[STATEMENT]
lemma cis_conv_exp: "cis b = exp (\<i> * b)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. cis b = exp (\<i> * complex_of_real b)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. cis b = exp (\<i> * complex_of_real b)
[PROOF STEP]
have "(\<i> * complex_of_real b) ^ n /\<^sub>R fact n =
      of_real (cos_coeff n * b^n) + \<i> * of_real (sin_coeff n * b^n)"
    for n :: nat
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<i> * complex_of_real b) ^ n /\<^sub>R fact n = complex_of_real (cos_coeff n * b ^ n) + \<i> * complex_of_real (sin_coeff n * b ^ n)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (\<i> * complex_of_real b) ^ n /\<^sub>R fact n = complex_of_real (cos_coeff n * b ^ n) + \<i> * complex_of_real (sin_coeff n * b ^ n)
[PROOF STEP]
have "\<i> ^ n = fact n *\<^sub>R (cos_coeff n + \<i> * sin_coeff n)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<i> ^ n = fact n *\<^sub>R (complex_of_real (cos_coeff n) + \<i> * complex_of_real (sin_coeff n))
[PROOF STEP]
by (induct n)
        (simp_all add: sin_coeff_Suc cos_coeff_Suc complex_eq_iff Re_divide Im_divide field_simps
          power2_eq_square add_nonneg_eq_0_iff)
[PROOF STATE]
proof (state)
this:
\<i> ^ n = fact n *\<^sub>R (complex_of_real (cos_coeff n) + \<i> * complex_of_real (sin_coeff n))

goal (1 subgoal):
 1. (\<i> * complex_of_real b) ^ n /\<^sub>R fact n = complex_of_real (cos_coeff n * b ^ n) + \<i> * complex_of_real (sin_coeff n * b ^ n)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<i> ^ n = fact n *\<^sub>R (complex_of_real (cos_coeff n) + \<i> * complex_of_real (sin_coeff n))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<i> ^ n = fact n *\<^sub>R (complex_of_real (cos_coeff n) + \<i> * complex_of_real (sin_coeff n))

goal (1 subgoal):
 1. (\<i> * complex_of_real b) ^ n /\<^sub>R fact n = complex_of_real (cos_coeff n * b ^ n) + \<i> * complex_of_real (sin_coeff n * b ^ n)
[PROOF STEP]
by (simp add: field_simps)
[PROOF STATE]
proof (state)
this:
(\<i> * complex_of_real b) ^ n /\<^sub>R fact n = complex_of_real (cos_coeff n * b ^ n) + \<i> * complex_of_real (sin_coeff n * b ^ n)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
(\<i> * complex_of_real b) ^ ?n /\<^sub>R fact ?n = complex_of_real (cos_coeff ?n * b ^ ?n) + \<i> * complex_of_real (sin_coeff ?n * b ^ ?n)

goal (1 subgoal):
 1. cis b = exp (\<i> * complex_of_real b)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(\<i> * complex_of_real b) ^ ?n /\<^sub>R fact ?n = complex_of_real (cos_coeff ?n * b ^ ?n) + \<i> * complex_of_real (sin_coeff ?n * b ^ ?n)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
(\<i> * complex_of_real b) ^ ?n /\<^sub>R fact ?n = complex_of_real (cos_coeff ?n * b ^ ?n) + \<i> * complex_of_real (sin_coeff ?n * b ^ ?n)

goal (1 subgoal):
 1. cis b = exp (\<i> * complex_of_real b)
[PROOF STEP]
using sin_converges [of b] cos_converges [of b]
[PROOF STATE]
proof (prove)
using this:
(\<i> * complex_of_real b) ^ ?n /\<^sub>R fact ?n = complex_of_real (cos_coeff ?n * b ^ ?n) + \<i> * complex_of_real (sin_coeff ?n * b ^ ?n)
(\<lambda>n. sin_coeff n *\<^sub>R b ^ n) sums sin b
(\<lambda>n. cos_coeff n *\<^sub>R b ^ n) sums cos b

goal (1 subgoal):
 1. cis b = exp (\<i> * complex_of_real b)
[PROOF STEP]
by (auto simp add: Complex_eq cis.ctr exp_def simp del: of_real_mult
        intro!: sums_unique sums_add sums_mult sums_of_real)
[PROOF STATE]
proof (state)
this:
cis b = exp (\<i> * complex_of_real b)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma solution_fixed_point:
  fixes x:: "real \<Rightarrow> 'a::banach"
  assumes x: "(x solves_ode f) T X" and t: "t \<in> T"
  shows "x t0 + ivl_integral t0 t (\<lambda>t. f t (x t)) = x t"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x t0 + ivl_integral t0 t (\<lambda>t. f t (x t)) = x t
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. x t0 + ivl_integral t0 t (\<lambda>t. f t (x t)) = x t
[PROOF STEP]
from solves_odeD(1)[OF x, unfolded T_def]
[PROOF STATE]
proof (chain)
picking this:
(x has_vderiv_on (\<lambda>t. f t (x t))) {t0--t1}
[PROOF STEP]
have "(x has_vderiv_on (\<lambda>t. f t (x t))) (closed_segment t0 t)"
[PROOF STATE]
proof (prove)
using this:
(x has_vderiv_on (\<lambda>t. f t (x t))) {t0--t1}

goal (1 subgoal):
 1. (x has_vderiv_on (\<lambda>t. f t (x t))) {t0--t}
[PROOF STEP]
by (rule has_vderiv_on_subset) (insert \<open>t \<in> T\<close>, auto simp: closed_segment_eq_real_ivl T_def)
[PROOF STATE]
proof (state)
this:
(x has_vderiv_on (\<lambda>t. f t (x t))) {t0--t}

goal (1 subgoal):
 1. x t0 + ivl_integral t0 t (\<lambda>t. f t (x t)) = x t
[PROOF STEP]
from fundamental_theorem_of_calculus_ivl_integral[OF this]
[PROOF STATE]
proof (chain)
picking this:
((\<lambda>t. f t (x t)) has_ivl_integral x t - x t0) t0 t
[PROOF STEP]
have "((\<lambda>t. f t (x t)) has_ivl_integral x t - x t0) t0 t"
[PROOF STATE]
proof (prove)
using this:
((\<lambda>t. f t (x t)) has_ivl_integral x t - x t0) t0 t

goal (1 subgoal):
 1. ((\<lambda>t. f t (x t)) has_ivl_integral x t - x t0) t0 t
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
((\<lambda>t. f t (x t)) has_ivl_integral x t - x t0) t0 t

goal (1 subgoal):
 1. x t0 + ivl_integral t0 t (\<lambda>t. f t (x t)) = x t
[PROOF STEP]
from this[THEN ivl_integral_unique]
[PROOF STATE]
proof (chain)
picking this:
ivl_integral t0 t (\<lambda>t. f t (x t)) = x t - x t0
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
ivl_integral t0 t (\<lambda>t. f t (x t)) = x t - x t0

goal (1 subgoal):
 1. x t0 + ivl_integral t0 t (\<lambda>t. f t (x t)) = x t
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
x t0 + ivl_integral t0 t (\<lambda>t. f t (x t)) = x t

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
theorem thmD8: "\<J> 0 0 = Gen (\<P> 0 0)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<J> 0 0 = Gen (\<P> 0 0)
[PROOF STEP]
using Gen_subset_\<J>_0_0 \<J>_0_0_subset_Gen
[PROOF STATE]
proof (prove)
using this:
Gen (\<P> 0 0) \<subseteq> \<J> 0 0
\<J> 0 0 \<subseteq> Gen (\<P> 0 0)

goal (1 subgoal):
 1. \<J> 0 0 = Gen (\<P> 0 0)
[PROOF STEP]
by blast


[STATEMENT]
lemma eucl_of_list_if:
  assumes [simp]: "length xs = DIM('a::executable_euclidean_space)" "distinct xs"
  shows "eucl_of_list (map (\<lambda>xa. if xa = x then 1 else 0) (xs::nat list)) =
    (if x \<in> set xs then Basis_list ! index xs x else 0::'a)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. eucl_of_list (map (\<lambda>xa. if xa = x then 1 else 0) xs) = (if x \<in> set xs then Basis_list ! index xs x else (0::'a))
[PROOF STEP]
by (rule euclidean_eqI) (auto simp: eucl_of_list_inner inner_Basis index_nth_id)


[STATEMENT]
lemma height_balanced:
  assumes "balanced kdt"
  shows "height kdt = nat(ceiling(log 2 (size_kdt kdt)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. height kdt = nat \<lceil>log 2 (real (KD_Tree.size_kdt kdt))\<rceil>
[PROOF STEP]
proof cases
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. ?P \<Longrightarrow> height kdt = nat \<lceil>log 2 (real (KD_Tree.size_kdt kdt))\<rceil>
 2. \<not> ?P \<Longrightarrow> height kdt = nat \<lceil>log 2 (real (KD_Tree.size_kdt kdt))\<rceil>
[PROOF STEP]
assume *: "complete kdt"
[PROOF STATE]
proof (state)
this:
KD_Tree.complete kdt

goal (2 subgoals):
 1. ?P \<Longrightarrow> height kdt = nat \<lceil>log 2 (real (KD_Tree.size_kdt kdt))\<rceil>
 2. \<not> ?P \<Longrightarrow> height kdt = nat \<lceil>log 2 (real (KD_Tree.size_kdt kdt))\<rceil>
[PROOF STEP]
hence "size_kdt kdt = 2 ^ height kdt"
[PROOF STATE]
proof (prove)
using this:
KD_Tree.complete kdt

goal (1 subgoal):
 1. KD_Tree.size_kdt kdt = 2 ^ height kdt
[PROOF STEP]
by (simp add: size_if_complete)
[PROOF STATE]
proof (state)
this:
KD_Tree.size_kdt kdt = 2 ^ height kdt

goal (2 subgoals):
 1. ?P \<Longrightarrow> height kdt = nat \<lceil>log 2 (real (KD_Tree.size_kdt kdt))\<rceil>
 2. \<not> ?P \<Longrightarrow> height kdt = nat \<lceil>log 2 (real (KD_Tree.size_kdt kdt))\<rceil>
[PROOF STEP]
from log2_of_power_eq[OF this]
[PROOF STATE]
proof (chain)
picking this:
real (height kdt) = log 2 (real (KD_Tree.size_kdt kdt))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
real (height kdt) = log 2 (real (KD_Tree.size_kdt kdt))

goal (1 subgoal):
 1. height kdt = nat \<lceil>log 2 (real (KD_Tree.size_kdt kdt))\<rceil>
[PROOF STEP]
by linarith
[PROOF STATE]
proof (state)
this:
height kdt = nat \<lceil>log 2 (real (KD_Tree.size_kdt kdt))\<rceil>

goal (1 subgoal):
 1. \<not> KD_Tree.complete kdt \<Longrightarrow> height kdt = nat \<lceil>log 2 (real (KD_Tree.size_kdt kdt))\<rceil>
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> KD_Tree.complete kdt \<Longrightarrow> height kdt = nat \<lceil>log 2 (real (KD_Tree.size_kdt kdt))\<rceil>
[PROOF STEP]
assume *: "\<not> complete kdt"
[PROOF STATE]
proof (state)
this:
\<not> KD_Tree.complete kdt

goal (1 subgoal):
 1. \<not> KD_Tree.complete kdt \<Longrightarrow> height kdt = nat \<lceil>log 2 (real (KD_Tree.size_kdt kdt))\<rceil>
[PROOF STEP]
hence **: "height kdt = min_height kdt + 1"
[PROOF STATE]
proof (prove)
using this:
\<not> KD_Tree.complete kdt

goal (1 subgoal):
 1. height kdt = min_height kdt + 1
[PROOF STEP]
using assms min_height_le_height[of kdt]
[PROOF STATE]
proof (prove)
using this:
\<not> KD_Tree.complete kdt
balanced kdt
min_height kdt \<le> height kdt

goal (1 subgoal):
 1. height kdt = min_height kdt + 1
[PROOF STEP]
by(auto simp add: balanced_def complete_iff_height)
[PROOF STATE]
proof (state)
this:
height kdt = min_height kdt + 1

goal (1 subgoal):
 1. \<not> KD_Tree.complete kdt \<Longrightarrow> height kdt = nat \<lceil>log 2 (real (KD_Tree.size_kdt kdt))\<rceil>
[PROOF STEP]
hence "size_kdt kdt \<le> 2 ^ (min_height kdt + 1)"
[PROOF STATE]
proof (prove)
using this:
height kdt = min_height kdt + 1

goal (1 subgoal):
 1. KD_Tree.size_kdt kdt \<le> 2 ^ (min_height kdt + 1)
[PROOF STEP]
by (metis size_height)
[PROOF STATE]
proof (state)
this:
KD_Tree.size_kdt kdt \<le> 2 ^ (min_height kdt + 1)

goal (1 subgoal):
 1. \<not> KD_Tree.complete kdt \<Longrightarrow> height kdt = nat \<lceil>log 2 (real (KD_Tree.size_kdt kdt))\<rceil>
[PROOF STEP]
from  log2_of_power_le[OF this size_ge0] min_height_size_log_if_incomplete[OF *] **
[PROOF STATE]
proof (chain)
picking this:
log 2 (real (KD_Tree.size_kdt kdt)) \<le> real (min_height kdt + 1)
real (min_height kdt) < log 2 (real (KD_Tree.size_kdt kdt))
height kdt = min_height kdt + 1
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
log 2 (real (KD_Tree.size_kdt kdt)) \<le> real (min_height kdt + 1)
real (min_height kdt) < log 2 (real (KD_Tree.size_kdt kdt))
height kdt = min_height kdt + 1

goal (1 subgoal):
 1. height kdt = nat \<lceil>log 2 (real (KD_Tree.size_kdt kdt))\<rceil>
[PROOF STEP]
by linarith
[PROOF STATE]
proof (state)
this:
height kdt = nat \<lceil>log 2 (real (KD_Tree.size_kdt kdt))\<rceil>

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma lincomb_in_finite_cone:
  assumes "x = lincomb l W"
    and "finite W"
    and "\<forall>i \<in> W . l i \<ge> 0"
    and "W \<subseteq> carrier_vec n"
  shows "x \<in> finite_cone W"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x \<in> finite_cone W
[PROOF STEP]
using cone_iff_finite_cone assms
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?A \<subseteq> carrier_vec n; finite ?A\<rbrakk> \<Longrightarrow> cone ?A = finite_cone ?A
x = lincomb l W
finite W
\<forall>i\<in>W. (0::'a) \<le> l i
W \<subseteq> carrier_vec n

goal (1 subgoal):
 1. x \<in> finite_cone W
[PROOF STEP]
unfolding finite_cone_def nonneg_lincomb_def
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?A \<subseteq> carrier_vec n; finite ?A\<rbrakk> \<Longrightarrow> cone ?A = {b. \<exists>c. lincomb c (if finite ?A then ?A else {}) = b \<and> c ` (if finite ?A then ?A else {}) \<subseteq> Collect ((\<le>) (0::'a))}
x = lincomb l W
finite W
\<forall>i\<in>W. (0::'a) \<le> l i
W \<subseteq> carrier_vec n

goal (1 subgoal):
 1. x \<in> {b. \<exists>c. lincomb c (if finite W then W else {}) = b \<and> c ` (if finite W then W else {}) \<subseteq> Collect ((\<le>) (0::'a))}
[PROOF STEP]
by auto


[STATEMENT]
lemma tendsto_arcosh:
  fixes f :: "_ \<Rightarrow> real"
  assumes "(f \<longlongrightarrow> a) F" "a > 1"
  shows "((\<lambda>x. arcosh (f x)) \<longlongrightarrow> arcosh a) F"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<lambda>x. arcosh (f x)) \<longlongrightarrow> arcosh a) F
[PROOF STEP]
by (rule isCont_tendsto_compose [OF isCont_arcosh]) (use assms in auto)


[STATEMENT]
lemma irreducible\<^sub>d_mD:
  assumes "irreducible\<^sub>d_m f"
  shows "degree_m f > 0" and "\<And>g h. degree_m g < degree_m f \<Longrightarrow> degree_m h < degree_m f \<Longrightarrow> \<not> f =m g * h"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 < degree_m f &&& (\<And>g h. \<lbrakk>degree_m g < degree_m f; degree_m h < degree_m f\<rbrakk> \<Longrightarrow> Mp f \<noteq> Mp (g * h))
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
irreducible\<^sub>d_m f

goal (1 subgoal):
 1. 0 < degree_m f &&& (\<And>g h. \<lbrakk>degree_m g < degree_m f; degree_m h < degree_m f\<rbrakk> \<Longrightarrow> Mp f \<noteq> Mp (g * h))
[PROOF STEP]
by (auto elim: irreducible\<^sub>d_mE)


[STATEMENT]
lemma (in encoding) refl_symm_trans_closure_of_indRelT:
  fixes TRel :: "('procT \<times> 'procT) set"
  assumes refl: "refl TRel"
      and symm: "sym TRel"
  shows "indRelTEQ TRel = (symcl ((indRelT TRel)\<^sup>=))\<^sup>+"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. indRelTEQ TRel = (symcl ((indRelT TRel)\<^sup>=))\<^sup>+
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. indRelTEQ TRel = (symcl ((indRelT TRel)\<^sup>=))\<^sup>+
[PROOF STEP]
have "(symcl ((indRelT TRel)\<^sup>=))\<^sup>+ = (symcl (indRelT TRel))\<^sup>*"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (symcl ((indRelT TRel)\<^sup>=))\<^sup>+ = (symcl (indRelT TRel))\<^sup>*
[PROOF STEP]
by (rule refl_symm_trans_closure_is_symm_refl_trans_closure[where Rel="indRelT TRel"])
[PROOF STATE]
proof (state)
this:
(symcl ((indRelT TRel)\<^sup>=))\<^sup>+ = (symcl (indRelT TRel))\<^sup>*

goal (1 subgoal):
 1. indRelTEQ TRel = (symcl ((indRelT TRel)\<^sup>=))\<^sup>+
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(symcl ((indRelT TRel)\<^sup>=))\<^sup>+ = (symcl (indRelT TRel))\<^sup>*

goal (1 subgoal):
 1. indRelTEQ TRel = (symcl ((indRelT TRel)\<^sup>=))\<^sup>+
[PROOF STEP]
from symm
[PROOF STATE]
proof (chain)
picking this:
sym TRel
[PROOF STEP]
have "symcl (indRelT TRel) = indRelT TRel"
[PROOF STATE]
proof (prove)
using this:
sym TRel

goal (1 subgoal):
 1. symcl (indRelT TRel) = indRelT TRel
[PROOF STEP]
using indRelT_symm[where TRel="TRel"] symm_closure_of_symm_rel[where Rel="indRelT TRel"]
[PROOF STATE]
proof (prove)
using this:
sym TRel
sym TRel \<Longrightarrow> sym (indRelT TRel)
sym (indRelT TRel) \<Longrightarrow> symcl (indRelT TRel) = indRelT TRel

goal (1 subgoal):
 1. symcl (indRelT TRel) = indRelT TRel
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
symcl (indRelT TRel) = indRelT TRel

goal (1 subgoal):
 1. indRelTEQ TRel = (symcl ((indRelT TRel)\<^sup>=))\<^sup>+
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
(symcl ((indRelT TRel)\<^sup>=))\<^sup>+ = (symcl (indRelT TRel))\<^sup>*
symcl (indRelT TRel) = indRelT TRel
[PROOF STEP]
show "indRelTEQ TRel = (symcl ((indRelT TRel)\<^sup>=))\<^sup>+"
[PROOF STATE]
proof (prove)
using this:
(symcl ((indRelT TRel)\<^sup>=))\<^sup>+ = (symcl (indRelT TRel))\<^sup>*
symcl (indRelT TRel) = indRelT TRel

goal (1 subgoal):
 1. indRelTEQ TRel = (symcl ((indRelT TRel)\<^sup>=))\<^sup>+
[PROOF STEP]
using refl refl_trans_closure_of_indRelT[where TRel="TRel"]
[PROOF STATE]
proof (prove)
using this:
(symcl ((indRelT TRel)\<^sup>=))\<^sup>+ = (symcl (indRelT TRel))\<^sup>*
symcl (indRelT TRel) = indRelT TRel
refl TRel
refl TRel \<Longrightarrow> indRelTEQ TRel = (indRelT TRel)\<^sup>*

goal (1 subgoal):
 1. indRelTEQ TRel = (symcl ((indRelT TRel)\<^sup>=))\<^sup>+
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
indRelTEQ TRel = (symcl ((indRelT TRel)\<^sup>=))\<^sup>+

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma two_elems_card_ge_2: "finite xs \<Longrightarrow> x \<in> xs \<and> y \<in> xs \<and> x\<noteq>y \<Longrightarrow> Finite_Set.card xs \<ge> 2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>finite xs; x \<in> xs \<and> y \<in> xs \<and> x \<noteq> y\<rbrakk> \<Longrightarrow> 2 \<le> card xs
[PROOF STEP]
using card_gt_0_iff mk_disjoint_insert not_less_eq_eq
[PROOF STATE]
proof (prove)
using this:
(0 < card ?A) = (?A \<noteq> {} \<and> finite ?A)
?a \<in> ?A \<Longrightarrow> \<exists>B. ?A = insert ?a B \<and> ?a \<notin> B
(\<not> ?m \<le> ?n) = (Suc ?n \<le> ?m)

goal (1 subgoal):
 1. \<lbrakk>finite xs; x \<in> xs \<and> y \<in> xs \<and> x \<noteq> y\<rbrakk> \<Longrightarrow> 2 \<le> card xs
[PROOF STEP]
by fastforce


[STATEMENT]
lemma Iset_star_n: "(star_n X \<in> Iset (star_n A)) = (eventually (\<lambda>n. X n \<in> A n) \<U>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (star_n X \<in> Iset (star_n A)) = (\<forall>\<^sub>F n in \<U>. X n \<in> A n)
[PROOF STEP]
by (simp add: Iset_def starP2_star_n)


[STATEMENT]
lemma LIMSEQ_real_root:
   "\<lbrakk> X \<longlonglongrightarrow> a; m > 0 \<rbrakk> \<Longrightarrow> (\<lambda>n. root m (X n)) \<longlonglongrightarrow> (root m a)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>X \<longlonglongrightarrow> a; 0 < m\<rbrakk> \<Longrightarrow> (\<lambda>n. root m (X n)) \<longlonglongrightarrow> root m a
[PROOF STEP]
by (metis isCont_tendsto_compose [where g="\<lambda>x. root m x"] isCont_real_root)


[STATEMENT]
lemma root_poly_Re_code[code]:
  "root_poly_Re p = (let fs = coeffs (poly_add p p); k = length fs
     in cf_pos_poly (poly_of_list (map (\<lambda>(fi, i). fi * 2 ^ i) (zip fs [0..<k]))))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. root_poly_Re p = (let fs = coeffs (poly_add p p); k = length fs in cf_pos_poly (poly_of_list (map2 (\<lambda>fi i. fi * 2 ^ i) fs [0..<k])))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. root_poly_Re p = (let fs = coeffs (poly_add p p); k = length fs in cf_pos_poly (poly_of_list (map2 (\<lambda>fi i. fi * 2 ^ i) fs [0..<k])))
[PROOF STEP]
have [simp]: "quotient_of (1 / 2) = (1,2)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. quotient_of (1 / 2) = (1, 2)
[PROOF STEP]
by eval
[PROOF STATE]
proof (state)
this:
quotient_of (1 / 2) = (1, 2)

goal (1 subgoal):
 1. root_poly_Re p = (let fs = coeffs (poly_add p p); k = length fs in cf_pos_poly (poly_of_list (map2 (\<lambda>fi i. fi * 2 ^ i) fs [0..<k])))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. root_poly_Re p = (let fs = coeffs (poly_add p p); k = length fs in cf_pos_poly (poly_of_list (map2 (\<lambda>fi i. fi * 2 ^ i) fs [0..<k])))
[PROOF STEP]
unfolding root_poly_Re_def poly_mult_rat_def poly_mult_rat_main_def Let_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. cf_pos_poly (case quotient_of (inverse 2) of (n, d) \<Rightarrow> poly_of_list (map2 (\<lambda>fi i. fi * d ^ i * n ^ (length (coeffs (poly_add p p)) - Suc i)) (coeffs (poly_add p p)) [0..<length (coeffs (poly_add p p))])) = cf_pos_poly (poly_of_list (map2 (\<lambda>fi i. fi * 2 ^ i) (coeffs (poly_add p p)) [0..<length (coeffs (poly_add p p))]))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
root_poly_Re p = (let fs = coeffs (poly_add p p); k = length fs in cf_pos_poly (poly_of_list (map2 (\<lambda>fi i. fi * 2 ^ i) fs [0..<k])))

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma INF_partition_nat3:
  fixes f :: "nat \<Rightarrow> nat \<Rightarrow> 'a::refinement_lattice"
  shows "(\<Sqinter>j. f i j) =
    (\<Sqinter>j\<in>{j. i = j}. f i j) \<sqinter>
    (\<Sqinter>j\<in>{j. i < j}. f i j) \<sqinter>
    (\<Sqinter>j\<in>{j. j < i}. f i j)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<Sqinter> range (f i) = \<Sqinter> (f i ` {j::nat. i = j}) \<sqinter> \<Sqinter> (f i ` {j::nat. i < j}) \<sqinter> \<Sqinter> (f i ` {j::nat. j < i})
variables:
i :: nat
f :: nat \<Rightarrow> nat \<Rightarrow> 'a
type variables:
'a :: refinement_lattice
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<Sqinter> range (f i) = \<Sqinter> (f i ` {j::nat. i = j}) \<sqinter> \<Sqinter> (f i ` {j::nat. i < j}) \<sqinter> \<Sqinter> (f i ` {j::nat. j < i})
variables:
i :: nat
f :: nat \<Rightarrow> nat \<Rightarrow> 'a
type variables:
'a :: refinement_lattice
[PROOF STEP]
have univ_part: "UNIV = {j. i = j} \<union> {j. i < j} \<union> {j. j < i}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. UNIV = {j::nat. i = j} \<union> {j::nat. i < j} \<union> {j::nat. j < i}
variables:
i :: nat
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
UNIV = {j::nat. (i::nat) = j} \<union> {j::nat. i < j} \<union> {j::nat. j < i}

goal (1 subgoal):
 1. \<Sqinter> range (f i) = \<Sqinter> (f i ` {j::nat. i = j}) \<sqinter> \<Sqinter> (f i ` {j::nat. i < j}) \<sqinter> \<Sqinter> (f i ` {j::nat. j < i})
variables:
i :: nat
f :: nat \<Rightarrow> nat \<Rightarrow> 'a
type variables:
'a :: refinement_lattice
[PROOF STEP]
have "(\<Sqinter>j \<in> {j. i = j} \<union> {j. i < j} \<union> {j. j < i}. f i j) =
          (\<Sqinter>j\<in>{j. i = j}. f i j) \<sqinter>
          (\<Sqinter>j\<in>{j. i < j}. f i j) \<sqinter>
          (\<Sqinter>j\<in>{j. j < i}. f i j)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<Sqinter> (f i ` ({j::nat. i = j} \<union> {j::nat. i < j} \<union> {j::nat. j < i})) = \<Sqinter> (f i ` {j::nat. i = j}) \<sqinter> \<Sqinter> (f i ` {j::nat. i < j}) \<sqinter> \<Sqinter> (f i ` {j::nat. j < i})
variables:
i :: nat
f :: nat \<Rightarrow> nat \<Rightarrow> 'a
type variables:
'a :: refinement_lattice
[PROOF STEP]
by (metis INF_union)
[PROOF STATE]
proof (state)
this:
\<Sqinter> ((f::nat \<Rightarrow> nat \<Rightarrow> 'a::refinement_lattice) (i::nat) ` ({j::nat. i = j} \<union> {j::nat. i < j} \<union> {j::nat. j < i})) = \<Sqinter> (f i ` {j::nat. i = j}) \<sqinter> \<Sqinter> (f i ` {j::nat. i < j}) \<sqinter> \<Sqinter> (f i ` {j::nat. j < i})

goal (1 subgoal):
 1. \<Sqinter> range (f i) = \<Sqinter> (f i ` {j::nat. i = j}) \<sqinter> \<Sqinter> (f i ` {j::nat. i < j}) \<sqinter> \<Sqinter> (f i ` {j::nat. j < i})
variables:
i :: nat
f :: nat \<Rightarrow> nat \<Rightarrow> 'a
type variables:
'a :: refinement_lattice
[PROOF STEP]
with univ_part
[PROOF STATE]
proof (chain)
picking this:
UNIV = {j::nat. (i::nat) = j} \<union> {j::nat. i < j} \<union> {j::nat. j < i}
\<Sqinter> ((f::nat \<Rightarrow> nat \<Rightarrow> 'a::refinement_lattice) (i::nat) ` ({j::nat. i = j} \<union> {j::nat. i < j} \<union> {j::nat. j < i})) = \<Sqinter> (f i ` {j::nat. i = j}) \<sqinter> \<Sqinter> (f i ` {j::nat. i < j}) \<sqinter> \<Sqinter> (f i ` {j::nat. j < i})
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
UNIV = {j::nat. (i::nat) = j} \<union> {j::nat. i < j} \<union> {j::nat. j < i}
\<Sqinter> ((f::nat \<Rightarrow> nat \<Rightarrow> 'a::refinement_lattice) (i::nat) ` ({j::nat. i = j} \<union> {j::nat. i < j} \<union> {j::nat. j < i})) = \<Sqinter> (f i ` {j::nat. i = j}) \<sqinter> \<Sqinter> (f i ` {j::nat. i < j}) \<sqinter> \<Sqinter> (f i ` {j::nat. j < i})

goal (1 subgoal):
 1. \<Sqinter> range (f i) = \<Sqinter> (f i ` {j::nat. i = j}) \<sqinter> \<Sqinter> (f i ` {j::nat. i < j}) \<sqinter> \<Sqinter> (f i ` {j::nat. j < i})
variables:
i :: nat
f :: nat \<Rightarrow> nat \<Rightarrow> 'a
type variables:
'a :: refinement_lattice
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<Sqinter> range ((f::nat \<Rightarrow> nat \<Rightarrow> 'a::refinement_lattice) (i::nat)) = \<Sqinter> (f i ` {j::nat. i = j}) \<sqinter> \<Sqinter> (f i ` {j::nat. i < j}) \<sqinter> \<Sqinter> (f i ` {j::nat. j < i})

goal:
No subgoals!
variables:
i :: nat
f :: nat \<Rightarrow> nat \<Rightarrow> 'a
type variables:
'a :: refinement_lattice
[PROOF STEP]
qed


[STATEMENT]
lemma sup_fin_closed: "finite A \<Longrightarrow> A \<noteq> {} \<Longrightarrow>
  (\<And>x y. x \<in> A \<Longrightarrow> y \<in> A \<Longrightarrow> sup x y \<in> {x, y}) \<Longrightarrow> \<Squnion>\<^sub>f\<^sub>i\<^sub>n A \<in> A"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>finite A; A \<noteq> {}; \<And>x y. \<lbrakk>x \<in> A; y \<in> A\<rbrakk> \<Longrightarrow> sup x y \<in> {x, y}\<rbrakk> \<Longrightarrow> \<Squnion>\<^sub>f\<^sub>i\<^sub>n A \<in> A
[PROOF STEP]
apply (induct A rule: finite.induct)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>{} \<noteq> {}; \<And>x y. \<lbrakk>x \<in> {}; y \<in> {}\<rbrakk> \<Longrightarrow> sup x y \<in> {x, y}\<rbrakk> \<Longrightarrow> \<Squnion>\<^sub>f\<^sub>i\<^sub>n {} \<in> {}
 2. \<And>A a. \<lbrakk>finite A; \<lbrakk>A \<noteq> {}; \<And>x y. \<lbrakk>x \<in> A; y \<in> A\<rbrakk> \<Longrightarrow> sup x y \<in> {x, y}\<rbrakk> \<Longrightarrow> \<Squnion>\<^sub>f\<^sub>i\<^sub>n A \<in> A; insert a A \<noteq> {}; \<And>x y. \<lbrakk>x \<in> insert a A; y \<in> insert a A\<rbrakk> \<Longrightarrow> sup x y \<in> {x, y}\<rbrakk> \<Longrightarrow> \<Squnion>\<^sub>f\<^sub>i\<^sub>n insert a A \<in> insert a A
[PROOF STEP]
using Sup_fin.insert
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>finite ?A; ?A \<noteq> {}\<rbrakk> \<Longrightarrow> \<Squnion>\<^sub>f\<^sub>i\<^sub>n insert ?x ?A = sup ?x (\<Squnion>\<^sub>f\<^sub>i\<^sub>n ?A)

goal (2 subgoals):
 1. \<lbrakk>{} \<noteq> {}; \<And>x y. \<lbrakk>x \<in> {}; y \<in> {}\<rbrakk> \<Longrightarrow> sup x y \<in> {x, y}\<rbrakk> \<Longrightarrow> \<Squnion>\<^sub>f\<^sub>i\<^sub>n {} \<in> {}
 2. \<And>A a. \<lbrakk>finite A; \<lbrakk>A \<noteq> {}; \<And>x y. \<lbrakk>x \<in> A; y \<in> A\<rbrakk> \<Longrightarrow> sup x y \<in> {x, y}\<rbrakk> \<Longrightarrow> \<Squnion>\<^sub>f\<^sub>i\<^sub>n A \<in> A; insert a A \<noteq> {}; \<And>x y. \<lbrakk>x \<in> insert a A; y \<in> insert a A\<rbrakk> \<Longrightarrow> sup x y \<in> {x, y}\<rbrakk> \<Longrightarrow> \<Squnion>\<^sub>f\<^sub>i\<^sub>n insert a A \<in> insert a A
[PROOF STEP]
by auto fastforce


[STATEMENT]
lemma still_reachable_eq: "\<lbrakk> A\<subseteq>Rb\<^sup>*``B; B\<subseteq>Ra\<^sup>*``A; \<forall> (x,y) \<in> Ra-Rb. y \<in>(Rb\<^sup>*``B); \<forall> (x,y) \<in> Rb-Ra. y\<in> (Ra\<^sup>*``A)\<rbrakk> \<Longrightarrow> Ra\<^sup>*``A =  Rb\<^sup>*``B "
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>A \<subseteq> Rb\<^sup>* `` B; B \<subseteq> Ra\<^sup>* `` A; \<forall>(x, y)\<in>Ra - Rb. y \<in> Rb\<^sup>* `` B; \<forall>(x, y)\<in>Rb - Ra. y \<in> Ra\<^sup>* `` A\<rbrakk> \<Longrightarrow> Ra\<^sup>* `` A = Rb\<^sup>* `` B
[PROOF STEP]
apply (rule equalityI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>A \<subseteq> Rb\<^sup>* `` B; B \<subseteq> Ra\<^sup>* `` A; \<forall>(x, y)\<in>Ra - Rb. y \<in> Rb\<^sup>* `` B; \<forall>(x, y)\<in>Rb - Ra. y \<in> Ra\<^sup>* `` A\<rbrakk> \<Longrightarrow> Ra\<^sup>* `` A \<subseteq> Rb\<^sup>* `` B
 2. \<lbrakk>A \<subseteq> Rb\<^sup>* `` B; B \<subseteq> Ra\<^sup>* `` A; \<forall>(x, y)\<in>Ra - Rb. y \<in> Rb\<^sup>* `` B; \<forall>(x, y)\<in>Rb - Ra. y \<in> Ra\<^sup>* `` A\<rbrakk> \<Longrightarrow> Rb\<^sup>* `` B \<subseteq> Ra\<^sup>* `` A
[PROOF STEP]
apply (erule still_reachable ,assumption)+
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma cartesian_product_memE':
  assumes "x \<in> cartesian_product A B"
  obtains a b where "a \<in> A \<and> b \<in> B \<and> x = a@b"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>a b. a \<in> A \<and> b \<in> B \<and> x = a @ b \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
x \<in> cartesian_product A B

goal (1 subgoal):
 1. (\<And>a b. a \<in> A \<and> b \<in> B \<and> x = a @ b \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
unfolding cartesian_product_def
[PROOF STATE]
proof (prove)
using this:
x \<in> {xs. \<exists>as\<in>A. \<exists>bs\<in>B. xs = as @ bs}

goal (1 subgoal):
 1. (\<And>a b. a \<in> A \<and> b \<in> B \<and> x = a @ b \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast


[STATEMENT]
lemma first_entrance_disjoint:
  "disjoint_family (first_entrance_set A)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. disjoint_family (first_entrance_set A)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. disjoint_family (first_entrance_set A)
[PROOF STEP]
have "first_entrance_set A = disjointed (\<lambda>i. (T^^i)--`A)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. first_entrance_set A = disjointed (\<lambda>i. (T ^^ i) --` A)
[PROOF STEP]
by (auto simp add: disjointed_def first_entrance_set_def)
[PROOF STATE]
proof (state)
this:
first_entrance_set A = disjointed (\<lambda>i. (T ^^ i) --` A)

goal (1 subgoal):
 1. disjoint_family (first_entrance_set A)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
first_entrance_set A = disjointed (\<lambda>i. (T ^^ i) --` A)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
first_entrance_set A = disjointed (\<lambda>i. (T ^^ i) --` A)

goal (1 subgoal):
 1. disjoint_family (first_entrance_set A)
[PROOF STEP]
by (simp add: disjoint_family_disjointed)
[PROOF STATE]
proof (state)
this:
disjoint_family (first_entrance_set A)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma mult_right_ennreal_cancel: "a * ennreal c = b * ennreal c \<longleftrightarrow> (a = b \<or> c \<le> 0)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (a * ennreal c = b * ennreal c) = (a = b \<or> c \<le> 0)
[PROOF STEP]
proof (cases "0 \<le> c")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. 0 \<le> c \<Longrightarrow> (a * ennreal c = b * ennreal c) = (a = b \<or> c \<le> 0)
 2. \<not> 0 \<le> c \<Longrightarrow> (a * ennreal c = b * ennreal c) = (a = b \<or> c \<le> 0)
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
0 \<le> c

goal (2 subgoals):
 1. 0 \<le> c \<Longrightarrow> (a * ennreal c = b * ennreal c) = (a = b \<or> c \<le> 0)
 2. \<not> 0 \<le> c \<Longrightarrow> (a * ennreal c = b * ennreal c) = (a = b \<or> c \<le> 0)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
0 \<le> c
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
0 \<le> c

goal (1 subgoal):
 1. (a * ennreal c = b * ennreal c) = (a = b \<or> c \<le> 0)
[PROOF STEP]
by (metis ennreal_eq_0_iff ennreal_mult_right_cong ennreal_neq_top mult_divide_eq_ennreal)
[PROOF STATE]
proof (state)
this:
(a * ennreal c = b * ennreal c) = (a = b \<or> c \<le> 0)

goal (1 subgoal):
 1. \<not> 0 \<le> c \<Longrightarrow> (a * ennreal c = b * ennreal c) = (a = b \<or> c \<le> 0)
[PROOF STEP]
qed (use ennreal_neg in auto)


[STATEMENT]
lemma distinct_quicksort [simp]: "distinct (quicksort xs) = distinct xs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. distinct (quicksort xs) = distinct xs
[PROOF STEP]
by(simp add: quicksort_def distinct_quicksort_acc)


[STATEMENT]
lemma mod_add:"
  ((a + k) mod m = (b + k) mod m) =
  ((a::nat) mod m = b mod m)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((a + k) mod m = (b + k) mod m) = (a mod m = b mod m)
[PROOF STEP]
by (induct "k", simp_all add: mod_Suc_conv)


[STATEMENT]
lemma continuous_at_within_inverse[continuous_intros]:
  fixes f :: "'a::t2_space \<Rightarrow> 'b::real_normed_div_algebra"
  assumes "continuous (at a within s) f"
    and "f a \<noteq> 0"
  shows "continuous (at a within s) (\<lambda>x. inverse (f x))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. continuous (at a within s) (\<lambda>x. inverse (f x))
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
continuous (at a within s) f
f a \<noteq> (0::'b)

goal (1 subgoal):
 1. continuous (at a within s) (\<lambda>x. inverse (f x))
[PROOF STEP]
unfolding continuous_within
[PROOF STATE]
proof (prove)
using this:
(f \<longlongrightarrow> f a) (at a within s)
f a \<noteq> (0::'b)

goal (1 subgoal):
 1. ((\<lambda>x. inverse (f x)) \<longlongrightarrow> inverse (f a)) (at a within s)
[PROOF STEP]
by (rule tendsto_inverse)


[STATEMENT]
lemma ipv4addr_of_dotdecimal_eqE:
    "\<lbrakk> ipv4addr_of_dotdecimal (a,b,c,d) = ipv4addr_of_dotdecimal (e,f,g,h);
       a < 256; b < 256; c < 256; d < 256; e < 256; f < 256; g < 256; h < 256 \<rbrakk> \<Longrightarrow>
         a = e \<and> b = f \<and> c = g \<and> d = h"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ipv4addr_of_dotdecimal (a, b, c, d) = ipv4addr_of_dotdecimal (e, f, g, h); a < 256; b < 256; c < 256; d < 256; e < 256; f < 256; g < 256; h < 256\<rbrakk> \<Longrightarrow> a = e \<and> b = f \<and> c = g \<and> d = h
[PROOF STEP]
by (metis Pair_inject dotdecimal_of_ipv4addr_ipv4addr_of_dotdecimal)


[STATEMENT]
lemma LIMSEQ_abs_realpow_zero: "\<bar>c\<bar> < 1 \<Longrightarrow> (\<lambda>n. \<bar>c\<bar> ^ n :: real) \<longlonglongrightarrow> 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<bar>c\<bar> < 1 \<Longrightarrow> (^) \<bar>c\<bar> \<longlonglongrightarrow> 0
[PROOF STEP]
by (rule LIMSEQ_realpow_zero [OF abs_ge_zero])


[STATEMENT]
lemma condensation_inequality:
  assumes mono: "\<And>m n. 0 < m \<Longrightarrow> m \<le> n \<Longrightarrow> f n \<le> f m"
  shows   "(\<Sum>k=1..<n. f k) \<ge> (\<Sum>k=1..<n. f (2 * 2 ^ Discrete.log k))" (is "?thesis1")
          "(\<Sum>k=1..<n. f k) \<le> (\<Sum>k=1..<n. f (2 ^ Discrete.log k))" (is "?thesis2")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Sum>k = 1..<n. f (2 * 2 ^ Discrete.log k)) \<le> sum f {1..<n} &&& sum f {1..<n} \<le> (\<Sum>k = 1..<n. f (2 ^ Discrete.log k))
[PROOF STEP]
by (intro sum_mono mono Discrete.log_exp2_ge Discrete.log_exp2_le, simp, simp)+


[STATEMENT]
lemma bind_RES_RETURN2_eq: "bind (RES X) (\<lambda>(x,y). RETURN (f x y)) =
  RES { f x y | x y. (x,y)\<in>X }"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. RES X \<bind> (\<lambda>(x, y). RETURN (f x y)) = SPEC (\<lambda>uu_. \<exists>x y. uu_ = f x y \<and> (x, y) \<in> X)
[PROOF STEP]
apply (simp add: pw_eq_iff refine_pw_simps)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>x. (\<exists>a b. (a, b) \<in> X \<and> f a b = x) = (\<exists>xa y. x = f xa y \<and> (xa, y) \<in> X)
[PROOF STEP]
apply blast
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma wqo_on_subset:
  "A \<subseteq> B \<Longrightarrow> wqo_on P B \<Longrightarrow> wqo_on P A"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>A \<subseteq> B; wqo_on P B\<rbrakk> \<Longrightarrow> wqo_on P A
[PROOF STEP]
using almost_full_on_subset [of A B P]
    and transp_on_subset [of A B P]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>A \<subseteq> B; almost_full_on P B\<rbrakk> \<Longrightarrow> almost_full_on P A
\<lbrakk>A \<subseteq> B; transp_on P B\<rbrakk> \<Longrightarrow> transp_on P A

goal (1 subgoal):
 1. \<lbrakk>A \<subseteq> B; wqo_on P B\<rbrakk> \<Longrightarrow> wqo_on P A
[PROOF STEP]
unfolding wqo_on_def
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>A \<subseteq> B; almost_full_on P B\<rbrakk> \<Longrightarrow> almost_full_on P A
\<lbrakk>A \<subseteq> B; transp_on P B\<rbrakk> \<Longrightarrow> transp_on P A

goal (1 subgoal):
 1. \<lbrakk>A \<subseteq> B; transp_on P B \<and> almost_full_on P B\<rbrakk> \<Longrightarrow> transp_on P A \<and> almost_full_on P A
[PROOF STEP]
by blast


[STATEMENT]
theorem regular_empty:  "regular {}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. regular {}
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. regular {}
[PROOF STEP]
interpret D: dfa "\<lparr>dfa.states = {0}, init = 0, final = {}, nxt = \<lambda>q x. q\<rparr>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. dfa \<lparr>dfa.states = {0}, init = 0, final = {}, nxt = \<lambda>q x. q\<rparr>
[PROOF STEP]
by (auto simp: dfa_def)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. regular {}
[PROOF STEP]
have "D.language = {}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. D.language = {}
[PROOF STEP]
by (simp add: D.language_def)
[PROOF STATE]
proof (state)
this:
D.language = {}

goal (1 subgoal):
 1. regular {}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
D.language = {}
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
D.language = {}

goal (1 subgoal):
 1. regular {}
[PROOF STEP]
unfolding regular_def dfa_def
[PROOF STATE]
proof (prove)
using this:
D.language = {}

goal (1 subgoal):
 1. \<exists>M. ((dfa.init M \<in> dfa.states M \<and> dfa.final M \<subseteq> dfa.states M) \<and> (\<forall>q x. q \<in> dfa.states M \<longrightarrow> dfa.nxt M q x \<in> dfa.states M) \<and> finite (dfa.states M)) \<and> dfa.language M = {}
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
regular {}

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma uniqAppendIff:
  "uniq (l1 @ l2) = (uniq l1 \<and> uniq l2 \<and> set l1 \<inter> set l2 = {})" (is "?lhs = ?rhs")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. uniq (l1 @ l2) = (uniq l1 \<and> uniq l2 \<and> set l1 \<inter> set l2 = {})
[PROOF STEP]
by (induct l1) auto


[STATEMENT]
lemma mod_eq_div_right_strict_mono_on: "
  \<lbrakk> 0 < (k::nat); \<forall>x\<in>I. \<forall>y\<in>I. x mod k = y mod k \<rbrakk> \<Longrightarrow>
  strict_mono_on (\<lambda>x. x div k) I"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 < k; \<forall>x\<in>I. \<forall>y\<in>I. x mod k = y mod k\<rbrakk> \<Longrightarrow> SetInterval2.strict_mono_on (\<lambda>x. x div k) I
[PROOF STEP]
apply (rule div_right_strict_mono_on, simp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 < k; \<forall>x\<in>I. \<forall>y\<in>I. x mod k = y mod k\<rbrakk> \<Longrightarrow> \<forall>x\<in>I. \<forall>y\<in>I. x < y \<longrightarrow> x + k \<le> y
[PROOF STEP]
apply (blast intro: less_mod_eq_imp_add_divisor_le)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma "eventually (\<lambda>i::real. i powr (-i/(i-1)) - i powr (-1/(i-1)) < 1) (at_right 0)"
  and "eventually (\<lambda>i::real. i powr (-i/(i-1)) - i powr (-1/(i-1)) > -1) at_top"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>\<^sub>F i in at_right 0. i powr (- i / (i - 1)) - i powr (- 1 / (i - 1)) < 1 &&& \<forall>\<^sub>F i in at_top. - 1 < i powr (- i / (i - 1)) - i powr (- 1 / (i - 1))
[PROOF STEP]
by real_asymp+


[STATEMENT]
lemma bij_imp_card: assumes bij: "bij f" shows "card {x. P (f x)} = card {x. P x}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. card {x. P (f x)} = card {x. P x}
[PROOF STEP]
unfolding bij_imp_Collect_image[OF bij] bij_imp_card_image[OF bij_imp_bij_inv[OF bij]]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. card (Collect P) = card {x. P x}
[PROOF STEP]
..


[STATEMENT]
lemma connected_convex_1:
  fixes S :: "real set"
  shows "connected S \<longleftrightarrow> convex S"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. connected S = convex S
[PROOF STEP]
by (metis is_interval_convex convex_connected is_interval_connected_1)


[STATEMENT]
lemma real_of_int_div3: "real_of_int n / real_of_int x - real_of_int (n div x) \<le> 1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. real_of_int n / real_of_int x - real_of_int (n div x) \<le> 1
[PROOF STEP]
apply (simp add: algebra_simps)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. real_of_int n / real_of_int x \<le> 1 + real_of_int (n div x)
[PROOF STEP]
by (metis add.commute floor_correct floor_divide_of_int_eq less_eq_real_def of_int_1 of_int_add)


[STATEMENT]
lemma nat_power_of_nat [simp]: "m > 0 \<Longrightarrow> nat_power m (of_nat n) = of_nat (m ^ n)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 < m \<Longrightarrow> nat_power m (of_nat n) = of_nat (m ^ n)
[PROOF STEP]
by (induction n) (simp_all add: nat_power_add)


[STATEMENT]
lemma sint_range:
  assumes b1:"real_of_int (sint ra) < real_of_int (sint POS_INF)"
  assumes b2:"real_of_int (sint NEG_INF) < real_of_int (sint ra)"
  shows "sint ra  \<in> {i. i > -((2^31)-1)  \<and> i < (2^31)-1}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. sint ra \<in> {i. - (2 ^ 31 - 1) < i \<and> i < 2 ^ 31 - 1}
[PROOF STEP]
using b1 b2
[PROOF STATE]
proof (prove)
using this:
real_of_int (sint ra) < real_of_int (sint POS_INF)
real_of_int (sint NEG_INF) < real_of_int (sint ra)

goal (1 subgoal):
 1. sint ra \<in> {i. - (2 ^ 31 - 1) < i \<and> i < 2 ^ 31 - 1}
[PROOF STEP]
by auto


[STATEMENT]
lemma quadratic_eq_factoring:
  assumes D : "D = b\<^sup>2 - 4 * a * c"
  assumes nn: "0 \<le> D"
  assumes x1: "x\<^sub>1 = (-b + sqrt D) / (2 * a)"
  assumes x2: "x\<^sub>2 = (-b - sqrt D) / (2 * a)"
  assumes a : "a \<noteq> 0"
  shows "a * x\<^sup>2 + b * x + c = a * (x - x\<^sub>1) * (x - x\<^sub>2)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. a * x\<^sup>2 + b * x + c = a * (x - x\<^sub>1) * (x - x\<^sub>2)
[PROOF STEP]
using nn
[PROOF STATE]
proof (prove)
using this:
0 \<le> D

goal (1 subgoal):
 1. a * x\<^sup>2 + b * x + c = a * (x - x\<^sub>1) * (x - x\<^sub>2)
[PROOF STEP]
by (simp add: D x1 x2)
     (simp add: assms power2_eq_square power3_eq_cube field_split_simps)


[STATEMENT]
lemma iT_Mult_inext_nth: "I \<noteq> {} \<Longrightarrow> (I \<otimes> k) \<rightarrow> n = (I \<rightarrow> n) * k"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. I \<noteq> {} \<Longrightarrow> (I \<otimes> k) \<rightarrow> n = (I \<rightarrow> n) * k
[PROOF STEP]
apply (induct n)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. I \<noteq> {} \<Longrightarrow> (I \<otimes> k) \<rightarrow> 0 = (I \<rightarrow> 0) * k
 2. \<And>n. \<lbrakk>I \<noteq> {} \<Longrightarrow> (I \<otimes> k) \<rightarrow> n = (I \<rightarrow> n) * k; I \<noteq> {}\<rbrakk> \<Longrightarrow> (I \<otimes> k) \<rightarrow> Suc n = (I \<rightarrow> Suc n) * k
[PROOF STEP]
apply (simp add: iT_Mult_Min)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>n. \<lbrakk>I \<noteq> {} \<Longrightarrow> (I \<otimes> k) \<rightarrow> n = (I \<rightarrow> n) * k; I \<noteq> {}\<rbrakk> \<Longrightarrow> (I \<otimes> k) \<rightarrow> Suc n = (I \<rightarrow> Suc n) * k
[PROOF STEP]
apply (simp add: iT_Mult_inext)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma one_matrix_inverse: "inverse_matrix (one_matrix n) (one_matrix n)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. inverse_matrix (one_matrix n) (one_matrix n)
[PROOF STEP]
by (simp add: inverse_matrix_def left_inverse_matrix_def right_inverse_matrix_def)


[STATEMENT]
lemma is_a_proper_intersec_is_a_intersec:
  assumes "is_a_proper_intersec P A B C D"
  shows "is_a_intersec P A B C D"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. is_a_intersec P A B C D
[PROOF STEP]
using assms is_a_intersec_def is_a_proper_intersec_def
[PROOF STATE]
proof (prove)
using this:
is_a_proper_intersec P A B C D
is_a_intersec ?P ?A ?B ?C ?D \<equiv> col ?P ?A ?B \<and> col ?P ?C ?D
is_a_proper_intersec ?P ?A ?B ?C ?D \<equiv> ?A \<noteq> ?B \<and> ?C \<noteq> ?D \<and> line ?A ?B \<noteq> line ?C ?D \<and> col ?P ?A ?B \<and> col ?P ?C ?D

goal (1 subgoal):
 1. is_a_intersec P A B C D
[PROOF STEP]
by auto


[STATEMENT]
lemma separation_by_Un_closed:
  fixes S :: "'a :: euclidean_space set"
  assumes ST: "closed S" "closed T" "S \<inter> T = {}" and conS: "connected(- S)" and conT: "connected(- T)"
  shows "connected(- (S \<union> T))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. connected (- (S \<union> T))
[PROOF STEP]
using assms separation_by_Un_closed_pointwise
[PROOF STATE]
proof (prove)
using this:
closed S
closed T
S \<inter> T = {}
connected (- S)
connected (- T)
\<lbrakk>closed ?S; closed ?T; ?S \<inter> ?T = {}; connected_component (- ?S) ?a ?b; connected_component (- ?T) ?a ?b\<rbrakk> \<Longrightarrow> connected_component (- (?S \<union> ?T)) ?a ?b

goal (1 subgoal):
 1. connected (- (S \<union> T))
[PROOF STEP]
by (fastforce simp add: connected_iff_connected_component)


[STATEMENT]
lemma group_eq_pow_eq_mod:
  fixes a b :: nat
  assumes "\<^bold>g [^] a = \<^bold>g [^] b"
    and "order G > 0"
  shows "[a = b] (mod order G)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. [a = b] (mod order G)
[PROOF STEP]
proof(cases "a > b")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. b < a \<Longrightarrow> [a = b] (mod order G)
 2. \<not> b < a \<Longrightarrow> [a = b] (mod order G)
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
b < a

goal (2 subgoals):
 1. b < a \<Longrightarrow> [a = b] (mod order G)
 2. \<not> b < a \<Longrightarrow> [a = b] (mod order G)
[PROOF STEP]
have "\<^bold>g [^] a \<otimes> inv (\<^bold>g [^] b) = \<one>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<^bold>g [^] a \<otimes> inv (\<^bold>g [^] b) = \<one>
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
\<^bold>g [^] a = \<^bold>g [^] b
0 < order G

goal (1 subgoal):
 1. \<^bold>g [^] a \<otimes> inv (\<^bold>g [^] b) = \<one>
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<^bold>g [^] a \<otimes> inv (\<^bold>g [^] b) = \<one>

goal (2 subgoals):
 1. b < a \<Longrightarrow> [a = b] (mod order G)
 2. \<not> b < a \<Longrightarrow> [a = b] (mod order G)
[PROOF STEP]
hence "\<^bold>g [^] (a - b) = \<one>"
[PROOF STATE]
proof (prove)
using this:
\<^bold>g [^] a \<otimes> inv (\<^bold>g [^] b) = \<one>

goal (1 subgoal):
 1. \<^bold>g [^] (a - b) = \<one>
[PROOF STEP]
by (smt True add_Suc_right assms diff_add_inverse generator_closed group.l_cancel_one' group_l_invI l_inv_ex less_imp_Suc_add nat_pow_closed nat_pow_mult)
[PROOF STATE]
proof (state)
this:
\<^bold>g [^] (a - b) = \<one>

goal (2 subgoals):
 1. b < a \<Longrightarrow> [a = b] (mod order G)
 2. \<not> b < a \<Longrightarrow> [a = b] (mod order G)
[PROOF STEP]
hence "\<^bold>g [^] ((a - b) mod (order G)) = \<one>"
[PROOF STATE]
proof (prove)
using this:
\<^bold>g [^] (a - b) = \<one>

goal (1 subgoal):
 1. \<^bold>g [^] ((a - b) mod order G) = \<one>
[PROOF STEP]
using pow_generator_mod
[PROOF STATE]
proof (prove)
using this:
\<^bold>g [^] (a - b) = \<one>
\<^bold>g [^] (?k mod order G) = \<^bold>g [^] ?k

goal (1 subgoal):
 1. \<^bold>g [^] ((a - b) mod order G) = \<one>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<^bold>g [^] ((a - b) mod order G) = \<one>

goal (2 subgoals):
 1. b < a \<Longrightarrow> [a = b] (mod order G)
 2. \<not> b < a \<Longrightarrow> [a = b] (mod order G)
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
\<^bold>g [^] ((a - b) mod order G) = \<one>

goal (1 subgoal):
 1. [a = b] (mod order G)
[PROOF STEP]
using gen_power_0
[PROOF STATE]
proof (prove)
using this:
\<^bold>g [^] ((a - b) mod order G) = \<one>
\<lbrakk>\<^bold>g [^] ?r = \<one>; ?r < order G\<rbrakk> \<Longrightarrow> ?r = 0

goal (1 subgoal):
 1. [a = b] (mod order G)
[PROOF STEP]
using assms(1) assms(2) order_gt_0_iff_finite pow_generator_eq_iff_cong
[PROOF STATE]
proof (prove)
using this:
\<^bold>g [^] ((a - b) mod order G) = \<one>
\<lbrakk>\<^bold>g [^] ?r = \<one>; ?r < order G\<rbrakk> \<Longrightarrow> ?r = 0
\<^bold>g [^] a = \<^bold>g [^] b
0 < order G
(0 < order G) = finite (carrier G)
finite (carrier G) \<Longrightarrow> (\<^bold>g [^] ?x = \<^bold>g [^] ?y) = [?x = ?y] (mod order G)

goal (1 subgoal):
 1. [a = b] (mod order G)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
[a = b] (mod order G)

goal (1 subgoal):
 1. \<not> b < a \<Longrightarrow> [a = b] (mod order G)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> b < a \<Longrightarrow> [a = b] (mod order G)
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
\<not> b < a

goal (1 subgoal):
 1. \<not> b < a \<Longrightarrow> [a = b] (mod order G)
[PROOF STEP]
have "\<^bold>g [^] a \<otimes> inv (\<^bold>g [^] b) = \<one>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<^bold>g [^] a \<otimes> inv (\<^bold>g [^] b) = \<one>
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
\<^bold>g [^] a = \<^bold>g [^] b
0 < order G

goal (1 subgoal):
 1. \<^bold>g [^] a \<otimes> inv (\<^bold>g [^] b) = \<one>
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<^bold>g [^] a \<otimes> inv (\<^bold>g [^] b) = \<one>

goal (1 subgoal):
 1. \<not> b < a \<Longrightarrow> [a = b] (mod order G)
[PROOF STEP]
hence "\<^bold>g [^] (b - a) = \<one>"
[PROOF STATE]
proof (prove)
using this:
\<^bold>g [^] a \<otimes> inv (\<^bold>g [^] b) = \<one>

goal (1 subgoal):
 1. \<^bold>g [^] (b - a) = \<one>
[PROOF STEP]
by (metis (no_types, lifting) False Group.group.axioms(1) Units_eq add_diff_inverse_nat assms(1) generator_closed group_l_invI l_inv_ex l_neq_1_exp_neq_0 monoid.Units_l_cancel nat_pow_closed nat_pow_mult r_one)
[PROOF STATE]
proof (state)
this:
\<^bold>g [^] (b - a) = \<one>

goal (1 subgoal):
 1. \<not> b < a \<Longrightarrow> [a = b] (mod order G)
[PROOF STEP]
hence "\<^bold>g [^] ((b - a) mod (order G)) = \<one>"
[PROOF STATE]
proof (prove)
using this:
\<^bold>g [^] (b - a) = \<one>

goal (1 subgoal):
 1. \<^bold>g [^] ((b - a) mod order G) = \<one>
[PROOF STEP]
using pow_generator_mod
[PROOF STATE]
proof (prove)
using this:
\<^bold>g [^] (b - a) = \<one>
\<^bold>g [^] (?k mod order G) = \<^bold>g [^] ?k

goal (1 subgoal):
 1. \<^bold>g [^] ((b - a) mod order G) = \<one>
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<^bold>g [^] ((b - a) mod order G) = \<one>

goal (1 subgoal):
 1. \<not> b < a \<Longrightarrow> [a = b] (mod order G)
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
\<^bold>g [^] ((b - a) mod order G) = \<one>

goal (1 subgoal):
 1. [a = b] (mod order G)
[PROOF STEP]
using gen_power_0
[PROOF STATE]
proof (prove)
using this:
\<^bold>g [^] ((b - a) mod order G) = \<one>
\<lbrakk>\<^bold>g [^] ?r = \<one>; ?r < order G\<rbrakk> \<Longrightarrow> ?r = 0

goal (1 subgoal):
 1. [a = b] (mod order G)
[PROOF STEP]
using assms(1) assms(2) order_gt_0_iff_finite pow_generator_eq_iff_cong
[PROOF STATE]
proof (prove)
using this:
\<^bold>g [^] ((b - a) mod order G) = \<one>
\<lbrakk>\<^bold>g [^] ?r = \<one>; ?r < order G\<rbrakk> \<Longrightarrow> ?r = 0
\<^bold>g [^] a = \<^bold>g [^] b
0 < order G
(0 < order G) = finite (carrier G)
finite (carrier G) \<Longrightarrow> (\<^bold>g [^] ?x = \<^bold>g [^] ?y) = [?x = ?y] (mod order G)

goal (1 subgoal):
 1. [a = b] (mod order G)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
[a = b] (mod order G)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
theorem wls_freshAbs_psubstAbs:
assumes "wlsAbs (us,s) A" and "wlsEnv rho"
shows
"freshAbs zs z (A $[rho]) =
 (\<forall> ys y. freshAbs ys y A \<or> freshImEnvAt zs z rho ys y)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. freshAbs zs z A $[rho] = (\<forall>ys y. freshAbs ys y A \<or> freshImEnvAt zs z rho ys y)
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
wlsAbs (us, s) A
wlsEnv rho

goal (1 subgoal):
 1. freshAbs zs z A $[rho] = (\<forall>ys y. freshAbs ys y A \<or> freshImEnvAt zs z rho ys y)
[PROOF STEP]
by(simp add: freshAbs_psubstAbs)


[STATEMENT]
lemma vcpower_vsubset_mono:
  assumes "A \<subseteq>\<^sub>\<circ> B"
  shows "A ^\<^sub>\<times> n \<subseteq>\<^sub>\<circ> B ^\<^sub>\<times> n"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. A ^\<^sub>\<times> n \<subseteq>\<^sub>\<circ> B ^\<^sub>\<times> n
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
A \<subseteq>\<^sub>\<circ> B

goal (1 subgoal):
 1. A ^\<^sub>\<times> n \<subseteq>\<^sub>\<circ> B ^\<^sub>\<times> n
[PROOF STEP]
by (intro vsubsetI vcpowerI vproductI)
    (auto intro: vproductD[OF vcpowerD, rule_format])


[STATEMENT]
lemma Zmax_plus1:"f \<in> {j. j \<le> (n::nat)} \<rightarrow> (UNIV::int set) \<Longrightarrow>
           ((Zmax n f) + 1) \<notin> f ` {j. j \<le> n}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. f \<in> {j. j \<le> n} \<rightarrow> UNIV \<Longrightarrow> Zmax n f + 1 \<notin> f ` {j. j \<le> n}
[PROOF STEP]
apply (cut_tac  Zmax_geTr[of f n])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>f \<in> {j. j \<le> n} \<rightarrow> UNIV; f \<in> {j. j \<le> n} \<rightarrow> UNIV \<longrightarrow> (\<forall>j\<in>{j. j \<le> n}. f j \<le> Zmax n f)\<rbrakk> \<Longrightarrow> Zmax n f + 1 \<notin> f ` {j. j \<le> n}
[PROOF STEP]
apply (rule contrapos_pp, simp+)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<forall>j\<le>n. f j \<le> Zmax n f; Zmax n f + 1 \<in> f ` {j. j \<le> n}\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply (simp add:image_def, erule exE, erule conjE)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>\<forall>j\<le>n. f j \<le> Zmax n f; x \<le> n; Zmax n f + 1 = f x\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply (frule_tac a = x in forall_spec, assumption,
       thin_tac "\<forall>j\<le>n. f j \<le> Zmax n f")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>x \<le> n; Zmax n f + 1 = f x; f x \<le> Zmax n f\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply (frule sym, thin_tac "Zmax n f + 1 = f x", simp)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma harm_nonneg: "harm n \<ge> (0 :: 'a :: {real_normed_field,linordered_field})"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (0::'a) \<le> harm n
[PROOF STEP]
unfolding harm_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (0::'a) \<le> (\<Sum>k = 1..n. inverse (of_nat k))
[PROOF STEP]
by (intro sum_nonneg) simp_all


[STATEMENT]
lemma finite_diff_not_empty:
  assumes "finite Y" and "card Y < card X"
  shows "X - Y \<noteq> {}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. X - Y \<noteq> {}
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. X - Y = {} \<Longrightarrow> False
[PROOF STEP]
assume "X - Y = {}"
[PROOF STATE]
proof (state)
this:
X - Y = {}

goal (1 subgoal):
 1. X - Y = {} \<Longrightarrow> False
[PROOF STEP]
hence "X \<subseteq> Y"
[PROOF STATE]
proof (prove)
using this:
X - Y = {}

goal (1 subgoal):
 1. X \<subseteq> Y
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
X \<subseteq> Y

goal (1 subgoal):
 1. X - Y = {} \<Longrightarrow> False
[PROOF STEP]
from card_mono[OF assms(1) this] assms(2)
[PROOF STATE]
proof (chain)
picking this:
card X \<le> card Y
card Y < card X
[PROOF STEP]
show False
[PROOF STATE]
proof (prove)
using this:
card X \<le> card Y
card Y < card X

goal (1 subgoal):
 1. False
[PROOF STEP]
by linarith
[PROOF STATE]
proof (state)
this:
False

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma currentLevelPrefix:
  assumes "isPrefix a b"
  shows "currentLevel a <= currentLevel b"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. currentLevel a \<le> currentLevel b
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
isPrefix a b

goal (1 subgoal):
 1. currentLevel a \<le> currentLevel b
[PROOF STEP]
unfolding isPrefix_def
[PROOF STATE]
proof (prove)
using this:
\<exists>s. a @ s = b

goal (1 subgoal):
 1. currentLevel a \<le> currentLevel b
[PROOF STEP]
unfolding currentLevel_def
[PROOF STATE]
proof (prove)
using this:
\<exists>s. a @ s = b

goal (1 subgoal):
 1. length (markedElements a) \<le> length (markedElements b)
[PROOF STEP]
by (auto simp add: markedElementsAppend)


[STATEMENT]
lemma hyperplane_face_of_halfspace_le: "{x. a \<bullet> x = b} face_of {x. a \<bullet> x \<le> b}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {x. a \<bullet> x = b} face_of {x. a \<bullet> x \<le> b}
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. {x. a \<bullet> x = b} face_of {x. a \<bullet> x \<le> b}
[PROOF STEP]
have "{x. a \<bullet> x \<le> b} \<inter> {x. a \<bullet> x = b} = {x. a \<bullet> x = b}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {x. a \<bullet> x \<le> b} \<inter> {x. a \<bullet> x = b} = {x. a \<bullet> x = b}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
{x. a \<bullet> x \<le> b} \<inter> {x. a \<bullet> x = b} = {x. a \<bullet> x = b}

goal (1 subgoal):
 1. {x. a \<bullet> x = b} face_of {x. a \<bullet> x \<le> b}
[PROOF STEP]
with face_of_Int_supporting_hyperplane_le [OF convex_halfspace_le [of a b], of a b]
[PROOF STATE]
proof (chain)
picking this:
(\<And>x. x \<in> {x. a \<bullet> x \<le> b} \<Longrightarrow> a \<bullet> x \<le> b) \<Longrightarrow> {x. a \<bullet> x \<le> b} \<inter> {x. a \<bullet> x = b} face_of {x. a \<bullet> x \<le> b}
{x. a \<bullet> x \<le> b} \<inter> {x. a \<bullet> x = b} = {x. a \<bullet> x = b}
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
(\<And>x. x \<in> {x. a \<bullet> x \<le> b} \<Longrightarrow> a \<bullet> x \<le> b) \<Longrightarrow> {x. a \<bullet> x \<le> b} \<inter> {x. a \<bullet> x = b} face_of {x. a \<bullet> x \<le> b}
{x. a \<bullet> x \<le> b} \<inter> {x. a \<bullet> x = b} = {x. a \<bullet> x = b}

goal (1 subgoal):
 1. {x. a \<bullet> x = b} face_of {x. a \<bullet> x \<le> b}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
{x. a \<bullet> x = b} face_of {x. a \<bullet> x \<le> b}

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma mult_norm_matrix_sgn_eq:
  fixes x :: "('a::real_normed_algebra_1)^'n"
  shows "(\<parallel>A *v sgn x\<parallel>) * (\<parallel>x\<parallel>) = \<parallel>A *v x\<parallel>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<parallel>A *v sgn x\<parallel> * \<parallel>x\<parallel> = \<parallel>A *v x\<parallel>
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<parallel>A *v sgn x\<parallel> * \<parallel>x\<parallel> = \<parallel>A *v x\<parallel>
[PROOF STEP]
have "\<parallel>A *v x\<parallel> = \<parallel>A *v ((\<parallel>x\<parallel>) *\<^sub>R sgn x)\<parallel>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<parallel>A *v x\<parallel> = \<parallel>A *v \<parallel>x\<parallel> *\<^sub>R sgn x\<parallel>
[PROOF STEP]
by(simp add: scaleR_norm_sgn_eq)
[PROOF STATE]
proof (state)
this:
\<parallel>A *v x\<parallel> = \<parallel>A *v \<parallel>x\<parallel> *\<^sub>R sgn x\<parallel>

goal (1 subgoal):
 1. \<parallel>A *v sgn x\<parallel> * \<parallel>x\<parallel> = \<parallel>A *v x\<parallel>
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
\<parallel>A *v x\<parallel> = \<parallel>A *v \<parallel>x\<parallel> *\<^sub>R sgn x\<parallel>

goal (1 subgoal):
 1. \<parallel>A *v sgn x\<parallel> * \<parallel>x\<parallel> = \<parallel>A *v x\<parallel>
[PROOF STEP]
have "... = (\<parallel>A *v sgn x\<parallel>) * (\<parallel>x\<parallel>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<parallel>A *v \<parallel>x\<parallel> *\<^sub>R sgn x\<parallel> = \<parallel>A *v sgn x\<parallel> * \<parallel>x\<parallel>
[PROOF STEP]
by(simp add: vector_scaleR_commute)
[PROOF STATE]
proof (state)
this:
\<parallel>A *v \<parallel>x\<parallel> *\<^sub>R sgn x\<parallel> = \<parallel>A *v sgn x\<parallel> * \<parallel>x\<parallel>

goal (1 subgoal):
 1. \<parallel>A *v sgn x\<parallel> * \<parallel>x\<parallel> = \<parallel>A *v x\<parallel>
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
\<parallel>A *v x\<parallel> = \<parallel>A *v sgn x\<parallel> * \<parallel>x\<parallel>
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<parallel>A *v x\<parallel> = \<parallel>A *v sgn x\<parallel> * \<parallel>x\<parallel>

goal (1 subgoal):
 1. \<parallel>A *v sgn x\<parallel> * \<parallel>x\<parallel> = \<parallel>A *v x\<parallel>
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
\<parallel>A *v sgn x\<parallel> * \<parallel>x\<parallel> = \<parallel>A *v x\<parallel>

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma sincos_total_2pi_le:
  assumes "x\<^sup>2 + y\<^sup>2 = 1"
  shows "\<exists>t. 0 \<le> t \<and> t \<le> 2 * pi \<and> x = cos t \<and> y = sin t"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>t\<ge>0. t \<le> 2 * pi \<and> x = cos t \<and> y = sin t
[PROOF STEP]
proof (cases rule: le_cases [of 0 y])
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. 0 \<le> y \<Longrightarrow> \<exists>t\<ge>0. t \<le> 2 * pi \<and> x = cos t \<and> y = sin t
 2. y \<le> 0 \<Longrightarrow> \<exists>t\<ge>0. t \<le> 2 * pi \<and> x = cos t \<and> y = sin t
[PROOF STEP]
case le
[PROOF STATE]
proof (state)
this:
0 \<le> y

goal (2 subgoals):
 1. 0 \<le> y \<Longrightarrow> \<exists>t\<ge>0. t \<le> 2 * pi \<and> x = cos t \<and> y = sin t
 2. y \<le> 0 \<Longrightarrow> \<exists>t\<ge>0. t \<le> 2 * pi \<and> x = cos t \<and> y = sin t
[PROOF STEP]
from sincos_total_pi [OF le]
[PROOF STATE]
proof (chain)
picking this:
?x\<^sup>2 + y\<^sup>2 = 1 \<Longrightarrow> \<exists>t\<ge>0. t \<le> pi \<and> ?x = cos t \<and> y = sin t
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
?x\<^sup>2 + y\<^sup>2 = 1 \<Longrightarrow> \<exists>t\<ge>0. t \<le> pi \<and> ?x = cos t \<and> y = sin t

goal (1 subgoal):
 1. \<exists>t\<ge>0. t \<le> 2 * pi \<and> x = cos t \<and> y = sin t
[PROOF STEP]
by (metis assms le_add_same_cancel1 mult.commute mult_2_right order.trans)
[PROOF STATE]
proof (state)
this:
\<exists>t\<ge>0. t \<le> 2 * pi \<and> x = cos t \<and> y = sin t

goal (1 subgoal):
 1. y \<le> 0 \<Longrightarrow> \<exists>t\<ge>0. t \<le> 2 * pi \<and> x = cos t \<and> y = sin t
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. y \<le> 0 \<Longrightarrow> \<exists>t\<ge>0. t \<le> 2 * pi \<and> x = cos t \<and> y = sin t
[PROOF STEP]
case ge
[PROOF STATE]
proof (state)
this:
y \<le> 0

goal (1 subgoal):
 1. y \<le> 0 \<Longrightarrow> \<exists>t\<ge>0. t \<le> 2 * pi \<and> x = cos t \<and> y = sin t
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
y \<le> 0
[PROOF STEP]
have "0 \<le> -y"
[PROOF STATE]
proof (prove)
using this:
y \<le> 0

goal (1 subgoal):
 1. 0 \<le> - y
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
0 \<le> - y

goal (1 subgoal):
 1. y \<le> 0 \<Longrightarrow> \<exists>t\<ge>0. t \<le> 2 * pi \<and> x = cos t \<and> y = sin t
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
0 \<le> - y
[PROOF STEP]
obtain t where t: "t\<ge>0" "t \<le> pi" "x = cos t" "-y = sin t"
[PROOF STATE]
proof (prove)
using this:
0 \<le> - y

goal (1 subgoal):
 1. (\<And>t. \<lbrakk>0 \<le> t; t \<le> pi; x = cos t; - y = sin t\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using sincos_total_pi assms
[PROOF STATE]
proof (prove)
using this:
0 \<le> - y
\<lbrakk>0 \<le> ?y; ?x\<^sup>2 + ?y\<^sup>2 = 1\<rbrakk> \<Longrightarrow> \<exists>t\<ge>0. t \<le> pi \<and> ?x = cos t \<and> ?y = sin t
x\<^sup>2 + y\<^sup>2 = 1

goal (1 subgoal):
 1. (\<And>t. \<lbrakk>0 \<le> t; t \<le> pi; x = cos t; - y = sin t\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto (metis \<open>0 \<le> - y\<close> power2_minus)
[PROOF STATE]
proof (state)
this:
0 \<le> t
t \<le> pi
x = cos t
- y = sin t

goal (1 subgoal):
 1. y \<le> 0 \<Longrightarrow> \<exists>t\<ge>0. t \<le> 2 * pi \<and> x = cos t \<and> y = sin t
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>t\<ge>0. t \<le> 2 * pi \<and> x = cos t \<and> y = sin t
[PROOF STEP]
by (rule exI [where x = "2 * pi - t"]) (use t in auto)
[PROOF STATE]
proof (state)
this:
\<exists>t\<ge>0. t \<le> 2 * pi \<and> x = cos t \<and> y = sin t

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma SUP_approx_ennreal:
  fixes x::ennreal and e::real
  assumes "e > 0" "A \<noteq> {}"
  assumes SUP: "x = (SUP i \<in> A. f i)"
  assumes "x \<noteq> \<infinity>"
  shows "\<exists>i \<in> A. x < f i + e"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>i\<in>A. x < f i + ennreal e
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<exists>i\<in>A. x < f i + ennreal e
[PROOF STEP]
have "x < x + e"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x < x + ennreal e
[PROOF STEP]
using \<open>0<e\<close> \<open>x \<noteq> \<infinity>\<close>
[PROOF STATE]
proof (prove)
using this:
0 < e
x \<noteq> \<infinity>

goal (1 subgoal):
 1. x < x + ennreal e
[PROOF STEP]
by (cases x) auto
[PROOF STATE]
proof (state)
this:
x < x + ennreal e

goal (1 subgoal):
 1. \<exists>i\<in>A. x < f i + ennreal e
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
x < x + ennreal e

goal (1 subgoal):
 1. \<exists>i\<in>A. x < f i + ennreal e
[PROOF STEP]
have "x + e = (SUP i \<in> A. f i + e)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x + ennreal e = (SUP i\<in>A. f i + ennreal e)
[PROOF STEP]
unfolding SUP ennreal_SUP_add_left[OF \<open>A \<noteq> {}\<close>]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Sup (f ` A) + ennreal e = Sup (f ` A) + ennreal e
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
x + ennreal e = (SUP i\<in>A. f i + ennreal e)

goal (1 subgoal):
 1. \<exists>i\<in>A. x < f i + ennreal e
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
x < (SUP i\<in>A. f i + ennreal e)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
x < (SUP i\<in>A. f i + ennreal e)

goal (1 subgoal):
 1. \<exists>i\<in>A. x < f i + ennreal e
[PROOF STEP]
unfolding less_SUP_iff
[PROOF STATE]
proof (prove)
using this:
\<exists>xa\<in>A. x < f xa + ennreal e

goal (1 subgoal):
 1. \<exists>i\<in>A. x < f i + ennreal e
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
\<exists>i\<in>A. x < f i + ennreal e

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma ptensor_mat_trace:
  assumes "m1 \<in> carrier_mat d1 d1"
    and "m2 \<in> carrier_mat d2 d2"
  shows "trace (ptensor_mat m1 m2) = trace m1 * trace m2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. trace (ptensor_mat m1 m2) = trace m1 * trace m2
[PROOF STEP]
unfolding ptensor_mat_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. trace (tensor_mat dims0 vars1' m1 m2) = trace m1 * trace m2
[PROOF STEP]
apply (rule partial_state.tensor_mat_trace)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. m1 \<in> carrier_mat (partial_state.d1 dims0 vars1') (partial_state.d1 dims0 vars1')
 2. m2 \<in> carrier_mat (partial_state.d2 dims0 vars1') (partial_state.d2 dims0 vars1')
[PROOF STEP]
unfolding partial_state.d1_def partial_state.d2_def
    partial_state.dims1_def partial_state.dims2_def nths_vars1' nths_vars2'
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. m1 \<in> carrier_mat (prod_list dims1) (prod_list dims1)
 2. m2 \<in> carrier_mat (prod_list dims2) (prod_list dims2)
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
m1 \<in> carrier_mat d1 d1
m2 \<in> carrier_mat d2 d2

goal (2 subgoals):
 1. m1 \<in> carrier_mat (prod_list dims1) (prod_list dims1)
 2. m2 \<in> carrier_mat (prod_list dims2) (prod_list dims2)
[PROOF STEP]
unfolding d1_def d2_def
[PROOF STATE]
proof (prove)
using this:
m1 \<in> carrier_mat (prod_list dims1) (prod_list dims1)
m2 \<in> carrier_mat (prod_list dims2) (prod_list dims2)

goal (2 subgoals):
 1. m1 \<in> carrier_mat (prod_list dims1) (prod_list dims1)
 2. m2 \<in> carrier_mat (prod_list dims2) (prod_list dims2)
[PROOF STEP]
by auto


[STATEMENT]
lemma lspace_ennreal_iff:
  assumes "p > 0"
  shows "lspace (lebesgue_on S) (ennreal p) = {f \<in> borel_measurable (lebesgue_on S). integrable (lebesgue_on S) (\<lambda>x. (norm(f x) powr p))}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. lspace (lebesgue_on S) (ennreal p) = {f \<in> borel_measurable (lebesgue_on S). integrable (lebesgue_on S) (\<lambda>x. norm (f x) powr p)}
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
0 < p

goal (1 subgoal):
 1. lspace (lebesgue_on S) (ennreal p) = {f \<in> borel_measurable (lebesgue_on S). integrable (lebesgue_on S) (\<lambda>x. norm (f x) powr p)}
[PROOF STEP]
by (fastforce simp: Lp_measurable Lp_D intro: Lp_I)


[STATEMENT]
theorem B_trusts_NS3:
     "\<lbrakk>Says B A  (Crypt (pubEK A) \<lbrace>Nonce NA, Nonce NB\<rbrace>) \<in> set evs;
       Gets B (Crypt (pubEK B) (Nonce NB)) \<in> set evs;
       A \<notin> bad;  B \<notin> bad;  evs \<in> ns_public\<rbrakk>
      \<Longrightarrow> \<exists>C. Says A C (Crypt (pubEK C) (Nonce NB)) \<in> set evs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Says B A (Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB\<rbrace>) \<in> set evs; Gets B (Crypt (pubK B) (Nonce NB)) \<in> set evs; A \<notin> bad; B \<notin> bad; evs \<in> ns_public\<rbrakk> \<Longrightarrow> \<exists>C. Says A C (Crypt (pubK C) (Nonce NB)) \<in> set evs
[PROOF STEP]
by (blast intro: B_trusts_NS3_lemma)


[STATEMENT]
lemma (in Ring) mprodR_Suc:"\<lbrakk>e \<in> {j. j \<le> (Suc n)} \<rightarrow> {j. (0::nat) \<le> j};
                 f \<in> {j. j \<le> (Suc n)} \<rightarrow> carrier R\<rbrakk> \<Longrightarrow>
       mprod_expR R e f (Suc n) =
            (mprod_expR R e f n) \<cdot>\<^sub>r ((f (Suc n))^\<^bsup>R (e (Suc n))\<^esup>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>e \<in> {j. j \<le> Suc n} \<rightarrow> {j. 0 \<le> j}; f \<in> {j. j \<le> Suc n} \<rightarrow> carrier R\<rbrakk> \<Longrightarrow> mprod_expR R e f (Suc n) = mprod_expR R e f n \<cdot>\<^sub>r f (Suc n)^\<^bsup>R e (Suc n)\<^esup>
[PROOF STEP]
apply (simp add:mprod_expR_def)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma vector_prop1:
  assumes "is_vector v"
    shows "-v\<^sup>T;v = 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. - v\<^sup>T ; v = 0
[PROOF STEP]
by (metis assms compl_inf_bot inf_top.right_neutral one_compl one_idem_mult vector_2)


[STATEMENT]
lemma relImage_Gr:
  "\<lbrakk>R \<subseteq> A \<times> A\<rbrakk> \<Longrightarrow> relImage R f = (Gr A f)\<inverse> O R O Gr A f"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. R \<subseteq> A \<times> A \<Longrightarrow> relImage R f = (Gr A f)\<inverse> O R O Gr A f
[PROOF STEP]
unfolding relImage_def Gr_def relcomp_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. R \<subseteq> A \<times> A \<Longrightarrow> {(f a1, f a2) |a1 a2. (a1, a2) \<in> R} = {(x, y). ((\<lambda>x xa. (x, xa) \<in> {(a, f a) |a. a \<in> A}\<inverse>) OO (\<lambda>x xa. (x, xa) \<in> {(x, y). ((\<lambda>x xa. (x, xa) \<in> R) OO (\<lambda>x xa. (x, xa) \<in> {(a, f a) |a. a \<in> A})) x y})) x y}
[PROOF STEP]
by auto


[STATEMENT]
lemma count_remdups_mset_eq_1: "a \<in># remdups_mset A \<longleftrightarrow> count (remdups_mset A) a = 1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (a \<in># remdups_mset A) = (count (remdups_mset A) a = 1)
[PROOF STEP]
unfolding remdups_mset_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (a \<in># mset_set (set_mset A)) = (count (mset_set (set_mset A)) a = 1)
[PROOF STEP]
by (auto simp: count_eq_zero_iff intro: count_inI)


[STATEMENT]
lemma eventually_subst':
  "eventually (\<lambda>x. f x = g x) F \<Longrightarrow> eventually (\<lambda>x. P x (f x)) F = eventually (\<lambda>x. P x (g x)) F"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>\<^sub>F x in F. f x = g x \<Longrightarrow> (\<forall>\<^sub>F x in F. P x (f x)) = (\<forall>\<^sub>F x in F. P x (g x))
[PROOF STEP]
by (rule eventually_subst, erule eventually_rev_mp) simp


[STATEMENT]
lemma is_nth_power_conv_multiplicity:
  fixes x :: "'a :: {factorial_semiring, normalization_semidom_multiplicative}"
  assumes "n > 0"
  shows   "is_nth_power n (normalize x) \<longleftrightarrow> (\<forall>p. prime p \<longrightarrow> n dvd multiplicity p x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. is_nth_power n (normalize x) = (\<forall>p. prime p \<longrightarrow> n dvd multiplicity p x)
[PROOF STEP]
proof (cases "x = 0")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. x = (0::'a) \<Longrightarrow> is_nth_power n (normalize x) = (\<forall>p. prime p \<longrightarrow> n dvd multiplicity p x)
 2. x \<noteq> (0::'a) \<Longrightarrow> is_nth_power n (normalize x) = (\<forall>p. prime p \<longrightarrow> n dvd multiplicity p x)
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
x \<noteq> (0::'a)

goal (2 subgoals):
 1. x = (0::'a) \<Longrightarrow> is_nth_power n (normalize x) = (\<forall>p. prime p \<longrightarrow> n dvd multiplicity p x)
 2. x \<noteq> (0::'a) \<Longrightarrow> is_nth_power n (normalize x) = (\<forall>p. prime p \<longrightarrow> n dvd multiplicity p x)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. is_nth_power n (normalize x) = (\<forall>p. prime p \<longrightarrow> n dvd multiplicity p x)
[PROOF STEP]
proof (safe intro!: is_nth_powerI elim!: is_nth_powerE)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>y p. \<lbrakk>normalize x = y ^ n; prime p\<rbrakk> \<Longrightarrow> n dvd multiplicity p x
 2. \<forall>p. prime p \<longrightarrow> n dvd multiplicity p x \<Longrightarrow> normalize x = ?y4 ^ n
[PROOF STEP]
fix y p :: 'a
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>y p. \<lbrakk>normalize x = y ^ n; prime p\<rbrakk> \<Longrightarrow> n dvd multiplicity p x
 2. \<forall>p. prime p \<longrightarrow> n dvd multiplicity p x \<Longrightarrow> normalize x = ?y4 ^ n
[PROOF STEP]
assume *: "normalize x = y ^ n" "prime p"
[PROOF STATE]
proof (state)
this:
normalize x = y ^ n
prime p

goal (2 subgoals):
 1. \<And>y p. \<lbrakk>normalize x = y ^ n; prime p\<rbrakk> \<Longrightarrow> n dvd multiplicity p x
 2. \<forall>p. prime p \<longrightarrow> n dvd multiplicity p x \<Longrightarrow> normalize x = ?y4 ^ n
[PROOF STEP]
with assms and False
[PROOF STATE]
proof (chain)
picking this:
0 < n
x \<noteq> (0::'a)
normalize x = y ^ n
prime p
[PROOF STEP]
have [simp]: "y \<noteq> 0"
[PROOF STATE]
proof (prove)
using this:
0 < n
x \<noteq> (0::'a)
normalize x = y ^ n
prime p

goal (1 subgoal):
 1. y \<noteq> (0::'a)
[PROOF STEP]
by (auto simp: power_0_left)
[PROOF STATE]
proof (state)
this:
y \<noteq> (0::'a)

goal (2 subgoals):
 1. \<And>y p. \<lbrakk>normalize x = y ^ n; prime p\<rbrakk> \<Longrightarrow> n dvd multiplicity p x
 2. \<forall>p. prime p \<longrightarrow> n dvd multiplicity p x \<Longrightarrow> normalize x = ?y4 ^ n
[PROOF STEP]
have "multiplicity p x = multiplicity p (y ^ n)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. multiplicity p x = multiplicity p (y ^ n)
[PROOF STEP]
by (subst *(1) [symmetric]) simp
[PROOF STATE]
proof (state)
this:
multiplicity p x = multiplicity p (y ^ n)

goal (2 subgoals):
 1. \<And>y p. \<lbrakk>normalize x = y ^ n; prime p\<rbrakk> \<Longrightarrow> n dvd multiplicity p x
 2. \<forall>p. prime p \<longrightarrow> n dvd multiplicity p x \<Longrightarrow> normalize x = ?y4 ^ n
[PROOF STEP]
with False and * and assms
[PROOF STATE]
proof (chain)
picking this:
x \<noteq> (0::'a)
normalize x = y ^ n
prime p
0 < n
multiplicity p x = multiplicity p (y ^ n)
[PROOF STEP]
show "n dvd multiplicity p x"
[PROOF STATE]
proof (prove)
using this:
x \<noteq> (0::'a)
normalize x = y ^ n
prime p
0 < n
multiplicity p x = multiplicity p (y ^ n)

goal (1 subgoal):
 1. n dvd multiplicity p x
[PROOF STEP]
by (auto simp: prime_elem_multiplicity_power_distrib)
[PROOF STATE]
proof (state)
this:
n dvd multiplicity p x

goal (1 subgoal):
 1. \<forall>p. prime p \<longrightarrow> n dvd multiplicity p x \<Longrightarrow> normalize x = ?y4 ^ n
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<forall>p. prime p \<longrightarrow> n dvd multiplicity p x \<Longrightarrow> normalize x = ?y4 ^ n
[PROOF STEP]
assume *: "\<forall>p. prime p \<longrightarrow> n dvd multiplicity p x"
[PROOF STATE]
proof (state)
this:
\<forall>p. prime p \<longrightarrow> n dvd multiplicity p x

goal (1 subgoal):
 1. \<forall>p. prime p \<longrightarrow> n dvd multiplicity p x \<Longrightarrow> normalize x = ?y4 ^ n
[PROOF STEP]
have "multiplicity p ((\<Prod>p\<in>prime_factors x. p ^ (multiplicity p x div n)) ^ n) =
            multiplicity p x" if "prime p" for p
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. multiplicity p ((\<Prod>p\<in>prime_factors x. p ^ (multiplicity p x div n)) ^ n) = multiplicity p x
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. multiplicity p ((\<Prod>p\<in>prime_factors x. p ^ (multiplicity p x div n)) ^ n) = multiplicity p x
[PROOF STEP]
from that and *
[PROOF STATE]
proof (chain)
picking this:
prime p
\<forall>p. prime p \<longrightarrow> n dvd multiplicity p x
[PROOF STEP]
have "n dvd multiplicity p x"
[PROOF STATE]
proof (prove)
using this:
prime p
\<forall>p. prime p \<longrightarrow> n dvd multiplicity p x

goal (1 subgoal):
 1. n dvd multiplicity p x
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
n dvd multiplicity p x

goal (1 subgoal):
 1. multiplicity p ((\<Prod>p\<in>prime_factors x. p ^ (multiplicity p x div n)) ^ n) = multiplicity p x
[PROOF STEP]
have "multiplicity p x = 0" if "p \<notin> prime_factors x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. multiplicity p x = 0
[PROOF STEP]
using that and \<open>prime p\<close>
[PROOF STATE]
proof (prove)
using this:
p \<notin> prime_factors x
prime p

goal (1 subgoal):
 1. multiplicity p x = 0
[PROOF STEP]
by (simp add: prime_factors_multiplicity)
[PROOF STATE]
proof (state)
this:
p \<notin> prime_factors x \<Longrightarrow> multiplicity p x = 0

goal (1 subgoal):
 1. multiplicity p ((\<Prod>p\<in>prime_factors x. p ^ (multiplicity p x div n)) ^ n) = multiplicity p x
[PROOF STEP]
with that and * and assms
[PROOF STATE]
proof (chain)
picking this:
prime p
\<forall>p. prime p \<longrightarrow> n dvd multiplicity p x
0 < n
p \<notin> prime_factors x \<Longrightarrow> multiplicity p x = 0
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
prime p
\<forall>p. prime p \<longrightarrow> n dvd multiplicity p x
0 < n
p \<notin> prime_factors x \<Longrightarrow> multiplicity p x = 0

goal (1 subgoal):
 1. multiplicity p ((\<Prod>p\<in>prime_factors x. p ^ (multiplicity p x div n)) ^ n) = multiplicity p x
[PROOF STEP]
unfolding prod_power_distrib power_mult [symmetric]
[PROOF STATE]
proof (prove)
using this:
prime p
\<forall>p. prime p \<longrightarrow> n dvd multiplicity p x
0 < n
p \<notin> prime_factors x \<Longrightarrow> multiplicity p x = 0

goal (1 subgoal):
 1. multiplicity p (\<Prod>xa\<in>prime_factors x. xa ^ (multiplicity xa x div n * n)) = multiplicity p x
[PROOF STEP]
by (subst multiplicity_prod_prime_powers) (auto simp: in_prime_factors_imp_prime elim: dvdE)
[PROOF STATE]
proof (state)
this:
multiplicity p ((\<Prod>p\<in>prime_factors x. p ^ (multiplicity p x div n)) ^ n) = multiplicity p x

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
prime ?p \<Longrightarrow> multiplicity ?p ((\<Prod>p\<in>prime_factors x. p ^ (multiplicity p x div n)) ^ n) = multiplicity ?p x

goal (1 subgoal):
 1. \<forall>p. prime p \<longrightarrow> n dvd multiplicity p x \<Longrightarrow> normalize x = ?y4 ^ n
[PROOF STEP]
with assms False
[PROOF STATE]
proof (chain)
picking this:
0 < n
x \<noteq> (0::'a)
prime ?p \<Longrightarrow> multiplicity ?p ((\<Prod>p\<in>prime_factors x. p ^ (multiplicity p x div n)) ^ n) = multiplicity ?p x
[PROOF STEP]
have "normalize x = normalize ((\<Prod>p\<in>prime_factors x. p ^ (multiplicity p x div n)) ^ n)"
[PROOF STATE]
proof (prove)
using this:
0 < n
x \<noteq> (0::'a)
prime ?p \<Longrightarrow> multiplicity ?p ((\<Prod>p\<in>prime_factors x. p ^ (multiplicity p x div n)) ^ n) = multiplicity ?p x

goal (1 subgoal):
 1. normalize x = normalize ((\<Prod>p\<in>prime_factors x. p ^ (multiplicity p x div n)) ^ n)
[PROOF STEP]
by (intro multiplicity_eq_imp_eq) (auto simp: multiplicity_prod_prime_powers)
[PROOF STATE]
proof (state)
this:
normalize x = normalize ((\<Prod>p\<in>prime_factors x. p ^ (multiplicity p x div n)) ^ n)

goal (1 subgoal):
 1. \<forall>p. prime p \<longrightarrow> n dvd multiplicity p x \<Longrightarrow> normalize x = ?y4 ^ n
[PROOF STEP]
thus "normalize x = normalize (\<Prod>p\<in>prime_factors x. p ^ (multiplicity p x div n)) ^ n"
[PROOF STATE]
proof (prove)
using this:
normalize x = normalize ((\<Prod>p\<in>prime_factors x. p ^ (multiplicity p x div n)) ^ n)

goal (1 subgoal):
 1. normalize x = normalize (\<Prod>p\<in>prime_factors x. p ^ (multiplicity p x div n)) ^ n
[PROOF STEP]
by (simp add: normalize_power)
[PROOF STATE]
proof (state)
this:
normalize x = normalize (\<Prod>p\<in>prime_factors x. p ^ (multiplicity p x div n)) ^ n

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
is_nth_power n (normalize x) = (\<forall>p. prime p \<longrightarrow> n dvd multiplicity p x)

goal (1 subgoal):
 1. x = (0::'a) \<Longrightarrow> is_nth_power n (normalize x) = (\<forall>p. prime p \<longrightarrow> n dvd multiplicity p x)
[PROOF STEP]
qed (insert assms, auto)


[STATEMENT]
lemma binomial_altdef_nat: "k \<le> n \<Longrightarrow> n choose k = fact n div (fact k * fact (n - k))"
  for k n :: nat
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. k \<le> n \<Longrightarrow> n choose k = fact n div (fact k * fact (n - k))
[PROOF STEP]
by (subst binomial_fact_lemma [symmetric]) auto


[STATEMENT]
lemma dvd_gcd_mult: fixes p :: "'a :: semiring_gcd"
  assumes dvd: "k dvd p * q" "k dvd p * r"
  shows "k dvd p * gcd q r"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. k dvd p * gcd q r
[PROOF STEP]
by (rule dvd_trans, rule gcd_greatest[OF dvd])
     (auto intro!: mult_dvd_mono simp: gcd_mult_left)


[STATEMENT]
lemma cis_inverse [simp]: "inverse (cis a) = cis (- a)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. inverse (cis a) = cis (- a)
[PROOF STEP]
by (simp add: complex_eq_iff)


[STATEMENT]
lemma nths_eq_samelength: "\<lbrakk> length xs = length ys; \<forall>i \<in> inds. xs ! i = ys ! i \<rbrakk> \<Longrightarrow> nths xs inds = nths ys inds"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>length xs = length ys; \<forall>i\<in>inds. xs ! i = ys ! i\<rbrakk> \<Longrightarrow> nths xs inds = nths ys inds
[PROOF STEP]
by (rule nths_eq, auto)


[STATEMENT]
lemma coeff_0_prod_list: "coeff (prod_list xs) 0 = prod_list (map (\<lambda>p. coeff p 0) xs)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. coeff (prod_list xs) 0 = (\<Prod>p\<leftarrow>xs. coeff p 0)
[PROOF STEP]
by (induct xs) (simp_all add: coeff_mult)


[STATEMENT]
lemma finite_set_minimal:
  assumes "finite s"
      and "s \<noteq> {}"
      and "\<forall>x\<in>s . \<forall>y\<in>s . f x \<le> f y \<or> f y \<le> f x"
    shows "\<exists>m\<in>s . \<forall>z\<in>s . f m \<le> f z"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>m\<in>s. \<forall>z\<in>s. f m \<le> f z
[PROOF STEP]
apply (rule finite_ne_subset_induct[where S=s])
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. finite s
 2. s \<noteq> {}
 3. s \<subseteq> s
 4. \<And>x. \<exists>m\<in>{x}. \<forall>z\<in>{x}. f m \<le> f z
 5. \<And>x F. \<lbrakk>finite F; F \<noteq> {}; F \<subseteq> s; x \<in> s; x \<notin> F; \<exists>m\<in>F. \<forall>z\<in>F. f m \<le> f z\<rbrakk> \<Longrightarrow> \<exists>m\<in>insert x F. \<forall>z\<in>insert x F. f m \<le> f z
[PROOF STEP]
apply (rule assms(1))
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. s \<noteq> {}
 2. s \<subseteq> s
 3. \<And>x. \<exists>m\<in>{x}. \<forall>z\<in>{x}. f m \<le> f z
 4. \<And>x F. \<lbrakk>finite F; F \<noteq> {}; F \<subseteq> s; x \<in> s; x \<notin> F; \<exists>m\<in>F. \<forall>z\<in>F. f m \<le> f z\<rbrakk> \<Longrightarrow> \<exists>m\<in>insert x F. \<forall>z\<in>insert x F. f m \<le> f z
[PROOF STEP]
apply (rule assms(2))
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. s \<subseteq> s
 2. \<And>x. \<exists>m\<in>{x}. \<forall>z\<in>{x}. f m \<le> f z
 3. \<And>x F. \<lbrakk>finite F; F \<noteq> {}; F \<subseteq> s; x \<in> s; x \<notin> F; \<exists>m\<in>F. \<forall>z\<in>F. f m \<le> f z\<rbrakk> \<Longrightarrow> \<exists>m\<in>insert x F. \<forall>z\<in>insert x F. f m \<le> f z
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>x. \<exists>m\<in>{x}. \<forall>z\<in>{x}. f m \<le> f z
 2. \<And>x F. \<lbrakk>finite F; F \<noteq> {}; F \<subseteq> s; x \<in> s; x \<notin> F; \<exists>m\<in>F. \<forall>z\<in>F. f m \<le> f z\<rbrakk> \<Longrightarrow> \<exists>m\<in>insert x F. \<forall>z\<in>insert x F. f m \<le> f z
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x F. \<lbrakk>finite F; F \<noteq> {}; F \<subseteq> s; x \<in> s; x \<notin> F; \<exists>m\<in>F. \<forall>z\<in>F. f m \<le> f z\<rbrakk> \<Longrightarrow> \<exists>m\<in>insert x F. \<forall>z\<in>insert x F. f m \<le> f z
[PROOF STEP]
by (metis assms(3) insert_iff order_trans subsetD)


[STATEMENT]
lemma strict_mono_on_UNIV_strict_mono_conv: "
  strict_mono_on f UNIV = strict_mono f"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. SetInterval2.strict_mono_on f UNIV = strict_mono f
[PROOF STEP]
unfolding strict_mono_on_def strict_mono_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<forall>a\<in>UNIV. \<forall>b\<in>UNIV. a < b \<longrightarrow> f a < f b) = (\<forall>x y. x < y \<longrightarrow> f x < f y)
[PROOF STEP]
by blast


[STATEMENT]
lemma onormI:
  assumes "\<And>x. norm (f x) \<le> b * norm x"
    and "x \<noteq> 0" and "norm (f x) = b * norm x"
  shows "onorm f = b"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. onorm f = b
[PROOF STEP]
apply (unfold onorm_def, rule cSup_eq_maximum)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. b \<in> range (\<lambda>x. norm (f x) / norm x)
 2. \<And>x. x \<in> range (\<lambda>x. norm (f x) / norm x) \<Longrightarrow> x \<le> b
[PROOF STEP]
apply (smt (verit) UNIV_I assms(2) assms(3) image_iff nonzero_mult_div_cancel_right norm_eq_zero)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. x \<in> range (\<lambda>x. norm (f x) / norm x) \<Longrightarrow> x \<le> b
[PROOF STEP]
by (smt (verit, del_insts) assms(1) assms(2) divide_nonneg_nonpos norm_ge_zero norm_le_zero_iff pos_divide_le_eq rangeE zero_le_mult_iff)


[STATEMENT]
lemma finite_ordertype_le_card:
  assumes "finite A" "wf r" "trans r"
  shows "ordertype A r \<le> ord_of_nat (card A)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ordertype A r \<le> ord_of_nat (card A)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. ordertype A r \<le> ord_of_nat (card A)
[PROOF STEP]
have "Ord (ordertype A r)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Ord (ordertype A r)
[PROOF STEP]
by (simp add: wf_Ord_ordertype assms)
[PROOF STATE]
proof (state)
this:
Ord (ordertype A r)

goal (1 subgoal):
 1. ordertype A r \<le> ord_of_nat (card A)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
Ord (ordertype A r)

goal (1 subgoal):
 1. ordertype A r \<le> ord_of_nat (card A)
[PROOF STEP]
have "ordermap A r ` A = elts (ordertype A r)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ordermap A r ` A = elts (ordertype A r)
[PROOF STEP]
by (simp add: ordertype_def finite_imp_small \<open>finite A\<close>)
[PROOF STATE]
proof (state)
this:
ordermap A r ` A = elts (ordertype A r)

goal (1 subgoal):
 1. ordertype A r \<le> ord_of_nat (card A)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
ordermap A r ` A = elts (ordertype A r)

goal (1 subgoal):
 1. ordertype A r \<le> ord_of_nat (card A)
[PROOF STEP]
have "card (ordermap A r ` A) \<le> card A"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. card (ordermap A r ` A) \<le> card A
[PROOF STEP]
using \<open>finite A\<close> card_image_le
[PROOF STATE]
proof (prove)
using this:
finite A
finite ?A \<Longrightarrow> card (?f ` ?A) \<le> card ?A

goal (1 subgoal):
 1. card (ordermap A r ` A) \<le> card A
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
card (ordermap A r ` A) \<le> card A

goal (1 subgoal):
 1. ordertype A r \<le> ord_of_nat (card A)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
Ord (ordertype A r)
ordermap A r ` A = elts (ordertype A r)
card (ordermap A r ` A) \<le> card A
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
Ord (ordertype A r)
ordermap A r ` A = elts (ordertype A r)
card (ordermap A r ` A) \<le> card A

goal (1 subgoal):
 1. ordertype A r \<le> ord_of_nat (card A)
[PROOF STEP]
by (metis Ord_linear_le Ord_ord_of_nat \<open>finite A\<close> card_ord_of_nat card_seteq finite_imageI less_eq_V_def)
[PROOF STATE]
proof (state)
this:
ordertype A r \<le> ord_of_nat (card A)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma fdia_fbox_demorgan: "( |R\<rangle> (f::'b \<Rightarrow> 'c::complete_boolean_algebra) x) = - |R] (\<lambda>y. -f y) x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1.  |R\<rangle> f x = - |R] (\<lambda>y. - f y) x
[PROOF STEP]
apply (simp add: fbox_def fdia_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<Squnion>{f y |y. (x, y) \<in> R} = - \<Sqinter>{- f y |y. (x, y) \<in> R}
[PROOF STEP]
apply (rule antisym)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<Squnion>{f y |y. (x, y) \<in> R} \<le> - \<Sqinter>{- f y |y. (x, y) \<in> R}
 2. - \<Sqinter>{- f y |y. (x, y) \<in> R} \<le> \<Squnion>{f y |y. (x, y) \<in> R}
[PROOF STEP]
apply (rule Sup_least)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>xa. xa \<in> {f y |y. (x, y) \<in> R} \<Longrightarrow> xa \<le> - \<Sqinter>{- f y |y. (x, y) \<in> R}
 2. - \<Sqinter>{- f y |y. (x, y) \<in> R} \<le> \<Squnion>{f y |y. (x, y) \<in> R}
[PROOF STEP]
apply (simp add: Inf_lower compl_le_swap1)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. - \<Sqinter>{- f y |y. (x, y) \<in> R} \<le> \<Squnion>{f y |y. (x, y) \<in> R}
[PROOF STEP]
apply (simp add: uminus_Inf)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<Squnion>(uminus ` {- f y |y. (x, y) \<in> R}) \<le> \<Squnion>{f y |y. (x, y) \<in> R}
[PROOF STEP]
apply (rule SUP_least; intro Sup_upper)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>xa. xa \<in> {- f y |y. (x, y) \<in> R} \<Longrightarrow> - xa \<in> {f y |y. (x, y) \<in> R}
[PROOF STEP]
by auto


[STATEMENT]
lemma "\<exists>(a::nat) b m. (b - a) mod m = 0 \<and> a mod m \<noteq> b mod m"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>a b m. (b - a) mod m = 0 \<and> a mod m \<noteq> b mod m
[PROOF STEP]
apply (rule_tac x=1 in exI)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>b m. (b - 1) mod m = 0 \<and> 1 mod m \<noteq> b mod m
[PROOF STEP]
apply (rule_tac x=0 in exI)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>m. (0 - 1) mod m = 0 \<and> 1 mod m \<noteq> 0 mod m
[PROOF STEP]
apply (rule_tac x=2 in exI)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (0 - 1) mod 2 = 0 \<and> 1 mod 2 \<noteq> 0 mod 2
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma keys_homogenizeI:
  assumes "x \<notin> indets p" and "t \<in> keys p"
  shows "Poly_Mapping.single x (poly_deg p - deg_pm t) + t \<in> keys (homogenize x p)" (is "?t \<in> keys ?p")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. monomial (poly_deg p - deg_pm t) x + t \<in> keys (homogenize x p)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. monomial (poly_deg p - deg_pm t) x + t \<in> keys (homogenize x p)
[PROOF STEP]
from assms(2)
[PROOF STATE]
proof (chain)
picking this:
t \<in> keys p
[PROOF STEP]
have "keys t \<subseteq> indets p"
[PROOF STATE]
proof (prove)
using this:
t \<in> keys p

goal (1 subgoal):
 1. keys t \<subseteq> indets p
[PROOF STEP]
by (simp add: in_indetsI subsetI)
[PROOF STATE]
proof (state)
this:
keys t \<subseteq> indets p

goal (1 subgoal):
 1. monomial (poly_deg p - deg_pm t) x + t \<in> keys (homogenize x p)
[PROOF STEP]
with assms(1)
[PROOF STATE]
proof (chain)
picking this:
x \<notin> indets p
keys t \<subseteq> indets p
[PROOF STEP]
have "x \<notin> keys t"
[PROOF STATE]
proof (prove)
using this:
x \<notin> indets p
keys t \<subseteq> indets p

goal (1 subgoal):
 1. x \<notin> keys t
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
x \<notin> keys t

goal (1 subgoal):
 1. monomial (poly_deg p - deg_pm t) x + t \<in> keys (homogenize x p)
[PROOF STEP]
with assms(1)
[PROOF STATE]
proof (chain)
picking this:
x \<notin> indets p
x \<notin> keys t
[PROOF STEP]
have "lookup ?p ?t = lookup p t"
[PROOF STATE]
proof (prove)
using this:
x \<notin> indets p
x \<notin> keys t

goal (1 subgoal):
 1. lookup (homogenize x p) (monomial (poly_deg p - deg_pm t) x + t) = lookup p t
[PROOF STEP]
by (rule lookup_homogenize)
[PROOF STATE]
proof (state)
this:
lookup (homogenize x p) (monomial (poly_deg p - deg_pm t) x + t) = lookup p t

goal (1 subgoal):
 1. monomial (poly_deg p - deg_pm t) x + t \<in> keys (homogenize x p)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
lookup (homogenize x p) (monomial (poly_deg p - deg_pm t) x + t) = lookup p t

goal (1 subgoal):
 1. monomial (poly_deg p - deg_pm t) x + t \<in> keys (homogenize x p)
[PROOF STEP]
from assms(2)
[PROOF STATE]
proof (chain)
picking this:
t \<in> keys p
[PROOF STEP]
have "\<dots> \<noteq> 0"
[PROOF STATE]
proof (prove)
using this:
t \<in> keys p

goal (1 subgoal):
 1. lookup p t \<noteq> (0::'b)
[PROOF STEP]
by (simp add: in_keys_iff)
[PROOF STATE]
proof (state)
this:
lookup p t \<noteq> (0::'b)

goal (1 subgoal):
 1. monomial (poly_deg p - deg_pm t) x + t \<in> keys (homogenize x p)
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
lookup (homogenize x p) (monomial (poly_deg p - deg_pm t) x + t) \<noteq> (0::'b)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
lookup (homogenize x p) (monomial (poly_deg p - deg_pm t) x + t) \<noteq> (0::'b)

goal (1 subgoal):
 1. monomial (poly_deg p - deg_pm t) x + t \<in> keys (homogenize x p)
[PROOF STEP]
by (simp add: in_keys_iff)
[PROOF STATE]
proof (state)
this:
monomial (poly_deg p - deg_pm t) x + t \<in> keys (homogenize x p)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma refl_symm_trans_closure_is_symm_refl_trans_closure:
  fixes Rel :: "('a \<times> 'a) set"
  shows "(symcl (Rel\<^sup>=))\<^sup>+ = (symcl Rel)\<^sup>*"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (symcl (Rel\<^sup>=))\<^sup>+ = (symcl Rel)\<^sup>*
[PROOF STEP]
using refl_symm_closure_is_symm_refl_closure[where Rel="Rel"]
[PROOF STATE]
proof (prove)
using this:
symcl (Rel\<^sup>=) = (symcl Rel)\<^sup>=

goal (1 subgoal):
 1. (symcl (Rel\<^sup>=))\<^sup>+ = (symcl Rel)\<^sup>*
[PROOF STEP]
by simp


[STATEMENT]
lemma euler_mascheroni_bounds:
  fixes n :: nat assumes "n \<ge> 1" defines "t \<equiv> harm n - ln (of_nat (Suc n)) :: real"
  shows "euler_mascheroni \<in> {t + inverse (of_nat (2*(n+1)))..t + inverse (of_nat (2*n))}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. euler_mascheroni \<in> {t + inverse (real (2 * (n + 1)))..t + inverse (real (2 * n))}
[PROOF STEP]
using assms euler_mascheroni_upper[of "n-1"] euler_mascheroni_lower[of "n-1"]
[PROOF STATE]
proof (prove)
using this:
1 \<le> n
t \<equiv> harm n - ln (real (Suc n))
euler_mascheroni \<le> harm (Suc (n - 1)) - ln (real (n - 1 + 2)) + 1 / real (2 * (n - 1 + 1))
harm (Suc (n - 1)) - ln (real (n - 1 + 2)) + 1 / real (2 * (n - 1 + 2)) \<le> euler_mascheroni

goal (1 subgoal):
 1. euler_mascheroni \<in> {t + inverse (real (2 * (n + 1)))..t + inverse (real (2 * n))}
[PROOF STEP]
unfolding t_def
[PROOF STATE]
proof (prove)
using this:
1 \<le> n
harm n - ln (real (Suc n)) \<equiv> harm n - ln (real (Suc n))
euler_mascheroni \<le> harm (Suc (n - 1)) - ln (real (n - 1 + 2)) + 1 / real (2 * (n - 1 + 1))
harm (Suc (n - 1)) - ln (real (n - 1 + 2)) + 1 / real (2 * (n - 1 + 2)) \<le> euler_mascheroni

goal (1 subgoal):
 1. euler_mascheroni \<in> {harm n - ln (real (Suc n)) + inverse (real (2 * (n + 1)))..harm n - ln (real (Suc n)) + inverse (real (2 * n))}
[PROOF STEP]
by (cases n) (simp_all add: harm_Suc t_def inverse_eq_divide)


[STATEMENT]
lemma closed_neg_Im_slit: "closed {z. Re z = 0 \<and> Im z \<le> 0}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. closed {z. Re z = 0 \<and> Im z \<le> 0}
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. closed {z. Re z = 0 \<and> Im z \<le> 0}
[PROOF STEP]
have "closed ({z. Re z = 0} \<inter> {z. Im z \<le> 0})"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. closed ({z. Re z = 0} \<inter> {z. Im z \<le> 0})
[PROOF STEP]
by (intro closed_Int closed_halfspace_Re_eq closed_halfspace_Im_le)
[PROOF STATE]
proof (state)
this:
closed ({z. Re z = 0} \<inter> {z. Im z \<le> 0})

goal (1 subgoal):
 1. closed {z. Re z = 0 \<and> Im z \<le> 0}
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
closed ({z. Re z = 0} \<inter> {z. Im z \<le> 0})

goal (1 subgoal):
 1. closed {z. Re z = 0 \<and> Im z \<le> 0}
[PROOF STEP]
have "{z. Re z = 0} \<inter> {z. Im z \<le> 0} = {z. Re z = 0 \<and> Im z \<le> 0}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {z. Re z = 0} \<inter> {z. Im z \<le> 0} = {z. Re z = 0 \<and> Im z \<le> 0}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
{z. Re z = 0} \<inter> {z. Im z \<le> 0} = {z. Re z = 0 \<and> Im z \<le> 0}

goal (1 subgoal):
 1. closed {z. Re z = 0 \<and> Im z \<le> 0}
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
closed {z. Re z = 0 \<and> Im z \<le> 0}
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
closed {z. Re z = 0 \<and> Im z \<le> 0}

goal (1 subgoal):
 1. closed {z. Re z = 0 \<and> Im z \<le> 0}
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
closed {z. Re z = 0 \<and> Im z \<le> 0}

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma inefficient_list_intersect_correct: "set (inefficient_list_intersect a b) = (set a) \<inter> (set b)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. set (inefficient_list_intersect a b) = set a \<inter> set b
[PROOF STEP]
apply(induction a)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. set (inefficient_list_intersect [] b) = set [] \<inter> set b
 2. \<And>a1 a2. set (inefficient_list_intersect a2 b) = set a2 \<inter> set b \<Longrightarrow> set (inefficient_list_intersect (a1 # a2) b) = set (a1 # a2) \<inter> set b
[PROOF STEP]
by(simp_all)