[STATEMENT]
theorem relabel_to_front_correct:
  "<emp>
  relabel_to_front el s t
  <\<lambda>
    None \<Rightarrow> \<up>(\<not>ln_invar el \<or> \<not>Network (ln_\<alpha> el) s t)
  | Some (c,am,N,cfi) \<Rightarrow>
      \<up>(c = ln_\<alpha> el \<and> ln_invar el)
    * (\<exists>\<^sub>Acf. asmtx_assn N int_assn cf cfi
          * \<up>(RGraph_Impl c s t N cf
            \<and> Network.isMaxFlow c s t (Network.flow_of_cf c cf)))
    * \<up>(Graph.is_adj_map c am)
  >\<^sub>t
  "
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. <emp> relabel_to_front el s t <\<lambda>r. case r of None \<Rightarrow> \<up> (\<not> ln_invar el \<or> \<not> Network (ln_\<alpha> el) s t) | Some (c, am, N, cfi) \<Rightarrow> \<up> (c = ln_\<alpha> el \<and> ln_invar el) * (\<exists>\<^sub>Acf. asmtx_assn N cap_assn cf cfi * \<up> (RGraph_Impl c s t N cf \<and> Network.isMaxFlow c s t (Network.flow_of_cf c cf))) * \<up> (Graph.is_adj_map c am)>\<^sub>t
[PROOF STEP]
unfolding relabel_to_front_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. <emp> case prepareNet el s t of None \<Rightarrow> return None | Some (c, am, N) \<Rightarrow> relabel_to_front_impl_tab_am c s t N am \<bind> (\<lambda>cf. return (Some (c, am, N, cf))) <\<lambda>r. case r of None \<Rightarrow> \<up> (\<not> ln_invar el \<or> \<not> Network (ln_\<alpha> el) s t) | Some (c, am, N, cfi) \<Rightarrow> \<up> (c = ln_\<alpha> el \<and> ln_invar el) * (\<exists>\<^sub>Acf. asmtx_assn N cap_assn cf cfi * \<up> (RGraph_Impl c s t N cf \<and> Network.isMaxFlow c s t (Network.flow_of_cf c cf))) * \<up> (Graph.is_adj_map c am)>\<^sub>t
[PROOF STEP]
using prepareNet_correct[of el s t]
[PROOF STATE]
proof (prove)
using this:
case prepareNet el s t of None \<Rightarrow> \<not> ln_invar el \<or> \<not> Network (ln_\<alpha> el) s t | Some (c, adjmap, N) \<Rightarrow> (el, c) \<in> ln_rel \<and> Network c s t \<and> Graph.is_adj_map c adjmap \<and> Graph.V c \<subseteq> {0..<N}

goal (1 subgoal):
 1. <emp> case prepareNet el s t of None \<Rightarrow> return None | Some (c, am, N) \<Rightarrow> relabel_to_front_impl_tab_am c s t N am \<bind> (\<lambda>cf. return (Some (c, am, N, cf))) <\<lambda>r. case r of None \<Rightarrow> \<up> (\<not> ln_invar el \<or> \<not> Network (ln_\<alpha> el) s t) | Some (c, am, N, cfi) \<Rightarrow> \<up> (c = ln_\<alpha> el \<and> ln_invar el) * (\<exists>\<^sub>Acf. asmtx_assn N cap_assn cf cfi * \<up> (RGraph_Impl c s t N cf \<and> Network.isMaxFlow c s t (Network.flow_of_cf c cf))) * \<up> (Graph.is_adj_map c am)>\<^sub>t
[PROOF STEP]
by (sep_auto simp: ln_rel_def in_br_conv)


[STATEMENT]
lemma map_fm_binders_negation_free :
  assumes "negation_free \<phi>"
  shows "negation_free (map_fm_binders f \<phi> n)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. negation_free (map_fm_binders f \<phi> n)
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
negation_free \<phi>

goal (1 subgoal):
 1. negation_free (map_fm_binders f \<phi> n)
[PROOF STEP]
apply(induction \<phi> arbitrary : n)
[PROOF STATE]
proof (prove)
goal (10 subgoals):
 1. \<And>n. negation_free TrueF \<Longrightarrow> negation_free (map_fm_binders f TrueF n)
 2. \<And>n. negation_free FalseF \<Longrightarrow> negation_free (map_fm_binders f FalseF n)
 3. \<And>x n. negation_free (fm.Atom x) \<Longrightarrow> negation_free (map_fm_binders f (fm.Atom x) n)
 4. \<And>\<phi>1 \<phi>2 n. \<lbrakk>\<And>n. negation_free \<phi>1 \<Longrightarrow> negation_free (map_fm_binders f \<phi>1 n); \<And>n. negation_free \<phi>2 \<Longrightarrow> negation_free (map_fm_binders f \<phi>2 n); negation_free (And \<phi>1 \<phi>2)\<rbrakk> \<Longrightarrow> negation_free (map_fm_binders f (And \<phi>1 \<phi>2) n)
 5. \<And>\<phi>1 \<phi>2 n. \<lbrakk>\<And>n. negation_free \<phi>1 \<Longrightarrow> negation_free (map_fm_binders f \<phi>1 n); \<And>n. negation_free \<phi>2 \<Longrightarrow> negation_free (map_fm_binders f \<phi>2 n); negation_free (Or \<phi>1 \<phi>2)\<rbrakk> \<Longrightarrow> negation_free (map_fm_binders f (Or \<phi>1 \<phi>2) n)
 6. \<And>\<phi> n. \<lbrakk>\<And>n. negation_free \<phi> \<Longrightarrow> negation_free (map_fm_binders f \<phi> n); negation_free (Neg \<phi>)\<rbrakk> \<Longrightarrow> negation_free (map_fm_binders f (Neg \<phi>) n)
 7. \<And>\<phi> n. \<lbrakk>\<And>n. negation_free \<phi> \<Longrightarrow> negation_free (map_fm_binders f \<phi> n); negation_free (ExQ \<phi>)\<rbrakk> \<Longrightarrow> negation_free (map_fm_binders f (ExQ \<phi>) n)
 8. \<And>\<phi> n. \<lbrakk>\<And>n. negation_free \<phi> \<Longrightarrow> negation_free (map_fm_binders f \<phi> n); negation_free (AllQ \<phi>)\<rbrakk> \<Longrightarrow> negation_free (map_fm_binders f (AllQ \<phi>) n)
 9. \<And>x1 \<phi> n. \<lbrakk>\<And>n. negation_free \<phi> \<Longrightarrow> negation_free (map_fm_binders f \<phi> n); negation_free (ExN x1 \<phi>)\<rbrakk> \<Longrightarrow> negation_free (map_fm_binders f (ExN x1 \<phi>) n)
 10. \<And>x1 \<phi> n. \<lbrakk>\<And>n. negation_free \<phi> \<Longrightarrow> negation_free (map_fm_binders f \<phi> n); negation_free (AllN x1 \<phi>)\<rbrakk> \<Longrightarrow> negation_free (map_fm_binders f (AllN x1 \<phi>) n)
[PROOF STEP]
by auto


[STATEMENT]
lemma reflects_equivalent_objects:
    assumes "C.obj a" and "C.obj b" and "D.equivalent_objects (map\<^sub>0 a) (map\<^sub>0 b)"
    shows "C.equivalent_objects a b"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. C.equivalent_objects a b
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. C.equivalent_objects a b
[PROOF STEP]
obtain f' where f': "\<guillemotleft>f' : map\<^sub>0 a \<rightarrow>\<^sub>D map\<^sub>0 b\<guillemotright> \<and> D.equivalence_map f'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>f'. \<guillemotleft>f' : map\<^sub>0 a \<rightarrow>\<^sub>D map\<^sub>0 b\<guillemotright> \<and> D.equivalence_map f' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using assms D.equivalent_objects_def D.equivalence_map_def
[PROOF STATE]
proof (prove)
using this:
C.obj a
C.obj b
D.equivalent_objects (map\<^sub>0 a) (map\<^sub>0 b)
D.equivalent_objects ?a ?b \<equiv> \<exists>f. \<guillemotleft>f : ?a \<rightarrow>\<^sub>D ?b\<guillemotright> \<and> D.equivalence_map f
D.equivalence_map ?f \<equiv> \<exists>g \<eta> \<epsilon>. D.internal_equivalence ?f g \<eta> \<epsilon>

goal (1 subgoal):
 1. (\<And>f'. \<guillemotleft>f' : map\<^sub>0 a \<rightarrow>\<^sub>D map\<^sub>0 b\<guillemotright> \<and> D.equivalence_map f' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<guillemotleft>f' : map\<^sub>0 a \<rightarrow>\<^sub>D map\<^sub>0 b\<guillemotright> \<and> D.equivalence_map f'

goal (1 subgoal):
 1. C.equivalent_objects a b
[PROOF STEP]
obtain f where f: "\<guillemotleft>f : a \<rightarrow>\<^sub>C b\<guillemotright> \<and> C.ide f \<and> D.isomorphic (F f) f'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>f. \<guillemotleft>f : a \<rightarrow>\<^sub>C b\<guillemotright> \<and> C.ide f \<and> D.isomorphic (F f) f' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using assms f' locally_essentially_surjective [of a b f'] D.equivalence_map_is_ide
[PROOF STATE]
proof (prove)
using this:
C.obj a
C.obj b
D.equivalent_objects (map\<^sub>0 a) (map\<^sub>0 b)
\<guillemotleft>f' : map\<^sub>0 a \<rightarrow>\<^sub>D map\<^sub>0 b\<guillemotright> \<and> D.equivalence_map f'
\<lbrakk>C.obj a; C.obj b; \<guillemotleft>f' : map\<^sub>0 a \<rightarrow>\<^sub>D map\<^sub>0 b\<guillemotright>; D.ide f'\<rbrakk> \<Longrightarrow> \<exists>f. \<guillemotleft>f : a \<rightarrow>\<^sub>C b\<guillemotright> \<and> C.ide f \<and> D.isomorphic (F f) f'
D.equivalence_map ?f \<Longrightarrow> D.ide ?f

goal (1 subgoal):
 1. (\<And>f. \<guillemotleft>f : a \<rightarrow>\<^sub>C b\<guillemotright> \<and> C.ide f \<and> D.isomorphic (F f) f' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<guillemotleft>f : a \<rightarrow>\<^sub>C b\<guillemotright> \<and> C.ide f \<and> D.isomorphic (F f) f'

goal (1 subgoal):
 1. C.equivalent_objects a b
[PROOF STEP]
have "D.equivalence_map (F f)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. D.equivalence_map (F f)
[PROOF STEP]
using f f' D.equivalence_map_preserved_by_iso [of f' "F f"] D.isomorphic_symmetric
[PROOF STATE]
proof (prove)
using this:
\<guillemotleft>f : a \<rightarrow>\<^sub>C b\<guillemotright> \<and> C.ide f \<and> D.isomorphic (F f) f'
\<guillemotleft>f' : map\<^sub>0 a \<rightarrow>\<^sub>D map\<^sub>0 b\<guillemotright> \<and> D.equivalence_map f'
\<lbrakk>D.equivalence_map f'; D.isomorphic f' (F f)\<rbrakk> \<Longrightarrow> D.equivalence_map (F f)
D.isomorphic ?f ?g \<Longrightarrow> D.isomorphic ?g ?f

goal (1 subgoal):
 1. D.equivalence_map (F f)
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
D.equivalence_map (F f)

goal (1 subgoal):
 1. C.equivalent_objects a b
[PROOF STEP]
hence "C.equivalence_map f"
[PROOF STATE]
proof (prove)
using this:
D.equivalence_map (F f)

goal (1 subgoal):
 1. C.equivalence_map f
[PROOF STEP]
using f f' reflects_equivalence_map [of f]
[PROOF STATE]
proof (prove)
using this:
D.equivalence_map (F f)
\<guillemotleft>f : a \<rightarrow>\<^sub>C b\<guillemotright> \<and> C.ide f \<and> D.isomorphic (F f) f'
\<guillemotleft>f' : map\<^sub>0 a \<rightarrow>\<^sub>D map\<^sub>0 b\<guillemotright> \<and> D.equivalence_map f'
\<lbrakk>C.ide f; D.equivalence_map (F f)\<rbrakk> \<Longrightarrow> C.equivalence_map f

goal (1 subgoal):
 1. C.equivalence_map f
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
C.equivalence_map f

goal (1 subgoal):
 1. C.equivalent_objects a b
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
C.equivalence_map f

goal (1 subgoal):
 1. C.equivalent_objects a b
[PROOF STEP]
using f C.equivalent_objects_def
[PROOF STATE]
proof (prove)
using this:
C.equivalence_map f
\<guillemotleft>f : a \<rightarrow>\<^sub>C b\<guillemotright> \<and> C.ide f \<and> D.isomorphic (F f) f'
C.equivalent_objects ?a ?b \<equiv> \<exists>f. \<guillemotleft>f : ?a \<rightarrow>\<^sub>C ?b\<guillemotright> \<and> C.equivalence_map f

goal (1 subgoal):
 1. C.equivalent_objects a b
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
C.equivalent_objects a b

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma th_3_lm_1: "\<lbrakk>c_unfold (length ls) (c_fold ls) = ls; ls = a # ls1\<rbrakk> \<Longrightarrow> c_unfold (length (x # ls)) (c_fold (x # ls)) = x # ls"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>c_unfold (length ls) (c_fold ls) = ls; ls = a # ls1\<rbrakk> \<Longrightarrow> c_unfold (length (x # ls)) (c_fold (x # ls)) = x # ls
[PROOF STEP]
apply(cases ls1)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>c_unfold (length ls) (c_fold ls) = ls; ls = a # ls1; ls1 = []\<rbrakk> \<Longrightarrow> c_unfold (length (x # ls)) (c_fold (x # ls)) = x # ls
 2. \<And>aa list. \<lbrakk>c_unfold (length ls) (c_fold ls) = ls; ls = a # ls1; ls1 = aa # list\<rbrakk> \<Longrightarrow> c_unfold (length (x # ls)) (c_fold (x # ls)) = x # ls
[PROOF STEP]
apply(simp add: c_fold_1)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>aa list. \<lbrakk>c_unfold (length ls) (c_fold ls) = ls; ls = a # ls1; ls1 = aa # list\<rbrakk> \<Longrightarrow> c_unfold (length (x # ls)) (c_fold (x # ls)) = x # ls
[PROOF STEP]
apply(simp)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma map_component_inj:
  assumes "inj f" and "map_component f u = map_component f v"
  shows "u = v"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. u = v
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. u = v
[PROOF STEP]
from assms(2)
[PROOF STATE]
proof (chain)
picking this:
map_component f u = map_component f v
[PROOF STEP]
have "term_of_pair (pp_of_term u, f (component_of_term u)) =
                      term_of_pair (pp_of_term v, f (component_of_term v))"
[PROOF STATE]
proof (prove)
using this:
map_component f u = map_component f v

goal (1 subgoal):
 1. term_of_pair (pp_of_term u, f (component_of_term u)) = term_of_pair (pp_of_term v, f (component_of_term v))
[PROOF STEP]
by (simp only: map_component_def)
[PROOF STATE]
proof (state)
this:
term_of_pair (pp_of_term u, f (component_of_term u)) = term_of_pair (pp_of_term v, f (component_of_term v))

goal (1 subgoal):
 1. u = v
[PROOF STEP]
hence "(pp_of_term u, f (component_of_term u)) = (pp_of_term v, f (component_of_term v))"
[PROOF STATE]
proof (prove)
using this:
term_of_pair (pp_of_term u, f (component_of_term u)) = term_of_pair (pp_of_term v, f (component_of_term v))

goal (1 subgoal):
 1. (pp_of_term u, f (component_of_term u)) = (pp_of_term v, f (component_of_term v))
[PROOF STEP]
by (rule term_of_pair_injective)
[PROOF STATE]
proof (state)
this:
(pp_of_term u, f (component_of_term u)) = (pp_of_term v, f (component_of_term v))

goal (1 subgoal):
 1. u = v
[PROOF STEP]
hence 1: "pp_of_term u = pp_of_term v" and "f (component_of_term u) = f (component_of_term v)"
[PROOF STATE]
proof (prove)
using this:
(pp_of_term u, f (component_of_term u)) = (pp_of_term v, f (component_of_term v))

goal (1 subgoal):
 1. pp_of_term u = pp_of_term v &&& f (component_of_term u) = f (component_of_term v)
[PROOF STEP]
by simp_all
[PROOF STATE]
proof (state)
this:
pp_of_term u = pp_of_term v
f (component_of_term u) = f (component_of_term v)

goal (1 subgoal):
 1. u = v
[PROOF STEP]
from assms(1) this(2)
[PROOF STATE]
proof (chain)
picking this:
inj f
f (component_of_term u) = f (component_of_term v)
[PROOF STEP]
have "component_of_term u = component_of_term v"
[PROOF STATE]
proof (prove)
using this:
inj f
f (component_of_term u) = f (component_of_term v)

goal (1 subgoal):
 1. component_of_term u = component_of_term v
[PROOF STEP]
by (rule injD)
[PROOF STATE]
proof (state)
this:
component_of_term u = component_of_term v

goal (1 subgoal):
 1. u = v
[PROOF STEP]
with 1
[PROOF STATE]
proof (chain)
picking this:
pp_of_term u = pp_of_term v
component_of_term u = component_of_term v
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
pp_of_term u = pp_of_term v
component_of_term u = component_of_term v

goal (1 subgoal):
 1. u = v
[PROOF STEP]
by (metis term_of_pair_pair)
[PROOF STATE]
proof (state)
this:
u = v

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma s'_pos: "0 \<le> x \<Longrightarrow> x < t_stop \<Longrightarrow> 0 \<le> v \<Longrightarrow> a \<le> 0 \<Longrightarrow> 0 < s' x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> x; x < t_stop; 0 \<le> v; a \<le> 0\<rbrakk> \<Longrightarrow> 0 < s' x
[PROOF STEP]
by (intro le_neq_trans s'_nonneg)
    (auto simp: s'_def p'_def t_stop_def field_split_simps)


[STATEMENT]
theorem isAut_pref_Conflict:
assumes a: "reach s" and i: "isAut s confID uID papID"
shows "pref s uID papID = Conflict"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pref s uID papID = Conflict
[PROOF STEP]
using isAut_pref_Conflict1[OF a] i
[PROOF STATE]
proof (prove)
using this:
isAut_pref_Conflict s
isAut s confID uID papID

goal (1 subgoal):
 1. pref s uID papID = Conflict
[PROOF STEP]
unfolding isAut_pref_Conflict_def
[PROOF STATE]
proof (prove)
using this:
\<forall>confID uID papID. isAut s confID uID papID \<longrightarrow> pref s uID papID = Conflict
isAut s confID uID papID

goal (1 subgoal):
 1. pref s uID papID = Conflict
[PROOF STEP]
by auto


[STATEMENT]
lemma nonzero_of_real_inverse:
  "x \<noteq> 0 \<Longrightarrow> of_real (inverse x) = inverse (of_real x :: 'a::real_div_algebra)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x \<noteq> 0 \<Longrightarrow> of_real (inverse x) = inverse (of_real x)
[PROOF STEP]
by (simp add: of_real_def nonzero_inverse_scaleR_distrib)


[STATEMENT]
lemma cas_ends:
  assumes "cas u p v" "cas u' p v'"
  shows "(p \<noteq> [] \<and> u = u' \<and> v = v') \<or> (p = [] \<and> u = v \<and> u' = v')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. p \<noteq> [] \<and> u = u' \<and> v = v' \<or> p = [] \<and> u = v \<and> u' = v'
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
cas u p v
cas u' p v'

goal (1 subgoal):
 1. p \<noteq> [] \<and> u = u' \<and> v = v' \<or> p = [] \<and> u = v \<and> u' = v'
[PROOF STEP]
by (induct u p v arbitrary: u u' rule: cas.induct) auto


[STATEMENT]
lemma synth_cut: "\<lbrakk> Y \<in> synth (insert X H); X \<in> synth H \<rbrakk> \<Longrightarrow> Y \<in> synth H"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Y \<in> synth (insert X H); X \<in> synth H\<rbrakk> \<Longrightarrow> Y \<in> synth H
[PROOF STEP]
by (erule synth_trans, blast)


[STATEMENT]
lemma inv_free_Abelian_group [simp]: "Poly_Mapping.keys x \<subseteq> S \<Longrightarrow> inv\<^bsub>free_Abelian_group S\<^esub> x = -x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Poly_Mapping.keys x \<subseteq> S \<Longrightarrow> inv\<^bsub>free_Abelian_group S\<^esub> x = - x
[PROOF STEP]
by (rule group.inv_equality [OF group_free_Abelian_group]) auto


[STATEMENT]
lemma vimage_vsingleton_in[intro, simp]:
  assumes "a \<in>\<^sub>\<circ> A"
  shows "set {\<langle>a, b\<rangle>} `\<^sub>\<circ> A = set {b}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. set {\<langle>a, b\<rangle>} `\<^sub>\<circ> A = set {b}
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
a \<in>\<^sub>\<circ> A

goal (1 subgoal):
 1. set {\<langle>a, b\<rangle>} `\<^sub>\<circ> A = set {b}
[PROOF STEP]
by auto


[STATEMENT]
lemma mod_diff_mult_self1: "
  k * m \<le> (n::nat) \<Longrightarrow> (n - k * m) mod m = n mod m"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. k * m \<le> n \<Longrightarrow> (n - k * m) mod m = n mod m
[PROOF STEP]
by (simp add: mod_diff_right_eq)


[STATEMENT]
lemma finite_varsL: "finite (varsL l)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. finite (varsL l)
[PROOF STEP]
using finite_varsA
[PROOF STATE]
proof (prove)
using this:
finite (varsA ?at)

goal (1 subgoal):
 1. finite (varsL l)
[PROOF STEP]
by (cases l, auto)


[STATEMENT]
lemma wf_ord0_prec: "wf ord0_prec"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. wf ord0_prec
[PROOF STEP]
apply (unfold ord0_prec_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. wf (\<Union>f i. {(f i, ord0_Lim f)})
[PROOF STEP]
apply (rule wfUNIVI, induct_tac x)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>P x. \<forall>x. (\<forall>y. (y, x) \<in> (\<Union>f i. {(f i, ord0_Lim f)}) \<longrightarrow> P y) \<longrightarrow> P x \<Longrightarrow> P ord0_Zero
 2. \<And>P x xa. \<lbrakk>\<forall>x. (\<forall>y. (y, x) \<in> (\<Union>f i. {(f i, ord0_Lim f)}) \<longrightarrow> P y) \<longrightarrow> P x; \<And>xaa. xaa \<in> range xa \<Longrightarrow> P xaa\<rbrakk> \<Longrightarrow> P (ord0_Lim xa)
[PROOF STEP]
apply (drule spec, erule mp, simp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>P x xa. \<lbrakk>\<forall>x. (\<forall>y. (y, x) \<in> (\<Union>f i. {(f i, ord0_Lim f)}) \<longrightarrow> P y) \<longrightarrow> P x; \<And>xaa. xaa \<in> range xa \<Longrightarrow> P xaa\<rbrakk> \<Longrightarrow> P (ord0_Lim xa)
[PROOF STEP]
apply (drule spec, erule mp, auto)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma ball_trans:
  assumes "y \<in> ball z q" "r + q \<le> s" shows "ball y r \<subseteq> ball z s"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ball y r \<subseteq> ball z s
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
y \<in> ball z q
r + q \<le> s

goal (1 subgoal):
 1. ball y r \<subseteq> ball z s
[PROOF STEP]
by metric


[STATEMENT]
theorem IFNTT_correct:
  assumes "length numbers = n"
  shows "IFNTT numbers = INTT numbers"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. IFNTT numbers = INTT numbers
[PROOF STEP]
using IFNTT_INTT_gen_eq INTT_gen_INTT_full_length assms n_two_pot
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>length ?numbers = 2 ^ ?l; 2 ^ ?l \<le> n\<rbrakk> \<Longrightarrow> IFNTT ?numbers = INTT_gen (length ?numbers) ?numbers
length ?numbers = n \<Longrightarrow> INTT_gen n ?numbers = INTT ?numbers
length numbers = n
n = 2 ^ N

goal (1 subgoal):
 1. IFNTT numbers = INTT numbers
[PROOF STEP]
by force


[STATEMENT]
lemma (in cpx_sq_mat) diag_elem_indices_disjoint:
  assumes "B\<in> carrier_mat dimR dimC"
  shows "disjoint_family_on (\<lambda>n. diag_elem_indices (diag_idx_to_el B n) B)
    {..<dist_el_card B}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. disjoint_family_on (\<lambda>n. diag_elem_indices (diag_idx_to_el B n) B) {..<dist_el_card B}
[PROOF STEP]
unfolding disjoint_family_on_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>m\<in>{..<dist_el_card B}. \<forall>n\<in>{..<dist_el_card B}. m \<noteq> n \<longrightarrow> diag_elem_indices (diag_idx_to_el B m) B \<inter> diag_elem_indices (diag_idx_to_el B n) B = {}
[PROOF STEP]
proof (intro ballI impI)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>m n. \<lbrakk>m \<in> {..<dist_el_card B}; n \<in> {..<dist_el_card B}; m \<noteq> n\<rbrakk> \<Longrightarrow> diag_elem_indices (diag_idx_to_el B m) B \<inter> diag_elem_indices (diag_idx_to_el B n) B = {}
[PROOF STEP]
fix p m
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>m n. \<lbrakk>m \<in> {..<dist_el_card B}; n \<in> {..<dist_el_card B}; m \<noteq> n\<rbrakk> \<Longrightarrow> diag_elem_indices (diag_idx_to_el B m) B \<inter> diag_elem_indices (diag_idx_to_el B n) B = {}
[PROOF STEP]
assume "m\<in> {..< dist_el_card B}" and "p\<in> {..< dist_el_card B}" and "m\<noteq> p"
[PROOF STATE]
proof (state)
this:
m \<in> {..<dist_el_card B}
p \<in> {..<dist_el_card B}
m \<noteq> p

goal (1 subgoal):
 1. \<And>m n. \<lbrakk>m \<in> {..<dist_el_card B}; n \<in> {..<dist_el_card B}; m \<noteq> n\<rbrakk> \<Longrightarrow> diag_elem_indices (diag_idx_to_el B m) B \<inter> diag_elem_indices (diag_idx_to_el B n) B = {}
[PROOF STEP]
thus "diag_elem_indices (diag_idx_to_el B m) B \<inter>
    diag_elem_indices (diag_idx_to_el B p) B = {}"
[PROOF STATE]
proof (prove)
using this:
m \<in> {..<dist_el_card B}
p \<in> {..<dist_el_card B}
m \<noteq> p

goal (1 subgoal):
 1. diag_elem_indices (diag_idx_to_el B m) B \<inter> diag_elem_indices (diag_idx_to_el B p) B = {}
[PROOF STEP]
using diag_elem_indices_empty  assms fc_mats_carrier
[PROOF STATE]
proof (prove)
using this:
m \<in> {..<dist_el_card B}
p \<in> {..<dist_el_card B}
m \<noteq> p
\<lbrakk>?B \<in> carrier_mat ?dimR ?dimC; ?i < dist_el_card ?B; ?j < dist_el_card ?B; ?i \<noteq> ?j\<rbrakk> \<Longrightarrow> diag_elem_indices (diag_idx_to_el ?B ?i) ?B \<inter> diag_elem_indices (diag_idx_to_el ?B ?j) ?B = {}
B \<in> carrier_mat dimR dimC
fc_mats = carrier_mat dimR dimC

goal (1 subgoal):
 1. diag_elem_indices (diag_idx_to_el B m) B \<inter> diag_elem_indices (diag_idx_to_el B p) B = {}
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
diag_elem_indices (diag_idx_to_el B m) B \<inter> diag_elem_indices (diag_idx_to_el B p) B = {}

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma in_set_cyc_permutations:
  assumes "distinct xs"
  shows "ys \<in> set (cyc_permutations xs) \<longleftrightarrow> distinct ys \<and> set xs = set ys \<and> hd ys = hd xs" (is "?L xs ys \<longleftrightarrow> ?R xs ys")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (ys \<in> set (cyc_permutations xs)) = (distinct ys \<and> set xs = set ys \<and> hd ys = hd xs)
[PROOF STEP]
proof (cases xs)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. xs = [] \<Longrightarrow> (ys \<in> set (cyc_permutations xs)) = (distinct ys \<and> set xs = set ys \<and> hd ys = hd xs)
 2. \<And>a list. xs = a # list \<Longrightarrow> (ys \<in> set (cyc_permutations xs)) = (distinct ys \<and> set xs = set ys \<and> hd ys = hd xs)
[PROOF STEP]
case (Cons x xs)
[PROOF STATE]
proof (state)
this:
xs = x # xs

goal (2 subgoals):
 1. xs = [] \<Longrightarrow> (ys \<in> set (cyc_permutations xs)) = (distinct ys \<and> set xs = set ys \<and> hd ys = hd xs)
 2. \<And>a list. xs = a # list \<Longrightarrow> (ys \<in> set (cyc_permutations xs)) = (distinct ys \<and> set xs = set ys \<and> hd ys = hd xs)
[PROOF STEP]
with assms
[PROOF STATE]
proof (chain)
picking this:
distinct xs
xs = x # xs
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
distinct xs
xs = x # xs

goal (1 subgoal):
 1. (ys \<in> set (cyc_permutations xs)) = (distinct ys \<and> set xs = set ys \<and> hd ys = hd xs)
[PROOF STEP]
by (cases ys) (auto simp: in_set_permutations intro!: imageI)
[PROOF STATE]
proof (state)
this:
(ys \<in> set (cyc_permutations xs)) = (distinct ys \<and> set xs = set ys \<and> hd ys = hd xs)

goal (1 subgoal):
 1. xs = [] \<Longrightarrow> (ys \<in> set (cyc_permutations xs)) = (distinct ys \<and> set xs = set ys \<and> hd ys = hd xs)
[PROOF STEP]
qed auto


[STATEMENT]
lemma trms\<^sub>s\<^sub>s\<^sub>t_fv_vars\<^sub>s\<^sub>s\<^sub>t_subset: "t \<in> trms\<^sub>s\<^sub>s\<^sub>t A \<Longrightarrow> fv t \<subseteq> vars\<^sub>s\<^sub>s\<^sub>t A"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. t \<in> trms\<^sub>s\<^sub>s\<^sub>t A \<Longrightarrow> fv t \<subseteq> vars\<^sub>s\<^sub>s\<^sub>t A
[PROOF STEP]
proof (induction A)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. t \<in> trms\<^sub>s\<^sub>s\<^sub>t [] \<Longrightarrow> fv t \<subseteq> vars\<^sub>s\<^sub>s\<^sub>t []
 2. \<And>a A. \<lbrakk>t \<in> trms\<^sub>s\<^sub>s\<^sub>t A \<Longrightarrow> fv t \<subseteq> vars\<^sub>s\<^sub>s\<^sub>t A; t \<in> trms\<^sub>s\<^sub>s\<^sub>t (a # A)\<rbrakk> \<Longrightarrow> fv t \<subseteq> vars\<^sub>s\<^sub>s\<^sub>t (a # A)
[PROOF STEP]
case (Cons a A)
[PROOF STATE]
proof (state)
this:
t \<in> trms\<^sub>s\<^sub>s\<^sub>t A \<Longrightarrow> fv t \<subseteq> vars\<^sub>s\<^sub>s\<^sub>t A
t \<in> trms\<^sub>s\<^sub>s\<^sub>t (a # A)

goal (2 subgoals):
 1. t \<in> trms\<^sub>s\<^sub>s\<^sub>t [] \<Longrightarrow> fv t \<subseteq> vars\<^sub>s\<^sub>s\<^sub>t []
 2. \<And>a A. \<lbrakk>t \<in> trms\<^sub>s\<^sub>s\<^sub>t A \<Longrightarrow> fv t \<subseteq> vars\<^sub>s\<^sub>s\<^sub>t A; t \<in> trms\<^sub>s\<^sub>s\<^sub>t (a # A)\<rbrakk> \<Longrightarrow> fv t \<subseteq> vars\<^sub>s\<^sub>s\<^sub>t (a # A)
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
t \<in> trms\<^sub>s\<^sub>s\<^sub>t A \<Longrightarrow> fv t \<subseteq> vars\<^sub>s\<^sub>s\<^sub>t A
t \<in> trms\<^sub>s\<^sub>s\<^sub>t (a # A)

goal (1 subgoal):
 1. fv t \<subseteq> vars\<^sub>s\<^sub>s\<^sub>t (a # A)
[PROOF STEP]
by (cases a) auto
[PROOF STATE]
proof (state)
this:
fv t \<subseteq> vars\<^sub>s\<^sub>s\<^sub>t (a # A)

goal (1 subgoal):
 1. t \<in> trms\<^sub>s\<^sub>s\<^sub>t [] \<Longrightarrow> fv t \<subseteq> vars\<^sub>s\<^sub>s\<^sub>t []
[PROOF STEP]
qed simp


[STATEMENT]
lemma class_of_0_eq:
  assumes "U \<in> I" "U' \<in> I"
  shows "\<lfloor>U, \<zero>\<^bsub>U\<^esub>\<rfloor> = \<lfloor>U', \<zero>\<^bsub>U'\<^esub>\<rfloor>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lfloor>U, \<zero>\<^bsub>U\<^esub>\<rfloor> = \<lfloor>U', \<zero>\<^bsub>U'\<^esub>\<rfloor>
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lfloor>U, \<zero>\<^bsub>U\<^esub>\<rfloor> = \<lfloor>U', \<zero>\<^bsub>U'\<^esub>\<rfloor>
[PROOF STEP]
obtain W where W: "W \<in> I" "W \<subseteq> U" "W \<subseteq> U'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>W. \<lbrakk>W \<in> I; W \<subseteq> U; W \<subseteq> U'\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (metis Int_subset_iff assms has_lower_bound)
[PROOF STATE]
proof (state)
this:
W \<in> I
W \<subseteq> U
W \<subseteq> U'

goal (1 subgoal):
 1. \<lfloor>U, \<zero>\<^bsub>U\<^esub>\<rfloor> = \<lfloor>U', \<zero>\<^bsub>U'\<^esub>\<rfloor>
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
W \<in> I
W \<subseteq> U
W \<subseteq> U'
[PROOF STEP]
have "is_open W" "is_open U" "is_open U'"
[PROOF STATE]
proof (prove)
using this:
W \<in> I
W \<subseteq> U
W \<subseteq> U'

goal (1 subgoal):
 1. is_open W &&& is_open U &&& is_open U'
[PROOF STEP]
by (auto simp add: assms subset_of_opens)
[PROOF STATE]
proof (state)
this:
is_open W
is_open U
is_open U'

goal (1 subgoal):
 1. \<lfloor>U, \<zero>\<^bsub>U\<^esub>\<rfloor> = \<lfloor>U', \<zero>\<^bsub>U'\<^esub>\<rfloor>
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
is_open W
is_open U
is_open U'
[PROOF STEP]
have "\<rho> U W \<zero>\<^bsub>U\<^esub> = \<rho> U' W \<zero>\<^bsub>U'\<^esub>"
[PROOF STATE]
proof (prove)
using this:
is_open W
is_open U
is_open U'

goal (1 subgoal):
 1. \<rho> U W \<zero>\<^bsub>U\<^esub> = \<rho> U' W \<zero>\<^bsub>U'\<^esub>
[PROOF STEP]
using W is_ring_morphism [of U W] is_ring_morphism [of U' W]
[PROOF STATE]
proof (prove)
using this:
is_open W
is_open U
is_open U'
W \<in> I
W \<subseteq> U
W \<subseteq> U'
\<lbrakk>is_open U; is_open W; W \<subseteq> U\<rbrakk> \<Longrightarrow> ring_homomorphism (\<rho> U W) (\<FF> U) +\<^bsub>U\<^esub> \<cdot>\<^bsub>U\<^esub> \<zero>\<^bsub>U\<^esub> \<one>\<^bsub>U\<^esub> (\<FF> W) +\<^bsub>W\<^esub> \<cdot>\<^bsub>W\<^esub> \<zero>\<^bsub>W\<^esub> \<one>\<^bsub>W\<^esub>
\<lbrakk>is_open U'; is_open W; W \<subseteq> U'\<rbrakk> \<Longrightarrow> ring_homomorphism (\<rho> U' W) (\<FF> U') +\<^bsub>U'\<^esub> \<cdot>\<^bsub>U'\<^esub> \<zero>\<^bsub>U'\<^esub> \<one>\<^bsub>U'\<^esub> (\<FF> W) +\<^bsub>W\<^esub> \<cdot>\<^bsub>W\<^esub> \<zero>\<^bsub>W\<^esub> \<one>\<^bsub>W\<^esub>

goal (1 subgoal):
 1. \<rho> U W \<zero>\<^bsub>U\<^esub> = \<rho> U' W \<zero>\<^bsub>U'\<^esub>
[PROOF STEP]
by (simp add: ring_homomorphism_def group_homomorphism_def monoid_homomorphism_def
               monoid_homomorphism_axioms_def)
[PROOF STATE]
proof (state)
this:
\<rho> U W \<zero>\<^bsub>U\<^esub> = \<rho> U' W \<zero>\<^bsub>U'\<^esub>

goal (1 subgoal):
 1. \<lfloor>U, \<zero>\<^bsub>U\<^esub>\<rfloor> = \<lfloor>U', \<zero>\<^bsub>U'\<^esub>\<rfloor>
[PROOF STEP]
with W
[PROOF STATE]
proof (chain)
picking this:
W \<in> I
W \<subseteq> U
W \<subseteq> U'
\<rho> U W \<zero>\<^bsub>U\<^esub> = \<rho> U' W \<zero>\<^bsub>U'\<^esub>
[PROOF STEP]
have "\<exists>W. W \<in> I \<and> W \<subseteq> U \<and> W \<subseteq> U' \<and> \<rho> U W \<zero>\<^bsub>U\<^esub> = \<rho> U' W \<zero>\<^bsub>U'\<^esub>"
[PROOF STATE]
proof (prove)
using this:
W \<in> I
W \<subseteq> U
W \<subseteq> U'
\<rho> U W \<zero>\<^bsub>U\<^esub> = \<rho> U' W \<zero>\<^bsub>U'\<^esub>

goal (1 subgoal):
 1. \<exists>W. W \<in> I \<and> W \<subseteq> U \<and> W \<subseteq> U' \<and> \<rho> U W \<zero>\<^bsub>U\<^esub> = \<rho> U' W \<zero>\<^bsub>U'\<^esub>
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>W. W \<in> I \<and> W \<subseteq> U \<and> W \<subseteq> U' \<and> \<rho> U W \<zero>\<^bsub>U\<^esub> = \<rho> U' W \<zero>\<^bsub>U'\<^esub>

goal (1 subgoal):
 1. \<lfloor>U, \<zero>\<^bsub>U\<^esub>\<rfloor> = \<lfloor>U', \<zero>\<^bsub>U'\<^esub>\<rfloor>
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<exists>W. W \<in> I \<and> W \<subseteq> U \<and> W \<subseteq> U' \<and> \<rho> U W \<zero>\<^bsub>U\<^esub> = \<rho> U' W \<zero>\<^bsub>U'\<^esub>

goal (1 subgoal):
 1. \<lfloor>U, \<zero>\<^bsub>U\<^esub>\<rfloor> = \<lfloor>U', \<zero>\<^bsub>U'\<^esub>\<rfloor>
[PROOF STEP]
have "\<zero>\<^bsub>U\<^esub> \<in> \<FF> U" "\<zero>\<^bsub>U'\<^esub> \<in> \<FF> U'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<zero>\<^bsub>U\<^esub> \<in> \<FF> U &&& \<zero>\<^bsub>U'\<^esub> \<in> \<FF> U'
[PROOF STEP]
by (auto simp add: assms class_of_0_in)
[PROOF STATE]
proof (state)
this:
\<zero>\<^bsub>U\<^esub> \<in> \<FF> U
\<zero>\<^bsub>U'\<^esub> \<in> \<FF> U'

goal (1 subgoal):
 1. \<lfloor>U, \<zero>\<^bsub>U\<^esub>\<rfloor> = \<lfloor>U', \<zero>\<^bsub>U'\<^esub>\<rfloor>
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<exists>W. W \<in> I \<and> W \<subseteq> U \<and> W \<subseteq> U' \<and> \<rho> U W \<zero>\<^bsub>U\<^esub> = \<rho> U' W \<zero>\<^bsub>U'\<^esub>
\<zero>\<^bsub>U\<^esub> \<in> \<FF> U
\<zero>\<^bsub>U'\<^esub> \<in> \<FF> U'
[PROOF STEP]
have "(U, \<zero>\<^bsub>U\<^esub>) \<sim> (U', \<zero>\<^bsub>U'\<^esub>)"
[PROOF STATE]
proof (prove)
using this:
\<exists>W. W \<in> I \<and> W \<subseteq> U \<and> W \<subseteq> U' \<and> \<rho> U W \<zero>\<^bsub>U\<^esub> = \<rho> U' W \<zero>\<^bsub>U'\<^esub>
\<zero>\<^bsub>U\<^esub> \<in> \<FF> U
\<zero>\<^bsub>U'\<^esub> \<in> \<FF> U'

goal (1 subgoal):
 1. (U, \<zero>\<^bsub>U\<^esub>) \<sim> (U', \<zero>\<^bsub>U'\<^esub>)
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
\<exists>W. W \<in> I \<and> W \<subseteq> U \<and> W \<subseteq> U' \<and> \<rho> U W \<zero>\<^bsub>U\<^esub> = \<rho> U' W \<zero>\<^bsub>U'\<^esub>
\<zero>\<^bsub>U\<^esub> \<in> \<FF> U
\<zero>\<^bsub>U'\<^esub> \<in> \<FF> U'
U \<in> I
U' \<in> I

goal (1 subgoal):
 1. (U, \<zero>\<^bsub>U\<^esub>) \<sim> (U', \<zero>\<^bsub>U'\<^esub>)
[PROOF STEP]
by (auto simp: rel_def)
[PROOF STATE]
proof (state)
this:
(U, \<zero>\<^bsub>U\<^esub>) \<sim> (U', \<zero>\<^bsub>U'\<^esub>)

goal (1 subgoal):
 1. \<lfloor>U, \<zero>\<^bsub>U\<^esub>\<rfloor> = \<lfloor>U', \<zero>\<^bsub>U'\<^esub>\<rfloor>
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(U, \<zero>\<^bsub>U\<^esub>) \<sim> (U', \<zero>\<^bsub>U'\<^esub>)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
(U, \<zero>\<^bsub>U\<^esub>) \<sim> (U', \<zero>\<^bsub>U'\<^esub>)

goal (1 subgoal):
 1. \<lfloor>U, \<zero>\<^bsub>U\<^esub>\<rfloor> = \<lfloor>U', \<zero>\<^bsub>U'\<^esub>\<rfloor>
[PROOF STEP]
unfolding class_of_def
[PROOF STATE]
proof (prove)
using this:
(U, \<zero>\<^bsub>U\<^esub>) \<sim> (U', \<zero>\<^bsub>U'\<^esub>)

goal (1 subgoal):
 1. rel.Class (U, \<zero>\<^bsub>U\<^esub>) = rel.Class (U', \<zero>\<^bsub>U'\<^esub>)
[PROOF STEP]
by (simp add: rel.Class_eq)
[PROOF STATE]
proof (state)
this:
\<lfloor>U, \<zero>\<^bsub>U\<^esub>\<rfloor> = \<lfloor>U', \<zero>\<^bsub>U'\<^esub>\<rfloor>

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma continuous_logarithm_on_contractible:
  fixes f :: "'a::real_normed_vector \<Rightarrow> complex"
  assumes "continuous_on S f" "contractible S" "\<And>z. z \<in> S \<Longrightarrow> f z \<noteq> 0"
  obtains g where "continuous_on S g" "\<And>x. x \<in> S \<Longrightarrow> f x = exp(g x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>g. \<lbrakk>continuous_on S g; \<And>x. x \<in> S \<Longrightarrow> f x = exp (g x)\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (\<And>g. \<lbrakk>continuous_on S g; \<And>x. x \<in> S \<Longrightarrow> f x = exp (g x)\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
obtain c where hom: "homotopic_with_canon (\<lambda>h. True) S (-{0}) f (\<lambda>x. c)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>c. homotopic_with_canon (\<lambda>h. True) S (- {0}) f (\<lambda>x. c) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using nullhomotopic_from_contractible assms
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>continuous_on ?S ?f; ?f ` ?S \<subseteq> ?T; contractible ?S; \<And>c. homotopic_with_canon (\<lambda>h. True) ?S ?T ?f (\<lambda>x. c) \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis
continuous_on S f
contractible S
?z \<in> S \<Longrightarrow> f ?z \<noteq> 0

goal (1 subgoal):
 1. (\<And>c. homotopic_with_canon (\<lambda>h. True) S (- {0}) f (\<lambda>x. c) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (metis imageE subset_Compl_singleton)
[PROOF STATE]
proof (state)
this:
homotopic_with_canon (\<lambda>h. True) S (- {0}) f (\<lambda>x. c)

goal (1 subgoal):
 1. (\<And>g. \<lbrakk>continuous_on S g; \<And>x. x \<in> S \<Longrightarrow> f x = exp (g x)\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
homotopic_with_canon (\<lambda>h. True) S (- {0}) f (\<lambda>x. c)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
homotopic_with_canon (\<lambda>h. True) S (- {0}) f (\<lambda>x. c)

goal (1 subgoal):
 1. thesis
[PROOF STEP]
by (metis inessential_eq_continuous_logarithm that)
[PROOF STATE]
proof (state)
this:
thesis

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma product_universe_implies_factor_universe:
  "O x y \<Longrightarrow> x \<otimes> y = u \<Longrightarrow> x = u"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>O x y; x \<otimes> y = u\<rbrakk> \<Longrightarrow> x = u
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>O x y; x \<otimes> y = u\<rbrakk> \<Longrightarrow> x = u
[PROOF STEP]
assume "x \<otimes> y = u"
[PROOF STATE]
proof (state)
this:
x \<otimes> y = u

goal (1 subgoal):
 1. \<lbrakk>O x y; x \<otimes> y = u\<rbrakk> \<Longrightarrow> x = u
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
x \<otimes> y = u

goal (1 subgoal):
 1. \<lbrakk>O x y; x \<otimes> y = u\<rbrakk> \<Longrightarrow> x = u
[PROOF STEP]
assume "O x y"
[PROOF STATE]
proof (state)
this:
O x y

goal (1 subgoal):
 1. \<lbrakk>O x y; x \<otimes> y = u\<rbrakk> \<Longrightarrow> x = u
[PROOF STEP]
hence "P (x \<otimes> y) x"
[PROOF STATE]
proof (prove)
using this:
O x y

goal (1 subgoal):
 1. P (x \<otimes> y) x
[PROOF STEP]
by (rule product_in_first_factor)
[PROOF STATE]
proof (state)
this:
P (x \<otimes> y) x

goal (1 subgoal):
 1. \<lbrakk>O x y; x \<otimes> y = u\<rbrakk> \<Longrightarrow> x = u
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
x \<otimes> y = u
P (x \<otimes> y) x
[PROOF STEP]
have "P u x"
[PROOF STATE]
proof (prove)
using this:
x \<otimes> y = u
P (x \<otimes> y) x

goal (1 subgoal):
 1. P u x
[PROOF STEP]
by (rule subst)
[PROOF STATE]
proof (state)
this:
P u x

goal (1 subgoal):
 1. \<lbrakk>O x y; x \<otimes> y = u\<rbrakk> \<Longrightarrow> x = u
[PROOF STEP]
with universe_character
[PROOF STATE]
proof (chain)
picking this:
P ?x u
P u x
[PROOF STEP]
show "x = u"
[PROOF STATE]
proof (prove)
using this:
P ?x u
P u x

goal (1 subgoal):
 1. x = u
[PROOF STEP]
by (rule part_antisymmetry)
[PROOF STATE]
proof (state)
this:
x = u

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma zmult_div_ge_0:"\<lbrakk> (0::int) \<le> x; 0 \<le> a; 0 < c \<rbrakk> \<Longrightarrow> 0 \<le> a * x div c"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> x; 0 \<le> a; 0 < c\<rbrakk> \<Longrightarrow> 0 \<le> a * x div c
[PROOF STEP]
by (metis pos_imp_zdiv_nonneg_iff split_mult_pos_le)


[STATEMENT]
lemma (in Group) rcs_fixed:"\<lbrakk>G \<guillemotright> H; a \<in> carrier G; H \<bullet> a = H\<rbrakk>  \<Longrightarrow> a \<in> H"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>G \<guillemotright> H ; a \<in> carrier G; H \<bullet> a = H\<rbrakk> \<Longrightarrow> a \<in> H
[PROOF STEP]
by (frule a_in_rcs[of "H" "a"], assumption+, simp)


[STATEMENT]
lemma sort_set_unique_h:
  assumes "irreflp r \<and> transp r"
  assumes "set (x#xs) = set (y#ys)"
  assumes "\<forall>z \<in> set xs. r x z"
  assumes "\<forall>z \<in> set ys. r y z"
  shows "x = y \<and> set xs = set ys"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x = y \<and> set xs = set ys
[PROOF STEP]
by (metis assms insert_eq_iff irreflp_def list.set_intros(1)
      list.simps(15) set_ConsD transpD)


[STATEMENT]
lemma take_Suc: "take (Suc n) xs = (if xs = [] then [] else hd xs # take n (tl xs))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. take (Suc n) xs = (if xs = [] then [] else hd xs # take n (tl xs))
[PROOF STEP]
by (simp add: take_Suc)


[STATEMENT]
lemma flists_elem_uniq: "\<lbrakk> x \<in> flists A; x \<in> flists B \<rbrakk> \<Longrightarrow> A = B"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>x \<in> flists A; x \<in> flists B\<rbrakk> \<Longrightarrow> A = B
[PROOF STEP]
by (simp add: flists_def)


[STATEMENT]
lemma \<gamma>_inf_rep: "\<gamma>_rep(inf_rep p1 p2) = \<gamma>_rep p1 \<inter> \<gamma>_rep p2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<gamma>_rep (inf_rep p1 p2) = \<gamma>_rep p1 \<inter> \<gamma>_rep p2
[PROOF STEP]
by(auto simp:inf_rep_def \<gamma>_rep_cases split: prod.splits extended.splits)


[STATEMENT]
lemma integrable_std_normal_moment: "integrable lborel (\<lambda>x. std_normal_density x * x^k)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. integrable lborel (\<lambda>x. std_normal_density x * x ^ k)
[PROOF STEP]
using integrable_normal_moment[of 1 0 k]
[PROOF STATE]
proof (prove)
using this:
0 < 1 \<Longrightarrow> integrable lborel (\<lambda>x. std_normal_density x * (x - 0) ^ k)

goal (1 subgoal):
 1. integrable lborel (\<lambda>x. std_normal_density x * x ^ k)
[PROOF STEP]
by simp


[STATEMENT]
lemma in_set_take_conv_nth:
  "x \<in> set (take n xs) \<longleftrightarrow> (\<exists>i<min n (length xs). xs ! i = x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (x \<in> set (take n xs)) = (\<exists>i<min n (length xs). xs ! i = x)
[PROOF STEP]
by (simp add: in_set_conv_iff)


[STATEMENT]
lemma real_int_of_real[simp]: "real_is_int x \<Longrightarrow> real_of_int (int_of_real x) = x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. real_is_int x \<Longrightarrow> real_of_int (int_of_real x) = x
[PROOF STEP]
by (auto simp add: int_of_real_def real_is_int_def)


[STATEMENT]
lemma unat_less_2p_word_bits:
  "unat (x :: machine_word) < 2 ^ word_bits"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. unat x < 2 ^ word_bits
[PROOF STEP]
apply (simp only: word_bits_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. unat x < 2 ^ LENGTH(64)
[PROOF STEP]
apply (rule unat_lt2p)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma ring_finite_field_ops64: "ring_ops (finite_field_ops64 pp) mod_ring_rel64"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ring_ops (finite_field_ops64 pp) mod_ring_rel64
[PROOF STEP]
by (unfold_locales, auto simp:
  finite_field_ops64_def
  bi_unique_mod_ring_rel64
  right_total_mod_ring_rel64
  mod_ring_plus64
  mod_ring_minus64
  mod_ring_uminus64
  mod_ring_mult64
  mod_ring_eq64
  mod_ring_0_64
  mod_ring_1_64
  Domainp_mod_ring_rel64)


[STATEMENT]
lemma vlrestriction_vconst_on: "(vconst_on A c) \<restriction>\<^sup>l\<^sub>\<circ> B = (vconst_on B c) \<restriction>\<^sup>l\<^sub>\<circ> A"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vconst_on A c \<restriction>\<^sup>l\<^sub>\<circ> B = vconst_on B c \<restriction>\<^sup>l\<^sub>\<circ> A
[PROOF STEP]
by auto


[STATEMENT]
lemma sequent_pseq: "sequent (pseq fs) = fs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. sequent (pseq fs) = fs
[PROOF STEP]
by (simp add: pseq_def sequent_def snd_o_Pair)


[STATEMENT]
lemma mod_word_by_minus_1_eq [simp]:
  \<open>w mod - 1 = w * of_bool (w < - 1)\<close> for w :: \<open>'a::len word\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. w mod - 1 = w * of_bool (w < - 1)
[PROOF STEP]
proof (cases \<open>w = - 1\<close>)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. w = - 1 \<Longrightarrow> w mod - 1 = w * of_bool (w < - 1)
 2. w \<noteq> - 1 \<Longrightarrow> w mod - 1 = w * of_bool (w < - 1)
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
w = - 1

goal (2 subgoals):
 1. w = - 1 \<Longrightarrow> w mod - 1 = w * of_bool (w < - 1)
 2. w \<noteq> - 1 \<Longrightarrow> w mod - 1 = w * of_bool (w < - 1)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
w = - 1
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
w = - 1

goal (1 subgoal):
 1. w mod - 1 = w * of_bool (w < - 1)
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
w mod - 1 = w * of_bool (w < - 1)

goal (1 subgoal):
 1. w \<noteq> - 1 \<Longrightarrow> w mod - 1 = w * of_bool (w < - 1)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. w \<noteq> - 1 \<Longrightarrow> w mod - 1 = w * of_bool (w < - 1)
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
w \<noteq> - 1

goal (1 subgoal):
 1. w \<noteq> - 1 \<Longrightarrow> w mod - 1 = w * of_bool (w < - 1)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
w \<noteq> - 1

goal (1 subgoal):
 1. w \<noteq> - 1 \<Longrightarrow> w mod - 1 = w * of_bool (w < - 1)
[PROOF STEP]
have \<open>w < - 1\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. w < - 1
[PROOF STEP]
using False
[PROOF STATE]
proof (prove)
using this:
w \<noteq> - 1

goal (1 subgoal):
 1. w < - 1
[PROOF STEP]
by (simp add: word_order.not_eq_extremum)
[PROOF STATE]
proof (state)
this:
w < - 1

goal (1 subgoal):
 1. w \<noteq> - 1 \<Longrightarrow> w mod - 1 = w * of_bool (w < - 1)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
w \<noteq> - 1
w < - 1
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
w \<noteq> - 1
w < - 1

goal (1 subgoal):
 1. w mod - 1 = w * of_bool (w < - 1)
[PROOF STEP]
by (simp add: mod_word_less)
[PROOF STATE]
proof (state)
this:
w mod - 1 = w * of_bool (w < - 1)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma SeqQuoteP_subst [simp]:
      "(SeqQuoteP t u s k)(j::=w) =
       SeqQuoteP (subst j w t) (subst j w u) (subst j w s) (subst j w k)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (SeqQuoteP t u s k)(j::=w) = SeqQuoteP (subst j w t) (subst j w u) (subst j w s) (subst j w k)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (SeqQuoteP t u s k)(j::=w) = SeqQuoteP (subst j w t) (subst j w u) (subst j w s) (subst j w k)
[PROOF STEP]
obtain l::name and sl::name and sl'::name and m::name and n::name and
         sm::name and sm'::name and sn::name and sn'::name
    where "atom l \<sharp> (s,k,w,j,sl,sl',m,n,sm,sm',sn,sn')"
          "atom sl \<sharp> (s,w,j,sl',m,n,sm,sm',sn,sn')"  "atom sl' \<sharp> (s,w,j,m,n,sm,sm',sn,sn')"
          "atom m \<sharp> (s,w,j,n,sm,sm',sn,sn')"  "atom n \<sharp> (s,w,j,sm,sm',sn,sn')"
          "atom sm \<sharp> (s,w,j,sm',sn,sn')"  "atom sm' \<sharp> (s,w,j,sn,sn')"
          "atom sn \<sharp> (s,w,j,sn')"  "atom sn' \<sharp> (s,w,j)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>l sl sl' m n sm sm' sn sn'. \<lbrakk>atom l \<sharp> (s, k, w, j, sl, sl', m, n, sm, sm', sn, sn'); atom sl \<sharp> (s, w, j, sl', m, n, sm, sm', sn, sn'); atom sl' \<sharp> (s, w, j, m, n, sm, sm', sn, sn'); atom m \<sharp> (s, w, j, n, sm, sm', sn, sn'); atom n \<sharp> (s, w, j, sm, sm', sn, sn'); atom sm \<sharp> (s, w, j, sm', sn, sn'); atom sm' \<sharp> (s, w, j, sn, sn'); atom sn \<sharp> (s, w, j, sn'); atom sn' \<sharp> (s, w, j)\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (metis obtain_fresh)
[PROOF STATE]
proof (state)
this:
atom l \<sharp> (s, k, w, j, sl, sl', m, n, sm, sm', sn, sn')
atom sl \<sharp> (s, w, j, sl', m, n, sm, sm', sn, sn')
atom sl' \<sharp> (s, w, j, m, n, sm, sm', sn, sn')
atom m \<sharp> (s, w, j, n, sm, sm', sn, sn')
atom n \<sharp> (s, w, j, sm, sm', sn, sn')
atom sm \<sharp> (s, w, j, sm', sn, sn')
atom sm' \<sharp> (s, w, j, sn, sn')
atom sn \<sharp> (s, w, j, sn')
atom sn' \<sharp> (s, w, j)

goal (1 subgoal):
 1. (SeqQuoteP t u s k)(j::=w) = SeqQuoteP (subst j w t) (subst j w u) (subst j w s) (subst j w k)
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
atom l \<sharp> (s, k, w, j, sl, sl', m, n, sm, sm', sn, sn')
atom sl \<sharp> (s, w, j, sl', m, n, sm, sm', sn, sn')
atom sl' \<sharp> (s, w, j, m, n, sm, sm', sn, sn')
atom m \<sharp> (s, w, j, n, sm, sm', sn, sn')
atom n \<sharp> (s, w, j, sm, sm', sn, sn')
atom sm \<sharp> (s, w, j, sm', sn, sn')
atom sm' \<sharp> (s, w, j, sn, sn')
atom sn \<sharp> (s, w, j, sn')
atom sn' \<sharp> (s, w, j)

goal (1 subgoal):
 1. (SeqQuoteP t u s k)(j::=w) = SeqQuoteP (subst j w t) (subst j w u) (subst j w s) (subst j w k)
[PROOF STEP]
by (force simp add: SeqQuoteP.simps [of l _ _ sl sl' m n sm sm' sn sn'])
[PROOF STATE]
proof (state)
this:
(SeqQuoteP t u s k)(j::=w) = SeqQuoteP (subst j w t) (subst j w u) (subst j w s) (subst j w k)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma antisymPD: "\<lbrakk> antisymp r; r a b; r b a \<rbrakk> \<Longrightarrow> a = b"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>antisymp r; r a b; r b a\<rbrakk> \<Longrightarrow> a = b
[PROOF STEP]
by (fact antisympD)


[STATEMENT]
lemma lucas_lehmer_hom_cong:
  "[fst x = fst y] (mod int m) \<Longrightarrow> [snd x = snd y] (mod int m) \<Longrightarrow>
   lucas_lehmer_hom m x = lucas_lehmer_hom m y"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>[fst x = fst y] (mod int m); [snd x = snd y] (mod int m)\<rbrakk> \<Longrightarrow> lucas_lehmer_hom m x = lucas_lehmer_hom m y
[PROOF STEP]
by (auto simp: lucas_lehmer_hom_def cong_def case_prod_unfold)


[STATEMENT]
lemma equiv_segments_SC_rel: "equiv segments SC_rel"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. equiv segments SC_rel
[PROOF STEP]
by (simp add: equiv_def SC_rel_refl SC_rel_sym SC_rel_trans)


[STATEMENT]
lemma lemma_2:
  fixes PROB :: "'a problem" and as :: "('a action) list" and s :: "'a state"
  assumes "finite PROB" "s \<in> (valid_states PROB)" "(as \<in> valid_plans PROB)"
    "((length as) > (2 ^ (card (fmdom' s)) - 1))"
  shows "(\<exists>as1 as2 as3.
    (as1 @ as2 @ as3 = as)
    \<and> (exec_plan s (as1 @ as2) = exec_plan s as1)
    \<and> \<not>(as2 = [])
  )"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
[PROOF STEP]
have "Suc (length as) > 2^(card (fmdom' s))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 2 ^ card (fmdom' s) < Suc (length as)
[PROOF STEP]
using assms(4)
[PROOF STATE]
proof (prove)
using this:
2 ^ card (fmdom' s) - 1 < length as

goal (1 subgoal):
 1. 2 ^ card (fmdom' s) < Suc (length as)
[PROOF STEP]
by linarith
[PROOF STATE]
proof (state)
this:
2 ^ card (fmdom' s) < Suc (length as)

goal (1 subgoal):
 1. \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
2 ^ card (fmdom' s) < Suc (length as)
[PROOF STEP]
have 1: "card (state_set (state_list s as)) > 2^card (fmdom' s)"
[PROOF STATE]
proof (prove)
using this:
2 ^ card (fmdom' s) < Suc (length as)

goal (1 subgoal):
 1. 2 ^ card (fmdom' s) < card (state_set (state_list s as))
[PROOF STEP]
using card_state_set[symmetric]
[PROOF STATE]
proof (prove)
using this:
2 ^ card (fmdom' s) < Suc (length as)
card (state_set (state_list ?s ?as)) = Suc (length ?as)

goal (1 subgoal):
 1. 2 ^ card (fmdom' s) < card (state_set (state_list s as))
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
2 ^ card (fmdom' s) < card (state_set (state_list s as))

goal (1 subgoal):
 1. \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
[PROOF STEP]
{
    \<comment> \<open>NOTE type of 'valid\_states PROB' had to be asserted to match 'FINITE\_valid\_states'.\<close>
[PROOF STATE]
proof (state)
this:
2 ^ card (fmdom' s) < card (state_set (state_list s as))

goal (1 subgoal):
 1. \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
[PROOF STEP]
have 2: "finite (prob_dom PROB)" "finite ((valid_states PROB)  :: 'a state set)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. finite (prob_dom PROB) &&& finite (valid_states PROB)
[PROOF STEP]
using assms(1) FINITE_prob_dom FINITE_valid_states
[PROOF STATE]
proof (prove)
using this:
finite PROB
finite ?PROB \<Longrightarrow> finite (prob_dom ?PROB)
finite ?PROB \<Longrightarrow> finite (valid_states ?PROB)

goal (1 subgoal):
 1. finite (prob_dom PROB) &&& finite (valid_states PROB)
[PROOF STEP]
by blast+
[PROOF STATE]
proof (state)
this:
finite (prob_dom PROB)
finite (valid_states PROB)

goal (1 subgoal):
 1. \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
[PROOF STEP]
have 3: "fmdom' s = prob_dom PROB"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fmdom' s = prob_dom PROB
[PROOF STEP]
using assms(2) valid_states_def
[PROOF STATE]
proof (prove)
using this:
s \<in> valid_states PROB
valid_states ?prob \<equiv> {s. fmdom' s = prob_dom ?prob}

goal (1 subgoal):
 1. fmdom' s = prob_dom PROB
[PROOF STEP]
by fast
[PROOF STATE]
proof (state)
this:
fmdom' s = prob_dom PROB

goal (1 subgoal):
 1. \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
fmdom' s = prob_dom PROB
[PROOF STEP]
have "card ((valid_states PROB) :: 'a state set) = 2^card (fmdom' s)"
[PROOF STATE]
proof (prove)
using this:
fmdom' s = prob_dom PROB

goal (1 subgoal):
 1. card (valid_states PROB) = 2 ^ card (fmdom' s)
[PROOF STEP]
using assms(1) CARD_valid_states
[PROOF STATE]
proof (prove)
using this:
fmdom' s = prob_dom PROB
finite PROB
finite ?PROB \<Longrightarrow> card (valid_states ?PROB) = 2 ^ card (prob_dom ?PROB)

goal (1 subgoal):
 1. card (valid_states PROB) = 2 ^ card (fmdom' s)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
card (valid_states PROB) = 2 ^ card (fmdom' s)

goal (1 subgoal):
 1. \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
card (valid_states PROB) = 2 ^ card (fmdom' s)
[PROOF STEP]
have 4: "card (state_set (state_list (s :: 'a state) as)) > card ((valid_states PROB) :: 'a state set)"
[PROOF STATE]
proof (prove)
using this:
card (valid_states PROB) = 2 ^ card (fmdom' s)

goal (1 subgoal):
 1. card (valid_states PROB) < card (state_set (state_list s as))
[PROOF STEP]
unfolding valid_states_def
[PROOF STATE]
proof (prove)
using this:
card {s. fmdom' s = prob_dom PROB} = 2 ^ card (fmdom' s)

goal (1 subgoal):
 1. card {s. fmdom' s = prob_dom PROB} < card (state_set (state_list s as))
[PROOF STEP]
using 1 2(1) 3 card_of_set_of_all_possible_states[of "prob_dom PROB"]
[PROOF STATE]
proof (prove)
using this:
card {s. fmdom' s = prob_dom PROB} = 2 ^ card (fmdom' s)
2 ^ card (fmdom' s) < card (state_set (state_list s as))
finite (prob_dom PROB)
fmdom' s = prob_dom PROB
finite (prob_dom PROB) \<Longrightarrow> card {s. fmdom' s = prob_dom PROB} = 2 ^ card (prob_dom PROB)

goal (1 subgoal):
 1. card {s. fmdom' s = prob_dom PROB} < card (state_set (state_list s as))
[PROOF STEP]
by argo
        \<comment> \<open>TODO refactor into lemma.\<close>
[PROOF STATE]
proof (state)
this:
card (valid_states PROB) < card (state_set (state_list s as))

goal (1 subgoal):
 1. \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
card (valid_states PROB) < card (state_set (state_list s as))

goal (1 subgoal):
 1. \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
[PROOF STEP]
let ?S="state_set (state_list (s :: 'a state) as)"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
[PROOF STEP]
let ?T="valid_states PROB :: 'a state set"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
[PROOF STEP]
assume C2: "inj_on last ?S"
        \<comment> \<open>TODO unwrap the metis step or refactor into lemma.\<close>
[PROOF STATE]
proof (state)
this:
inj_on last (state_set (state_list s as))

goal (1 subgoal):
 1. \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
[PROOF STEP]
have a: "?T \<subseteq> last ` ?S"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. valid_states PROB \<subseteq> last ` state_set (state_list s as)
[PROOF STEP]
using C2
[PROOF STATE]
proof (prove)
using this:
inj_on last (state_set (state_list s as))

goal (1 subgoal):
 1. valid_states PROB \<subseteq> last ` state_set (state_list s as)
[PROOF STEP]
by (metis "2"(2) "4" assms(2) assms(3) card_image card_mono lemma_1 not_less)
[PROOF STATE]
proof (state)
this:
valid_states PROB \<subseteq> last ` state_set (state_list s as)

goal (1 subgoal):
 1. \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
[PROOF STEP]
have "finite (state_set (state_list s as))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. finite (state_set (state_list s as))
[PROOF STEP]
using state_set_finite
[PROOF STATE]
proof (prove)
using this:
finite (state_set ?X)

goal (1 subgoal):
 1. finite (state_set (state_list s as))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
finite (state_set (state_list s as))

goal (1 subgoal):
 1. \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
finite (state_set (state_list s as))
[PROOF STEP]
have "card (last ` ?S) = card ?S"
[PROOF STATE]
proof (prove)
using this:
finite (state_set (state_list s as))

goal (1 subgoal):
 1. card (last ` state_set (state_list s as)) = card (state_set (state_list s as))
[PROOF STEP]
using C2 inj_on_iff_eq_card
[PROOF STATE]
proof (prove)
using this:
finite (state_set (state_list s as))
inj_on last (state_set (state_list s as))
finite ?A \<Longrightarrow> inj_on ?f ?A = (card (?f ` ?A) = card ?A)

goal (1 subgoal):
 1. card (last ` state_set (state_list s as)) = card (state_set (state_list s as))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
card (last ` state_set (state_list s as)) = card (state_set (state_list s as))

goal (1 subgoal):
 1. \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
card (last ` state_set (state_list s as)) = card (state_set (state_list s as))

goal (1 subgoal):
 1. \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
[PROOF STEP]
have "\<dots> > card ?T"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. card (valid_states PROB) < card (state_set (state_list s as))
[PROOF STEP]
using 4
[PROOF STATE]
proof (prove)
using this:
card (valid_states PROB) < card (state_set (state_list s as))

goal (1 subgoal):
 1. card (valid_states PROB) < card (state_set (state_list s as))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
card (valid_states PROB) < card (state_set (state_list s as))

goal (1 subgoal):
 1. \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
card (valid_states PROB) < card (state_set (state_list s as))
[PROOF STEP]
have "\<exists>x. x \<in> (last ` ?S) \<and> x \<notin> ?T"
[PROOF STATE]
proof (prove)
using this:
card (valid_states PROB) < card (state_set (state_list s as))

goal (1 subgoal):
 1. \<exists>x. x \<in> last ` state_set (state_list s as) \<and> x \<notin> valid_states PROB
[PROOF STEP]
using C2 a assms(2) assms(3) calculation lemma_1
[PROOF STATE]
proof (prove)
using this:
card (valid_states PROB) < card (state_set (state_list s as))
inj_on last (state_set (state_list s as))
valid_states PROB \<subseteq> last ` state_set (state_list s as)
s \<in> valid_states PROB
as \<in> valid_plans PROB
card (last ` state_set (state_list s as)) = card (state_set (state_list s as))
\<lbrakk>?s \<in> valid_states ?PROB; ?as \<in> valid_plans ?PROB\<rbrakk> \<Longrightarrow> last ` state_set (state_list ?s ?as) \<subseteq> valid_states ?PROB

goal (1 subgoal):
 1. \<exists>x. x \<in> last ` state_set (state_list s as) \<and> x \<notin> valid_states PROB
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
\<exists>x. x \<in> last ` state_set (state_list s as) \<and> x \<notin> valid_states PROB

goal (1 subgoal):
 1. \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
inj_on last (state_set (state_list s as)) \<Longrightarrow> \<exists>x. x \<in> last ` state_set (state_list s as) \<and> x \<notin> valid_states PROB

goal (1 subgoal):
 1. \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
[PROOF STEP]
note 5 = this
[PROOF STATE]
proof (state)
this:
inj_on last (state_set (state_list s as)) \<Longrightarrow> \<exists>x. x \<in> last ` state_set (state_list s as) \<and> x \<notin> valid_states PROB

goal (1 subgoal):
 1. \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
inj_on last (state_set (state_list s as)) \<Longrightarrow> \<exists>x. x \<in> last ` state_set (state_list s as) \<and> x \<notin> valid_states PROB

goal (1 subgoal):
 1. \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
inj_on last (state_set (state_list s as)) \<Longrightarrow> \<exists>x. x \<in> last ` state_set (state_list s as) \<and> x \<notin> valid_states PROB

goal (1 subgoal):
 1. \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
[PROOF STEP]
assume C: "inj last (state_set (state_list (s :: 'a state) as)) (valid_states PROB)"
[PROOF STATE]
proof (state)
this:
FactoredSystem.inj last (state_set (state_list s as)) (valid_states PROB)

goal (1 subgoal):
 1. \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
FactoredSystem.inj last (state_set (state_list s as)) (valid_states PROB)
[PROOF STEP]
have "inj_on last (state_set (state_list (s :: 'a state) as))"
[PROOF STATE]
proof (prove)
using this:
FactoredSystem.inj last (state_set (state_list s as)) (valid_states PROB)

goal (1 subgoal):
 1. inj_on last (state_set (state_list s as))
[PROOF STEP]
using C inj_def
[PROOF STATE]
proof (prove)
using this:
FactoredSystem.inj last (state_set (state_list s as)) (valid_states PROB)
FactoredSystem.inj last (state_set (state_list s as)) (valid_states PROB)
FactoredSystem.inj ?f ?A ?B \<equiv> (\<forall>x\<in>?A. ?f x \<in> ?B) \<and> inj_on ?f ?A

goal (1 subgoal):
 1. inj_on last (state_set (state_list s as))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
inj_on last (state_set (state_list s as))

goal (1 subgoal):
 1. \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
inj_on last (state_set (state_list s as))
[PROOF STEP]
obtain x where "x \<in> last ` (state_set (state_list s as)) \<and> x \<notin> valid_states PROB"
[PROOF STATE]
proof (prove)
using this:
inj_on last (state_set (state_list s as))

goal (1 subgoal):
 1. (\<And>x. x \<in> last ` state_set (state_list s as) \<and> x \<notin> valid_states PROB \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using 5
[PROOF STATE]
proof (prove)
using this:
inj_on last (state_set (state_list s as))
inj_on last (state_set (state_list s as)) \<Longrightarrow> \<exists>x. x \<in> last ` state_set (state_list s as) \<and> x \<notin> valid_states PROB

goal (1 subgoal):
 1. (\<And>x. x \<in> last ` state_set (state_list s as) \<and> x \<notin> valid_states PROB \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by presburger
[PROOF STATE]
proof (state)
this:
x \<in> last ` state_set (state_list s as) \<and> x \<notin> valid_states PROB

goal (1 subgoal):
 1. \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
x \<in> last ` state_set (state_list s as) \<and> x \<notin> valid_states PROB
[PROOF STEP]
have "\<not>(\<forall>x\<in>state_set (state_list s as). last x \<in> valid_states PROB)"
[PROOF STATE]
proof (prove)
using this:
x \<in> last ` state_set (state_list s as) \<and> x \<notin> valid_states PROB

goal (1 subgoal):
 1. \<not> (\<forall>x\<in>state_set (state_list s as). last x \<in> valid_states PROB)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<not> (\<forall>x\<in>state_set (state_list s as). last x \<in> valid_states PROB)

goal (1 subgoal):
 1. \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<not> (\<forall>x\<in>state_set (state_list s as). last x \<in> valid_states PROB)
[PROOF STEP]
have "\<not>inj last (state_set (state_list (s :: 'a state) as)) (valid_states PROB)"
[PROOF STATE]
proof (prove)
using this:
\<not> (\<forall>x\<in>state_set (state_list s as). last x \<in> valid_states PROB)

goal (1 subgoal):
 1. \<not> FactoredSystem.inj last (state_set (state_list s as)) (valid_states PROB)
[PROOF STEP]
using inj_def
[PROOF STATE]
proof (prove)
using this:
\<not> (\<forall>x\<in>state_set (state_list s as). last x \<in> valid_states PROB)
FactoredSystem.inj ?f ?A ?B \<equiv> (\<forall>x\<in>?A. ?f x \<in> ?B) \<and> inj_on ?f ?A

goal (1 subgoal):
 1. \<not> FactoredSystem.inj last (state_set (state_list s as)) (valid_states PROB)
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
\<not> FactoredSystem.inj last (state_set (state_list s as)) (valid_states PROB)

goal (1 subgoal):
 1. \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<not> FactoredSystem.inj last (state_set (state_list s as)) (valid_states PROB)
[PROOF STEP]
have False
[PROOF STATE]
proof (prove)
using this:
\<not> FactoredSystem.inj last (state_set (state_list s as)) (valid_states PROB)

goal (1 subgoal):
 1. False
[PROOF STEP]
using C
[PROOF STATE]
proof (prove)
using this:
\<not> FactoredSystem.inj last (state_set (state_list s as)) (valid_states PROB)
FactoredSystem.inj last (state_set (state_list s as)) (valid_states PROB)

goal (1 subgoal):
 1. False
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
False

goal (1 subgoal):
 1. \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
FactoredSystem.inj last (state_set (state_list s as)) (valid_states PROB) \<Longrightarrow> False

goal (1 subgoal):
 1. \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
inj_on last (state_set (state_list s as)) \<Longrightarrow> \<exists>x. x \<in> last ` state_set (state_list s as) \<and> x \<notin> valid_states PROB
FactoredSystem.inj last (state_set (state_list s as)) (valid_states PROB) \<Longrightarrow> False
[PROOF STEP]
have "\<not>inj last (state_set (state_list (s :: 'a state) as)) (valid_states PROB)"
[PROOF STATE]
proof (prove)
using this:
inj_on last (state_set (state_list s as)) \<Longrightarrow> \<exists>x. x \<in> last ` state_set (state_list s as) \<and> x \<notin> valid_states PROB
FactoredSystem.inj last (state_set (state_list s as)) (valid_states PROB) \<Longrightarrow> False

goal (1 subgoal):
 1. \<not> FactoredSystem.inj last (state_set (state_list s as)) (valid_states PROB)
[PROOF STEP]
unfolding inj_def
[PROOF STATE]
proof (prove)
using this:
inj_on last (state_set (state_list s as)) \<Longrightarrow> \<exists>x. x \<in> last ` state_set (state_list s as) \<and> x \<notin> valid_states PROB
(\<forall>x\<in>state_set (state_list s as). last x \<in> valid_states PROB) \<and> inj_on last (state_set (state_list s as)) \<Longrightarrow> False

goal (1 subgoal):
 1. \<not> ((\<forall>x\<in>state_set (state_list s as). last x \<in> valid_states PROB) \<and> inj_on last (state_set (state_list s as)))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<not> FactoredSystem.inj last (state_set (state_list s as)) (valid_states PROB)

goal (1 subgoal):
 1. \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
\<not> FactoredSystem.inj last (state_set (state_list s as)) (valid_states PROB)

goal (1 subgoal):
 1. \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<not> FactoredSystem.inj last (state_set (state_list s as)) (valid_states PROB)
[PROOF STEP]
obtain slist_1 slist_2 where 6:
    "slist_1 \<in> state_set (state_list s as)"
    "slist_2 \<in> state_set (state_list s as)"
    "(last slist_1 = last slist_2)"
    "length slist_1 \<noteq> length slist_2"
[PROOF STATE]
proof (prove)
using this:
\<not> FactoredSystem.inj last (state_set (state_list s as)) (valid_states PROB)

goal (1 subgoal):
 1. (\<And>slist_1 slist_2. \<lbrakk>slist_1 \<in> state_set (state_list s as); slist_2 \<in> state_set (state_list s as); last slist_1 = last slist_2; length slist_1 \<noteq> length slist_2\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using assms(2, 3) not_eq_last_diff_paths
[PROOF STATE]
proof (prove)
using this:
\<not> FactoredSystem.inj last (state_set (state_list s as)) (valid_states PROB)
s \<in> valid_states PROB
as \<in> valid_plans PROB
\<lbrakk>?s \<in> valid_states ?PROB; ?as \<in> valid_plans ?PROB; \<not> FactoredSystem.inj last (state_set (state_list ?s ?as)) (valid_states ?PROB)\<rbrakk> \<Longrightarrow> \<exists>slist_1 slist_2. slist_1 \<in> state_set (state_list ?s ?as) \<and> slist_2 \<in> state_set (state_list ?s ?as) \<and> last slist_1 = last slist_2 \<and> length slist_1 \<noteq> length slist_2

goal (1 subgoal):
 1. (\<And>slist_1 slist_2. \<lbrakk>slist_1 \<in> state_set (state_list s as); slist_2 \<in> state_set (state_list s as); last slist_1 = last slist_2; length slist_1 \<noteq> length slist_2\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
slist_1 \<in> state_set (state_list s as)
slist_2 \<in> state_set (state_list s as)
last slist_1 = last slist_2
length slist_1 \<noteq> length slist_2

goal (1 subgoal):
 1. \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
slist_1 \<in> state_set (state_list s as)
slist_2 \<in> state_set (state_list s as)
last slist_1 = last slist_2
length slist_1 \<noteq> length slist_2
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
slist_1 \<in> state_set (state_list s as)
slist_2 \<in> state_set (state_list s as)
last slist_1 = last slist_2
length slist_1 \<noteq> length slist_2

goal (1 subgoal):
 1. \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
[PROOF STEP]
proof (cases as)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<lbrakk>slist_1 \<in> state_set (state_list s as); slist_2 \<in> state_set (state_list s as); last slist_1 = last slist_2; length slist_1 \<noteq> length slist_2; as = []\<rbrakk> \<Longrightarrow> \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
 2. \<And>a list. \<lbrakk>slist_1 \<in> state_set (state_list s as); slist_2 \<in> state_set (state_list s as); last slist_1 = last slist_2; length slist_1 \<noteq> length slist_2; as = a # list\<rbrakk> \<Longrightarrow> \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
[PROOF STEP]
case Nil
[PROOF STATE]
proof (state)
this:
as = []

goal (2 subgoals):
 1. \<lbrakk>slist_1 \<in> state_set (state_list s as); slist_2 \<in> state_set (state_list s as); last slist_1 = last slist_2; length slist_1 \<noteq> length slist_2; as = []\<rbrakk> \<Longrightarrow> \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
 2. \<And>a list. \<lbrakk>slist_1 \<in> state_set (state_list s as); slist_2 \<in> state_set (state_list s as); last slist_1 = last slist_2; length slist_1 \<noteq> length slist_2; as = a # list\<rbrakk> \<Longrightarrow> \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
[PROOF STEP]
text \<open> 4th assumption is violated in the 'Nil' case. \<close>
[PROOF STATE]
proof (state)
this:
as = []

goal (2 subgoals):
 1. \<lbrakk>slist_1 \<in> state_set (state_list s as); slist_2 \<in> state_set (state_list s as); last slist_1 = last slist_2; length slist_1 \<noteq> length slist_2; as = []\<rbrakk> \<Longrightarrow> \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
 2. \<And>a list. \<lbrakk>slist_1 \<in> state_set (state_list s as); slist_2 \<in> state_set (state_list s as); last slist_1 = last slist_2; length slist_1 \<noteq> length slist_2; as = a # list\<rbrakk> \<Longrightarrow> \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
as = []
[PROOF STEP]
have "\<not>(2 ^ card (fmdom' s) - 1 < length as)"
[PROOF STATE]
proof (prove)
using this:
as = []

goal (1 subgoal):
 1. \<not> 2 ^ card (fmdom' s) - 1 < length as
[PROOF STEP]
using Nil
[PROOF STATE]
proof (prove)
using this:
as = []
as = []

goal (1 subgoal):
 1. \<not> 2 ^ card (fmdom' s) - 1 < length as
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<not> 2 ^ card (fmdom' s) - 1 < length as

goal (2 subgoals):
 1. \<lbrakk>slist_1 \<in> state_set (state_list s as); slist_2 \<in> state_set (state_list s as); last slist_1 = last slist_2; length slist_1 \<noteq> length slist_2; as = []\<rbrakk> \<Longrightarrow> \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
 2. \<And>a list. \<lbrakk>slist_1 \<in> state_set (state_list s as); slist_2 \<in> state_set (state_list s as); last slist_1 = last slist_2; length slist_1 \<noteq> length slist_2; as = a # list\<rbrakk> \<Longrightarrow> \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<not> 2 ^ card (fmdom' s) - 1 < length as
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<not> 2 ^ card (fmdom' s) - 1 < length as

goal (1 subgoal):
 1. \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
[PROOF STEP]
using assms(4)
[PROOF STATE]
proof (prove)
using this:
\<not> 2 ^ card (fmdom' s) - 1 < length as
2 ^ card (fmdom' s) - 1 < length as

goal (1 subgoal):
 1. \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []

goal (1 subgoal):
 1. \<And>a list. \<lbrakk>slist_1 \<in> state_set (state_list s as); slist_2 \<in> state_set (state_list s as); last slist_1 = last slist_2; length slist_1 \<noteq> length slist_2; as = a # list\<rbrakk> \<Longrightarrow> \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a list. \<lbrakk>slist_1 \<in> state_set (state_list s as); slist_2 \<in> state_set (state_list s as); last slist_1 = last slist_2; length slist_1 \<noteq> length slist_2; as = a # list\<rbrakk> \<Longrightarrow> \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
[PROOF STEP]
case (Cons a list)
[PROOF STATE]
proof (state)
this:
as = a # list

goal (1 subgoal):
 1. \<And>a list. \<lbrakk>slist_1 \<in> state_set (state_list s as); slist_2 \<in> state_set (state_list s as); last slist_1 = last slist_2; length slist_1 \<noteq> length slist_2; as = a # list\<rbrakk> \<Longrightarrow> \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
as = a # list
[PROOF STEP]
have "as \<noteq> []"
[PROOF STATE]
proof (prove)
using this:
as = a # list

goal (1 subgoal):
 1. as \<noteq> []
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
as \<noteq> []

goal (1 subgoal):
 1. \<And>a list. \<lbrakk>slist_1 \<in> state_set (state_list s as); slist_2 \<in> state_set (state_list s as); last slist_1 = last slist_2; length slist_1 \<noteq> length slist_2; as = a # list\<rbrakk> \<Longrightarrow> \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
as \<noteq> []

goal (1 subgoal):
 1. \<And>a list. \<lbrakk>slist_1 \<in> state_set (state_list s as); slist_2 \<in> state_set (state_list s as); last slist_1 = last slist_2; length slist_1 \<noteq> length slist_2; as = a # list\<rbrakk> \<Longrightarrow> \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
[PROOF STEP]
have "slist_1 \<noteq> []" "slist_2 \<noteq> []"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. slist_1 \<noteq> [] &&& slist_2 \<noteq> []
[PROOF STEP]
using 6(1, 2) NIL_NOTIN_stateset
[PROOF STATE]
proof (prove)
using this:
slist_1 \<in> state_set (state_list s as)
slist_2 \<in> state_set (state_list s as)
[] \<notin> state_set ?X

goal (1 subgoal):
 1. slist_1 \<noteq> [] &&& slist_2 \<noteq> []
[PROOF STEP]
by blast+
[PROOF STATE]
proof (state)
this:
slist_1 \<noteq> []
slist_2 \<noteq> []

goal (1 subgoal):
 1. \<And>a list. \<lbrakk>slist_1 \<in> state_set (state_list s as); slist_2 \<in> state_set (state_list s as); last slist_1 = last slist_2; length slist_1 \<noteq> length slist_2; as = a # list\<rbrakk> \<Longrightarrow> \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
as \<noteq> []
slist_1 \<noteq> []
slist_2 \<noteq> []
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
as \<noteq> []
slist_1 \<noteq> []
slist_2 \<noteq> []

goal (1 subgoal):
 1. \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
[PROOF STEP]
using assms(2, 3) 6(1, 2, 3, 4) eq_last_state_imp_append_nempty_as
[PROOF STATE]
proof (prove)
using this:
as \<noteq> []
slist_1 \<noteq> []
slist_2 \<noteq> []
s \<in> valid_states PROB
as \<in> valid_plans PROB
slist_1 \<in> state_set (state_list s as)
slist_2 \<in> state_set (state_list s as)
last slist_1 = last slist_2
length slist_1 \<noteq> length slist_2
\<lbrakk>?as \<noteq> []; ?s \<in> valid_states ?PROB; ?as \<in> valid_plans ?PROB; ?slist_1.0 \<noteq> []; ?slist_2.0 \<noteq> []; ?slist_1.0 \<in> state_set (state_list ?s ?as); ?slist_2.0 \<in> state_set (state_list ?s ?as); length ?slist_1.0 \<noteq> length ?slist_2.0; last ?slist_1.0 = last ?slist_2.0\<rbrakk> \<Longrightarrow> \<exists>as1 as2 as3. as1 @ as2 @ as3 = ?as \<and> exec_plan ?s (as1 @ as2) = exec_plan ?s as1 \<and> as2 \<noteq> []

goal (1 subgoal):
 1. \<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
\<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<exists>as1 as2 as3. as1 @ as2 @ as3 = as \<and> exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma list_all_mp[elim]:
assumes "list_all (\<lambda> a. \<phi> a \<longrightarrow> \<psi> a) al" and "list_all \<phi> al"
shows "list_all \<psi> al"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. list_all \<psi> al
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
list_all (\<lambda>a. \<phi> a \<longrightarrow> \<psi> a) al
list_all \<phi> al

goal (1 subgoal):
 1. list_all \<psi> al
[PROOF STEP]
unfolding list_all_iff
[PROOF STATE]
proof (prove)
using this:
\<forall>a\<in>set al. \<phi> a \<longrightarrow> \<psi> a
Ball (set al) \<phi>

goal (1 subgoal):
 1. Ball (set al) \<psi>
[PROOF STEP]
by auto


[STATEMENT]
lemma distinct_mset_mono_strict: \<open>D' \<subset># D \<Longrightarrow> distinct_mset D \<Longrightarrow> distinct_mset D'\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>D' \<subset># D; distinct_mset D\<rbrakk> \<Longrightarrow> distinct_mset D'
[PROOF STEP]
using distinct_mset_mono
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?D' \<subseteq># ?D; distinct_mset ?D\<rbrakk> \<Longrightarrow> distinct_mset ?D'

goal (1 subgoal):
 1. \<lbrakk>D' \<subset># D; distinct_mset D\<rbrakk> \<Longrightarrow> distinct_mset D'
[PROOF STEP]
by auto


[STATEMENT]
lemma iso_register_inv_comp2: \<open>iso_register F \<Longrightarrow> F o inv F = id\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. iso_register F \<Longrightarrow> F \<circ> inv F = id
[PROOF STEP]
using inv_unique_comp iso_register_def
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?f \<circ> ?g = id; ?g \<circ> ?f = id\<rbrakk> \<Longrightarrow> inv ?f = ?g
iso_register ?F = (register ?F \<and> (\<exists>G. register G \<and> ?F \<circ> G = id \<and> G \<circ> ?F = id))

goal (1 subgoal):
 1. iso_register F \<Longrightarrow> F \<circ> inv F = id
[PROOF STEP]
by blast


[STATEMENT]
lemma cont2cont_foldl [simp, cont2cont]:
  fixes f :: "'a::cpo \<Rightarrow> 'b::cpo \<Rightarrow> 'c::cpo \<Rightarrow> 'b"
  fixes xs :: "'c list"
  fixes z :: "'a \<Rightarrow> 'b"
  assumes "cont (\<lambda>(x, y, z). f x y z)"
  assumes "cont z"
  shows "cont (\<lambda>x. foldl (f x) (z x) xs)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. cont (\<lambda>x. foldl (f x) (z x) xs)
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
cont (\<lambda>(x, y, z). f x y z)
cont z

goal (1 subgoal):
 1. cont (\<lambda>x. foldl (f x) (z x) xs)
[PROOF STEP]
by (induct xs rule: rev_induct) (auto simp: prod_cont_iff intro: cont_apply)


[STATEMENT]
lemma satisfies_nFEx: "lformula \<phi> \<Longrightarrow> \<AA> \<Turnstile> nFEx b \<phi> \<longleftrightarrow> \<AA> \<Turnstile> FEx b \<phi>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. lformula \<phi> \<Longrightarrow> (\<AA> \<Turnstile> nFEx b \<phi>) = (\<AA> \<Turnstile> FEx b \<phi>)
[PROOF STEP]
by (induct \<phi> rule: nFEx.induct)
    (auto simp add: satisfies_nFOr Extend_satisfies_decr
      LEQ_0 LESS_SUC(1) nvars_Extend Extend_satisfies0 Extend_commute_safe Extend_commute_unsafe)


[STATEMENT]
lemma fibs_1 [simp]:
  "fibs !! 1 = 1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fibs !! 1 = 1
[PROOF STEP]
by (subst fibs.simps) simp


[STATEMENT]
lemma conjugate_conjl2[simp]: "conjugate (\<lambda>x. y \<lhd> x) = (\<lambda>x. x \<rhd> y)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. conjugate ((\<lhd>) y) = (\<lambda>x. x \<rhd> y)
[PROOF STEP]
by (metis conjugation_pair_conj unique_conjugate residuated_conj1 residuated_conjl2)


[STATEMENT]
lemma Re_sum [simp]: "Re(sum f S) = sum (\<lambda>x.  Re(f x)) S" for f :: "'a \<Rightarrow> quat"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. quat.Re (sum f S) = (\<Sum>x\<in>S. quat.Re (f x))
[PROOF STEP]
by (induct S rule: infinite_finite_induct) auto


[STATEMENT]
lemma set_suffixes_append:
  "set (suffixes (xs @ ys)) = set (suffixes ys) \<union> {xs' @ ys |xs'. xs' \<in> set (suffixes xs)}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. set (suffixes (xs @ ys)) = set (suffixes ys) \<union> {xs' @ ys |xs'. xs' \<in> set (suffixes xs)}
[PROOF STEP]
by (subst suffixes_append, cases xs rule: rev_cases) auto


[STATEMENT]
lemma keys_Const\<^sub>0: "keys (Const\<^sub>0 c) = (if c = 0 then {} else {0})"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. keys (Const\<^sub>0 c) = (if c = (0::'b) then {} else {0})
[PROOF STEP]
unfolding Const\<^sub>0_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. keys (Poly_Mapping.single 0 c) = (if c = (0::'b) then {} else {0})
[PROOF STEP]
by transfer' auto


[STATEMENT]
theorem E15[simp_unl]: "\<turnstile> \<diamond>#F = #F"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<turnstile> \<diamond>#F = #F
[PROOF STEP]
by (simp add: eventually_def)


[STATEMENT]
lemma (in bounded_linear) sums: "(\<lambda>n. X n) sums a \<Longrightarrow> (\<lambda>n. f (X n)) sums (f a)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. X sums a \<Longrightarrow> (\<lambda>n. f (X n)) sums f a
[PROOF STEP]
unfolding sums_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lambda>n. sum X {..<n}) \<longlonglongrightarrow> a \<Longrightarrow> (\<lambda>n. \<Sum>n<n. f (X n)) \<longlonglongrightarrow> f a
[PROOF STEP]
by (drule tendsto) (simp only: sum)


[STATEMENT]
lemma eqOn_update[simp]:
assumes "cpt (P - {p}) env \<pi>l" and "cpt (P - {p}) env1 \<pi>l1"
shows
"eqOn P (env(p := length \<pi>l)) (\<pi>l @ [\<pi>]) (env1(p := length \<pi>l1)) (\<pi>l1 @ [\<pi>])
 \<longleftrightarrow>
 eqOn (P - {p}) env \<pi>l env1 \<pi>l1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. local.eqOn P (env(p := length \<pi>l)) (\<pi>l @ [\<pi>]) (env1(p := length \<pi>l1)) (\<pi>l1 @ [\<pi>]) = local.eqOn (P - {p}) env \<pi>l env1 \<pi>l1
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
cpt (P - {p}) env \<pi>l
cpt (P - {p}) env1 \<pi>l1

goal (1 subgoal):
 1. local.eqOn P (env(p := length \<pi>l)) (\<pi>l @ [\<pi>]) (env1(p := length \<pi>l1)) (\<pi>l1 @ [\<pi>]) = local.eqOn (P - {p}) env \<pi>l env1 \<pi>l1
[PROOF STEP]
unfolding eqOn_def cpt_def
[PROOF STATE]
proof (prove)
using this:
\<forall>p\<in>P - {p}. env p < length \<pi>l
\<forall>p\<in>P - {p}. env1 p < length \<pi>l1

goal (1 subgoal):
 1. (\<forall>pa. pa \<in> P \<longrightarrow> (\<pi>l @ [\<pi>]) ! (env(p := length \<pi>l)) pa = (\<pi>l1 @ [\<pi>]) ! (env1(p := length \<pi>l1)) pa) = (\<forall>pa. pa \<in> P - {p} \<longrightarrow> \<pi>l ! env pa = \<pi>l1 ! env1 pa)
[PROOF STEP]
by simp (metis DiffI nth_append singleton_iff)


[STATEMENT]
lemma imp_reverse2:
  "PRE (\<lambda>s:: 'a list store. s ''x'' = X)
   (''y'' ::= (\<lambda>s. []));
   (WHILE (\<lambda>s. s ''x'' \<noteq> []) INV (\<lambda>s. rev (s ''x'') @ s ''y'' = rev X)
    DO
     (''y'' ::= (\<lambda>s. hd (s ''x'') # s ''y''));
     (''x'' ::= (\<lambda>s. tl (s ''x'')))
    OD)
   POST (\<lambda>s. s ''y''= rev X )"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. rdom \<lceil>\<lambda>s. s ''x'' = X\<rceil> \<subseteq> wp ((''y'' ::= (\<lambda>s. [])) ; (WHILE (\<lambda>s. s ''x'' \<noteq> []) INV (\<lambda>s. rev (s ''x'') @ s ''y'' = rev X) DO (''y'' ::= (\<lambda>s. hd (s ''x'') # s ''y'')) ; (''x'' ::= (\<lambda>s. tl (s ''x''))) OD)) \<lceil>\<lambda>s. s ''y'' = rev X\<rceil>
[PROOF STEP]
apply hoare
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. rdom \<lceil>\<lambda>s. rev (s ''x'') @ s ''y'' = rev X\<rceil> ; pp_a \<lceil>\<lambda>s. s ''x'' \<noteq> []\<rceil> \<subseteq> rdom \<lceil>\<lambda>s. s ''y'' = rev X\<rceil>
 2. rdom \<lceil>\<lambda>s. rev (s ''x'') @ s ''y'' = rev X\<rceil> ; rdom \<lceil>\<lambda>s. s ''x'' \<noteq> []\<rceil> \<subseteq> wp (''y'' ::= (\<lambda>s. hd (s ''x'') # s ''y'')) (wp (''x'' ::= (\<lambda>s. tl (s ''x''))) \<lceil>\<lambda>s. rev (s ''x'') @ s ''y'' = rev X\<rceil>)
 3. rdom \<lceil>\<lambda>s. s ''x'' = X\<rceil> \<subseteq> wp (''y'' ::= (\<lambda>s. [])) (rdom \<lceil>\<lambda>s. rev (s ''x'') @ s ''y'' = rev X\<rceil>)
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>rev (x ''x'') @ x ''y'' = rev X; x ''x'' \<noteq> []\<rbrakk> \<Longrightarrow> rev (tl (x ''x'')) @ hd (x ''x'') # x ''y'' = rev X
[PROOF STEP]
apply (metis append.simps append_assoc hd_Cons_tl rev.simps(2))
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma invars_pop_small: "\<lbrakk>
  invar (States dir big small);
  0 < size small;
  Small.pop small = (x, small')\<rbrakk>
 \<Longrightarrow>  invar big  \<and> invar small'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invar (States dir big small); 0 < size small; Small.pop small = (x, small')\<rbrakk> \<Longrightarrow> invar big \<and> invar small'
[PROOF STEP]
by(auto simp: Small_Proof.invar_pop)


[STATEMENT]
lemma zip_eq_Nil_iff [simp]: "zip xs ys = [] \<longleftrightarrow> xs = [] \<or> ys = []"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (zip xs ys = []) = (xs = [] \<or> ys = [])
[PROOF STEP]
by(cases xs ys rule: list.exhaust[case_product list.exhaust]) simp_all


[STATEMENT]
lemma fds_deriv_1 [simp]: "fds_deriv 1 = 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fds_deriv 1 = 0
[PROOF STEP]
by (rule fds_eqI) (simp add: fds_nth_deriv fds_nth_one)


[STATEMENT]
lemma "isNotDSource_EmptyDAcc":
  assumes "isNotDSource i S"
  shows    "DAcc i S ={}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. DAcc i S = {}
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
isNotDSource i S

goal (1 subgoal):
 1. DAcc i S = {}
[PROOF STEP]
by (simp add: DAcc_def isNotDSource_def, auto)


[STATEMENT]
lemma distinct_fst_isin_same_fst:
  "\<lbrakk>(x,y) \<in> set xs; (x,y') \<in> set xs; distinct_fst xs\<rbrakk>
  \<Longrightarrow> y = y'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(x, y) \<in> set xs; (x, y') \<in> set xs; distinct_fst xs\<rbrakk> \<Longrightarrow> y = y'
[PROOF STEP]
by(induct xs,auto simp:distinct_fst_def image_def)


[STATEMENT]
lemma of_hypnat_less_iff [simp]:
  "\<And>m n. of_hypnat m < (of_hypnat n::'a::linordered_semidom star) \<longleftrightarrow> m < n"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>m n. (of_hypnat m < of_hypnat n) = (m < n)
[PROOF STEP]
by transfer (rule of_nat_less_iff)


[STATEMENT]
lemma Jacobi_mod_cong: "[a = b] (mod n) \<Longrightarrow> Jacobi a n = Jacobi b n"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. [a = b] (mod n) \<Longrightarrow> Jacobi a n = Jacobi b n
[PROOF STEP]
by (metis Jacobi_mod cong_def dvd_refl)


[STATEMENT]
lemma ls_nds_rel_sv[relator_props]:
  assumes "single_valued R"
  shows "single_valued (\<langle>R\<rangle>ls_nds_rel)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. single_valued (\<langle>R\<rangle>ls_nds_rel)
[PROOF STEP]
using list_set_rel_sv[OF assms]
[PROOF STATE]
proof (prove)
using this:
single_valued (\<langle>R\<rangle>list_set_rel)

goal (1 subgoal):
 1. single_valued (\<langle>R\<rangle>ls_nds_rel)
[PROOF STEP]
unfolding ls_nds_rel_def
[PROOF STATE]
proof (prove)
using this:
single_valued (\<langle>R\<rangle>list_set_rel)

goal (1 subgoal):
 1. single_valued (\<langle>R\<rangle>list_set_rel \<inter> {(uu_, y). inj_on name y})
[PROOF STEP]
by (metis inf.cobounded1 single_valued_subset)


[STATEMENT]
lemma fds_nth_zeta: "fds_nth fds_zeta = (\<lambda>n. if n = 0 then 0 else 1)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fds_nth fds_zeta = (\<lambda>n. if n = 0 then 0::'a else (1::'a))
[PROOF STEP]
by (simp add: fds_zeta_def fun_eq_iff)


[STATEMENT]
lemma dist_varset_morphism_is_morphism:
  assumes "(I:: 'd set) \<subseteq> J0 \<union> J1"
  assumes "J1 \<subseteq> I"
  assumes "\<phi> = dist_varset_morphism I J0"
  shows "ring_hom_ring R (Pring (Pring R J0) J1) \<phi>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ring_hom_ring R (Pring (Pring R J0) J1) \<phi>
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. ring_hom_ring R (Pring (Pring R J0) J1) \<phi>
[PROOF STEP]
have 0:"ring_hom_ring R (Pring R J0) indexed_const"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ring_hom_ring R (Pring R J0) indexed_const
[PROOF STEP]
by (simp add: indexed_const_ring_hom)
[PROOF STATE]
proof (state)
this:
ring_hom_ring R (Pring R J0) indexed_const

goal (1 subgoal):
 1. ring_hom_ring R (Pring (Pring R J0) J1) \<phi>
[PROOF STEP]
have 1:"ring_hom_ring (Pring R J0) (Pring (Pring R J0) J1) (ring.indexed_const (Pring R J0))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ring_hom_ring (Pring R J0) (Pring (Pring R J0) J1) (ring.indexed_const (Pring R J0))
[PROOF STEP]
by (simp add: cring.indexed_const_ring_hom is_cring local.ring_axioms ring.Pring_is_cring)
[PROOF STATE]
proof (state)
this:
ring_hom_ring (Pring R J0) (Pring (Pring R J0) J1) (ring.indexed_const (Pring R J0))

goal (1 subgoal):
 1. ring_hom_ring R (Pring (Pring R J0) J1) \<phi>
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ring_hom_ring R (Pring (Pring R J0) J1) \<phi>
[PROOF STEP]
using 0 1 assms ring_hom_trans[of "indexed_const" R "Pring R J0" "ring.indexed_const (Pring R J0)"
              "(Pring (Pring R J0) J1) "]
[PROOF STATE]
proof (prove)
using this:
ring_hom_ring R (Pring R J0) indexed_const
ring_hom_ring (Pring R J0) (Pring (Pring R J0) J1) (ring.indexed_const (Pring R J0))
I \<subseteq> J0 \<union> J1
J1 \<subseteq> I
\<phi> = dist_varset_morphism I J0
\<lbrakk>indexed_const \<in> ring_hom R (Pring R J0); ring.indexed_const (Pring R J0) \<in> ring_hom (Pring R J0) (Pring (Pring R J0) J1)\<rbrakk> \<Longrightarrow> ring.indexed_const (Pring R J0) \<circ> indexed_const \<in> ring_hom R (Pring (Pring R J0) J1)

goal (1 subgoal):
 1. ring_hom_ring R (Pring (Pring R J0) J1) \<phi>
[PROOF STEP]
unfolding dist_varset_morphism_def
[PROOF STATE]
proof (prove)
using this:
ring_hom_ring R (Pring R J0) indexed_const
ring_hom_ring (Pring R J0) (Pring (Pring R J0) J1) (ring.indexed_const (Pring R J0))
I \<subseteq> J0 \<union> J1
J1 \<subseteq> I
\<phi> = ring.indexed_const (Pring R J0) \<circ> indexed_const
\<lbrakk>indexed_const \<in> ring_hom R (Pring R J0); ring.indexed_const (Pring R J0) \<in> ring_hom (Pring R J0) (Pring (Pring R J0) J1)\<rbrakk> \<Longrightarrow> ring.indexed_const (Pring R J0) \<circ> indexed_const \<in> ring_hom R (Pring (Pring R J0) J1)

goal (1 subgoal):
 1. ring_hom_ring R (Pring (Pring R J0) J1) \<phi>
[PROOF STEP]
by (meson ring_hom_ring.axioms(1) ring_hom_ring.axioms(2) ring_hom_ring.homh ring_hom_ringI2)
[PROOF STATE]
proof (state)
this:
ring_hom_ring R (Pring (Pring R J0) J1) \<phi>

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma parts_Un_subset1: "parts(G) \<union> parts(H) \<subseteq> parts(G \<union> H)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. parts G \<union> parts H \<subseteq> parts (G \<union> H)
[PROOF STEP]
by (intro Un_least parts_mono Un_upper1 Un_upper2)


[STATEMENT]
lemma imp_cnj_compat_eqvL:
assumes "\<phi>1 \<in> fmla" and "\<phi>2 \<in> fmla" and "\<chi> \<in> fmla"
shows "prv (imp (eqv \<phi>1 \<phi>2) (eqv (cnj \<phi>1 \<chi>) (cnj \<phi>2 \<chi>)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. prv (imp (eqv \<phi>1 \<phi>2) (eqv (cnj \<phi>1 \<chi>) (cnj \<phi>2 \<chi>)))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. prv (imp (eqv \<phi>1 \<phi>2) (eqv (cnj \<phi>1 \<chi>) (cnj \<phi>2 \<chi>)))
[PROOF STEP]
have "prv (imp (imp (imp \<phi>2 \<phi>1) (imp (cnj \<phi>2 \<chi>) (cnj \<phi>1 \<chi>)))
    (imp (cnj (imp \<phi>1 \<phi>2) (imp \<phi>2 \<phi>1)) (cnj (imp (cnj \<phi>1 \<chi>) (cnj \<phi>2 \<chi>))
    (imp (cnj \<phi>2 \<chi>) (cnj \<phi>1 \<chi>)))))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. prv (imp (imp (imp \<phi>2 \<phi>1) (imp (cnj \<phi>2 \<chi>) (cnj \<phi>1 \<chi>))) (imp (cnj (imp \<phi>1 \<phi>2) (imp \<phi>2 \<phi>1)) (cnj (imp (cnj \<phi>1 \<chi>) (cnj \<phi>2 \<chi>)) (imp (cnj \<phi>2 \<chi>) (cnj \<phi>1 \<chi>)))))
[PROOF STEP]
by (metis (no_types) imp cnj assms prv_imp_mp assms prv_cnj_imp_mono prv_imp_com prv_imp_refl)
[PROOF STATE]
proof (state)
this:
prv (imp (imp (imp \<phi>2 \<phi>1) (imp (cnj \<phi>2 \<chi>) (cnj \<phi>1 \<chi>))) (imp (cnj (imp \<phi>1 \<phi>2) (imp \<phi>2 \<phi>1)) (cnj (imp (cnj \<phi>1 \<chi>) (cnj \<phi>2 \<chi>)) (imp (cnj \<phi>2 \<chi>) (cnj \<phi>1 \<chi>)))))

goal (1 subgoal):
 1. prv (imp (eqv \<phi>1 \<phi>2) (eqv (cnj \<phi>1 \<chi>) (cnj \<phi>2 \<chi>)))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
prv (imp (imp (imp \<phi>2 \<phi>1) (imp (cnj \<phi>2 \<chi>) (cnj \<phi>1 \<chi>))) (imp (cnj (imp \<phi>1 \<phi>2) (imp \<phi>2 \<phi>1)) (cnj (imp (cnj \<phi>1 \<chi>) (cnj \<phi>2 \<chi>)) (imp (cnj \<phi>2 \<chi>) (cnj \<phi>1 \<chi>)))))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
prv (imp (imp (imp \<phi>2 \<phi>1) (imp (cnj \<phi>2 \<chi>) (cnj \<phi>1 \<chi>))) (imp (cnj (imp \<phi>1 \<phi>2) (imp \<phi>2 \<phi>1)) (cnj (imp (cnj \<phi>1 \<chi>) (cnj \<phi>2 \<chi>)) (imp (cnj \<phi>2 \<chi>) (cnj \<phi>1 \<chi>)))))

goal (1 subgoal):
 1. prv (imp (eqv \<phi>1 \<phi>2) (eqv (cnj \<phi>1 \<chi>) (cnj \<phi>2 \<chi>)))
[PROOF STEP]
by (metis (no_types) imp cnj assms prv_imp_mp assms eqv_def prv_cnj_imp_mono prv_imp_com prv_imp_refl)
[PROOF STATE]
proof (state)
this:
prv (imp (eqv \<phi>1 \<phi>2) (eqv (cnj \<phi>1 \<chi>) (cnj \<phi>2 \<chi>)))

goal:
No subgoals!
[PROOF STEP]
qed