[STATEMENT]
theorem avl_insert:
  "avl t \<Longrightarrow> avl(insert x t)"
  "avl t \<Longrightarrow> height (insert x t) \<in> {height t, height t + 1}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (avl t \<Longrightarrow> avl (AVL_Set_Code.insert x t)) &&& (avl t \<Longrightarrow> height (AVL_Set_Code.insert x t) \<in> {height t, height t + 1})
[PROOF STEP]
proof (induction t rule: tree2_induct)
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. avl \<langle>\<rangle> \<Longrightarrow> avl (AVL_Set_Code.insert x \<langle>\<rangle>)
 2. avl \<langle>\<rangle> \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>\<rangle>) \<in> {height \<langle>\<rangle>, height \<langle>\<rangle> + 1}
 3. \<And>x1 a b x3. \<lbrakk>avl x1 \<Longrightarrow> avl (AVL_Set_Code.insert x x1); avl x1 \<Longrightarrow> height (AVL_Set_Code.insert x x1) \<in> {height x1, height x1 + 1}; avl x3 \<Longrightarrow> avl (AVL_Set_Code.insert x x3); avl x3 \<Longrightarrow> height (AVL_Set_Code.insert x x3) \<in> {height x3, height x3 + 1}; avl \<langle>x1, (a, b), x3\<rangle>\<rbrakk> \<Longrightarrow> avl (AVL_Set_Code.insert x \<langle>x1, (a, b), x3\<rangle>)
 4. \<And>x1 a b x3. \<lbrakk>avl x1 \<Longrightarrow> avl (AVL_Set_Code.insert x x1); avl x1 \<Longrightarrow> height (AVL_Set_Code.insert x x1) \<in> {height x1, height x1 + 1}; avl x3 \<Longrightarrow> avl (AVL_Set_Code.insert x x3); avl x3 \<Longrightarrow> height (AVL_Set_Code.insert x x3) \<in> {height x3, height x3 + 1}; avl \<langle>x1, (a, b), x3\<rangle>\<rbrakk> \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>x1, (a, b), x3\<rangle>) \<in> {height \<langle>x1, (a, b), x3\<rangle>, height \<langle>x1, (a, b), x3\<rangle> + 1}
[PROOF STEP]
case (Node l a _ r)
[PROOF STATE]
proof (state)
this:
avl l \<Longrightarrow> avl (AVL_Set_Code.insert x l)
avl l \<Longrightarrow> height (AVL_Set_Code.insert x l) \<in> {height l, height l + 1}
avl r \<Longrightarrow> avl (AVL_Set_Code.insert x r)
avl r \<Longrightarrow> height (AVL_Set_Code.insert x r) \<in> {height r, height r + 1}

goal (4 subgoals):
 1. avl \<langle>\<rangle> \<Longrightarrow> avl (AVL_Set_Code.insert x \<langle>\<rangle>)
 2. avl \<langle>\<rangle> \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>\<rangle>) \<in> {height \<langle>\<rangle>, height \<langle>\<rangle> + 1}
 3. \<And>x1 a b x3. \<lbrakk>avl x1 \<Longrightarrow> avl (AVL_Set_Code.insert x x1); avl x1 \<Longrightarrow> height (AVL_Set_Code.insert x x1) \<in> {height x1, height x1 + 1}; avl x3 \<Longrightarrow> avl (AVL_Set_Code.insert x x3); avl x3 \<Longrightarrow> height (AVL_Set_Code.insert x x3) \<in> {height x3, height x3 + 1}; avl \<langle>x1, (a, b), x3\<rangle>\<rbrakk> \<Longrightarrow> avl (AVL_Set_Code.insert x \<langle>x1, (a, b), x3\<rangle>)
 4. \<And>x1 a b x3. \<lbrakk>avl x1 \<Longrightarrow> avl (AVL_Set_Code.insert x x1); avl x1 \<Longrightarrow> height (AVL_Set_Code.insert x x1) \<in> {height x1, height x1 + 1}; avl x3 \<Longrightarrow> avl (AVL_Set_Code.insert x x3); avl x3 \<Longrightarrow> height (AVL_Set_Code.insert x x3) \<in> {height x3, height x3 + 1}; avl \<langle>x1, (a, b), x3\<rangle>\<rbrakk> \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>x1, (a, b), x3\<rangle>) \<in> {height \<langle>x1, (a, b), x3\<rangle>, height \<langle>x1, (a, b), x3\<rangle> + 1}
[PROOF STEP]
case 1
[PROOF STATE]
proof (state)
this:
avl \<langle>l, (a, b_), r\<rangle>

goal (4 subgoals):
 1. avl \<langle>\<rangle> \<Longrightarrow> avl (AVL_Set_Code.insert x \<langle>\<rangle>)
 2. avl \<langle>\<rangle> \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>\<rangle>) \<in> {height \<langle>\<rangle>, height \<langle>\<rangle> + 1}
 3. \<And>x1 a b x3. \<lbrakk>avl x1 \<Longrightarrow> avl (AVL_Set_Code.insert x x1); avl x1 \<Longrightarrow> height (AVL_Set_Code.insert x x1) \<in> {height x1, height x1 + 1}; avl x3 \<Longrightarrow> avl (AVL_Set_Code.insert x x3); avl x3 \<Longrightarrow> height (AVL_Set_Code.insert x x3) \<in> {height x3, height x3 + 1}; avl \<langle>x1, (a, b), x3\<rangle>\<rbrakk> \<Longrightarrow> avl (AVL_Set_Code.insert x \<langle>x1, (a, b), x3\<rangle>)
 4. \<And>x1 a b x3. \<lbrakk>avl x1 \<Longrightarrow> avl (AVL_Set_Code.insert x x1); avl x1 \<Longrightarrow> height (AVL_Set_Code.insert x x1) \<in> {height x1, height x1 + 1}; avl x3 \<Longrightarrow> avl (AVL_Set_Code.insert x x3); avl x3 \<Longrightarrow> height (AVL_Set_Code.insert x x3) \<in> {height x3, height x3 + 1}; avl \<langle>x1, (a, b), x3\<rangle>\<rbrakk> \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>x1, (a, b), x3\<rangle>) \<in> {height \<langle>x1, (a, b), x3\<rangle>, height \<langle>x1, (a, b), x3\<rangle> + 1}
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. avl (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>)
[PROOF STEP]
proof(cases "x = a")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. x = a \<Longrightarrow> avl (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>)
 2. x \<noteq> a \<Longrightarrow> avl (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>)
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
x = a

goal (2 subgoals):
 1. x = a \<Longrightarrow> avl (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>)
 2. x \<noteq> a \<Longrightarrow> avl (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>)
[PROOF STEP]
with 1
[PROOF STATE]
proof (chain)
picking this:
avl \<langle>l, (a, b_), r\<rangle>
x = a
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
avl \<langle>l, (a, b_), r\<rangle>
x = a

goal (1 subgoal):
 1. avl (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>)
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
avl (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>)

goal (1 subgoal):
 1. x \<noteq> a \<Longrightarrow> avl (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. x \<noteq> a \<Longrightarrow> avl (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>)
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
x \<noteq> a

goal (1 subgoal):
 1. x \<noteq> a \<Longrightarrow> avl (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. avl (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>)
[PROOF STEP]
proof(cases "x<a")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. x < a \<Longrightarrow> avl (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>)
 2. \<not> x < a \<Longrightarrow> avl (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>)
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
x < a

goal (2 subgoals):
 1. x < a \<Longrightarrow> avl (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>)
 2. \<not> x < a \<Longrightarrow> avl (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>)
[PROOF STEP]
with 1 Node(1,2)
[PROOF STATE]
proof (chain)
picking this:
avl \<langle>l, (a, b_), r\<rangle>
avl l \<Longrightarrow> avl (AVL_Set_Code.insert x l)
avl l \<Longrightarrow> height (AVL_Set_Code.insert x l) \<in> {height l, height l + 1}
x < a
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
avl \<langle>l, (a, b_), r\<rangle>
avl l \<Longrightarrow> avl (AVL_Set_Code.insert x l)
avl l \<Longrightarrow> height (AVL_Set_Code.insert x l) \<in> {height l, height l + 1}
x < a

goal (1 subgoal):
 1. avl (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>)
[PROOF STEP]
by (auto intro!:avl_balL)
[PROOF STATE]
proof (state)
this:
avl (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>)

goal (1 subgoal):
 1. \<not> x < a \<Longrightarrow> avl (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> x < a \<Longrightarrow> avl (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>)
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
\<not> x < a

goal (1 subgoal):
 1. \<not> x < a \<Longrightarrow> avl (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>)
[PROOF STEP]
with 1 Node(3,4) \<open>x\<noteq>a\<close>
[PROOF STATE]
proof (chain)
picking this:
avl \<langle>l, (a, b_), r\<rangle>
avl r \<Longrightarrow> avl (AVL_Set_Code.insert x r)
avl r \<Longrightarrow> height (AVL_Set_Code.insert x r) \<in> {height r, height r + 1}
x \<noteq> a
\<not> x < a
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
avl \<langle>l, (a, b_), r\<rangle>
avl r \<Longrightarrow> avl (AVL_Set_Code.insert x r)
avl r \<Longrightarrow> height (AVL_Set_Code.insert x r) \<in> {height r, height r + 1}
x \<noteq> a
\<not> x < a

goal (1 subgoal):
 1. avl (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>)
[PROOF STEP]
by (auto intro!:avl_balR)
[PROOF STATE]
proof (state)
this:
avl (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
avl (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
avl (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>)

goal (3 subgoals):
 1. avl \<langle>\<rangle> \<Longrightarrow> avl (AVL_Set_Code.insert x \<langle>\<rangle>)
 2. avl \<langle>\<rangle> \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>\<rangle>) \<in> {height \<langle>\<rangle>, height \<langle>\<rangle> + 1}
 3. \<And>x1 a b x3. \<lbrakk>avl x1 \<Longrightarrow> avl (AVL_Set_Code.insert x x1); avl x1 \<Longrightarrow> height (AVL_Set_Code.insert x x1) \<in> {height x1, height x1 + 1}; avl x3 \<Longrightarrow> avl (AVL_Set_Code.insert x x3); avl x3 \<Longrightarrow> height (AVL_Set_Code.insert x x3) \<in> {height x3, height x3 + 1}; avl \<langle>x1, (a, b), x3\<rangle>\<rbrakk> \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>x1, (a, b), x3\<rangle>) \<in> {height \<langle>x1, (a, b), x3\<rangle>, height \<langle>x1, (a, b), x3\<rangle> + 1}
[PROOF STEP]
case 2
[PROOF STATE]
proof (state)
this:
avl \<langle>l, (a, b_), r\<rangle>

goal (3 subgoals):
 1. avl \<langle>\<rangle> \<Longrightarrow> avl (AVL_Set_Code.insert x \<langle>\<rangle>)
 2. avl \<langle>\<rangle> \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>\<rangle>) \<in> {height \<langle>\<rangle>, height \<langle>\<rangle> + 1}
 3. \<And>x1 a b x3. \<lbrakk>avl x1 \<Longrightarrow> avl (AVL_Set_Code.insert x x1); avl x1 \<Longrightarrow> height (AVL_Set_Code.insert x x1) \<in> {height x1, height x1 + 1}; avl x3 \<Longrightarrow> avl (AVL_Set_Code.insert x x3); avl x3 \<Longrightarrow> height (AVL_Set_Code.insert x x3) \<in> {height x3, height x3 + 1}; avl \<langle>x1, (a, b), x3\<rangle>\<rbrakk> \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>x1, (a, b), x3\<rangle>) \<in> {height \<langle>x1, (a, b), x3\<rangle>, height \<langle>x1, (a, b), x3\<rangle> + 1}
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
[PROOF STEP]
proof(cases "x = a")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. x = a \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
 2. x \<noteq> a \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
x = a

goal (2 subgoals):
 1. x = a \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
 2. x \<noteq> a \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
[PROOF STEP]
with 2
[PROOF STATE]
proof (chain)
picking this:
avl \<langle>l, (a, b_), r\<rangle>
x = a
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
avl \<langle>l, (a, b_), r\<rangle>
x = a

goal (1 subgoal):
 1. height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}

goal (1 subgoal):
 1. x \<noteq> a \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. x \<noteq> a \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
x \<noteq> a

goal (1 subgoal):
 1. x \<noteq> a \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
[PROOF STEP]
proof(cases "x<a")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. x < a \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
 2. \<not> x < a \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
x < a

goal (2 subgoals):
 1. x < a \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
 2. \<not> x < a \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
[PROOF STEP]
proof(cases "height (insert x l) = height r + 2")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. height (AVL_Set_Code.insert x l) = height r + 2 \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
 2. height (AVL_Set_Code.insert x l) \<noteq> height r + 2 \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
height (AVL_Set_Code.insert x l) \<noteq> height r + 2

goal (2 subgoals):
 1. height (AVL_Set_Code.insert x l) = height r + 2 \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
 2. height (AVL_Set_Code.insert x l) \<noteq> height r + 2 \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
[PROOF STEP]
with 2 Node(1,2) \<open>x < a\<close>
[PROOF STATE]
proof (chain)
picking this:
avl \<langle>l, (a, b_), r\<rangle>
avl l \<Longrightarrow> avl (AVL_Set_Code.insert x l)
avl l \<Longrightarrow> height (AVL_Set_Code.insert x l) \<in> {height l, height l + 1}
x < a
height (AVL_Set_Code.insert x l) \<noteq> height r + 2
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
avl \<langle>l, (a, b_), r\<rangle>
avl l \<Longrightarrow> avl (AVL_Set_Code.insert x l)
avl l \<Longrightarrow> height (AVL_Set_Code.insert x l) \<in> {height l, height l + 1}
x < a
height (AVL_Set_Code.insert x l) \<noteq> height r + 2

goal (1 subgoal):
 1. height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
[PROOF STEP]
by (auto simp: height_balL2)
[PROOF STATE]
proof (state)
this:
height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}

goal (1 subgoal):
 1. height (AVL_Set_Code.insert x l) = height r + 2 \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. height (AVL_Set_Code.insert x l) = height r + 2 \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
height (AVL_Set_Code.insert x l) = height r + 2

goal (1 subgoal):
 1. height (AVL_Set_Code.insert x l) = height r + 2 \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
[PROOF STEP]
hence "(height (balL (insert x l) a r) = height r + 2) \<or>
          (height (balL (insert x l) a r) = height r + 3)" (is "?A \<or> ?B")
[PROOF STATE]
proof (prove)
using this:
height (AVL_Set_Code.insert x l) = height r + 2

goal (1 subgoal):
 1. height (balL (AVL_Set_Code.insert x l) a r) = height r + 2 \<or> height (balL (AVL_Set_Code.insert x l) a r) = height r + 3
[PROOF STEP]
using 2 Node(1,2) height_balL[OF _ _ True]
[PROOF STATE]
proof (prove)
using this:
height (AVL_Set_Code.insert x l) = height r + 2
avl \<langle>l, (a, b_), r\<rangle>
avl l \<Longrightarrow> avl (AVL_Set_Code.insert x l)
avl l \<Longrightarrow> height (AVL_Set_Code.insert x l) \<in> {height l, height l + 1}
\<lbrakk>avl (AVL_Set_Code.insert x l); avl r\<rbrakk> \<Longrightarrow> height (balL (AVL_Set_Code.insert x l) ?a r) \<in> {height r + 2, height r + 3}

goal (1 subgoal):
 1. height (balL (AVL_Set_Code.insert x l) a r) = height r + 2 \<or> height (balL (AVL_Set_Code.insert x l) a r) = height r + 3
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
height (balL (AVL_Set_Code.insert x l) a r) = height r + 2 \<or> height (balL (AVL_Set_Code.insert x l) a r) = height r + 3

goal (1 subgoal):
 1. height (AVL_Set_Code.insert x l) = height r + 2 \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
height (balL (AVL_Set_Code.insert x l) a r) = height r + 2 \<or> height (balL (AVL_Set_Code.insert x l) a r) = height r + 3

goal (1 subgoal):
 1. height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. height (balL (AVL_Set_Code.insert x l) a r) = height r + 2 \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
 2. height (balL (AVL_Set_Code.insert x l) a r) = height r + 3 \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
[PROOF STEP]
assume ?A
[PROOF STATE]
proof (state)
this:
height (balL (AVL_Set_Code.insert x l) a r) = height r + 2

goal (2 subgoals):
 1. height (balL (AVL_Set_Code.insert x l) a r) = height r + 2 \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
 2. height (balL (AVL_Set_Code.insert x l) a r) = height r + 3 \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
[PROOF STEP]
with 2 \<open>x < a\<close>
[PROOF STATE]
proof (chain)
picking this:
avl \<langle>l, (a, b_), r\<rangle>
x < a
height (balL (AVL_Set_Code.insert x l) a r) = height r + 2
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
avl \<langle>l, (a, b_), r\<rangle>
x < a
height (balL (AVL_Set_Code.insert x l) a r) = height r + 2

goal (1 subgoal):
 1. height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
[PROOF STEP]
by (auto)
[PROOF STATE]
proof (state)
this:
height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}

goal (1 subgoal):
 1. height (balL (AVL_Set_Code.insert x l) a r) = height r + 3 \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. height (balL (AVL_Set_Code.insert x l) a r) = height r + 3 \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
[PROOF STEP]
assume ?B
[PROOF STATE]
proof (state)
this:
height (balL (AVL_Set_Code.insert x l) a r) = height r + 3

goal (1 subgoal):
 1. height (balL (AVL_Set_Code.insert x l) a r) = height r + 3 \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
[PROOF STEP]
with 2 Node(2) True \<open>x < a\<close>
[PROOF STATE]
proof (chain)
picking this:
avl \<langle>l, (a, b_), r\<rangle>
avl l \<Longrightarrow> height (AVL_Set_Code.insert x l) \<in> {height l, height l + 1}
height (AVL_Set_Code.insert x l) = height r + 2
x < a
height (balL (AVL_Set_Code.insert x l) a r) = height r + 3
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
avl \<langle>l, (a, b_), r\<rangle>
avl l \<Longrightarrow> height (AVL_Set_Code.insert x l) \<in> {height l, height l + 1}
height (AVL_Set_Code.insert x l) = height r + 2
x < a
height (balL (AVL_Set_Code.insert x l) a r) = height r + 3

goal (1 subgoal):
 1. height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
[PROOF STEP]
by (simp) arith
[PROOF STATE]
proof (state)
this:
height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}

goal (1 subgoal):
 1. \<not> x < a \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> x < a \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
\<not> x < a

goal (1 subgoal):
 1. \<not> x < a \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
[PROOF STEP]
proof(cases "height (insert x r) = height l + 2")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. height (AVL_Set_Code.insert x r) = height l + 2 \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
 2. height (AVL_Set_Code.insert x r) \<noteq> height l + 2 \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
height (AVL_Set_Code.insert x r) \<noteq> height l + 2

goal (2 subgoals):
 1. height (AVL_Set_Code.insert x r) = height l + 2 \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
 2. height (AVL_Set_Code.insert x r) \<noteq> height l + 2 \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
[PROOF STEP]
with 2 Node(3,4) \<open>\<not>x < a\<close>
[PROOF STATE]
proof (chain)
picking this:
avl \<langle>l, (a, b_), r\<rangle>
avl r \<Longrightarrow> avl (AVL_Set_Code.insert x r)
avl r \<Longrightarrow> height (AVL_Set_Code.insert x r) \<in> {height r, height r + 1}
\<not> x < a
height (AVL_Set_Code.insert x r) \<noteq> height l + 2
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
avl \<langle>l, (a, b_), r\<rangle>
avl r \<Longrightarrow> avl (AVL_Set_Code.insert x r)
avl r \<Longrightarrow> height (AVL_Set_Code.insert x r) \<in> {height r, height r + 1}
\<not> x < a
height (AVL_Set_Code.insert x r) \<noteq> height l + 2

goal (1 subgoal):
 1. height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
[PROOF STEP]
by (auto simp: height_balR2)
[PROOF STATE]
proof (state)
this:
height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}

goal (1 subgoal):
 1. height (AVL_Set_Code.insert x r) = height l + 2 \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. height (AVL_Set_Code.insert x r) = height l + 2 \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
height (AVL_Set_Code.insert x r) = height l + 2

goal (1 subgoal):
 1. height (AVL_Set_Code.insert x r) = height l + 2 \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
[PROOF STEP]
hence "(height (balR l a (insert x r)) = height l + 2) \<or>
          (height (balR l a (insert x r)) = height l + 3)"  (is "?A \<or> ?B")
[PROOF STATE]
proof (prove)
using this:
height (AVL_Set_Code.insert x r) = height l + 2

goal (1 subgoal):
 1. height (balR l a (AVL_Set_Code.insert x r)) = height l + 2 \<or> height (balR l a (AVL_Set_Code.insert x r)) = height l + 3
[PROOF STEP]
using 2 Node(3) height_balR[OF _ _ True]
[PROOF STATE]
proof (prove)
using this:
height (AVL_Set_Code.insert x r) = height l + 2
avl \<langle>l, (a, b_), r\<rangle>
avl r \<Longrightarrow> avl (AVL_Set_Code.insert x r)
\<lbrakk>avl l; avl (AVL_Set_Code.insert x r)\<rbrakk> \<Longrightarrow> height (balR l ?a (AVL_Set_Code.insert x r)) \<in> {height l + 2, height l + 3}

goal (1 subgoal):
 1. height (balR l a (AVL_Set_Code.insert x r)) = height l + 2 \<or> height (balR l a (AVL_Set_Code.insert x r)) = height l + 3
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
height (balR l a (AVL_Set_Code.insert x r)) = height l + 2 \<or> height (balR l a (AVL_Set_Code.insert x r)) = height l + 3

goal (1 subgoal):
 1. height (AVL_Set_Code.insert x r) = height l + 2 \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
height (balR l a (AVL_Set_Code.insert x r)) = height l + 2 \<or> height (balR l a (AVL_Set_Code.insert x r)) = height l + 3

goal (1 subgoal):
 1. height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. height (balR l a (AVL_Set_Code.insert x r)) = height l + 2 \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
 2. height (balR l a (AVL_Set_Code.insert x r)) = height l + 3 \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
[PROOF STEP]
assume ?A
[PROOF STATE]
proof (state)
this:
height (balR l a (AVL_Set_Code.insert x r)) = height l + 2

goal (2 subgoals):
 1. height (balR l a (AVL_Set_Code.insert x r)) = height l + 2 \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
 2. height (balR l a (AVL_Set_Code.insert x r)) = height l + 3 \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
[PROOF STEP]
with 2 \<open>\<not>x < a\<close>
[PROOF STATE]
proof (chain)
picking this:
avl \<langle>l, (a, b_), r\<rangle>
\<not> x < a
height (balR l a (AVL_Set_Code.insert x r)) = height l + 2
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
avl \<langle>l, (a, b_), r\<rangle>
\<not> x < a
height (balR l a (AVL_Set_Code.insert x r)) = height l + 2

goal (1 subgoal):
 1. height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
[PROOF STEP]
by (auto)
[PROOF STATE]
proof (state)
this:
height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}

goal (1 subgoal):
 1. height (balR l a (AVL_Set_Code.insert x r)) = height l + 3 \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. height (balR l a (AVL_Set_Code.insert x r)) = height l + 3 \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
[PROOF STEP]
assume ?B
[PROOF STATE]
proof (state)
this:
height (balR l a (AVL_Set_Code.insert x r)) = height l + 3

goal (1 subgoal):
 1. height (balR l a (AVL_Set_Code.insert x r)) = height l + 3 \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
[PROOF STEP]
with 2 Node(4) True \<open>\<not>x < a\<close>
[PROOF STATE]
proof (chain)
picking this:
avl \<langle>l, (a, b_), r\<rangle>
avl r \<Longrightarrow> height (AVL_Set_Code.insert x r) \<in> {height r, height r + 1}
height (AVL_Set_Code.insert x r) = height l + 2
\<not> x < a
height (balR l a (AVL_Set_Code.insert x r)) = height l + 3
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
avl \<langle>l, (a, b_), r\<rangle>
avl r \<Longrightarrow> height (AVL_Set_Code.insert x r) \<in> {height r, height r + 1}
height (AVL_Set_Code.insert x r) = height l + 2
\<not> x < a
height (balR l a (AVL_Set_Code.insert x r)) = height l + 3

goal (1 subgoal):
 1. height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}
[PROOF STEP]
by (simp) arith
[PROOF STATE]
proof (state)
this:
height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
height (AVL_Set_Code.insert x \<langle>l, (a, b_), r\<rangle>) \<in> {height \<langle>l, (a, b_), r\<rangle>, height \<langle>l, (a, b_), r\<rangle> + 1}

goal (2 subgoals):
 1. avl \<langle>\<rangle> \<Longrightarrow> avl (AVL_Set_Code.insert x \<langle>\<rangle>)
 2. avl \<langle>\<rangle> \<Longrightarrow> height (AVL_Set_Code.insert x \<langle>\<rangle>) \<in> {height \<langle>\<rangle>, height \<langle>\<rangle> + 1}
[PROOF STEP]
qed simp_all


[STATEMENT]
lemma ordered_fmap_distinct:
  assumes "is_fmap S"
  shows "distinct (map fst (ordered_fmap S))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. distinct (map fst (ordered_fmap S))
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
is_fmap S

goal (1 subgoal):
 1. distinct (map fst (ordered_fmap S))
[PROOF STEP]
by transfer (rule ordered_map_distinct)


[STATEMENT]
lemma projection_is_projection_on:
  fixes M :: \<open>'a::chilbert_space set\<close>
  assumes \<open>convex M\<close> and \<open>closed M\<close> and \<open>M \<noteq> {}\<close>
  shows "is_projection_on (projection M) M"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. is_projection_on (projection M) M
[PROOF STEP]
by (metis assms(1) assms(2) assms(3) is_projection_on_exists projection_def someI)


[STATEMENT]
lemma am_nodes_as_filter:
  assumes "is_adj_map am"
  shows "{v . (u,v)\<in>cfE_of f} = set (filter (\<lambda>v. cf_of f (u,v) \<noteq> 0) (am u))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {v. (u, v) \<in> cfE_of f} = set (filter (\<lambda>v. cf_of f (u, v) \<noteq> 0) (am u))
[PROOF STEP]
using assms cfE_of_ss_invE
[PROOF STATE]
proof (prove)
using this:
is_adj_map am
cfE_of ?cf \<subseteq> E \<union> E\<inverse>

goal (1 subgoal):
 1. {v. (u, v) \<in> cfE_of f} = set (filter (\<lambda>v. cf_of f (u, v) \<noteq> 0) (am u))
[PROOF STEP]
unfolding is_adj_map_def Graph.E_def
[PROOF STATE]
proof (prove)
using this:
\<forall>u. distinct (am u) \<and> set (am u) = {(u, v). c (u, v) \<noteq> 0} `` {u} \<union> {(u, v). c (u, v) \<noteq> 0}\<inverse> `` {u}
{(u, v). cf_of ?cf (u, v) \<noteq> 0} \<subseteq> {(u, v). c (u, v) \<noteq> 0} \<union> {(u, v). c (u, v) \<noteq> 0}\<inverse>

goal (1 subgoal):
 1. {v. (u, v) \<in> {(u, v). cf_of f (u, v) \<noteq> 0}} = set (filter (\<lambda>v. cf_of f (u, v) \<noteq> 0) (am u))
[PROOF STEP]
by fastforce


[STATEMENT]
lemma frac_eqI:
  assumes "s1\<in>S" and "(r, s) \<in> R \<times> S" "(r', s') \<in> R \<times> S"
     and eq:"s1 \<cdot> s' \<cdot> r = s1 \<cdot> s \<cdot> r'"
  shows "frac r s = frac r' s'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. r / s = r' / s'
[PROOF STEP]
unfolding frac_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. rel.Class (r, s) = rel.Class (r', s')
[PROOF STEP]
proof (rule rel.Class_eq)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. ((r, s), r', s') \<in> {(x, y). (x, y) \<in> (R \<times> S) \<times> R \<times> S \<and> x \<sim> y}
[PROOF STEP]
have "s1 \<cdot> (s' \<cdot> r - s \<cdot> r') = \<zero>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. s1 \<cdot> (s' \<cdot> r - s \<cdot> r') = \<zero>
[PROOF STEP]
using assms comm.inverse_distributive(1) comm.multiplicative.associative
[PROOF STATE]
proof (prove)
using this:
s1 \<in> S
(r, s) \<in> R \<times> S
(r', s') \<in> R \<times> S
s1 \<cdot> s' \<cdot> r = s1 \<cdot> s \<cdot> r'
\<lbrakk>?a \<in> R; ?b \<in> R; ?c \<in> R\<rbrakk> \<Longrightarrow> ?a \<cdot> (?b - ?c) = ?a \<cdot> ?b - ?a \<cdot> ?c
\<lbrakk>?a \<in> R; ?b \<in> R; ?c \<in> R\<rbrakk> \<Longrightarrow> ?a \<cdot> ?b \<cdot> ?c = ?a \<cdot> (?b \<cdot> ?c)

goal (1 subgoal):
 1. s1 \<cdot> (s' \<cdot> r - s \<cdot> r') = \<zero>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
s1 \<cdot> (s' \<cdot> r - s \<cdot> r') = \<zero>

goal (1 subgoal):
 1. ((r, s), r', s') \<in> {(x, y). (x, y) \<in> (R \<times> S) \<times> R \<times> S \<and> x \<sim> y}
[PROOF STEP]
with \<open>s1\<in>S\<close>
[PROOF STATE]
proof (chain)
picking this:
s1 \<in> S
s1 \<cdot> (s' \<cdot> r - s \<cdot> r') = \<zero>
[PROOF STEP]
have "(r, s) \<sim> (r', s')"
[PROOF STATE]
proof (prove)
using this:
s1 \<in> S
s1 \<cdot> (s' \<cdot> r - s \<cdot> r') = \<zero>

goal (1 subgoal):
 1. (r, s) \<sim> (r', s')
[PROOF STEP]
unfolding rel_def
[PROOF STATE]
proof (prove)
using this:
s1 \<in> S
s1 \<cdot> (s' \<cdot> r - s \<cdot> r') = \<zero>

goal (1 subgoal):
 1. \<exists>s1. s1 \<in> S \<and> s1 \<cdot> (snd (r', s') \<cdot> fst (r, s) - snd (r, s) \<cdot> fst (r', s')) = \<zero>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(r, s) \<sim> (r', s')

goal (1 subgoal):
 1. ((r, s), r', s') \<in> {(x, y). (x, y) \<in> (R \<times> S) \<times> R \<times> S \<and> x \<sim> y}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(r, s) \<sim> (r', s')
[PROOF STEP]
show "((r, s), r', s') \<in> {(x, y). (x, y) \<in> (R \<times> S) \<times> R \<times> S \<and> x \<sim> y}"
[PROOF STATE]
proof (prove)
using this:
(r, s) \<sim> (r', s')

goal (1 subgoal):
 1. ((r, s), r', s') \<in> {(x, y). (x, y) \<in> (R \<times> S) \<times> R \<times> S \<and> x \<sim> y}
[PROOF STEP]
using assms(2,3)
[PROOF STATE]
proof (prove)
using this:
(r, s) \<sim> (r', s')
(r, s) \<in> R \<times> S
(r', s') \<in> R \<times> S

goal (1 subgoal):
 1. ((r, s), r', s') \<in> {(x, y). (x, y) \<in> (R \<times> S) \<times> R \<times> S \<and> x \<sim> y}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
((r, s), r', s') \<in> {(x, y). (x, y) \<in> (R \<times> S) \<times> R \<times> S \<and> x \<sim> y}

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma (in group) l_coset_carrier:
  "\<lbrakk> y \<in> x <# H; x \<in> carrier G; subgroup H G \<rbrakk> \<Longrightarrow> y \<in> carrier G"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>y \<in> x <# H; x \<in> carrier G; subgroup H G\<rbrakk> \<Longrightarrow> y \<in> carrier G
[PROOF STEP]
by (auto simp add: l_coset_def m_assoc  subgroup.subset [THEN subsetD] subgroup.m_closed)


[STATEMENT]
lemma inf_add_right:
  assumes "z \<noteq> \<infinity>\<^sub>h"
  shows "z +\<^sub>h \<infinity>\<^sub>h = \<infinity>\<^sub>h"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. z +\<^sub>h \<infinity>\<^sub>h = \<infinity>\<^sub>h
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
z \<noteq> \<infinity>\<^sub>h

goal (1 subgoal):
 1. z +\<^sub>h \<infinity>\<^sub>h = \<infinity>\<^sub>h
[PROOF STEP]
using inf_or_of_complex[of z]
[PROOF STATE]
proof (prove)
using this:
z \<noteq> \<infinity>\<^sub>h
z = \<infinity>\<^sub>h \<or> (\<exists>x. z = of_complex x)

goal (1 subgoal):
 1. z +\<^sub>h \<infinity>\<^sub>h = \<infinity>\<^sub>h
[PROOF STEP]
by auto


[STATEMENT]
lemma Ball_scf_diff:
  assumes "is_pref_profile R1" "is_pref_profile R2"
  shows   "(\<forall>x\<in>scf R1 - scf R2. P x) \<longleftrightarrow>
             (a \<in> scf R2 \<or> a \<notin> scf R1 \<or> P a) \<and> (b \<in> scf R2 \<or> b \<notin> scf R1 \<or> P b) \<and>
             (c \<in> scf R2 \<or> c \<notin> scf R1 \<or> P c)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<forall>x\<in>scf R1 - scf R2. P x) = ((a \<in> scf R2 \<or> a \<notin> scf R1 \<or> P a) \<and> (b \<in> scf R2 \<or> b \<notin> scf R1 \<or> P b) \<and> (c \<in> scf R2 \<or> c \<notin> scf R1 \<or> P c))
[PROOF STEP]
using assms[THEN scf_alts]
[PROOF STATE]
proof (prove)
using this:
scf R1 \<subseteq> alts
scf R2 \<subseteq> alts

goal (1 subgoal):
 1. (\<forall>x\<in>scf R1 - scf R2. P x) = ((a \<in> scf R2 \<or> a \<notin> scf R1 \<or> P a) \<and> (b \<in> scf R2 \<or> b \<notin> scf R1 \<or> P b) \<and> (c \<in> scf R2 \<or> c \<notin> scf R1 \<or> P c))
[PROOF STEP]
unfolding alts_eq
[PROOF STATE]
proof (prove)
using this:
scf R1 \<subseteq> {a, b, c}
scf R2 \<subseteq> {a, b, c}

goal (1 subgoal):
 1. (\<forall>x\<in>scf R1 - scf R2. P x) = ((a \<in> scf R2 \<or> a \<notin> scf R1 \<or> P a) \<and> (b \<in> scf R2 \<or> b \<notin> scf R1 \<or> P b) \<and> (c \<in> scf R2 \<or> c \<notin> scf R1 \<or> P c))
[PROOF STEP]
by blast


[STATEMENT]
lemma changes_map_sgn_eq:
  "changes xs = changes (map sgn xs)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. changes xs = changes (map sgn xs)
[PROOF STEP]
proof (induct xs rule:changes.induct)
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. changes [] = changes (map sgn [])
 2. \<And>uu_. changes [uu_] = changes (map sgn [uu_])
 3. \<And>x1 x2 xs. \<lbrakk>x1 * x2 < (0::'a) \<Longrightarrow> changes (x2 # xs) = changes (map sgn (x2 # xs)); \<lbrakk>\<not> x1 * x2 < (0::'a); x2 = (0::'a)\<rbrakk> \<Longrightarrow> changes (x1 # xs) = changes (map sgn (x1 # xs)); \<lbrakk>\<not> x1 * x2 < (0::'a); x2 \<noteq> (0::'a)\<rbrakk> \<Longrightarrow> changes (x2 # xs) = changes (map sgn (x2 # xs))\<rbrakk> \<Longrightarrow> changes (x1 # x2 # xs) = changes (map sgn (x1 # x2 # xs))
[PROOF STEP]
case (3 x1 x2 xs)
[PROOF STATE]
proof (state)
this:
x1 * x2 < (0::'a) \<Longrightarrow> changes (x2 # xs) = changes (map sgn (x2 # xs))
\<lbrakk>\<not> x1 * x2 < (0::'a); x2 = (0::'a)\<rbrakk> \<Longrightarrow> changes (x1 # xs) = changes (map sgn (x1 # xs))
\<lbrakk>\<not> x1 * x2 < (0::'a); x2 \<noteq> (0::'a)\<rbrakk> \<Longrightarrow> changes (x2 # xs) = changes (map sgn (x2 # xs))

goal (3 subgoals):
 1. changes [] = changes (map sgn [])
 2. \<And>uu_. changes [uu_] = changes (map sgn [uu_])
 3. \<And>x1 x2 xs. \<lbrakk>x1 * x2 < (0::'a) \<Longrightarrow> changes (x2 # xs) = changes (map sgn (x2 # xs)); \<lbrakk>\<not> x1 * x2 < (0::'a); x2 = (0::'a)\<rbrakk> \<Longrightarrow> changes (x1 # xs) = changes (map sgn (x1 # xs)); \<lbrakk>\<not> x1 * x2 < (0::'a); x2 \<noteq> (0::'a)\<rbrakk> \<Longrightarrow> changes (x2 # xs) = changes (map sgn (x2 # xs))\<rbrakk> \<Longrightarrow> changes (x1 # x2 # xs) = changes (map sgn (x1 # x2 # xs))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
x1 * x2 < (0::'a) \<Longrightarrow> changes (x2 # xs) = changes (map sgn (x2 # xs))
\<lbrakk>\<not> x1 * x2 < (0::'a); x2 = (0::'a)\<rbrakk> \<Longrightarrow> changes (x1 # xs) = changes (map sgn (x1 # xs))
\<lbrakk>\<not> x1 * x2 < (0::'a); x2 \<noteq> (0::'a)\<rbrakk> \<Longrightarrow> changes (x2 # xs) = changes (map sgn (x2 # xs))

goal (3 subgoals):
 1. changes [] = changes (map sgn [])
 2. \<And>uu_. changes [uu_] = changes (map sgn [uu_])
 3. \<And>x1 x2 xs. \<lbrakk>x1 * x2 < (0::'a) \<Longrightarrow> changes (x2 # xs) = changes (map sgn (x2 # xs)); \<lbrakk>\<not> x1 * x2 < (0::'a); x2 = (0::'a)\<rbrakk> \<Longrightarrow> changes (x1 # xs) = changes (map sgn (x1 # xs)); \<lbrakk>\<not> x1 * x2 < (0::'a); x2 \<noteq> (0::'a)\<rbrakk> \<Longrightarrow> changes (x2 # xs) = changes (map sgn (x2 # xs))\<rbrakk> \<Longrightarrow> changes (x1 # x2 # xs) = changes (map sgn (x1 # x2 # xs))
[PROOF STEP]
have "x1*x2<0 \<longleftrightarrow> sgn x1 * sgn x2 < 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (x1 * x2 < (0::'a)) = (sgn x1 * sgn x2 < (0::'a))
[PROOF STEP]
by (unfold mult_less_0_iff sgn_less sgn_greater,simp)
[PROOF STATE]
proof (state)
this:
(x1 * x2 < (0::'a)) = (sgn x1 * sgn x2 < (0::'a))

goal (3 subgoals):
 1. changes [] = changes (map sgn [])
 2. \<And>uu_. changes [uu_] = changes (map sgn [uu_])
 3. \<And>x1 x2 xs. \<lbrakk>x1 * x2 < (0::'a) \<Longrightarrow> changes (x2 # xs) = changes (map sgn (x2 # xs)); \<lbrakk>\<not> x1 * x2 < (0::'a); x2 = (0::'a)\<rbrakk> \<Longrightarrow> changes (x1 # xs) = changes (map sgn (x1 # xs)); \<lbrakk>\<not> x1 * x2 < (0::'a); x2 \<noteq> (0::'a)\<rbrakk> \<Longrightarrow> changes (x2 # xs) = changes (map sgn (x2 # xs))\<rbrakk> \<Longrightarrow> changes (x1 # x2 # xs) = changes (map sgn (x1 # x2 # xs))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(x1 * x2 < (0::'a)) = (sgn x1 * sgn x2 < (0::'a))

goal (3 subgoals):
 1. changes [] = changes (map sgn [])
 2. \<And>uu_. changes [uu_] = changes (map sgn [uu_])
 3. \<And>x1 x2 xs. \<lbrakk>x1 * x2 < (0::'a) \<Longrightarrow> changes (x2 # xs) = changes (map sgn (x2 # xs)); \<lbrakk>\<not> x1 * x2 < (0::'a); x2 = (0::'a)\<rbrakk> \<Longrightarrow> changes (x1 # xs) = changes (map sgn (x1 # xs)); \<lbrakk>\<not> x1 * x2 < (0::'a); x2 \<noteq> (0::'a)\<rbrakk> \<Longrightarrow> changes (x2 # xs) = changes (map sgn (x2 # xs))\<rbrakk> \<Longrightarrow> changes (x1 # x2 # xs) = changes (map sgn (x1 # x2 # xs))
[PROOF STEP]
have "x2=0 \<longleftrightarrow> sgn x2 =0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (x2 = (0::'a)) = (sgn x2 = (0::'a))
[PROOF STEP]
by (rule sgn_0_0[symmetric])
[PROOF STATE]
proof (state)
this:
(x2 = (0::'a)) = (sgn x2 = (0::'a))

goal (3 subgoals):
 1. changes [] = changes (map sgn [])
 2. \<And>uu_. changes [uu_] = changes (map sgn [uu_])
 3. \<And>x1 x2 xs. \<lbrakk>x1 * x2 < (0::'a) \<Longrightarrow> changes (x2 # xs) = changes (map sgn (x2 # xs)); \<lbrakk>\<not> x1 * x2 < (0::'a); x2 = (0::'a)\<rbrakk> \<Longrightarrow> changes (x1 # xs) = changes (map sgn (x1 # xs)); \<lbrakk>\<not> x1 * x2 < (0::'a); x2 \<noteq> (0::'a)\<rbrakk> \<Longrightarrow> changes (x2 # xs) = changes (map sgn (x2 # xs))\<rbrakk> \<Longrightarrow> changes (x1 # x2 # xs) = changes (map sgn (x1 # x2 # xs))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
x1 * x2 < (0::'a) \<Longrightarrow> changes (x2 # xs) = changes (map sgn (x2 # xs))
\<lbrakk>\<not> x1 * x2 < (0::'a); x2 = (0::'a)\<rbrakk> \<Longrightarrow> changes (x1 # xs) = changes (map sgn (x1 # xs))
\<lbrakk>\<not> x1 * x2 < (0::'a); x2 \<noteq> (0::'a)\<rbrakk> \<Longrightarrow> changes (x2 # xs) = changes (map sgn (x2 # xs))
(x1 * x2 < (0::'a)) = (sgn x1 * sgn x2 < (0::'a))
(x2 = (0::'a)) = (sgn x2 = (0::'a))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
x1 * x2 < (0::'a) \<Longrightarrow> changes (x2 # xs) = changes (map sgn (x2 # xs))
\<lbrakk>\<not> x1 * x2 < (0::'a); x2 = (0::'a)\<rbrakk> \<Longrightarrow> changes (x1 # xs) = changes (map sgn (x1 # xs))
\<lbrakk>\<not> x1 * x2 < (0::'a); x2 \<noteq> (0::'a)\<rbrakk> \<Longrightarrow> changes (x2 # xs) = changes (map sgn (x2 # xs))
(x1 * x2 < (0::'a)) = (sgn x1 * sgn x2 < (0::'a))
(x2 = (0::'a)) = (sgn x2 = (0::'a))

goal (1 subgoal):
 1. changes (x1 # x2 # xs) = changes (map sgn (x1 # x2 # xs))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
changes (x1 # x2 # xs) = changes (map sgn (x1 # x2 # xs))

goal (2 subgoals):
 1. changes [] = changes (map sgn [])
 2. \<And>uu_. changes [uu_] = changes (map sgn [uu_])
[PROOF STEP]
qed simp_all


[STATEMENT]
lemma pt_Collect_eqvt:
  fixes pi::"'x prm"
  assumes pt: "pt TYPE('a) TYPE('x)"
  and     at: "at TYPE('x)"
  shows "pi\<bullet>{x::'a. P x} = {x. P ((rev pi)\<bullet>x)}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pi \<bullet> {x. P x} = {x. P (rev pi \<bullet> x)}
[PROOF STEP]
apply(auto simp add: perm_set_def pt_rev_pi[OF pt, OF at])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. P (rev pi \<bullet> x) \<Longrightarrow> \<exists>xa. x = pi \<bullet> xa \<and> P xa
[PROOF STEP]
apply(rule_tac x="(rev pi)\<bullet>x" in exI)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. P (rev pi \<bullet> x) \<Longrightarrow> x = pi \<bullet> rev pi \<bullet> x \<and> P (rev pi \<bullet> x)
[PROOF STEP]
apply(simp add: pt_pi_rev[OF pt, OF at])
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done

\<comment> \<open>some helper lemmas for the pt_perm_supp_ineq lemma\<close>


[STATEMENT]
lemma bigtheta_powr_0 [landau_simp]:
  "eventually (\<lambda>x. (f x :: real) \<noteq> 0) F \<Longrightarrow> (\<lambda>x. f x powr 0) \<in> \<Theta>[F](\<lambda>_. 1)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>\<^sub>F x in F. f x \<noteq> 0 \<Longrightarrow> (\<lambda>x. f x powr 0) \<in> \<Theta>[F](\<lambda>_. 1)
[PROOF STEP]
by (intro bigthetaI_cong) (auto elim!: eventually_mono)


[STATEMENT]
lemma AS_VALID_MPLS_VALID:
  fixes PROB as
  assumes "(as \<in> valid_plans PROB)"
  shows "(Inf (PLS s as) \<in> MPLS_s PROB s)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Inf (PLS s as) \<in> MPLS_s PROB s
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
as \<in> valid_plans PROB

goal (1 subgoal):
 1. Inf (PLS s as) \<in> MPLS_s PROB s
[PROOF STEP]
unfolding MPLS_s_def
[PROOF STATE]
proof (prove)
using this:
as \<in> valid_plans PROB

goal (1 subgoal):
 1. Inf (PLS s as) \<in> (\<lambda>(s, as). Inf (PLS s as)) ` {(s, as) |as. as \<in> valid_plans PROB}
[PROOF STEP]
by fast

\<comment> \<open>NOTE moved up because it's used in the following lemma.\<close>
\<comment> \<open>NOTE type of `s` had to be fixed for 'in\_PLS\_leq\_2\_pow\_n'.\<close>


[STATEMENT]
lemma uniPPV_uniPPc: "unique_PPV V \<Longrightarrow> (\<forall>i < length V. unique_PPc (V!i))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. unique_PPV V \<Longrightarrow> \<forall>i<length V. unique_PPc (V ! i)
[PROOF STEP]
by (auto, simp add: unique_PPV_def, induct V,
    auto simp add: unique_PPc_def,
    metis in_set_conv_nth length_Suc_conv set_ConsD)

\<comment> \<open>SEMANTICS\<close>


[STATEMENT]
lemma pivot_rvars: "\<lbrakk>\<triangle> (\<T> s); x\<^sub>i \<in> lvars (\<T> s); x\<^sub>j \<in> rvars_of_lvar (\<T> s) x\<^sub>i\<rbrakk> \<Longrightarrow> rvars (\<T> (pivot x\<^sub>i x\<^sub>j s)) = rvars (\<T> s) - {x\<^sub>j} \<union> {x\<^sub>i}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<triangle> (\<T> s); x\<^sub>i \<in> lvars (\<T> s); x\<^sub>j \<in> rvars_eq (eq_for_lvar (\<T> s) x\<^sub>i)\<rbrakk> \<Longrightarrow> rvars (\<T> (pivot x\<^sub>i x\<^sub>j s)) = rvars (\<T> s) - {x\<^sub>j} \<union> {x\<^sub>i}
[PROOF STEP]
using pivot_vars'
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<triangle> (\<T> ?s); ?x\<^sub>i \<in> lvars (\<T> ?s); ?x\<^sub>j \<in> rvars_eq (eq_for_lvar (\<T> ?s) ?x\<^sub>i)\<rbrakk> \<Longrightarrow> let s' = pivot ?x\<^sub>i ?x\<^sub>j ?s in rvars (\<T> s') = rvars (\<T> ?s) - {?x\<^sub>j} \<union> {?x\<^sub>i} \<and> lvars (\<T> s') = lvars (\<T> ?s) - {?x\<^sub>i} \<union> {?x\<^sub>j}

goal (1 subgoal):
 1. \<lbrakk>\<triangle> (\<T> s); x\<^sub>i \<in> lvars (\<T> s); x\<^sub>j \<in> rvars_eq (eq_for_lvar (\<T> s) x\<^sub>i)\<rbrakk> \<Longrightarrow> rvars (\<T> (pivot x\<^sub>i x\<^sub>j s)) = rvars (\<T> s) - {x\<^sub>j} \<union> {x\<^sub>i}
[PROOF STEP]
by (simp add: Let_def)


[STATEMENT]
lemma fcard0_if_le1_not_singleton: "\<lbrakk>\<forall>x. xs \<noteq> {|x|}; fcard xs \<le> 1\<rbrakk> \<Longrightarrow> fcard xs = 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<forall>x. xs \<noteq> {|x|}; fcard xs \<le> 1\<rbrakk> \<Longrightarrow> fcard xs = 0
[PROOF STEP]
using fcard_single_1_iff[of xs]
[PROOF STATE]
proof (prove)
using this:
(fcard xs = 1) = (\<exists>x. xs = {|x|})

goal (1 subgoal):
 1. \<lbrakk>\<forall>x. xs \<noteq> {|x|}; fcard xs \<le> 1\<rbrakk> \<Longrightarrow> fcard xs = 0
[PROOF STEP]
by fastforce


[STATEMENT]
lemma slow_median_correct: "slow_median xs = median xs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. slow_median xs = median xs
[PROOF STEP]
by (simp add: median_def slow_median_def slow_select_correct)


[STATEMENT]
lemma un_assoc: "consec i j \<and> consec j k \<longrightarrow> (i \<squnion> j) \<squnion> k = i \<squnion> (j \<squnion> k)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. consec i j \<and> consec j k \<longrightarrow> (i \<squnion> j) \<squnion> k = i \<squnion> (j \<squnion> k)
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. consec i j \<and> consec j k \<Longrightarrow> (i \<squnion> j) \<squnion> k = i \<squnion> (j \<squnion> k)
[PROOF STEP]
assume assm:"consec i j \<and> consec j k"
[PROOF STATE]
proof (state)
this:
consec i j \<and> consec j k

goal (1 subgoal):
 1. consec i j \<and> consec j k \<Longrightarrow> (i \<squnion> j) \<squnion> k = i \<squnion> (j \<squnion> k)
[PROOF STEP]
from assm
[PROOF STATE]
proof (chain)
picking this:
consec i j \<and> consec j k
[PROOF STEP]
have 3:"maximum (i \<squnion> j) = maximum j"
[PROOF STATE]
proof (prove)
using this:
consec i j \<and> consec j k

goal (1 subgoal):
 1. maximum (i \<squnion> j) = maximum j
[PROOF STEP]
using nat_int.consec_un_max
[PROOF STATE]
proof (prove)
using this:
consec i j \<and> consec j k
consec ?i ?j \<longrightarrow> maximum ?j = maximum (?i \<squnion> ?j)

goal (1 subgoal):
 1. maximum (i \<squnion> j) = maximum j
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
maximum (i \<squnion> j) = maximum j

goal (1 subgoal):
 1. consec i j \<and> consec j k \<Longrightarrow> (i \<squnion> j) \<squnion> k = i \<squnion> (j \<squnion> k)
[PROOF STEP]
from assm
[PROOF STATE]
proof (chain)
picking this:
consec i j \<and> consec j k
[PROOF STEP]
have 4:"minimum (j \<squnion> k) = minimum (j)"
[PROOF STATE]
proof (prove)
using this:
consec i j \<and> consec j k

goal (1 subgoal):
 1. minimum (j \<squnion> k) = minimum j
[PROOF STEP]
using nat_int.consec_un_min
[PROOF STATE]
proof (prove)
using this:
consec i j \<and> consec j k
consec ?i ?j \<longrightarrow> minimum ?i = minimum (?i \<squnion> ?j)

goal (1 subgoal):
 1. minimum (j \<squnion> k) = minimum j
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
minimum (j \<squnion> k) = minimum j

goal (1 subgoal):
 1. consec i j \<and> consec j k \<Longrightarrow> (i \<squnion> j) \<squnion> k = i \<squnion> (j \<squnion> k)
[PROOF STEP]
have "i \<squnion> j  = Abs_nat_int{minimum i .. maximum j}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. i \<squnion> j = Abs_nat_int {minimum i..maximum j}
[PROOF STEP]
by (metis Rep_nat_int_inverse assm nat_int.consec_un_min_max)
[PROOF STATE]
proof (state)
this:
i \<squnion> j = Abs_nat_int {minimum i..maximum j}

goal (1 subgoal):
 1. consec i j \<and> consec j k \<Longrightarrow> (i \<squnion> j) \<squnion> k = i \<squnion> (j \<squnion> k)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
i \<squnion> j = Abs_nat_int {minimum i..maximum j}
[PROOF STEP]
have 5:"(i \<squnion> j) \<squnion> k = Abs_nat_int{minimum i .. maximum k}"
[PROOF STATE]
proof (prove)
using this:
i \<squnion> j = Abs_nat_int {minimum i..maximum j}

goal (1 subgoal):
 1. (i \<squnion> j) \<squnion> k = Abs_nat_int {minimum i..maximum k}
[PROOF STEP]
by (metis (no_types, opaque_lifting) "3" Rep_nat_int_inverse antisym assm bot.extremum
        nat_int.consec_def nat_int.consec_un_min nat_int.consec_un_min_max nat_int.un_subset1)
[PROOF STATE]
proof (state)
this:
(i \<squnion> j) \<squnion> k = Abs_nat_int {minimum i..maximum k}

goal (1 subgoal):
 1. consec i j \<and> consec j k \<Longrightarrow> (i \<squnion> j) \<squnion> k = i \<squnion> (j \<squnion> k)
[PROOF STEP]
have "j \<squnion> k = Abs_nat_int{minimum j .. maximum k}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. j \<squnion> k = Abs_nat_int {minimum j..maximum k}
[PROOF STEP]
by (metis Rep_nat_int_inverse assm nat_int.consec_un_min_max)
[PROOF STATE]
proof (state)
this:
j \<squnion> k = Abs_nat_int {minimum j..maximum k}

goal (1 subgoal):
 1. consec i j \<and> consec j k \<Longrightarrow> (i \<squnion> j) \<squnion> k = i \<squnion> (j \<squnion> k)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
j \<squnion> k = Abs_nat_int {minimum j..maximum k}
[PROOF STEP]
have 6:"i \<squnion> (j \<squnion> k) = Abs_nat_int{minimum i .. maximum k}"
[PROOF STATE]
proof (prove)
using this:
j \<squnion> k = Abs_nat_int {minimum j..maximum k}

goal (1 subgoal):
 1. i \<squnion> (j \<squnion> k) = Abs_nat_int {minimum i..maximum k}
[PROOF STEP]
by (metis (no_types, opaque_lifting) "4" Rep_nat_int_inverse antisym assm bot.extremum
        nat_int.consec_def nat_int.consec_un_max nat_int.consec_un_min_max nat_int.un_subset2)
[PROOF STATE]
proof (state)
this:
i \<squnion> (j \<squnion> k) = Abs_nat_int {minimum i..maximum k}

goal (1 subgoal):
 1. consec i j \<and> consec j k \<Longrightarrow> (i \<squnion> j) \<squnion> k = i \<squnion> (j \<squnion> k)
[PROOF STEP]
from 5 and 6
[PROOF STATE]
proof (chain)
picking this:
(i \<squnion> j) \<squnion> k = Abs_nat_int {minimum i..maximum k}
i \<squnion> (j \<squnion> k) = Abs_nat_int {minimum i..maximum k}
[PROOF STEP]
show " (i \<squnion> j) \<squnion> k = i \<squnion> (j \<squnion> k)"
[PROOF STATE]
proof (prove)
using this:
(i \<squnion> j) \<squnion> k = Abs_nat_int {minimum i..maximum k}
i \<squnion> (j \<squnion> k) = Abs_nat_int {minimum i..maximum k}

goal (1 subgoal):
 1. (i \<squnion> j) \<squnion> k = i \<squnion> (j \<squnion> k)
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
(i \<squnion> j) \<squnion> k = i \<squnion> (j \<squnion> k)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma nth_dec_above:
  assumes "length xs = i" "length ys = j" "k \<notin> {i..<i+j}"
  shows "nth_default 0 (xs @ zs) (dec_above i j k) = (nth_default 0 (xs @ ys @ zs)) k"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. nth_default (0::'a) (xs @ zs) (dec_above i j k) = nth_default (0::'a) (xs @ ys @ zs) k
[PROOF STEP]
using assms dec_above_def nth_append add.commute
[PROOF STATE]
proof (prove)
using this:
length xs = i
length ys = j
k \<notin> {i..<i + j}
dec_above ?b ?i ?x = (if ?x \<le> ?b then ?x else ?x - ?i)
(?xs @ ?ys) ! ?n = (if ?n < length ?xs then ?xs ! ?n else ?ys ! (?n - length ?xs))
?a + ?b = ?b + ?a

goal (1 subgoal):
 1. nth_default (0::'a) (xs @ zs) (dec_above i j k) = nth_default (0::'a) (xs @ ys @ zs) k
[PROOF STEP]
by (smt add_diff_cancel_left add_le_cancel_left add_strict_increasing append_Nil2 atLeastLessThan_iff le_add_diff_inverse length_append length_greater_0_conv less_imp_le_nat not_less nth_default_append)


[STATEMENT]
lemma not_coin_flip: "map_spmf (\<lambda> a. \<not> a) coin_spmf = coin_spmf"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. map_spmf Not coin_spmf = coin_spmf
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. map_spmf Not coin_spmf = coin_spmf
[PROOF STEP]
have "inj_on Not {True, False}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. inj_on Not {True, False}
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
inj_on Not {True, False}

goal (1 subgoal):
 1. map_spmf Not coin_spmf = coin_spmf
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
inj_on Not {True, False}

goal (1 subgoal):
 1. map_spmf Not coin_spmf = coin_spmf
[PROOF STEP]
have  "Not ` {True, False} = {True, False}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Not ` {True, False} = {True, False}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Not ` {True, False} = {True, False}

goal (1 subgoal):
 1. map_spmf Not coin_spmf = coin_spmf
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
inj_on Not {True, False}
Not ` {True, False} = {True, False}
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
inj_on Not {True, False}
Not ` {True, False} = {True, False}

goal (1 subgoal):
 1. map_spmf Not coin_spmf = coin_spmf
[PROOF STEP]
using one_time_pad
[PROOF STATE]
proof (prove)
using this:
inj_on Not {True, False}
Not ` {True, False} = {True, False}
\<lbrakk>inj_on ?f {..<?q}; ?f ` {..<?q} = {..<?q}\<rbrakk> \<Longrightarrow> map_spmf ?f (sample_uniform ?q) = sample_uniform ?q

goal (1 subgoal):
 1. map_spmf Not coin_spmf = coin_spmf
[PROOF STEP]
by (simp add: UNIV_bool)
[PROOF STATE]
proof (state)
this:
map_spmf Not coin_spmf = coin_spmf

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma id_imp_bij_betw:
  assumes f: "f : A \<rightarrow> A"
      and ff: "\<And>a. a \<in> A \<Longrightarrow> f (f a) = a"
  shows "bij_betw f A A"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. bij_betw f A A
[PROOF STEP]
by (intro bij_betwI[OF f f], simp_all add: ff)


[STATEMENT]
lemma mono2mono_ennreal_add[THEN lfp.mono2mono2, cont_intro, simp]:
  shows monotone_eadd: "monotone (rel_prod (\<le>) (\<le>)) (\<le>) (\<lambda>(x, y). x + y :: ennreal)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. monotone (rel_prod (\<le>) (\<le>)) (\<le>) (\<lambda>(x, y). x + y)
[PROOF STEP]
by(simp add: monotone_ennreal_add1 monotone_ennreal_add2)


[STATEMENT]
lemma nonzero_alphaprod: assumes "i \<le> k + 1" shows "(\<Prod>l\<leftarrow>[3..<i]. \<alpha> l ^ (p l)) \<noteq> 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Prod>l\<leftarrow>[3..<i]. \<alpha> l ^ p l) \<noteq> 0
[PROOF STEP]
unfolding prod_list_zero_iff
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 \<notin> set (map (\<lambda>l. \<alpha> l ^ p l) [3..<i])
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
i \<le> k + 1

goal (1 subgoal):
 1. 0 \<notin> set (map (\<lambda>l. \<alpha> l ^ p l) [3..<i])
[PROOF STEP]
by (auto simp: \<alpha>0)


[STATEMENT]
lemma dghm_comp_ObjMap_vdomain[dg_cs_simps]:
  assumes "\<GG> : \<BB> \<mapsto>\<mapsto>\<^sub>D\<^sub>G\<^bsub>\<alpha>\<^esub> \<CC>" and "\<FF> : \<AA> \<mapsto>\<mapsto>\<^sub>D\<^sub>G\<^bsub>\<alpha>\<^esub> \<BB>"
  shows "\<D>\<^sub>\<circ> ((\<GG> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<FF>)\<lparr>ObjMap\<rparr>) = \<AA>\<lparr>Obj\<rparr>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<D>\<^sub>\<circ> ((\<GG> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<FF>)\<lparr>ObjMap\<rparr>) = \<AA>\<lparr>Obj\<rparr>
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
\<GG> : \<BB> \<mapsto>\<mapsto>\<^sub>D\<^sub>G\<^bsub>\<alpha>\<^esub> \<CC>
\<FF> : \<AA> \<mapsto>\<mapsto>\<^sub>D\<^sub>G\<^bsub>\<alpha>\<^esub> \<BB>

goal (1 subgoal):
 1. \<D>\<^sub>\<circ> ((\<GG> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<FF>)\<lparr>ObjMap\<rparr>) = \<AA>\<lparr>Obj\<rparr>
[PROOF STEP]
by
    (
      cs_concl
        cs_simp: dghm_comp_components dg_cs_simps V_cs_simps
        cs_intro: is_dghm.dghm_ObjMap_vrange
    )


[STATEMENT]
lemma infsetsum_nonneg_is_SUPREMUM_ereal:
  fixes f :: "'a \<Rightarrow> real"
  assumes summable: "f abs_summable_on A"
    and fnn: "\<And>x. x\<in>A \<Longrightarrow> f x \<ge> 0"
  shows "ereal (infsetsum f A) = (SUP F\<in>{F. finite F \<and> F \<subseteq> A}. (ereal (sum f F)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ereal (infsetsum f A) = (SUP F\<in>{F. finite F \<and> F \<subseteq> A}. ereal (sum f F))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. ereal (infsetsum f A) = (SUP F\<in>{F. finite F \<and> F \<subseteq> A}. ereal (sum f F))
[PROOF STEP]
have "ereal (infsetsum f A) = enn2ereal (ennreal (infsetsum f A))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ereal (infsetsum f A) = enn2ereal (ennreal (infsetsum f A))
[PROOF STEP]
by (simp add: fnn infsetsum_nonneg)
[PROOF STATE]
proof (state)
this:
ereal (infsetsum f A) = enn2ereal (ennreal (infsetsum f A))

goal (1 subgoal):
 1. ereal (infsetsum f A) = (SUP F\<in>{F. finite F \<and> F \<subseteq> A}. ereal (sum f F))
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
ereal (infsetsum f A) = enn2ereal (ennreal (infsetsum f A))

goal (1 subgoal):
 1. ereal (infsetsum f A) = (SUP F\<in>{F. finite F \<and> F \<subseteq> A}. ereal (sum f F))
[PROOF STEP]
have "\<dots> = enn2ereal (SUP F\<in>{F. finite F \<and> F \<subseteq> A}. ennreal (sum f F))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. enn2ereal (ennreal (infsetsum f A)) = enn2ereal (SUP F\<in>{F. finite F \<and> F \<subseteq> A}. ennreal (sum f F))
[PROOF STEP]
apply (subst infsetsum_nonneg_is_SUPREMUM_ennreal)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. f abs_summable_on A
 2. \<And>x. x \<in> A \<Longrightarrow> 0 \<le> f x
 3. enn2ereal (SUP F\<in>{F. finite F \<and> F \<subseteq> A}. ennreal (sum f F)) = enn2ereal (SUP F\<in>{F. finite F \<and> F \<subseteq> A}. ennreal (sum f F))
[PROOF STEP]
using fnn
[PROOF STATE]
proof (prove)
using this:
?x \<in> A \<Longrightarrow> 0 \<le> f ?x

goal (3 subgoals):
 1. f abs_summable_on A
 2. \<And>x. x \<in> A \<Longrightarrow> 0 \<le> f x
 3. enn2ereal (SUP F\<in>{F. finite F \<and> F \<subseteq> A}. ennreal (sum f F)) = enn2ereal (SUP F\<in>{F. finite F \<and> F \<subseteq> A}. ennreal (sum f F))
[PROOF STEP]
by (auto simp add: local.summable)
[PROOF STATE]
proof (state)
this:
enn2ereal (ennreal (infsetsum f A)) = enn2ereal (SUP F\<in>{F. finite F \<and> F \<subseteq> A}. ennreal (sum f F))

goal (1 subgoal):
 1. ereal (infsetsum f A) = (SUP F\<in>{F. finite F \<and> F \<subseteq> A}. ereal (sum f F))
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
enn2ereal (ennreal (infsetsum f A)) = enn2ereal (SUP F\<in>{F. finite F \<and> F \<subseteq> A}. ennreal (sum f F))

goal (1 subgoal):
 1. ereal (infsetsum f A) = (SUP F\<in>{F. finite F \<and> F \<subseteq> A}. ereal (sum f F))
[PROOF STEP]
have "\<dots> = (SUP F\<in>{F. finite F \<and> F \<subseteq> A}. (ereal (sum f F)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. enn2ereal (SUP F\<in>{F. finite F \<and> F \<subseteq> A}. ennreal (sum f F)) = (SUP F\<in>{F. finite F \<and> F \<subseteq> A}. ereal (sum f F))
[PROOF STEP]
proof (simp add: image_def Sup_ennreal.rep_eq)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. max 0 (Sup {y. \<exists>x. (\<exists>xa. finite xa \<and> xa \<subseteq> A \<and> x = ennreal (sum f xa)) \<and> y = enn2ereal x}) = Sup {y. \<exists>x. finite x \<and> x \<subseteq> A \<and> y = ereal (sum f x)}
[PROOF STEP]
have "0 \<le> Sup {y. \<exists>x. (\<exists>xa. finite xa \<and> xa \<subseteq> A \<and> x = ennreal (sum f xa)) \<and>
                     y = enn2ereal x}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 \<le> Sup {y. \<exists>x. (\<exists>xa. finite xa \<and> xa \<subseteq> A \<and> x = ennreal (sum f xa)) \<and> y = enn2ereal x}
[PROOF STEP]
by (metis (mono_tags, lifting) Sup_upper empty_subsetI ennreal_0 finite.emptyI
          mem_Collect_eq sum.empty zero_ennreal.rep_eq)
[PROOF STATE]
proof (state)
this:
0 \<le> Sup {y. \<exists>x. (\<exists>xa. finite xa \<and> xa \<subseteq> A \<and> x = ennreal (sum f xa)) \<and> y = enn2ereal x}

goal (1 subgoal):
 1. max 0 (Sup {y. \<exists>x. (\<exists>xa. finite xa \<and> xa \<subseteq> A \<and> x = ennreal (sum f xa)) \<and> y = enn2ereal x}) = Sup {y. \<exists>x. finite x \<and> x \<subseteq> A \<and> y = ereal (sum f x)}
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
0 \<le> Sup {y. \<exists>x. (\<exists>xa. finite xa \<and> xa \<subseteq> A \<and> x = ennreal (sum f xa)) \<and> y = enn2ereal x}

goal (1 subgoal):
 1. max 0 (Sup {y. \<exists>x. (\<exists>xa. finite xa \<and> xa \<subseteq> A \<and> x = ennreal (sum f xa)) \<and> y = enn2ereal x}) = Sup {y. \<exists>x. finite x \<and> x \<subseteq> A \<and> y = ereal (sum f x)}
[PROOF STEP]
have "(\<exists>x. (\<exists>y. finite y \<and> y \<subseteq> A \<and> x = ennreal (sum f y)) \<and> y = enn2ereal x) =
                   (\<exists>x. finite x \<and> x \<subseteq> A \<and> y = ereal (sum f x))" for y
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<exists>x. (\<exists>y. finite y \<and> y \<subseteq> A \<and> x = ennreal (sum f y)) \<and> y = enn2ereal x) = (\<exists>x. finite x \<and> x \<subseteq> A \<and> y = ereal (sum f x))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (\<exists>x. (\<exists>y. finite y \<and> y \<subseteq> A \<and> x = ennreal (sum f y)) \<and> y = enn2ereal x) = (\<exists>x. finite x \<and> x \<subseteq> A \<and> y = ereal (sum f x))
[PROOF STEP]
have "(\<exists>x. (\<exists>y. finite y \<and> y \<subseteq> A \<and> x = ennreal (sum f y)) \<and> y = enn2ereal x) \<longleftrightarrow>
            (\<exists>X x. finite X \<and> X \<subseteq> A \<and> x = ennreal (sum f X) \<and> y = enn2ereal x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<exists>x. (\<exists>y. finite y \<and> y \<subseteq> A \<and> x = ennreal (sum f y)) \<and> y = enn2ereal x) = (\<exists>X x. finite X \<and> X \<subseteq> A \<and> x = ennreal (sum f X) \<and> y = enn2ereal x)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(\<exists>x. (\<exists>y. finite y \<and> y \<subseteq> A \<and> x = ennreal (sum f y)) \<and> y = enn2ereal x) = (\<exists>X x. finite X \<and> X \<subseteq> A \<and> x = ennreal (sum f X) \<and> y = enn2ereal x)

goal (1 subgoal):
 1. (\<exists>x. (\<exists>y. finite y \<and> y \<subseteq> A \<and> x = ennreal (sum f y)) \<and> y = enn2ereal x) = (\<exists>x. finite x \<and> x \<subseteq> A \<and> y = ereal (sum f x))
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(\<exists>x. (\<exists>y. finite y \<and> y \<subseteq> A \<and> x = ennreal (sum f y)) \<and> y = enn2ereal x) = (\<exists>X x. finite X \<and> X \<subseteq> A \<and> x = ennreal (sum f X) \<and> y = enn2ereal x)

goal (1 subgoal):
 1. (\<exists>x. (\<exists>y. finite y \<and> y \<subseteq> A \<and> x = ennreal (sum f y)) \<and> y = enn2ereal x) = (\<exists>x. finite x \<and> x \<subseteq> A \<and> y = ereal (sum f x))
[PROOF STEP]
have "\<dots> \<longleftrightarrow> (\<exists>X. finite X \<and> X \<subseteq> A \<and> y = ereal (sum f X))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<exists>X x. finite X \<and> X \<subseteq> A \<and> x = ennreal (sum f X) \<and> y = enn2ereal x) = (\<exists>X. finite X \<and> X \<subseteq> A \<and> y = ereal (sum f X))
[PROOF STEP]
by (rule arg_cong[of _ _ Ex])
           (auto simp: fun_eq_iff intro!: enn2ereal_ennreal sum_nonneg enn2ereal_ennreal[symmetric] fnn)
[PROOF STATE]
proof (state)
this:
(\<exists>X x. finite X \<and> X \<subseteq> A \<and> x = ennreal (sum f X) \<and> y = enn2ereal x) = (\<exists>X. finite X \<and> X \<subseteq> A \<and> y = ereal (sum f X))

goal (1 subgoal):
 1. (\<exists>x. (\<exists>y. finite y \<and> y \<subseteq> A \<and> x = ennreal (sum f y)) \<and> y = enn2ereal x) = (\<exists>x. finite x \<and> x \<subseteq> A \<and> y = ereal (sum f x))
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
(\<exists>x. (\<exists>y. finite y \<and> y \<subseteq> A \<and> x = ennreal (sum f y)) \<and> y = enn2ereal x) = (\<exists>X. finite X \<and> X \<subseteq> A \<and> y = ereal (sum f X))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
(\<exists>x. (\<exists>y. finite y \<and> y \<subseteq> A \<and> x = ennreal (sum f y)) \<and> y = enn2ereal x) = (\<exists>X. finite X \<and> X \<subseteq> A \<and> y = ereal (sum f X))

goal (1 subgoal):
 1. (\<exists>x. (\<exists>y. finite y \<and> y \<subseteq> A \<and> x = ennreal (sum f y)) \<and> y = enn2ereal x) = (\<exists>x. finite x \<and> x \<subseteq> A \<and> y = ereal (sum f x))
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
(\<exists>x. (\<exists>y. finite y \<and> y \<subseteq> A \<and> x = ennreal (sum f y)) \<and> y = enn2ereal x) = (\<exists>x. finite x \<and> x \<subseteq> A \<and> y = ereal (sum f x))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
(\<exists>x. (\<exists>y. finite y \<and> y \<subseteq> A \<and> x = ennreal (sum f y)) \<and> ?y = enn2ereal x) = (\<exists>x. finite x \<and> x \<subseteq> A \<and> ?y = ereal (sum f x))

goal (1 subgoal):
 1. max 0 (Sup {y. \<exists>x. (\<exists>xa. finite xa \<and> xa \<subseteq> A \<and> x = ennreal (sum f xa)) \<and> y = enn2ereal x}) = Sup {y. \<exists>x. finite x \<and> x \<subseteq> A \<and> y = ereal (sum f x)}
[PROOF STEP]
hence "Sup {y. \<exists>x. (\<exists>y. finite y \<and> y \<subseteq> A \<and> x = ennreal (sum f y)) \<and> y = enn2ereal x} =
           Sup {y. \<exists>x. finite x \<and> x \<subseteq> A \<and> y = ereal (sum f x)}"
[PROOF STATE]
proof (prove)
using this:
(\<exists>x. (\<exists>y. finite y \<and> y \<subseteq> A \<and> x = ennreal (sum f y)) \<and> ?y = enn2ereal x) = (\<exists>x. finite x \<and> x \<subseteq> A \<and> ?y = ereal (sum f x))

goal (1 subgoal):
 1. Sup {y. \<exists>x. (\<exists>y. finite y \<and> y \<subseteq> A \<and> x = ennreal (sum f y)) \<and> y = enn2ereal x} = Sup {y. \<exists>x. finite x \<and> x \<subseteq> A \<and> y = ereal (sum f x)}
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
Sup {y. \<exists>x. (\<exists>y. finite y \<and> y \<subseteq> A \<and> x = ennreal (sum f y)) \<and> y = enn2ereal x} = Sup {y. \<exists>x. finite x \<and> x \<subseteq> A \<and> y = ereal (sum f x)}

goal (1 subgoal):
 1. max 0 (Sup {y. \<exists>x. (\<exists>xa. finite xa \<and> xa \<subseteq> A \<and> x = ennreal (sum f xa)) \<and> y = enn2ereal x}) = Sup {y. \<exists>x. finite x \<and> x \<subseteq> A \<and> y = ereal (sum f x)}
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
0 \<le> Sup {y. \<exists>x. (\<exists>xa. finite xa \<and> xa \<subseteq> A \<and> x = ennreal (sum f xa)) \<and> y = enn2ereal x}
Sup {y. \<exists>x. (\<exists>y. finite y \<and> y \<subseteq> A \<and> x = ennreal (sum f y)) \<and> y = enn2ereal x} = Sup {y. \<exists>x. finite x \<and> x \<subseteq> A \<and> y = ereal (sum f x)}
[PROOF STEP]
show "max 0 (Sup {y. \<exists>x. (\<exists>xa. finite xa \<and> xa \<subseteq> A \<and> x
                                       = ennreal (sum f xa)) \<and> y = enn2ereal x})
         = Sup {y. \<exists>x. finite x \<and> x \<subseteq> A \<and> y = ereal (sum f x)}"
[PROOF STATE]
proof (prove)
using this:
0 \<le> Sup {y. \<exists>x. (\<exists>xa. finite xa \<and> xa \<subseteq> A \<and> x = ennreal (sum f xa)) \<and> y = enn2ereal x}
Sup {y. \<exists>x. (\<exists>y. finite y \<and> y \<subseteq> A \<and> x = ennreal (sum f y)) \<and> y = enn2ereal x} = Sup {y. \<exists>x. finite x \<and> x \<subseteq> A \<and> y = ereal (sum f x)}

goal (1 subgoal):
 1. max 0 (Sup {y. \<exists>x. (\<exists>xa. finite xa \<and> xa \<subseteq> A \<and> x = ennreal (sum f xa)) \<and> y = enn2ereal x}) = Sup {y. \<exists>x. finite x \<and> x \<subseteq> A \<and> y = ereal (sum f x)}
[PROOF STEP]
by linarith
[PROOF STATE]
proof (state)
this:
max 0 (Sup {y. \<exists>x. (\<exists>xa. finite xa \<and> xa \<subseteq> A \<and> x = ennreal (sum f xa)) \<and> y = enn2ereal x}) = Sup {y. \<exists>x. finite x \<and> x \<subseteq> A \<and> y = ereal (sum f x)}

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
enn2ereal (SUP F\<in>{F. finite F \<and> F \<subseteq> A}. ennreal (sum f F)) = (SUP F\<in>{F. finite F \<and> F \<subseteq> A}. ereal (sum f F))

goal (1 subgoal):
 1. ereal (infsetsum f A) = (SUP F\<in>{F. finite F \<and> F \<subseteq> A}. ereal (sum f F))
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
ereal (infsetsum f A) = (SUP F\<in>{F. finite F \<and> F \<subseteq> A}. ereal (sum f F))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
ereal (infsetsum f A) = (SUP F\<in>{F. finite F \<and> F \<subseteq> A}. ereal (sum f F))

goal (1 subgoal):
 1. ereal (infsetsum f A) = (SUP F\<in>{F. finite F \<and> F \<subseteq> A}. ereal (sum f F))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
ereal (infsetsum f A) = (SUP F\<in>{F. finite F \<and> F \<subseteq> A}. ereal (sum f F))

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma measurable_count_space_eq2:
  "finite A \<Longrightarrow> f \<in> measurable M (count_space A) \<longleftrightarrow> (f \<in> space M \<rightarrow> A \<and> (\<forall>a\<in>A. f -` {a} \<inter> space M \<in> sets M))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. finite A \<Longrightarrow> (f \<in> M \<rightarrow>\<^sub>M count_space A) = (f \<in> space M \<rightarrow> A \<and> (\<forall>a\<in>A. f -` {a} \<inter> space M \<in> sets M))
[PROOF STEP]
by (intro measurable_count_space_eq_countable countable_finite)


[STATEMENT]
lemma knights_path_min2: "knights_path (board n m) ps \<Longrightarrow> min2 ps = 1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. knights_path (board n m) ps \<Longrightarrow> min2 ps = 1
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. knights_path (board n m) ps \<Longrightarrow> min2 ps = 1
[PROOF STEP]
assume assms: "knights_path (board n m) ps"
[PROOF STATE]
proof (state)
this:
knights_path (board n m) ps

goal (1 subgoal):
 1. knights_path (board n m) ps \<Longrightarrow> min2 ps = 1
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
knights_path (board n m) ps
[PROOF STEP]
have "min n m \<ge> 1"
[PROOF STATE]
proof (prove)
using this:
knights_path (board n m) ps

goal (1 subgoal):
 1. 1 \<le> min n m
[PROOF STEP]
using knights_path_board_m_n_geq_1
[PROOF STATE]
proof (prove)
using this:
knights_path (board n m) ps
knights_path (board ?n ?m) ?ps \<Longrightarrow> 1 \<le> min ?n ?m

goal (1 subgoal):
 1. 1 \<le> min n m
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
1 \<le> min n m

goal (1 subgoal):
 1. knights_path (board n m) ps \<Longrightarrow> min2 ps = 1
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
1 \<le> min n m
[PROOF STEP]
have "(1,1) \<in> board n m" and ge_1: "\<forall>(i,j) \<in> board n m. j \<ge> 1"
[PROOF STATE]
proof (prove)
using this:
1 \<le> min n m

goal (1 subgoal):
 1. (1, 1) \<in> board n m &&& \<forall>(i, j)\<in>board n m. 1 \<le> j
[PROOF STEP]
unfolding board_def
[PROOF STATE]
proof (prove)
using this:
1 \<le> min n m

goal (1 subgoal):
 1. (1, 1) \<in> {(i, j) |i j. 1 \<le> i \<and> i \<le> int n \<and> 1 \<le> j \<and> j \<le> int m} &&& \<forall>(i, j)\<in>{(i, j) |i j. 1 \<le> i \<and> i \<le> int n \<and> 1 \<le> j \<and> j \<le> int m}. 1 \<le> j
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(1, 1) \<in> board n m
\<forall>(i, j)\<in>board n m. 1 \<le> j

goal (1 subgoal):
 1. knights_path (board n m) ps \<Longrightarrow> min2 ps = 1
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(1, 1) \<in> board n m
\<forall>(i, j)\<in>board n m. 1 \<le> j
[PROOF STEP]
have finite: "finite ((snd) ` board n m)" and
          non_empty: "(snd) ` board n m \<noteq> {}" and
          mem_1: "1 \<in> (snd) ` board n m"
[PROOF STATE]
proof (prove)
using this:
(1, 1) \<in> board n m
\<forall>(i, j)\<in>board n m. 1 \<le> j

goal (1 subgoal):
 1. finite (snd ` board n m) &&& snd ` board n m \<noteq> {} &&& 1 \<in> snd ` board n m
[PROOF STEP]
using board_finite
[PROOF STATE]
proof (prove)
using this:
(1, 1) \<in> board n m
\<forall>(i, j)\<in>board n m. 1 \<le> j
finite (board ?n ?m)

goal (1 subgoal):
 1. finite (snd ` board n m) &&& snd ` board n m \<noteq> {} &&& 1 \<in> snd ` board n m
[PROOF STEP]
by auto (metis sndI image_eqI)
[PROOF STATE]
proof (state)
this:
finite (snd ` board n m)
snd ` board n m \<noteq> {}
1 \<in> snd ` board n m

goal (1 subgoal):
 1. knights_path (board n m) ps \<Longrightarrow> min2 ps = 1
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
finite (snd ` board n m)
snd ` board n m \<noteq> {}
1 \<in> snd ` board n m
[PROOF STEP]
have "Min ((snd) ` board n m) = 1"
[PROOF STATE]
proof (prove)
using this:
finite (snd ` board n m)
snd ` board n m \<noteq> {}
1 \<in> snd ` board n m

goal (1 subgoal):
 1. Min (snd ` board n m) = 1
[PROOF STEP]
using ge_1
[PROOF STATE]
proof (prove)
using this:
finite (snd ` board n m)
snd ` board n m \<noteq> {}
1 \<in> snd ` board n m
\<forall>(i, j)\<in>board n m. 1 \<le> j

goal (1 subgoal):
 1. Min (snd ` board n m) = 1
[PROOF STEP]
by (auto simp: Min_eq_iff)
[PROOF STATE]
proof (state)
this:
Min (snd ` board n m) = 1

goal (1 subgoal):
 1. knights_path (board n m) ps \<Longrightarrow> min2 ps = 1
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
Min (snd ` board n m) = 1
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
Min (snd ` board n m) = 1

goal (1 subgoal):
 1. min2 ps = 1
[PROOF STEP]
using assms knights_path_set_eq
[PROOF STATE]
proof (prove)
using this:
Min (snd ` board n m) = 1
knights_path (board n m) ps
knights_path ?b ?ps \<Longrightarrow> set ?ps = ?b

goal (1 subgoal):
 1. min2 ps = 1
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
min2 ps = 1

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma keys_tail: "keys (tail p) = keys p - {lt p}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. keys (tail p) = keys p - {lt p}
[PROOF STEP]
by (simp add: tail_alt keys_except)


[STATEMENT]
lemma lookupNoneAppend[rule_format]:
"\<forall> l L2. (lookup L1 l = None \<longrightarrow> lookup L2 l = None \<longrightarrow> lookup (L1 @ L2) l = None)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>l L2. lookup L1 l = None \<longrightarrow> lookup L2 l = None \<longrightarrow> lookup (L1 @ L2) l = None
[PROOF STEP]
by (induct L1, simp+)


[STATEMENT]
lemma from_FSM_product_initial :
  assumes "q1 \<in> states M" and "q2 \<in> states M"
shows "initial (product (from_FSM M q1) (from_FSM M q2)) = (q1,q2)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. FSM.initial (Product_FSM.product (from_FSM M q1) (from_FSM M q2)) = (q1, q2)
[PROOF STEP]
by (simp add: assms(1) assms(2))


[STATEMENT]
lemma cnj_mult_self:
  assumes "coprime k n"
  shows "cnj (\<chi> k) * \<chi> k = 1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. cnj (\<chi> k) * \<chi> k = 1
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. cnj (\<chi> k) * \<chi> k = 1
[PROOF STEP]
have "cnj (\<chi> k) * \<chi> k = norm (\<chi> k)^2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. cnj (\<chi> k) * \<chi> k = complex_of_real ((cmod (\<chi> k))\<^sup>2)
[PROOF STEP]
by (simp add: mult.commute complex_mult_cnj cmod_def)
[PROOF STATE]
proof (state)
this:
cnj (\<chi> k) * \<chi> k = complex_of_real ((cmod (\<chi> k))\<^sup>2)

goal (1 subgoal):
 1. cnj (\<chi> k) * \<chi> k = 1
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
cnj (\<chi> k) * \<chi> k = complex_of_real ((cmod (\<chi> k))\<^sup>2)

goal (1 subgoal):
 1. cnj (\<chi> k) * \<chi> k = 1
[PROOF STEP]
have "\<dots> = 1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. complex_of_real ((cmod (\<chi> k))\<^sup>2) = 1
[PROOF STEP]
using norm[of k] assms
[PROOF STATE]
proof (prove)
using this:
cmod (\<chi> k) = (if coprime k n then 1 else 0)
coprime k n

goal (1 subgoal):
 1. complex_of_real ((cmod (\<chi> k))\<^sup>2) = 1
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
complex_of_real ((cmod (\<chi> k))\<^sup>2) = 1

goal (1 subgoal):
 1. cnj (\<chi> k) * \<chi> k = 1
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
cnj (\<chi> k) * \<chi> k = 1
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
cnj (\<chi> k) * \<chi> k = 1

goal (1 subgoal):
 1. cnj (\<chi> k) * \<chi> k = 1
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
cnj (\<chi> k) * \<chi> k = 1

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma interp_factorization_reflect:
  assumes "(0::'a::idom) \<notin> fst ` set (snd fctrs)"
  shows   "reflect_poly (interp_factorization fctrs) = interp_alt_factorization fctrs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. reflect_poly (interp_factorization fctrs) = interp_alt_factorization fctrs
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. reflect_poly (interp_factorization fctrs) = interp_alt_factorization fctrs
[PROOF STEP]
have "reflect_poly (interp_factorization fctrs) =
          Polynomial.smult (fst fctrs) (\<Prod>x\<leftarrow>snd fctrs. reflect_poly [:- fst x, 1:] ^ Suc (snd x))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. reflect_poly (interp_factorization fctrs) = smult (fst fctrs) (\<Prod>x\<leftarrow>snd fctrs. reflect_poly [:- fst x, 1::'a:] ^ Suc (snd x))
[PROOF STEP]
by (simp add: interp_factorization_def interp_alt_factorization_def case_prod_unfold
             reflect_poly_smult reflect_poly_prod_list reflect_poly_power o_def del: power_Suc)
[PROOF STATE]
proof (state)
this:
reflect_poly (interp_factorization fctrs) = smult (fst fctrs) (\<Prod>x\<leftarrow>snd fctrs. reflect_poly [:- fst x, 1::'a:] ^ Suc (snd x))

goal (1 subgoal):
 1. reflect_poly (interp_factorization fctrs) = interp_alt_factorization fctrs
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
reflect_poly (interp_factorization fctrs) = smult (fst fctrs) (\<Prod>x\<leftarrow>snd fctrs. reflect_poly [:- fst x, 1::'a:] ^ Suc (snd x))

goal (1 subgoal):
 1. reflect_poly (interp_factorization fctrs) = interp_alt_factorization fctrs
[PROOF STEP]
have "map (\<lambda>x. reflect_poly [:- fst x, 1:] ^ Suc (snd x)) (snd fctrs) =
               map (\<lambda>x. [:1, - fst x:] ^ Suc (snd x)) (snd fctrs)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. map (\<lambda>x. reflect_poly [:- fst x, 1::'a:] ^ Suc (snd x)) (snd fctrs) = map (\<lambda>x. [:1::'a, - fst x:] ^ Suc (snd x)) (snd fctrs)
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
(0::'a) \<notin> fst ` set (snd fctrs)

goal (1 subgoal):
 1. map (\<lambda>x. reflect_poly [:- fst x, 1::'a:] ^ Suc (snd x)) (snd fctrs) = map (\<lambda>x. [:1::'a, - fst x:] ^ Suc (snd x)) (snd fctrs)
[PROOF STEP]
by (intro list.map_cong0, subst reflect_poly_pCons) auto
[PROOF STATE]
proof (state)
this:
map (\<lambda>x. reflect_poly [:- fst x, 1::'a:] ^ Suc (snd x)) (snd fctrs) = map (\<lambda>x. [:1::'a, - fst x:] ^ Suc (snd x)) (snd fctrs)

goal (1 subgoal):
 1. reflect_poly (interp_factorization fctrs) = interp_alt_factorization fctrs
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
map (\<lambda>x. reflect_poly [:- fst x, 1::'a:] ^ Suc (snd x)) (snd fctrs) = map (\<lambda>x. [:1::'a, - fst x:] ^ Suc (snd x)) (snd fctrs)

goal (1 subgoal):
 1. reflect_poly (interp_factorization fctrs) = interp_alt_factorization fctrs
[PROOF STEP]
have "Polynomial.smult (fst fctrs) (prod_list \<dots>) = interp_alt_factorization fctrs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. smult (fst fctrs) (\<Prod>x\<leftarrow>snd fctrs. [:1::'a, - fst x:] ^ Suc (snd x)) = interp_alt_factorization fctrs
[PROOF STEP]
by (simp add: interp_alt_factorization_def case_prod_unfold)
[PROOF STATE]
proof (state)
this:
smult (fst fctrs) (\<Prod>x\<leftarrow>snd fctrs. [:1::'a, - fst x:] ^ Suc (snd x)) = interp_alt_factorization fctrs

goal (1 subgoal):
 1. reflect_poly (interp_factorization fctrs) = interp_alt_factorization fctrs
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
reflect_poly (interp_factorization fctrs) = interp_alt_factorization fctrs
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
reflect_poly (interp_factorization fctrs) = interp_alt_factorization fctrs

goal (1 subgoal):
 1. reflect_poly (interp_factorization fctrs) = interp_alt_factorization fctrs
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
reflect_poly (interp_factorization fctrs) = interp_alt_factorization fctrs

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma proj_poly_syz_sum_list: "proj_poly_syz n (sum_list xs) = sum_list (map (proj_poly_syz n) xs)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. proj_poly_syz n (sum_list xs) = sum_list (map (proj_poly_syz n) xs)
[PROOF STEP]
by (rule fun_sum_list_commute, simp_all add: proj_poly_syz_plus)


[STATEMENT]
lemma inorder_ins:
  "sorted(inorder t) \<Longrightarrow> inorder(ins x t) = ins_list x (inorder t)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Sorted_Less.sorted (Tree2.inorder t) \<Longrightarrow> Tree2.inorder (ins x t) = ins_list x (Tree2.inorder t)
[PROOF STEP]
by(induction x t rule: ins.induct)
  (auto simp: ins_list_simps inorder_baliL inorder_baliR)


[STATEMENT]
lemma vsubset_vunion_left: "(A \<union>\<^sub>\<circ> B) \<subseteq>\<^sub>\<circ> C \<longleftrightarrow> (A \<subseteq>\<^sub>\<circ> C \<and> B \<subseteq>\<^sub>\<circ> C)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (A \<union>\<^sub>\<circ> B \<subseteq>\<^sub>\<circ> C) = (A \<subseteq>\<^sub>\<circ> C \<and> B \<subseteq>\<^sub>\<circ> C)
[PROOF STEP]
by simp


[STATEMENT]
lemma Gets_imp_Says:
     "\<lbrakk>Gets B X \<in> set evs; evs \<in> yahalom\<rbrakk> \<Longrightarrow> \<exists>A. Says A B X \<in> set evs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Gets B X \<in> set evs; evs \<in> yahalom\<rbrakk> \<Longrightarrow> \<exists>A. Says A B X \<in> set evs
[PROOF STEP]
by (erule rev_mp, erule yahalom.induct, auto)


[STATEMENT]
lemma AT_fps_Suc: "AT_fps f (Suc n) = (fps_X - 1) * fps_deriv (AT_fps f n)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. AT_fps f (Suc n) = (fps_X - 1) * fps_deriv (AT_fps f n)
[PROOF STEP]
proof (rule fps_ext)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>na. AT_fps f (Suc n) $ na = ((fps_X - 1) * fps_deriv (AT_fps f n)) $ na
[PROOF STEP]
fix m :: nat
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>na. AT_fps f (Suc n) $ na = ((fps_X - 1) * fps_deriv (AT_fps f n)) $ na
[PROOF STEP]
show "AT_fps f (Suc n) $ m = ((fps_X - 1) * fps_deriv (AT_fps f n)) $ m"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. AT_fps f (Suc n) $ m = ((fps_X - 1) * fps_deriv (AT_fps f n)) $ m
[PROOF STEP]
by (cases m) (simp_all add: AT_fps_def fps_deriv_def algebra_simps)
[PROOF STATE]
proof (state)
this:
AT_fps f (Suc n) $ m = ((fps_X - 1) * fps_deriv (AT_fps f n)) $ m

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma dg_prod_3_ObjI'[dg_prod_cs_intros]:
  assumes "abc = [a, b, c]\<^sub>\<circ>" and "a \<in>\<^sub>\<circ> \<AA>\<lparr>Obj\<rparr>" and "b \<in>\<^sub>\<circ> \<BB>\<lparr>Obj\<rparr>" and "c \<in>\<^sub>\<circ> \<CC>\<lparr>Obj\<rparr>"
  shows "abc \<in>\<^sub>\<circ> (\<AA> \<times>\<^sub>D\<^sub>G\<^sub>3 \<BB> \<times>\<^sub>D\<^sub>G\<^sub>3 \<CC>)\<lparr>Obj\<rparr>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. abc \<in>\<^sub>\<circ> (\<AA> \<times>\<^sub>D\<^sub>G\<^sub>3 \<BB> \<times>\<^sub>D\<^sub>G\<^sub>3 \<CC>)\<lparr>Obj\<rparr>
[PROOF STEP]
using assms(2-4)
[PROOF STATE]
proof (prove)
using this:
a \<in>\<^sub>\<circ> \<AA>\<lparr>Obj\<rparr>
b \<in>\<^sub>\<circ> \<BB>\<lparr>Obj\<rparr>
c \<in>\<^sub>\<circ> \<CC>\<lparr>Obj\<rparr>

goal (1 subgoal):
 1. abc \<in>\<^sub>\<circ> (\<AA> \<times>\<^sub>D\<^sub>G\<^sub>3 \<BB> \<times>\<^sub>D\<^sub>G\<^sub>3 \<CC>)\<lparr>Obj\<rparr>
[PROOF STEP]
unfolding assms(1)
[PROOF STATE]
proof (prove)
using this:
a \<in>\<^sub>\<circ> \<AA>\<lparr>Obj\<rparr>
b \<in>\<^sub>\<circ> \<BB>\<lparr>Obj\<rparr>
c \<in>\<^sub>\<circ> \<CC>\<lparr>Obj\<rparr>

goal (1 subgoal):
 1. [a, b, c]\<^sub>\<circ> \<in>\<^sub>\<circ> (\<AA> \<times>\<^sub>D\<^sub>G\<^sub>3 \<BB> \<times>\<^sub>D\<^sub>G\<^sub>3 \<CC>)\<lparr>Obj\<rparr>
[PROOF STEP]
by (rule dg_prod_3_ObjI)


[STATEMENT]
lemma "\<lbrakk> rbt l; rbt r \<rbrakk> \<Longrightarrow> bheight(join l x r) \<le> max (bheight l) (bheight r) + 1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>rbt l; rbt r\<rbrakk> \<Longrightarrow> bheight (Set2_Join_RBT.join l x r) \<le> max (bheight l) (bheight r) + 1
[PROOF STEP]
using bheight_paint_Black[of "joinL l x r"] bheight_paint_Black[of "joinR l x r"]
  bheight_joinL[of l r x] bheight_joinR[of l r x]
[PROOF STATE]
proof (prove)
using this:
bheight (paint Black (joinL l x r)) \<le> bheight (joinL l x r) + 1
bheight (paint Black (joinR l x r)) \<le> bheight (joinR l x r) + 1
\<lbrakk>invh l; invh r; bheight l \<le> bheight r\<rbrakk> \<Longrightarrow> bheight (joinL l x r) = bheight r
\<lbrakk>invh l; invh r; bheight r \<le> bheight l\<rbrakk> \<Longrightarrow> bheight (joinR l x r) = bheight l

goal (1 subgoal):
 1. \<lbrakk>rbt l; rbt r\<rbrakk> \<Longrightarrow> bheight (Set2_Join_RBT.join l x r) \<le> max (bheight l) (bheight r) + 1
[PROOF STEP]
by(auto simp: max_def rbt_def join_def)


[STATEMENT]
lemma continuous_on_min[continuous_intros]:
  fixes f g :: "'a::topological_space \<Rightarrow> 'b::linorder_topology"
  shows "continuous_on A f \<Longrightarrow> continuous_on A g \<Longrightarrow> continuous_on A (\<lambda>x. min (f x) (g x))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>continuous_on A f; continuous_on A g\<rbrakk> \<Longrightarrow> continuous_on A (\<lambda>x. min (f x) (g x))
[PROOF STEP]
by (auto simp: continuous_on_def intro!: tendsto_min)


[STATEMENT]
lemma swap_id_eq: "Fun.swap a b id x = (if x = a then b else if x = b then a else x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (id \<circ> Transposition.transpose a b) x = (if x = a then b else if x = b then a else x)
[PROOF STEP]
by (simp add: Fun.swap_def)


[STATEMENT]
lemma WHILE_le_rule:
  assumes R0: "(s,s')\<in>R"
  assumes RS: "\<And>W s s'. \<lbrakk>\<And>s s'. (s,s')\<in>R \<Longrightarrow> W s \<le> M s'; (s,s')\<in>R\<rbrakk> \<Longrightarrow>
    do {if b s then bind (f s) W else RETURN s} \<le> M s'"
  shows "WHILE b f s \<le> M s'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. WHILE b f s \<le> M s'
[PROOF STEP]
unfolding WHILE_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. WHILE\<^bsup>\<lambda>_. True\<^esup> b f s \<le> M s'
[PROOF STEP]
apply (rule WHILEI_le_rule[OF R0])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>W s s'. \<lbrakk>\<And>s s'. (s, s') \<in> R \<Longrightarrow> W s \<le> M s'; (s, s') \<in> R\<rbrakk> \<Longrightarrow> ASSERT True \<bind> (\<lambda>_. if b s then f s \<bind> W else RETURN s) \<le> M s'
[PROOF STEP]
apply (simp add: RS)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma finite_subclsS: "finite (subclsS P)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. finite (subclsS P)
[PROOF STEP]
by(rule_tac B = "subcls1 P" in finite_subset,
  auto simp:subclsS_subcls1 finite_subcls1)


[STATEMENT]
lemma ln_concave: "concave_on {0<..} ln"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. concave_on {0<..} ln
[PROOF STEP]
unfolding log_ln
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. concave_on {0<..} (log (exp 1))
[PROOF STEP]
by (simp add: log_concave)


[STATEMENT]
lemma sqrt_rat_ceiling: "sqrt_rat_ceiling x = \<lceil> sqrt (of_rat x) \<rceil>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. sqrt_rat_ceiling x = \<lceil>sqrt (real_of_rat x)\<rceil>
[PROOF STEP]
unfolding sqrt_rat_ceiling_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. root_rat_ceiling 2 x = \<lceil>sqrt (real_of_rat x)\<rceil>
[PROOF STEP]
by (simp add: sqrt_def)


[STATEMENT]
lemma ranking_index: "\<lbrakk> length P = n; set P = {<n} \<rbrakk> \<Longrightarrow> ranking P = map (index P) [0..<length P]"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>length P = n; set P = {<n}\<rbrakk> \<Longrightarrow> ranking P = map (index P) [0..<length P]
[PROOF STEP]
by(simp add: list_eq_iff_nth_eq ranking_def card_distinct nth_rk_of_pref)


[STATEMENT]
lemma out_degree_app_iso_eq':
  assumes "digraph_isomorphism hom" and "u \<in> verts (app_iso hom G)"
  shows "out_degree (app_iso hom G) u = out_degree G (iso_verts (inv_iso hom) u)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. out_degree (app_iso hom G) u = out_degree G (iso_verts (inv_iso hom) u)
[PROOF STEP]
using assms out_degree_app_iso_eq[of hom "iso_verts (inv_iso hom) u"]
[PROOF STATE]
proof (prove)
using this:
digraph_isomorphism hom
u \<in> verts (app_iso hom G)
\<lbrakk>digraph_isomorphism hom; iso_verts (inv_iso hom) u \<in> verts G\<rbrakk> \<Longrightarrow> out_degree (app_iso hom G) (iso_verts hom (iso_verts (inv_iso hom) u)) = out_degree G (iso_verts (inv_iso hom) u)

goal (1 subgoal):
 1. out_degree (app_iso hom G) u = out_degree G (iso_verts (inv_iso hom) u)
[PROOF STEP]
by auto


[STATEMENT]
lemma ref_eq: "((P::('a::ev_eq,'b) action) = Q) = (P \<sqsubseteq> Q & Q \<sqsubseteq> P)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (P = Q) = (P \<sqsubseteq> Q \<and> Q \<sqsubseteq> P)
[PROOF STEP]
apply (rule)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. P = Q \<Longrightarrow> P \<sqsubseteq> Q \<and> Q \<sqsubseteq> P
 2. P \<sqsubseteq> Q \<and> Q \<sqsubseteq> P \<Longrightarrow> P = Q
[PROOF STEP]
apply (simp add: ref_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P \<sqsubseteq> Q \<and> Q \<sqsubseteq> P \<Longrightarrow> P = Q
[PROOF STEP]
apply (auto simp add: ref_def fun_eq_iff relation_of_inject[symmetric])
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done