[STATEMENT]
lemma llength_lconcat_lfinite_conv_sum:
  assumes "lfinite xss"
  shows "llength (lconcat xss) = (\<Sum>i | enat i < llength xss. llength (lnth xss i))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. llength (lconcat xss) = (\<Sum>i | enat i < llength xss. llength (lnth xss i))
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
lfinite xss

goal (1 subgoal):
 1. llength (lconcat xss) = (\<Sum>i | enat i < llength xss. llength (lnth xss i))
[PROOF STEP]
proof(induct)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. llength (lconcat LNil) = (\<Sum>i | enat i < llength LNil. llength (lnth LNil i))
 2. \<And>xs x. \<lbrakk>lfinite xs; llength (lconcat xs) = (\<Sum>i | enat i < llength xs. llength (lnth xs i))\<rbrakk> \<Longrightarrow> llength (lconcat (LCons x xs)) = (\<Sum>i | enat i < llength (LCons x xs). llength (lnth (LCons x xs) i))
[PROOF STEP]
case lfinite_LNil
[PROOF STATE]
proof (state)
this:

goal (2 subgoals):
 1. llength (lconcat LNil) = (\<Sum>i | enat i < llength LNil. llength (lnth LNil i))
 2. \<And>xs x. \<lbrakk>lfinite xs; llength (lconcat xs) = (\<Sum>i | enat i < llength xs. llength (lnth xs i))\<rbrakk> \<Longrightarrow> llength (lconcat (LCons x xs)) = (\<Sum>i | enat i < llength (LCons x xs). llength (lnth (LCons x xs) i))
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. llength (lconcat LNil) = (\<Sum>i | enat i < llength LNil. llength (lnth LNil i))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
llength (lconcat LNil) = (\<Sum>i | enat i < llength LNil. llength (lnth LNil i))

goal (1 subgoal):
 1. \<And>xs x. \<lbrakk>lfinite xs; llength (lconcat xs) = (\<Sum>i | enat i < llength xs. llength (lnth xs i))\<rbrakk> \<Longrightarrow> llength (lconcat (LCons x xs)) = (\<Sum>i | enat i < llength (LCons x xs). llength (lnth (LCons x xs) i))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>xs x. \<lbrakk>lfinite xs; llength (lconcat xs) = (\<Sum>i | enat i < llength xs. llength (lnth xs i))\<rbrakk> \<Longrightarrow> llength (lconcat (LCons x xs)) = (\<Sum>i | enat i < llength (LCons x xs). llength (lnth (LCons x xs) i))
[PROOF STEP]
case (lfinite_LConsI xss xs)
[PROOF STATE]
proof (state)
this:
lfinite xss
llength (lconcat xss) = (\<Sum>i | enat i < llength xss. llength (lnth xss i))

goal (1 subgoal):
 1. \<And>xs x. \<lbrakk>lfinite xs; llength (lconcat xs) = (\<Sum>i | enat i < llength xs. llength (lnth xs i))\<rbrakk> \<Longrightarrow> llength (lconcat (LCons x xs)) = (\<Sum>i | enat i < llength (LCons x xs). llength (lnth (LCons x xs) i))
[PROOF STEP]
have "{i. enat i \<le> llength xss} = insert 0 {Suc i|i. enat i < llength xss}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {i. enat i \<le> llength xss} = insert 0 {Suc i |i. enat i < llength xss}
[PROOF STEP]
by(auto simp add: zero_enat_def[symmetric] Suc_ile_eq gr0_conv_Suc)
[PROOF STATE]
proof (state)
this:
{i. enat i \<le> llength xss} = insert 0 {Suc i |i. enat i < llength xss}

goal (1 subgoal):
 1. \<And>xs x. \<lbrakk>lfinite xs; llength (lconcat xs) = (\<Sum>i | enat i < llength xs. llength (lnth xs i))\<rbrakk> \<Longrightarrow> llength (lconcat (LCons x xs)) = (\<Sum>i | enat i < llength (LCons x xs). llength (lnth (LCons x xs) i))
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
{i. enat i \<le> llength xss} = insert 0 {Suc i |i. enat i < llength xss}

goal (1 subgoal):
 1. \<And>xs x. \<lbrakk>lfinite xs; llength (lconcat xs) = (\<Sum>i | enat i < llength xs. llength (lnth xs i))\<rbrakk> \<Longrightarrow> llength (lconcat (LCons x xs)) = (\<Sum>i | enat i < llength (LCons x xs). llength (lnth (LCons x xs) i))
[PROOF STEP]
have "\<dots> = insert 0 (Suc ` {i. enat i < llength xss})"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. insert 0 {Suc i |i. enat i < llength xss} = insert 0 (Suc ` {i. enat i < llength xss})
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
insert 0 {Suc i |i. enat i < llength xss} = insert 0 (Suc ` {i. enat i < llength xss})

goal (1 subgoal):
 1. \<And>xs x. \<lbrakk>lfinite xs; llength (lconcat xs) = (\<Sum>i | enat i < llength xs. llength (lnth xs i))\<rbrakk> \<Longrightarrow> llength (lconcat (LCons x xs)) = (\<Sum>i | enat i < llength (LCons x xs). llength (lnth (LCons x xs) i))
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
insert 0 {Suc i |i. enat i < llength xss} = insert 0 (Suc ` {i. enat i < llength xss})

goal (1 subgoal):
 1. \<And>xs x. \<lbrakk>lfinite xs; llength (lconcat xs) = (\<Sum>i | enat i < llength xs. llength (lnth xs i))\<rbrakk> \<Longrightarrow> llength (lconcat (LCons x xs)) = (\<Sum>i | enat i < llength (LCons x xs). llength (lnth (LCons x xs) i))
[PROOF STEP]
have "0 \<notin> Suc ` {i. enat i < llength xss}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 \<notin> Suc ` {i. enat i < llength xss}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
0 \<notin> Suc ` {i. enat i < llength xss}

goal (1 subgoal):
 1. \<And>xs x. \<lbrakk>lfinite xs; llength (lconcat xs) = (\<Sum>i | enat i < llength xs. llength (lnth xs i))\<rbrakk> \<Longrightarrow> llength (lconcat (LCons x xs)) = (\<Sum>i | enat i < llength (LCons x xs). llength (lnth (LCons x xs) i))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
0 \<notin> Suc ` {i. enat i < llength xss}

goal (1 subgoal):
 1. \<And>xs x. \<lbrakk>lfinite xs; llength (lconcat xs) = (\<Sum>i | enat i < llength xs. llength (lnth xs i))\<rbrakk> \<Longrightarrow> llength (lconcat (LCons x xs)) = (\<Sum>i | enat i < llength (LCons x xs). llength (lnth (LCons x xs) i))
[PROOF STEP]
from \<open>lfinite xss\<close>
[PROOF STATE]
proof (chain)
picking this:
lfinite xss
[PROOF STEP]
have "finite {i. enat i < llength xss}"
[PROOF STATE]
proof (prove)
using this:
lfinite xss

goal (1 subgoal):
 1. finite {i. enat i < llength xss}
[PROOF STEP]
by(rule lfinite_finite_index)
[PROOF STATE]
proof (state)
this:
finite {i. enat i < llength xss}

goal (1 subgoal):
 1. \<And>xs x. \<lbrakk>lfinite xs; llength (lconcat xs) = (\<Sum>i | enat i < llength xs. llength (lnth xs i))\<rbrakk> \<Longrightarrow> llength (lconcat (LCons x xs)) = (\<Sum>i | enat i < llength (LCons x xs). llength (lnth (LCons x xs) i))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
{i. enat i \<le> llength xss} = insert 0 (Suc ` {i. enat i < llength xss})
0 \<notin> Suc ` {i. enat i < llength xss}
finite {i. enat i < llength xss}
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
{i. enat i \<le> llength xss} = insert 0 (Suc ` {i. enat i < llength xss})
0 \<notin> Suc ` {i. enat i < llength xss}
finite {i. enat i < llength xss}

goal (1 subgoal):
 1. llength (lconcat (LCons xs xss)) = (\<Sum>i | enat i < llength (LCons xs xss). llength (lnth (LCons xs xss) i))
[PROOF STEP]
using lfinite_LConsI
[PROOF STATE]
proof (prove)
using this:
{i. enat i \<le> llength xss} = insert 0 (Suc ` {i. enat i < llength xss})
0 \<notin> Suc ` {i. enat i < llength xss}
finite {i. enat i < llength xss}
lfinite xss
llength (lconcat xss) = (\<Sum>i | enat i < llength xss. llength (lnth xss i))

goal (1 subgoal):
 1. llength (lconcat (LCons xs xss)) = (\<Sum>i | enat i < llength (LCons xs xss). llength (lnth (LCons xs xss) i))
[PROOF STEP]
by(simp add: sum.reindex)
[PROOF STATE]
proof (state)
this:
llength (lconcat (LCons xs xss)) = (\<Sum>i | enat i < llength (LCons xs xss). llength (lnth (LCons xs xss) i))

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma therm_dyn_up_real_arith:
  assumes "a > 0" and Thyps: "Tmin \<le> T" "T \<le> Tmax" "Tmax < (L::real)"
    and thyps: "0 \<le> \<tau>" "\<forall>\<tau>\<in>{0..\<tau>}. \<tau> \<le> - (ln ((L - Tmax) / (L - T)) / a) "
  shows "L - Tmax \<le> exp (-(a * \<tau>)) * (L - T)"
    and "L - exp (-(a * \<tau>)) * (L - T) \<le> Tmax"
    and "Tmin \<le> L - exp (-(a * \<tau>)) * (L - T)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L - Tmax \<le> exp (- (a \<cdot> \<tau>)) \<cdot> (L - T) &&& L - exp (- (a \<cdot> \<tau>)) \<cdot> (L - T) \<le> Tmax &&& Tmin \<le> L - exp (- (a \<cdot> \<tau>)) \<cdot> (L - T)
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. L - Tmax \<le> exp (- (a \<cdot> \<tau>)) \<cdot> (L - T)
 2. L - exp (- (a \<cdot> \<tau>)) \<cdot> (L - T) \<le> Tmax
 3. Tmin \<le> L - exp (- (a \<cdot> \<tau>)) \<cdot> (L - T)
[PROOF STEP]
have "0 \<le> \<tau> \<and> \<tau> \<le> - (ln ((L - Tmax) / (L - T)) / a)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 \<le> \<tau> \<and> \<tau> \<le> - (ln ((L - Tmax) / (L - T)) / a)
[PROOF STEP]
using thyps
[PROOF STATE]
proof (prove)
using this:
0 \<le> \<tau>
\<forall>\<tau>\<in>{0..\<tau>}. \<tau> \<le> - (ln ((L - Tmax) / (L - T)) / a)

goal (1 subgoal):
 1. 0 \<le> \<tau> \<and> \<tau> \<le> - (ln ((L - Tmax) / (L - T)) / a)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
0 \<le> \<tau> \<and> \<tau> \<le> - (ln ((L - Tmax) / (L - T)) / a)

goal (3 subgoals):
 1. L - Tmax \<le> exp (- (a \<cdot> \<tau>)) \<cdot> (L - T)
 2. L - exp (- (a \<cdot> \<tau>)) \<cdot> (L - T) \<le> Tmax
 3. Tmin \<le> L - exp (- (a \<cdot> \<tau>)) \<cdot> (L - T)
[PROOF STEP]
hence "ln ((L - Tmax) / (L - T)) \<le> - a * \<tau> \<and> - a * \<tau> \<le> 0"
[PROOF STATE]
proof (prove)
using this:
0 \<le> \<tau> \<and> \<tau> \<le> - (ln ((L - Tmax) / (L - T)) / a)

goal (1 subgoal):
 1. ln ((L - Tmax) / (L - T)) \<le> - a \<cdot> \<tau> \<and> - a \<cdot> \<tau> \<le> 0
[PROOF STEP]
using assms(1) divide_le_cancel
[PROOF STATE]
proof (prove)
using this:
0 \<le> \<tau> \<and> \<tau> \<le> - (ln ((L - Tmax) / (L - T)) / a)
0 < a
(?a / ?c \<le> ?b / ?c) = (((0::?'a) < ?c \<longrightarrow> ?a \<le> ?b) \<and> (?c < (0::?'a) \<longrightarrow> ?b \<le> ?a))

goal (1 subgoal):
 1. ln ((L - Tmax) / (L - T)) \<le> - a \<cdot> \<tau> \<and> - a \<cdot> \<tau> \<le> 0
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
ln ((L - Tmax) / (L - T)) \<le> - a \<cdot> \<tau> \<and> - a \<cdot> \<tau> \<le> 0

goal (3 subgoals):
 1. L - Tmax \<le> exp (- (a \<cdot> \<tau>)) \<cdot> (L - T)
 2. L - exp (- (a \<cdot> \<tau>)) \<cdot> (L - T) \<le> Tmax
 3. Tmin \<le> L - exp (- (a \<cdot> \<tau>)) \<cdot> (L - T)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
ln ((L - Tmax) / (L - T)) \<le> - a \<cdot> \<tau> \<and> - a \<cdot> \<tau> \<le> 0

goal (3 subgoals):
 1. L - Tmax \<le> exp (- (a \<cdot> \<tau>)) \<cdot> (L - T)
 2. L - exp (- (a \<cdot> \<tau>)) \<cdot> (L - T) \<le> Tmax
 3. Tmin \<le> L - exp (- (a \<cdot> \<tau>)) \<cdot> (L - T)
[PROOF STEP]
have "(L - Tmax) / (L - T) > 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 < (L - Tmax) / (L - T)
[PROOF STEP]
using Thyps
[PROOF STATE]
proof (prove)
using this:
Tmin \<le> T
T \<le> Tmax
Tmax < L

goal (1 subgoal):
 1. 0 < (L - Tmax) / (L - T)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
0 < (L - Tmax) / (L - T)

goal (3 subgoals):
 1. L - Tmax \<le> exp (- (a \<cdot> \<tau>)) \<cdot> (L - T)
 2. L - exp (- (a \<cdot> \<tau>)) \<cdot> (L - T) \<le> Tmax
 3. Tmin \<le> L - exp (- (a \<cdot> \<tau>)) \<cdot> (L - T)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
ln ((L - Tmax) / (L - T)) \<le> - a \<cdot> \<tau> \<and> - a \<cdot> \<tau> \<le> 0
0 < (L - Tmax) / (L - T)
[PROOF STEP]
have "(L - Tmax) / (L - T) \<le> exp (-a * \<tau>) \<and> exp (-a * \<tau>) \<le> 1"
[PROOF STATE]
proof (prove)
using this:
ln ((L - Tmax) / (L - T)) \<le> - a \<cdot> \<tau> \<and> - a \<cdot> \<tau> \<le> 0
0 < (L - Tmax) / (L - T)

goal (1 subgoal):
 1. (L - Tmax) / (L - T) \<le> exp (- a \<cdot> \<tau>) \<and> exp (- a \<cdot> \<tau>) \<le> 1
[PROOF STEP]
using exp_ln exp_le_one_iff
[PROOF STATE]
proof (prove)
using this:
ln ((L - Tmax) / (L - T)) \<le> - a \<cdot> \<tau> \<and> - a \<cdot> \<tau> \<le> 0
0 < (L - Tmax) / (L - T)
0 < ?x \<Longrightarrow> exp (ln ?x) = ?x
(exp ?x \<le> 1) = (?x \<le> 0)

goal (1 subgoal):
 1. (L - Tmax) / (L - T) \<le> exp (- a \<cdot> \<tau>) \<and> exp (- a \<cdot> \<tau>) \<le> 1
[PROOF STEP]
by (metis exp_less_cancel_iff not_less)
[PROOF STATE]
proof (state)
this:
(L - Tmax) / (L - T) \<le> exp (- a \<cdot> \<tau>) \<and> exp (- a \<cdot> \<tau>) \<le> 1

goal (3 subgoals):
 1. L - Tmax \<le> exp (- (a \<cdot> \<tau>)) \<cdot> (L - T)
 2. L - exp (- (a \<cdot> \<tau>)) \<cdot> (L - T) \<le> Tmax
 3. Tmin \<le> L - exp (- (a \<cdot> \<tau>)) \<cdot> (L - T)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(L - Tmax) / (L - T) \<le> exp (- a \<cdot> \<tau>) \<and> exp (- a \<cdot> \<tau>) \<le> 1

goal (3 subgoals):
 1. L - Tmax \<le> exp (- (a \<cdot> \<tau>)) \<cdot> (L - T)
 2. L - exp (- (a \<cdot> \<tau>)) \<cdot> (L - T) \<le> Tmax
 3. Tmin \<le> L - exp (- (a \<cdot> \<tau>)) \<cdot> (L - T)
[PROOF STEP]
have "L - T > 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 < L - T
[PROOF STEP]
using Thyps
[PROOF STATE]
proof (prove)
using this:
Tmin \<le> T
T \<le> Tmax
Tmax < L

goal (1 subgoal):
 1. 0 < L - T
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
0 < L - T

goal (3 subgoals):
 1. L - Tmax \<le> exp (- (a \<cdot> \<tau>)) \<cdot> (L - T)
 2. L - exp (- (a \<cdot> \<tau>)) \<cdot> (L - T) \<le> Tmax
 3. Tmin \<le> L - exp (- (a \<cdot> \<tau>)) \<cdot> (L - T)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
(L - Tmax) / (L - T) \<le> exp (- a \<cdot> \<tau>) \<and> exp (- a \<cdot> \<tau>) \<le> 1
0 < L - T
[PROOF STEP]
have obs: "(L - Tmax) \<le> exp (-a * \<tau>) * (L - T) \<and> exp (-a * \<tau>) * (L - T) \<le> (L - T)"
[PROOF STATE]
proof (prove)
using this:
(L - Tmax) / (L - T) \<le> exp (- a \<cdot> \<tau>) \<and> exp (- a \<cdot> \<tau>) \<le> 1
0 < L - T

goal (1 subgoal):
 1. L - Tmax \<le> exp (- a \<cdot> \<tau>) \<cdot> (L - T) \<and> exp (- a \<cdot> \<tau>) \<cdot> (L - T) \<le> L - T
[PROOF STEP]
by (simp add: pos_divide_le_eq)
[PROOF STATE]
proof (state)
this:
L - Tmax \<le> exp (- a \<cdot> \<tau>) \<cdot> (L - T) \<and> exp (- a \<cdot> \<tau>) \<cdot> (L - T) \<le> L - T

goal (3 subgoals):
 1. L - Tmax \<le> exp (- (a \<cdot> \<tau>)) \<cdot> (L - T)
 2. L - exp (- (a \<cdot> \<tau>)) \<cdot> (L - T) \<le> Tmax
 3. Tmin \<le> L - exp (- (a \<cdot> \<tau>)) \<cdot> (L - T)
[PROOF STEP]
thus "(L - Tmax) \<le> exp (-(a * \<tau>)) * (L - T)"
[PROOF STATE]
proof (prove)
using this:
L - Tmax \<le> exp (- a \<cdot> \<tau>) \<cdot> (L - T) \<and> exp (- a \<cdot> \<tau>) \<cdot> (L - T) \<le> L - T

goal (1 subgoal):
 1. L - Tmax \<le> exp (- (a \<cdot> \<tau>)) \<cdot> (L - T)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
L - Tmax \<le> exp (- (a \<cdot> \<tau>)) \<cdot> (L - T)

goal (2 subgoals):
 1. L - exp (- (a \<cdot> \<tau>)) \<cdot> (L - T) \<le> Tmax
 2. Tmin \<le> L - exp (- (a \<cdot> \<tau>)) \<cdot> (L - T)
[PROOF STEP]
thus "L - exp (-(a * \<tau>)) * (L - T) \<le> Tmax"
[PROOF STATE]
proof (prove)
using this:
L - Tmax \<le> exp (- (a \<cdot> \<tau>)) \<cdot> (L - T)

goal (1 subgoal):
 1. L - exp (- (a \<cdot> \<tau>)) \<cdot> (L - T) \<le> Tmax
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
L - exp (- (a \<cdot> \<tau>)) \<cdot> (L - T) \<le> Tmax

goal (1 subgoal):
 1. Tmin \<le> L - exp (- (a \<cdot> \<tau>)) \<cdot> (L - T)
[PROOF STEP]
show "Tmin \<le> L - exp (-(a * \<tau>)) * (L - T)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Tmin \<le> L - exp (- (a \<cdot> \<tau>)) \<cdot> (L - T)
[PROOF STEP]
using Thyps and obs
[PROOF STATE]
proof (prove)
using this:
Tmin \<le> T
T \<le> Tmax
Tmax < L
L - Tmax \<le> exp (- a \<cdot> \<tau>) \<cdot> (L - T) \<and> exp (- a \<cdot> \<tau>) \<cdot> (L - T) \<le> L - T

goal (1 subgoal):
 1. Tmin \<le> L - exp (- (a \<cdot> \<tau>)) \<cdot> (L - T)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Tmin \<le> L - exp (- (a \<cdot> \<tau>)) \<cdot> (L - T)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma list_as_mapping_lookup_transitions :
  "(case (Mapping.lookup (list_as_mapping (map (\<lambda>(q,x,y,q') . ((q,x),y,q')) ts)) (q,x)) of Some ts \<Rightarrow> ts | None \<Rightarrow> {}) = { (y,q') . (q,x,y,q') \<in> set ts}"
(is "?S1 = ?S2")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (case Mapping.lookup (list_as_mapping (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts)) (q, x) of None \<Rightarrow> {} | Some ts \<Rightarrow> ts) = {(y, q'). (q, x, y, q') \<in> set ts}
[PROOF STEP]
proof (cases "\<exists>z. ((q, x), z) \<in> set (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts)")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<exists>z. ((q, x), z) \<in> set (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts) \<Longrightarrow> (case Mapping.lookup (list_as_mapping (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts)) (q, x) of None \<Rightarrow> {} | Some ts \<Rightarrow> ts) = {(y, q'). (q, x, y, q') \<in> set ts}
 2. \<nexists>z. ((q, x), z) \<in> set (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts) \<Longrightarrow> (case Mapping.lookup (list_as_mapping (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts)) (q, x) of None \<Rightarrow> {} | Some ts \<Rightarrow> ts) = {(y, q'). (q, x, y, q') \<in> set ts}
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
\<exists>z. ((q, x), z) \<in> set (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts)

goal (2 subgoals):
 1. \<exists>z. ((q, x), z) \<in> set (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts) \<Longrightarrow> (case Mapping.lookup (list_as_mapping (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts)) (q, x) of None \<Rightarrow> {} | Some ts \<Rightarrow> ts) = {(y, q'). (q, x, y, q') \<in> set ts}
 2. \<nexists>z. ((q, x), z) \<in> set (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts) \<Longrightarrow> (case Mapping.lookup (list_as_mapping (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts)) (q, x) of None \<Rightarrow> {} | Some ts \<Rightarrow> ts) = {(y, q'). (q, x, y, q') \<in> set ts}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<exists>z. ((q, x), z) \<in> set (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts)
[PROOF STEP]
have "?S1 = {z. ((q, x), z) \<in> set (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts)}"
[PROOF STATE]
proof (prove)
using this:
\<exists>z. ((q, x), z) \<in> set (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts)

goal (1 subgoal):
 1. (case Mapping.lookup (list_as_mapping (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts)) (q, x) of None \<Rightarrow> {} | Some ts \<Rightarrow> ts) = {z. ((q, x), z) \<in> set (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts)}
[PROOF STEP]
unfolding list_as_mapping_lookup
[PROOF STATE]
proof (prove)
using this:
\<exists>z. ((q, x), z) \<in> set (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts)

goal (1 subgoal):
 1. (case if \<exists>z. ((q, x), z) \<in> set (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts) then Some {z. ((q, x), z) \<in> set (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts)} else None of None \<Rightarrow> {} | Some ts \<Rightarrow> ts) = {z. ((q, x), z) \<in> set (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts)}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(case Mapping.lookup (list_as_mapping (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts)) (q, x) of None \<Rightarrow> {} | Some ts \<Rightarrow> ts) = {z. ((q, x), z) \<in> set (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts)}

goal (2 subgoals):
 1. \<exists>z. ((q, x), z) \<in> set (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts) \<Longrightarrow> (case Mapping.lookup (list_as_mapping (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts)) (q, x) of None \<Rightarrow> {} | Some ts \<Rightarrow> ts) = {(y, q'). (q, x, y, q') \<in> set ts}
 2. \<nexists>z. ((q, x), z) \<in> set (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts) \<Longrightarrow> (case Mapping.lookup (list_as_mapping (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts)) (q, x) of None \<Rightarrow> {} | Some ts \<Rightarrow> ts) = {(y, q'). (q, x, y, q') \<in> set ts}
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(case Mapping.lookup (list_as_mapping (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts)) (q, x) of None \<Rightarrow> {} | Some ts \<Rightarrow> ts) = {z. ((q, x), z) \<in> set (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts)}

goal (2 subgoals):
 1. \<exists>z. ((q, x), z) \<in> set (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts) \<Longrightarrow> (case Mapping.lookup (list_as_mapping (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts)) (q, x) of None \<Rightarrow> {} | Some ts \<Rightarrow> ts) = {(y, q'). (q, x, y, q') \<in> set ts}
 2. \<nexists>z. ((q, x), z) \<in> set (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts) \<Longrightarrow> (case Mapping.lookup (list_as_mapping (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts)) (q, x) of None \<Rightarrow> {} | Some ts \<Rightarrow> ts) = {(y, q'). (q, x, y, q') \<in> set ts}
[PROOF STEP]
have "\<dots> = ?S2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {z. ((q, x), z) \<in> set (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts)} = {(y, q'). (q, x, y, q') \<in> set ts}
[PROOF STEP]
by (induction ts; auto)
[PROOF STATE]
proof (state)
this:
{z. ((q, x), z) \<in> set (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts)} = {(y, q'). (q, x, y, q') \<in> set ts}

goal (2 subgoals):
 1. \<exists>z. ((q, x), z) \<in> set (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts) \<Longrightarrow> (case Mapping.lookup (list_as_mapping (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts)) (q, x) of None \<Rightarrow> {} | Some ts \<Rightarrow> ts) = {(y, q'). (q, x, y, q') \<in> set ts}
 2. \<nexists>z. ((q, x), z) \<in> set (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts) \<Longrightarrow> (case Mapping.lookup (list_as_mapping (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts)) (q, x) of None \<Rightarrow> {} | Some ts \<Rightarrow> ts) = {(y, q'). (q, x, y, q') \<in> set ts}
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
(case Mapping.lookup (list_as_mapping (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts)) (q, x) of None \<Rightarrow> {} | Some ts \<Rightarrow> ts) = {(y, q'). (q, x, y, q') \<in> set ts}
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
(case Mapping.lookup (list_as_mapping (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts)) (q, x) of None \<Rightarrow> {} | Some ts \<Rightarrow> ts) = {(y, q'). (q, x, y, q') \<in> set ts}

goal (1 subgoal):
 1. (case Mapping.lookup (list_as_mapping (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts)) (q, x) of None \<Rightarrow> {} | Some ts \<Rightarrow> ts) = {(y, q'). (q, x, y, q') \<in> set ts}
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
(case Mapping.lookup (list_as_mapping (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts)) (q, x) of None \<Rightarrow> {} | Some ts \<Rightarrow> ts) = {(y, q'). (q, x, y, q') \<in> set ts}

goal (1 subgoal):
 1. \<nexists>z. ((q, x), z) \<in> set (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts) \<Longrightarrow> (case Mapping.lookup (list_as_mapping (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts)) (q, x) of None \<Rightarrow> {} | Some ts \<Rightarrow> ts) = {(y, q'). (q, x, y, q') \<in> set ts}
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<nexists>z. ((q, x), z) \<in> set (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts) \<Longrightarrow> (case Mapping.lookup (list_as_mapping (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts)) (q, x) of None \<Rightarrow> {} | Some ts \<Rightarrow> ts) = {(y, q'). (q, x, y, q') \<in> set ts}
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
\<nexists>z. ((q, x), z) \<in> set (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts)

goal (1 subgoal):
 1. \<nexists>z. ((q, x), z) \<in> set (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts) \<Longrightarrow> (case Mapping.lookup (list_as_mapping (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts)) (q, x) of None \<Rightarrow> {} | Some ts \<Rightarrow> ts) = {(y, q'). (q, x, y, q') \<in> set ts}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<nexists>z. ((q, x), z) \<in> set (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts)
[PROOF STEP]
have "?S1 = {}"
[PROOF STATE]
proof (prove)
using this:
\<nexists>z. ((q, x), z) \<in> set (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts)

goal (1 subgoal):
 1. (case Mapping.lookup (list_as_mapping (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts)) (q, x) of None \<Rightarrow> {} | Some ts \<Rightarrow> ts) = {}
[PROOF STEP]
unfolding list_as_mapping_lookup
[PROOF STATE]
proof (prove)
using this:
\<nexists>z. ((q, x), z) \<in> set (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts)

goal (1 subgoal):
 1. (case if \<exists>z. ((q, x), z) \<in> set (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts) then Some {z. ((q, x), z) \<in> set (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts)} else None of None \<Rightarrow> {} | Some ts \<Rightarrow> ts) = {}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(case Mapping.lookup (list_as_mapping (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts)) (q, x) of None \<Rightarrow> {} | Some ts \<Rightarrow> ts) = {}

goal (1 subgoal):
 1. \<nexists>z. ((q, x), z) \<in> set (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts) \<Longrightarrow> (case Mapping.lookup (list_as_mapping (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts)) (q, x) of None \<Rightarrow> {} | Some ts \<Rightarrow> ts) = {(y, q'). (q, x, y, q') \<in> set ts}
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(case Mapping.lookup (list_as_mapping (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts)) (q, x) of None \<Rightarrow> {} | Some ts \<Rightarrow> ts) = {}

goal (1 subgoal):
 1. \<nexists>z. ((q, x), z) \<in> set (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts) \<Longrightarrow> (case Mapping.lookup (list_as_mapping (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts)) (q, x) of None \<Rightarrow> {} | Some ts \<Rightarrow> ts) = {(y, q'). (q, x, y, q') \<in> set ts}
[PROOF STEP]
have "\<dots> = ?S2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {} = {(y, q'). (q, x, y, q') \<in> set ts}
[PROOF STEP]
using False
[PROOF STATE]
proof (prove)
using this:
\<nexists>z. ((q, x), z) \<in> set (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts)

goal (1 subgoal):
 1. {} = {(y, q'). (q, x, y, q') \<in> set ts}
[PROOF STEP]
by (induction ts; auto)
[PROOF STATE]
proof (state)
this:
{} = {(y, q'). (q, x, y, q') \<in> set ts}

goal (1 subgoal):
 1. \<nexists>z. ((q, x), z) \<in> set (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts) \<Longrightarrow> (case Mapping.lookup (list_as_mapping (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts)) (q, x) of None \<Rightarrow> {} | Some ts \<Rightarrow> ts) = {(y, q'). (q, x, y, q') \<in> set ts}
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
(case Mapping.lookup (list_as_mapping (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts)) (q, x) of None \<Rightarrow> {} | Some ts \<Rightarrow> ts) = {(y, q'). (q, x, y, q') \<in> set ts}
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
(case Mapping.lookup (list_as_mapping (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts)) (q, x) of None \<Rightarrow> {} | Some ts \<Rightarrow> ts) = {(y, q'). (q, x, y, q') \<in> set ts}

goal (1 subgoal):
 1. (case Mapping.lookup (list_as_mapping (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts)) (q, x) of None \<Rightarrow> {} | Some ts \<Rightarrow> ts) = {(y, q'). (q, x, y, q') \<in> set ts}
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
(case Mapping.lookup (list_as_mapping (map (\<lambda>(q, x, y, q'). ((q, x), y, q')) ts)) (q, x) of None \<Rightarrow> {} | Some ts \<Rightarrow> ts) = {(y, q'). (q, x, y, q') \<in> set ts}

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma integrable_sin_and_cos:
  fixes m n::int
  shows "integrable (lebesgue_on {a..b}) (\<lambda>x. cos(x * m) * cos(x * n))"
        "integrable (lebesgue_on {a..b}) (\<lambda>x. cos(x * m) * sin(x * n))"
        "integrable (lebesgue_on {a..b}) (\<lambda>x. sin(x * m) * cos(x * n))"
        "integrable (lebesgue_on {a..b}) (\<lambda>x. sin(x * m) * sin(x * n))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (integrable (lebesgue_on {a..b}) (\<lambda>x. cos (x * real_of_int m) * cos (x * real_of_int n)) &&& integrable (lebesgue_on {a..b}) (\<lambda>x. cos (x * real_of_int m) * sin (x * real_of_int n))) &&& integrable (lebesgue_on {a..b}) (\<lambda>x. sin (x * real_of_int m) * cos (x * real_of_int n)) &&& integrable (lebesgue_on {a..b}) (\<lambda>x. sin (x * real_of_int m) * sin (x * real_of_int n))
[PROOF STEP]
by (intro continuous_imp_integrable_real continuous_intros)+


[STATEMENT]
lemma val_ineq_setE:
  assumes "f \<in> carrier (Q\<^sub>p[\<X>\<^bsub>n\<^esub>])"
  assumes "g \<in> carrier (Q\<^sub>p[\<X>\<^bsub>n\<^esub>])"
  assumes "x \<in> carrier (Q\<^sub>p\<^bsup>n\<^esup>)"
  assumes      "val (Qp_ev f x) \<le> val (Qp_ev g x)"
  shows "x \<in> (val_ineq_set n f g)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x \<in> val_ineq_set n f g
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
f \<in> carrier (Q\<^sub>p [\<X>\<^bsub>n\<^esub>])
g \<in> carrier (Q\<^sub>p [\<X>\<^bsub>n\<^esub>])
x \<in> carrier (Q\<^sub>p\<^bsup>n\<^esup>)
val (eval_at_point Q\<^sub>p x f) \<le> val (eval_at_point Q\<^sub>p x g)

goal (1 subgoal):
 1. x \<in> val_ineq_set n f g
[PROOF STEP]
unfolding val_ineq_set_def
[PROOF STATE]
proof (prove)
using this:
f \<in> carrier (Q\<^sub>p [\<X>\<^bsub>n\<^esub>])
g \<in> carrier (Q\<^sub>p [\<X>\<^bsub>n\<^esub>])
x \<in> carrier (Q\<^sub>p\<^bsup>n\<^esup>)
val (eval_at_point Q\<^sub>p x f) \<le> val (eval_at_point Q\<^sub>p x g)

goal (1 subgoal):
 1. x \<in> {x \<in> carrier (Q\<^sub>p\<^bsup>n\<^esup>). val (eval_at_point Q\<^sub>p x f) \<le> val (eval_at_point Q\<^sub>p x g)}
[PROOF STEP]
by blast


[STATEMENT]
lemma ereal_mult_mono_strict':
  fixes a b c d::ereal
  assumes "a > 0" "c > 0" "a < b" "c < d"
  shows "a * c < b * d"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. a * c < b * d
[PROOF STEP]
using assms ereal_mult_mono_strict
[PROOF STATE]
proof (prove)
using this:
0 < a
0 < c
a < b
c < d
\<lbrakk>0 < ?b; 0 < ?c; ?a < ?b; ?c < ?d\<rbrakk> \<Longrightarrow> ?a * ?c < ?b * ?d

goal (1 subgoal):
 1. a * c < b * d
[PROOF STEP]
by auto


[STATEMENT]
lemma powrat_add_pos_neg:
 "\<lbrakk> 0 < x; 0 < r; s < 0 \<rbrakk>
  \<Longrightarrow> x pow\<^sub>\<rat> (r + s) = (x pow\<^sub>\<rat> r) * (x pow\<^sub>\<rat> s)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 < x; 0 < r; s < 0\<rbrakk> \<Longrightarrow> x pow\<^sub>\<rat> (r + s) = x pow\<^sub>\<rat> r * x pow\<^sub>\<rat> s
[PROOF STEP]
by (metis add.commute mult.commute powrat_add_neg_pos)


[STATEMENT]
lemma (in semidom_divide) prod_mset_minus:
  assumes "a \<in># A" and "a \<noteq> 0"
  shows "prod_mset (A - {#a#}) = prod_mset A div a"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<Prod>\<^sub># (A - {#a#}) = \<Prod>\<^sub># A div a
[PROOF STEP]
using assms prod_mset_diff [of "{#a#}" A]
[PROOF STATE]
proof (prove)
using this:
a \<in># A
a \<noteq> (0::'a)
\<lbrakk>{#a#} \<subseteq># A; (0::'a) \<notin># {#a#}\<rbrakk> \<Longrightarrow> \<Prod>\<^sub># (A - {#a#}) = \<Prod>\<^sub># A div \<Prod>\<^sub># {#a#}

goal (1 subgoal):
 1. \<Prod>\<^sub># (A - {#a#}) = \<Prod>\<^sub># A div a
[PROOF STEP]
by auto


[STATEMENT]
lemma lset_lnth_member: "\<lbrakk> lset xs \<subseteq> A; enat n < llength xs \<rbrakk> \<Longrightarrow> lnth xs n \<in> A"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>lset xs \<subseteq> A; enat n < llength xs\<rbrakk> \<Longrightarrow> lnth xs n \<in> A
[PROOF STEP]
using contra_subsetD[of "lset xs" A] in_lset_conv_lnth[of _ xs]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>lset xs \<subseteq> A; ?c \<notin> A\<rbrakk> \<Longrightarrow> ?c \<notin> lset xs
(?x \<in> lset xs) = (\<exists>n. enat n < llength xs \<and> lnth xs n = ?x)

goal (1 subgoal):
 1. \<lbrakk>lset xs \<subseteq> A; enat n < llength xs\<rbrakk> \<Longrightarrow> lnth xs n \<in> A
[PROOF STEP]
by blast


[STATEMENT]
lemma "\<not> (\<forall>x::'a::linordered_field. \<exists>y z w.
  3 * x + z * 4 = 3 * y \<and> x + y < z \<and> x > w \<and> 3 * x < w + y)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> (\<forall>x. \<exists>y z w. (3::'a) * x + z * (4::'a) = (3::'a) * y \<and> x + y < z \<and> w < x \<and> (3::'a) * x < w + y)
[PROOF STEP]
by ferrack


[STATEMENT]
lemma (in order_topology) order_tendsto_iff:
  "(f \<longlongrightarrow> x) F \<longleftrightarrow> (\<forall>l<x. eventually (\<lambda>x. l < f x) F) \<and> (\<forall>u>x. eventually (\<lambda>x. f x < u) F)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (f \<longlongrightarrow> x) F = ((\<forall>l<x. \<forall>\<^sub>F x in F. l < f x) \<and> (\<forall>u>x. \<forall>\<^sub>F x in F. f x < u))
[PROOF STEP]
by (auto simp: nhds_order filterlim_inf filterlim_INF filterlim_principal)


[STATEMENT]
lemma insert_correct:
  assumes I: "invar q"
  shows
  "invar (insert e a q)"
  "queue_to_multiset (insert e a q) = queue_to_multiset q + {# (e,a) #}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. invar (local.insert e a q) &&& queue_to_multiset (local.insert e a q) = queue_to_multiset q + {#(e, a)#}
[PROOF STEP]
using insert_queue_invar[of q] rank_invar_insert[of q] insert_mset[of q] I
[PROOF STATE]
proof (prove)
using this:
queue_invar q \<Longrightarrow> queue_invar (local.insert ?e ?a q)
rank_invar q \<Longrightarrow> rank_invar (local.insert ?e ?a q)
queue_invar q \<Longrightarrow> queue_to_multiset (local.insert ?e ?a q) = queue_to_multiset q + {#(?e, ?a)#}
invar q

goal (1 subgoal):
 1. invar (local.insert e a q) &&& queue_to_multiset (local.insert e a q) = queue_to_multiset q + {#(e, a)#}
[PROOF STEP]
unfolding invar_def
[PROOF STATE]
proof (prove)
using this:
queue_invar q \<Longrightarrow> queue_invar (local.insert ?e ?a q)
rank_invar q \<Longrightarrow> rank_invar (local.insert ?e ?a q)
queue_invar q \<Longrightarrow> queue_to_multiset (local.insert ?e ?a q) = queue_to_multiset q + {#(?e, ?a)#}
queue_invar q \<and> rank_invar q

goal (1 subgoal):
 1. queue_invar (local.insert e a q) \<and> rank_invar (local.insert e a q) &&& queue_to_multiset (local.insert e a q) = queue_to_multiset q + {#(e, a)#}
[PROOF STEP]
by auto