[STATEMENT]
lemma real_power_up_fl: "real_of_float (power_up_fl p x n) = power_up p x n"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. real_of_float (power_up_fl p x n) = power_up p (real_of_float x) n
[PROOF STEP]
by transfer simp


[STATEMENT]
lemma Dynkin_systemI:
  assumes "\<And> A. A \<in> M \<Longrightarrow> A \<subseteq> \<Omega>" "\<Omega> \<in> M"
  assumes "\<And> A. A \<in> M \<Longrightarrow> \<Omega> - A \<in> M"
  assumes "\<And> A. disjoint_family A \<Longrightarrow> range A \<subseteq> M
          \<Longrightarrow> (\<Union>i::nat. A i) \<in> M"
  shows "Dynkin_system \<Omega> M"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Dynkin_system \<Omega> M
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
?A \<in> M \<Longrightarrow> ?A \<subseteq> \<Omega>
\<Omega> \<in> M
?A \<in> M \<Longrightarrow> \<Omega> - ?A \<in> M
\<lbrakk>disjoint_family ?A; range ?A \<subseteq> M\<rbrakk> \<Longrightarrow> \<Union> (range ?A) \<in> M

goal (1 subgoal):
 1. Dynkin_system \<Omega> M
[PROOF STEP]
by (auto simp: Dynkin_system_def Dynkin_system_axioms_def subset_class_def)


[STATEMENT]
lemma F_inf_n: "F_inf n = n"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. F_inf n = n
[PROOF STEP]
by (simp add: F_inf_def n_nS12 n_S1 fun_eq_iff)


[STATEMENT]
lemma max_list_in_set: \<open>finite S \<Longrightarrow> set xs \<subseteq> S \<Longrightarrow> max_list xs \<le> max_set S\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>finite S; set xs \<subseteq> S\<rbrakk> \<Longrightarrow> max_list xs \<le> max_set S
[PROOF STEP]
unfolding max_set_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>finite S; set xs \<subseteq> S\<rbrakk> \<Longrightarrow> max_list xs \<le> (if S = {} then 0 else Max S)
[PROOF STEP]
using max_list_in_Cons
[PROOF STATE]
proof (prove)
using this:
?xs \<noteq> [] \<Longrightarrow> max_list ?xs \<in> set ?xs

goal (1 subgoal):
 1. \<lbrakk>finite S; set xs \<subseteq> S\<rbrakk> \<Longrightarrow> max_list xs \<le> (if S = {} then 0 else Max S)
[PROOF STEP]
by (metis (mono_tags, lifting) Max_ge bot.extremum_uniqueI bot_nat_0.extremum max_list.simps(1)
      set_empty subsetD)


[STATEMENT]
lemma inj_on_DirProd_carrier:
  shows "inj_on (\<lambda>(g, gs). g # gs) (carrier (G \<times>\<times> (DirProd_list Gs)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. inj_on (\<lambda>(g, gs). g # gs) (carrier (G \<times>\<times> DirProd_list Gs))
[PROOF STEP]
unfolding DirProd_def inj_on_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>x\<in>carrier \<lparr>carrier = carrier G \<times> carrier (DirProd_list Gs), mult = \<lambda>(g, h) (g', h'). (g \<otimes>\<^bsub>G\<^esub> g', h \<otimes>\<^bsub>DirProd_list Gs\<^esub> h'), one = (\<one>\<^bsub>G\<^esub>, \<one>\<^bsub>DirProd_list Gs\<^esub>)\<rparr>. \<forall>y\<in>carrier \<lparr>carrier = carrier G \<times> carrier (DirProd_list Gs), mult = \<lambda>(g, h) (g', h'). (g \<otimes>\<^bsub>G\<^esub> g', h \<otimes>\<^bsub>DirProd_list Gs\<^esub> h'), one = (\<one>\<^bsub>G\<^esub>, \<one>\<^bsub>DirProd_list Gs\<^esub>)\<rparr>. (case x of (x, xa) \<Rightarrow> x # xa) = (case y of (x, xa) \<Rightarrow> x # xa) \<longrightarrow> x = y
[PROOF STEP]
by auto


[STATEMENT]
lemma step_push_size_new_small [simp]: "\<lbrakk>
  invar (States dir big small);
  step (States dir big (Small.push x small)) = States dir' big' small'
\<rbrakk> \<Longrightarrow> size_new small' = Suc (size_new small)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invar (States dir big small); step (States dir big (Small.push x small)) = States dir' big' small'\<rbrakk> \<Longrightarrow> size_new small' = Suc (size_new small)
[PROOF STEP]
using
    invar_push_small[of dir big small x]
    step_size_new_small[of dir big "Small.push x small" dir' big' small']
    size_new_push[of small x]
[PROOF STATE]
proof (prove)
using this:
invar (States dir big small) \<Longrightarrow> invar (States dir big (Small.push x small))
\<lbrakk>invar (States dir big (Small.push x small)); step (States dir big (Small.push x small)) = States dir' big' small'\<rbrakk> \<Longrightarrow> size_new small' = size_new (Small.push x small)
invar small \<Longrightarrow> size_new (Small.push x small) = Suc (size_new small)

goal (1 subgoal):
 1. \<lbrakk>invar (States dir big small); step (States dir big (Small.push x small)) = States dir' big' small'\<rbrakk> \<Longrightarrow> size_new small' = Suc (size_new small)
[PROOF STEP]
by simp


[STATEMENT]
lemma ord_eucl_utility_imp_rpr: "eucl_ordinal_utility s rel u \<longrightarrow> real_vector_rpr s rel"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. eucl_ordinal_utility s rel u \<longrightarrow> real_vector_rpr s rel
[PROOF STEP]
using eucl_ordinal_utility.axioms ordinal_util_imp_rat_prefs real_vector_rpr.intro
[PROOF STATE]
proof (prove)
using this:
eucl_ordinal_utility ?carrier ?relation ?u \<Longrightarrow> ordinal_utility ?carrier ?relation ?u
ordinal_utility ?carrier ?relation ?u \<Longrightarrow> rational_preference ?carrier ?relation
rational_preference ?carrier ?relation \<Longrightarrow> real_vector_rpr ?carrier ?relation

goal (1 subgoal):
 1. eucl_ordinal_utility s rel u \<longrightarrow> real_vector_rpr s rel
[PROOF STEP]
by blast


[STATEMENT]
lemma convergent_liminf_cl:
  fixes X :: "nat \<Rightarrow> 'a::{complete_linorder,linorder_topology}"
  shows "convergent X \<Longrightarrow> liminf X = lim X"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. convergent X \<Longrightarrow> liminf X = lim X
[PROOF STEP]
by (auto simp: convergent_def limI lim_imp_Liminf)


[STATEMENT]
lemma dupe_monic_i_int_finite_field_ops32: assumes
      m: "m \<le> 65535"
  and dupe_i: "dupe_monic_i_int (finite_field_ops32 (uint32_of_int m)) D H S T U = (A,B)"
  and 1: "D*S + H*T =m 1"
  and mon: "monic D"
  and norm: "Mp D = D" "Mp H = H" "Mp S = S" "Mp T = T" "Mp U = U"
shows
  "A * D + B * H =m U"
  "B = 0 \<or> degree B < degree D"
  "Mp A = A"
  "Mp B = B"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (A * D + B * H =m U &&& B = 0 \<or> degree B < degree D) &&& Mp A = A &&& Mp B = B
[PROOF STEP]
using m1 mod_ring_gen.dupe_monic_i_int[OF
        mod_ring_locale.mod_ring_finite_field_ops32[unfolded mod_ring_locale_def],
        internalize_sort "'a :: nontriv", OF type_to_set, unfolded remove_duplicate_premise,
        cancel_type_definition, OF _ assms]
[PROOF STATE]
proof (prove)
using this:
1 < m
{0..<m} \<noteq> {} \<Longrightarrow> A * D + B * H =m U
{0..<m} \<noteq> {} \<Longrightarrow> B = 0 \<or> degree B < degree D
{0..<m} \<noteq> {} \<Longrightarrow> Mp A = A
{0..<m} \<noteq> {} \<Longrightarrow> Mp B = B

goal (1 subgoal):
 1. (A * D + B * H =m U &&& B = 0 \<or> degree B < degree D) &&& Mp A = A &&& Mp B = B
[PROOF STEP]
by auto


[STATEMENT]
theorem wls_swapAbs_vsubstAbs:
assumes "wlsAbs (us,s) A"
shows "((A $[y1 // y]_ys) $[z1 \<and> z2]_zs) =
       ((A $[z1 \<and> z2]_zs) $[(y1 @ys[z1 \<and> z2]_zs) // (y @ys[z1 \<and> z2]_zs)]_ys)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. A $[y1 // y]_ys $[z1 \<and> z2]_zs = A $[z1 \<and> z2]_zs $[y1 @ys[z1 \<and> z2]_zs // y @ys[z1 \<and> z2]_zs]_ys
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
wlsAbs (us, s) A

goal (1 subgoal):
 1. A $[y1 // y]_ys $[z1 \<and> z2]_zs = A $[z1 \<and> z2]_zs $[y1 @ys[z1 \<and> z2]_zs // y @ys[z1 \<and> z2]_zs]_ys
[PROOF STEP]
by(simp add: swapAbs_vsubstAbs)


[STATEMENT]
lemma ordsetmap_smap: "\<lbrakk> X\<in>\<P>; Y\<in>\<P>; X\<supseteq>Y \<rbrakk> \<Longrightarrow> smap X \<subseteq> smap Y"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>X \<in> \<P>; Y \<in> \<P>; Y \<subseteq> X\<rbrakk> \<Longrightarrow> dual_order.poset_simplex_map \<P> X \<subseteq> dual_order.poset_simplex_map \<P> Y
[PROOF STEP]
using ComplexLikePoset.ordsetmap_smap[OF ComplexLikePoset_special_cosets]
        smap_def
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?a \<in> \<P>; ?b \<in> \<P>; ?b \<subseteq> ?a\<rbrakk> \<Longrightarrow> dual_order.poset_simplex_map \<P> ?a \<subseteq> dual_order.poset_simplex_map \<P> ?b
dual_order.poset_simplex_map \<P> ?x = {y. dual_order.pseudominimal_in (dual_order.below_in \<P> ?x) y}

goal (1 subgoal):
 1. \<lbrakk>X \<in> \<P>; Y \<in> \<P>; Y \<subseteq> X\<rbrakk> \<Longrightarrow> dual_order.poset_simplex_map \<P> X \<subseteq> dual_order.poset_simplex_map \<P> Y
[PROOF STEP]
by    simp


[STATEMENT]
lemma majE: "2 * (E - \<alpha>) \<ge> N"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. N \<le> 2 * (E - \<alpha>)
[PROOF STEP]
using TNaE TltN
[PROOF STATE]
proof (prove)
using this:
2 * (N + 2 * \<alpha> - E) \<le> T
T < N

goal (1 subgoal):
 1. N \<le> 2 * (E - \<alpha>)
[PROOF STEP]
by auto


[STATEMENT]
lemma integral_scaleR_right[simp]: "(\<integral> x. c *\<^sub>R f x \<partial>M) = c *\<^sub>R integral\<^sup>L M f"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. LINT x|M. c *\<^sub>R f x = c *\<^sub>R integral\<^sup>L M f
[PROOF STEP]
by (rule integral_bounded_linear'[OF bounded_linear_scaleR_right bounded_linear_scaleR_right[of "1 / c"]]) simp


[STATEMENT]
lemma sorted_scaled_inl: "ccw.sortedP 0 (map ((*\<^sub>R) 2) (ccw.selsort 0 (inl (snd X))))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ccw.sortedP 0 (map ((*\<^sub>R) 2) (ccw.selsort 0 (inl (snd X))))
[PROOF STEP]
using sorted_inl
[PROOF STATE]
proof (prove)
using this:
ccw.sortedP 0 (ccw.selsort 0 (inl (snd ?X)))

goal (1 subgoal):
 1. ccw.sortedP 0 (map ((*\<^sub>R) 2) (ccw.selsort 0 (inl (snd X))))
[PROOF STEP]
by (rule ccw_sorted_scaleR) simp


[STATEMENT]
lemma open_map_compose:
     "\<lbrakk>open_map X X' f; open_map X' X'' g\<rbrakk> \<Longrightarrow> open_map X X'' (g \<circ> f)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>open_map X X' f; open_map X' X'' g\<rbrakk> \<Longrightarrow> open_map X X'' (g \<circ> f)
[PROOF STEP]
by (metis (no_types, lifting) image_comp open_map_def)


[STATEMENT]
lemma sigma_eqI:
  assumes [simp]: "M \<subseteq> Pow \<Omega>" "N \<subseteq> Pow \<Omega>" "sigma_sets \<Omega> M = sigma_sets \<Omega> N"
  shows "sigma \<Omega> M = sigma \<Omega> N"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. sigma \<Omega> M = sigma \<Omega> N
[PROOF STEP]
by (rule measure_eqI) (simp_all add: emeasure_sigma)


[STATEMENT]
lemma twos_complement: "- x = word_succ (not x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. - x = word_succ (not x)
[PROOF STEP]
using arg_cong[OF word_add_not[where x=x], where f="\<lambda>a. a - x + 1"]
[PROOF STATE]
proof (prove)
using this:
x + not x - x + 1 = - 1 - x + 1

goal (1 subgoal):
 1. - x = word_succ (not x)
[PROOF STEP]
by (simp add: word_succ_p1 word_sp_01[unfolded word_succ_p1] del: word_add_not)


[STATEMENT]
lemma conj_mono: "c\<^sub>0 \<sqsubseteq> d\<^sub>0 \<Longrightarrow> c\<^sub>1 \<sqsubseteq> d\<^sub>1 \<Longrightarrow> c\<^sub>0 \<iinter> c\<^sub>1 \<sqsubseteq> d\<^sub>0 \<iinter> d\<^sub>1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>c\<^sub>0 \<sqsubseteq> d\<^sub>0; c\<^sub>1 \<sqsubseteq> d\<^sub>1\<rbrakk> \<Longrightarrow> c\<^sub>0 \<iinter> c\<^sub>1 \<sqsubseteq> d\<^sub>0 \<iinter> d\<^sub>1
variables:
(\<iinter>) :: 'a \<Rightarrow> 'a \<Rightarrow> 'a
c\<^sub>0, c\<^sub>1, d\<^sub>0, d\<^sub>1 :: 'a
type variables:
'a :: refinement_lattice
[PROOF STEP]
by (metis inf.absorb_iff1 inf_conj_product inf_right_idem)


[STATEMENT]
lemma free_tv_ML_scheme:
  fixes sch :: type_scheme
  shows "(n : free_tv sch) = (n: set (free_tv_ML sch))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (n \<in> free_tv sch) = (n \<in> set (free_tv_ML sch))
[PROOF STEP]
by (induct sch) simp_all


[STATEMENT]
theorem not_g_secure_implies_secure:
 "\<not> (g_secure (c_process g_step g_out g_s\<^sub>0) (c_dom g_D) \<longrightarrow>
  secure (c_process g_step g_out g_s\<^sub>0) g_I (c_dom g_D))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> (g_secure (c_process g_step g_out g_s\<^sub>0) (c_dom g_D) \<longrightarrow> secure (c_process g_step g_out g_s\<^sub>0) g_I (c_dom g_D))
[PROOF STEP]
proof (simp, rule conjI, rule g_secure_counterexample)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> secure (c_process g_step g_out g_s\<^sub>0) g_I (c_dom g_D)
[PROOF STEP]
qed (rule notI, drule secure_implies_c_secure, erule contrapos_pp,
 rule not_c_secure_counterexample)


[STATEMENT]
lemma path_connected_UNIV [iff]: "path_connected (UNIV :: 'a::real_normed_vector set)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. path_connected UNIV
[PROOF STEP]
by (simp add: convex_imp_path_connected)


[STATEMENT]
lemma Group_Img:"\<lbrakk>Group F; Group G; f \<in> gHom F G \<rbrakk> \<Longrightarrow> Group (Img\<^bsub>F,G\<^esub> f)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Group F; Group G; f \<in> gHom F G\<rbrakk> \<Longrightarrow> Group (Img\<^bsub>F,G\<^esub> f)
[PROOF STEP]
apply (frule sg_gimg [of "F" "G" "f"], assumption+,
       simp add:Gimage_def Group.Group_Gp[of "G"])
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma num_syms_ge_num_unique_vars:
  "num_syms t \<ge> num_unique_vars t"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. num_unique_vars t \<le> num_syms t
[PROOF STEP]
by (metis le_trans num_syms_geq_num_vars num_vars_geq_num_unique_vars)


[STATEMENT]
lemma closed_open_segment_iff [simp]:
    fixes a :: "'a::euclidean_space"  shows "closed(open_segment a b) \<longleftrightarrow> a = b"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. closed (open_segment a b) = (a = b)
[PROOF STEP]
by (metis open_segment_def DiffE closure_eq closure_open_segment ends_in_segment(1) insert_iff segment_image_interval(2))


[STATEMENT]
lemma poly_pcompose: "poly (pcompose p q) x = poly p (poly q x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. poly (p \<circ>\<^sub>p q) x = poly p (poly q x)
[PROOF STEP]
by (induct p) (simp_all add: pcompose_pCons)


[STATEMENT]
lemma AllowedActs_Join [simp]:
     "AllowedActs (F\<squnion>G) = AllowedActs F \<inter> AllowedActs G"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. AllowedActs (F \<squnion> G) = AllowedActs F \<inter> AllowedActs G
[PROOF STEP]
by (auto simp add: Join_def)


[STATEMENT]
lemma ldeep_s_last1_if_distinct: "distinct xs \<Longrightarrow> ldeep_s sel xs (last xs) = 1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. distinct xs \<Longrightarrow> ldeep_s sel xs (last xs) = 1
[PROOF STEP]
by (induction xs) auto


[STATEMENT]
lemma card_sym_mod_range: "y > 0 \<Longrightarrow> card {- ((y - 1) div 2) .. y div 2} = y"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 < y \<Longrightarrow> card {- int ((y - 1) div 2)..int (y div 2)} = y
[PROOF STEP]
by simp


[STATEMENT]
lemma separate:
  assumes "(a,b)=chophelper (to_list v p) []"
  shows "insertion f p = sum_list [insertion f term * (f v) ^ i. (term,i)\<leftarrow>a] + sum_list [insertion f term * (f v) ^ i. (term,i)\<leftarrow>b]"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. insertion f p = (\<Sum>(term, i)\<leftarrow>a. insertion f term * f v ^ i) + (\<Sum>(term, i)\<leftarrow>b. insertion f term * f v ^ i)
[PROOF STEP]
using to_list_insertion[of f p v]  preserve[OF assms, symmetric]
[PROOF STATE]
proof (prove)
using this:
insertion f p = (\<Sum>(term, i)\<leftarrow>to_list v p. insertion f term * f v ^ i)
[] @ to_list v p = a @ b

goal (1 subgoal):
 1. insertion f p = (\<Sum>(term, i)\<leftarrow>a. insertion f term * f v ^ i) + (\<Sum>(term, i)\<leftarrow>b. insertion f term * f v ^ i)
[PROOF STEP]
unfolding List.append.left_neutral
[PROOF STATE]
proof (prove)
using this:
insertion f p = (\<Sum>(term, i)\<leftarrow>to_list v p. insertion f term * f v ^ i)
to_list v p = a @ b

goal (1 subgoal):
 1. insertion f p = (\<Sum>(term, i)\<leftarrow>a. insertion f term * f v ^ i) + (\<Sum>(term, i)\<leftarrow>b. insertion f term * f v ^ i)
[PROOF STEP]
by (simp del: to_list.simps)


[STATEMENT]
theorem rqs'_cost_expectation_le:
  assumes "linorder_on A R" "set xs \<subseteq> A"
  shows   "measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
linorder_on A R
set xs \<subseteq> A

goal (1 subgoal):
 1. measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
[PROOF STEP]
proof (induction R xs rule: rqs'_cost.induct)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>R xs. \<lbrakk>\<And>x xa. \<lbrakk>xs \<noteq> []; x \<in> set_pmf (pmf_of_set {..<length xs}); xa = xs ! x; linorder_on A R; set (lesss R xa xs) \<subseteq> A\<rbrakk> \<Longrightarrow> measure_pmf.expectation (rqs'_cost R (lesss R xa xs)) real \<le> rqs_cost_exp (length (lesss R xa xs)); \<And>x xa. \<lbrakk>xs \<noteq> []; x \<in> set_pmf (pmf_of_set {..<length xs}); xa = xs ! x; linorder_on A R; set (greaters R xa xs) \<subseteq> A\<rbrakk> \<Longrightarrow> measure_pmf.expectation (rqs'_cost R (greaters R xa xs)) real \<le> rqs_cost_exp (length (greaters R xa xs)); linorder_on A R; set xs \<subseteq> A\<rbrakk> \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
[PROOF STEP]
case (1 R xs)
[PROOF STATE]
proof (state)
this:
\<lbrakk>xs \<noteq> []; ?x \<in> set_pmf (pmf_of_set {..<length xs}); ?xa = xs ! ?x; linorder_on A R; set (lesss R ?xa xs) \<subseteq> A\<rbrakk> \<Longrightarrow> measure_pmf.expectation (rqs'_cost R (lesss R ?xa xs)) real \<le> rqs_cost_exp (length (lesss R ?xa xs))
\<lbrakk>xs \<noteq> []; ?x \<in> set_pmf (pmf_of_set {..<length xs}); ?xa = xs ! ?x; linorder_on A R; set (greaters R ?xa xs) \<subseteq> A\<rbrakk> \<Longrightarrow> measure_pmf.expectation (rqs'_cost R (greaters R ?xa xs)) real \<le> rqs_cost_exp (length (greaters R ?xa xs))
linorder_on A R
set xs \<subseteq> A

goal (1 subgoal):
 1. \<And>R xs. \<lbrakk>\<And>x xa. \<lbrakk>xs \<noteq> []; x \<in> set_pmf (pmf_of_set {..<length xs}); xa = xs ! x; linorder_on A R; set (lesss R xa xs) \<subseteq> A\<rbrakk> \<Longrightarrow> measure_pmf.expectation (rqs'_cost R (lesss R xa xs)) real \<le> rqs_cost_exp (length (lesss R xa xs)); \<And>x xa. \<lbrakk>xs \<noteq> []; x \<in> set_pmf (pmf_of_set {..<length xs}); xa = xs ! x; linorder_on A R; set (greaters R xa xs) \<subseteq> A\<rbrakk> \<Longrightarrow> measure_pmf.expectation (rqs'_cost R (greaters R xa xs)) real \<le> rqs_cost_exp (length (greaters R xa xs)); linorder_on A R; set xs \<subseteq> A\<rbrakk> \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
[PROOF STEP]
proof (cases "xs = []")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. xs = [] \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
 2. xs \<noteq> [] \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
xs \<noteq> []

goal (2 subgoals):
 1. xs = [] \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
 2. xs \<noteq> [] \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
[PROOF STEP]
define n where "n = length xs - 1"
[PROOF STATE]
proof (state)
this:
n = length xs - 1

goal (2 subgoals):
 1. xs = [] \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
 2. xs \<noteq> [] \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
[PROOF STEP]
have length_eq: "length xs = Suc n"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. length xs = Suc n
[PROOF STEP]
using False
[PROOF STATE]
proof (prove)
using this:
xs \<noteq> []

goal (1 subgoal):
 1. length xs = Suc n
[PROOF STEP]
by (simp add: n_def)
[PROOF STATE]
proof (state)
this:
length xs = Suc n

goal (2 subgoals):
 1. xs = [] \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
 2. xs \<noteq> [] \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
[PROOF STEP]
define E where "E = (\<lambda>xs. measure_pmf.expectation (rqs'_cost R xs) real)"
[PROOF STATE]
proof (state)
this:
E = (\<lambda>xs. measure_pmf.expectation (rqs'_cost R xs) real)

goal (2 subgoals):
 1. xs = [] \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
 2. xs \<noteq> [] \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
[PROOF STEP]
define f where "f = (\<lambda>x. rqs_cost_exp (length (lesss R x xs)) +
                                rqs_cost_exp (length (greaters R x xs)))"
[PROOF STATE]
proof (state)
this:
f = (\<lambda>x. rqs_cost_exp (length (lesss R x xs)) + rqs_cost_exp (length (greaters R x xs)))

goal (2 subgoals):
 1. xs = [] \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
 2. xs \<noteq> [] \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
[PROOF STEP]
have "rqs'_cost R xs =
            do {
              i \<leftarrow> pmf_of_set {..<length xs};
              map_pmf (\<lambda>(n1, y). length xs - Suc 0 + n1 + y)
                (pair_pmf (rqs'_cost R (lesss R (xs ! i) xs))
                          (rqs'_cost R (greaters R (xs ! i) xs)))
            }"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. rqs'_cost R xs = pmf_of_set {..<length xs} \<bind> (\<lambda>i. map_pmf (\<lambda>(n1, y). length xs - Suc 0 + n1 + y) (pair_pmf (rqs'_cost R (lesss R (xs ! i) xs)) (rqs'_cost R (greaters R (xs ! i) xs))))
[PROOF STEP]
using False
[PROOF STATE]
proof (prove)
using this:
xs \<noteq> []

goal (1 subgoal):
 1. rqs'_cost R xs = pmf_of_set {..<length xs} \<bind> (\<lambda>i. map_pmf (\<lambda>(n1, y). length xs - Suc 0 + n1 + y) (pair_pmf (rqs'_cost R (lesss R (xs ! i) xs)) (rqs'_cost R (greaters R (xs ! i) xs))))
[PROOF STEP]
by (subst rqs'_cost.simps) (simp_all add: Let_def)
[PROOF STATE]
proof (state)
this:
rqs'_cost R xs = pmf_of_set {..<length xs} \<bind> (\<lambda>i. map_pmf (\<lambda>(n1, y). length xs - Suc 0 + n1 + y) (pair_pmf (rqs'_cost R (lesss R (xs ! i) xs)) (rqs'_cost R (greaters R (xs ! i) xs))))

goal (2 subgoals):
 1. xs = [] \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
 2. xs \<noteq> [] \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
rqs'_cost R xs = pmf_of_set {..<length xs} \<bind> (\<lambda>i. map_pmf (\<lambda>(n1, y). length xs - Suc 0 + n1 + y) (pair_pmf (rqs'_cost R (lesss R (xs ! i) xs)) (rqs'_cost R (greaters R (xs ! i) xs))))

goal (2 subgoals):
 1. xs = [] \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
 2. xs \<noteq> [] \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
[PROOF STEP]
have "measure_pmf.expectation \<dots> real = real n +
           (\<Sum>k<length xs. E (lesss R (xs ! k) xs) + E (greaters R (xs ! k) xs)) / real (length xs)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. measure_pmf.expectation (pmf_of_set {..<length xs} \<bind> (\<lambda>i. map_pmf (\<lambda>(n1, y). length xs - Suc 0 + n1 + y) (pair_pmf (rqs'_cost R (lesss R (xs ! i) xs)) (rqs'_cost R (greaters R (xs ! i) xs))))) real = real n + (\<Sum>k<length xs. E (lesss R (xs ! k) xs) + E (greaters R (xs ! k) xs)) / real (length xs)
[PROOF STEP]
using False
[PROOF STATE]
proof (prove)
using this:
xs \<noteq> []

goal (1 subgoal):
 1. measure_pmf.expectation (pmf_of_set {..<length xs} \<bind> (\<lambda>i. map_pmf (\<lambda>(n1, y). length xs - Suc 0 + n1 + y) (pair_pmf (rqs'_cost R (lesss R (xs ! i) xs)) (rqs'_cost R (greaters R (xs ! i) xs))))) real = real n + (\<Sum>k<length xs. E (lesss R (xs ! k) xs) + E (greaters R (xs ! k) xs)) / real (length xs)
[PROOF STEP]
by (subst pmf_expectation_bind_pmf_of_set)
         (auto intro!: finite_imageI finite_cartesian_product simp: case_prod_unfold
            integrable_measure_pmf_finite sum_divide_distrib [symmetric] field_simps
            length_eq sum.distrib E_def)
[PROOF STATE]
proof (state)
this:
measure_pmf.expectation (pmf_of_set {..<length xs} \<bind> (\<lambda>i. map_pmf (\<lambda>(n1, y). length xs - Suc 0 + n1 + y) (pair_pmf (rqs'_cost R (lesss R (xs ! i) xs)) (rqs'_cost R (greaters R (xs ! i) xs))))) real = real n + (\<Sum>k<length xs. E (lesss R (xs ! k) xs) + E (greaters R (xs ! k) xs)) / real (length xs)

goal (2 subgoals):
 1. xs = [] \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
 2. xs \<noteq> [] \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
measure_pmf.expectation (pmf_of_set {..<length xs} \<bind> (\<lambda>i. map_pmf (\<lambda>(n1, y). length xs - Suc 0 + n1 + y) (pair_pmf (rqs'_cost R (lesss R (xs ! i) xs)) (rqs'_cost R (greaters R (xs ! i) xs))))) real = real n + (\<Sum>k<length xs. E (lesss R (xs ! k) xs) + E (greaters R (xs ! k) xs)) / real (length xs)

goal (2 subgoals):
 1. xs = [] \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
 2. xs \<noteq> [] \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
[PROOF STEP]
have "\<dots> \<le> real n + (\<Sum>k<length xs. f (xs ! k)) / real (length xs)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. real n + (\<Sum>k<length xs. E (lesss R (xs ! k) xs) + E (greaters R (xs ! k) xs)) / real (length xs) \<le> real n + (\<Sum>k<length xs. f (xs ! k)) / real (length xs)
[PROOF STEP]
unfolding E_def f_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. real n + (\<Sum>k<length xs. measure_pmf.expectation (rqs'_cost R (lesss R (xs ! k) xs)) real + measure_pmf.expectation (rqs'_cost R (greaters R (xs ! k) xs)) real) / real (length xs) \<le> real n + (\<Sum>k<length xs. rqs_cost_exp (length (lesss R (xs ! k) xs)) + rqs_cost_exp (length (greaters R (xs ! k) xs))) / real (length xs)
[PROOF STEP]
using False "1.prems"
[PROOF STATE]
proof (prove)
using this:
xs \<noteq> []
linorder_on A R
set xs \<subseteq> A

goal (1 subgoal):
 1. real n + (\<Sum>k<length xs. measure_pmf.expectation (rqs'_cost R (lesss R (xs ! k) xs)) real + measure_pmf.expectation (rqs'_cost R (greaters R (xs ! k) xs)) real) / real (length xs) \<le> real n + (\<Sum>k<length xs. rqs_cost_exp (length (lesss R (xs ! k) xs)) + rqs_cost_exp (length (greaters R (xs ! k) xs))) / real (length xs)
[PROOF STEP]
by (intro add_mono order.refl divide_right_mono sum_mono "1.IH"[OF _ _ refl] False)
         (auto simp: lesss_def greaters_def)
[PROOF STATE]
proof (state)
this:
real n + (\<Sum>k<length xs. E (lesss R (xs ! k) xs) + E (greaters R (xs ! k) xs)) / real (length xs) \<le> real n + (\<Sum>k<length xs. f (xs ! k)) / real (length xs)

goal (2 subgoals):
 1. xs = [] \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
 2. xs \<noteq> [] \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
real n + (\<Sum>k<length xs. E (lesss R (xs ! k) xs) + E (greaters R (xs ! k) xs)) / real (length xs) \<le> real n + (\<Sum>k<length xs. f (xs ! k)) / real (length xs)

goal (2 subgoals):
 1. xs = [] \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
 2. xs \<noteq> [] \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
[PROOF STEP]
have "(\<Sum>k<length xs. f (xs ! k)) = (\<Sum>x\<in>#mset xs. f x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Sum>k<length xs. f (xs ! k)) = \<Sum>\<^sub># (image_mset f (mset xs))
[PROOF STEP]
by (simp only: mset_map [symmetric] sum_mset_sum_list sum_list_sum_nth)
         (simp_all add: atLeast0LessThan)
[PROOF STATE]
proof (state)
this:
(\<Sum>k<length xs. f (xs ! k)) = \<Sum>\<^sub># (image_mset f (mset xs))

goal (2 subgoals):
 1. xs = [] \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
 2. xs \<noteq> [] \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(\<Sum>k<length xs. f (xs ! k)) = \<Sum>\<^sub># (image_mset f (mset xs))

goal (2 subgoals):
 1. xs = [] \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
 2. xs \<noteq> [] \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
[PROOF STEP]
have "mset xs = mset (insort_wrt R xs)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mset xs = mset (insort_wrt R xs)
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
mset xs = mset (insort_wrt R xs)

goal (2 subgoals):
 1. xs = [] \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
 2. xs \<noteq> [] \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
mset xs = mset (insort_wrt R xs)

goal (2 subgoals):
 1. xs = [] \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
 2. xs \<noteq> [] \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
[PROOF STEP]
have "(\<Sum>x\<in>#\<dots>. f x) = (\<Sum>i<length xs. f (insort_wrt R xs ! i))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<Sum>\<^sub># (image_mset f (mset (insort_wrt R xs))) = (\<Sum>i<length xs. f (insort_wrt R xs ! i))
[PROOF STEP]
by (simp only: mset_map [symmetric] sum_mset_sum_list sum_list_sum_nth)
         (simp_all add: atLeast0LessThan)
[PROOF STATE]
proof (state)
this:
\<Sum>\<^sub># (image_mset f (mset (insort_wrt R xs))) = (\<Sum>i<length xs. f (insort_wrt R xs ! i))

goal (2 subgoals):
 1. xs = [] \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
 2. xs \<noteq> [] \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
\<Sum>\<^sub># (image_mset f (mset (insort_wrt R xs))) = (\<Sum>i<length xs. f (insort_wrt R xs ! i))

goal (2 subgoals):
 1. xs = [] \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
 2. xs \<noteq> [] \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
[PROOF STEP]
have "\<dots> \<le> (\<Sum>i<length xs. rqs_cost_exp i + rqs_cost_exp (length xs - i - 1))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Sum>i<length xs. f (insort_wrt R xs ! i)) \<le> (\<Sum>i<length xs. rqs_cost_exp i + rqs_cost_exp (length xs - i - 1))
[PROOF STEP]
unfolding f_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Sum>i<length xs. rqs_cost_exp (length (lesss R (insort_wrt R xs ! i) xs)) + rqs_cost_exp (length (greaters R (insort_wrt R xs ! i) xs))) \<le> (\<Sum>i<length xs. rqs_cost_exp i + rqs_cost_exp (length xs - i - 1))
[PROOF STEP]
proof (intro sum_mono add_mono rqs_cost_exp_leI)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>i. i \<in> {..<length xs} \<Longrightarrow> length (lesss R (insort_wrt R xs ! i) xs) \<le> i
 2. \<And>i. i \<in> {..<length xs} \<Longrightarrow> length (greaters R (insort_wrt R xs ! i) xs) \<le> length xs - i - 1
[PROOF STEP]
fix i
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>i. i \<in> {..<length xs} \<Longrightarrow> length (lesss R (insort_wrt R xs ! i) xs) \<le> i
 2. \<And>i. i \<in> {..<length xs} \<Longrightarrow> length (greaters R (insort_wrt R xs ! i) xs) \<le> length xs - i - 1
[PROOF STEP]
assume i: "i \<in> {..<length xs}"
[PROOF STATE]
proof (state)
this:
i \<in> {..<length xs}

goal (2 subgoals):
 1. \<And>i. i \<in> {..<length xs} \<Longrightarrow> length (lesss R (insort_wrt R xs ! i) xs) \<le> i
 2. \<And>i. i \<in> {..<length xs} \<Longrightarrow> length (greaters R (insort_wrt R xs ! i) xs) \<le> length xs - i - 1
[PROOF STEP]
show "length (lesss R (insort_wrt R xs ! i) xs) \<le> i"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. length (lesss R (insort_wrt R xs ! i) xs) \<le> i
[PROOF STEP]
using i "1.prems"
[PROOF STATE]
proof (prove)
using this:
i \<in> {..<length xs}
linorder_on A R
set xs \<subseteq> A

goal (1 subgoal):
 1. length (lesss R (insort_wrt R xs ! i) xs) \<le> i
[PROOF STEP]
by (intro length_lesss_le'[where A = A]) auto
[PROOF STATE]
proof (state)
this:
length (lesss R (insort_wrt R xs ! i) xs) \<le> i

goal (1 subgoal):
 1. \<And>i. i \<in> {..<length xs} \<Longrightarrow> length (greaters R (insort_wrt R xs ! i) xs) \<le> length xs - i - 1
[PROOF STEP]
show "length (greaters R (insort_wrt R xs ! i) xs) \<le> length xs - i - 1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. length (greaters R (insort_wrt R xs ! i) xs) \<le> length xs - i - 1
[PROOF STEP]
using i "1.prems"
[PROOF STATE]
proof (prove)
using this:
i \<in> {..<length xs}
linorder_on A R
set xs \<subseteq> A

goal (1 subgoal):
 1. length (greaters R (insort_wrt R xs ! i) xs) \<le> length xs - i - 1
[PROOF STEP]
by (intro length_greaters_le'[where A = A]) auto
[PROOF STATE]
proof (state)
this:
length (greaters R (insort_wrt R xs ! i) xs) \<le> length xs - i - 1

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
(\<Sum>i<length xs. f (insort_wrt R xs ! i)) \<le> (\<Sum>i<length xs. rqs_cost_exp i + rqs_cost_exp (length xs - i - 1))

goal (2 subgoals):
 1. xs = [] \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
 2. xs \<noteq> [] \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(\<Sum>i<length xs. f (insort_wrt R xs ! i)) \<le> (\<Sum>i<length xs. rqs_cost_exp i + rqs_cost_exp (length xs - i - 1))

goal (2 subgoals):
 1. xs = [] \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
 2. xs \<noteq> [] \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
[PROOF STEP]
have "\<dots> = (\<Sum>i\<le>n. rqs_cost_exp i + rqs_cost_exp (n - i))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Sum>i<length xs. rqs_cost_exp i + rqs_cost_exp (length xs - i - 1)) = (\<Sum>i\<le>n. rqs_cost_exp i + rqs_cost_exp (n - i))
[PROOF STEP]
by (intro sum.cong) (auto simp: length_eq)
[PROOF STATE]
proof (state)
this:
(\<Sum>i<length xs. rqs_cost_exp i + rqs_cost_exp (length xs - i - 1)) = (\<Sum>i\<le>n. rqs_cost_exp i + rqs_cost_exp (n - i))

goal (2 subgoals):
 1. xs = [] \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
 2. xs \<noteq> [] \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(\<Sum>i<length xs. rqs_cost_exp i + rqs_cost_exp (length xs - i - 1)) = (\<Sum>i\<le>n. rqs_cost_exp i + rqs_cost_exp (n - i))

goal (2 subgoals):
 1. xs = [] \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
 2. xs \<noteq> [] \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
[PROOF STEP]
have "real n + \<dots> / real (length xs) = rqs_cost_exp (length xs)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. real n + (\<Sum>i\<le>n. rqs_cost_exp i + rqs_cost_exp (n - i)) / real (length xs) = rqs_cost_exp (length xs)
[PROOF STEP]
by (simp add: length_eq rqs_cost_exp.simps(2))
[PROOF STATE]
proof (state)
this:
real n + (\<Sum>i\<le>n. rqs_cost_exp i + rqs_cost_exp (n - i)) / real (length xs) = rqs_cost_exp (length xs)

goal (2 subgoals):
 1. xs = [] \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
 2. xs \<noteq> [] \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
(\<And>x y. x \<le> y \<Longrightarrow> real n + x / real (length xs) \<le> real n + y / real (length xs)) \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
(\<And>x y. x \<le> y \<Longrightarrow> real n + x / real (length xs) \<le> real n + y / real (length xs)) \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)

goal (1 subgoal):
 1. measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
[PROOF STEP]
by (simp add: divide_right_mono)
[PROOF STATE]
proof (state)
this:
measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)

goal (1 subgoal):
 1. xs = [] \<Longrightarrow> measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)
[PROOF STEP]
qed (auto simp: rqs'_cost.simps)
[PROOF STATE]
proof (state)
this:
measure_pmf.expectation (rqs'_cost R xs) real \<le> rqs_cost_exp (length xs)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma vars_zero: "vars 0 = {}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vars 0 = {}
[PROOF STEP]
using zero_coeff_zero coeff_zero
[PROOF STATE]
proof (prove)
using this:
(?p = 0) = (\<forall>v. coeff ?p v = 0)
(coeff ?p ?x \<noteq> 0) = (?x \<in> vars ?p)

goal (1 subgoal):
 1. vars 0 = {}
[PROOF STEP]
by auto


[STATEMENT]
lemma compute_double_of_Float[code]:
  "double_of_Float f = double_of_man_exp (integer_of_int (mantissa f)) (integer_of_int (Float.exponent f))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. double_of_Float f = double_of_man_exp (integer_of_int (mantissa f)) (integer_of_int (Float.exponent f))
[PROOF STEP]
unfolding double_of_man_exp_def Let_def Float_mantissa_exponent int_of_integer_integer_of_int
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. double_of_Float f = (if is_finite_Float TYPE((11, 52) IEEE.float) f then Some (Double.of_finite_Float f) else None)
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. is_finite_Float TYPE((11, 52) IEEE.float) f \<Longrightarrow> double_of_Float f = Some (Double.of_finite_Float f)
 2. \<not> is_finite_Float TYPE((11, 52) IEEE.float) f \<Longrightarrow> double_of_Float f = None
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. is_finite_Float TYPE((11, 52) IEEE.float) f \<Longrightarrow> double_of_Float f = Some (Double.of_finite_Float f)
[PROOF STEP]
by transfer auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> is_finite_Float TYPE((11, 52) IEEE.float) f \<Longrightarrow> double_of_Float f = None
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> is_finite_Float TYPE((11, 52) IEEE.float) f \<Longrightarrow> double_of_Float f = None
[PROOF STEP]
by transfer auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma Cons_in_lists_iff[simp]: "x#xs \<in> lists A \<longleftrightarrow> x \<in> A \<and> xs \<in> lists A"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (x # xs \<in> lists A) = (x \<in> A \<and> xs \<in> lists A)
[PROOF STEP]
by auto


[STATEMENT]
lemma eval_wlp_SetDC:
  "wlp (SetDC p S) R s = Inf ((\<lambda>a. wlp (p a) R s) ` S s)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. wlp (SetDC p S) R s = (INF a\<in>S s. wlp (p a) R s)
[PROOF STEP]
unfolding wlp_def SetDC_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (INF a\<in>S s. p a False R s) = (INF a\<in>S s. p a False R s)
[PROOF STEP]
by(simp)


[STATEMENT]
lemma im_jointfun1:"(jointfun n f m g) `({j. j \<le> (Suc (n + m))}) =
                                      f `{j. j \<le> n} \<union> g ` {j. j \<le> m}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. jointfun n f m g ` {j. j \<le> Suc (n + m)} = f ` {j. j \<le> n} \<union> g ` {j. j \<le> m}
[PROOF STEP]
apply (cut_tac Nset_nset[of "n" "m"])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {i. i \<le> Suc (n + m)} = {i. i \<le> n} \<union> nset (Suc n) (Suc (n + m)) \<Longrightarrow> jointfun n f m g ` {j. j \<le> Suc (n + m)} = f ` {j. j \<le> n} \<union> g ` {j. j \<le> m}
[PROOF STEP]
apply (subst  im_set_un2[of "{j. j \<le> (Suc (n + m))}" "{j. j \<le> n}"
              "nset (Suc n) (Suc (n + m))" "jointfun n f m g"], assumption)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {i. i \<le> Suc (n + m)} = {i. i \<le> n} \<union> nset (Suc n) (Suc (n + m)) \<Longrightarrow> jointfun n f m g ` {j. j \<le> n} \<union> jointfun n f m g ` nset (Suc n) (Suc (n + m)) = f ` {j. j \<le> n} \<union> g ` {j. j \<le> m}
[PROOF STEP]
apply (simp add:im_jointfunTr1 im_jointfunTr2)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
theorem If_BisT[simp]:
assumes "compatTst tst" and "c1 \<approx>T d1" and "c2 \<approx>T d2"
shows "If tst c1 c2 \<approx>T If tst d1 d2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. if tst then c1 else c2 \<approx>T if tst then d1 else d2
[PROOF STEP]
using assms thetaIfTT_BisT
[PROOF STATE]
proof (prove)
using this:
compatTst tst
c1 \<approx>T d1
c2 \<approx>T d2
thetaIfTT \<subseteq> BisT

goal (1 subgoal):
 1. if tst then c1 else c2 \<approx>T if tst then d1 else d2
[PROOF STEP]
unfolding thetaIfTT_def
[PROOF STATE]
proof (prove)
using this:
compatTst tst
c1 \<approx>T d1
c2 \<approx>T d2
{(if tst then c1 else c2, if tst then d1 else d2) |tst c1 c2 d1 d2. compatTst tst \<and> c1 \<approx>T d1 \<and> c2 \<approx>T d2} \<subseteq> BisT

goal (1 subgoal):
 1. if tst then c1 else c2 \<approx>T if tst then d1 else d2
[PROOF STEP]
by blast


[STATEMENT]
lemma oDeriv_oSuc [simp]:
"oDeriv F (oSuc x) = oFix F (oSuc (oDeriv F x))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. oDeriv F (oSuc x) = oFix F (oSuc (oDeriv F x))
[PROOF STEP]
by (simp add: oDeriv_def)


[STATEMENT]
lemma sound_and_compltete_mat_leqb_eqc [iff]:
  assumes "dim_row A\<^sup>T = dim_vec c"
  assumes "dim_col A\<^sup>T = dim_vec b"
  shows "(\<exists>x. [A *\<^sub>v x]\<le>b) \<and> (\<exists>y. [y \<^sub>v* A]=c) \<longleftrightarrow> (\<exists>X. simplex (mat_leqb_eqc A b c) = Sat X)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<exists>x. [A*\<^sub>vx]\<le>b) \<and> (\<exists>y. [y\<^sub>v*A]=c)) = (\<exists>X. simplex (mat_leqb_eqc A b c) = Inr X)
[PROOF STEP]
by (metis assms(1) assms(2) completeness_mat_leqb_eqc index_transpose_mat(3)
      soundness_mat_leqb_eqc1 soundness_mat_leqb_eqc2)


[STATEMENT]
lemma exists_set_with_max_card:
  assumes "finite S" "S \<noteq> {}"
  shows "\<exists>s \<in> S. card s = Max (card ` S)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>s\<in>S. card s = Max (card ` S)
[PROOF STEP]
by (metis (mono_tags, lifting) Max_in assms finite_imageI imageE image_is_empty)


[STATEMENT]
lemma max_Var_floatariths_Max:
  "max_Var_floatariths xs = (if set xs = {} then 0 else linorder_class.Max (max_Var_floatarith ` set xs))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. max_Var_floatariths xs = (if set xs = {} then 0 else Max (max_Var_floatarith ` set xs))
[PROOF STEP]
by (induct xs) auto


[STATEMENT]
lemma pos_sub_infty:
  assumes "E \<in> sets M"
    and "\<bar>\<mu> E\<bar> < \<infinity>"
  shows "\<bar>\<mu> (pos_sub E)\<bar> < \<infinity>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<bar>\<mu> (pos_sub E)\<bar> < \<infinity>
[PROOF STEP]
using signed_measure_finite_subset assms
    pos_sub_sets pos_sub_subset
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?E \<in> sets M; \<bar>\<mu> ?E\<bar> < \<infinity>; ?A \<in> sets M; ?A \<subseteq> ?E\<rbrakk> \<Longrightarrow> \<bar>\<mu> ?A\<bar> < \<infinity>
E \<in> sets M
\<bar>\<mu> E\<bar> < \<infinity>
?E \<in> sets M \<Longrightarrow> pos_sub ?E \<in> sets M
pos_sub ?E \<subseteq> ?E

goal (1 subgoal):
 1. \<bar>\<mu> (pos_sub E)\<bar> < \<infinity>
[PROOF STEP]
by simp


[STATEMENT]
theorem UP_cring:
  "cring P"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. cring P
[PROOF STEP]
using UP_ring
[PROOF STATE]
proof (prove)
using this:
ring P

goal (1 subgoal):
 1. cring P
[PROOF STEP]
unfolding cring_def
[PROOF STATE]
proof (prove)
using this:
ring P

goal (1 subgoal):
 1. ring P \<and> Group.comm_monoid P
[PROOF STEP]
by (auto intro!: comm_monoidI UP_m_assoc UP_m_comm)


[STATEMENT]
lemma min_enat_simps [simp]:
  "min (enat m) (enat n) = enat (min m n)"
  "min q 0 = 0"
  "min 0 q = 0"
  "min q (\<infinity>::enat) = q"
  "min (\<infinity>::enat) q = q"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (min (enat m) (enat n) = enat (min m n) &&& min q 0 = 0) &&& min 0 q = 0 &&& min q \<infinity> = q &&& min \<infinity> q = q
[PROOF STEP]
by (auto simp add: min_def)


[STATEMENT]
lemma "(3::real) * x + 7 * a < 4 \<and> 3 < 2 * x \<longrightarrow> a < 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 3 * x + 7 * a < 4 \<and> 3 < 2 * x \<longrightarrow> a < 0
[PROOF STEP]
by sos


[STATEMENT]
lemma (in topological_space) nhds_generated_topology:
  "open = generate_topology T \<Longrightarrow> nhds x = (INF S\<in>{S\<in>T. x \<in> S}. principal S)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. open = generate_topology T \<Longrightarrow> nhds x = Inf (principal ` {S \<in> T. x \<in> S})
[PROOF STEP]
unfolding nhds_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. open = generate_topology T \<Longrightarrow> Inf (principal ` {S. open S \<and> x \<in> S}) = Inf (principal ` {S \<in> T. x \<in> S})
[PROOF STEP]
proof (safe intro!: antisym INF_greatest)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>S. \<lbrakk>open = generate_topology T; S \<in> T; x \<in> S\<rbrakk> \<Longrightarrow> Inf (principal ` {S. generate_topology T S \<and> x \<in> S}) \<le> principal S
 2. \<And>i. \<lbrakk>open = generate_topology T; generate_topology T i; x \<in> i\<rbrakk> \<Longrightarrow> Inf (principal ` {S \<in> T. x \<in> S}) \<le> principal i
[PROOF STEP]
fix S
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>S. \<lbrakk>open = generate_topology T; S \<in> T; x \<in> S\<rbrakk> \<Longrightarrow> Inf (principal ` {S. generate_topology T S \<and> x \<in> S}) \<le> principal S
 2. \<And>i. \<lbrakk>open = generate_topology T; generate_topology T i; x \<in> i\<rbrakk> \<Longrightarrow> Inf (principal ` {S \<in> T. x \<in> S}) \<le> principal i
[PROOF STEP]
assume "generate_topology T S" "x \<in> S"
[PROOF STATE]
proof (state)
this:
generate_topology T S
x \<in> S

goal (2 subgoals):
 1. \<And>S. \<lbrakk>open = generate_topology T; S \<in> T; x \<in> S\<rbrakk> \<Longrightarrow> Inf (principal ` {S. generate_topology T S \<and> x \<in> S}) \<le> principal S
 2. \<And>i. \<lbrakk>open = generate_topology T; generate_topology T i; x \<in> i\<rbrakk> \<Longrightarrow> Inf (principal ` {S \<in> T. x \<in> S}) \<le> principal i
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
generate_topology T S
x \<in> S
[PROOF STEP]
show "(INF S\<in>{S \<in> T. x \<in> S}. principal S) \<le> principal S"
[PROOF STATE]
proof (prove)
using this:
generate_topology T S
x \<in> S

goal (1 subgoal):
 1. Inf (principal ` {S \<in> T. x \<in> S}) \<le> principal S
[PROOF STEP]
by induct
      (auto intro: INF_lower order_trans simp: inf_principal[symmetric] simp del: inf_principal)
[PROOF STATE]
proof (state)
this:
Inf (principal ` {S \<in> T. x \<in> S}) \<le> principal S

goal (1 subgoal):
 1. \<And>S. \<lbrakk>open = generate_topology T; S \<in> T; x \<in> S\<rbrakk> \<Longrightarrow> Inf (principal ` {S. generate_topology T S \<and> x \<in> S}) \<le> principal S
[PROOF STEP]
qed (auto intro!: INF_lower intro: generate_topology.intros)


[STATEMENT]
lemma mono_mult2_alt:
  assumes "ns \<subseteq> ns'" "s \<subseteq> s'" shows "mult2_alt b ns s \<subseteq> mult2_alt b ns' s'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mult2_alt b ns s \<subseteq> mult2_alt b ns' s'
[PROOF STEP]
unfolding mult2_alt_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {(X, Y). \<exists>X1 X2 Y1 Y2. X = X1 + X2 \<and> Y = Y1 + Y2 \<and> (X1, Y1) \<in> multpw ns \<and> (b \<or> Y2 \<noteq> {#}) \<and> (\<forall>x. x \<in># X2 \<longrightarrow> (\<exists>y. y \<in># Y2 \<and> (x, y) \<in> s))} \<subseteq> {(X, Y). \<exists>X1 X2 Y1 Y2. X = X1 + X2 \<and> Y = Y1 + Y2 \<and> (X1, Y1) \<in> multpw ns' \<and> (b \<or> Y2 \<noteq> {#}) \<and> (\<forall>x. x \<in># X2 \<longrightarrow> (\<exists>y. y \<in># Y2 \<and> (x, y) \<in> s'))}
[PROOF STEP]
using mono_multpw[OF assms(1)] assms
[PROOF STATE]
proof (prove)
using this:
multpw ns \<subseteq> multpw ns'
ns \<subseteq> ns'
s \<subseteq> s'

goal (1 subgoal):
 1. {(X, Y). \<exists>X1 X2 Y1 Y2. X = X1 + X2 \<and> Y = Y1 + Y2 \<and> (X1, Y1) \<in> multpw ns \<and> (b \<or> Y2 \<noteq> {#}) \<and> (\<forall>x. x \<in># X2 \<longrightarrow> (\<exists>y. y \<in># Y2 \<and> (x, y) \<in> s))} \<subseteq> {(X, Y). \<exists>X1 X2 Y1 Y2. X = X1 + X2 \<and> Y = Y1 + Y2 \<and> (X1, Y1) \<in> multpw ns' \<and> (b \<or> Y2 \<noteq> {#}) \<and> (\<forall>x. x \<in># X2 \<longrightarrow> (\<exists>y. y \<in># Y2 \<and> (x, y) \<in> s'))}
[PROOF STEP]
by (blast 19)


[STATEMENT]
lemma pair_completeD:
  assumes "pair_complete A r"
  shows "x \<in> A \<Longrightarrow> y \<in> A \<Longrightarrow> \<exists>s. extreme_bound A r {x,y} s"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>x \<in> A; y \<in> A\<rbrakk> \<Longrightarrow> Ex (extreme_bound A r {x, y})
[PROOF STEP]
by (intro completeD[OF assms[unfolded pair_complete_def]], auto)


[STATEMENT]
lemma UP_smult_assoc1:
      "[| a \<in> carrier R; b \<in> carrier R; p \<in> carrier P |] ==>
      (a \<otimes> b) \<odot>\<^bsub>P\<^esub> p = a \<odot>\<^bsub>P\<^esub> (b \<odot>\<^bsub>P\<^esub> p)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>a \<in> carrier R; b \<in> carrier R; p \<in> carrier P\<rbrakk> \<Longrightarrow> a \<otimes> b \<odot>\<^bsub>P\<^esub> p = a \<odot>\<^bsub>P\<^esub> (b \<odot>\<^bsub>P\<^esub> p)
[PROOF STEP]
by (rule up_eqI) (simp_all add: R.m_assoc)


[STATEMENT]
lemma geqmaxNone:
  assumes "invar_vebt (Node (Some (mi, ma)) deg treeList summary) n ""x \<ge> ma "
  shows "vebt_succ  (Node (Some (mi, ma)) deg treeList summary) x = None "
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vebt_succ (Node (Some (mi, ma)) deg treeList summary) x = None
[PROOF STEP]
proof(rule ccontr)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. vebt_succ (Node (Some (mi, ma)) deg treeList summary) x \<noteq> None \<Longrightarrow> False
[PROOF STEP]
assume "vebt_succ (Node (Some (mi, ma)) deg treeList summary) x \<noteq> None"
[PROOF STATE]
proof (state)
this:
vebt_succ (Node (Some (mi, ma)) deg treeList summary) x \<noteq> None

goal (1 subgoal):
 1. vebt_succ (Node (Some (mi, ma)) deg treeList summary) x \<noteq> None \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
vebt_succ (Node (Some (mi, ma)) deg treeList summary) x \<noteq> None
[PROOF STEP]
obtain y where "vebt_succ (Node (Some (mi, ma)) deg treeList summary) x =  Some y"
[PROOF STATE]
proof (prove)
using this:
vebt_succ (Node (Some (mi, ma)) deg treeList summary) x \<noteq> None

goal (1 subgoal):
 1. (\<And>y. vebt_succ (Node (Some (mi, ma)) deg treeList summary) x = Some y \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
vebt_succ (Node (Some (mi, ma)) deg treeList summary) x = Some y

goal (1 subgoal):
 1. vebt_succ (Node (Some (mi, ma)) deg treeList summary) x \<noteq> None \<Longrightarrow> False
[PROOF STEP]
hence  "y > ma \<and> y \<in> set_vebt' ((Node (Some (mi, ma)) deg treeList summary))"
[PROOF STATE]
proof (prove)
using this:
vebt_succ (Node (Some (mi, ma)) deg treeList summary) x = Some y

goal (1 subgoal):
 1. ma < y \<and> y \<in> set_vebt' (Node (Some (mi, ma)) deg treeList summary)
[PROOF STEP]
by (smt (verit, ccfv_SIG) assms(1) assms(2) dual_order.strict_trans2 member_inv min_in_set_def vebt_mint.simps(3) mint_corr not_less_iff_gr_or_eq succ_corr succ_member)
[PROOF STATE]
proof (state)
this:
ma < y \<and> y \<in> set_vebt' (Node (Some (mi, ma)) deg treeList summary)

goal (1 subgoal):
 1. vebt_succ (Node (Some (mi, ma)) deg treeList summary) x \<noteq> None \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
ma < y \<and> y \<in> set_vebt' (Node (Some (mi, ma)) deg treeList summary)
[PROOF STEP]
show False
[PROOF STATE]
proof (prove)
using this:
ma < y \<and> y \<in> set_vebt' (Node (Some (mi, ma)) deg treeList summary)

goal (1 subgoal):
 1. False
[PROOF STEP]
by (metis assms(1) leD vebt_maxt.simps(3) maxt_corr_help mem_Collect_eq set_vebt'_def)
[PROOF STATE]
proof (state)
this:
False

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma in_q63_code: "x mod 63 \<in> q63 \<longleftrightarrow> IArray.sub q63_array (x mod 63)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (x mod 63 \<in> q63) = q63_array !! (x mod 63)
[PROOF STEP]
by (subst sub_q63_array) auto


[STATEMENT]
lemma some_gcd_ff_list_divides: "x \<in> set xs \<Longrightarrow> divides_ff (some_gcd_ff_list xs) x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x \<in> set xs \<Longrightarrow> divides_ff (some_gcd_ff_list xs) x
[PROOF STEP]
using some_gcd_ff_list[of xs]
[PROOF STATE]
proof (prove)
using this:
gcd_ff_list xs (some_gcd_ff_list xs)

goal (1 subgoal):
 1. x \<in> set xs \<Longrightarrow> divides_ff (some_gcd_ff_list xs) x
[PROOF STEP]
unfolding gcd_ff_list_def
[PROOF STATE]
proof (prove)
using this:
Ball (set xs) (divides_ff (some_gcd_ff_list xs)) \<and> (\<forall>d. Ball (set xs) (divides_ff d) \<longrightarrow> divides_ff d (some_gcd_ff_list xs))

goal (1 subgoal):
 1. x \<in> set xs \<Longrightarrow> divides_ff (some_gcd_ff_list xs) x
[PROOF STEP]
by auto


[STATEMENT]
lemma inf_qbs_Mx[simp]: "qbs_Mx (inf_quasi_borel X X') = qbs_Mx X \<inter> qbs_Mx X'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. qbs_Mx (inf_quasi_borel X X') = qbs_Mx X \<inter> qbs_Mx X'
[PROOF STEP]
by(simp add: qbs_Mx_def inf_quasi_borel_correct)


[STATEMENT]
lemma lm043:
  "omega pair = {(fst pair, {y})| y. y \<in>  snd pair}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. omega pair = {(fst pair, {y}) |y. y \<in> snd pair}
[PROOF STEP]
using lm042 setOfPairs
[PROOF STATE]
proof (prove)
using this:
omega ?pair = {fst ?pair} \<times> {{y} |y. y \<in> snd ?pair}
{(fst ?pair, {y}) |y. y \<in> snd ?pair} = {fst ?pair} \<times> {{y} |y. y \<in> snd ?pair}

goal (1 subgoal):
 1. omega pair = {(fst pair, {y}) |y. y \<in> snd pair}
[PROOF STEP]
by metis


[STATEMENT]
lemma inc_matrix_point_not_in_block_iff:  "i < length Vs \<Longrightarrow> j < length Bs \<Longrightarrow>
    (inc_mat_of Vs Bs) $$ (i, j) = 0 \<longleftrightarrow> Vs ! i \<notin> Bs ! j"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>i < length Vs; j < length Bs\<rbrakk> \<Longrightarrow> (inc_mat_of Vs Bs $$ (i, j) = (0::'b)) = (Vs ! i \<notin> Bs ! j)
[PROOF STEP]
using inc_matrix_point_not_in_block inc_matrix_point_not_in_block_zero
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?i < length ?Vs; ?j < length ?Bs; inc_mat_of ?Vs ?Bs $$ (?i, ?j) = (0::?'b)\<rbrakk> \<Longrightarrow> ?Vs ! ?i \<notin> ?Bs ! ?j
\<lbrakk>?i < length ?Vs; ?j < length ?Bs; ?Vs ! ?i \<notin> ?Bs ! ?j\<rbrakk> \<Longrightarrow> inc_mat_of ?Vs ?Bs $$ (?i, ?j) = (0::?'b)

goal (1 subgoal):
 1. \<lbrakk>i < length Vs; j < length Bs\<rbrakk> \<Longrightarrow> (inc_mat_of Vs Bs $$ (i, j) = (0::'b)) = (Vs ! i \<notin> Bs ! j)
[PROOF STEP]
by blast


[STATEMENT]
lemma pair_measure_closed: "{a \<times> b | a b. a \<in> sets A \<and> b \<in> sets B} \<subseteq> Pow (space A \<times> space B)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {a \<times> b |a b. a \<in> sets A \<and> b \<in> sets B} \<subseteq> Pow (space A \<times> space B)
[PROOF STEP]
using sets.space_closed[of A] sets.space_closed[of B]
[PROOF STATE]
proof (prove)
using this:
sets A \<subseteq> Pow (space A)
sets B \<subseteq> Pow (space B)

goal (1 subgoal):
 1. {a \<times> b |a b. a \<in> sets A \<and> b \<in> sets B} \<subseteq> Pow (space A \<times> space B)
[PROOF STEP]
by auto


[STATEMENT]
lemma snth_shift: "snth (shift xs ys) n = (if n < length xs then xs ! n else snth ys (n - length xs))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (xs @- ys) !! n = (if n < length xs then xs ! n else ys !! (n - length xs))
[PROOF STEP]
by simp


[STATEMENT]
lemma antisym_finer_than: "S = T" if "S finer_than T" "T finer_than S"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. S = T
[PROOF STEP]
using that
[PROOF STATE]
proof (prove)
using this:
S finer_than T
T finer_than S

goal (1 subgoal):
 1. S = T
[PROOF STEP]
apply (auto simp: finer_than_def topology_eq_iff continuous_map_alt)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>\<forall>U. openin T U \<longrightarrow> openin S (U \<inter> topspace T); topspace S = topspace T; \<forall>U. openin S U \<longrightarrow> openin T (U \<inter> topspace T); x \<subseteq> topspace T; openin S x\<rbrakk> \<Longrightarrow> openin T x
 2. \<And>x. \<lbrakk>\<forall>U. openin T U \<longrightarrow> openin S (U \<inter> topspace T); topspace S = topspace T; \<forall>U. openin S U \<longrightarrow> openin T (U \<inter> topspace T); x \<subseteq> topspace T; openin T x\<rbrakk> \<Longrightarrow> openin S x
[PROOF STEP]
apply (metis inf.orderE)+
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma exp_one_2pi_iff:
  fixes x::real shows "exp (2 * of_real pi * \<i> * x) = 1 \<longleftrightarrow> x \<in> \<int>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (exp (2 * complex_of_real pi * \<i> * complex_of_real x) = 1) = (x \<in> \<int>)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (exp (2 * complex_of_real pi * \<i> * complex_of_real x) = 1) = (x \<in> \<int>)
[PROOF STEP]
have c: "cis (2 * x * pi) = 1 \<longleftrightarrow> x \<in> \<int>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (cis (2 * x * pi) = 1) = (x \<in> \<int>)
[PROOF STEP]
by (auto simp: complex_eq_iff sin_times_pi_eq_0 cos_one_2pi_int, meson Ints_cases)
[PROOF STATE]
proof (state)
this:
(cis (2 * x * pi) = 1) = (x \<in> \<int>)

goal (1 subgoal):
 1. (exp (2 * complex_of_real pi * \<i> * complex_of_real x) = 1) = (x \<in> \<int>)
[PROOF STEP]
have "exp (2 * of_real pi * \<i> * x) = exp (\<i> * complex_of_real (2 * x * pi))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. exp (2 * complex_of_real pi * \<i> * complex_of_real x) = exp (\<i> * complex_of_real (2 * x * pi))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. exp (2 * complex_of_real pi * \<i> * complex_of_real x) = exp (\<i> * complex_of_real (2 * x * pi))
[PROOF STEP]
have "2 * of_real pi * \<i> * x = \<i> * complex_of_real (2 * x * pi)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 2 * complex_of_real pi * \<i> * complex_of_real x = \<i> * complex_of_real (2 * x * pi)
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
2 * complex_of_real pi * \<i> * complex_of_real x = \<i> * complex_of_real (2 * x * pi)

goal (1 subgoal):
 1. exp (2 * complex_of_real pi * \<i> * complex_of_real x) = exp (\<i> * complex_of_real (2 * x * pi))
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
2 * complex_of_real pi * \<i> * complex_of_real x = \<i> * complex_of_real (2 * x * pi)

goal (1 subgoal):
 1. exp (2 * complex_of_real pi * \<i> * complex_of_real x) = exp (\<i> * complex_of_real (2 * x * pi))
[PROOF STEP]
by argo
[PROOF STATE]
proof (state)
this:
exp (2 * complex_of_real pi * \<i> * complex_of_real x) = exp (\<i> * complex_of_real (2 * x * pi))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
exp (2 * complex_of_real pi * \<i> * complex_of_real x) = exp (\<i> * complex_of_real (2 * x * pi))

goal (1 subgoal):
 1. (exp (2 * complex_of_real pi * \<i> * complex_of_real x) = 1) = (x \<in> \<int>)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
exp (2 * complex_of_real pi * \<i> * complex_of_real x) = exp (\<i> * complex_of_real (2 * x * pi))

goal (1 subgoal):
 1. (exp (2 * complex_of_real pi * \<i> * complex_of_real x) = 1) = (x \<in> \<int>)
[PROOF STEP]
from cis_conv_exp
[PROOF STATE]
proof (chain)
picking this:
cis ?b = exp (\<i> * complex_of_real ?b)
[PROOF STEP]
have "\<dots> = cis (2 * x * pi)"
[PROOF STATE]
proof (prove)
using this:
cis ?b = exp (\<i> * complex_of_real ?b)

goal (1 subgoal):
 1. exp (\<i> * complex_of_real (2 * x * pi)) = cis (2 * x * pi)
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
exp (\<i> * complex_of_real (2 * x * pi)) = cis (2 * x * pi)

goal (1 subgoal):
 1. (exp (2 * complex_of_real pi * \<i> * complex_of_real x) = 1) = (x \<in> \<int>)
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
exp (2 * complex_of_real pi * \<i> * complex_of_real x) = cis (2 * x * pi)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
exp (2 * complex_of_real pi * \<i> * complex_of_real x) = cis (2 * x * pi)

goal (1 subgoal):
 1. (exp (2 * complex_of_real pi * \<i> * complex_of_real x) = 1) = (x \<in> \<int>)
[PROOF STEP]
using c
[PROOF STATE]
proof (prove)
using this:
exp (2 * complex_of_real pi * \<i> * complex_of_real x) = cis (2 * x * pi)
(cis (2 * x * pi) = 1) = (x \<in> \<int>)

goal (1 subgoal):
 1. (exp (2 * complex_of_real pi * \<i> * complex_of_real x) = 1) = (x \<in> \<int>)
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
(exp (2 * complex_of_real pi * \<i> * complex_of_real x) = 1) = (x \<in> \<int>)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma uniformly_convergent_eq_cauchy:
  fixes s::"nat \<Rightarrow> 'b \<Rightarrow> 'a::complete_space"
  shows
    "(\<exists>l. \<forall>e>0. \<exists>N. \<forall>n x. N \<le> n \<and> P x \<longrightarrow> dist(s n x)(l x) < e) \<longleftrightarrow>
      (\<forall>e>0. \<exists>N. \<forall>m n x. N \<le> m \<and> N \<le> n \<and> P x  \<longrightarrow> dist (s m x) (s n x) < e)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<exists>l. \<forall>e>0. \<exists>N. \<forall>n x. N \<le> n \<and> P x \<longrightarrow> dist (s n x) (l x) < e) = (\<forall>e>0. \<exists>N. \<forall>m n x. N \<le> m \<and> N \<le> n \<and> P x \<longrightarrow> dist (s m x) (s n x) < e)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (\<exists>l. \<forall>e>0. \<exists>N. \<forall>n x. N \<le> n \<and> P x \<longrightarrow> dist (s n x) (l x) < e) = (\<forall>e>0. \<exists>N. \<forall>m n x. N \<le> m \<and> N \<le> n \<and> P x \<longrightarrow> dist (s m x) (s n x) < e)
[PROOF STEP]
have *: "(\<forall>n\<ge>N. \<forall>x. Q x \<longrightarrow> R n x) \<longleftrightarrow> (\<forall>n x. N \<le> n \<and> Q x \<longrightarrow> R n x)"
    "(\<forall>x. Q x \<longrightarrow> (\<forall>m\<ge>N. \<forall>n\<ge>N. S n m x)) \<longleftrightarrow> (\<forall>m n x. N \<le> m \<and> N \<le> n \<and> Q x \<longrightarrow> S n m x)"
    for N::nat and Q::"'b \<Rightarrow> bool" and R S
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<forall>n\<ge>N. \<forall>x. Q x \<longrightarrow> R n x) = (\<forall>n x. N \<le> n \<and> Q x \<longrightarrow> R n x) &&& (\<forall>x. Q x \<longrightarrow> (\<forall>m\<ge>N. \<forall>n\<ge>N. S n m x)) = (\<forall>m n x. N \<le> m \<and> N \<le> n \<and> Q x \<longrightarrow> S n m x)
[PROOF STEP]
by blast+
[PROOF STATE]
proof (state)
this:
(\<forall>n\<ge>?N. \<forall>x. ?Q x \<longrightarrow> ?R n x) = (\<forall>n x. ?N \<le> n \<and> ?Q x \<longrightarrow> ?R n x)
(\<forall>x. ?Q x \<longrightarrow> (\<forall>m\<ge>?N. \<forall>n\<ge>?N. ?S n m x)) = (\<forall>m n x. ?N \<le> m \<and> ?N \<le> n \<and> ?Q x \<longrightarrow> ?S n m x)

goal (1 subgoal):
 1. (\<exists>l. \<forall>e>0. \<exists>N. \<forall>n x. N \<le> n \<and> P x \<longrightarrow> dist (s n x) (l x) < e) = (\<forall>e>0. \<exists>N. \<forall>m n x. N \<le> m \<and> N \<le> n \<and> P x \<longrightarrow> dist (s m x) (s n x) < e)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<exists>l. \<forall>e>0. \<exists>N. \<forall>n x. N \<le> n \<and> P x \<longrightarrow> dist (s n x) (l x) < e) = (\<forall>e>0. \<exists>N. \<forall>m n x. N \<le> m \<and> N \<le> n \<and> P x \<longrightarrow> dist (s m x) (s n x) < e)
[PROOF STEP]
using uniformly_convergent_eq_Cauchy[of "Collect P" s]
[PROOF STATE]
proof (prove)
using this:
uniformly_convergent_on (Collect P) s = uniformly_Cauchy_on (Collect P) s

goal (1 subgoal):
 1. (\<exists>l. \<forall>e>0. \<exists>N. \<forall>n x. N \<le> n \<and> P x \<longrightarrow> dist (s n x) (l x) < e) = (\<forall>e>0. \<exists>N. \<forall>m n x. N \<le> m \<and> N \<le> n \<and> P x \<longrightarrow> dist (s m x) (s n x) < e)
[PROOF STEP]
unfolding uniformly_convergent_on_def uniformly_Cauchy_on_def uniform_limit_sequentially_iff
[PROOF STATE]
proof (prove)
using this:
(\<exists>l. \<forall>e>0. \<exists>N. \<forall>n\<ge>N. \<forall>x\<in>Collect P. dist (s n x) (l x) < e) = (\<forall>e>0. \<exists>M. \<forall>x\<in>Collect P. \<forall>m\<ge>M. \<forall>n\<ge>M. dist (s m x) (s n x) < e)

goal (1 subgoal):
 1. (\<exists>l. \<forall>e>0. \<exists>N. \<forall>n x. N \<le> n \<and> P x \<longrightarrow> dist (s n x) (l x) < e) = (\<forall>e>0. \<exists>N. \<forall>m n x. N \<le> m \<and> N \<le> n \<and> P x \<longrightarrow> dist (s m x) (s n x) < e)
[PROOF STEP]
by (simp add: *)
[PROOF STATE]
proof (state)
this:
(\<exists>l. \<forall>e>0. \<exists>N. \<forall>n x. N \<le> n \<and> P x \<longrightarrow> dist (s n x) (l x) < e) = (\<forall>e>0. \<exists>N. \<forall>m n x. N \<le> m \<and> N \<le> n \<and> P x \<longrightarrow> dist (s m x) (s n x) < e)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma two_is_prime_nat [simp]: "prime (2::nat)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. prime 2
[PROOF STEP]
by (simp add: prime_nat_iff')


[STATEMENT]
lemma fps_cutoff_zero_iff: "fps_cutoff n f = 0 \<longleftrightarrow> (f = 0 \<or> n \<le> subdegree f)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (fps_cutoff n f = 0) = (f = 0 \<or> n \<le> subdegree f)
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. fps_cutoff n f = 0 \<Longrightarrow> f = 0 \<or> n \<le> subdegree f
 2. f = 0 \<or> n \<le> subdegree f \<Longrightarrow> fps_cutoff n f = 0
[PROOF STEP]
assume A: "fps_cutoff n f = 0"
[PROOF STATE]
proof (state)
this:
fps_cutoff n f = 0

goal (2 subgoals):
 1. fps_cutoff n f = 0 \<Longrightarrow> f = 0 \<or> n \<le> subdegree f
 2. f = 0 \<or> n \<le> subdegree f \<Longrightarrow> fps_cutoff n f = 0
[PROOF STEP]
thus "f = 0 \<or> n \<le> subdegree f"
[PROOF STATE]
proof (prove)
using this:
fps_cutoff n f = 0

goal (1 subgoal):
 1. f = 0 \<or> n \<le> subdegree f
[PROOF STEP]
proof (cases "f = 0")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<lbrakk>fps_cutoff n f = 0; f = 0\<rbrakk> \<Longrightarrow> f = 0 \<or> n \<le> subdegree f
 2. \<lbrakk>fps_cutoff n f = 0; f \<noteq> 0\<rbrakk> \<Longrightarrow> f = 0 \<or> n \<le> subdegree f
[PROOF STEP]
assume "f \<noteq> 0"
[PROOF STATE]
proof (state)
this:
f \<noteq> 0

goal (2 subgoals):
 1. \<lbrakk>fps_cutoff n f = 0; f = 0\<rbrakk> \<Longrightarrow> f = 0 \<or> n \<le> subdegree f
 2. \<lbrakk>fps_cutoff n f = 0; f \<noteq> 0\<rbrakk> \<Longrightarrow> f = 0 \<or> n \<le> subdegree f
[PROOF STEP]
with A
[PROOF STATE]
proof (chain)
picking this:
fps_cutoff n f = 0
f \<noteq> 0
[PROOF STEP]
have "n \<le> subdegree f"
[PROOF STATE]
proof (prove)
using this:
fps_cutoff n f = 0
f \<noteq> 0

goal (1 subgoal):
 1. n \<le> subdegree f
[PROOF STEP]
by (intro subdegree_geI) (simp_all add: fps_eq_iff split: if_split_asm)
[PROOF STATE]
proof (state)
this:
n \<le> subdegree f

goal (2 subgoals):
 1. \<lbrakk>fps_cutoff n f = 0; f = 0\<rbrakk> \<Longrightarrow> f = 0 \<or> n \<le> subdegree f
 2. \<lbrakk>fps_cutoff n f = 0; f \<noteq> 0\<rbrakk> \<Longrightarrow> f = 0 \<or> n \<le> subdegree f
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
n \<le> subdegree f

goal (1 subgoal):
 1. f = 0 \<or> n \<le> subdegree f
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
f = 0 \<or> n \<le> subdegree f

goal (1 subgoal):
 1. \<lbrakk>fps_cutoff n f = 0; f = 0\<rbrakk> \<Longrightarrow> f = 0 \<or> n \<le> subdegree f
[PROOF STEP]
qed simp
[PROOF STATE]
proof (state)
this:
f = 0 \<or> n \<le> subdegree f

goal (1 subgoal):
 1. f = 0 \<or> n \<le> subdegree f \<Longrightarrow> fps_cutoff n f = 0
[PROOF STEP]
qed (auto simp: fps_eq_iff intro: nth_less_subdegree_zero)


[STATEMENT]
lemma bit_or_int_iff:
  \<open>bit (k OR l) n \<longleftrightarrow> bit k n \<or> bit l n\<close> for k l :: int
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. bit (k OR l) n = (bit k n \<or> bit l n)
[PROOF STEP]
by (simp add: or_int_def bit_not_int_iff bit_and_int_iff)


[STATEMENT]
lemma segment_to_point_exists:
  fixes S :: "'a :: euclidean_space set"
    assumes "closed S" "S \<noteq> {}"
    obtains b where "b \<in> S" "open_segment a b \<inter> S = {}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>b. \<lbrakk>b \<in> S; open_segment a b \<inter> S = {}\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (metis assms segment_to_closest_point closest_point_exists that)


[STATEMENT]
lemma set_less_trans_set_less_eq [trans]:
  "\<lbrakk> A \<sqsubset>' B; B \<sqsubseteq>' C \<rbrakk> \<Longrightarrow> A \<sqsubset>' C"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>A \<sqsubset>' B; B \<sqsubseteq>' C\<rbrakk> \<Longrightarrow> A \<sqsubset>' C
[PROOF STEP]
by(auto simp add: set_less_eq_aux_def dest: set_less_aux_trans)


[STATEMENT]
lemma imirror_is_empty: "(imirror I = {}) = (I = {})"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (imirror I = {}) = (I = {})
[PROOF STEP]
unfolding imirror_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((-) (iMin I + Max I) ` I = {}) = (I = {})
[PROOF STEP]
by simp


[STATEMENT]
lemma check_all_list_return_iff[return_iff]: "check_all_list P l msg msgf = Inr () \<longleftrightarrow> (\<forall>x\<in>set l. P x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (check_all_list P l msg msgf = Inr ()) = (\<forall>x\<in>set l. P x)
[PROOF STEP]
unfolding check_all_list_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((try forallM (\<lambda>x. check (P x) (\<lambda>_. ((shows msg \<circ>\<circ>\<circ> shows_prec) 0 '': '' \<circ>\<circ> msgf) x)) l catch (\<lambda>x. Inl (snd x))) = Inr ()) = (\<forall>x\<in>set l. P x)
[PROOF STEP]
by (induction l) (auto)


[STATEMENT]
lemma filterlim_at_top_to_right:
  "filterlim f F at_top \<longleftrightarrow> (LIM x (at_right (0::real)). f (inverse x) :> F)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. filterlim f F at_top = (LIM x at_right 0. f (inverse x) :> F)
[PROOF STEP]
unfolding filterlim_def at_top_to_right filtermap_filtermap
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (filtermap (\<lambda>x. f (inverse x)) (at_right 0) \<le> F) = (filtermap (\<lambda>x. f (inverse x)) (at_right 0) \<le> F)
[PROOF STEP]
..


[STATEMENT]
lemma urel32_inverse: assumes x: "urel32 x x'"
  shows "urel32 (inverse_p32 pp x) (inverse_p p x')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. urel32 (inverse_p32 pp x) (inverse_p p x')
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. urel32 (inverse_p32 pp x) (inverse_p p x')
[PROOF STEP]
have p: "urel32 (pp - 2) (int (nat (p - 2)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. urel32 (pp - 2) (int (nat (p - 2)))
[PROOF STEP]
using p2 small
[PROOF STATE]
proof (prove)
using this:
2 \<le> p
p \<le> 65535

goal (1 subgoal):
 1. urel32 (pp - 2) (int (nat (p - 2)))
[PROOF STEP]
unfolding urel32_def
[PROOF STATE]
proof (prove)
using this:
2 \<le> p
p \<le> 65535

goal (1 subgoal):
 1. int (nat (p - 2)) = int_of_uint32 (pp - 2) \<and> int (nat (p - 2)) < p
[PROOF STEP]
unfolding ppp
[PROOF STATE]
proof (prove)
using this:
2 \<le> int_of_uint32 pp
int_of_uint32 pp \<le> 65535

goal (1 subgoal):
 1. int (nat (int_of_uint32 pp - 2)) = int_of_uint32 (pp - 2) \<and> int (nat (int_of_uint32 pp - 2)) < int_of_uint32 pp
[PROOF STEP]
by (simp add: int_of_uint32.rep_eq minus_uint32.rep_eq uint_sub_if')
[PROOF STATE]
proof (state)
this:
urel32 (pp - 2) (int (nat (p - 2)))

goal (1 subgoal):
 1. urel32 (inverse_p32 pp x) (inverse_p p x')
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. urel32 (inverse_p32 pp x) (inverse_p p x')
[PROOF STEP]
unfolding inverse_p32_def inverse_p_def urel32_eq[OF x urel32_0]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. urel32 (if x' = 0 then 0 else power_p32 pp x (pp - 2)) (if x' = 0 then 0 else power_p p x' (nat (p - 2)))
[PROOF STEP]
using urel32_0 urel32_power[OF x p]
[PROOF STATE]
proof (prove)
using this:
urel32 0 0
urel32 (power_p32 pp x (pp - 2)) (power_p p x' (nat (p - 2)))

goal (1 subgoal):
 1. urel32 (if x' = 0 then 0 else power_p32 pp x (pp - 2)) (if x' = 0 then 0 else power_p p x' (nat (p - 2)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
urel32 (inverse_p32 pp x) (inverse_p p x')

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma Stable_Constrains_Int:
    "[| F \<in> Stable C; F \<in> (C \<inter> A) Co A' |]
     ==> F \<in> (C \<inter> A) Co (C \<inter> A')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>F \<in> Stable C; F \<in> C \<inter> A Co A'\<rbrakk> \<Longrightarrow> F \<in> C \<inter> A Co C \<inter> A'
[PROOF STEP]
apply (unfold Stable_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>F \<in> C Co C; F \<in> C \<inter> A Co A'\<rbrakk> \<Longrightarrow> F \<in> C \<inter> A Co C \<inter> A'
[PROOF STEP]
apply (blast intro: Constrains_Int [THEN Constrains_weaken])
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma mtx_vec_mult_0r[simp]: "A *\<^sub>V 0 = 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. A *\<^sub>V 0 = 0
[PROOF STEP]
by (transfer, simp)


[STATEMENT]
lemma real_divr_nonneg_neg_upper_bound: "0 \<le> x \<Longrightarrow> y \<le> 0 \<Longrightarrow> real_divr prec x y \<le> 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> x; y \<le> 0\<rbrakk> \<Longrightarrow> real_divr prec x y \<le> 0
[PROOF STEP]
by (simp add: real_divr_def truncate_up_nonpos divide_le_0_iff)


[STATEMENT]
lemma degree_pdevs_of_list_eq':
  \<open>degree (pdevs_of_list xs) = Min {n. n \<le> length xs \<and> (\<forall>m. n \<le> m \<longrightarrow> m < length xs \<longrightarrow> xs ! m = 0)}\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. degree (pdevs_of_list xs) = Min {n. n \<le> length xs \<and> (\<forall>m\<ge>n. m < length xs \<longrightarrow> xs ! m = (0::'a))}
[PROOF STEP]
apply (simp add: degree_def pdevs_apply_pdevs_of_list)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (LEAST i. \<forall>j<length xs. i \<le> j \<longrightarrow> xs ! j = (0::'a)) = Min {n. n \<le> length xs \<and> (\<forall>m\<ge>n. m < length xs \<longrightarrow> xs ! m = (0::'a))}
[PROOF STEP]
apply (rule Least_equality)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<forall>j<length xs. Min {n. n \<le> length xs \<and> (\<forall>m\<ge>n. m < length xs \<longrightarrow> xs ! m = (0::'a))} \<le> j \<longrightarrow> xs ! j = (0::'a)
 2. \<And>y. \<forall>j<length xs. y \<le> j \<longrightarrow> xs ! j = (0::'a) \<Longrightarrow> Min {n. n \<le> length xs \<and> (\<forall>m\<ge>n. m < length xs \<longrightarrow> xs ! m = (0::'a))} \<le> y
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>j. \<lbrakk>j < length xs; Min {n. n \<le> length xs \<and> (\<forall>m\<ge>n. m < length xs \<longrightarrow> xs ! m = (0::'a))} \<le> j\<rbrakk> \<Longrightarrow> xs ! j = (0::'a)
 2. \<And>y. \<forall>j<length xs. y \<le> j \<longrightarrow> xs ! j = (0::'a) \<Longrightarrow> Min {n. n \<le> length xs \<and> (\<forall>m\<ge>n. m < length xs \<longrightarrow> xs ! m = (0::'a))} \<le> y
[PROOF STEP]
apply (subst (asm) Min_le_iff)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>j. j < length xs \<Longrightarrow> finite {n. n \<le> length xs \<and> (\<forall>m\<ge>n. m < length xs \<longrightarrow> xs ! m = (0::'a))}
 2. \<And>j. j < length xs \<Longrightarrow> {n. n \<le> length xs \<and> (\<forall>m\<ge>n. m < length xs \<longrightarrow> xs ! m = (0::'a))} \<noteq> {}
 3. \<And>j. \<lbrakk>j < length xs; \<exists>a\<in>{n. n \<le> length xs \<and> (\<forall>m\<ge>n. m < length xs \<longrightarrow> xs ! m = (0::'a))}. a \<le> j\<rbrakk> \<Longrightarrow> xs ! j = (0::'a)
 4. \<And>y. \<forall>j<length xs. y \<le> j \<longrightarrow> xs ! j = (0::'a) \<Longrightarrow> Min {n. n \<le> length xs \<and> (\<forall>m\<ge>n. m < length xs \<longrightarrow> xs ! m = (0::'a))} \<le> y
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>y. \<forall>j<length xs. y \<le> j \<longrightarrow> xs ! j = (0::'a) \<Longrightarrow> Min {n. n \<le> length xs \<and> (\<forall>m\<ge>n. m < length xs \<longrightarrow> xs ! m = (0::'a))} \<le> y
[PROOF STEP]
apply (subst Min_le_iff)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>y. \<forall>j<length xs. y \<le> j \<longrightarrow> xs ! j = (0::'a) \<Longrightarrow> finite {n. n \<le> length xs \<and> (\<forall>m\<ge>n. m < length xs \<longrightarrow> xs ! m = (0::'a))}
 2. \<And>y. \<forall>j<length xs. y \<le> j \<longrightarrow> xs ! j = (0::'a) \<Longrightarrow> {n. n \<le> length xs \<and> (\<forall>m\<ge>n. m < length xs \<longrightarrow> xs ! m = (0::'a))} \<noteq> {}
 3. \<And>y. \<forall>j<length xs. y \<le> j \<longrightarrow> xs ! j = (0::'a) \<Longrightarrow> \<exists>a\<in>{n. n \<le> length xs \<and> (\<forall>m\<ge>n. m < length xs \<longrightarrow> xs ! m = (0::'a))}. a \<le> y
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>y. \<forall>j<length xs. y \<le> j \<longrightarrow> xs ! j = (0::'a) \<Longrightarrow> \<exists>a\<le>length xs. (\<forall>m\<ge>a. m < length xs \<longrightarrow> xs ! m = (0::'a)) \<and> a \<le> y
[PROOF STEP]
apply (metis le_cases not_less)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma contour_integrable_continuous_circlepath:
    "continuous_on (path_image (circlepath z r)) f
     \<Longrightarrow> f contour_integrable_on (circlepath z r)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. continuous_on (path_image (circlepath z r)) f \<Longrightarrow> f contour_integrable_on circlepath z r
[PROOF STEP]
by (simp add: circlepath_def contour_integrable_continuous_part_circlepath)


[STATEMENT]
lemma deriv_cos [simp]: "deriv cos a = - sin a"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. deriv cos a = - sin a
[PROOF STEP]
by (simp add: DERIV_imp_deriv)


[STATEMENT]
lemma FAddSA_dom_dom_States [simp]:
  "\<lbrakk> S \<in> (dom F); S \<notin> States SA \<rbrakk> \<Longrightarrow>
    (dom ((F::('a \<rightharpoonup> (('a,'b,'d)seqauto) set)) [f+] (S, SA))) =
    ((dom F) \<union> (States (SA::('a,'b,'d)seqauto)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>S \<in> dom F; S \<notin> States SA\<rbrakk> \<Longrightarrow> dom (F [f+] (S, SA)) = dom F \<union> States SA
[PROOF STEP]
by (unfold FAddSA_def Let_def, auto)


[STATEMENT]
lemma closedin_subtopology_Un:
    "\<lbrakk>closedin (subtopology X T) S; closedin (subtopology X U) S\<rbrakk>
     \<Longrightarrow> closedin (subtopology X (T \<union> U)) S"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>closedin (subtopology X T) S; closedin (subtopology X U) S\<rbrakk> \<Longrightarrow> closedin (subtopology X (T \<union> U)) S
[PROOF STEP]
by (simp add: closedin_subtopology) blast


[STATEMENT]
lemma cong_left_commutativity:
  assumes "Cong A B C D"
  shows "Cong B A C D"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Cong B A C D
[PROOF STEP]
using assms cong_inner_transitivity cong_pseudo_reflexivity
[PROOF STATE]
proof (prove)
using this:
Cong A B C D
\<forall>a b p q r s. Cong a b p q \<and> Cong a b r s \<longrightarrow> Cong p q r s
\<forall>a b. Cong a b b a

goal (1 subgoal):
 1. Cong B A C D
[PROOF STEP]
by blast


[STATEMENT]
lemma pi_float_interval: "pi \<in> set_of (real_interval (pi_float_interval prec))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pi \<in>\<^sub>r pi_float_interval prec
[PROOF STEP]
using pi_boundaries
[PROOF STATE]
proof (prove)
using this:
pi \<in> {real_of_float (lb_pi ?n)..real_of_float (ub_pi ?n)}

goal (1 subgoal):
 1. pi \<in>\<^sub>r pi_float_interval prec
[PROOF STEP]
by (auto simp: set_of_eq lower_pi_float_interval upper_pi_float_interval)


[STATEMENT]
lemma min_coin_defI: assumes "r \<noteq> \<epsilon>" and "s \<noteq> \<epsilon>" and  "g r = h s" and
      "(\<And> r' s'. r' \<le>np r \<Longrightarrow> s' \<le>np s \<Longrightarrow> g r' = h s' \<Longrightarrow> r' = r \<and> s' = s)"
   shows "g r =\<^sub>m h s"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. g r =\<^sub>m h s
[PROOF STEP]
unfolding min_coin_def[rule_format]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. r \<noteq> \<epsilon> \<and> s \<noteq> \<epsilon> \<and> g r = h s \<and> (\<forall>r' s'. r' \<le>np r \<and> s' \<le>np s \<and> g r' = h s' \<longrightarrow> r' = r \<and> s' = s)
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
r \<noteq> \<epsilon>
s \<noteq> \<epsilon>
g r = h s
\<lbrakk>?r' \<le>np r; ?s' \<le>np s; g ?r' = h ?s'\<rbrakk> \<Longrightarrow> ?r' = r \<and> ?s' = s

goal (1 subgoal):
 1. r \<noteq> \<epsilon> \<and> s \<noteq> \<epsilon> \<and> g r = h s \<and> (\<forall>r' s'. r' \<le>np r \<and> s' \<le>np s \<and> g r' = h s' \<longrightarrow> r' = r \<and> s' = s)
[PROOF STEP]
by blast


[STATEMENT]
lemma eval_ternary_DeMorgan:
  "eval_ternary_Not (eval_ternary_And a b) = eval_ternary_Or (eval_ternary_Not a) (eval_ternary_Not b)"
  "eval_ternary_Not (eval_ternary_Or a b) = eval_ternary_And (eval_ternary_Not a) (eval_ternary_Not b)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. eval_ternary_Not (eval_ternary_And a b) = eval_ternary_Or (eval_ternary_Not a) (eval_ternary_Not b) &&& eval_ternary_Not (eval_ternary_Or a b) = eval_ternary_And (eval_ternary_Not a) (eval_ternary_Not b)
[PROOF STEP]
by (cases a b rule: ternaryvalue.exhaust[case_product ternaryvalue.exhaust],auto)+


[STATEMENT]
lemma dvd_imp_dvdm:
  assumes "a dvd b" shows "a dvdm b"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. a dvdm b
[PROOF STEP]
by (metis assms dvd_def dvdm_def)


[STATEMENT]
lemma "\<not>(\<exists>(a::int) b m. (b - a) mod m = 0 \<and> a mod m \<noteq> b mod m)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<nexists>a b m. (b - a) mod m = 0 \<and> a mod m \<noteq> b mod m
[PROOF STEP]
by (simp add: zmod_eq_diff_mod_0_conv)