \<in> ?X \<Longrightarrow> ?g x = ?f x\<rbrakk> \<Longrightarrow> isometry_on ?X ?g
?t \<in> {0..dist x y} \<Longrightarrow> g ?t \<in> G \<and> dist x (g ?t) = ?t
(?i \<in> {?l..?u}) = (?l \<le> ?i \<and> ?i \<le> ?u)

goal (3 subgoals):
 1. \<lbrakk>\<And>t. 0 \<le> t \<and> t \<le> dist (g 0) y \<Longrightarrow> geodesic_segment_param (g ` {0..dist (g 0) y}) (g 0) t = g t; g (dist (g 0) y) = y; isometry_on {0..dist (g 0) y} g; G = g ` {0..dist (g 0) y}; x = g 0; 0 \<le> t; t \<le> dist (g 0) y\<rbrakk> \<Longrightarrow> dist (g 0) (g t) = t
 2. \<lbrakk>\<And>t. 0 \<le> t \<and> t \<le> dist (g 0) y \<Longrightarrow> geodesic_segment_param (g ` {0..dist (g 0) y}) (g 0) t = g t; g (dist (g 0) y) = y; isometry_on {0..dist (g 0) y} g; G = g ` {0..dist (g 0) y}; x = g 0; 0 \<le> s; s \<le> dist (g 0) y; 0 \<le> t; t \<le> dist (g 0) y\<rbrakk> \<Longrightarrow> dist (g s) (g t) = \<bar>s - t\<bar>
 3. \<And>xa. \<lbrakk>\<And>t. 0 \<le> t \<and> t \<le> dist (g 0) y \<Longrightarrow> geodesic_segment_param (g ` {0..dist (g 0) y}) (g 0) t = g t; g (dist (g 0) y) = y; isometry_on {0..dist (g 0) y} g; G = g ` {0..dist (g 0) y}; x = g 0; z = g xa; 0 \<le> xa; xa \<le> dist (g 0) y\<rbrakk> \<Longrightarrow> g xa = geodesic_segment_param (g ` {0..dist (g 0) y}) (g 0) (dist (g 0) (g xa))
[PROOF STEP]
apply blast
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>\<And>t. 0 \<le> t \<and> t \<le> dist (g 0) y \<Longrightarrow> geodesic_segment_param (g ` {0..dist (g 0) y}) (g 0) t = g t; g (dist (g 0) y) = y; isometry_on {0..dist (g 0) y} g; G = g ` {0..dist (g 0) y}; x = g 0; 0 \<le> s; s \<le> dist (g 0) y; 0 \<le> t; t \<le> dist (g 0) y\<rbrakk> \<Longrightarrow> dist (g s) (g t) = \<bar>s - t\<bar>
 2. \<And>xa. \<lbrakk>\<And>t. 0 \<le> t \<and> t \<le> dist (g 0) y \<Longrightarrow> geodesic_segment_param (g ` {0..dist (g 0) y}) (g 0) t = g t; g (dist (g 0) y) = y; isometry_on {0..dist (g 0) y} g; G = g ` {0..dist (g 0) y}; x = g 0; z = g xa; 0 \<le> xa; xa \<le> dist (g 0) y\<rbrakk> \<Longrightarrow> g xa = geodesic_segment_param (g ` {0..dist (g 0) y}) (g 0) (dist (g 0) (g xa))
[PROOF STEP]
by (auto simp add: * dist_real_def isometry_onD)
[PROOF STATE]
proof (state)
this:
geodesic_segment_param G x 0 = x
geodesic_segment_param G x (dist x y) = y
t \<in> {0..dist x y} \<Longrightarrow> geodesic_segment_param G x t \<in> G
isometry_on {0..dist x y} (geodesic_segment_param G x)
geodesic_segment_param G x ` {0..dist x y} = G
t \<in> {0..dist x y} \<Longrightarrow> dist x (geodesic_segment_param G x t) = t
\<lbrakk>s \<in> {0..dist x y}; t \<in> {0..dist x y}\<rbrakk> \<Longrightarrow> dist (geodesic_segment_param G x s) (geodesic_segment_param G x t) = \<bar>s - t\<bar>
z \<in> G \<Longrightarrow> z = geodesic_segment_param G x (dist x z)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma iUntil_disj_conv1: "
  I \<noteq> {} \<Longrightarrow>
  (P t'. t' \<U> t I. Q t) = (Q (iMin I) \<or> (P t'. t' \<U> t I. Q t \<and> iMin I < t))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. I \<noteq> {} \<Longrightarrow> (P t'. t' \<U> t I. Q t) = (Q (iMin I) \<or> (P t'. t' \<U> t I. Q t \<and> iMin I < t))
[PROOF STEP]
apply (case_tac "Q (iMin I)")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>I \<noteq> {}; Q (iMin I)\<rbrakk> \<Longrightarrow> (P t'. t' \<U> t I. Q t) = (Q (iMin I) \<or> (P t'. t' \<U> t I. Q t \<and> iMin I < t))
 2. \<lbrakk>I \<noteq> {}; \<not> Q (iMin I)\<rbrakk> \<Longrightarrow> (P t'. t' \<U> t I. Q t) = (Q (iMin I) \<or> (P t'. t' \<U> t I. Q t \<and> iMin I < t))
[PROOF STEP]
apply (simp add: iMin_imp_iUntil)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>I \<noteq> {}; \<not> Q (iMin I)\<rbrakk> \<Longrightarrow> (P t'. t' \<U> t I. Q t) = (Q (iMin I) \<or> (P t'. t' \<U> t I. Q t \<and> iMin I < t))
[PROOF STEP]
apply (unfold iUntil_def, blast)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma one_strongly_connected_implies_7_eq:
  assumes "one_strongly_connected x"
    shows "x;1;x = x\<^sup>+"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x ; 1 ; x = x\<^sup>+
[PROOF STEP]
using assms many_strongly_connected_iff_7 one_strongly_connected_iff one_strongly_connected_iff_3_eq
[PROOF STATE]
proof (prove)
using this:
one_strongly_connected x
many_strongly_connected ?x = (?x\<^sup>T\<^sup>+ = ?x\<^sup>+)
one_strongly_connected ?x = (connected ?x \<and> many_strongly_connected ?x)
one_strongly_connected ?x = (?x ; 1 ; ?x = ?x\<^sup>T\<^sup>+)

goal (1 subgoal):
 1. x ; 1 ; x = x\<^sup>+
[PROOF STEP]
by force


[STATEMENT]
lemma flow_cleanup: \<comment> \<open>Lemma 5.4\<close>
  "\<exists>h \<le> g. flow \<Delta> h \<and> value_flow \<Delta> h = value_flow \<Delta> g \<and> (\<forall>x. d_IN h x \<le> value_flow \<Delta> h)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>h\<le>g. flow \<Delta> h \<and> value_flow \<Delta> h = value_flow \<Delta> g \<and> (\<forall>x. d_IN h x \<le> value_flow \<Delta> h)
[PROOF STEP]
by(intro exI[where x=h] conjI strip le_funI d_IN_h_le_value flow_h value_h h_le_g)


[STATEMENT]
lemma mset_le_subtract_right: "(A::'a multiset)+B \<subseteq># X \<Longrightarrow> A \<subseteq># X-B \<and> B\<subseteq>#X"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. A + B \<subseteq># X \<Longrightarrow> A \<subseteq># X - B \<and> B \<subseteq># X
[PROOF STEP]
by (auto dest: mset_le_subtract[of "A+B" "X" "B"] mset_union_subset)


[STATEMENT]
lemma accepts_atom:
 "accepts (atom a) w = (w = [a])"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. accepts (atom a) w = (w = [a])
[PROOF STEP]
by (simp add: accepts_conv_steps start_fin_in_steps_atom fin_atom)


[STATEMENT]
lemma lhospital_at_top_at_top:
  fixes f g :: "real \<Rightarrow> real"
  assumes g_0: "LIM x at_top. g x :> at_top"
    and g': "eventually (\<lambda>x. g' x \<noteq> 0) at_top"
    and Df: "eventually (\<lambda>x. DERIV f x :> f' x) at_top"
    and Dg: "eventually (\<lambda>x. DERIV g x :> g' x) at_top"
    and lim: "((\<lambda> x. (f' x / g' x)) \<longlongrightarrow> x) at_top"
  shows "((\<lambda> x. f x / g x) \<longlongrightarrow> x) at_top"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<lambda>x. f x / g x) \<longlongrightarrow> x) at_top
[PROOF STEP]
unfolding filterlim_at_top_to_right
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<lambda>x. f (inverse x) / g (inverse x)) \<longlongrightarrow> x) (at_right 0)
[PROOF STEP]
proof (rule lhopital_right_0_at_top)
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. LIM x at_right 0. g (inverse x) :> at_top
 2. \<forall>\<^sub>F x in at_right 0. ?g' x \<noteq> 0
 3. \<forall>\<^sub>F x in at_right 0. ((\<lambda>x. f (inverse x)) has_real_derivative ?f' x) (at x)
 4. \<forall>\<^sub>F x in at_right 0. ((\<lambda>x. g (inverse x)) has_real_derivative ?g' x) (at x)
 5. ((\<lambda>x. ?f' x / ?g' x) \<longlongrightarrow> x) (at_right 0)
[PROOF STEP]
let ?F = "\<lambda>x. f (inverse x)"
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. LIM x at_right 0. g (inverse x) :> at_top
 2. \<forall>\<^sub>F x in at_right 0. ?g' x \<noteq> 0
 3. \<forall>\<^sub>F x in at_right 0. ((\<lambda>x. f (inverse x)) has_real_derivative ?f' x) (at x)
 4. \<forall>\<^sub>F x in at_right 0. ((\<lambda>x. g (inverse x)) has_real_derivative ?g' x) (at x)
 5. ((\<lambda>x. ?f' x / ?g' x) \<longlongrightarrow> x) (at_right 0)
[PROOF STEP]
let ?G = "\<lambda>x. g (inverse x)"
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. LIM x at_right 0. g (inverse x) :> at_top
 2. \<forall>\<^sub>F x in at_right 0. ?g' x \<noteq> 0
 3. \<forall>\<^sub>F x in at_right 0. ((\<lambda>x. f (inverse x)) has_real_derivative ?f' x) (at x)
 4. \<forall>\<^sub>F x in at_right 0. ((\<lambda>x. g (inverse x)) has_real_derivative ?g' x) (at x)
 5. ((\<lambda>x. ?f' x / ?g' x) \<longlongrightarrow> x) (at_right 0)
[PROOF STEP]
let ?R = "at_right (0::real)"
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. LIM x at_right 0. g (inverse x) :> at_top
 2. \<forall>\<^sub>F x in at_right 0. ?g' x \<noteq> 0
 3. \<forall>\<^sub>F x in at_right 0. ((\<lambda>x. f (inverse x)) has_real_derivative ?f' x) (at x)
 4. \<forall>\<^sub>F x in at_right 0. ((\<lambda>x. g (inverse x)) has_real_derivative ?g' x) (at x)
 5. ((\<lambda>x. ?f' x / ?g' x) \<longlongrightarrow> x) (at_right 0)
[PROOF STEP]
let ?D = "\<lambda>f' x. f' (inverse x) * - (inverse x ^ Suc (Suc 0))"
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. LIM x at_right 0. g (inverse x) :> at_top
 2. \<forall>\<^sub>F x in at_right 0. ?g' x \<noteq> 0
 3. \<forall>\<^sub>F x in at_right 0. ((\<lambda>x. f (inverse x)) has_real_derivative ?f' x) (at x)
 4. \<forall>\<^sub>F x in at_right 0. ((\<lambda>x. g (inverse x)) has_real_derivative ?g' x) (at x)
 5. ((\<lambda>x. ?f' x / ?g' x) \<longlongrightarrow> x) (at_right 0)
[PROOF STEP]
show "LIM x ?R. ?G x :> at_top"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. LIM x at_right 0. g (inverse x) :> at_top
[PROOF STEP]
using g_0
[PROOF STATE]
proof (prove)
using this:
filterlim g at_top at_top

goal (1 subgoal):
 1. LIM x at_right 0. g (inverse x) :> at_top
[PROOF STEP]
unfolding filterlim_at_top_to_right
[PROOF STATE]
proof (prove)
using this:
LIM x at_right 0. g (inverse x) :> at_top

goal (1 subgoal):
 1. LIM x at_right 0. g (inverse x) :> at_top
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
LIM x at_right 0. g (inverse x) :> at_top

goal (4 subgoals):
 1. \<forall>\<^sub>F x in at_right 0. ?g' x \<noteq> 0
 2. \<forall>\<^sub>F x in at_right 0. ((\<lambda>x. f (inverse x)) has_real_derivative ?f' x) (at x)
 3. \<forall>\<^sub>F x in at_right 0. ((\<lambda>x. g (inverse x)) has_real_derivative ?g' x) (at x)
 4. ((\<lambda>x. ?f' x / ?g' x) \<longlongrightarrow> x) (at_right 0)
[PROOF STEP]
show "eventually (\<lambda>x. DERIV ?G x  :> ?D g' x) ?R"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>\<^sub>F x in at_right 0. ((\<lambda>x. g (inverse x)) has_real_derivative g' (inverse x) * - (inverse x ^ Suc (Suc 0))) (at x)
[PROOF STEP]
unfolding eventually_at_right_to_top
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>\<^sub>F x in at_top. ((\<lambda>x. g (inverse x)) has_real_derivative g' (inverse (inverse x)) * - (inverse (inverse x) ^ Suc (Suc 0))) (at (inverse x))
[PROOF STEP]
using Dg eventually_ge_at_top[where c=1]
[PROOF STATE]
proof (prove)
using this:
\<forall>\<^sub>F x in at_top. (g has_real_derivative g' x) (at x)
eventually ((\<le>) (1::?'a1)) at_top

goal (1 subgoal):
 1. \<forall>\<^sub>F x in at_top. ((\<lambda>x. g (inverse x)) has_real_derivative g' (inverse (inverse x)) * - (inverse (inverse x) ^ Suc (Suc 0))) (at (inverse x))
[PROOF STEP]
by eventually_elim (rule derivative_eq_intros DERIV_chain'[where f=inverse] | simp)+
[PROOF STATE]
proof (state)
this:
\<forall>\<^sub>F x in at_right 0. ((\<lambda>x. g (inverse x)) has_real_derivative g' (inverse x) * - (inverse x ^ Suc (Suc 0))) (at x)

goal (3 subgoals):
 1. \<forall>\<^sub>F x in at_right 0. g' (inverse x) * - (inverse x ^ Suc (Suc 0)) \<noteq> 0
 2. \<forall>\<^sub>F x in at_right 0. ((\<lambda>x. f (inverse x)) has_real_derivative ?f' x) (at x)
 3. ((\<lambda>x. ?f' x / (g' (inverse x) * - (inverse x ^ Suc (Suc 0)))) \<longlongrightarrow> x) (at_right 0)
[PROOF STEP]
show "eventually (\<lambda>x. DERIV ?F x  :> ?D f' x) ?R"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>\<^sub>F x in at_right 0. ((\<lambda>x. f (inverse x)) has_real_derivative f' (inverse x) * - (inverse x ^ Suc (Suc 0))) (at x)
[PROOF STEP]
unfolding eventually_at_right_to_top
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>\<^sub>F x in at_top. ((\<lambda>x. f (inverse x)) has_real_derivative f' (inverse (inverse x)) * - (inverse (inverse x) ^ Suc (Suc 0))) (at (inverse x))
[PROOF STEP]
using Df eventually_ge_at_top[where c=1]
[PROOF STATE]
proof (prove)
using this:
\<forall>\<^sub>F x in at_top. (f has_real_derivative f' x) (at x)
eventually ((\<le>) (1::?'a1)) at_top

goal (1 subgoal):
 1. \<forall>\<^sub>F x in at_top. ((\<lambda>x. f (inverse x)) has_real_derivative f' (inverse (inverse x)) * - (inverse (inverse x) ^ Suc (Suc 0))) (at (inverse x))
[PROOF STEP]
by eventually_elim (rule derivative_eq_intros DERIV_chain'[where f=inverse] | simp)+
[PROOF STATE]
proof (state)
this:
\<forall>\<^sub>F x in at_right 0. ((\<lambda>x. f (inverse x)) has_real_derivative f' (inverse x) * - (inverse x ^ Suc (Suc 0))) (at x)

goal (2 subgoals):
 1. \<forall>\<^sub>F x in at_right 0. g' (inverse x) * - (inverse x ^ Suc (Suc 0)) \<noteq> 0
 2. ((\<lambda>x. f' (inverse x) * - (inverse x ^ Suc (Suc 0)) / (g' (inverse x) * - (inverse x ^ Suc (Suc 0)))) \<longlongrightarrow> x) (at_right 0)
[PROOF STEP]
show "eventually (\<lambda>x. ?D g' x \<noteq> 0) ?R"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>\<^sub>F x in at_right 0. g' (inverse x) * - (inverse x ^ Suc (Suc 0)) \<noteq> 0
[PROOF STEP]
unfolding eventually_at_right_to_top
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>\<^sub>F x in at_top. g' (inverse (inverse x)) * - (inverse (inverse x) ^ Suc (Suc 0)) \<noteq> 0
[PROOF STEP]
using g' eventually_ge_at_top[where c=1]
[PROOF STATE]
proof (prove)
using this:
\<forall>\<^sub>F x in at_top. g' x \<noteq> 0
eventually ((\<le>) (1::?'a1)) at_top

goal (1 subgoal):
 1. \<forall>\<^sub>F x in at_top. g' (inverse (inverse x)) * - (inverse (inverse x) ^ Suc (Suc 0)) \<noteq> 0
[PROOF STEP]
by eventually_elim auto
[PROOF STATE]
proof (state)
this:
\<forall>\<^sub>F x in at_right 0. g' (inverse x) * - (inverse x ^ Suc (Suc 0)) \<noteq> 0

goal (1 subgoal):
 1. ((\<lambda>x. f' (inverse x) * - (inverse x ^ Suc (Suc 0)) / (g' (inverse x) * - (inverse x ^ Suc (Suc 0)))) \<longlongrightarrow> x) (at_right 0)
[PROOF STEP]
show "((\<lambda>x. ?D f' x / ?D g' x) \<longlongrightarrow> x) ?R"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<lambda>x. f' (inverse x) * - (inverse x ^ Suc (Suc 0)) / (g' (inverse x) * - (inverse x ^ Suc (Suc 0)))) \<longlongrightarrow> x) (at_right 0)
[PROOF STEP]
unfolding filterlim_at_right_to_top
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<lambda>x. f' (inverse (inverse x)) * - (inverse (inverse x) ^ Suc (Suc 0)) / (g' (inverse (inverse x)) * - (inverse (inverse x) ^ Suc (Suc 0)))) \<longlongrightarrow> x) at_top
[PROOF STEP]
apply (intro filterlim_cong[THEN iffD2, OF refl refl _ lim])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>\<^sub>F x in at_top. f' (inverse (inverse x)) * - (inverse (inverse x) ^ Suc (Suc 0)) / (g' (inverse (inverse x)) * - (inverse (inverse x) ^ Suc (Suc 0))) = f' x / g' x
[PROOF STEP]
using eventually_ge_at_top[where c=1]
[PROOF STATE]
proof (prove)
using this:
eventually ((\<le>) (1::?'a1)) at_top

goal (1 subgoal):
 1. \<forall>\<^sub>F x in at_top. f' (inverse (inverse x)) * - (inverse (inverse x) ^ Suc (Suc 0)) / (g' (inverse (inverse x)) * - (inverse (inverse x) ^ Suc (Suc 0))) = f' x / g' x
[PROOF STEP]
by eventually_elim simp
[PROOF STATE]
proof (state)
this:
((\<lambda>x. f' (inverse x) * - (inverse x ^ Suc (Suc 0)) / (g' (inverse x) * - (inverse x ^ Suc (Suc 0)))) \<longlongrightarrow> x) (at_right 0)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma singleton_list_hd_last: "length xs = 1 \<Longrightarrow> hd xs = last xs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. length xs = 1 \<Longrightarrow> hd xs = last xs
[PROOF STEP]
by (metis One_nat_def impossible_Cons last.simps length_0_conv less_nat_zero_code list.sel(1) nat_less_le neq_Nil_conv not_less_eq_eq)


[STATEMENT]
lemma dist_fls_sym: "dist (a :: 'a fls) b = dist b a"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. dist a b = dist b a
[PROOF STEP]
by  (cases "a\<noteq>b", cases "fls_subdegree (a-b) \<ge> 0")
      (simp_all add: fls_subdegree_minus_sym dist_fls_def)


[STATEMENT]
lemma wordinterval_size_length: "wordinterval_size r = length (wi2l r)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. wordinterval_size r = length (wi2l r)
[PROOF STEP]
by(induction r) (auto)


[STATEMENT]
lemma basis_enum_of_vec_cblinfun_apply:
  fixes M :: "complex mat"
  defines "nA \<equiv> length (canonical_basis :: 'a::{basis_enum,complex_normed_vector} list)"
    and "nB \<equiv> length (canonical_basis :: 'b::{basis_enum,complex_normed_vector} list)"
  assumes "M \<in> carrier_mat nB nA" and "dim_vec x = nA"
  shows "basis_enum_of_vec (M *\<^sub>v x) = (cblinfun_of_mat M :: 'a \<Rightarrow>\<^sub>C\<^sub>L 'b) *\<^sub>V basis_enum_of_vec x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. basis_enum_of_vec (M *\<^sub>v x) = cblinfun_of_mat M *\<^sub>V basis_enum_of_vec x
[PROOF STEP]
by (metis assms basis_enum_of_vec_inverse cblinfun_of_mat.rep_eq)


[STATEMENT]
lemma ereal_of_enat_nonneg: "ereal_of_enat n \<ge> 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 \<le> ereal_of_enat n
[PROOF STEP]
by(cases n) simp_all


[STATEMENT]
lemma extract_subdiags_eq_comp:
  fixes A::"complex Matrix.mat"
  assumes "diagonal_mat A"
  and "A\<in> carrier_mat n n"
  and "0 < n"
  and "i < length (eq_comps (diag_mat A))"
  shows "\<exists>k. (extract_subdiags A (eq_comps (diag_mat A)))!i =
    k \<cdot>\<^sub>m (1\<^sub>m ((eq_comps (diag_mat A))!i))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>k. extract_subdiags A (eq_comps (diag_mat A)) ! i = k \<cdot>\<^sub>m 1\<^sub>m (eq_comps (diag_mat A) ! i)
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. extract_subdiags A (eq_comps (diag_mat A)) ! i = ?k \<cdot>\<^sub>m 1\<^sub>m (eq_comps (diag_mat A) ! i)
[PROOF STEP]
define l where "l = diag_mat A"
[PROOF STATE]
proof (state)
this:
l = diag_mat A

goal (1 subgoal):
 1. extract_subdiags A (eq_comps (diag_mat A)) ! i = ?k \<cdot>\<^sub>m 1\<^sub>m (eq_comps (diag_mat A) ! i)
[PROOF STEP]
define k where "k = l!(n_sum i (eq_comps l))"
[PROOF STATE]
proof (state)
this:
k = l ! n_sum i (eq_comps l)

goal (1 subgoal):
 1. extract_subdiags A (eq_comps (diag_mat A)) ! i = ?k \<cdot>\<^sub>m 1\<^sub>m (eq_comps (diag_mat A) ! i)
[PROOF STEP]
show "extract_subdiags A (eq_comps (diag_mat A)) ! i =
    k \<cdot>\<^sub>m 1\<^sub>m (eq_comps (diag_mat A) ! i)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. extract_subdiags A (eq_comps (diag_mat A)) ! i = k \<cdot>\<^sub>m 1\<^sub>m (eq_comps (diag_mat A) ! i)
[PROOF STEP]
proof (rule eq_matI, auto simp add: assms)
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<And>j. j < eq_comps (diag_mat A) ! i \<Longrightarrow> extract_subdiags A (eq_comps (diag_mat A)) ! i $$ (j, j) = k
 2. \<And>ia j. \<lbrakk>ia < eq_comps (diag_mat A) ! i; j < eq_comps (diag_mat A) ! i; ia \<noteq> j\<rbrakk> \<Longrightarrow> extract_subdiags A (eq_comps (diag_mat A)) ! i $$ (ia, j) = 0
 3. dim_row (extract_subdiags A (eq_comps (diag_mat A)) ! i) = eq_comps (diag_mat A) ! i
 4. dim_col (extract_subdiags A (eq_comps (diag_mat A)) ! i) = eq_comps (diag_mat A) ! i
[PROOF STEP]
show dr: "dim_row (extract_subdiags A (eq_comps (diag_mat A)) ! i) =
      eq_comps (diag_mat A) ! i"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. dim_row (extract_subdiags A (eq_comps (diag_mat A)) ! i) = eq_comps (diag_mat A) ! i
[PROOF STEP]
using extract_subdiags_carrier assms carrier_matD(1)
[PROOF STATE]
proof (prove)
using this:
?i < length ?l \<Longrightarrow> extract_subdiags ?B ?l ! ?i \<in> carrier_mat (?l ! ?i) (?l ! ?i)
diagonal_mat A
A \<in> carrier_mat n n
0 < n
i < length (eq_comps (diag_mat A))
?A \<in> carrier_mat ?nr ?nc \<Longrightarrow> dim_row ?A = ?nr

goal (1 subgoal):
 1. dim_row (extract_subdiags A (eq_comps (diag_mat A)) ! i) = eq_comps (diag_mat A) ! i
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
dim_row (extract_subdiags A (eq_comps (diag_mat A)) ! i) = eq_comps (diag_mat A) ! i

goal (3 subgoals):
 1. \<And>j. j < eq_comps (diag_mat A) ! i \<Longrightarrow> extract_subdiags A (eq_comps (diag_mat A)) ! i $$ (j, j) = k
 2. \<And>ia j. \<lbrakk>ia < eq_comps (diag_mat A) ! i; j < eq_comps (diag_mat A) ! i; ia \<noteq> j\<rbrakk> \<Longrightarrow> extract_subdiags A (eq_comps (diag_mat A)) ! i $$ (ia, j) = 0
 3. dim_col (extract_subdiags A (eq_comps (diag_mat A)) ! i) = eq_comps (diag_mat A) ! i
[PROOF STEP]
show dc: "dim_col (extract_subdiags A (eq_comps (diag_mat A)) ! i) =
      eq_comps (diag_mat A) ! i"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. dim_col (extract_subdiags A (eq_comps (diag_mat A)) ! i) = eq_comps (diag_mat A) ! i
[PROOF STEP]
using extract_subdiags_carrier assms carrier_matD
[PROOF STATE]
proof (prove)
using this:
?i < length ?l \<Longrightarrow> extract_subdiags ?B ?l ! ?i \<in> carrier_mat (?l ! ?i) (?l ! ?i)
diagonal_mat A
A \<in> carrier_mat n n
0 < n
i < length (eq_comps (diag_mat A))
?A \<in> carrier_mat ?nr ?nc \<Longrightarrow> dim_row ?A = ?nr
?A \<in> carrier_mat ?nr ?nc \<Longrightarrow> dim_col ?A = ?nc

goal (1 subgoal):
 1. dim_col (extract_subdiags A (eq_comps (diag_mat A)) ! i) = eq_comps (diag_mat A) ! i
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
dim_col (extract_subdiags A (eq_comps (diag_mat A)) ! i) = eq_comps (diag_mat A) ! i

goal (2 subgoals):
 1. \<And>j. j < eq_comps (diag_mat A) ! i \<Longrightarrow> extract_subdiags A (eq_comps (diag_mat A)) ! i $$ (j, j) = k
 2. \<And>ia j. \<lbrakk>ia < eq_comps (diag_mat A) ! i; j < eq_comps (diag_mat A) ! i; ia \<noteq> j\<rbrakk> \<Longrightarrow> extract_subdiags A (eq_comps (diag_mat A)) ! i $$ (ia, j) = 0
[PROOF STEP]
fix m np
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>j. j < eq_comps (diag_mat A) ! i \<Longrightarrow> extract_subdiags A (eq_comps (diag_mat A)) ! i $$ (j, j) = k
 2. \<And>ia j. \<lbrakk>ia < eq_comps (diag_mat A) ! i; j < eq_comps (diag_mat A) ! i; ia \<noteq> j\<rbrakk> \<Longrightarrow> extract_subdiags A (eq_comps (diag_mat A)) ! i $$ (ia, j) = 0
[PROOF STEP]
assume "m < eq_comps (diag_mat A)!i" and "np < eq_comps (diag_mat A)!i"
      and "m\<noteq> np"
[PROOF STATE]
proof (state)
this:
m < eq_comps (diag_mat A) ! i
np < eq_comps (diag_mat A) ! i
m \<noteq> np

goal (2 subgoals):
 1. \<And>j. j < eq_comps (diag_mat A) ! i \<Longrightarrow> extract_subdiags A (eq_comps (diag_mat A)) ! i $$ (j, j) = k
 2. \<And>ia j. \<lbrakk>ia < eq_comps (diag_mat A) ! i; j < eq_comps (diag_mat A) ! i; ia \<noteq> j\<rbrakk> \<Longrightarrow> extract_subdiags A (eq_comps (diag_mat A)) ! i $$ (ia, j) = 0
[PROOF STEP]
note mnp=this
[PROOF STATE]
proof (state)
this:
m < eq_comps (diag_mat A) ! i
np < eq_comps (diag_mat A) ! i
m \<noteq> np

goal (2 subgoals):
 1. \<And>j. j < eq_comps (diag_mat A) ! i \<Longrightarrow> extract_subdiags A (eq_comps (diag_mat A)) ! i $$ (j, j) = k
 2. \<And>ia j. \<lbrakk>ia < eq_comps (diag_mat A) ! i; j < eq_comps (diag_mat A) ! i; ia \<noteq> j\<rbrakk> \<Longrightarrow> extract_subdiags A (eq_comps (diag_mat A)) ! i $$ (ia, j) = 0
[PROOF STEP]
have "diagonal_mat (extract_subdiags A (eq_comps (diag_mat A)) !i)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. diagonal_mat (extract_subdiags A (eq_comps (diag_mat A)) ! i)
[PROOF STEP]
proof (rule extract_subdiags_diagonal)
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. diagonal_mat A
 2. A \<in> carrier_mat ?n ?n
 3. eq_comps (diag_mat A) \<noteq> []
 4. sum_list (eq_comps (diag_mat A)) \<le> ?n
 5. i < length (eq_comps (diag_mat A))
[PROOF STEP]
show "diagonal_mat A"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. diagonal_mat A
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
diagonal_mat A
A \<in> carrier_mat n n
0 < n
i < length (eq_comps (diag_mat A))

goal (1 subgoal):
 1. diagonal_mat A
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
diagonal_mat A

goal (4 subgoals):
 1. A \<in> carrier_mat ?n ?n
 2. eq_comps (diag_mat A) \<noteq> []
 3. sum_list (eq_comps (diag_mat A)) \<le> ?n
 4. i < length (eq_comps (diag_mat A))
[PROOF STEP]
show "A\<in> carrier_mat n n"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. A \<in> carrier_mat n n
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
diagonal_mat A
A \<in> carrier_mat n n
0 < n
i < length (eq_comps (diag_mat A))

goal (1 subgoal):
 1. A \<in> carrier_mat n n
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
A \<in> carrier_mat n n

goal (3 subgoals):
 1. eq_comps (diag_mat A) \<noteq> []
 2. sum_list (eq_comps (diag_mat A)) \<le> n
 3. i < length (eq_comps (diag_mat A))
[PROOF STEP]
show "eq_comps (diag_mat A) \<noteq> []"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. eq_comps (diag_mat A) \<noteq> []
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
diagonal_mat A
A \<in> carrier_mat n n
0 < n
i < length (eq_comps (diag_mat A))

goal (1 subgoal):
 1. eq_comps (diag_mat A) \<noteq> []
[PROOF STEP]
unfolding diag_mat_def
[PROOF STATE]
proof (prove)
using this:
diagonal_mat A
A \<in> carrier_mat n n
0 < n
i < length (eq_comps (map (\<lambda>i. A $$ (i, i)) [0..<dim_row A]))

goal (1 subgoal):
 1. eq_comps (map (\<lambda>i. A $$ (i, i)) [0..<dim_row A]) \<noteq> []
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
eq_comps (diag_mat A) \<noteq> []

goal (2 subgoals):
 1. sum_list (eq_comps (diag_mat A)) \<le> n
 2. i < length (eq_comps (diag_mat A))
[PROOF STEP]
show "sum_list (eq_comps (diag_mat A)) \<le> n"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. sum_list (eq_comps (diag_mat A)) \<le> n
[PROOF STEP]
using assms eq_comps_sum_list
[PROOF STATE]
proof (prove)
using this:
diagonal_mat A
A \<in> carrier_mat n n
0 < n
i < length (eq_comps (diag_mat A))
sum_list (eq_comps ?l) = length ?l

goal (1 subgoal):
 1. sum_list (eq_comps (diag_mat A)) \<le> n
[PROOF STEP]
unfolding diag_mat_def
[PROOF STATE]
proof (prove)
using this:
diagonal_mat A
A \<in> carrier_mat n n
0 < n
i < length (eq_comps (map (\<lambda>i. A $$ (i, i)) [0..<dim_row A]))
sum_list (eq_comps ?l) = length ?l

goal (1 subgoal):
 1. sum_list (eq_comps (map (\<lambda>i. A $$ (i, i)) [0..<dim_row A])) \<le> n
[PROOF STEP]
by (metis carrier_matD(1) carrier_matD(2) length_cols_mat_to_cols_list
            length_map order.eq_iff)
[PROOF STATE]
proof (state)
this:
sum_list (eq_comps (diag_mat A)) \<le> n

goal (1 subgoal):
 1. i < length (eq_comps (diag_mat A))
[PROOF STEP]
show "i < length (eq_comps (diag_mat A))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. i < length (eq_comps (diag_mat A))
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
diagonal_mat A
A \<in> carrier_mat n n
0 < n
i < length (eq_comps (diag_mat A))

goal (1 subgoal):
 1. i < length (eq_comps (diag_mat A))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
i < length (eq_comps (diag_mat A))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
diagonal_mat (extract_subdiags A (eq_comps (diag_mat A)) ! i)

goal (2 subgoals):
 1. \<And>j. j < eq_comps (diag_mat A) ! i \<Longrightarrow> extract_subdiags A (eq_comps (diag_mat A)) ! i $$ (j, j) = k
 2. \<And>ia j. \<lbrakk>ia < eq_comps (diag_mat A) ! i; j < eq_comps (diag_mat A) ! i; ia \<noteq> j\<rbrakk> \<Longrightarrow> extract_subdiags A (eq_comps (diag_mat A)) ! i $$ (ia, j) = 0
[PROOF STEP]
thus "extract_subdiags A (eq_comps (diag_mat A)) ! i $$ (m, np) = 0"
[PROOF STATE]
proof (prove)
using this:
diagonal_mat (extract_subdiags A (eq_comps (diag_mat A)) ! i)

goal (1 subgoal):
 1. extract_subdiags A (eq_comps (diag_mat A)) ! i $$ (m, np) = 0
[PROOF STEP]
using mnp dr dc
[PROOF STATE]
proof (prove)
using this:
diagonal_mat (extract_subdiags A (eq_comps (diag_mat A)) ! i)
m < eq_comps (diag_mat A) ! i
np < eq_comps (diag_mat A) ! i
m \<noteq> np
dim_row (extract_subdiags A (eq_comps (diag_mat A)) ! i) = eq_comps (diag_mat A) ! i
dim_col (extract_subdiags A (eq_comps (diag_mat A)) ! i) = eq_comps (diag_mat A) ! i

goal (1 subgoal):
 1. extract_subdiags A (eq_comps (diag_mat A)) ! i $$ (m, np) = 0
[PROOF STEP]
by (metis diagonal_mat_def)
[PROOF STATE]
proof (state)
this:
extract_subdiags A (eq_comps (diag_mat A)) ! i $$ (m, np) = 0

goal (1 subgoal):
 1. \<And>j. j < eq_comps (diag_mat A) ! i \<Longrightarrow> extract_subdiags A (eq_comps (diag_mat A)) ! i $$ (j, j) = k
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>j. j < eq_comps (diag_mat A) ! i \<Longrightarrow> extract_subdiags A (eq_comps (diag_mat A)) ! i $$ (j, j) = k
[PROOF STEP]
fix p
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>j. j < eq_comps (diag_mat A) ! i \<Longrightarrow> extract_subdiags A (eq_comps (diag_mat A)) ! i $$ (j, j) = k
[PROOF STEP]
assume "p < eq_comps (diag_mat A) ! i"
[PROOF STATE]
proof (state)
this:
p < eq_comps (diag_mat A) ! i

goal (1 subgoal):
 1. \<And>j. j < eq_comps (diag_mat A) ! i \<Longrightarrow> extract_subdiags A (eq_comps (diag_mat A)) ! i $$ (j, j) = k
[PROOF STEP]
have "extract_subdiags A (eq_comps (diag_mat A)) ! i $$ (p, p) =
      diag_mat A! (n_sum i (eq_comps (diag_mat A)) + p)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. extract_subdiags A (eq_comps (diag_mat A)) ! i $$ (p, p) = diag_mat A ! (n_sum i (eq_comps (diag_mat A)) + p)
[PROOF STEP]
proof (rule extract_subdiags_diag_elem)
[PROOF STATE]
proof (state)
goal (7 subgoals):
 1. A \<in> carrier_mat ?n ?n
 2. 0 < ?n
 3. eq_comps (diag_mat A) \<noteq> []
 4. i < length (eq_comps (diag_mat A))
 5. p < eq_comps (diag_mat A) ! i
 6. sum_list (eq_comps (diag_mat A)) \<le> ?n
 7. \<forall>j<length (eq_comps (diag_mat A)). 0 < eq_comps (diag_mat A) ! j
[PROOF STEP]
show "A\<in> carrier_mat n n" "0 < n" "i < length (eq_comps (diag_mat A))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. A \<in> carrier_mat n n &&& 0 < n &&& i < length (eq_comps (diag_mat A))
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
diagonal_mat A
A \<in> carrier_mat n n
0 < n
i < length (eq_comps (diag_mat A))

goal (1 subgoal):
 1. A \<in> carrier_mat n n &&& 0 < n &&& i < length (eq_comps (diag_mat A))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
A \<in> carrier_mat n n
0 < n
i < length (eq_comps (diag_mat A))

goal (4 subgoals):
 1. eq_comps (diag_mat A) \<noteq> []
 2. p < eq_comps (diag_mat A) ! i
 3. sum_list (eq_comps (diag_mat A)) \<le> n
 4. \<forall>j<length (eq_comps (diag_mat A)). 0 < eq_comps (diag_mat A) ! j
[PROOF STEP]
show ne: "eq_comps (diag_mat A) \<noteq> []"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. eq_comps (diag_mat A) \<noteq> []
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
diagonal_mat A
A \<in> carrier_mat n n
0 < n
i < length (eq_comps (diag_mat A))

goal (1 subgoal):
 1. eq_comps (diag_mat A) \<noteq> []
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
eq_comps (diag_mat A) \<noteq> []

goal (3 subgoals):
 1. p < eq_comps (diag_mat A) ! i
 2. sum_list (eq_comps (diag_mat A)) \<le> n
 3. \<forall>j<length (eq_comps (diag_mat A)). 0 < eq_comps (diag_mat A) ! j
[PROOF STEP]
show "p < eq_comps (diag_mat A) ! i"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. p < eq_comps (diag_mat A) ! i
[PROOF STEP]
using \<open>p < eq_comps (diag_mat A) ! i\<close>
[PROOF STATE]
proof (prove)
using this:
p < eq_comps (diag_mat A) ! i

goal (1 subgoal):
 1. p < eq_comps (diag_mat A) ! i
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
p < eq_comps (diag_mat A) ! i

goal (2 subgoals):
 1. sum_list (eq_comps (diag_mat A)) \<le> n
 2. \<forall>j<length (eq_comps (diag_mat A)). 0 < eq_comps (diag_mat A) ! j
[PROOF STEP]
show "sum_list (eq_comps (diag_mat A)) \<le> n"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. sum_list (eq_comps (diag_mat A)) \<le> n
[PROOF STEP]
using assms eq_comps_sum_list[of "diag_mat A"]
[PROOF STATE]
proof (prove)
using this:
diagonal_mat A
A \<in> carrier_mat n n
0 < n
i < length (eq_comps (diag_mat A))
sum_list (eq_comps (diag_mat A)) = length (diag_mat A)

goal (1 subgoal):
 1. sum_list (eq_comps (diag_mat A)) \<le> n
[PROOF STEP]
unfolding diag_mat_def
[PROOF STATE]
proof (prove)
using this:
diagonal_mat A
A \<in> carrier_mat n n
0 < n
i < length (eq_comps (map (\<lambda>i. A $$ (i, i)) [0..<dim_row A]))
sum_list (eq_comps (map (\<lambda>i. A $$ (i, i)) [0..<dim_row A])) = length (map (\<lambda>i. A $$ (i, i)) [0..<dim_row A])

goal (1 subgoal):
 1. sum_list (eq_comps (map (\<lambda>i. A $$ (i, i)) [0..<dim_row A])) \<le> n
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
sum_list (eq_comps (diag_mat A)) \<le> n

goal (1 subgoal):
 1. \<forall>j<length (eq_comps (diag_mat A)). 0 < eq_comps (diag_mat A) ! j
[PROOF STEP]
show "\<forall>j<length (eq_comps (diag_mat A)). 0 < eq_comps (diag_mat A) ! j"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>j<length (eq_comps (diag_mat A)). 0 < eq_comps (diag_mat A) ! j
[PROOF STEP]
using eq_comps_gt_0 ne
[PROOF STATE]
proof (prove)
using this:
?l \<noteq> [] \<Longrightarrow> list_all ((<) 0) (eq_comps ?l)
eq_comps (diag_mat A) \<noteq> []

goal (1 subgoal):
 1. \<forall>j<length (eq_comps (diag_mat A)). 0 < eq_comps (diag_mat A) ! j
[PROOF STEP]
by (metis eq_comps.simps(1) list_all_length)
[PROOF STATE]
proof (state)
this:
\<forall>j<length (eq_comps (diag_mat A)). 0 < eq_comps (diag_mat A) ! j

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
extract_subdiags A (eq_comps (diag_mat A)) ! i $$ (p, p) = diag_mat A ! (n_sum i (eq_comps (diag_mat A)) + p)

goal (1 subgoal):
 1. \<And>j. j < eq_comps (diag_mat A) ! i \<Longrightarrow> extract_subdiags A (eq_comps (diag_mat A)) ! i $$ (j, j) = k
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
extract_subdiags A (eq_comps (diag_mat A)) ! i $$ (p, p) = diag_mat A ! (n_sum i (eq_comps (diag_mat A)) + p)

goal (1 subgoal):
 1. \<And>j. j < eq_comps (diag_mat A) ! i \<Longrightarrow> extract_subdiags A (eq_comps (diag_mat A)) ! i $$ (j, j) = k
[PROOF STEP]
have "... = k"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. diag_mat A ! (n_sum i (eq_comps (diag_mat A)) + p) = k
[PROOF STEP]
unfolding k_def l_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. diag_mat A ! (n_sum i (eq_comps (diag_mat A)) + p) = diag_mat A ! n_sum i (eq_comps (diag_mat A))
[PROOF STEP]
proof (rule eq_comps_elems_eq[symmetric])
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. diag_mat A \<noteq> []
 2. i < length (eq_comps (diag_mat A))
 3. p < eq_comps (diag_mat A) ! i
[PROOF STEP]
show "diag_mat A \<noteq> []"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. diag_mat A \<noteq> []
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
diagonal_mat A
A \<in> carrier_mat n n
0 < n
i < length (eq_comps (diag_mat A))

goal (1 subgoal):
 1. diag_mat A \<noteq> []
[PROOF STEP]
unfolding diag_mat_def
[PROOF STATE]
proof (prove)
using this:
diagonal_mat A
A \<in> carrier_mat n n
0 < n
i < length (eq_comps (map (\<lambda>i. A $$ (i, i)) [0..<dim_row A]))

goal (1 subgoal):
 1. map (\<lambda>i. A $$ (i, i)) [0..<dim_row A] \<noteq> []
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
diag_mat A \<noteq> []

goal (2 subgoals):
 1. i < length (eq_comps (diag_mat A))
 2. p < eq_comps (diag_mat A) ! i
[PROOF STEP]
show "p < eq_comps (diag_mat A) ! i"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. p < eq_comps (diag_mat A) ! i
[PROOF STEP]
using \<open>p < eq_comps (diag_mat A) ! i\<close>
[PROOF STATE]
proof (prove)
using this:
p < eq_comps (diag_mat A) ! i

goal (1 subgoal):
 1. p < eq_comps (diag_mat A) ! i
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
p < eq_comps (diag_mat A) ! i

goal (1 subgoal):
 1. i < length (eq_comps (diag_mat A))
[PROOF STEP]
show "i < length (eq_comps (diag_mat A))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. i < length (eq_comps (diag_mat A))
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
diagonal_mat A
A \<in> carrier_mat n n
0 < n
i < length (eq_comps (diag_mat A))

goal (1 subgoal):
 1. i < length (eq_comps (diag_mat A))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
i < length (eq_comps (diag_mat A))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
diag_mat A ! (n_sum i (eq_comps (diag_mat A)) + p) = k

goal (1 subgoal):
 1. \<And>j. j < eq_comps (diag_mat A) ! i \<Longrightarrow> extract_subdiags A (eq_comps (diag_mat A)) ! i $$ (j, j) = k
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
extract_subdiags A (eq_comps (diag_mat A)) ! i $$ (p, p) = k
[PROOF STEP]
show
      "extract_subdiags A (eq_comps (diag_mat A)) ! i $$ (p, p) = k"
[PROOF STATE]
proof (prove)
using this:
extract_subdiags A (eq_comps (diag_mat A)) ! i $$ (p, p) = k

goal (1 subgoal):
 1. extract_subdiags A (eq_comps (diag_mat A)) ! i $$ (p, p) = k
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
extract_subdiags A (eq_comps (diag_mat A)) ! i $$ (p, p) = k

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
extract_subdiags A (eq_comps (diag_mat A)) ! i = k \<cdot>\<^sub>m 1\<^sub>m (eq_comps (diag_mat A) ! i)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma l11_44_1:
  assumes "\<not> Col A B C"
  shows "B A C CongA B C A \<longleftrightarrow> Cong B A B C"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (B A C CongA B C A) = Cong B A B C
[PROOF STEP]
using assms l11_44_1_a l11_44_1_b not_col_distincts
[PROOF STATE]
proof (prove)
using this:
\<not> Col A B C
\<lbrakk>?A \<noteq> ?B; ?A \<noteq> ?C; Cong ?B ?A ?B ?C\<rbrakk> \<Longrightarrow> ?B ?A ?C CongA ?B ?C ?A
\<lbrakk>\<not> Col ?A ?B ?C; ?B ?A ?C CongA ?B ?C ?A\<rbrakk> \<Longrightarrow> Cong ?B ?A ?B ?C
\<not> Col ?A ?B ?C \<Longrightarrow> \<not> Col ?A ?B ?C \<and> ?A \<noteq> ?B \<and> ?B \<noteq> ?C \<and> ?A \<noteq> ?C

goal (1 subgoal):
 1. (B A C CongA B C A) = Cong B A B C
[PROOF STEP]
by blast


[STATEMENT]
lemma length_update:
  "length (AList.update k v xs)
  = (if k \<in> fst ` set xs then length xs else Suc (length xs))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. length (AList.update k v xs) = (if k \<in> fst ` set xs then length xs else Suc (length xs))
[PROOF STEP]
by(induct xs) simp_all


[STATEMENT]
lemma mem_0_Ord:
  assumes k: "Ord k" and knz: "k \<noteq> 0" shows "0 \<in> elts k"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 \<in> elts k
[PROOF STEP]
by (metis Ord_def Transset_def inf.orderE k knz trad_foundation)


[STATEMENT]
lemma flat_pm_of_poly_pCons:
  "flat_pm_of_poly x (pCons c p) =
    c + punit.monom_mult 1 (Poly_Mapping.single x 1) (flat_pm_of_poly x (p::_::comm_semiring_1 poly))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. flat_pm_of_poly x (pCons c p) = c + punit.monom_mult (1::'b) (monomial 1 x) (flat_pm_of_poly x p)
[PROOF STEP]
by (simp add: flat_pm_of_poly_def pm_of_poly_pCons flatten_plus flatten_monomial flatten_times
          flip: times_monomial_left)


[STATEMENT]
lemma bigo_lesseq1: "f =o O(h) \<Longrightarrow> \<forall>x. \<bar>g x\<bar> \<le> \<bar>f x\<bar> \<Longrightarrow> g =o O(h)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>f \<in> O(h); \<forall>x. \<bar>g x\<bar> \<le> \<bar>f x\<bar>\<rbrakk> \<Longrightarrow> g \<in> O(h)
[PROOF STEP]
apply (unfold bigo_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>f \<in> {ha. \<exists>c. \<forall>x. \<bar>ha x\<bar> \<le> c * \<bar>h x\<bar>}; \<forall>x. \<bar>g x\<bar> \<le> \<bar>f x\<bar>\<rbrakk> \<Longrightarrow> g \<in> {ha. \<exists>c. \<forall>x. \<bar>ha x\<bar> \<le> c * \<bar>h x\<bar>}
[PROOF STEP]
apply clarsimp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>c. \<lbrakk>\<forall>x. \<bar>g x\<bar> \<le> \<bar>f x\<bar>; \<forall>x. \<bar>f x\<bar> \<le> c * \<bar>h x\<bar>\<rbrakk> \<Longrightarrow> \<exists>c. \<forall>x. \<bar>g x\<bar> \<le> c * \<bar>h x\<bar>
[PROOF STEP]
apply (rule_tac x = c in exI)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>c. \<lbrakk>\<forall>x. \<bar>g x\<bar> \<le> \<bar>f x\<bar>; \<forall>x. \<bar>f x\<bar> \<le> c * \<bar>h x\<bar>\<rbrakk> \<Longrightarrow> \<forall>x. \<bar>g x\<bar> \<le> c * \<bar>h x\<bar>
[PROOF STEP]
apply (rule allI)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>c x. \<lbrakk>\<forall>x. \<bar>g x\<bar> \<le> \<bar>f x\<bar>; \<forall>x. \<bar>f x\<bar> \<le> c * \<bar>h x\<bar>\<rbrakk> \<Longrightarrow> \<bar>g x\<bar> \<le> c * \<bar>h x\<bar>
[PROOF STEP]
apply (rule order_trans)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>c x. \<lbrakk>\<forall>x. \<bar>g x\<bar> \<le> \<bar>f x\<bar>; \<forall>x. \<bar>f x\<bar> \<le> c * \<bar>h x\<bar>\<rbrakk> \<Longrightarrow> \<bar>g x\<bar> \<le> ?y4 c x
 2. \<And>c x. \<lbrakk>\<forall>x. \<bar>g x\<bar> \<le> \<bar>f x\<bar>; \<forall>x. \<bar>f x\<bar> \<le> c * \<bar>h x\<bar>\<rbrakk> \<Longrightarrow> ?y4 c x \<le> c * \<bar>h x\<bar>
[PROOF STEP]
apply (erule spec)+
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma nba_image_rel[param]:
    assumes "inj_on f (nodes A)"
    shows "(A, nba_image f A) \<in> \<langle>Id_on (alphabet A), br f (\<lambda> p. p \<in> nodes A)\<rangle> nba_rel"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (A, nba_image f A) \<in> \<langle>Id_on (alphabet A), br f (\<lambda>p. p \<in> nodes A)\<rangle>nba_rel
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (A, nba_image f A) \<in> \<langle>Id_on (alphabet A), br f (\<lambda>p. p \<in> nodes A)\<rangle>nba_rel
[PROOF STEP]
have "A = nba (alphabet A) (initial A) (transition A) (accepting A)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. A = nba (alphabet A) (initial A) (transition A) (accepting A)
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
A = nba (alphabet A) (initial A) (transition A) (accepting A)

goal (1 subgoal):
 1. (A, nba_image f A) \<in> \<langle>Id_on (alphabet A), br f (\<lambda>p. p \<in> nodes A)\<rangle>nba_rel
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
A = nba (alphabet A) (initial A) (transition A) (accepting A)

goal (1 subgoal):
 1. (A, nba_image f A) \<in> \<langle>Id_on (alphabet A), br f (\<lambda>p. p \<in> nodes A)\<rangle>nba_rel
[PROOF STEP]
have "(\<dots>, nba_image f A) \<in> \<langle>Id_on (alphabet A), br f (\<lambda> p. p \<in> nodes A)\<rangle> nba_rel"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (nba (alphabet A) (initial A) (transition A) (accepting A), nba_image f A) \<in> \<langle>Id_on (alphabet A), br f (\<lambda>p. p \<in> nodes A)\<rangle>nba_rel
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
inj_on f (nodes A)

goal (1 subgoal):
 1. (nba (alphabet A) (initial A) (transition A) (accepting A), nba_image f A) \<in> \<langle>Id_on (alphabet A), br f (\<lambda>p. p \<in> nodes A)\<rangle>nba_rel
[PROOF STEP]
unfolding nba_image_def
[PROOF STATE]
proof (prove)
using this:
inj_on f (nodes A)

goal (1 subgoal):
 1. (nba (alphabet A) (initial A) (transition A) (accepting A), nba (alphabet A) (f ` initial A) (\<lambda>a p. f ` transition A a (inv_into (nodes A) f p)) (\<lambda>p. accepting A (inv_into (nodes A) f p))) \<in> \<langle>Id_on (alphabet A), br f (\<lambda>p. p \<in> nodes A)\<rangle>nba_rel
[PROOF STEP]
by (parametricity) (auto intro: nba_rel_eq simp: in_br_conv br_set_rel_alt)
[PROOF STATE]
proof (state)
this:
(nba (alphabet A) (initial A) (transition A) (accepting A), nba_image f A) \<in> \<langle>Id_on (alphabet A), br f (\<lambda>p. p \<in> nodes A)\<rangle>nba_rel

goal (1 subgoal):
 1. (A, nba_image f A) \<in> \<langle>Id_on (alphabet A), br f (\<lambda>p. p \<in> nodes A)\<rangle>nba_rel
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
(A, nba_image f A) \<in> \<langle>Id_on (alphabet A), br f (\<lambda>p. p \<in> nodes A)\<rangle>nba_rel
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
(A, nba_image f A) \<in> \<langle>Id_on (alphabet A), br f (\<lambda>p. p \<in> nodes A)\<rangle>nba_rel

goal (1 subgoal):
 1. (A, nba_image f A) \<in> \<langle>Id_on (alphabet A), br f (\<lambda>p. p \<in> nodes A)\<rangle>nba_rel
[PROOF STEP]
by this
[PROOF STATE]
proof (state)
this:
(A, nba_image f A) \<in> \<langle>Id_on (alphabet A), br f (\<lambda>p. p \<in> nodes A)\<rangle>nba_rel

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma continuous_on_final_topology_iff:
  "continuous_map (final_topology X Y f) Z g \<longleftrightarrow> (\<forall>i. continuous_map (Y i) Z (g o f i))"
  if "\<And>i. f i \<in> topspace (Y i) \<rightarrow> X" "g \<in> X \<rightarrow> topspace Z"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. continuous_map (final_topology X Y f) Z g = (\<forall>i. continuous_map (Y i) Z (g \<circ> f i))
[PROOF STEP]
using that
[PROOF STATE]
proof (prove)
using this:
f ?i \<in> topspace (Y ?i) \<rightarrow> X
g \<in> X \<rightarrow> topspace Z

goal (1 subgoal):
 1. continuous_map (final_topology X Y f) Z g = (\<forall>i. continuous_map (Y i) Z (g \<circ> f i))
[PROOF STEP]
by (auto intro!: continuous_on_final_topologyI1[OF _ that]
      intro: continuous_map_compose[OF continuous_on_final_topologyI2[OF that(1)]])


[STATEMENT]
lemma p2ndf_simps[simp]:
  "\<lceil>P\<rceil> \<le> \<lceil>Q\<rceil> = (\<forall>s. P s \<longrightarrow> Q s)"
  "(\<lceil>P\<rceil> = \<lceil>Q\<rceil>) = (\<forall>s. P s = Q s)"
  "(\<lceil>P\<rceil> \<cdot> \<lceil>Q\<rceil>) = \<lceil>\<lambda> s. P s \<and> Q s\<rceil>"
  "(\<lceil>P\<rceil> + \<lceil>Q\<rceil>) = \<lceil>\<lambda> s. P s \<or> Q s\<rceil>"
  "ad \<lceil>P\<rceil> = \<lceil>\<lambda>s. \<not> P s\<rceil>"
  "d \<lceil>P\<rceil> = \<lceil>P\<rceil>" "\<lceil>P\<rceil> \<le> \<eta>\<^sup>\<bullet>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<lceil>P\<rceil> \<le> \<lceil>Q\<rceil>) = (\<forall>s. P s \<longrightarrow> Q s) &&& (\<lceil>P\<rceil> = \<lceil>Q\<rceil>) = (\<forall>s. P s = Q s) &&& \<lceil>P\<rceil> \<cdot> \<lceil>Q\<rceil> = \<lceil>\<lambda>s. P s \<and> Q s\<rceil>) &&& (\<lceil>P\<rceil> + \<lceil>Q\<rceil> = \<lceil>\<lambda>s. P s \<or> Q s\<rceil> &&& ad \<lceil>P\<rceil> = \<lceil>\<lambda>s. \<not> P s\<rceil>) &&& d \<lceil>P\<rceil> = \<lceil>P\<rceil> &&& \<lceil>P\<rceil> \<le> \<eta>\<^sup>\<bullet>
[PROOF STEP]
unfolding less_eq_nd_fun_def times_nd_fun_def plus_nd_fun_def ads_d_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (id (\<lambda>f g. f\<^sub>\<bullet> \<le> g\<^sub>\<bullet>) \<lceil>P\<rceil> \<lceil>Q\<rceil> = (\<forall>s. P s \<longrightarrow> Q s) &&& (\<lceil>P\<rceil> = \<lceil>Q\<rceil>) = (\<forall>s. P s = Q s) &&& id (\<lambda>f g. (f\<^sub>\<bullet> \<circ>\<^sub>K g\<^sub>\<bullet>)\<^sup>\<bullet>) \<lceil>P\<rceil> \<lceil>Q\<rceil> = \<lceil>\<lambda>s. P s \<and> Q s\<rceil>) &&& ((\<lceil>P\<rceil>\<^sub>\<bullet> \<squnion> \<lceil>Q\<rceil>\<^sub>\<bullet>)\<^sup>\<bullet> = \<lceil>\<lambda>s. P s \<or> Q s\<rceil> &&& ad \<lceil>P\<rceil> = \<lceil>\<lambda>s. \<not> P s\<rceil>) &&& ad (ad \<lceil>P\<rceil>) = \<lceil>P\<rceil> &&& id (\<lambda>f g. f\<^sub>\<bullet> \<le> g\<^sub>\<bullet>) \<lceil>P\<rceil> (\<eta>\<^sup>\<bullet>)
[PROOF STEP]
by (auto simp: nd_fun_eq_iff kcomp_def le_fun_def antidomain_op_nd_fun_def)


[STATEMENT]
lemma totatives_eq_empty_iff [simp]: "totatives n = {} \<longleftrightarrow> n = 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (totatives n = {}) = (n = 0)
[PROOF STEP]
using one_in_totatives[of n]
[PROOF STATE]
proof (prove)
using this:
0 < n \<Longrightarrow> Suc 0 \<in> totatives n

goal (1 subgoal):
 1. (totatives n = {}) = (n = 0)
[PROOF STEP]
by (auto simp del: one_in_totatives)


[STATEMENT]
lemma writeCArrayCorrect1:
  "readCArray (writeCArray array index value) index = value"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. readCArray (writeCArray array index value) index = value
[PROOF STEP]
by (simp add: readCArray_def writeCArray_def)


[STATEMENT]
lemma ex_leq_Suc:
  "(\<exists>i\<le>Suc j. P i) \<longleftrightarrow> P 0 \<or> (\<exists>i\<le>j. P (Suc i))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<exists>i\<le>Suc j. P i) = (P 0 \<or> (\<exists>i\<le>j. P (Suc i)))
[PROOF STEP]
by (auto simp: le_Suc_eq')


[STATEMENT]
lemma nat_to_pr_at_0: "nat_to_pr 0 = (\<lambda> x. 0)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. nat_to_pr 0 = (\<lambda>x. 0)
[PROOF STEP]
by (simp add: nat_to_pr_def)


[STATEMENT]
lemma newton_seq_fact2:
"\<And>k.  val_Zp (f\<bullet>(ns k)) \<ge> 2*(val_Zp (f'\<bullet>a)) + (2^k)*t"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>k. eint 2 * val_Zp (f' \<bullet> a) + eint (2 ^ k) * t \<le> val_Zp (f \<bullet> ns k)
[PROOF STEP]
by (meson le_iff_add newton_seq_props_induct)