[STATEMENT]
lemma wordinterval_setminus'_rr_set_eq:
    "wordinterval_to_set(wordinterval_setminus' (WordInterval s e) (WordInterval ms me)) =
    wordinterval_to_set (WordInterval s e) - wordinterval_to_set (WordInterval ms me)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. wordinterval_to_set (wordinterval_setminus' (WordInterval s e) (WordInterval ms me)) = wordinterval_to_set (WordInterval s e) - wordinterval_to_set (WordInterval ms me)
[PROOF STEP]
apply(simp only: wordinterval_setminus'.simps)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. wordinterval_to_set (if e < s \<or> me < ms then WordInterval s e else if e \<le> me then WordInterval (if ms = 0 then 1 else s) (min e (word_prev ms)) else if ms \<le> s then WordInterval (max s (word_next me)) (if me = - 1 then 0 else e) else RangeUnion (WordInterval (if ms = 0 then 1 else s) (word_prev ms)) (WordInterval (word_next me) (if me = - 1 then 0 else e))) = wordinterval_to_set (WordInterval s e) - wordinterval_to_set (WordInterval ms me)
[PROOF STEP]
apply(case_tac "e < s")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. e < s \<Longrightarrow> wordinterval_to_set (if e < s \<or> me < ms then WordInterval s e else if e \<le> me then WordInterval (if ms = 0 then 1 else s) (min e (word_prev ms)) else if ms \<le> s then WordInterval (max s (word_next me)) (if me = - 1 then 0 else e) else RangeUnion (WordInterval (if ms = 0 then 1 else s) (word_prev ms)) (WordInterval (word_next me) (if me = - 1 then 0 else e))) = wordinterval_to_set (WordInterval s e) - wordinterval_to_set (WordInterval ms me)
 2. \<not> e < s \<Longrightarrow> wordinterval_to_set (if e < s \<or> me < ms then WordInterval s e else if e \<le> me then WordInterval (if ms = 0 then 1 else s) (min e (word_prev ms)) else if ms \<le> s then WordInterval (max s (word_next me)) (if me = - 1 then 0 else e) else RangeUnion (WordInterval (if ms = 0 then 1 else s) (word_prev ms)) (WordInterval (word_next me) (if me = - 1 then 0 else e))) = wordinterval_to_set (WordInterval s e) - wordinterval_to_set (WordInterval ms me)
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> e < s \<Longrightarrow> wordinterval_to_set (if e < s \<or> me < ms then WordInterval s e else if e \<le> me then WordInterval (if ms = 0 then 1 else s) (min e (word_prev ms)) else if ms \<le> s then WordInterval (max s (word_next me)) (if me = - 1 then 0 else e) else RangeUnion (WordInterval (if ms = 0 then 1 else s) (word_prev ms)) (WordInterval (word_next me) (if me = - 1 then 0 else e))) = wordinterval_to_set (WordInterval s e) - wordinterval_to_set (WordInterval ms me)
[PROOF STEP]
apply(case_tac "me < ms")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>\<not> e < s; me < ms\<rbrakk> \<Longrightarrow> wordinterval_to_set (if e < s \<or> me < ms then WordInterval s e else if e \<le> me then WordInterval (if ms = 0 then 1 else s) (min e (word_prev ms)) else if ms \<le> s then WordInterval (max s (word_next me)) (if me = - 1 then 0 else e) else RangeUnion (WordInterval (if ms = 0 then 1 else s) (word_prev ms)) (WordInterval (word_next me) (if me = - 1 then 0 else e))) = wordinterval_to_set (WordInterval s e) - wordinterval_to_set (WordInterval ms me)
 2. \<lbrakk>\<not> e < s; \<not> me < ms\<rbrakk> \<Longrightarrow> wordinterval_to_set (if e < s \<or> me < ms then WordInterval s e else if e \<le> me then WordInterval (if ms = 0 then 1 else s) (min e (word_prev ms)) else if ms \<le> s then WordInterval (max s (word_next me)) (if me = - 1 then 0 else e) else RangeUnion (WordInterval (if ms = 0 then 1 else s) (word_prev ms)) (WordInterval (word_next me) (if me = - 1 then 0 else e))) = wordinterval_to_set (WordInterval s e) - wordinterval_to_set (WordInterval ms me)
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<not> e < s; \<not> me < ms\<rbrakk> \<Longrightarrow> wordinterval_to_set (if e < s \<or> me < ms then WordInterval s e else if e \<le> me then WordInterval (if ms = 0 then 1 else s) (min e (word_prev ms)) else if ms \<le> s then WordInterval (max s (word_next me)) (if me = - 1 then 0 else e) else RangeUnion (WordInterval (if ms = 0 then 1 else s) (word_prev ms)) (WordInterval (word_next me) (if me = - 1 then 0 else e))) = wordinterval_to_set (WordInterval s e) - wordinterval_to_set (WordInterval ms me)
[PROOF STEP]
apply(case_tac [!] "e \<le> me")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me\<rbrakk> \<Longrightarrow> wordinterval_to_set (if e < s \<or> me < ms then WordInterval s e else if e \<le> me then WordInterval (if ms = 0 then 1 else s) (min e (word_prev ms)) else if ms \<le> s then WordInterval (max s (word_next me)) (if me = - 1 then 0 else e) else RangeUnion (WordInterval (if ms = 0 then 1 else s) (word_prev ms)) (WordInterval (word_next me) (if me = - 1 then 0 else e))) = wordinterval_to_set (WordInterval s e) - wordinterval_to_set (WordInterval ms me)
 2. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me\<rbrakk> \<Longrightarrow> wordinterval_to_set (if e < s \<or> me < ms then WordInterval s e else if e \<le> me then WordInterval (if ms = 0 then 1 else s) (min e (word_prev ms)) else if ms \<le> s then WordInterval (max s (word_next me)) (if me = - 1 then 0 else e) else RangeUnion (WordInterval (if ms = 0 then 1 else s) (word_prev ms)) (WordInterval (word_next me) (if me = - 1 then 0 else e))) = wordinterval_to_set (WordInterval s e) - wordinterval_to_set (WordInterval ms me)
[PROOF STEP]
apply(case_tac [!] "ms = 0")
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms = 0\<rbrakk> \<Longrightarrow> wordinterval_to_set (if e < s \<or> me < ms then WordInterval s e else if e \<le> me then WordInterval (if ms = 0 then 1 else s) (min e (word_prev ms)) else if ms \<le> s then WordInterval (max s (word_next me)) (if me = - 1 then 0 else e) else RangeUnion (WordInterval (if ms = 0 then 1 else s) (word_prev ms)) (WordInterval (word_next me) (if me = - 1 then 0 else e))) = wordinterval_to_set (WordInterval s e) - wordinterval_to_set (WordInterval ms me)
 2. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0\<rbrakk> \<Longrightarrow> wordinterval_to_set (if e < s \<or> me < ms then WordInterval s e else if e \<le> me then WordInterval (if ms = 0 then 1 else s) (min e (word_prev ms)) else if ms \<le> s then WordInterval (max s (word_next me)) (if me = - 1 then 0 else e) else RangeUnion (WordInterval (if ms = 0 then 1 else s) (word_prev ms)) (WordInterval (word_next me) (if me = - 1 then 0 else e))) = wordinterval_to_set (WordInterval s e) - wordinterval_to_set (WordInterval ms me)
 3. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms = 0\<rbrakk> \<Longrightarrow> wordinterval_to_set (if e < s \<or> me < ms then WordInterval s e else if e \<le> me then WordInterval (if ms = 0 then 1 else s) (min e (word_prev ms)) else if ms \<le> s then WordInterval (max s (word_next me)) (if me = - 1 then 0 else e) else RangeUnion (WordInterval (if ms = 0 then 1 else s) (word_prev ms)) (WordInterval (word_next me) (if me = - 1 then 0 else e))) = wordinterval_to_set (WordInterval s e) - wordinterval_to_set (WordInterval ms me)
 4. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0\<rbrakk> \<Longrightarrow> wordinterval_to_set (if e < s \<or> me < ms then WordInterval s e else if e \<le> me then WordInterval (if ms = 0 then 1 else s) (min e (word_prev ms)) else if ms \<le> s then WordInterval (max s (word_next me)) (if me = - 1 then 0 else e) else RangeUnion (WordInterval (if ms = 0 then 1 else s) (word_prev ms)) (WordInterval (word_next me) (if me = - 1 then 0 else e))) = wordinterval_to_set (WordInterval s e) - wordinterval_to_set (WordInterval ms me)
[PROOF STEP]
apply(case_tac [!] "ms \<le> s")
[PROOF STATE]
proof (prove)
goal (8 subgoals):
 1. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms = 0; ms \<le> s\<rbrakk> \<Longrightarrow> wordinterval_to_set (if e < s \<or> me < ms then WordInterval s e else if e \<le> me then WordInterval (if ms = 0 then 1 else s) (min e (word_prev ms)) else if ms \<le> s then WordInterval (max s (word_next me)) (if me = - 1 then 0 else e) else RangeUnion (WordInterval (if ms = 0 then 1 else s) (word_prev ms)) (WordInterval (word_next me) (if me = - 1 then 0 else e))) = wordinterval_to_set (WordInterval s e) - wordinterval_to_set (WordInterval ms me)
 2. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms = 0; \<not> ms \<le> s\<rbrakk> \<Longrightarrow> wordinterval_to_set (if e < s \<or> me < ms then WordInterval s e else if e \<le> me then WordInterval (if ms = 0 then 1 else s) (min e (word_prev ms)) else if ms \<le> s then WordInterval (max s (word_next me)) (if me = - 1 then 0 else e) else RangeUnion (WordInterval (if ms = 0 then 1 else s) (word_prev ms)) (WordInterval (word_next me) (if me = - 1 then 0 else e))) = wordinterval_to_set (WordInterval s e) - wordinterval_to_set (WordInterval ms me)
 3. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0; ms \<le> s\<rbrakk> \<Longrightarrow> wordinterval_to_set (if e < s \<or> me < ms then WordInterval s e else if e \<le> me then WordInterval (if ms = 0 then 1 else s) (min e (word_prev ms)) else if ms \<le> s then WordInterval (max s (word_next me)) (if me = - 1 then 0 else e) else RangeUnion (WordInterval (if ms = 0 then 1 else s) (word_prev ms)) (WordInterval (word_next me) (if me = - 1 then 0 else e))) = wordinterval_to_set (WordInterval s e) - wordinterval_to_set (WordInterval ms me)
 4. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0; \<not> ms \<le> s\<rbrakk> \<Longrightarrow> wordinterval_to_set (if e < s \<or> me < ms then WordInterval s e else if e \<le> me then WordInterval (if ms = 0 then 1 else s) (min e (word_prev ms)) else if ms \<le> s then WordInterval (max s (word_next me)) (if me = - 1 then 0 else e) else RangeUnion (WordInterval (if ms = 0 then 1 else s) (word_prev ms)) (WordInterval (word_next me) (if me = - 1 then 0 else e))) = wordinterval_to_set (WordInterval s e) - wordinterval_to_set (WordInterval ms me)
 5. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms = 0; ms \<le> s\<rbrakk> \<Longrightarrow> wordinterval_to_set (if e < s \<or> me < ms then WordInterval s e else if e \<le> me then WordInterval (if ms = 0 then 1 else s) (min e (word_prev ms)) else if ms \<le> s then WordInterval (max s (word_next me)) (if me = - 1 then 0 else e) else RangeUnion (WordInterval (if ms = 0 then 1 else s) (word_prev ms)) (WordInterval (word_next me) (if me = - 1 then 0 else e))) = wordinterval_to_set (WordInterval s e) - wordinterval_to_set (WordInterval ms me)
 6. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms = 0; \<not> ms \<le> s\<rbrakk> \<Longrightarrow> wordinterval_to_set (if e < s \<or> me < ms then WordInterval s e else if e \<le> me then WordInterval (if ms = 0 then 1 else s) (min e (word_prev ms)) else if ms \<le> s then WordInterval (max s (word_next me)) (if me = - 1 then 0 else e) else RangeUnion (WordInterval (if ms = 0 then 1 else s) (word_prev ms)) (WordInterval (word_next me) (if me = - 1 then 0 else e))) = wordinterval_to_set (WordInterval s e) - wordinterval_to_set (WordInterval ms me)
 7. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; ms \<le> s\<rbrakk> \<Longrightarrow> wordinterval_to_set (if e < s \<or> me < ms then WordInterval s e else if e \<le> me then WordInterval (if ms = 0 then 1 else s) (min e (word_prev ms)) else if ms \<le> s then WordInterval (max s (word_next me)) (if me = - 1 then 0 else e) else RangeUnion (WordInterval (if ms = 0 then 1 else s) (word_prev ms)) (WordInterval (word_next me) (if me = - 1 then 0 else e))) = wordinterval_to_set (WordInterval s e) - wordinterval_to_set (WordInterval ms me)
 8. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s\<rbrakk> \<Longrightarrow> wordinterval_to_set (if e < s \<or> me < ms then WordInterval s e else if e \<le> me then WordInterval (if ms = 0 then 1 else s) (min e (word_prev ms)) else if ms \<le> s then WordInterval (max s (word_next me)) (if me = - 1 then 0 else e) else RangeUnion (WordInterval (if ms = 0 then 1 else s) (word_prev ms)) (WordInterval (word_next me) (if me = - 1 then 0 else e))) = wordinterval_to_set (WordInterval s e) - wordinterval_to_set (WordInterval ms me)
[PROOF STEP]
apply(case_tac [!] "me = - 1")
[PROOF STATE]
proof (prove)
goal (16 subgoals):
 1. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms = 0; ms \<le> s; me = - 1\<rbrakk> \<Longrightarrow> wordinterval_to_set (if e < s \<or> me < ms then WordInterval s e else if e \<le> me then WordInterval (if ms = 0 then 1 else s) (min e (word_prev ms)) else if ms \<le> s then WordInterval (max s (word_next me)) (if me = - 1 then 0 else e) else RangeUnion (WordInterval (if ms = 0 then 1 else s) (word_prev ms)) (WordInterval (word_next me) (if me = - 1 then 0 else e))) = wordinterval_to_set (WordInterval s e) - wordinterval_to_set (WordInterval ms me)
 2. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms = 0; ms \<le> s; me \<noteq> - 1\<rbrakk> \<Longrightarrow> wordinterval_to_set (if e < s \<or> me < ms then WordInterval s e else if e \<le> me then WordInterval (if ms = 0 then 1 else s) (min e (word_prev ms)) else if ms \<le> s then WordInterval (max s (word_next me)) (if me = - 1 then 0 else e) else RangeUnion (WordInterval (if ms = 0 then 1 else s) (word_prev ms)) (WordInterval (word_next me) (if me = - 1 then 0 else e))) = wordinterval_to_set (WordInterval s e) - wordinterval_to_set (WordInterval ms me)
 3. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms = 0; \<not> ms \<le> s; me = - 1\<rbrakk> \<Longrightarrow> wordinterval_to_set (if e < s \<or> me < ms then WordInterval s e else if e \<le> me then WordInterval (if ms = 0 then 1 else s) (min e (word_prev ms)) else if ms \<le> s then WordInterval (max s (word_next me)) (if me = - 1 then 0 else e) else RangeUnion (WordInterval (if ms = 0 then 1 else s) (word_prev ms)) (WordInterval (word_next me) (if me = - 1 then 0 else e))) = wordinterval_to_set (WordInterval s e) - wordinterval_to_set (WordInterval ms me)
 4. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms = 0; \<not> ms \<le> s; me \<noteq> - 1\<rbrakk> \<Longrightarrow> wordinterval_to_set (if e < s \<or> me < ms then WordInterval s e else if e \<le> me then WordInterval (if ms = 0 then 1 else s) (min e (word_prev ms)) else if ms \<le> s then WordInterval (max s (word_next me)) (if me = - 1 then 0 else e) else RangeUnion (WordInterval (if ms = 0 then 1 else s) (word_prev ms)) (WordInterval (word_next me) (if me = - 1 then 0 else e))) = wordinterval_to_set (WordInterval s e) - wordinterval_to_set (WordInterval ms me)
 5. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0; ms \<le> s; me = - 1\<rbrakk> \<Longrightarrow> wordinterval_to_set (if e < s \<or> me < ms then WordInterval s e else if e \<le> me then WordInterval (if ms = 0 then 1 else s) (min e (word_prev ms)) else if ms \<le> s then WordInterval (max s (word_next me)) (if me = - 1 then 0 else e) else RangeUnion (WordInterval (if ms = 0 then 1 else s) (word_prev ms)) (WordInterval (word_next me) (if me = - 1 then 0 else e))) = wordinterval_to_set (WordInterval s e) - wordinterval_to_set (WordInterval ms me)
 6. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0; ms \<le> s; me \<noteq> - 1\<rbrakk> \<Longrightarrow> wordinterval_to_set (if e < s \<or> me < ms then WordInterval s e else if e \<le> me then WordInterval (if ms = 0 then 1 else s) (min e (word_prev ms)) else if ms \<le> s then WordInterval (max s (word_next me)) (if me = - 1 then 0 else e) else RangeUnion (WordInterval (if ms = 0 then 1 else s) (word_prev ms)) (WordInterval (word_next me) (if me = - 1 then 0 else e))) = wordinterval_to_set (WordInterval s e) - wordinterval_to_set (WordInterval ms me)
 7. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me = - 1\<rbrakk> \<Longrightarrow> wordinterval_to_set (if e < s \<or> me < ms then WordInterval s e else if e \<le> me then WordInterval (if ms = 0 then 1 else s) (min e (word_prev ms)) else if ms \<le> s then WordInterval (max s (word_next me)) (if me = - 1 then 0 else e) else RangeUnion (WordInterval (if ms = 0 then 1 else s) (word_prev ms)) (WordInterval (word_next me) (if me = - 1 then 0 else e))) = wordinterval_to_set (WordInterval s e) - wordinterval_to_set (WordInterval ms me)
 8. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1\<rbrakk> \<Longrightarrow> wordinterval_to_set (if e < s \<or> me < ms then WordInterval s e else if e \<le> me then WordInterval (if ms = 0 then 1 else s) (min e (word_prev ms)) else if ms \<le> s then WordInterval (max s (word_next me)) (if me = - 1 then 0 else e) else RangeUnion (WordInterval (if ms = 0 then 1 else s) (word_prev ms)) (WordInterval (word_next me) (if me = - 1 then 0 else e))) = wordinterval_to_set (WordInterval s e) - wordinterval_to_set (WordInterval ms me)
 9. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms = 0; ms \<le> s; me = - 1\<rbrakk> \<Longrightarrow> wordinterval_to_set (if e < s \<or> me < ms then WordInterval s e else if e \<le> me then WordInterval (if ms = 0 then 1 else s) (min e (word_prev ms)) else if ms \<le> s then WordInterval (max s (word_next me)) (if me = - 1 then 0 else e) else RangeUnion (WordInterval (if ms = 0 then 1 else s) (word_prev ms)) (WordInterval (word_next me) (if me = - 1 then 0 else e))) = wordinterval_to_set (WordInterval s e) - wordinterval_to_set (WordInterval ms me)
 10. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms = 0; ms \<le> s; me \<noteq> - 1\<rbrakk> \<Longrightarrow> wordinterval_to_set (if e < s \<or> me < ms then WordInterval s e else if e \<le> me then WordInterval (if ms = 0 then 1 else s) (min e (word_prev ms)) else if ms \<le> s then WordInterval (max s (word_next me)) (if me = - 1 then 0 else e) else RangeUnion (WordInterval (if ms = 0 then 1 else s) (word_prev ms)) (WordInterval (word_next me) (if me = - 1 then 0 else e))) = wordinterval_to_set (WordInterval s e) - wordinterval_to_set (WordInterval ms me)
A total of 16 subgoals...
[PROOF STEP]
apply(simp_all add: word_next_unfold word_prev_unfold min_def max_def)
[PROOF STATE]
proof (prove)
goal (9 subgoals):
 1. \<lbrakk>\<not> e < s; ms = 0; me = - 1\<rbrakk> \<Longrightarrow> {} = {s..e} - {0..- 1}
 2. \<lbrakk>\<not> e < s; e \<le> me; ms = 0; me \<noteq> - 1\<rbrakk> \<Longrightarrow> {} = {s..e} - {0..me}
 3. \<lbrakk>\<not> e < s; ms \<noteq> 0; ms \<le> s; me = - 1\<rbrakk> \<Longrightarrow> (e \<le> ms - 1 \<longrightarrow> {s..e} = {s..e} - {ms..- 1}) \<and> (\<not> e \<le> ms - 1 \<longrightarrow> {s..ms - 1} = {s..e} - {ms..- 1})
 4. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0; ms \<le> s; me \<noteq> - 1\<rbrakk> \<Longrightarrow> (e \<le> ms - 1 \<longrightarrow> {s..e} = {s..e} - {ms..me}) \<and> (\<not> e \<le> ms - 1 \<longrightarrow> {s..ms - 1} = {s..e} - {ms..me})
 5. \<lbrakk>\<not> e < s; ms \<noteq> 0; \<not> ms \<le> s; me = - 1\<rbrakk> \<Longrightarrow> (e \<le> ms - 1 \<longrightarrow> {s..e} = {s..e} - {ms..- 1}) \<and> (\<not> e \<le> ms - 1 \<longrightarrow> {s..ms - 1} = {s..e} - {ms..- 1})
 6. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1\<rbrakk> \<Longrightarrow> (e \<le> ms - 1 \<longrightarrow> {s..e} = {s..e} - {ms..me}) \<and> (\<not> e \<le> ms - 1 \<longrightarrow> {s..ms - 1} = {s..e} - {ms..me})
 7. \<lbrakk>\<not> e < s; \<not> e \<le> me; ms = 0; me \<noteq> - 1\<rbrakk> \<Longrightarrow> (s \<le> me + 1 \<longrightarrow> {me + 1..e} = {s..e} - {0..me}) \<and> (\<not> s \<le> me + 1 \<longrightarrow> {s..e} = {s..e} - {0..me})
 8. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; ms \<le> s; me \<noteq> - 1\<rbrakk> \<Longrightarrow> (s \<le> me + 1 \<longrightarrow> {me + 1..e} = {s..e} - {ms..me}) \<and> (\<not> s \<le> me + 1 \<longrightarrow> {s..e} = {s..e} - {ms..me})
 9. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1\<rbrakk> \<Longrightarrow> {s..ms - 1} \<union> {me + 1..e} = {s..e} - {ms..me}
[PROOF STEP]
apply(safe)
[PROOF STATE]
proof (prove)
goal (31 subgoals):
 1. \<And>x. \<lbrakk>\<not> e < s; ms = 0; me = - 1; x \<in> {s..e}; x \<notin> {0..- 1}\<rbrakk> \<Longrightarrow> x \<in> {}
 2. \<And>x. \<lbrakk>\<not> e < s; e \<le> me; ms = 0; me \<noteq> - 1; x \<in> {s..e}; x \<notin> {0..me}\<rbrakk> \<Longrightarrow> x \<in> {}
 3. \<And>x. \<lbrakk>\<not> e < s; ms \<noteq> 0; ms \<le> s; me = - 1; e \<le> ms - 1; x \<in> {s..e}; x \<in> {ms..- 1}\<rbrakk> \<Longrightarrow> False
 4. \<And>x. \<lbrakk>\<not> e < s; ms \<noteq> 0; ms \<le> s; me = - 1; \<not> e \<le> ms - 1; x \<in> {s..ms - 1}\<rbrakk> \<Longrightarrow> x \<in> {s..e}
 5. \<And>x. \<lbrakk>\<not> e < s; ms \<noteq> 0; ms \<le> s; me = - 1; \<not> e \<le> ms - 1; x \<in> {s..ms - 1}; x \<in> {ms..- 1}\<rbrakk> \<Longrightarrow> False
 6. \<And>x. \<lbrakk>\<not> e < s; ms \<noteq> 0; ms \<le> s; me = - 1; \<not> e \<le> ms - 1; x \<in> {s..e}; x \<notin> {ms..- 1}\<rbrakk> \<Longrightarrow> x \<in> {s..ms - 1}
 7. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0; ms \<le> s; me \<noteq> - 1; e \<le> ms - 1; x \<in> {s..e}; x \<in> {ms..me}\<rbrakk> \<Longrightarrow> False
 8. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0; ms \<le> s; me \<noteq> - 1; \<not> e \<le> ms - 1; x \<in> {s..ms - 1}\<rbrakk> \<Longrightarrow> x \<in> {s..e}
 9. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0; ms \<le> s; me \<noteq> - 1; \<not> e \<le> ms - 1; x \<in> {s..ms - 1}; x \<in> {ms..me}\<rbrakk> \<Longrightarrow> False
 10. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0; ms \<le> s; me \<noteq> - 1; \<not> e \<le> ms - 1; x \<in> {s..e}; x \<notin> {ms..me}\<rbrakk> \<Longrightarrow> x \<in> {s..ms - 1}
A total of 31 subgoals...
[PROOF STEP]
apply(auto)
[PROOF STATE]
proof (prove)
goal (22 subgoals):
 1. \<And>x. \<lbrakk>\<not> e < s; ms \<noteq> 0; ms \<le> s; me = - 1; e \<le> ms - 1; ms \<le> x; s \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> False
 2. \<And>x. \<lbrakk>\<not> e < s; ms \<noteq> 0; ms \<le> s; me = - 1; \<not> e \<le> ms - 1; ms \<le> x; s \<le> x; x \<le> ms - 1\<rbrakk> \<Longrightarrow> False
 3. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0; ms \<le> s; me \<noteq> - 1; e \<le> ms - 1; s \<le> x; x \<le> e; ms \<le> x; x \<le> me\<rbrakk> \<Longrightarrow> False
 4. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0; ms \<le> s; me \<noteq> - 1; \<not> e \<le> ms - 1; s \<le> x; x \<le> ms - 1; ms \<le> x; x \<le> me\<rbrakk> \<Longrightarrow> False
 5. \<And>x. \<lbrakk>\<not> e < s; ms \<noteq> 0; \<not> ms \<le> s; me = - 1; e \<le> ms - 1; ms \<le> x; s \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> False
 6. \<And>x. \<lbrakk>\<not> e < s; ms \<noteq> 0; \<not> ms \<le> s; me = - 1; \<not> e \<le> ms - 1; ms \<le> x; s \<le> x; x \<le> ms - 1\<rbrakk> \<Longrightarrow> False
 7. \<And>x. \<lbrakk>\<not> e < s; ms \<noteq> 0; \<not> ms \<le> s; me = - 1; \<not> e \<le> ms - 1; \<not> ms \<le> x; s \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> x \<le> ms - 1
 8. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; e \<le> ms - 1; s \<le> x; x \<le> e; ms \<le> x; x \<le> me\<rbrakk> \<Longrightarrow> False
 9. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; \<not> e \<le> ms - 1; s \<le> x; x \<le> ms - 1; ms \<le> x; x \<le> me\<rbrakk> \<Longrightarrow> False
 10. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; \<not> e \<le> ms - 1; s \<le> x; x \<le> e; \<not> ms \<le> x\<rbrakk> \<Longrightarrow> x \<le> ms - 1
A total of 22 subgoals...
[PROOF STEP]
apply(uint_arith)
[PROOF STATE]
proof (prove)
goal (21 subgoals):
 1. \<And>x. \<lbrakk>\<not> e < s; ms \<noteq> 0; ms \<le> s; me = - 1; \<not> e \<le> ms - 1; ms \<le> x; s \<le> x; x \<le> ms - 1\<rbrakk> \<Longrightarrow> False
 2. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0; ms \<le> s; me \<noteq> - 1; e \<le> ms - 1; s \<le> x; x \<le> e; ms \<le> x; x \<le> me\<rbrakk> \<Longrightarrow> False
 3. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0; ms \<le> s; me \<noteq> - 1; \<not> e \<le> ms - 1; s \<le> x; x \<le> ms - 1; ms \<le> x; x \<le> me\<rbrakk> \<Longrightarrow> False
 4. \<And>x. \<lbrakk>\<not> e < s; ms \<noteq> 0; \<not> ms \<le> s; me = - 1; e \<le> ms - 1; ms \<le> x; s \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> False
 5. \<And>x. \<lbrakk>\<not> e < s; ms \<noteq> 0; \<not> ms \<le> s; me = - 1; \<not> e \<le> ms - 1; ms \<le> x; s \<le> x; x \<le> ms - 1\<rbrakk> \<Longrightarrow> False
 6. \<And>x. \<lbrakk>\<not> e < s; ms \<noteq> 0; \<not> ms \<le> s; me = - 1; \<not> e \<le> ms - 1; \<not> ms \<le> x; s \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> x \<le> ms - 1
 7. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; e \<le> ms - 1; s \<le> x; x \<le> e; ms \<le> x; x \<le> me\<rbrakk> \<Longrightarrow> False
 8. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; \<not> e \<le> ms - 1; s \<le> x; x \<le> ms - 1; ms \<le> x; x \<le> me\<rbrakk> \<Longrightarrow> False
 9. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; \<not> e \<le> ms - 1; s \<le> x; x \<le> e; \<not> ms \<le> x\<rbrakk> \<Longrightarrow> x \<le> ms - 1
 10. \<And>x. \<lbrakk>\<not> e < s; \<not> e \<le> me; ms = 0; me \<noteq> - 1; s \<le> me + 1; x \<le> me; me + 1 \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> False
A total of 21 subgoals...
[PROOF STEP]
apply(uint_arith)
[PROOF STATE]
proof (prove)
goal (20 subgoals):
 1. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0; ms \<le> s; me \<noteq> - 1; e \<le> ms - 1; s \<le> x; x \<le> e; ms \<le> x; x \<le> me\<rbrakk> \<Longrightarrow> False
 2. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0; ms \<le> s; me \<noteq> - 1; \<not> e \<le> ms - 1; s \<le> x; x \<le> ms - 1; ms \<le> x; x \<le> me\<rbrakk> \<Longrightarrow> False
 3. \<And>x. \<lbrakk>\<not> e < s; ms \<noteq> 0; \<not> ms \<le> s; me = - 1; e \<le> ms - 1; ms \<le> x; s \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> False
 4. \<And>x. \<lbrakk>\<not> e < s; ms \<noteq> 0; \<not> ms \<le> s; me = - 1; \<not> e \<le> ms - 1; ms \<le> x; s \<le> x; x \<le> ms - 1\<rbrakk> \<Longrightarrow> False
 5. \<And>x. \<lbrakk>\<not> e < s; ms \<noteq> 0; \<not> ms \<le> s; me = - 1; \<not> e \<le> ms - 1; \<not> ms \<le> x; s \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> x \<le> ms - 1
 6. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; e \<le> ms - 1; s \<le> x; x \<le> e; ms \<le> x; x \<le> me\<rbrakk> \<Longrightarrow> False
 7. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; \<not> e \<le> ms - 1; s \<le> x; x \<le> ms - 1; ms \<le> x; x \<le> me\<rbrakk> \<Longrightarrow> False
 8. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; \<not> e \<le> ms - 1; s \<le> x; x \<le> e; \<not> ms \<le> x\<rbrakk> \<Longrightarrow> x \<le> ms - 1
 9. \<And>x. \<lbrakk>\<not> e < s; \<not> e \<le> me; ms = 0; me \<noteq> - 1; s \<le> me + 1; x \<le> me; me + 1 \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> False
 10. \<And>x. \<lbrakk>\<not> e < s; \<not> e \<le> me; ms = 0; me \<noteq> - 1; s \<le> me + 1; \<not> x \<le> me; s \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> me + 1 \<le> x
A total of 20 subgoals...
[PROOF STEP]
apply(uint_arith)
[PROOF STATE]
proof (prove)
goal (19 subgoals):
 1. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0; ms \<le> s; me \<noteq> - 1; \<not> e \<le> ms - 1; s \<le> x; x \<le> ms - 1; ms \<le> x; x \<le> me\<rbrakk> \<Longrightarrow> False
 2. \<And>x. \<lbrakk>\<not> e < s; ms \<noteq> 0; \<not> ms \<le> s; me = - 1; e \<le> ms - 1; ms \<le> x; s \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> False
 3. \<And>x. \<lbrakk>\<not> e < s; ms \<noteq> 0; \<not> ms \<le> s; me = - 1; \<not> e \<le> ms - 1; ms \<le> x; s \<le> x; x \<le> ms - 1\<rbrakk> \<Longrightarrow> False
 4. \<And>x. \<lbrakk>\<not> e < s; ms \<noteq> 0; \<not> ms \<le> s; me = - 1; \<not> e \<le> ms - 1; \<not> ms \<le> x; s \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> x \<le> ms - 1
 5. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; e \<le> ms - 1; s \<le> x; x \<le> e; ms \<le> x; x \<le> me\<rbrakk> \<Longrightarrow> False
 6. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; \<not> e \<le> ms - 1; s \<le> x; x \<le> ms - 1; ms \<le> x; x \<le> me\<rbrakk> \<Longrightarrow> False
 7. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; \<not> e \<le> ms - 1; s \<le> x; x \<le> e; \<not> ms \<le> x\<rbrakk> \<Longrightarrow> x \<le> ms - 1
 8. \<And>x. \<lbrakk>\<not> e < s; \<not> e \<le> me; ms = 0; me \<noteq> - 1; s \<le> me + 1; x \<le> me; me + 1 \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> False
 9. \<And>x. \<lbrakk>\<not> e < s; \<not> e \<le> me; ms = 0; me \<noteq> - 1; s \<le> me + 1; \<not> x \<le> me; s \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> me + 1 \<le> x
 10. \<And>x. \<lbrakk>\<not> e < s; \<not> e \<le> me; ms = 0; me \<noteq> - 1; \<not> s \<le> me + 1; x \<le> me; s \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> False
A total of 19 subgoals...
[PROOF STEP]
apply(uint_arith)
[PROOF STATE]
proof (prove)
goal (18 subgoals):
 1. \<And>x. \<lbrakk>\<not> e < s; ms \<noteq> 0; \<not> ms \<le> s; me = - 1; e \<le> ms - 1; ms \<le> x; s \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> False
 2. \<And>x. \<lbrakk>\<not> e < s; ms \<noteq> 0; \<not> ms \<le> s; me = - 1; \<not> e \<le> ms - 1; ms \<le> x; s \<le> x; x \<le> ms - 1\<rbrakk> \<Longrightarrow> False
 3. \<And>x. \<lbrakk>\<not> e < s; ms \<noteq> 0; \<not> ms \<le> s; me = - 1; \<not> e \<le> ms - 1; \<not> ms \<le> x; s \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> x \<le> ms - 1
 4. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; e \<le> ms - 1; s \<le> x; x \<le> e; ms \<le> x; x \<le> me\<rbrakk> \<Longrightarrow> False
 5. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; \<not> e \<le> ms - 1; s \<le> x; x \<le> ms - 1; ms \<le> x; x \<le> me\<rbrakk> \<Longrightarrow> False
 6. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; \<not> e \<le> ms - 1; s \<le> x; x \<le> e; \<not> ms \<le> x\<rbrakk> \<Longrightarrow> x \<le> ms - 1
 7. \<And>x. \<lbrakk>\<not> e < s; \<not> e \<le> me; ms = 0; me \<noteq> - 1; s \<le> me + 1; x \<le> me; me + 1 \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> False
 8. \<And>x. \<lbrakk>\<not> e < s; \<not> e \<le> me; ms = 0; me \<noteq> - 1; s \<le> me + 1; \<not> x \<le> me; s \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> me + 1 \<le> x
 9. \<And>x. \<lbrakk>\<not> e < s; \<not> e \<le> me; ms = 0; me \<noteq> - 1; \<not> s \<le> me + 1; x \<le> me; s \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> False
 10. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; ms \<le> s; me \<noteq> - 1; s \<le> me + 1; me + 1 \<le> x; x \<le> e; ms \<le> x; x \<le> me\<rbrakk> \<Longrightarrow> False
A total of 18 subgoals...
[PROOF STEP]
apply(uint_arith)
[PROOF STATE]
proof (prove)
goal (17 subgoals):
 1. \<And>x. \<lbrakk>\<not> e < s; ms \<noteq> 0; \<not> ms \<le> s; me = - 1; \<not> e \<le> ms - 1; ms \<le> x; s \<le> x; x \<le> ms - 1\<rbrakk> \<Longrightarrow> False
 2. \<And>x. \<lbrakk>\<not> e < s; ms \<noteq> 0; \<not> ms \<le> s; me = - 1; \<not> e \<le> ms - 1; \<not> ms \<le> x; s \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> x \<le> ms - 1
 3. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; e \<le> ms - 1; s \<le> x; x \<le> e; ms \<le> x; x \<le> me\<rbrakk> \<Longrightarrow> False
 4. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; \<not> e \<le> ms - 1; s \<le> x; x \<le> ms - 1; ms \<le> x; x \<le> me\<rbrakk> \<Longrightarrow> False
 5. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; \<not> e \<le> ms - 1; s \<le> x; x \<le> e; \<not> ms \<le> x\<rbrakk> \<Longrightarrow> x \<le> ms - 1
 6. \<And>x. \<lbrakk>\<not> e < s; \<not> e \<le> me; ms = 0; me \<noteq> - 1; s \<le> me + 1; x \<le> me; me + 1 \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> False
 7. \<And>x. \<lbrakk>\<not> e < s; \<not> e \<le> me; ms = 0; me \<noteq> - 1; s \<le> me + 1; \<not> x \<le> me; s \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> me + 1 \<le> x
 8. \<And>x. \<lbrakk>\<not> e < s; \<not> e \<le> me; ms = 0; me \<noteq> - 1; \<not> s \<le> me + 1; x \<le> me; s \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> False
 9. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; ms \<le> s; me \<noteq> - 1; s \<le> me + 1; me + 1 \<le> x; x \<le> e; ms \<le> x; x \<le> me\<rbrakk> \<Longrightarrow> False
 10. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; ms \<le> s; me \<noteq> - 1; s \<le> me + 1; s \<le> x; x \<le> e; \<not> x \<le> me\<rbrakk> \<Longrightarrow> me + 1 \<le> x
A total of 17 subgoals...
[PROOF STEP]
apply(uint_arith)
[PROOF STATE]
proof (prove)
goal (16 subgoals):
 1. \<And>x. \<lbrakk>\<not> e < s; ms \<noteq> 0; \<not> ms \<le> s; me = - 1; \<not> e \<le> ms - 1; \<not> ms \<le> x; s \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> x \<le> ms - 1
 2. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; e \<le> ms - 1; s \<le> x; x \<le> e; ms \<le> x; x \<le> me\<rbrakk> \<Longrightarrow> False
 3. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; \<not> e \<le> ms - 1; s \<le> x; x \<le> ms - 1; ms \<le> x; x \<le> me\<rbrakk> \<Longrightarrow> False
 4. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; \<not> e \<le> ms - 1; s \<le> x; x \<le> e; \<not> ms \<le> x\<rbrakk> \<Longrightarrow> x \<le> ms - 1
 5. \<And>x. \<lbrakk>\<not> e < s; \<not> e \<le> me; ms = 0; me \<noteq> - 1; s \<le> me + 1; x \<le> me; me + 1 \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> False
 6. \<And>x. \<lbrakk>\<not> e < s; \<not> e \<le> me; ms = 0; me \<noteq> - 1; s \<le> me + 1; \<not> x \<le> me; s \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> me + 1 \<le> x
 7. \<And>x. \<lbrakk>\<not> e < s; \<not> e \<le> me; ms = 0; me \<noteq> - 1; \<not> s \<le> me + 1; x \<le> me; s \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> False
 8. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; ms \<le> s; me \<noteq> - 1; s \<le> me + 1; me + 1 \<le> x; x \<le> e; ms \<le> x; x \<le> me\<rbrakk> \<Longrightarrow> False
 9. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; ms \<le> s; me \<noteq> - 1; s \<le> me + 1; s \<le> x; x \<le> e; \<not> x \<le> me\<rbrakk> \<Longrightarrow> me + 1 \<le> x
 10. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; ms \<le> s; me \<noteq> - 1; \<not> s \<le> me + 1; s \<le> x; x \<le> e; ms \<le> x; x \<le> me\<rbrakk> \<Longrightarrow> False
A total of 16 subgoals...
[PROOF STEP]
apply(uint_arith)
[PROOF STATE]
proof (prove)
goal (15 subgoals):
 1. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; e \<le> ms - 1; s \<le> x; x \<le> e; ms \<le> x; x \<le> me\<rbrakk> \<Longrightarrow> False
 2. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; \<not> e \<le> ms - 1; s \<le> x; x \<le> ms - 1; ms \<le> x; x \<le> me\<rbrakk> \<Longrightarrow> False
 3. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; \<not> e \<le> ms - 1; s \<le> x; x \<le> e; \<not> ms \<le> x\<rbrakk> \<Longrightarrow> x \<le> ms - 1
 4. \<And>x. \<lbrakk>\<not> e < s; \<not> e \<le> me; ms = 0; me \<noteq> - 1; s \<le> me + 1; x \<le> me; me + 1 \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> False
 5. \<And>x. \<lbrakk>\<not> e < s; \<not> e \<le> me; ms = 0; me \<noteq> - 1; s \<le> me + 1; \<not> x \<le> me; s \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> me + 1 \<le> x
 6. \<And>x. \<lbrakk>\<not> e < s; \<not> e \<le> me; ms = 0; me \<noteq> - 1; \<not> s \<le> me + 1; x \<le> me; s \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> False
 7. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; ms \<le> s; me \<noteq> - 1; s \<le> me + 1; me + 1 \<le> x; x \<le> e; ms \<le> x; x \<le> me\<rbrakk> \<Longrightarrow> False
 8. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; ms \<le> s; me \<noteq> - 1; s \<le> me + 1; s \<le> x; x \<le> e; \<not> x \<le> me\<rbrakk> \<Longrightarrow> me + 1 \<le> x
 9. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; ms \<le> s; me \<noteq> - 1; \<not> s \<le> me + 1; s \<le> x; x \<le> e; ms \<le> x; x \<le> me\<rbrakk> \<Longrightarrow> False
 10. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; s \<le> x; x \<le> ms - 1\<rbrakk> \<Longrightarrow> x \<le> e
A total of 15 subgoals...
[PROOF STEP]
apply(uint_arith)
[PROOF STATE]
proof (prove)
goal (14 subgoals):
 1. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; \<not> e \<le> ms - 1; s \<le> x; x \<le> ms - 1; ms \<le> x; x \<le> me\<rbrakk> \<Longrightarrow> False
 2. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; \<not> e \<le> ms - 1; s \<le> x; x \<le> e; \<not> ms \<le> x\<rbrakk> \<Longrightarrow> x \<le> ms - 1
 3. \<And>x. \<lbrakk>\<not> e < s; \<not> e \<le> me; ms = 0; me \<noteq> - 1; s \<le> me + 1; x \<le> me; me + 1 \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> False
 4. \<And>x. \<lbrakk>\<not> e < s; \<not> e \<le> me; ms = 0; me \<noteq> - 1; s \<le> me + 1; \<not> x \<le> me; s \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> me + 1 \<le> x
 5. \<And>x. \<lbrakk>\<not> e < s; \<not> e \<le> me; ms = 0; me \<noteq> - 1; \<not> s \<le> me + 1; x \<le> me; s \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> False
 6. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; ms \<le> s; me \<noteq> - 1; s \<le> me + 1; me + 1 \<le> x; x \<le> e; ms \<le> x; x \<le> me\<rbrakk> \<Longrightarrow> False
 7. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; ms \<le> s; me \<noteq> - 1; s \<le> me + 1; s \<le> x; x \<le> e; \<not> x \<le> me\<rbrakk> \<Longrightarrow> me + 1 \<le> x
 8. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; ms \<le> s; me \<noteq> - 1; \<not> s \<le> me + 1; s \<le> x; x \<le> e; ms \<le> x; x \<le> me\<rbrakk> \<Longrightarrow> False
 9. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; s \<le> x; x \<le> ms - 1\<rbrakk> \<Longrightarrow> x \<le> e
 10. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; me + 1 \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> s \<le> x
A total of 14 subgoals...
[PROOF STEP]
apply(uint_arith)
[PROOF STATE]
proof (prove)
goal (13 subgoals):
 1. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; \<not> e \<le> ms - 1; s \<le> x; x \<le> e; \<not> ms \<le> x\<rbrakk> \<Longrightarrow> x \<le> ms - 1
 2. \<And>x. \<lbrakk>\<not> e < s; \<not> e \<le> me; ms = 0; me \<noteq> - 1; s \<le> me + 1; x \<le> me; me + 1 \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> False
 3. \<And>x. \<lbrakk>\<not> e < s; \<not> e \<le> me; ms = 0; me \<noteq> - 1; s \<le> me + 1; \<not> x \<le> me; s \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> me + 1 \<le> x
 4. \<And>x. \<lbrakk>\<not> e < s; \<not> e \<le> me; ms = 0; me \<noteq> - 1; \<not> s \<le> me + 1; x \<le> me; s \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> False
 5. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; ms \<le> s; me \<noteq> - 1; s \<le> me + 1; me + 1 \<le> x; x \<le> e; ms \<le> x; x \<le> me\<rbrakk> \<Longrightarrow> False
 6. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; ms \<le> s; me \<noteq> - 1; s \<le> me + 1; s \<le> x; x \<le> e; \<not> x \<le> me\<rbrakk> \<Longrightarrow> me + 1 \<le> x
 7. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; ms \<le> s; me \<noteq> - 1; \<not> s \<le> me + 1; s \<le> x; x \<le> e; ms \<le> x; x \<le> me\<rbrakk> \<Longrightarrow> False
 8. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; s \<le> x; x \<le> ms - 1\<rbrakk> \<Longrightarrow> x \<le> e
 9. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; me + 1 \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> s \<le> x
 10. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; ms \<le> x; x \<le> me; s \<le> x; x \<le> ms - 1\<rbrakk> \<Longrightarrow> False
A total of 13 subgoals...
[PROOF STEP]
apply(uint_arith)
[PROOF STATE]
proof (prove)
goal (12 subgoals):
 1. \<And>x. \<lbrakk>\<not> e < s; \<not> e \<le> me; ms = 0; me \<noteq> - 1; s \<le> me + 1; x \<le> me; me + 1 \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> False
 2. \<And>x. \<lbrakk>\<not> e < s; \<not> e \<le> me; ms = 0; me \<noteq> - 1; s \<le> me + 1; \<not> x \<le> me; s \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> me + 1 \<le> x
 3. \<And>x. \<lbrakk>\<not> e < s; \<not> e \<le> me; ms = 0; me \<noteq> - 1; \<not> s \<le> me + 1; x \<le> me; s \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> False
 4. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; ms \<le> s; me \<noteq> - 1; s \<le> me + 1; me + 1 \<le> x; x \<le> e; ms \<le> x; x \<le> me\<rbrakk> \<Longrightarrow> False
 5. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; ms \<le> s; me \<noteq> - 1; s \<le> me + 1; s \<le> x; x \<le> e; \<not> x \<le> me\<rbrakk> \<Longrightarrow> me + 1 \<le> x
 6. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; ms \<le> s; me \<noteq> - 1; \<not> s \<le> me + 1; s \<le> x; x \<le> e; ms \<le> x; x \<le> me\<rbrakk> \<Longrightarrow> False
 7. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; s \<le> x; x \<le> ms - 1\<rbrakk> \<Longrightarrow> x \<le> e
 8. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; me + 1 \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> s \<le> x
 9. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; ms \<le> x; x \<le> me; s \<le> x; x \<le> ms - 1\<rbrakk> \<Longrightarrow> False
 10. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; ms \<le> x; x \<le> me; me + 1 \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> False
A total of 12 subgoals...
[PROOF STEP]
apply(uint_arith)
[PROOF STATE]
proof (prove)
goal (11 subgoals):
 1. \<And>x. \<lbrakk>\<not> e < s; \<not> e \<le> me; ms = 0; me \<noteq> - 1; s \<le> me + 1; \<not> x \<le> me; s \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> me + 1 \<le> x
 2. \<And>x. \<lbrakk>\<not> e < s; \<not> e \<le> me; ms = 0; me \<noteq> - 1; \<not> s \<le> me + 1; x \<le> me; s \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> False
 3. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; ms \<le> s; me \<noteq> - 1; s \<le> me + 1; me + 1 \<le> x; x \<le> e; ms \<le> x; x \<le> me\<rbrakk> \<Longrightarrow> False
 4. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; ms \<le> s; me \<noteq> - 1; s \<le> me + 1; s \<le> x; x \<le> e; \<not> x \<le> me\<rbrakk> \<Longrightarrow> me + 1 \<le> x
 5. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; ms \<le> s; me \<noteq> - 1; \<not> s \<le> me + 1; s \<le> x; x \<le> e; ms \<le> x; x \<le> me\<rbrakk> \<Longrightarrow> False
 6. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; s \<le> x; x \<le> ms - 1\<rbrakk> \<Longrightarrow> x \<le> e
 7. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; me + 1 \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> s \<le> x
 8. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; ms \<le> x; x \<le> me; s \<le> x; x \<le> ms - 1\<rbrakk> \<Longrightarrow> False
 9. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; ms \<le> x; x \<le> me; me + 1 \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> False
 10. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; \<not> me + 1 \<le> x; s \<le> x; x \<le> e; \<not> ms \<le> x\<rbrakk> \<Longrightarrow> x \<le> ms - 1
A total of 11 subgoals...
[PROOF STEP]
apply(uint_arith)
[PROOF STATE]
proof (prove)
goal (10 subgoals):
 1. \<And>x. \<lbrakk>\<not> e < s; \<not> e \<le> me; ms = 0; me \<noteq> - 1; \<not> s \<le> me + 1; x \<le> me; s \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> False
 2. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; ms \<le> s; me \<noteq> - 1; s \<le> me + 1; me + 1 \<le> x; x \<le> e; ms \<le> x; x \<le> me\<rbrakk> \<Longrightarrow> False
 3. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; ms \<le> s; me \<noteq> - 1; s \<le> me + 1; s \<le> x; x \<le> e; \<not> x \<le> me\<rbrakk> \<Longrightarrow> me + 1 \<le> x
 4. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; ms \<le> s; me \<noteq> - 1; \<not> s \<le> me + 1; s \<le> x; x \<le> e; ms \<le> x; x \<le> me\<rbrakk> \<Longrightarrow> False
 5. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; s \<le> x; x \<le> ms - 1\<rbrakk> \<Longrightarrow> x \<le> e
 6. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; me + 1 \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> s \<le> x
 7. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; ms \<le> x; x \<le> me; s \<le> x; x \<le> ms - 1\<rbrakk> \<Longrightarrow> False
 8. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; ms \<le> x; x \<le> me; me + 1 \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> False
 9. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; \<not> me + 1 \<le> x; s \<le> x; x \<le> e; \<not> ms \<le> x\<rbrakk> \<Longrightarrow> x \<le> ms - 1
 10. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; \<not> me + 1 \<le> x; s \<le> x; x \<le> e; \<not> x \<le> me\<rbrakk> \<Longrightarrow> x \<le> ms - 1
[PROOF STEP]
apply(uint_arith)
[PROOF STATE]
proof (prove)
goal (9 subgoals):
 1. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; ms \<le> s; me \<noteq> - 1; s \<le> me + 1; me + 1 \<le> x; x \<le> e; ms \<le> x; x \<le> me\<rbrakk> \<Longrightarrow> False
 2. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; ms \<le> s; me \<noteq> - 1; s \<le> me + 1; s \<le> x; x \<le> e; \<not> x \<le> me\<rbrakk> \<Longrightarrow> me + 1 \<le> x
 3. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; ms \<le> s; me \<noteq> - 1; \<not> s \<le> me + 1; s \<le> x; x \<le> e; ms \<le> x; x \<le> me\<rbrakk> \<Longrightarrow> False
 4. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; s \<le> x; x \<le> ms - 1\<rbrakk> \<Longrightarrow> x \<le> e
 5. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; me + 1 \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> s \<le> x
 6. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; ms \<le> x; x \<le> me; s \<le> x; x \<le> ms - 1\<rbrakk> \<Longrightarrow> False
 7. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; ms \<le> x; x \<le> me; me + 1 \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> False
 8. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; \<not> me + 1 \<le> x; s \<le> x; x \<le> e; \<not> ms \<le> x\<rbrakk> \<Longrightarrow> x \<le> ms - 1
 9. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; \<not> me + 1 \<le> x; s \<le> x; x \<le> e; \<not> x \<le> me\<rbrakk> \<Longrightarrow> x \<le> ms - 1
[PROOF STEP]
apply(uint_arith)
[PROOF STATE]
proof (prove)
goal (8 subgoals):
 1. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; ms \<le> s; me \<noteq> - 1; s \<le> me + 1; s \<le> x; x \<le> e; \<not> x \<le> me\<rbrakk> \<Longrightarrow> me + 1 \<le> x
 2. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; ms \<le> s; me \<noteq> - 1; \<not> s \<le> me + 1; s \<le> x; x \<le> e; ms \<le> x; x \<le> me\<rbrakk> \<Longrightarrow> False
 3. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; s \<le> x; x \<le> ms - 1\<rbrakk> \<Longrightarrow> x \<le> e
 4. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; me + 1 \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> s \<le> x
 5. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; ms \<le> x; x \<le> me; s \<le> x; x \<le> ms - 1\<rbrakk> \<Longrightarrow> False
 6. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; ms \<le> x; x \<le> me; me + 1 \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> False
 7. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; \<not> me + 1 \<le> x; s \<le> x; x \<le> e; \<not> ms \<le> x\<rbrakk> \<Longrightarrow> x \<le> ms - 1
 8. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; \<not> me + 1 \<le> x; s \<le> x; x \<le> e; \<not> x \<le> me\<rbrakk> \<Longrightarrow> x \<le> ms - 1
[PROOF STEP]
apply(uint_arith)
[PROOF STATE]
proof (prove)
goal (7 subgoals):
 1. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; ms \<le> s; me \<noteq> - 1; \<not> s \<le> me + 1; s \<le> x; x \<le> e; ms \<le> x; x \<le> me\<rbrakk> \<Longrightarrow> False
 2. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; s \<le> x; x \<le> ms - 1\<rbrakk> \<Longrightarrow> x \<le> e
 3. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; me + 1 \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> s \<le> x
 4. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; ms \<le> x; x \<le> me; s \<le> x; x \<le> ms - 1\<rbrakk> \<Longrightarrow> False
 5. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; ms \<le> x; x \<le> me; me + 1 \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> False
 6. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; \<not> me + 1 \<le> x; s \<le> x; x \<le> e; \<not> ms \<le> x\<rbrakk> \<Longrightarrow> x \<le> ms - 1
 7. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; \<not> me + 1 \<le> x; s \<le> x; x \<le> e; \<not> x \<le> me\<rbrakk> \<Longrightarrow> x \<le> ms - 1
[PROOF STEP]
apply(uint_arith)
[PROOF STATE]
proof (prove)
goal (6 subgoals):
 1. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; s \<le> x; x \<le> ms - 1\<rbrakk> \<Longrightarrow> x \<le> e
 2. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; me + 1 \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> s \<le> x
 3. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; ms \<le> x; x \<le> me; s \<le> x; x \<le> ms - 1\<rbrakk> \<Longrightarrow> False
 4. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; ms \<le> x; x \<le> me; me + 1 \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> False
 5. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; \<not> me + 1 \<le> x; s \<le> x; x \<le> e; \<not> ms \<le> x\<rbrakk> \<Longrightarrow> x \<le> ms - 1
 6. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; \<not> me + 1 \<le> x; s \<le> x; x \<le> e; \<not> x \<le> me\<rbrakk> \<Longrightarrow> x \<le> ms - 1
[PROOF STEP]
apply(uint_arith)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; me + 1 \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> s \<le> x
 2. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; ms \<le> x; x \<le> me; s \<le> x; x \<le> ms - 1\<rbrakk> \<Longrightarrow> False
 3. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; ms \<le> x; x \<le> me; me + 1 \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> False
 4. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; \<not> me + 1 \<le> x; s \<le> x; x \<le> e; \<not> ms \<le> x\<rbrakk> \<Longrightarrow> x \<le> ms - 1
 5. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; \<not> me + 1 \<le> x; s \<le> x; x \<le> e; \<not> x \<le> me\<rbrakk> \<Longrightarrow> x \<le> ms - 1
[PROOF STEP]
apply(uint_arith)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; ms \<le> x; x \<le> me; s \<le> x; x \<le> ms - 1\<rbrakk> \<Longrightarrow> False
 2. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; ms \<le> x; x \<le> me; me + 1 \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> False
 3. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; \<not> me + 1 \<le> x; s \<le> x; x \<le> e; \<not> ms \<le> x\<rbrakk> \<Longrightarrow> x \<le> ms - 1
 4. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; \<not> me + 1 \<le> x; s \<le> x; x \<le> e; \<not> x \<le> me\<rbrakk> \<Longrightarrow> x \<le> ms - 1
[PROOF STEP]
apply(uint_arith)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; ms \<le> x; x \<le> me; me + 1 \<le> x; x \<le> e\<rbrakk> \<Longrightarrow> False
 2. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; \<not> me + 1 \<le> x; s \<le> x; x \<le> e; \<not> ms \<le> x\<rbrakk> \<Longrightarrow> x \<le> ms - 1
 3. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; \<not> me + 1 \<le> x; s \<le> x; x \<le> e; \<not> x \<le> me\<rbrakk> \<Longrightarrow> x \<le> ms - 1
[PROOF STEP]
apply(uint_arith)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; \<not> me + 1 \<le> x; s \<le> x; x \<le> e; \<not> ms \<le> x\<rbrakk> \<Longrightarrow> x \<le> ms - 1
 2. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; \<not> me + 1 \<le> x; s \<le> x; x \<le> e; \<not> x \<le> me\<rbrakk> \<Longrightarrow> x \<le> ms - 1
[PROOF STEP]
apply(uint_arith)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms \<noteq> 0; \<not> ms \<le> s; me \<noteq> - 1; \<not> me + 1 \<le> x; s \<le> x; x \<le> e; \<not> x \<le> me\<rbrakk> \<Longrightarrow> x \<le> ms - 1
[PROOF STEP]
apply(uint_arith)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma reflexive_linorder_matrix:
  fixes f :: "('a::finite,'b::linorder_stone_relation_algebra_expansion) square"
  shows "matrix_idempotent_semiring.reflexive f \<longleftrightarrow> (\<forall>i . f (i,i) = top)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. matrix_idempotent_semiring.reflexive f = (\<forall>i. f (i, i) = top)
[PROOF STEP]
using reflexive_linorder_matrix_1 reflexive_linorder_matrix_2
[PROOF STATE]
proof (prove)
using this:
matrix_idempotent_semiring.reflexive ?f \<Longrightarrow> ?f (?i, ?i) = top
\<forall>i. ?f (i, i) = top \<Longrightarrow> matrix_idempotent_semiring.reflexive ?f

goal (1 subgoal):
 1. matrix_idempotent_semiring.reflexive f = (\<forall>i. f (i, i) = top)
[PROOF STEP]
by auto


[STATEMENT]
lemma NSCauchy_NSconvergent_iff: "NSCauchy X = NSconvergent X"
  for X :: "nat \<Rightarrow> 'a::banach"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. NSCauchy X = NSconvergent X
[PROOF STEP]
by (fast intro: NSCauchy_NSconvergent NSconvergent_NSCauchy)


[STATEMENT]
lemma (in field) isin_correct:
  assumes "in_carrier xs"
    and "isin e n e' m = Some (p, e'')"
  shows "peval xs (PExpr2 (PPow e' m)) = peval xs (PExpr2 (PMul (PExpr2 (PPow e (n - p))) e''))"
    and "p \<le> n"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. peval xs (PExpr2 (PPow e' m)) = peval xs (PExpr2 (PMul (PExpr2 (PPow e (n - p))) e'')) &&& p \<le> n
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
in_carrier xs
isin e n e' m = Some (p, e'')

goal (1 subgoal):
 1. peval xs (PExpr2 (PPow e' m)) = peval xs (PExpr2 (PMul (PExpr2 (PPow e (n - p))) e'')) &&& p \<le> n
[PROOF STEP]
by (induct e n e' m arbitrary: p e'' rule: isin.induct)
    (force
       simp add:
         nat_pow_distrib nat_pow_pow nat_pow_mult m_ac
         npemul_correct npepow_correct
       split: option.split_asm prod.split_asm if_split_asm)+


[STATEMENT]
lemma [code_post]:
 "(of_rat (- (1 / numeral k)) :: real) = - 1 / numeral k"
 "(of_rat (- (numeral k / numeral l)) :: real) = - numeral k / numeral l"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. real_of_rat (- (1 / numeral k)) = - 1 / numeral k &&& real_of_rat (- (numeral k / numeral l)) = - numeral k / numeral l
[PROOF STEP]
by (simp_all add: of_rat_divide of_rat_minus)


[STATEMENT]
lemma [simp]: "\<lfloor>A\<rfloor> \<squnion> \<lfloor>B\<rfloor> = \<lfloor>A \<union> B\<rfloor> \<and> \<lfloor>A\<rfloor> \<ominus> a = \<lfloor>A - {a}\<rfloor>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lfloor>A\<rfloor> \<squnion> \<lfloor>B\<rfloor> = \<lfloor>A \<union> B\<rfloor> \<and> \<lfloor>A\<rfloor> \<ominus> a = \<lfloor>A - {a}\<rfloor>
[PROOF STEP]
(*<*)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lfloor>A\<rfloor> \<squnion> \<lfloor>B\<rfloor> = \<lfloor>A \<union> B\<rfloor> \<and> \<lfloor>A\<rfloor> \<ominus> a = \<lfloor>A - {a}\<rfloor>
[PROOF STEP]
by(simp add:hyperset_defs)


[STATEMENT]
lemma bs_complement_correct: "bs_\<alpha> (bs_complement s) = - bs_\<alpha> s"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. bs_\<alpha> (bs_complement s) = - bs_\<alpha> s
[PROOF STEP]
unfolding bs_\<alpha>_def bs_complement_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {n. bit (NOT s) n} = - {n. bit s n}
[PROOF STEP]
by transfer (simp add: bit_eq_iff, auto simp add: bit_simps)


[STATEMENT]
lemma restrict_to_indices_count[simp]:
"count (restrict_to_indices m S) i = (if (i \<in> S) then (count m i) else 0)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. count (restrict_to_indices m S) i = (if i \<in> S then count m i else 0)
[PROOF STEP]
unfolding restrict_to_indices_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. count {#i \<in># m. i \<in> S#} i = (if i \<in> S then count m i else 0)
[PROOF STEP]
by (metis count_filter_mset)


[STATEMENT]
lemma differentiable_in_compose:
  "f differentiable (at (g x) within (g`s)) \<Longrightarrow> g differentiable (at x within s) \<Longrightarrow>
    (\<lambda>x. f (g x)) differentiable (at x within s)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>f differentiable at (g x) within g ` s; g differentiable at x within s\<rbrakk> \<Longrightarrow> (\<lambda>x. f (g x)) differentiable at x within s
[PROOF STEP]
unfolding differentiable_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<exists>D. (f has_derivative D) (at (g x) within g ` s); \<exists>D. (g has_derivative D) (at x within s)\<rbrakk> \<Longrightarrow> \<exists>D. ((\<lambda>x. f (g x)) has_derivative D) (at x within s)
[PROOF STEP]
by (blast intro: has_derivative_in_compose)


[STATEMENT]
lemma field_vector_diff_chain_within:
 assumes Df: "(f has_vector_derivative f') (at x within S)"
     and Dg: "(g has_field_derivative g') (at (f x) within f ` S)"
 shows "((g \<circ> f) has_vector_derivative (f' * g')) (at x within S)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (g \<circ> f has_vector_derivative f' * g') (at x within S)
[PROOF STEP]
using diff_chain_within[OF Df[unfolded has_vector_derivative_def]
                       Dg [unfolded has_field_derivative_def]]
[PROOF STATE]
proof (prove)
using this:
(g \<circ> f has_derivative (*) g' \<circ> (\<lambda>x. x *\<^sub>R f')) (at x within S)

goal (1 subgoal):
 1. (g \<circ> f has_vector_derivative f' * g') (at x within S)
[PROOF STEP]
by (auto simp: o_def mult.commute has_vector_derivative_def)


[STATEMENT]
lemma graph_homomorphism_def2: (* Shows a graph homomorphism is an embedding as in the paper *)
  shows "graph_homomorphism G\<^sub>1 G\<^sub>2 f =
   (vertices G\<^sub>1 = Domain f \<and> univalent f \<and> G\<^sub>1 = restrict G\<^sub>1 \<and> G\<^sub>2 = restrict G\<^sub>2 \<and> graph_union (map_graph f G\<^sub>1) G\<^sub>2 = G\<^sub>2)"
   (is "?lhs = ?rhs")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. graph_homomorphism G\<^sub>1 G\<^sub>2 f = (vertices G\<^sub>1 = Domain f \<and> univalent f \<and> graph G\<^sub>1 \<and> graph G\<^sub>2 \<and> graph_union (map_graph f G\<^sub>1) G\<^sub>2 = G\<^sub>2)
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. graph_homomorphism G\<^sub>1 G\<^sub>2 f \<Longrightarrow> vertices G\<^sub>1 = Domain f \<and> univalent f \<and> graph G\<^sub>1 \<and> graph G\<^sub>2 \<and> graph_union (map_graph f G\<^sub>1) G\<^sub>2 = G\<^sub>2
 2. vertices G\<^sub>1 = Domain f \<and> univalent f \<and> graph G\<^sub>1 \<and> graph G\<^sub>2 \<and> graph_union (map_graph f G\<^sub>1) G\<^sub>2 = G\<^sub>2 \<Longrightarrow> graph_homomorphism G\<^sub>1 G\<^sub>2 f
[PROOF STEP]
let ?m = "map_graph f G\<^sub>1"
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. graph_homomorphism G\<^sub>1 G\<^sub>2 f \<Longrightarrow> vertices G\<^sub>1 = Domain f \<and> univalent f \<and> graph G\<^sub>1 \<and> graph G\<^sub>2 \<and> graph_union (map_graph f G\<^sub>1) G\<^sub>2 = G\<^sub>2
 2. vertices G\<^sub>1 = Domain f \<and> univalent f \<and> graph G\<^sub>1 \<and> graph G\<^sub>2 \<and> graph_union (map_graph f G\<^sub>1) G\<^sub>2 = G\<^sub>2 \<Longrightarrow> graph_homomorphism G\<^sub>1 G\<^sub>2 f
[PROOF STEP]
assume ?rhs
[PROOF STATE]
proof (state)
this:
vertices G\<^sub>1 = Domain f \<and> univalent f \<and> graph G\<^sub>1 \<and> graph G\<^sub>2 \<and> graph_union (map_graph f G\<^sub>1) G\<^sub>2 = G\<^sub>2

goal (2 subgoals):
 1. graph_homomorphism G\<^sub>1 G\<^sub>2 f \<Longrightarrow> vertices G\<^sub>1 = Domain f \<and> univalent f \<and> graph G\<^sub>1 \<and> graph G\<^sub>2 \<and> graph_union (map_graph f G\<^sub>1) G\<^sub>2 = G\<^sub>2
 2. vertices G\<^sub>1 = Domain f \<and> univalent f \<and> graph G\<^sub>1 \<and> graph G\<^sub>2 \<and> graph_union (map_graph f G\<^sub>1) G\<^sub>2 = G\<^sub>2 \<Longrightarrow> graph_homomorphism G\<^sub>1 G\<^sub>2 f
[PROOF STEP]
hence assms : "vertices G\<^sub>1 = Domain f" "univalent f" "G\<^sub>1 = restrict G\<^sub>1"
    and sg: "subgraph ?m G\<^sub>2"
    and f_id:"f O Id_on (f `` vertices G\<^sub>1) = f"
[PROOF STATE]
proof (prove)
using this:
vertices G\<^sub>1 = Domain f \<and> univalent f \<and> graph G\<^sub>1 \<and> graph G\<^sub>2 \<and> graph_union (map_graph f G\<^sub>1) G\<^sub>2 = G\<^sub>2

goal (1 subgoal):
 1. (vertices G\<^sub>1 = Domain f &&& univalent f &&& graph G\<^sub>1) &&& subgraph (map_graph f G\<^sub>1) G\<^sub>2 &&& f O Id_on (f `` vertices G\<^sub>1) = f
[PROOF STEP]
unfolding subgraph_def
[PROOF STATE]
proof (prove)
using this:
vertices G\<^sub>1 = Domain f \<and> univalent f \<and> graph G\<^sub>1 \<and> graph G\<^sub>2 \<and> graph_union (map_graph f G\<^sub>1) G\<^sub>2 = G\<^sub>2

goal (1 subgoal):
 1. (vertices G\<^sub>1 = Domain f &&& univalent f &&& graph G\<^sub>1) &&& graph (map_graph f G\<^sub>1) \<and> graph G\<^sub>2 \<and> graph_union (map_graph f G\<^sub>1) G\<^sub>2 = G\<^sub>2 &&& f O Id_on (f `` vertices G\<^sub>1) = f
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
vertices G\<^sub>1 = Domain f
univalent f
graph G\<^sub>1
subgraph (map_graph f G\<^sub>1) G\<^sub>2
f O Id_on (f `` vertices G\<^sub>1) = f

goal (2 subgoals):
 1. graph_homomorphism G\<^sub>1 G\<^sub>2 f \<Longrightarrow> vertices G\<^sub>1 = Domain f \<and> univalent f \<and> graph G\<^sub>1 \<and> graph G\<^sub>2 \<and> graph_union (map_graph f G\<^sub>1) G\<^sub>2 = G\<^sub>2
 2. vertices G\<^sub>1 = Domain f \<and> univalent f \<and> graph G\<^sub>1 \<and> graph G\<^sub>2 \<and> graph_union (map_graph f G\<^sub>1) G\<^sub>2 = G\<^sub>2 \<Longrightarrow> graph_homomorphism G\<^sub>1 G\<^sub>2 f
[PROOF STEP]
hence "edge_preserving (Id_on (vertices ?m)) (edges ?m) (edges G\<^sub>2)"
[PROOF STATE]
proof (prove)
using this:
vertices G\<^sub>1 = Domain f
univalent f
graph G\<^sub>1
subgraph (map_graph f G\<^sub>1) G\<^sub>2
f O Id_on (f `` vertices G\<^sub>1) = f

goal (1 subgoal):
 1. edge_preserving (Id_on (vertices (map_graph f G\<^sub>1))) (edges (map_graph f G\<^sub>1)) (edges G\<^sub>2)
[PROOF STEP]
unfolding graph_homomorphism_def
[PROOF STATE]
proof (prove)
using this:
vertices G\<^sub>1 = Domain f
univalent f
graph G\<^sub>1
vertices (map_graph f G\<^sub>1) = Domain (Id_on (vertices (map_graph f G\<^sub>1))) \<and> graph (map_graph f G\<^sub>1) \<and> graph G\<^sub>2 \<and> Id_on (vertices (map_graph f G\<^sub>1)) `` vertices (map_graph f G\<^sub>1) \<subseteq> vertices G\<^sub>2 \<and> univalent (Id_on (vertices (map_graph f G\<^sub>1))) \<and> edge_preserving (Id_on (vertices (map_graph f G\<^sub>1))) (edges (map_graph f G\<^sub>1)) (edges G\<^sub>2)
f O Id_on (f `` vertices G\<^sub>1) = f

goal (1 subgoal):
 1. edge_preserving (Id_on (vertices (map_graph f G\<^sub>1))) (edges (map_graph f G\<^sub>1)) (edges G\<^sub>2)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
edge_preserving (Id_on (vertices (map_graph f G\<^sub>1))) (edges (map_graph f G\<^sub>1)) (edges G\<^sub>2)

goal (2 subgoals):
 1. graph_homomorphism G\<^sub>1 G\<^sub>2 f \<Longrightarrow> vertices G\<^sub>1 = Domain f \<and> univalent f \<and> graph G\<^sub>1 \<and> graph G\<^sub>2 \<and> graph_union (map_graph f G\<^sub>1) G\<^sub>2 = G\<^sub>2
 2. vertices G\<^sub>1 = Domain f \<and> univalent f \<and> graph G\<^sub>1 \<and> graph G\<^sub>2 \<and> graph_union (map_graph f G\<^sub>1) G\<^sub>2 = G\<^sub>2 \<Longrightarrow> graph_homomorphism G\<^sub>1 G\<^sub>2 f
[PROOF STEP]
hence "on_triple (f O Id_on (f `` vertices G\<^sub>1)) `` edges G\<^sub>1 \<subseteq> edges G\<^sub>2"
[PROOF STATE]
proof (prove)
using this:
edge_preserving (Id_on (vertices (map_graph f G\<^sub>1))) (edges (map_graph f G\<^sub>1)) (edges G\<^sub>2)

goal (1 subgoal):
 1. on_triple (f O Id_on (f `` vertices G\<^sub>1)) `` edges G\<^sub>1 \<subseteq> edges G\<^sub>2
[PROOF STEP]
(* rewriting peak *)
[PROOF STATE]
proof (prove)
using this:
edge_preserving (Id_on (vertices (map_graph f G\<^sub>1))) (edges (map_graph f G\<^sub>1)) (edges G\<^sub>2)

goal (1 subgoal):
 1. on_triple (f O Id_on (f `` vertices G\<^sub>1)) `` edges G\<^sub>1 \<subseteq> edges G\<^sub>2
[PROOF STEP]
unfolding relcomp_Image edge_preserving map_graph_selectors relcomp_on_triple
[PROOF STATE]
proof (prove)
using this:
on_triple (Id_on (f `` vertices G\<^sub>1)) `` on_triple f `` edges G\<^sub>1 \<subseteq> edges G\<^sub>2

goal (1 subgoal):
 1. on_triple (Id_on (f `` vertices G\<^sub>1)) `` on_triple f `` edges G\<^sub>1 \<subseteq> edges G\<^sub>2
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
on_triple (f O Id_on (f `` vertices G\<^sub>1)) `` edges G\<^sub>1 \<subseteq> edges G\<^sub>2

goal (2 subgoals):
 1. graph_homomorphism G\<^sub>1 G\<^sub>2 f \<Longrightarrow> vertices G\<^sub>1 = Domain f \<and> univalent f \<and> graph G\<^sub>1 \<and> graph G\<^sub>2 \<and> graph_union (map_graph f G\<^sub>1) G\<^sub>2 = G\<^sub>2
 2. vertices G\<^sub>1 = Domain f \<and> univalent f \<and> graph G\<^sub>1 \<and> graph G\<^sub>2 \<and> graph_union (map_graph f G\<^sub>1) G\<^sub>2 = G\<^sub>2 \<Longrightarrow> graph_homomorphism G\<^sub>1 G\<^sub>2 f
[PROOF STEP]
hence "edge_preserving f (edges G\<^sub>1) (edges G\<^sub>2)"
[PROOF STATE]
proof (prove)
using this:
on_triple (f O Id_on (f `` vertices G\<^sub>1)) `` edges G\<^sub>1 \<subseteq> edges G\<^sub>2

goal (1 subgoal):
 1. edge_preserving f (edges G\<^sub>1) (edges G\<^sub>2)
[PROOF STEP]
unfolding edge_preserving f_id
[PROOF STATE]
proof (prove)
using this:
on_triple f `` edges G\<^sub>1 \<subseteq> edges G\<^sub>2

goal (1 subgoal):
 1. on_triple f `` edges G\<^sub>1 \<subseteq> edges G\<^sub>2
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
edge_preserving f (edges G\<^sub>1) (edges G\<^sub>2)

goal (2 subgoals):
 1. graph_homomorphism G\<^sub>1 G\<^sub>2 f \<Longrightarrow> vertices G\<^sub>1 = Domain f \<and> univalent f \<and> graph G\<^sub>1 \<and> graph G\<^sub>2 \<and> graph_union (map_graph f G\<^sub>1) G\<^sub>2 = G\<^sub>2
 2. vertices G\<^sub>1 = Domain f \<and> univalent f \<and> graph G\<^sub>1 \<and> graph G\<^sub>2 \<and> graph_union (map_graph f G\<^sub>1) G\<^sub>2 = G\<^sub>2 \<Longrightarrow> graph_homomorphism G\<^sub>1 G\<^sub>2 f
[PROOF STEP]
thus ?lhs
[PROOF STATE]
proof (prove)
using this:
edge_preserving f (edges G\<^sub>1) (edges G\<^sub>2)

goal (1 subgoal):
 1. graph_homomorphism G\<^sub>1 G\<^sub>2 f
[PROOF STEP]
using sg assms
[PROOF STATE]
proof (prove)
using this:
edge_preserving f (edges G\<^sub>1) (edges G\<^sub>2)
subgraph (map_graph f G\<^sub>1) G\<^sub>2
vertices G\<^sub>1 = Domain f
univalent f
graph G\<^sub>1

goal (1 subgoal):
 1. graph_homomorphism G\<^sub>1 G\<^sub>2 f
[PROOF STEP]
unfolding graph_homomorphism_def
[PROOF STATE]
proof (prove)
using this:
edge_preserving f (edges G\<^sub>1) (edges G\<^sub>2)
vertices (map_graph f G\<^sub>1) = Domain (Id_on (vertices (map_graph f G\<^sub>1))) \<and> graph (map_graph f G\<^sub>1) \<and> graph G\<^sub>2 \<and> Id_on (vertices (map_graph f G\<^sub>1)) `` vertices (map_graph f G\<^sub>1) \<subseteq> vertices G\<^sub>2 \<and> univalent (Id_on (vertices (map_graph f G\<^sub>1))) \<and> edge_preserving (Id_on (vertices (map_graph f G\<^sub>1))) (edges (map_graph f G\<^sub>1)) (edges G\<^sub>2)
vertices G\<^sub>1 = Domain f
univalent f
graph G\<^sub>1

goal (1 subgoal):
 1. vertices G\<^sub>1 = Domain f \<and> graph G\<^sub>1 \<and> graph G\<^sub>2 \<and> f `` vertices G\<^sub>1 \<subseteq> vertices G\<^sub>2 \<and> univalent f \<and> edge_preserving f (edges G\<^sub>1) (edges G\<^sub>2)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
graph_homomorphism G\<^sub>1 G\<^sub>2 f

goal (1 subgoal):
 1. graph_homomorphism G\<^sub>1 G\<^sub>2 f \<Longrightarrow> vertices G\<^sub>1 = Domain f \<and> univalent f \<and> graph G\<^sub>1 \<and> graph G\<^sub>2 \<and> graph_union (map_graph f G\<^sub>1) G\<^sub>2 = G\<^sub>2
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. graph_homomorphism G\<^sub>1 G\<^sub>2 f \<Longrightarrow> vertices G\<^sub>1 = Domain f \<and> univalent f \<and> graph G\<^sub>1 \<and> graph G\<^sub>2 \<and> graph_union (map_graph f G\<^sub>1) G\<^sub>2 = G\<^sub>2
[PROOF STEP]
assume ih:?lhs
[PROOF STATE]
proof (state)
this:
graph_homomorphism G\<^sub>1 G\<^sub>2 f

goal (1 subgoal):
 1. graph_homomorphism G\<^sub>1 G\<^sub>2 f \<Longrightarrow> vertices G\<^sub>1 = Domain f \<and> univalent f \<and> graph G\<^sub>1 \<and> graph G\<^sub>2 \<and> graph_union (map_graph f G\<^sub>1) G\<^sub>2 = G\<^sub>2
[PROOF STEP]
hence "vertices G\<^sub>1 = Domain f \<and> univalent f \<and> G\<^sub>1 = restrict G\<^sub>1 \<and> subgraph (map_graph f G\<^sub>1) G\<^sub>2"
[PROOF STATE]
proof (prove)
using this:
graph_homomorphism G\<^sub>1 G\<^sub>2 f

goal (1 subgoal):
 1. vertices G\<^sub>1 = Domain f \<and> univalent f \<and> graph G\<^sub>1 \<and> subgraph (map_graph f G\<^sub>1) G\<^sub>2
[PROOF STEP]
unfolding graph_homomorphism_def edge_preserving
[PROOF STATE]
proof (prove)
using this:
vertices G\<^sub>1 = Domain f \<and> graph G\<^sub>1 \<and> graph G\<^sub>2 \<and> f `` vertices G\<^sub>1 \<subseteq> vertices G\<^sub>2 \<and> univalent f \<and> on_triple f `` edges G\<^sub>1 \<subseteq> edges G\<^sub>2

goal (1 subgoal):
 1. vertices G\<^sub>1 = Domain f \<and> univalent f \<and> graph G\<^sub>1 \<and> vertices (map_graph f G\<^sub>1) = Domain (Id_on (vertices (map_graph f G\<^sub>1))) \<and> graph (map_graph f G\<^sub>1) \<and> graph G\<^sub>2 \<and> Id_on (vertices (map_graph f G\<^sub>1)) `` vertices (map_graph f G\<^sub>1) \<subseteq> vertices G\<^sub>2 \<and> univalent (Id_on (vertices (map_graph f G\<^sub>1))) \<and> on_triple (Id_on (vertices (map_graph f G\<^sub>1))) `` edges (map_graph f G\<^sub>1) \<subseteq> edges G\<^sub>2
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
vertices G\<^sub>1 = Domain f \<and> univalent f \<and> graph G\<^sub>1 \<and> subgraph (map_graph f G\<^sub>1) G\<^sub>2

goal (1 subgoal):
 1. graph_homomorphism G\<^sub>1 G\<^sub>2 f \<Longrightarrow> vertices G\<^sub>1 = Domain f \<and> univalent f \<and> graph G\<^sub>1 \<and> graph G\<^sub>2 \<and> graph_union (map_graph f G\<^sub>1) G\<^sub>2 = G\<^sub>2
[PROOF STEP]
thus ?rhs
[PROOF STATE]
proof (prove)
using this:
vertices G\<^sub>1 = Domain f \<and> univalent f \<and> graph G\<^sub>1 \<and> subgraph (map_graph f G\<^sub>1) G\<^sub>2

goal (1 subgoal):
 1. vertices G\<^sub>1 = Domain f \<and> univalent f \<and> graph G\<^sub>1 \<and> graph G\<^sub>2 \<and> graph_union (map_graph f G\<^sub>1) G\<^sub>2 = G\<^sub>2
[PROOF STEP]
unfolding subgraph_def
[PROOF STATE]
proof (prove)
using this:
vertices G\<^sub>1 = Domain f \<and> univalent f \<and> graph G\<^sub>1 \<and> graph (map_graph f G\<^sub>1) \<and> graph G\<^sub>2 \<and> graph_union (map_graph f G\<^sub>1) G\<^sub>2 = G\<^sub>2

goal (1 subgoal):
 1. vertices G\<^sub>1 = Domain f \<and> univalent f \<and> graph G\<^sub>1 \<and> graph G\<^sub>2 \<and> graph_union (map_graph f G\<^sub>1) G\<^sub>2 = G\<^sub>2
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
vertices G\<^sub>1 = Domain f \<and> univalent f \<and> graph G\<^sub>1 \<and> graph G\<^sub>2 \<and> graph_union (map_graph f G\<^sub>1) G\<^sub>2 = G\<^sub>2

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma differentiable_image_in_sets_lebesgue_on:
  fixes f :: "'m::euclidean_space \<Rightarrow> 'n::euclidean_space"
  assumes S: "S \<in> sets lebesgue" and X: "X \<in> sets (lebesgue_on S)" and dim: "DIM('m) \<le> DIM('n)"
       and f: "f differentiable_on S"
     shows "f ` X \<in> sets (lebesgue_on (f`S))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. f ` X \<in> sets (lebesgue_on (f ` S))
[PROOF STEP]
proof (rule sets_lebesgue_on_continuous_image [OF S X])
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. continuous_on S f
 2. \<And>T. \<lbrakk>negligible T; T \<subseteq> S\<rbrakk> \<Longrightarrow> negligible (f ` T)
[PROOF STEP]
show "continuous_on S f"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. continuous_on S f
[PROOF STEP]
by (meson differentiable_imp_continuous_on f)
[PROOF STATE]
proof (state)
this:
continuous_on S f

goal (1 subgoal):
 1. \<And>T. \<lbrakk>negligible T; T \<subseteq> S\<rbrakk> \<Longrightarrow> negligible (f ` T)
[PROOF STEP]
show "\<And>T. \<lbrakk>negligible T; T \<subseteq> S\<rbrakk> \<Longrightarrow> negligible (f ` T)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>T. \<lbrakk>negligible T; T \<subseteq> S\<rbrakk> \<Longrightarrow> negligible (f ` T)
[PROOF STEP]
using differentiable_on_subset f
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?f differentiable_on ?t; ?s \<subseteq> ?t\<rbrakk> \<Longrightarrow> ?f differentiable_on ?s
f differentiable_on S

goal (1 subgoal):
 1. \<And>T. \<lbrakk>negligible T; T \<subseteq> S\<rbrakk> \<Longrightarrow> negligible (f ` T)
[PROOF STEP]
by (auto simp: intro!: negligible_differentiable_image_negligible [OF dim])
[PROOF STATE]
proof (state)
this:
\<lbrakk>negligible ?T; ?T \<subseteq> S\<rbrakk> \<Longrightarrow> negligible (f ` ?T)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma length_filtermap: "length (filtermap pred func tr) \<le> length tr"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. length (Filtermap.filtermap pred func tr) \<le> length tr
[PROOF STEP]
proof(induction tr)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. length (Filtermap.filtermap pred func []) \<le> length []
 2. \<And>a tr. length (Filtermap.filtermap pred func tr) \<le> length tr \<Longrightarrow> length (Filtermap.filtermap pred func (a # tr)) \<le> length (a # tr)
[PROOF STEP]
case (Cons trn tr)
[PROOF STATE]
proof (state)
this:
length (Filtermap.filtermap pred func tr) \<le> length tr

goal (2 subgoals):
 1. length (Filtermap.filtermap pred func []) \<le> length []
 2. \<And>a tr. length (Filtermap.filtermap pred func tr) \<le> length tr \<Longrightarrow> length (Filtermap.filtermap pred func (a # tr)) \<le> length (a # tr)
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
length (Filtermap.filtermap pred func tr) \<le> length tr

goal (1 subgoal):
 1. length (Filtermap.filtermap pred func (trn # tr)) \<le> length (trn # tr)
[PROOF STEP]
by (cases "pred trn") auto
[PROOF STATE]
proof (state)
this:
length (Filtermap.filtermap pred func (trn # tr)) \<le> length (trn # tr)

goal (1 subgoal):
 1. length (Filtermap.filtermap pred func []) \<le> length []
[PROOF STEP]
qed auto


[STATEMENT]
lemma all_conj_distr: "((\<^bold>\<forall>x. P x) \<and> (\<^bold>\<forall>x. Q x)) = (\<^bold>\<forall>x. (P x \<and> Q x))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<^bold>\<forall>x. P x) \<and> (\<^bold>\<forall>x. Q x)) = (\<^bold>\<forall>x. P x \<and> Q x)
[PROOF STEP]
by (rule ext) blast


[STATEMENT]
lemma Equiv_Exec_sym[rule_format]: "
  \<lbrakk> \<forall>c1 c2.
      equiv_states (localState1 c1) (localState2 c2) =
      equiv_states (localState2 c2) (localState1 c1) \<rbrakk> \<Longrightarrow>
  Equiv_Exec
    m equiv_states
    localState1 localState2 input_fun1 input_fun2 output_fun1 output_fun2
    trans_fun1 trans_fun2 k1 k2 c1 c2 =
  Equiv_Exec
    m equiv_states
    localState2 localState1 input_fun2 input_fun1 output_fun2 output_fun1
    trans_fun2 trans_fun1 k2 k1 c2 c1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>c1 c2. equiv_states (localState1 c1) (localState2 c2) = equiv_states (localState2 c2) (localState1 c1) \<Longrightarrow> Equiv_Exec m equiv_states localState1 localState2 input_fun1 input_fun2 output_fun1 output_fun2 trans_fun1 trans_fun2 k1 k2 c1 c2 = Equiv_Exec m equiv_states localState2 localState1 input_fun2 input_fun1 output_fun2 output_fun1 trans_fun2 trans_fun1 k2 k1 c2 c1
[PROOF STEP]
by (fastforce simp: Equiv_Exec_def)


[STATEMENT]
lemma Qp_funs_mult':
  assumes "x \<in> carrier (Q\<^sub>p\<^bsup>n\<^esup>)"
  assumes "f \<in> (carrier (Fun\<^bsub>n\<^esub> Q\<^sub>p))"
  assumes "g \<in> (carrier (Fun\<^bsub>n\<^esub> Q\<^sub>p))"
  shows "(f \<otimes>\<^bsub>Fun\<^bsub>n\<^esub> Q\<^sub>p\<^esub> g) x = f x \<otimes> g x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (f \<otimes>\<^bsub>function_ring (carrier (Q\<^sub>p\<^bsup>n\<^esup>)) Q\<^sub>p\<^esub> g) x = f x \<otimes> g x
[PROOF STEP]
using assms Qp_funs_mult Qp_funs_car_memE
[PROOF STATE]
proof (prove)
using this:
x \<in> carrier (Q\<^sub>p\<^bsup>n\<^esup>)
f \<in> carrier (function_ring (carrier (Q\<^sub>p\<^bsup>n\<^esup>)) Q\<^sub>p)
g \<in> carrier (function_ring (carrier (Q\<^sub>p\<^bsup>n\<^esup>)) Q\<^sub>p)
\<lbrakk>?x \<in> carrier (Q\<^sub>p\<^bsup>?n\<^esup>); ?f \<in> carrier (Q\<^sub>p\<^bsup>?n\<^esup>) \<rightarrow> carrier Q\<^sub>p; ?g \<in> carrier (Q\<^sub>p\<^bsup>?n\<^esup>) \<rightarrow> carrier Q\<^sub>p\<rbrakk> \<Longrightarrow> (?f \<otimes>\<^bsub>function_ring (carrier (Q\<^sub>p\<^bsup>?n\<^esup>)) Q\<^sub>p\<^esub> ?g) ?x = ?f ?x \<otimes> ?g ?x
?f \<in> carrier (function_ring (carrier (Q\<^sub>p\<^bsup>?n\<^esup>)) Q\<^sub>p) \<Longrightarrow> ?f \<in> carrier (Q\<^sub>p\<^bsup>?n\<^esup>) \<rightarrow> carrier Q\<^sub>p

goal (1 subgoal):
 1. (f \<otimes>\<^bsub>function_ring (carrier (Q\<^sub>p\<^bsup>n\<^esup>)) Q\<^sub>p\<^esub> g) x = f x \<otimes> g x
[PROOF STEP]
by blast


[STATEMENT]
lemma rbt_sorted_param[param]:
  "(ord.rbt_sorted,ord.rbt_sorted)\<in>(Rk\<rightarrow>Rk\<rightarrow>Id)\<rightarrow>\<langle>Rk,Rv\<rangle>rbt_rel\<rightarrow>Id"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (ord.rbt_sorted, ord.rbt_sorted) \<in> (Rk \<rightarrow> Rk \<rightarrow> bool_rel) \<rightarrow> \<langle>Rk, Rv\<rangle>rbt_rel \<rightarrow> bool_rel
[PROOF STEP]
unfolding ord.rbt_sorted_def[abs_def]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lambda>less. rec_rbt True (\<lambda>c l k v r la ra. ord.rbt_less less k l \<and> ord.rbt_greater less k r \<and> la \<and> ra), \<lambda>less. rec_rbt True (\<lambda>c l k v r la ra. ord.rbt_less less k l \<and> ord.rbt_greater less k r \<and> la \<and> ra)) \<in> (Rk \<rightarrow> Rk \<rightarrow> bool_rel) \<rightarrow> \<langle>Rk, Rv\<rangle>rbt_rel \<rightarrow> bool_rel
[PROOF STEP]
by (parametricity)


[STATEMENT]
lemma state_separator_language_inclusion :
  assumes "is_state_separator_from_canonical_separator (canonical_separator M q1 q2) q1 q2 A"
  and     "q1 \<in> states M"
  and     "q2 \<in> states M"
shows "L A \<subseteq> LS M q1 \<union> LS M q2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L A \<subseteq> LS M q1 \<union> LS M q2
[PROOF STEP]
using canonical_separator_language[OF assms(2,3)]
[PROOF STATE]
proof (prove)
using this:
L (canonical_separator M q1 q2) \<subseteq> L (from_FSM M q1) \<union> L (from_FSM M q2)

goal (1 subgoal):
 1. L A \<subseteq> LS M q1 \<union> LS M q2
[PROOF STEP]
using submachine_language[OF is_state_separator_from_canonical_separator_simps(1)[OF assms(1)]]
[PROOF STATE]
proof (prove)
using this:
L (canonical_separator M q1 q2) \<subseteq> L (from_FSM M q1) \<union> L (from_FSM M q2)
L A \<subseteq> L (canonical_separator M q1 q2)

goal (1 subgoal):
 1. L A \<subseteq> LS M q1 \<union> LS M q2
[PROOF STEP]
unfolding from_FSM_language[OF assms(2)] from_FSM_language[OF assms(3)]
[PROOF STATE]
proof (prove)
using this:
L (canonical_separator M q1 q2) \<subseteq> LS M q1 \<union> LS M q2
L A \<subseteq> L (canonical_separator M q1 q2)

goal (1 subgoal):
 1. L A \<subseteq> LS M q1 \<union> LS M q2
[PROOF STEP]
by blast


[STATEMENT]
lemma eint_mult_mono':
  assumes "(c::eint) \<ge> 0 \<and> c \<noteq> \<infinity>"
  assumes "k > n"
  shows "k*c \<ge> n*c"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. n * c \<le> k * c
[PROOF STEP]
apply(cases "c = 0")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. c = 0 \<Longrightarrow> n * c \<le> k * c
 2. c \<noteq> 0 \<Longrightarrow> n * c \<le> k * c
[PROOF STEP]
apply (metis add.right_neutral assms(2) eint_add_left_cancel eint_ord_code(3)
         eint_ord_simps(4) eq_iff less_le_trans mult.commute mult_eSuc_right'
         mult_one_right not_less times_eint_simps(4) zero_eint_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. c \<noteq> 0 \<Longrightarrow> n * c \<le> k * c
[PROOF STEP]
using assms eint_mult_mono
[PROOF STATE]
proof (prove)
using this:
0 \<le> c \<and> c \<noteq> \<infinity>
n < k
\<lbrakk>0 < ?c \<and> ?c \<noteq> \<infinity>; ?n < ?k\<rbrakk> \<Longrightarrow> ?n * ?c < ?k * ?c

goal (1 subgoal):
 1. c \<noteq> 0 \<Longrightarrow> n * c \<le> k * c
[PROOF STEP]
by (simp add: le_less)


[STATEMENT]
lemma shows
    reflp_strict_extends: "reflp strict_extends" and
    transp_strict_extends: "transp strict_extends" and
    antisymp_strict_extends: "antisymp strict_extends"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. reflp strict_extends &&& transp strict_extends &&& antisymp strict_extends
[PROOF STEP]
using reflp_extends transp_extends antisymp_extends
[PROOF STATE]
proof (prove)
using this:
reflp extends
transp extends
antisymp extends

goal (1 subgoal):
 1. reflp strict_extends &&& transp strict_extends &&& antisymp strict_extends
[PROOF STEP]
unfolding strict_extends_def reflp_def transp_def antisymp_def
[PROOF STATE]
proof (prove)
using this:
\<forall>x. extends x x
\<forall>x y z. extends x y \<longrightarrow> extends y z \<longrightarrow> extends x z
\<forall>x y. extends x y \<longrightarrow> extends y x \<longrightarrow> x = y

goal (1 subgoal):
 1. \<forall>x. extends x x \<and> sym_factor x \<subseteq> (sym_factor x)\<^sup>= &&& \<forall>x y z. extends x y \<and> sym_factor x \<subseteq> (sym_factor y)\<^sup>= \<longrightarrow> extends y z \<and> sym_factor y \<subseteq> (sym_factor z)\<^sup>= \<longrightarrow> extends x z \<and> sym_factor x \<subseteq> (sym_factor z)\<^sup>= &&& \<forall>x y. extends x y \<and> sym_factor x \<subseteq> (sym_factor y)\<^sup>= \<longrightarrow> extends y x \<and> sym_factor y \<subseteq> (sym_factor x)\<^sup>= \<longrightarrow> x = y
[PROOF STEP]
by auto


[STATEMENT]
lemma pow_mat_dim_square[simp]:
  "A \<in> carrier_mat n n \<Longrightarrow> dim_row (A ^\<^sub>m k) = n"
  "A \<in> carrier_mat n n \<Longrightarrow> dim_col (A ^\<^sub>m k) = n"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (A \<in> carrier_mat n n \<Longrightarrow> dim_row (A ^\<^sub>m k) = n) &&& (A \<in> carrier_mat n n \<Longrightarrow> dim_col (A ^\<^sub>m k) = n)
[PROOF STEP]
by auto


[STATEMENT]
lemma trivial_boundsI:
  fixes f g:: "real \<Rightarrow> real"
  assumes "\<forall>x. f x \<in> {l..u}" and "g \<equiv> g"
  shows   "eventually (\<lambda>x. f (g x) \<ge> l) at_top" "eventually (\<lambda>x. f (g x) \<le> u) at_top"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>\<^sub>F x in at_top. l \<le> f (g x) &&& \<forall>\<^sub>F x in at_top. f (g x) \<le> u
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
\<forall>x. f x \<in> {l..u}
g \<equiv> g

goal (1 subgoal):
 1. \<forall>\<^sub>F x in at_top. l \<le> f (g x) &&& \<forall>\<^sub>F x in at_top. f (g x) \<le> u
[PROOF STEP]
by auto


[STATEMENT]
lemma lemma_seq_point_gt_ex2:
   "\<lbrakk> (\<lambda>n. of_rat (r n)) \<longlonglongrightarrow> (x::real); of_rat y < x \<rbrakk>
    \<Longrightarrow> (\<exists>m. y < r m)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(\<lambda>n. real_of_rat (r n)) \<longlonglongrightarrow> x; real_of_rat y < x\<rbrakk> \<Longrightarrow> \<exists>m. y < r m
[PROOF STEP]
by (force dest: lemma_seq_point_gt_ex simp add: of_rat_less)


[STATEMENT]
lemma continuous_inverse_ereal_nonpos: "continuous_on ({..<0} :: ereal set) inverse"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. continuous_on {..<0} inverse
[PROOF STEP]
proof (subst continuous_on_cong[OF refl])
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>x. x \<in> {..<0} \<Longrightarrow> inverse x = ?g x
 2. continuous_on {..<0} ?g
[PROOF STEP]
have "continuous_on {(0::ereal)<..} inverse"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. continuous_on {0<..} inverse
[PROOF STEP]
by (rule continuous_on_subset[OF continuous_on_inverse_ereal]) auto
[PROOF STATE]
proof (state)
this:
continuous_on {0<..} inverse

goal (2 subgoals):
 1. \<And>x. x \<in> {..<0} \<Longrightarrow> inverse x = ?g x
 2. continuous_on {..<0} ?g
[PROOF STEP]
thus "continuous_on {..<(0::ereal)} (uminus \<circ> inverse \<circ> uminus)"
[PROOF STATE]
proof (prove)
using this:
continuous_on {0<..} inverse

goal (1 subgoal):
 1. continuous_on {..<0} (uminus \<circ> inverse \<circ> uminus)
[PROOF STEP]
by (intro continuous_intros) simp_all
[PROOF STATE]
proof (state)
this:
continuous_on {..<0} (uminus \<circ> inverse \<circ> uminus)

goal (1 subgoal):
 1. \<And>x. x \<in> {..<0} \<Longrightarrow> inverse x = (uminus \<circ> inverse \<circ> uminus) x
[PROOF STEP]
qed simp


[STATEMENT]
lemma rel_interior_eq_closure:
  fixes S :: "'n::euclidean_space set"
  shows "rel_interior S = closure S \<longleftrightarrow> affine S"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (rel_interior S = closure S) = affine S
[PROOF STEP]
proof (cases "S = {}")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. S = {} \<Longrightarrow> (rel_interior S = closure S) = affine S
 2. S \<noteq> {} \<Longrightarrow> (rel_interior S = closure S) = affine S
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
S = {}

goal (2 subgoals):
 1. S = {} \<Longrightarrow> (rel_interior S = closure S) = affine S
 2. S \<noteq> {} \<Longrightarrow> (rel_interior S = closure S) = affine S
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
S = {}
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
S = {}

goal (1 subgoal):
 1. (rel_interior S = closure S) = affine S
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(rel_interior S = closure S) = affine S

goal (1 subgoal):
 1. S \<noteq> {} \<Longrightarrow> (rel_interior S = closure S) = affine S
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. S \<noteq> {} \<Longrightarrow> (rel_interior S = closure S) = affine S
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
S \<noteq> {}

goal (1 subgoal):
 1. S \<noteq> {} \<Longrightarrow> (rel_interior S = closure S) = affine S
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (rel_interior S = closure S) = affine S
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. rel_interior S = closure S \<Longrightarrow> affine S
 2. affine S \<Longrightarrow> rel_interior S = closure S
[PROOF STEP]
assume eq: "rel_interior S = closure S"
[PROOF STATE]
proof (state)
this:
rel_interior S = closure S

goal (2 subgoals):
 1. rel_interior S = closure S \<Longrightarrow> affine S
 2. affine S \<Longrightarrow> rel_interior S = closure S
[PROOF STEP]
have "openin (top_of_set (affine hull S)) S"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. openin (top_of_set (affine hull S)) S
[PROOF STEP]
by (metis eq closure_subset openin_rel_interior rel_interior_subset subset_antisym)
[PROOF STATE]
proof (state)
this:
openin (top_of_set (affine hull S)) S

goal (2 subgoals):
 1. rel_interior S = closure S \<Longrightarrow> affine S
 2. affine S \<Longrightarrow> rel_interior S = closure S
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
openin (top_of_set (affine hull S)) S

goal (2 subgoals):
 1. rel_interior S = closure S \<Longrightarrow> affine S
 2. affine S \<Longrightarrow> rel_interior S = closure S
[PROOF STEP]
have "closedin (top_of_set (affine hull S)) S"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. closedin (top_of_set (affine hull S)) S
[PROOF STEP]
by (metis closed_subset closure_subset_eq eq hull_subset rel_interior_subset)
[PROOF STATE]
proof (state)
this:
closedin (top_of_set (affine hull S)) S

goal (2 subgoals):
 1. rel_interior S = closure S \<Longrightarrow> affine S
 2. affine S \<Longrightarrow> rel_interior S = closure S
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
openin (top_of_set (affine hull S)) S
closedin (top_of_set (affine hull S)) S
[PROOF STEP]
have "S = {} \<or> S = affine hull S"
[PROOF STATE]
proof (prove)
using this:
openin (top_of_set (affine hull S)) S
closedin (top_of_set (affine hull S)) S

goal (1 subgoal):
 1. S = {} \<or> S = affine hull S
[PROOF STEP]
using convex_connected connected_clopen convex_affine_hull
[PROOF STATE]
proof (prove)
using this:
openin (top_of_set (affine hull S)) S
closedin (top_of_set (affine hull S)) S
convex ?S \<Longrightarrow> connected ?S
connected ?S = (\<forall>T. openin (top_of_set ?S) T \<and> closedin (top_of_set ?S) T \<longrightarrow> T = {} \<or> T = ?S)
convex (affine hull ?S)

goal (1 subgoal):
 1. S = {} \<or> S = affine hull S
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
S = {} \<or> S = affine hull S

goal (2 subgoals):
 1. rel_interior S = closure S \<Longrightarrow> affine S
 2. affine S \<Longrightarrow> rel_interior S = closure S
[PROOF STEP]
with False
[PROOF STATE]
proof (chain)
picking this:
S \<noteq> {}
S = {} \<or> S = affine hull S
[PROOF STEP]
have "affine hull S = S"
[PROOF STATE]
proof (prove)
using this:
S \<noteq> {}
S = {} \<or> S = affine hull S

goal (1 subgoal):
 1. affine hull S = S
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
affine hull S = S

goal (2 subgoals):
 1. rel_interior S = closure S \<Longrightarrow> affine S
 2. affine S \<Longrightarrow> rel_interior S = closure S
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
affine hull S = S
[PROOF STEP]
show "affine S"
[PROOF STATE]
proof (prove)
using this:
affine hull S = S

goal (1 subgoal):
 1. affine S
[PROOF STEP]
by (metis affine_hull_eq)
[PROOF STATE]
proof (state)
this:
affine S

goal (1 subgoal):
 1. affine S \<Longrightarrow> rel_interior S = closure S
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. affine S \<Longrightarrow> rel_interior S = closure S
[PROOF STEP]
assume "affine S"
[PROOF STATE]
proof (state)
this:
affine S

goal (1 subgoal):
 1. affine S \<Longrightarrow> rel_interior S = closure S
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
affine S
[PROOF STEP]
show "rel_interior S = closure S"
[PROOF STATE]
proof (prove)
using this:
affine S

goal (1 subgoal):
 1. rel_interior S = closure S
[PROOF STEP]
by (simp add: rel_interior_affine affine_closed)
[PROOF STATE]
proof (state)
this:
rel_interior S = closure S

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
(rel_interior S = closure S) = affine S

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma suminf_eq_SUP_real:
  assumes X: "summable X" "\<And>i. 0 \<le> X i" shows "suminf X = (SUP i. \<Sum>n<i. X n::real)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. suminf X = (SUP i. sum X {..<i})
[PROOF STEP]
by (intro LIMSEQ_unique[OF summable_LIMSEQ] X LIMSEQ_incseq_SUP)
     (auto intro!: bdd_aboveI2[where M="\<Sum>i. X i"] sum_le_suminf X monoI sum_mono2)


[STATEMENT]
lemma arith_prog_disjoint:
  assumes "[a \<noteq> a'] (mod int b)" and "b > 0"
  shows   "arith_prog a b \<inter> arith_prog a' b = {}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. arith_prog a b \<inter> arith_prog a' b = {}
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
[a \<noteq> a'] (mod int b)
0 < b

goal (1 subgoal):
 1. arith_prog a b \<inter> arith_prog a' b = {}
[PROOF STEP]
by (auto simp: arith_prog_def cong_def)


[STATEMENT]
lemma hyperUn_assoc: "(A \<squnion> B) \<squnion> C = A \<squnion> (B \<squnion> C)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. A \<squnion> B \<squnion> C = A \<squnion> (B \<squnion> C)
[PROOF STEP]
by(simp add:hyperset_defs Un_assoc)


[STATEMENT]
lemma eval_fmla_Iff [simp]: "eval_fmla e (Iff A B) \<longleftrightarrow> (eval_fmla e A  \<longleftrightarrow>  eval_fmla e B)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. eval_fmla e (A IFF B) = (eval_fmla e A = eval_fmla e B)
[PROOF STEP]
by (auto simp: Iff_def)


[STATEMENT]
lemma (in Group) smallest_sg_gen:"\<lbrakk>A \<subseteq> carrier G; G \<guillemotright> H; A \<subseteq> H\<rbrakk> \<Longrightarrow>
                                   sg_gen G A \<subseteq> H"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>A \<subseteq> carrier G; G \<guillemotright> H ; A \<subseteq> H\<rbrakk> \<Longrightarrow> sg_gen G A \<subseteq> H
[PROOF STEP]
apply (simp add:sg_gen_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>A \<subseteq> carrier G; G \<guillemotright> H ; A \<subseteq> H\<rbrakk> \<Longrightarrow> \<Inter> {H. G \<guillemotright> H  \<and> A \<subseteq> H} \<subseteq> H
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done