[STATEMENT]
lemma convex_imp_convex_str_upper_cnt:
  assumes "\<forall>x \<in> carrier. convex (at_least_as_good x carrier relation)"
  shows "convex (at_least_as_good x carrier relation - as_good_as x carrier relation)"
    (is "convex ( ?a - ?b)")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. convex (at_least_as_good x carrier relation - as_good_as x carrier relation)
[PROOF STEP]
proof (rule convexI)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>xa y u v. \<lbrakk>xa \<in> at_least_as_good x carrier relation - as_good_as x carrier relation; y \<in> at_least_as_good x carrier relation - as_good_as x carrier relation; 0 \<le> u; 0 \<le> v; u + v = 1\<rbrakk> \<Longrightarrow> u *\<^sub>R xa + v *\<^sub>R y \<in> at_least_as_good x carrier relation - as_good_as x carrier relation
[PROOF STEP]
fix a y u v
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>xa y u v. \<lbrakk>xa \<in> at_least_as_good x carrier relation - as_good_as x carrier relation; y \<in> at_least_as_good x carrier relation - as_good_as x carrier relation; 0 \<le> u; 0 \<le> v; u + v = 1\<rbrakk> \<Longrightarrow> u *\<^sub>R xa + v *\<^sub>R y \<in> at_least_as_good x carrier relation - as_good_as x carrier relation
[PROOF STEP]
assume as_a: "a \<in> ?a - ?b"
[PROOF STATE]
proof (state)
this:
a \<in> at_least_as_good x carrier relation - as_good_as x carrier relation

goal (1 subgoal):
 1. \<And>xa y u v. \<lbrakk>xa \<in> at_least_as_good x carrier relation - as_good_as x carrier relation; y \<in> at_least_as_good x carrier relation - as_good_as x carrier relation; 0 \<le> u; 0 \<le> v; u + v = 1\<rbrakk> \<Longrightarrow> u *\<^sub>R xa + v *\<^sub>R y \<in> at_least_as_good x carrier relation - as_good_as x carrier relation
[PROOF STEP]
assume as_y: "y \<in> ?a - ?b"
[PROOF STATE]
proof (state)
this:
y \<in> at_least_as_good x carrier relation - as_good_as x carrier relation

goal (1 subgoal):
 1. \<And>xa y u v. \<lbrakk>xa \<in> at_least_as_good x carrier relation - as_good_as x carrier relation; y \<in> at_least_as_good x carrier relation - as_good_as x carrier relation; 0 \<le> u; 0 \<le> v; u + v = 1\<rbrakk> \<Longrightarrow> u *\<^sub>R xa + v *\<^sub>R y \<in> at_least_as_good x carrier relation - as_good_as x carrier relation
[PROOF STEP]
assume reals: "0 \<le> (u::real)" "0 \<le> v" "u + v = 1"
[PROOF STATE]
proof (state)
this:
0 \<le> u
0 \<le> v
u + v = 1

goal (1 subgoal):
 1. \<And>xa y u v. \<lbrakk>xa \<in> at_least_as_good x carrier relation - as_good_as x carrier relation; y \<in> at_least_as_good x carrier relation - as_good_as x carrier relation; 0 \<le> u; 0 \<le> v; u + v = 1\<rbrakk> \<Longrightarrow> u *\<^sub>R xa + v *\<^sub>R y \<in> at_least_as_good x carrier relation - as_good_as x carrier relation
[PROOF STEP]
have cvx: "weak_convex_pref relation "
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. weak_convex_pref relation
[PROOF STEP]
by (meson assms at_least_as_goodD convexI have_rpr
        preference_def rational_preference.axioms(1) weak_convex1I)
[PROOF STATE]
proof (state)
this:
weak_convex_pref relation

goal (1 subgoal):
 1. \<And>xa y u v. \<lbrakk>xa \<in> at_least_as_good x carrier relation - as_good_as x carrier relation; y \<in> at_least_as_good x carrier relation - as_good_as x carrier relation; 0 \<le> u; 0 \<le> v; u + v = 1\<rbrakk> \<Longrightarrow> u *\<^sub>R xa + v *\<^sub>R y \<in> at_least_as_good x carrier relation - as_good_as x carrier relation
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
weak_convex_pref relation
[PROOF STEP]
have a_g_x: "a \<succ>[relation] x"
[PROOF STATE]
proof (prove)
using this:
weak_convex_pref relation

goal (1 subgoal):
 1. a \<succeq> x \<and> (x, a) \<notin> relation
[PROOF STEP]
using as_a
[PROOF STATE]
proof (prove)
using this:
weak_convex_pref relation
a \<in> at_least_as_good x carrier relation - as_good_as x carrier relation

goal (1 subgoal):
 1. a \<succeq> x \<and> (x, a) \<notin> relation
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
a \<succeq> x \<and> (x, a) \<notin> relation

goal (1 subgoal):
 1. \<And>xa y u v. \<lbrakk>xa \<in> at_least_as_good x carrier relation - as_good_as x carrier relation; y \<in> at_least_as_good x carrier relation - as_good_as x carrier relation; 0 \<le> u; 0 \<le> v; u + v = 1\<rbrakk> \<Longrightarrow> u *\<^sub>R xa + v *\<^sub>R y \<in> at_least_as_good x carrier relation - as_good_as x carrier relation
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
a \<succeq> x \<and> (x, a) \<notin> relation
[PROOF STEP]
have y_gt_x: "y \<succ>[relation] x"
[PROOF STATE]
proof (prove)
using this:
a \<succeq> x \<and> (x, a) \<notin> relation

goal (1 subgoal):
 1. y \<succeq> x \<and> (x, y) \<notin> relation
[PROOF STEP]
using as_y
[PROOF STATE]
proof (prove)
using this:
a \<succeq> x \<and> (x, a) \<notin> relation
y \<in> at_least_as_good x carrier relation - as_good_as x carrier relation

goal (1 subgoal):
 1. y \<succeq> x \<and> (x, y) \<notin> relation
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
y \<succeq> x \<and> (x, y) \<notin> relation

goal (1 subgoal):
 1. \<And>xa y u v. \<lbrakk>xa \<in> at_least_as_good x carrier relation - as_good_as x carrier relation; y \<in> at_least_as_good x carrier relation - as_good_as x carrier relation; 0 \<le> u; 0 \<le> v; u + v = 1\<rbrakk> \<Longrightarrow> u *\<^sub>R xa + v *\<^sub>R y \<in> at_least_as_good x carrier relation - as_good_as x carrier relation
[PROOF STEP]
show "u *\<^sub>R a + v *\<^sub>R y \<in> ?a - ?b"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. u *\<^sub>R a + v *\<^sub>R y \<in> at_least_as_good x carrier relation - as_good_as x carrier relation
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. u *\<^sub>R a + v *\<^sub>R y \<in> at_least_as_good x carrier relation
 2. u *\<^sub>R a + v *\<^sub>R y \<notin> as_good_as x carrier relation
[PROOF STEP]
show "u *\<^sub>R a + v *\<^sub>R y \<in> ?a"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. u *\<^sub>R a + v *\<^sub>R y \<in> at_least_as_good x carrier relation
[PROOF STEP]
by (metis DiffD1 a_g_x as_a as_y assms convexD reals have_rpr
          preference_def rational_preference.axioms(1))
[PROOF STATE]
proof (state)
this:
u *\<^sub>R a + v *\<^sub>R y \<in> at_least_as_good x carrier relation

goal (1 subgoal):
 1. u *\<^sub>R a + v *\<^sub>R y \<notin> as_good_as x carrier relation
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. u *\<^sub>R a + v *\<^sub>R y \<notin> as_good_as x carrier relation
[PROOF STEP]
have "a \<succeq>[relation] y \<or> y \<succeq>[relation] a"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. a \<succeq> y \<or> y \<succeq> a
[PROOF STEP]
by (meson a_g_x y_gt_x assms(1) preference.not_outside have_rpr
          rational_preference.axioms(1) rational_preference.strict_not_refl_weak)
[PROOF STATE]
proof (state)
this:
a \<succeq> y \<or> y \<succeq> a

goal (1 subgoal):
 1. u *\<^sub>R a + v *\<^sub>R y \<notin> as_good_as x carrier relation
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
a \<succeq> y \<or> y \<succeq> a
[PROOF STEP]
show "u *\<^sub>R a + v *\<^sub>R y \<notin> ?b"
[PROOF STATE]
proof (prove)
using this:
a \<succeq> y \<or> y \<succeq> a

goal (1 subgoal):
 1. u *\<^sub>R a + v *\<^sub>R y \<notin> as_good_as x carrier relation
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. a \<succeq> y \<Longrightarrow> u *\<^sub>R a + v *\<^sub>R y \<notin> as_good_as x carrier relation
 2. y \<succeq> a \<Longrightarrow> u *\<^sub>R a + v *\<^sub>R y \<notin> as_good_as x carrier relation
[PROOF STEP]
assume "a \<succeq>[relation] y"
[PROOF STATE]
proof (state)
this:
a \<succeq> y

goal (2 subgoals):
 1. a \<succeq> y \<Longrightarrow> u *\<^sub>R a + v *\<^sub>R y \<notin> as_good_as x carrier relation
 2. y \<succeq> a \<Longrightarrow> u *\<^sub>R a + v *\<^sub>R y \<notin> as_good_as x carrier relation
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
a \<succeq> y
[PROOF STEP]
have "u *\<^sub>R a + v *\<^sub>R y \<succeq>[relation] y"
[PROOF STATE]
proof (prove)
using this:
a \<succeq> y

goal (1 subgoal):
 1. u *\<^sub>R a + v *\<^sub>R y \<succeq> y
[PROOF STEP]
using cvx assms(1) reals
[PROOF STATE]
proof (prove)
using this:
a \<succeq> y
weak_convex_pref relation
\<forall>x\<in>carrier. convex (at_least_as_good x carrier relation)
0 \<le> u
0 \<le> v
u + v = 1

goal (1 subgoal):
 1. u *\<^sub>R a + v *\<^sub>R y \<succeq> y
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
u *\<^sub>R a + v *\<^sub>R y \<succeq> y

goal (2 subgoals):
 1. a \<succeq> y \<Longrightarrow> u *\<^sub>R a + v *\<^sub>R y \<notin> as_good_as x carrier relation
 2. y \<succeq> a \<Longrightarrow> u *\<^sub>R a + v *\<^sub>R y \<notin> as_good_as x carrier relation
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
u *\<^sub>R a + v *\<^sub>R y \<succeq> y
[PROOF STEP]
have "u *\<^sub>R a + v *\<^sub>R y \<succ>[relation] x"
[PROOF STATE]
proof (prove)
using this:
u *\<^sub>R a + v *\<^sub>R y \<succeq> y

goal (1 subgoal):
 1. u *\<^sub>R a + v *\<^sub>R y \<succeq> x \<and> (x, u *\<^sub>R a + v *\<^sub>R y) \<notin> relation
[PROOF STEP]
using y_gt_x
[PROOF STATE]
proof (prove)
using this:
u *\<^sub>R a + v *\<^sub>R y \<succeq> y
y \<succeq> x \<and> (x, y) \<notin> relation

goal (1 subgoal):
 1. u *\<^sub>R a + v *\<^sub>R y \<succeq> x \<and> (x, u *\<^sub>R a + v *\<^sub>R y) \<notin> relation
[PROOF STEP]
by (meson assms(1) rational_preference.axioms(1) have_rpr
            rational_preference.strict_is_neg_transitive preference_def)
[PROOF STATE]
proof (state)
this:
u *\<^sub>R a + v *\<^sub>R y \<succeq> x \<and> (x, u *\<^sub>R a + v *\<^sub>R y) \<notin> relation

goal (2 subgoals):
 1. a \<succeq> y \<Longrightarrow> u *\<^sub>R a + v *\<^sub>R y \<notin> as_good_as x carrier relation
 2. y \<succeq> a \<Longrightarrow> u *\<^sub>R a + v *\<^sub>R y \<notin> as_good_as x carrier relation
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
u *\<^sub>R a + v *\<^sub>R y \<succeq> x \<and> (x, u *\<^sub>R a + v *\<^sub>R y) \<notin> relation
[PROOF STEP]
show "u *\<^sub>R a + v *\<^sub>R y \<notin> as_good_as x carrier relation"
[PROOF STATE]
proof (prove)
using this:
u *\<^sub>R a + v *\<^sub>R y \<succeq> x \<and> (x, u *\<^sub>R a + v *\<^sub>R y) \<notin> relation

goal (1 subgoal):
 1. u *\<^sub>R a + v *\<^sub>R y \<notin> as_good_as x carrier relation
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
u *\<^sub>R a + v *\<^sub>R y \<notin> as_good_as x carrier relation

goal (1 subgoal):
 1. y \<succeq> a \<Longrightarrow> u *\<^sub>R a + v *\<^sub>R y \<notin> as_good_as x carrier relation
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. y \<succeq> a \<Longrightarrow> u *\<^sub>R a + v *\<^sub>R y \<notin> as_good_as x carrier relation
[PROOF STEP]
assume "y \<succeq>[relation] a"
[PROOF STATE]
proof (state)
this:
y \<succeq> a

goal (1 subgoal):
 1. y \<succeq> a \<Longrightarrow> u *\<^sub>R a + v *\<^sub>R y \<notin> as_good_as x carrier relation
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
y \<succeq> a
[PROOF STEP]
have "u *\<^sub>R a + v *\<^sub>R y \<succeq>[relation] a"
[PROOF STATE]
proof (prove)
using this:
y \<succeq> a

goal (1 subgoal):
 1. u *\<^sub>R a + v *\<^sub>R y \<succeq> a
[PROOF STEP]
using cvx assms(1) reals
[PROOF STATE]
proof (prove)
using this:
y \<succeq> a
weak_convex_pref relation
\<forall>x\<in>carrier. convex (at_least_as_good x carrier relation)
0 \<le> u
0 \<le> v
u + v = 1

goal (1 subgoal):
 1. u *\<^sub>R a + v *\<^sub>R y \<succeq> a
[PROOF STEP]
by (metis add.commute weak_convex1D)
[PROOF STATE]
proof (state)
this:
u *\<^sub>R a + v *\<^sub>R y \<succeq> a

goal (1 subgoal):
 1. y \<succeq> a \<Longrightarrow> u *\<^sub>R a + v *\<^sub>R y \<notin> as_good_as x carrier relation
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
u *\<^sub>R a + v *\<^sub>R y \<succeq> a
[PROOF STEP]
have "u *\<^sub>R a + v *\<^sub>R y \<succ>[relation] x"
[PROOF STATE]
proof (prove)
using this:
u *\<^sub>R a + v *\<^sub>R y \<succeq> a

goal (1 subgoal):
 1. u *\<^sub>R a + v *\<^sub>R y \<succeq> x \<and> (x, u *\<^sub>R a + v *\<^sub>R y) \<notin> relation
[PROOF STEP]
by (meson a_g_x assms(1) rational_preference.strict_is_neg_transitive
            rational_preference.axioms(1) preference_def have_rpr)
[PROOF STATE]
proof (state)
this:
u *\<^sub>R a + v *\<^sub>R y \<succeq> x \<and> (x, u *\<^sub>R a + v *\<^sub>R y) \<notin> relation

goal (1 subgoal):
 1. y \<succeq> a \<Longrightarrow> u *\<^sub>R a + v *\<^sub>R y \<notin> as_good_as x carrier relation
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
u *\<^sub>R a + v *\<^sub>R y \<succeq> x \<and> (x, u *\<^sub>R a + v *\<^sub>R y) \<notin> relation
[PROOF STEP]
show "u *\<^sub>R a + v *\<^sub>R y \<notin> ?b"
[PROOF STATE]
proof (prove)
using this:
u *\<^sub>R a + v *\<^sub>R y \<succeq> x \<and> (x, u *\<^sub>R a + v *\<^sub>R y) \<notin> relation

goal (1 subgoal):
 1. u *\<^sub>R a + v *\<^sub>R y \<notin> as_good_as x carrier relation
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
u *\<^sub>R a + v *\<^sub>R y \<notin> as_good_as x carrier relation

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
u *\<^sub>R a + v *\<^sub>R y \<notin> as_good_as x carrier relation

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
u *\<^sub>R a + v *\<^sub>R y \<in> at_least_as_good x carrier relation - as_good_as x carrier relation

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma Lindelof_space_subtopology:
   "Lindelof_space(subtopology X S) \<longleftrightarrow>
        (\<forall>\<U>. (\<forall>U \<in> \<U>. openin X U) \<and> topspace X \<inter> S \<subseteq> \<Union>\<U>
            \<longrightarrow> (\<exists>V. countable V \<and> V \<subseteq> \<U> \<and> topspace X \<inter> S \<subseteq> \<Union>V))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Lindelof_space (subtopology X S) = (\<forall>\<U>. (\<forall>U\<in>\<U>. openin X U) \<and> topspace X \<inter> S \<subseteq> \<Union> \<U> \<longrightarrow> (\<exists>V. countable V \<and> V \<subseteq> \<U> \<and> topspace X \<inter> S \<subseteq> \<Union> V))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. Lindelof_space (subtopology X S) = (\<forall>\<U>. (\<forall>U\<in>\<U>. openin X U) \<and> topspace X \<inter> S \<subseteq> \<Union> \<U> \<longrightarrow> (\<exists>V. countable V \<and> V \<subseteq> \<U> \<and> topspace X \<inter> S \<subseteq> \<Union> V))
[PROOF STEP]
have *: "(S \<inter> \<Union>\<U> = topspace X \<inter> S) = (topspace X \<inter> S \<subseteq> \<Union>\<U>)"
    if "\<And>x. x \<in> \<U> \<Longrightarrow> openin X x" for \<U>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (S \<inter> \<Union> \<U> = topspace X \<inter> S) = (topspace X \<inter> S \<subseteq> \<Union> \<U>)
[PROOF STEP]
by (blast dest: openin_subset [OF that])
[PROOF STATE]
proof (state)
this:
(\<And>x. x \<in> ?\<U> \<Longrightarrow> openin X x) \<Longrightarrow> (S \<inter> \<Union> ?\<U> = topspace X \<inter> S) = (topspace X \<inter> S \<subseteq> \<Union> ?\<U>)

goal (1 subgoal):
 1. Lindelof_space (subtopology X S) = (\<forall>\<U>. (\<forall>U\<in>\<U>. openin X U) \<and> topspace X \<inter> S \<subseteq> \<Union> \<U> \<longrightarrow> (\<exists>V. countable V \<and> V \<subseteq> \<U> \<and> topspace X \<inter> S \<subseteq> \<Union> V))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(\<And>x. x \<in> ?\<U> \<Longrightarrow> openin X x) \<Longrightarrow> (S \<inter> \<Union> ?\<U> = topspace X \<inter> S) = (topspace X \<inter> S \<subseteq> \<Union> ?\<U>)

goal (1 subgoal):
 1. Lindelof_space (subtopology X S) = (\<forall>\<U>. (\<forall>U\<in>\<U>. openin X U) \<and> topspace X \<inter> S \<subseteq> \<Union> \<U> \<longrightarrow> (\<exists>V. countable V \<and> V \<subseteq> \<U> \<and> topspace X \<inter> S \<subseteq> \<Union> V))
[PROOF STEP]
have "(\<V> \<subseteq> \<U> \<and> S \<inter> \<Union>\<V> = topspace X \<inter> S) = (\<V> \<subseteq> \<U> \<and> topspace X \<inter> S \<subseteq> \<Union>\<V>)"
    if "\<forall>x. x \<in> \<U> \<longrightarrow> openin X x" "topspace X \<inter> S \<subseteq> \<Union>\<U>" "countable \<V>" for \<U> \<V>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<V> \<subseteq> \<U> \<and> S \<inter> \<Union> \<V> = topspace X \<inter> S) = (\<V> \<subseteq> \<U> \<and> topspace X \<inter> S \<subseteq> \<Union> \<V>)
[PROOF STEP]
using that *
[PROOF STATE]
proof (prove)
using this:
\<forall>x. x \<in> \<U> \<longrightarrow> openin X x
topspace X \<inter> S \<subseteq> \<Union> \<U>
countable \<V>
(\<And>x. x \<in> ?\<U> \<Longrightarrow> openin X x) \<Longrightarrow> (S \<inter> \<Union> ?\<U> = topspace X \<inter> S) = (topspace X \<inter> S \<subseteq> \<Union> ?\<U>)

goal (1 subgoal):
 1. (\<V> \<subseteq> \<U> \<and> S \<inter> \<Union> \<V> = topspace X \<inter> S) = (\<V> \<subseteq> \<U> \<and> topspace X \<inter> S \<subseteq> \<Union> \<V>)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<lbrakk>\<forall>x. x \<in> ?\<U> \<longrightarrow> openin X x; topspace X \<inter> S \<subseteq> \<Union> ?\<U>; countable ?\<V>\<rbrakk> \<Longrightarrow> (?\<V> \<subseteq> ?\<U> \<and> S \<inter> \<Union> ?\<V> = topspace X \<inter> S) = (?\<V> \<subseteq> ?\<U> \<and> topspace X \<inter> S \<subseteq> \<Union> ?\<V>)

goal (1 subgoal):
 1. Lindelof_space (subtopology X S) = (\<forall>\<U>. (\<forall>U\<in>\<U>. openin X U) \<and> topspace X \<inter> S \<subseteq> \<Union> \<U> \<longrightarrow> (\<exists>V. countable V \<and> V \<subseteq> \<U> \<and> topspace X \<inter> S \<subseteq> \<Union> V))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
(\<And>x. x \<in> ?\<U> \<Longrightarrow> openin X x) \<Longrightarrow> (S \<inter> \<Union> ?\<U> = topspace X \<inter> S) = (topspace X \<inter> S \<subseteq> \<Union> ?\<U>)
\<lbrakk>\<forall>x. x \<in> ?\<U> \<longrightarrow> openin X x; topspace X \<inter> S \<subseteq> \<Union> ?\<U>; countable ?\<V>\<rbrakk> \<Longrightarrow> (?\<V> \<subseteq> ?\<U> \<and> S \<inter> \<Union> ?\<V> = topspace X \<inter> S) = (?\<V> \<subseteq> ?\<U> \<and> topspace X \<inter> S \<subseteq> \<Union> ?\<V>)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
(\<And>x. x \<in> ?\<U> \<Longrightarrow> openin X x) \<Longrightarrow> (S \<inter> \<Union> ?\<U> = topspace X \<inter> S) = (topspace X \<inter> S \<subseteq> \<Union> ?\<U>)
\<lbrakk>\<forall>x. x \<in> ?\<U> \<longrightarrow> openin X x; topspace X \<inter> S \<subseteq> \<Union> ?\<U>; countable ?\<V>\<rbrakk> \<Longrightarrow> (?\<V> \<subseteq> ?\<U> \<and> S \<inter> \<Union> ?\<V> = topspace X \<inter> S) = (?\<V> \<subseteq> ?\<U> \<and> topspace X \<inter> S \<subseteq> \<Union> ?\<V>)

goal (1 subgoal):
 1. Lindelof_space (subtopology X S) = (\<forall>\<U>. (\<forall>U\<in>\<U>. openin X U) \<and> topspace X \<inter> S \<subseteq> \<Union> \<U> \<longrightarrow> (\<exists>V. countable V \<and> V \<subseteq> \<U> \<and> topspace X \<inter> S \<subseteq> \<Union> V))
[PROOF STEP]
unfolding Lindelof_space_def openin_subtopology_alt Ball_def
[PROOF STATE]
proof (prove)
using this:
(\<And>x. x \<in> ?\<U> \<Longrightarrow> openin X x) \<Longrightarrow> (S \<inter> \<Union> ?\<U> = topspace X \<inter> S) = (topspace X \<inter> S \<subseteq> \<Union> ?\<U>)
\<lbrakk>\<forall>x. x \<in> ?\<U> \<longrightarrow> openin X x; topspace X \<inter> S \<subseteq> \<Union> ?\<U>; countable ?\<V>\<rbrakk> \<Longrightarrow> (?\<V> \<subseteq> ?\<U> \<and> S \<inter> \<Union> ?\<V> = topspace X \<inter> S) = (?\<V> \<subseteq> ?\<U> \<and> topspace X \<inter> S \<subseteq> \<Union> ?\<V>)

goal (1 subgoal):
 1. (\<forall>\<U>. (\<forall>x. x \<in> \<U> \<longrightarrow> x \<in> (\<inter>) S ` Collect (openin X)) \<and> \<Union> \<U> = topspace (subtopology X S) \<longrightarrow> (\<exists>\<V>. countable \<V> \<and> \<V> \<subseteq> \<U> \<and> \<Union> \<V> = topspace (subtopology X S))) = (\<forall>\<U>. (\<forall>x. x \<in> \<U> \<longrightarrow> openin X x) \<and> topspace X \<inter> S \<subseteq> \<Union> \<U> \<longrightarrow> (\<exists>V. countable V \<and> V \<subseteq> \<U> \<and> topspace X \<inter> S \<subseteq> \<Union> V))
[PROOF STEP]
apply (simp add: all_subset_image imp_conjL ex_countable_subset_image flip: subset_iff)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<And>\<U>. (\<And>x. x \<in> \<U> \<Longrightarrow> openin X x) \<Longrightarrow> (S \<inter> \<Union> \<U> = topspace X \<inter> S) = (topspace X \<inter> S \<subseteq> \<Union> \<U>); \<And>\<U> \<V>. \<lbrakk>\<forall>x. x \<in> \<U> \<longrightarrow> openin X x; topspace X \<inter> S \<subseteq> \<Union> \<U>; countable \<V>\<rbrakk> \<Longrightarrow> (\<V> \<subseteq> \<U> \<and> S \<inter> \<Union> \<V> = topspace X \<inter> S) = (\<V> \<subseteq> \<U> \<and> topspace X \<inter> S \<subseteq> \<Union> \<V>)\<rbrakk> \<Longrightarrow> (\<forall>\<U>\<subseteq>Collect (openin X). S \<inter> \<Union> \<U> = topspace X \<inter> S \<longrightarrow> (\<exists>\<V>. countable \<V> \<and> \<V> \<subseteq> \<U> \<and> S \<inter> \<Union> \<V> = topspace X \<inter> S)) = (\<forall>\<U>. (\<forall>x. x \<in> \<U> \<longrightarrow> openin X x) \<longrightarrow> topspace X \<inter> S \<subseteq> \<Union> \<U> \<longrightarrow> (\<exists>V. countable V \<and> V \<subseteq> \<U> \<and> topspace X \<inter> S \<subseteq> \<Union> V))
[PROOF STEP]
apply (intro all_cong1 imp_cong ex_cong, auto)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
Lindelof_space (subtopology X S) = (\<forall>\<U>. (\<forall>U\<in>\<U>. openin X U) \<and> topspace X \<inter> S \<subseteq> \<Union> \<U> \<longrightarrow> (\<exists>V. countable V \<and> V \<subseteq> \<U> \<and> topspace X \<inter> S \<subseteq> \<Union> V))

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma real_le_trans: "\<lbrakk>i \<le> j; j \<le> k\<rbrakk> \<Longrightarrow> i \<le> (k::real)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>i \<le> j; j \<le> k\<rbrakk> \<Longrightarrow> i \<le> k
[PROOF STEP]
by (cases i, cases j, cases k) (auto simp: real_le intro: real_trans_lemma)


[STATEMENT]
lemma usolves_ode_union_closed:
  assumes x: "(x usolves_ode f from tx) T X"
  assumes y: "\<And>t. t \<in> closure S \<inter> closure T \<Longrightarrow> (x usolves_ode f from t) S X"
  assumes conn_T: "closure S \<inter> closure T \<subseteq> T"
  assumes conn_S: "closure S \<inter> closure T \<subseteq> S"
  assumes conn_t: "t \<in> closure S \<inter> closure T"
  shows "(x usolves_ode f from tx) (T \<union> S) X"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (x usolves_ode f from tx) (T \<union> S) X
[PROOF STEP]
using connection_usolves_ode[OF assms]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<And>t. t \<in> closure S \<inter> closure T \<Longrightarrow> t \<in> closure S \<inter> closure T; \<And>t. \<lbrakk>t \<in> closure S; t \<in> closure T\<rbrakk> \<Longrightarrow> x t = x t; \<And>t x. \<lbrakk>t \<in> closure S; t \<in> closure T; x \<in> X\<rbrakk> \<Longrightarrow> f t x = f t x\<rbrakk> \<Longrightarrow> ((\<lambda>t. if t \<in> T then x t else x t) usolves_ode (\<lambda>t. if t \<in> T then f t else f t) from tx) (T \<union> S) X

goal (1 subgoal):
 1. (x usolves_ode f from tx) (T \<union> S) X
[PROOF STEP]
by simp


[STATEMENT]
lemma refinement_transitive:
  "\<lbrakk> refines R1 pi1 S1 S2; refines R2 pi2 S2 S3 \<rbrakk>
  \<Longrightarrow> refines (R1 O R2) (pi1 o pi2) S1 S3"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>refines R1 pi1 S1 S2; refines R2 pi2 S2 S3\<rbrakk> \<Longrightarrow> refines (R1 O R2) (pi1 \<circ> pi2) S1 S3
[PROOF STEP]
apply (auto simp add: refines_defs del: subsetI
            intro: rhoare_trans)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>obs_consistent R1 pi1 S1 S2; obs_consistent R2 pi2 S2 S3; init S2 \<subseteq> R1 `` init S1; {R1} TS.trans S1, TS.trans S2 {> R1}; init S3 \<subseteq> R2 `` init S2; {R2} TS.trans S2, TS.trans S3 {> R2}\<rbrakk> \<Longrightarrow> init S3 \<subseteq> R2 `` R1 `` init S1
[PROOF STEP]
apply (fastforce dest: Image_mono)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma "(x - y = 0) = (x = (y::real))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (x - y = 0) = (x = y)
[PROOF STEP]
by arith


[STATEMENT]
lemma "\<forall>x::'a::linordered_field. x < 10 \<or> x > 20 \<or> (\<exists>y. y \<ge> 0 \<and> y \<le> 10 \<and> x + y = 20)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>x. x < (10::'a) \<or> (20::'a) < x \<or> (\<exists>y\<ge>0::'a. y \<le> (10::'a) \<and> x + y = (20::'a))
[PROOF STEP]
by ferrack


[STATEMENT]
lemma "list_of_array (the (Gale_Shapley
  [[3,0,1,2], [1,2,0,3], [1,3,2,0], [2,0,3,1]] [[3,0,2,1], [0,2,1,3], [0,1,2,3], [3,0,2,1]]))
  = [0,1,0,1]"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. list (the (Gale_Shapley2.Gale_Shapley [[3, 0, 1, 2], [1, 2, 0, 3], [1, 3, 2, 0], [2, 0, 3, 1]] [[3, 0, 2, 1], [0, 2, 1, 3], [0, 1, 2, 3], [3, 0, 2, 1]])) = [0, 1, 0, 1]
[PROOF STEP]
by eval


[STATEMENT]
lemma lincomb_index:
  assumes i: "i < nc"
    and Xk: "X \<subseteq> mat_kernel A"
  shows "lincomb a X $ i = sum (\<lambda>x. a x * x $ i) X"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. lincomb a X $ i = (\<Sum>x\<in>X. a x * x $ i)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. lincomb a X $ i = (\<Sum>x\<in>X. a x * x $ i)
[PROOF STEP]
have X: "X \<subseteq> carrier_vec nc"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. X \<subseteq> carrier_vec nc
[PROOF STEP]
using Xk mat_kernel_def A
[PROOF STATE]
proof (prove)
using this:
X \<subseteq> mat_kernel A
mat_kernel ?A = {v \<in> carrier_vec (dim_col ?A). ?A *\<^sub>v v = 0\<^sub>v (dim_row ?A)}
A \<in> carrier_mat nr nc

goal (1 subgoal):
 1. X \<subseteq> carrier_vec nc
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
X \<subseteq> carrier_vec nc

goal (1 subgoal):
 1. lincomb a X $ i = (\<Sum>x\<in>X. a x * x $ i)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. lincomb a X $ i = (\<Sum>x\<in>X. a x * x $ i)
[PROOF STEP]
using vec_space.lincomb_index[OF i X]
[PROOF STATE]
proof (prove)
using this:
NC.lincomb ?a X $ i = (\<Sum>x\<in>X. ?a x * x $ i)

goal (1 subgoal):
 1. lincomb a X $ i = (\<Sum>x\<in>X. a x * x $ i)
[PROOF STEP]
using lincomb_same[OF Xk]
[PROOF STATE]
proof (prove)
using this:
NC.lincomb ?a X $ i = (\<Sum>x\<in>X. ?a x * x $ i)
lincomb ?a X = NC.lincomb ?a X

goal (1 subgoal):
 1. lincomb a X $ i = (\<Sum>x\<in>X. a x * x $ i)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
lincomb a X $ i = (\<Sum>x\<in>X. a x * x $ i)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma fun_ord_le[simp]: "fun_ord (\<le>) = (\<le>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fun_ord (\<le>) = (\<le>)
[PROOF STEP]
unfolding fun_ord_def[abs_def]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lambda>f g. \<forall>x. f x \<le> g x) = (\<le>)
[PROOF STEP]
by (auto intro!: ext simp: le_fun_def)


[STATEMENT]
lemma closed_orbit_recurrence_times_nonempty:
  assumes "closed_orbit x"
  shows " {T \<in> existence_ivl0 x. T > 0 \<and> flow0 x T = x} \<noteq> {}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {T \<in> existence_ivl0 x. 0 < T \<and> flow0 x T = x} \<noteq> {}
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>xa>0. xa \<in> existence_ivl0 x \<and> flow0 x xa = x
[PROOF STEP]
using assms(1)
[PROOF STATE]
proof (prove)
using this:
closed_orbit x

goal (1 subgoal):
 1. \<exists>xa>0. xa \<in> existence_ivl0 x \<and> flow0 x xa = x
[PROOF STEP]
unfolding closed_orbit_def
[PROOF STATE]
proof (prove)
using this:
\<exists>T\<in>existence_ivl0 x. T \<noteq> 0 \<and> flow0 x T = x

goal (1 subgoal):
 1. \<exists>xa>0. xa \<in> existence_ivl0 x \<and> flow0 x xa = x
[PROOF STEP]
by (smt recurrence_time_flip_sign)


[STATEMENT]
lemma (in ergodic_conservative_mpt) induced_function_integral:
  fixes f::"'a \<Rightarrow> real"
  assumes [measurable]: "A \<in> sets M" "integrable M f" and "emeasure M A > 0"
  shows "integrable M (induced_function A f)"
        "(\<integral>y. induced_function A f y \<partial>M) = (\<integral> x. f x \<partial>M)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. integrable M (induced_function A f) &&& integral\<^sup>L M (induced_function A f) = integral\<^sup>L M f
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. integrable M (induced_function A f)
 2. integral\<^sup>L M (induced_function A f) = integral\<^sup>L M f
[PROOF STEP]
show "integrable M (induced_function A f)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. integrable M (induced_function A f)
[PROOF STEP]
using induced_function_integral_nonergodic(1)[OF assms(1) assms(2)]
[PROOF STATE]
proof (prove)
using this:
integrable M (induced_function A f)

goal (1 subgoal):
 1. integrable M (induced_function A f)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
integrable M (induced_function A f)

goal (1 subgoal):
 1. integral\<^sup>L M (induced_function A f) = integral\<^sup>L M f
[PROOF STEP]
have "(\<integral>y. induced_function A f y \<partial>M) = (\<integral> x \<in> (\<Union>n. (T^^n)--`A). f x \<partial>M)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. integral\<^sup>L M (induced_function A f) = set_lebesgue_integral M (\<Union>n. (T ^^ n) --` A) f
[PROOF STEP]
using induced_function_integral_nonergodic(2)[OF assms(1) assms(2)]
[PROOF STATE]
proof (prove)
using this:
integral\<^sup>L M (induced_function A f) = set_lebesgue_integral M (\<Union>n. (T ^^ n) --` A) f

goal (1 subgoal):
 1. integral\<^sup>L M (induced_function A f) = set_lebesgue_integral M (\<Union>n. (T ^^ n) --` A) f
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
integral\<^sup>L M (induced_function A f) = set_lebesgue_integral M (\<Union>n. (T ^^ n) --` A) f

goal (1 subgoal):
 1. integral\<^sup>L M (induced_function A f) = integral\<^sup>L M f
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
integral\<^sup>L M (induced_function A f) = set_lebesgue_integral M (\<Union>n. (T ^^ n) --` A) f

goal (1 subgoal):
 1. integral\<^sup>L M (induced_function A f) = integral\<^sup>L M f
[PROOF STEP]
have "... = (\<integral> x \<in> space M. f x \<partial>M)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. set_lebesgue_integral M (\<Union>n. (T ^^ n) --` A) f = set_lebesgue_integral M (space M) f
[PROOF STEP]
using set_integral_null_delta[OF assms(2), where ?A = "space M" and ?B = "(\<Union>n. (T^^n)--`A)"]
    preimages_conull(2)[OF assms(1) assms(3)]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>space M \<in> sets M; (\<Union>n. (T ^^ n) --` A) \<in> sets M; space M \<Delta> (\<Union>n. (T ^^ n) --` A) \<in> null_sets M\<rbrakk> \<Longrightarrow> set_lebesgue_integral M (space M) f = set_lebesgue_integral M (\<Union>n. (T ^^ n) --` A) f
space M \<Delta> (\<Union>n. (T ^^ n) --` A) \<in> null_sets M

goal (1 subgoal):
 1. set_lebesgue_integral M (\<Union>n. (T ^^ n) --` A) f = set_lebesgue_integral M (space M) f
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
set_lebesgue_integral M (\<Union>n. (T ^^ n) --` A) f = set_lebesgue_integral M (space M) f

goal (1 subgoal):
 1. integral\<^sup>L M (induced_function A f) = integral\<^sup>L M f
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
set_lebesgue_integral M (\<Union>n. (T ^^ n) --` A) f = set_lebesgue_integral M (space M) f

goal (1 subgoal):
 1. integral\<^sup>L M (induced_function A f) = integral\<^sup>L M f
[PROOF STEP]
have "... = (\<integral> x. f x \<partial>M)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. set_lebesgue_integral M (space M) f = integral\<^sup>L M f
[PROOF STEP]
using set_integral_space[OF assms(2)]
[PROOF STATE]
proof (prove)
using this:
set_lebesgue_integral M (space M) f = integral\<^sup>L M f

goal (1 subgoal):
 1. set_lebesgue_integral M (space M) f = integral\<^sup>L M f
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
set_lebesgue_integral M (space M) f = integral\<^sup>L M f

goal (1 subgoal):
 1. integral\<^sup>L M (induced_function A f) = integral\<^sup>L M f
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
integral\<^sup>L M (induced_function A f) = integral\<^sup>L M f
[PROOF STEP]
show "(\<integral>y. induced_function A f y \<partial>M) = (\<integral> x. f x \<partial>M)"
[PROOF STATE]
proof (prove)
using this:
integral\<^sup>L M (induced_function A f) = integral\<^sup>L M f

goal (1 subgoal):
 1. integral\<^sup>L M (induced_function A f) = integral\<^sup>L M f
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
integral\<^sup>L M (induced_function A f) = integral\<^sup>L M f

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma expands_to_max_gt:
  assumes "(f expands_to F) basis" "eventually (\<lambda>x. f x > g x) at_top"
  shows   "((\<lambda>x. max (f x) (g x)) expands_to F) basis"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<lambda>x. max (f x) (g x)) expands_to F) basis
[PROOF STEP]
using assms(1)
[PROOF STATE]
proof (prove)
using this:
(f expands_to F) basis

goal (1 subgoal):
 1. ((\<lambda>x. max (f x) (g x)) expands_to F) basis
[PROOF STEP]
by (rule expands_to_cong) (insert assms(2), auto simp: max_def elim: eventually_mono)


[STATEMENT]
lemma mat_adjoint_swap:
  fixes M ::"complex mat"
  assumes "M \<in> carrier_mat nB nA" and "iA < dim_row M" and "iB < dim_col M"
  shows "(mat_adjoint M)$$(iB,iA) = cnj (M$$(iA,iB))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mat_adjoint M $$ (iB, iA) = cnj (M $$ (iA, iB))
[PROOF STEP]
unfolding transpose_mat_def map_mat_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mat_adjoint M $$ (iB, iA) = cnj (M $$ (iA, iB))
[PROOF STEP]
by (simp add: assms(2) assms(3) mat_adjoint_def')


[STATEMENT]
lemma set_lebesgue_integral_cong_AE:
  assumes [measurable]: "A \<in> sets M" "f \<in> borel_measurable M" "g \<in> borel_measurable M"
  assumes "AE x \<in> A in M. f x = g x"
  shows "LINT x:A|M. f x = LINT x:A|M. g x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. set_lebesgue_integral M A f = set_lebesgue_integral M A g
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. set_lebesgue_integral M A f = set_lebesgue_integral M A g
[PROOF STEP]
have "AE x in M. indicator A x *\<^sub>R f x = indicator A x *\<^sub>R g x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. AE x in M. indicat_real A x *\<^sub>R f x = indicat_real A x *\<^sub>R g x
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
A \<in> sets M
f \<in> borel_measurable M
g \<in> borel_measurable M
AE x\<in>A in M. f x = g x

goal (1 subgoal):
 1. AE x in M. indicat_real A x *\<^sub>R f x = indicat_real A x *\<^sub>R g x
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
AE x in M. indicat_real A x *\<^sub>R f x = indicat_real A x *\<^sub>R g x

goal (1 subgoal):
 1. set_lebesgue_integral M A f = set_lebesgue_integral M A g
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
AE x in M. indicat_real A x *\<^sub>R f x = indicat_real A x *\<^sub>R g x

goal (1 subgoal):
 1. set_lebesgue_integral M A f = set_lebesgue_integral M A g
[PROOF STEP]
unfolding set_lebesgue_integral_def
[PROOF STATE]
proof (prove)
using this:
AE x in M. indicat_real A x *\<^sub>R f x = indicat_real A x *\<^sub>R g x

goal (1 subgoal):
 1. LINT x|M. indicat_real A x *\<^sub>R f x = LINT x|M. indicat_real A x *\<^sub>R g x
[PROOF STEP]
by (intro integral_cong_AE) auto
[PROOF STATE]
proof (state)
this:
set_lebesgue_integral M A f = set_lebesgue_integral M A g

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma four_block_one_mat[simp]:
  "four_block_mat (1\<^sub>m n1) (0\<^sub>m n1 n2) (0\<^sub>m n2 n1) (1\<^sub>m n2) = 1\<^sub>m (n1 + n2)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. four_block_mat (1\<^sub>m n1) (0\<^sub>m n1 n2) (0\<^sub>m n2 n1) (1\<^sub>m n2) = 1\<^sub>m (n1 + n2)
[PROOF STEP]
by (rule eq_matI, auto)


[STATEMENT]
lemma LIMSEQ_I: "(\<And>r. 0 < r \<Longrightarrow> \<exists>no. \<forall>n\<ge>no. norm (X n - L) < r) \<Longrightarrow> X \<longlonglongrightarrow> L"
  for L :: "'a::real_normed_vector"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>r. 0 < r \<Longrightarrow> \<exists>no. \<forall>n\<ge>no. norm (X n - L) < r) \<Longrightarrow> X \<longlonglongrightarrow> L
[PROOF STEP]
by (simp add: LIMSEQ_iff)


[STATEMENT]
lemma conservation_const_pointwise:
  assumes "u\<in>V - {s,t}"
  shows "(\<Sum>v\<in>E``{u}. f (u,v)) = (\<Sum>v\<in>E\<inverse>``{u}. f (v,u))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Sum>v\<in>E `` {u}. f (u, v)) = (\<Sum>v\<in>E\<inverse> `` {u}. f (v, u))
[PROOF STEP]
using conservation_const assms
[PROOF STATE]
proof (prove)
using this:
\<forall>v\<in>V - {s, t}. sum f (incoming v) = sum f (outgoing v)
u \<in> V - {s, t}

goal (1 subgoal):
 1. (\<Sum>v\<in>E `` {u}. f (u, v)) = (\<Sum>v\<in>E\<inverse> `` {u}. f (v, u))
[PROOF STEP]
by (auto simp: sum_incoming_pointwise sum_outgoing_pointwise)


[STATEMENT]
lemma mono_mult2_ns:
  assumes "ns \<subseteq> ns'" "s \<subseteq> s'" shows "mult2_ns ns s \<subseteq> mult2_ns ns' s'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mult2_ns ns s \<subseteq> mult2_ns ns' s'
[PROOF STEP]
using mono_multpw[OF assms(1)] mono_mult[OF assms(2)]
[PROOF STATE]
proof (prove)
using this:
multpw ns \<subseteq> multpw ns'
mult s \<subseteq> mult s'

goal (1 subgoal):
 1. mult2_ns ns s \<subseteq> mult2_ns ns' s'
[PROOF STEP]
unfolding mult2_ns_def
[PROOF STATE]
proof (prove)
using this:
multpw ns \<subseteq> multpw ns'
mult s \<subseteq> mult s'

goal (1 subgoal):
 1. multpw ns O (mult s)\<^sup>= \<subseteq> multpw ns' O (mult s')\<^sup>=
[PROOF STEP]
by auto


[STATEMENT]
lemma sorted_nths_atLeastAtMost_0: "\<lbrakk> m \<le> n; sorted (nths xs {0..n}) \<rbrakk> \<Longrightarrow> sorted (nths xs {0..m})"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>m \<le> n; sorted (nths xs {0..n})\<rbrakk> \<Longrightarrow> sorted (nths xs {0..m})
[PROOF STEP]
using nths_atLeastAtMost_prefix sorted_prefix
[PROOF STATE]
proof (prove)
using this:
?m \<le> ?n \<Longrightarrow> nths ?xs {0..?m} \<le> nths ?xs {0..?n}
\<lbrakk>?xs \<le> ?ys; sorted ?ys\<rbrakk> \<Longrightarrow> sorted ?xs

goal (1 subgoal):
 1. \<lbrakk>m \<le> n; sorted (nths xs {0..n})\<rbrakk> \<Longrightarrow> sorted (nths xs {0..m})
[PROOF STEP]
by blast


[STATEMENT]
lemma vproduct_vsingletonE:
  assumes "f \<in>\<^sub>\<circ> (\<Prod>\<^sub>\<circ>i\<in>\<^sub>\<circ>set{c}. A i)"
  obtains "vsv f" and "f\<lparr>c\<rparr> \<in>\<^sub>\<circ> A c" and "f = set {\<langle>c, f\<lparr>c\<rparr>\<rangle>}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lbrakk>vsv f; f\<lparr>c\<rparr> \<in>\<^sub>\<circ> A c; f = set {\<langle>c, f\<lparr>c\<rparr>\<rangle>}\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using assms vproduct_vsingletonD that
[PROOF STATE]
proof (prove)
using this:
f \<in>\<^sub>\<circ> vproduct (set {c}) A
?f \<in>\<^sub>\<circ> vproduct (set {?c}) ?A \<Longrightarrow> vsv ?f
?f \<in>\<^sub>\<circ> vproduct (set {?c}) ?A \<Longrightarrow> ?f\<lparr>?c\<rparr> \<in>\<^sub>\<circ> ?A ?c
?f \<in>\<^sub>\<circ> vproduct (set {?c}) ?A \<Longrightarrow> ?f = set {\<langle>?c, ?f\<lparr>?c\<rparr>\<rangle>}
\<lbrakk>vsv f; f\<lparr>c\<rparr> \<in>\<^sub>\<circ> A c; f = set {\<langle>c, f\<lparr>c\<rparr>\<rangle>}\<rbrakk> \<Longrightarrow> thesis

goal (1 subgoal):
 1. (\<lbrakk>vsv f; f\<lparr>c\<rparr> \<in>\<^sub>\<circ> A c; f = set {\<langle>c, f\<lparr>c\<rparr>\<rangle>}\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto


[STATEMENT]
lemma zero_less:
  assumes "nonzero x"
  shows "zeroes (length x) <\<^sub>v x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. zeroes (length x) <\<^sub>v x
[PROOF STEP]
using assms and eq_0_iff order_vec.dual_order.strict_iff_order
[PROOF STATE]
proof (prove)
using this:
nonzero x
(?xs = zeroes ?n) = (length ?xs = ?n \<and> (\<forall>x\<in>set ?xs. x = 0))
(?b <\<^sub>v ?a) = (?b \<le>\<^sub>v ?a \<and> ?a \<noteq> ?b)

goal (1 subgoal):
 1. zeroes (length x) <\<^sub>v x
[PROOF STEP]
by (auto simp: nonzero_iff)


[STATEMENT]
lemma similar_sq_mtx_simm: "A \<sim> B \<Longrightarrow> B \<sim> A"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. A \<sim> B \<Longrightarrow> B \<sim> A
[PROOF STEP]
apply(unfold similar_sq_mtx_def, clarsimp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>P. \<lbrakk>mtx_invertible P; A = P\<^sup>-\<^sup>1 * B * P\<rbrakk> \<Longrightarrow> \<exists>Pa. mtx_invertible Pa \<and> B = Pa\<^sup>-\<^sup>1 * (P\<^sup>-\<^sup>1 * B * P) * Pa
[PROOF STEP]
apply(rule_tac x="P\<^sup>-\<^sup>1" in exI, simp add: mult.assoc)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>P. \<lbrakk>mtx_invertible P; A = P\<^sup>-\<^sup>1 * (B * P)\<rbrakk> \<Longrightarrow> B = P * (P\<^sup>-\<^sup>1 * B)
[PROOF STEP]
by (metis mtx_invertibleD(2) mult.assoc mult.left_neutral)


[STATEMENT]
lemma set_word8_word_upto: "{0..(- 1 :: 8 word)} = set (word_upto 0 255)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {0..- 1} = set (word_upto 0 255)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. {0..- 1} = set (word_upto 0 255)
[PROOF STEP]
have \<open>0xFF = (- 1 :: 8 word)\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 255 = - 1
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
255 = - 1

goal (1 subgoal):
 1. {0..- 1} = set (word_upto 0 255)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
255 = - 1
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
255 = - 1

goal (1 subgoal):
 1. {0..- 1} = set (word_upto 0 255)
[PROOF STEP]
by (simp only:) (auto simp add: word_upto_set_eq)
[PROOF STATE]
proof (state)
this:
{0..- 1} = set (word_upto 0 255)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma fw_upd_leI:
  "fw_upd m' k i j i j \<le> fw_upd m k i j i j" if
  "m' i k \<le> m i k" "m' k j \<le> m k j" "m' i j \<le> m i j"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fw_upd m' k i j i j \<le> fw_upd m k i j i j
[PROOF STEP]
using that
[PROOF STATE]
proof (prove)
using this:
m' i k \<le> m i k
m' k j \<le> m k j
m' i j \<le> m i j

goal (1 subgoal):
 1. fw_upd m' k i j i j \<le> fw_upd m k i j i j
[PROOF STEP]
unfolding fw_upd_def upd_def min_def
[PROOF STATE]
proof (prove)
using this:
m' i k \<le> m i k
m' k j \<le> m k j
m' i j \<le> m i j

goal (1 subgoal):
 1. (m'(i := (m' i)(j := if m' i j \<le> m' i k + m' k j then m' i j else m' i k + m' k j))) i j \<le> (m(i := (m i)(j := if m i j \<le> m i k + m k j then m i j else m i k + m k j))) i j
[PROOF STEP]
using add_mono
[PROOF STATE]
proof (prove)
using this:
m' i k \<le> m i k
m' k j \<le> m k j
m' i j \<le> m i j
\<lbrakk>?a \<le> ?b; ?c \<le> ?d\<rbrakk> \<Longrightarrow> ?a + ?c \<le> ?b + ?d

goal (1 subgoal):
 1. (m'(i := (m' i)(j := if m' i j \<le> m' i k + m' k j then m' i j else m' i k + m' k j))) i j \<le> (m(i := (m i)(j := if m i j \<le> m i k + m k j then m i j else m i k + m k j))) i j
[PROOF STEP]
by fastforce


[STATEMENT]
lemma has_vector_derivative_mult_right[derivative_intros]:
  fixes a :: "'a::real_normed_algebra"
  shows "(f has_vector_derivative x) F \<Longrightarrow> ((\<lambda>x. a * f x) has_vector_derivative (a * x)) F"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (f has_vector_derivative x) F \<Longrightarrow> ((\<lambda>x. a * f x) has_vector_derivative a * x) F
[PROOF STEP]
by (rule bounded_linear.has_vector_derivative[OF bounded_linear_mult_right])


[STATEMENT]
lemma disjoint_family_on_vimageI: "disjoint_family_on F I \<Longrightarrow> disjoint_family_on (\<lambda>i. f -` F i) I"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. disjoint_family_on F I \<Longrightarrow> disjoint_family_on (\<lambda>i. f -` F i) I
[PROOF STEP]
by (auto simp: disjoint_family_on_def)


[STATEMENT]
lemma cos_gt_zero_pi: "-(pi/2) < x \<Longrightarrow> x < pi/2 \<Longrightarrow> 0 < cos x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>- (pi / 2) < x; x < pi / 2\<rbrakk> \<Longrightarrow> 0 < cos x
[PROOF STEP]
using cos_gt_zero [of x] cos_gt_zero [of "-x"]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>0 < x; x < pi / 2\<rbrakk> \<Longrightarrow> 0 < cos x
\<lbrakk>0 < - x; - x < pi / 2\<rbrakk> \<Longrightarrow> 0 < cos (- x)

goal (1 subgoal):
 1. \<lbrakk>- (pi / 2) < x; x < pi / 2\<rbrakk> \<Longrightarrow> 0 < cos x
[PROOF STEP]
by (cases rule: linorder_cases [of x 0]) auto


[STATEMENT]
lemma isCont_Ln' [simp,continuous_intros]:
   "\<lbrakk>isCont f z; f z \<notin> \<real>\<^sub>\<le>\<^sub>0\<rbrakk> \<Longrightarrow> isCont (\<lambda>x. Ln (f x)) z"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>isCont f z; f z \<notin> \<real>\<^sub>\<le>\<^sub>0\<rbrakk> \<Longrightarrow> isCont (\<lambda>x. Ln (f x)) z
[PROOF STEP]
by (blast intro: isCont_o2 [OF _ continuous_at_Ln])


[STATEMENT]
lemma eexp_tendsto [tendsto_intros]:
  assumes "((\<lambda>n. u n) \<longlongrightarrow> l) F"
  shows "((\<lambda>n. eexp(u n)) \<longlongrightarrow> eexp l) F"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<lambda>n. eexp (u n)) \<longlongrightarrow> eexp l) F
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
(u \<longlongrightarrow> l) F

goal (1 subgoal):
 1. ((\<lambda>n. eexp (u n)) \<longlongrightarrow> eexp l) F
[PROOF STEP]
by auto


[STATEMENT]
lemma ToTC_simp [simp]:
    assumes "C.arr f" and "C.arr g" and "C.arr h"
    shows "ToTC (f, g, h) = T (T (f, g), h)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ToTC (f, g, h) = T (T (f, g), h)
[PROOF STEP]
using assms ToTC_def CCC.arr_char
[PROOF STATE]
proof (prove)
using this:
C.arr f
C.arr g
C.arr h
ToTC ?f \<equiv> if CCC.arr ?f then T (T (fst ?f, fst (snd ?f)), snd (snd ?f)) else C.null
CCC.arr ?f = (C.arr (fst ?f) \<and> CC.arr (snd ?f))

goal (1 subgoal):
 1. ToTC (f, g, h) = T (T (f, g), h)
[PROOF STEP]
by simp


[STATEMENT]
lemma (in vars)
  "\<Gamma>,{}\<turnstile> \<lbrace>\<acute>M = 0 \<and> \<acute>S = 0\<rbrace>
          WHILE \<acute>M \<noteq> a
          INV \<lbrace>\<acute>S = \<acute>M * b\<rbrace>
          DO \<acute>S :== \<acute>S + b;; \<acute>M :== \<acute>M + 1 OD
          \<lbrace>\<acute>S = a * b\<rbrace>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<Gamma>\<turnstile> \<lbrace>\<acute>M = 0 \<and> \<acute>S = 0\<rbrace> WHILE \<acute>M \<noteq> a INV \<lbrace>\<acute>S = \<acute>M * b\<rbrace> DO \<acute>S :== \<acute>S + b;; \<acute>M :== \<acute>M + 1 OD \<lbrace>\<acute>S = a * b\<rbrace>
[PROOF STEP]
apply vcg
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>M S. \<lbrakk>M = 0; S = 0\<rbrakk> \<Longrightarrow> S = M * b
 2. \<And>M S. \<lbrakk>S = M * b; M \<noteq> a\<rbrakk> \<Longrightarrow> S + b = (M + 1) * b
 3. \<And>M S. \<lbrakk>S = M * b; \<not> M \<noteq> a\<rbrakk> \<Longrightarrow> S = a * b
[PROOF STEP]
txt \<open>@{subgoals [display]}\<close>
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>M S. \<lbrakk>M = 0; S = 0\<rbrakk> \<Longrightarrow> S = M * b
 2. \<And>M S. \<lbrakk>S = M * b; M \<noteq> a\<rbrakk> \<Longrightarrow> S + b = (M + 1) * b
 3. \<And>M S. \<lbrakk>S = M * b; \<not> M \<noteq> a\<rbrakk> \<Longrightarrow> S = a * b
[PROOF STEP]
txt \<open>The verification condition generator gives us three proof obligations,
         stemming from the path from the precondition to the invariant,
         from the invariant together with loop condition through the
         loop body to the invariant, and finally from the invariant together
         with the negated loop condition to the postcondition.\<close>
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>M S. \<lbrakk>M = 0; S = 0\<rbrakk> \<Longrightarrow> S = M * b
 2. \<And>M S. \<lbrakk>S = M * b; M \<noteq> a\<rbrakk> \<Longrightarrow> S + b = (M + 1) * b
 3. \<And>M S. \<lbrakk>S = M * b; \<not> M \<noteq> a\<rbrakk> \<Longrightarrow> S = a * b
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma JN_constrains:
    "i \<in> I ==> (\<Squnion>i \<in> I. F i) \<in> A co B = (\<forall>i \<in> I. F i \<in> A co B)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. i \<in> I \<Longrightarrow> (JOIN I F \<in> A co B) = (\<forall>i\<in>I. F i \<in> A co B)
[PROOF STEP]
by (simp add: constrains_def JOIN_def, blast)


[STATEMENT]
lemma finite_range [simp]: "finite (Poly_Mapping.range p)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. finite (Poly_Mapping.range p)
[PROOF STEP]
proof transfer
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>p. finite {x. p x \<noteq> (0::'a)} \<Longrightarrow> finite (Set.range p - {0::'a})
[PROOF STEP]
fix f :: "'b \<Rightarrow> 'a"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>p. finite {x. p x \<noteq> (0::'a)} \<Longrightarrow> finite (Set.range p - {0::'a})
[PROOF STEP]
assume *: "finite {x. f x \<noteq> 0}"
[PROOF STATE]
proof (state)
this:
finite {x. f x \<noteq> (0::'a)}

goal (1 subgoal):
 1. \<And>p. finite {x. p x \<noteq> (0::'a)} \<Longrightarrow> finite (Set.range p - {0::'a})
[PROOF STEP]
have "Set.range f - {0} \<subseteq> f ` {x. f x \<noteq> 0}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Set.range f - {0::'a} \<subseteq> f ` {x. f x \<noteq> (0::'a)}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Set.range f - {0::'a} \<subseteq> f ` {x. f x \<noteq> (0::'a)}

goal (1 subgoal):
 1. \<And>p. finite {x. p x \<noteq> (0::'a)} \<Longrightarrow> finite (Set.range p - {0::'a})
[PROOF STEP]
thus "finite (Set.range f - {0})"
[PROOF STATE]
proof (prove)
using this:
Set.range f - {0::'a} \<subseteq> f ` {x. f x \<noteq> (0::'a)}

goal (1 subgoal):
 1. finite (Set.range f - {0::'a})
[PROOF STEP]
by(rule finite_subset)(rule finite_imageI[OF *])
[PROOF STATE]
proof (state)
this:
finite (Set.range f - {0::'a})

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma max_cases: "(max a b = a \<Longrightarrow> P) \<Longrightarrow> (max a b = b \<Longrightarrow> P) \<Longrightarrow> P"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>max a b = a \<Longrightarrow> P; max a b = b \<Longrightarrow> P\<rbrakk> \<Longrightarrow> P
[PROOF STEP]
by (metis max_def)


[STATEMENT]
lemma laz_conj[simp]: "list_all_zip (\<lambda>x y. P x y \<and> Q x y) a b
                       \<longleftrightarrow> list_all_zip P a b \<and> list_all_zip Q a b"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. list_all_zip (\<lambda>x y. P x y \<and> Q x y) a b = (list_all_zip P a b \<and> list_all_zip Q a b)
[PROOF STEP]
by (auto simp add: list_all_zip_alt)


[STATEMENT]
lemma rQuot_lQuot: "rQuot a (lQuot b A) = lQuot b (rQuot a A)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. rQuot a (lQuot b A) = lQuot b (rQuot a A)
[PROOF STEP]
unfolding lQuot_def rQuot_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {xs. xs @ [a] \<in> {xs. b # xs \<in> A}} = {xs. b # xs \<in> {xs. xs @ [a] \<in> A}}
[PROOF STEP]
by auto


[STATEMENT]
lemma strict_mono_imp_strict_mono_on: "strict_mono f \<Longrightarrow> strict_mono_on f A"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. strict_mono f \<Longrightarrow> SetInterval2.strict_mono_on f A
[PROOF STEP]
unfolding strict_mono_on_def strict_mono_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>x y. x < y \<longrightarrow> f x < f y \<Longrightarrow> \<forall>a\<in>A. \<forall>b\<in>A. a < b \<longrightarrow> f a < f b
[PROOF STEP]
by blast


[STATEMENT]
lemma (in abelian_group) minus_other_side [simp]:
  "\<lbrakk>a\<in>carrier G; b\<in>carrier G\<rbrakk> \<Longrightarrow> (a\<ominus>\<^bsub>G\<^esub>b = \<zero>\<^bsub>G\<^esub>) = (a=b)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>a \<in> carrier G; b \<in> carrier G\<rbrakk> \<Longrightarrow> (a \<ominus> b = \<zero>) = (a = b)
[PROOF STEP]
by (metis a_minus_def add.inv_closed add.m_comm r_neg r_neg2)


[STATEMENT]
lemma trans_D: "P \<sqsubseteq>\<^sub>D Q \<Longrightarrow> Q \<sqsubseteq>\<^sub>D S \<Longrightarrow> P \<sqsubseteq>\<^sub>D S"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>P \<sqsubseteq>\<^sub>D Q; Q \<sqsubseteq>\<^sub>D S\<rbrakk> \<Longrightarrow> P \<sqsubseteq>\<^sub>D S
[PROOF STEP]
by (meson divergence_refine_def order_trans)


[STATEMENT]
lemma functions_of_subset_of:
  assumes "finite A"
  assumes "F \<in> {f \<in> A \<rightarrow>\<^sub>E B. inj_on f A} // domain_permutation A B"
  shows "functions_of A (subset_of A F) = F"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. functions_of A (subset_of A F) = F
[PROOF STEP]
using assms(2)
[PROOF STATE]
proof (prove)
using this:
F \<in> {f \<in> A \<rightarrow>\<^sub>E B. inj_on f A} // domain_permutation A B

goal (1 subgoal):
 1. functions_of A (subset_of A F) = F
[PROOF STEP]
proof (rule quotientE)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>F = domain_permutation A B `` {x}; x \<in> {f \<in> A \<rightarrow>\<^sub>E B. inj_on f A}\<rbrakk> \<Longrightarrow> functions_of A (subset_of A F) = F
[PROOF STEP]
fix f
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>F = domain_permutation A B `` {x}; x \<in> {f \<in> A \<rightarrow>\<^sub>E B. inj_on f A}\<rbrakk> \<Longrightarrow> functions_of A (subset_of A F) = F
[PROOF STEP]
assume f: "f \<in> {f \<in> A \<rightarrow>\<^sub>E B. inj_on f A}"
    and F_eq: "F = domain_permutation A B `` {f}"
[PROOF STATE]
proof (state)
this:
f \<in> {f \<in> A \<rightarrow>\<^sub>E B. inj_on f A}
F = domain_permutation A B `` {f}

goal (1 subgoal):
 1. \<And>x. \<lbrakk>F = domain_permutation A B `` {x}; x \<in> {f \<in> A \<rightarrow>\<^sub>E B. inj_on f A}\<rbrakk> \<Longrightarrow> functions_of A (subset_of A F) = F
[PROOF STEP]
from this
[PROOF STATE]
proof (chain)
picking this:
f \<in> {f \<in> A \<rightarrow>\<^sub>E B. inj_on f A}
F = domain_permutation A B `` {f}
[PROOF STEP]
have "subset_of A (domain_permutation A B `` {f}) = f ` A"
[PROOF STATE]
proof (prove)
using this:
f \<in> {f \<in> A \<rightarrow>\<^sub>E B. inj_on f A}
F = domain_permutation A B `` {f}

goal (1 subgoal):
 1. subset_of A (domain_permutation A B `` {f}) = f ` A
[PROOF STEP]
using equiv_domain_permutation image_respects_domain_permutation
[PROOF STATE]
proof (prove)
using this:
f \<in> {f \<in> A \<rightarrow>\<^sub>E B. inj_on f A}
F = domain_permutation A B `` {f}
equiv (?A \<rightarrow>\<^sub>E ?B) (domain_permutation ?A ?B)
(\<lambda>f. f ` ?A) respects domain_permutation ?A ?B

goal (1 subgoal):
 1. subset_of A (domain_permutation A B `` {f}) = f ` A
[PROOF STEP]
unfolding subset_of_def
[PROOF STATE]
proof (prove)
using this:
f \<in> {f \<in> A \<rightarrow>\<^sub>E B. inj_on f A}
F = domain_permutation A B `` {f}
equiv (?A \<rightarrow>\<^sub>E ?B) (domain_permutation ?A ?B)
(\<lambda>f. f ` ?A) respects domain_permutation ?A ?B

goal (1 subgoal):
 1. univ (\<lambda>f. f ` A) (domain_permutation A B `` {f}) = f ` A
[PROOF STEP]
by (intro univ_commute') auto
[PROOF STATE]
proof (state)
this:
subset_of A (domain_permutation A B `` {f}) = f ` A

goal (1 subgoal):
 1. \<And>x. \<lbrakk>F = domain_permutation A B `` {x}; x \<in> {f \<in> A \<rightarrow>\<^sub>E B. inj_on f A}\<rbrakk> \<Longrightarrow> functions_of A (subset_of A F) = F
[PROOF STEP]
from this f F_eq \<open>finite A\<close>
[PROOF STATE]
proof (chain)
picking this:
subset_of A (domain_permutation A B `` {f}) = f ` A
f \<in> {f \<in> A \<rightarrow>\<^sub>E B. inj_on f A}
F = domain_permutation A B `` {f}
finite A
[PROOF STEP]
show "functions_of A (subset_of A F) = F"
[PROOF STATE]
proof (prove)
using this:
subset_of A (domain_permutation A B `` {f}) = f ` A
f \<in> {f \<in> A \<rightarrow>\<^sub>E B. inj_on f A}
F = domain_permutation A B `` {f}
finite A

goal (1 subgoal):
 1. functions_of A (subset_of A F) = F
[PROOF STEP]
by (simp add: functions_of_eq)
[PROOF STATE]
proof (state)
this:
functions_of A (subset_of A F) = F

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma LIMSEQ_I: "(\<And>r. 0 < r \<Longrightarrow> \<exists>no. \<forall>n\<ge>no. norm (X n - L) < r) \<Longrightarrow> X \<longlonglongrightarrow> L"
  for L :: "'a::real_normed_vector"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>r. 0 < r \<Longrightarrow> \<exists>no. \<forall>n\<ge>no. norm (X n - L) < r) \<Longrightarrow> X \<longlonglongrightarrow> L
[PROOF STEP]
by (simp add: LIMSEQ_iff)


[STATEMENT]
lemma poly_mod_minus_left [simp]: "(- x) mod y = - (x mod y)"
  for x y :: "'a::field poly"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. - x mod y = - (x mod y)
[PROOF STEP]
using mod_smult_left [of "- 1::'a"]
[PROOF STATE]
proof (prove)
using this:
smult (- (1::'a)) ?x mod ?y = smult (- (1::'a)) (?x mod ?y)

goal (1 subgoal):
 1. - x mod y = - (x mod y)
[PROOF STEP]
by simp


[STATEMENT]
lemma carrier_dim_vec: "v \<in> carrier_vec n \<longleftrightarrow> dim_vec v = n"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (v \<in> carrier_vec n) = (dim_vec v = n)
[PROOF STEP]
unfolding carrier_vec_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (v \<in> {v. dim_vec v = n}) = (dim_vec v = n)
[PROOF STEP]
by auto


[STATEMENT]
lemma sum_assoc_eqpoll: "elts ((a\<Uplus>b)\<Uplus>c) \<approx> elts (a\<Uplus>(b\<Uplus>c))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. elts (a \<Uplus> b \<Uplus> c) \<approx> elts (a \<Uplus> (b \<Uplus> c))
[PROOF STEP]
unfolding eqpoll_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>f. bij_betw f (elts (a \<Uplus> b \<Uplus> c)) (elts (a \<Uplus> (b \<Uplus> c)))
[PROOF STEP]
by (metis sum_assoc_bij)


[STATEMENT]
lemma exteq_infinite:
  assumes "recfn a f"
  shows "infinite {g. recfn a g \<and> g \<simeq> f}" (is "infinite ?R")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. infinite {g. recfn a g \<and> g \<simeq> f}
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. infinite {g. recfn a g \<and> g \<simeq> f}
[PROOF STEP]
have "inj (wrap_Id f)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. inj (wrap_Id f)
[PROOF STEP]
using wrap_Id_injective \<open>recfn a f\<close>
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>recfn ?a ?f; wrap_Id ?f ?n\<^sub>1 = wrap_Id ?f ?n\<^sub>2\<rbrakk> \<Longrightarrow> ?n\<^sub>1 = ?n\<^sub>2
recfn a f

goal (1 subgoal):
 1. inj (wrap_Id f)
[PROOF STEP]
by (meson inj_onI)
[PROOF STATE]
proof (state)
this:
inj (wrap_Id f)

goal (1 subgoal):
 1. infinite {g. recfn a g \<and> g \<simeq> f}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
inj (wrap_Id f)
[PROOF STEP]
have "infinite (range (wrap_Id f))"
[PROOF STATE]
proof (prove)
using this:
inj (wrap_Id f)

goal (1 subgoal):
 1. infinite (range (wrap_Id f))
[PROOF STEP]
using finite_imageD
[PROOF STATE]
proof (prove)
using this:
inj (wrap_Id f)
\<lbrakk>finite (?f ` ?A); inj_on ?f ?A\<rbrakk> \<Longrightarrow> finite ?A

goal (1 subgoal):
 1. infinite (range (wrap_Id f))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
infinite (range (wrap_Id f))

goal (1 subgoal):
 1. infinite {g. recfn a g \<and> g \<simeq> f}
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
infinite (range (wrap_Id f))

goal (1 subgoal):
 1. infinite {g. recfn a g \<and> g \<simeq> f}
[PROOF STEP]
have "range (wrap_Id f) \<subseteq> ?R"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. range (wrap_Id f) \<subseteq> {g. recfn a g \<and> g \<simeq> f}
[PROOF STEP]
using assms exteq_sym exteq_wrap_Id recfn_wrap_Id
[PROOF STATE]
proof (prove)
using this:
recfn a f
?f \<simeq> ?g \<Longrightarrow> ?g \<simeq> ?f
recfn ?a ?f \<Longrightarrow> ?f \<simeq> wrap_Id ?f ?n
recfn ?a ?f \<Longrightarrow> recfn ?a (wrap_Id ?f ?n)

goal (1 subgoal):
 1. range (wrap_Id f) \<subseteq> {g. recfn a g \<and> g \<simeq> f}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
range (wrap_Id f) \<subseteq> {g. recfn a g \<and> g \<simeq> f}

goal (1 subgoal):
 1. infinite {g. recfn a g \<and> g \<simeq> f}
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
infinite (range (wrap_Id f))
range (wrap_Id f) \<subseteq> {g. recfn a g \<and> g \<simeq> f}
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
infinite (range (wrap_Id f))
range (wrap_Id f) \<subseteq> {g. recfn a g \<and> g \<simeq> f}

goal (1 subgoal):
 1. infinite {g. recfn a g \<and> g \<simeq> f}
[PROOF STEP]
by (simp add: infinite_super)
[PROOF STATE]
proof (state)
this:
infinite {g. recfn a g \<and> g \<simeq> f}

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma llist_all2_lnullD: "llist_all2 P xs ys \<Longrightarrow> lnull xs \<longleftrightarrow> lnull ys"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. llist_all2 P xs ys \<Longrightarrow> lnull xs = lnull ys
[PROOF STEP]
unfolding lnull_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. llist_all2 P xs ys \<Longrightarrow> (xs = LNil) = (ys = LNil)
[PROOF STEP]
by auto


[STATEMENT]
lemma eventually_going_toI [intro]:
  assumes "eventually P F"
  shows   "eventually (\<lambda>x. P (f x)) (f going_to F)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>\<^sub>F x in f going_to F. P (f x)
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
eventually P F

goal (1 subgoal):
 1. \<forall>\<^sub>F x in f going_to F. P (f x)
[PROOF STEP]
by (auto simp: going_to_def)


[STATEMENT]
lemma less_eqI [intro?]: "length xs = length ys \<Longrightarrow> \<forall>i<length xs. xs ! i \<le> ys ! i \<Longrightarrow> xs \<le>\<^sub>v ys"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>length xs = length ys; \<forall>i<length xs. xs ! i \<le> ys ! i\<rbrakk> \<Longrightarrow> xs \<le>\<^sub>v ys
[PROOF STEP]
by (auto simp: less_eq_def)


[STATEMENT]
lemma integral_by_parts_integrable:
  fixes f g F G::"real \<Rightarrow> real"
  assumes "a \<le> b"
  assumes cont_f[intro]: "continuous_on {a..b} f"
  assumes cont_g[intro]: "continuous_on {a..b} g"
  assumes [intro]: "\<And>x. x \<in> {a..b} \<Longrightarrow> (F has_field_derivative f x) (at x within {a..b})"
  assumes [intro]: "\<And>x. x \<in> {a..b} \<Longrightarrow> (G has_field_derivative g x) (at x within {a..b})"
  shows  "integrable lborel (\<lambda>x.((F x) * (g x) + (f x) * (G x)) * indicator {a .. b} x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. integrable lborel (\<lambda>x. (F x * g x + f x * G x) * indicat_real {a..b} x)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. integrable lborel (\<lambda>x. (F x * g x + f x * G x) * indicat_real {a..b} x)
[PROOF STEP]
have "integrable lborel (\<lambda>x. indicator {a..b} x *\<^sub>R ((F x) * (g x) + (f x) * (G x)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. integrable lborel (\<lambda>x. indicat_real {a..b} x *\<^sub>R (F x * g x + f x * G x))
[PROOF STEP]
by (intro borel_integrable_compact continuous_intros assms)
       (auto intro!: DERIV_continuous_on assms)
[PROOF STATE]
proof (state)
this:
integrable lborel (\<lambda>x. indicat_real {a..b} x *\<^sub>R (F x * g x + f x * G x))

goal (1 subgoal):
 1. integrable lborel (\<lambda>x. (F x * g x + f x * G x) * indicat_real {a..b} x)
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
integrable lborel (\<lambda>x. indicat_real {a..b} x *\<^sub>R (F x * g x + f x * G x))

goal (1 subgoal):
 1. integrable lborel (\<lambda>x. (F x * g x + f x * G x) * indicat_real {a..b} x)
[PROOF STEP]
by (simp add: mult_ac)
[PROOF STATE]
proof (state)
this:
integrable lborel (\<lambda>x. (F x * g x + f x * G x) * indicat_real {a..b} x)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma (in sigma_finite_measure) KL_density:
  fixes f :: "'a \<Rightarrow> real"
  assumes "1 < b"
  assumes f[measurable]: "f \<in> borel_measurable M" and nn: "AE x in M. 0 \<le> f x"
  shows "KL_divergence b M (density M f) = (\<integral>x. f x * log b (f x) \<partial>M)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. KL_divergence b M (density M (\<lambda>x. ennreal (f x))) = LINT x|M. f x * log b (f x)
[PROOF STEP]
unfolding KL_divergence_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. integral\<^sup>L (density M (\<lambda>x. ennreal (f x))) (entropy_density b M (density M (\<lambda>x. ennreal (f x)))) = LINT x|M. f x * log b (f x)
[PROOF STEP]
proof (subst integral_real_density)
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. f \<in> borel_measurable M
 2. AE x in M. 0 \<le> f x
 3. entropy_density b M (density M (\<lambda>x. ennreal (f x))) \<in> borel_measurable M
 4. LINT x|M. f x * entropy_density b M (density M (\<lambda>x. ennreal (f x))) x = LINT x|M. f x * log b (f x)
[PROOF STEP]
show [measurable]: "entropy_density b M (density M (\<lambda>x. ennreal (f x))) \<in> borel_measurable M"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. entropy_density b M (density M (\<lambda>x. ennreal (f x))) \<in> borel_measurable M
[PROOF STEP]
using f
[PROOF STATE]
proof (prove)
using this:
f \<in> borel_measurable M

goal (1 subgoal):
 1. entropy_density b M (density M (\<lambda>x. ennreal (f x))) \<in> borel_measurable M
[PROOF STEP]
by (auto simp: comp_def entropy_density_def)
[PROOF STATE]
proof (state)
this:
entropy_density b M (density M (\<lambda>x. ennreal (f x))) \<in> borel_measurable M

goal (3 subgoals):
 1. f \<in> borel_measurable M
 2. AE x in M. 0 \<le> f x
 3. LINT x|M. f x * entropy_density b M (density M (\<lambda>x. ennreal (f x))) x = LINT x|M. f x * log b (f x)
[PROOF STEP]
have "density M (RN_deriv M (density M f)) = density M f"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. density M (RN_deriv M (density M (\<lambda>x. ennreal (f x)))) = density M (\<lambda>x. ennreal (f x))
[PROOF STEP]
using f nn
[PROOF STATE]
proof (prove)
using this:
f \<in> borel_measurable M
AE x in M. 0 \<le> f x

goal (1 subgoal):
 1. density M (RN_deriv M (density M (\<lambda>x. ennreal (f x)))) = density M (\<lambda>x. ennreal (f x))
[PROOF STEP]
by (intro density_RN_deriv_density) auto
[PROOF STATE]
proof (state)
this:
density M (RN_deriv M (density M (\<lambda>x. ennreal (f x)))) = density M (\<lambda>x. ennreal (f x))

goal (3 subgoals):
 1. f \<in> borel_measurable M
 2. AE x in M. 0 \<le> f x
 3. LINT x|M. f x * entropy_density b M (density M (\<lambda>x. ennreal (f x))) x = LINT x|M. f x * log b (f x)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
density M (RN_deriv M (density M (\<lambda>x. ennreal (f x)))) = density M (\<lambda>x. ennreal (f x))
[PROOF STEP]
have eq: "AE x in M. RN_deriv M (density M f) x = f x"
[PROOF STATE]
proof (prove)
using this:
density M (RN_deriv M (density M (\<lambda>x. ennreal (f x)))) = density M (\<lambda>x. ennreal (f x))

goal (1 subgoal):
 1. AE x in M. RN_deriv M (density M (\<lambda>x. ennreal (f x))) x = ennreal (f x)
[PROOF STEP]
using f nn
[PROOF STATE]
proof (prove)
using this:
density M (RN_deriv M (density M (\<lambda>x. ennreal (f x)))) = density M (\<lambda>x. ennreal (f x))
f \<in> borel_measurable M
AE x in M. 0 \<le> f x

goal (1 subgoal):
 1. AE x in M. RN_deriv M (density M (\<lambda>x. ennreal (f x))) x = ennreal (f x)
[PROOF STEP]
by (intro density_unique) auto
[PROOF STATE]
proof (state)
this:
AE x in M. RN_deriv M (density M (\<lambda>x. ennreal (f x))) x = ennreal (f x)

goal (3 subgoals):
 1. f \<in> borel_measurable M
 2. AE x in M. 0 \<le> f x
 3. LINT x|M. f x * entropy_density b M (density M (\<lambda>x. ennreal (f x))) x = LINT x|M. f x * log b (f x)
[PROOF STEP]
show "(\<integral>x. f x * entropy_density b M (density M (\<lambda>x. ennreal (f x))) x \<partial>M) = (\<integral>x. f x * log b (f x) \<partial>M)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. LINT x|M. f x * entropy_density b M (density M (\<lambda>x. ennreal (f x))) x = LINT x|M. f x * log b (f x)
[PROOF STEP]
apply (intro integral_cong_AE)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. (\<lambda>x. f x * entropy_density b M (density M (\<lambda>x. ennreal (f x))) x) \<in> borel_measurable M
 2. (\<lambda>x. f x * log b (f x)) \<in> borel_measurable M
 3. AE x in M. f x * entropy_density b M (density M (\<lambda>x. ennreal (f x))) x = f x * log b (f x)
[PROOF STEP]
apply measurable
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. AE x in M. f x * entropy_density b M (density M (\<lambda>x. ennreal (f x))) x = f x * log b (f x)
[PROOF STEP]
using eq nn
[PROOF STATE]
proof (prove)
using this:
AE x in M. RN_deriv M (density M (\<lambda>x. ennreal (f x))) x = ennreal (f x)
AE x in M. 0 \<le> f x

goal (1 subgoal):
 1. AE x in M. f x * entropy_density b M (density M (\<lambda>x. ennreal (f x))) x = f x * log b (f x)
[PROOF STEP]
apply eventually_elim
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>RN_deriv M (density M (\<lambda>x. ennreal (f x))) x = ennreal (f x); 0 \<le> f x\<rbrakk> \<Longrightarrow> f x * entropy_density b M (density M (\<lambda>x. ennreal (f x))) x = f x * log b (f x)
[PROOF STEP]
apply (auto simp: entropy_density_def)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
LINT x|M. f x * entropy_density b M (density M (\<lambda>x. ennreal (f x))) x = LINT x|M. f x * log b (f x)

goal (2 subgoals):
 1. f \<in> borel_measurable M
 2. AE x in M. 0 \<le> f x
[PROOF STEP]
qed fact+


[STATEMENT]
lemma mcont2mcont_ennreal_spmf [THEN mcont2mcont, cont_intro]:
  shows mcont_ennreal_spmf: "mcont lub_spmf (ord_spmf (=)) Sup (\<le>) (\<lambda>p. ennreal (spmf p x))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mcont lub_spmf (ord_spmf (=)) Sup (\<le>) (\<lambda>p. ennreal (spmf p x))
[PROOF STEP]
by(rule mcontI mono2mono_ennreal monotone_spmf cont_ennreal_spmf)+


[STATEMENT]
lemma Liminf_ereal_mult_left:
  assumes "F \<noteq> bot" "(c::real) \<ge> 0"
    shows "Liminf F (\<lambda>n. ereal c * f n) = ereal c * Liminf F f"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Liminf F (\<lambda>n. ereal c * f n) = ereal c * Liminf F f
[PROOF STEP]
using Liminf_ereal_mult_right[OF assms]
[PROOF STATE]
proof (prove)
using this:
Liminf F (\<lambda>n. ?f n * ereal c) = Liminf F ?f * ereal c

goal (1 subgoal):
 1. Liminf F (\<lambda>n. ereal c * f n) = ereal c * Liminf F f
[PROOF STEP]
by (subst (1 2) mult.commute)


[STATEMENT]
lemma Inf_aform:
  assumes "e \<in> UNIV \<rightarrow> {-1 .. 1}"
  shows "Inf_aform X \<le> aform_val e X"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Inf_aform X \<le> aform_val e X
[PROOF STEP]
using order_trans[OF abs_ge_minus_self abs_pdevs_val_le_tdev[OF assms]]
[PROOF STATE]
proof (prove)
using this:
- pdevs_val e ?x1 \<le> tdev ?x1

goal (1 subgoal):
 1. Inf_aform X \<le> aform_val e X
[PROOF STEP]
by (auto simp: Inf_aform_def aform_val_def minus_le_iff)


[STATEMENT]
lemma arccos_cos: "0 \<le> x \<Longrightarrow> x \<le> pi \<Longrightarrow> arccos (cos x) = x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> x; x \<le> pi\<rbrakk> \<Longrightarrow> arccos (cos x) = x
[PROOF STEP]
by (auto simp: arccos_def intro!: the1_equality cos_total)


[STATEMENT]
lemma d_delta_arctan_upper_34_pos: "diff_delta_arctan_upper_34 x < 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. diff_delta_arctan_upper_34 x < 0
[PROOF STEP]
unfolding diff_delta_arctan_upper_34_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. - 256 / ((5 + 105 * x\<^sup>2 + 315 * x ^ 4 + 231 * x ^ 6)\<^sup>2 * (1 + x\<^sup>2)) < 0
[PROOF STEP]
apply (simp add: divide_simps add_nonneg_eq_0_iff zero_less_mult_iff)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 < 1 + x\<^sup>2
[PROOF STEP]
using power2_less_0 [of x]
[PROOF STATE]
proof (prove)
using this:
\<not> x\<^sup>2 < 0

goal (1 subgoal):
 1. 0 < 1 + x\<^sup>2
[PROOF STEP]
apply arith
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma monad_zero_hcmod_iff: "(x \<in> monad 0) = (hcmod x \<in> monad 0)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (x \<in> monad 0) = (hcmod x \<in> monad 0)
[PROOF STEP]
by (simp add: Infinitesimal_monad_zero_iff [symmetric] Infinitesimal_hcmod_iff)


[STATEMENT]
lemma incl_bijective_on_ide:
    shows "bij_betw incl (Collect R.ide) (Collect ide)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. bij_betw incl (Collect R.ide) (Collect ide)
[PROOF STEP]
using incl_injective_on_ide img_incl_ide bij_betw_def
[PROOF STATE]
proof (prove)
using this:
inj_on incl (Collect R.ide)
incl ` Collect R.ide = Collect ide
bij_betw ?f ?A ?B = (inj_on ?f ?A \<and> ?f ` ?A = ?B)

goal (1 subgoal):
 1. bij_betw incl (Collect R.ide) (Collect ide)
[PROOF STEP]
by blast


[STATEMENT]
theorem meet_related2 [elim?]: "y \<sqsubseteq> x \<Longrightarrow> x \<sqinter> y = y"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. y \<sqsubseteq> x \<Longrightarrow> x \<sqinter> y = y
[PROOF STEP]
by (drule meet_related) (simp add: meet_commute)


[STATEMENT]
lemma of_rat_Real: "of_rat x = Real (\<lambda>n. x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. of_rat x = Real (\<lambda>n. x)
[PROOF STEP]
proof (induct x)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a b. 0 < b \<Longrightarrow> of_rat (Fract a b) = Real (\<lambda>n. Fract a b)
[PROOF STEP]
case (Fract a b)
[PROOF STATE]
proof (state)
this:
0 < b

goal (1 subgoal):
 1. \<And>a b. 0 < b \<Longrightarrow> of_rat (Fract a b) = Real (\<lambda>n. Fract a b)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
0 < b
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
0 < b

goal (1 subgoal):
 1. of_rat (Fract a b) = Real (\<lambda>n. Fract a b)
[PROOF STEP]
apply (simp add: Fract_of_int_quotient of_rat_divide)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 < b \<Longrightarrow> of_int a / of_int b = Real (\<lambda>n. rat_of_int a / rat_of_int b)
[PROOF STEP]
apply (simp add: of_int_Real divide_inverse inverse_Real mult_Real)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
of_rat (Fract a b) = Real (\<lambda>n. Fract a b)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma trans_inv':
"(\<Sum> l\<in>{..<np'}. fiX (\<lambda> y. f y + x) p l) =
        (\<Sum> l\<in>{..<np'}. fiX f p l) + real np' * x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. sum (fiX (\<lambda>y. f y + x) p) {..<np'} = sum (fiX f p) {..<np'} + real np' * x
[PROOF STEP]
apply (induct_tac np')
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. sum (fiX (\<lambda>y. f y + x) p) {..<0} = sum (fiX f p) {..<0} + real 0 * x
 2. \<And>n. sum (fiX (\<lambda>y. f y + x) p) {..<n} = sum (fiX f p) {..<n} + real n * x \<Longrightarrow> sum (fiX (\<lambda>y. f y + x) p) {..<Suc n} = sum (fiX f p) {..<Suc n} + real (Suc n) * x
[PROOF STEP]
apply (auto simp add: cfni_def  fiX_def of_nat_Suc
       distrib_right lessThan_Suc)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma is_loopfree_last:
  assumes "is_loopfree_inv G (ig_arcs_cnt G)"
  shows "loop_free (mk_graph G)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. loop_free (mk_graph G)
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
is_loopfree_inv G (ig_arcs_cnt G)

goal (1 subgoal):
 1. loop_free (mk_graph G)
[PROOF STEP]
apply (auto simp: is_loopfree_inv_def loop_free_def mkg_simps in_set_conv_nth symcl_def)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>b i. \<lbrakk>\<forall>j<length (ig_arcs G). fst (ig_arcs G ! j) \<noteq> snd (ig_arcs G ! j); i < length (ig_arcs G); ig_arcs G ! i = (b, b)\<rbrakk> \<Longrightarrow> False
 2. \<And>aa i. \<lbrakk>\<forall>j<length (ig_arcs G). fst (ig_arcs G ! j) \<noteq> snd (ig_arcs G ! j); i < length (ig_arcs G); ig_arcs G ! i = (aa, aa)\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply (metis fst_eqD snd_eqD)+
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma measure_UNION:
  assumes measurable: "range A \<subseteq> sets M" "disjoint_family A"
  assumes finite: "emeasure M (\<Union>i. A i) \<noteq> \<infinity>"
  shows "(\<lambda>i. measure M (A i)) sums (measure M (\<Union>i. A i))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lambda>i. Sigma_Algebra.measure M (A i)) sums Sigma_Algebra.measure M (\<Union> (range A))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (\<lambda>i. Sigma_Algebra.measure M (A i)) sums Sigma_Algebra.measure M (\<Union> (range A))
[PROOF STEP]
have "(\<lambda>i. emeasure M (A i)) sums (emeasure M (\<Union>i. A i))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lambda>i. emeasure M (A i)) sums emeasure M (\<Union> (range A))
[PROOF STEP]
unfolding suminf_emeasure[OF measurable, symmetric]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lambda>i. emeasure M (A i)) sums (\<Sum>i. emeasure M (A i))
[PROOF STEP]
by (simp add: summable_sums)
[PROOF STATE]
proof (state)
this:
(\<lambda>i. emeasure M (A i)) sums emeasure M (\<Union> (range A))

goal (1 subgoal):
 1. (\<lambda>i. Sigma_Algebra.measure M (A i)) sums Sigma_Algebra.measure M (\<Union> (range A))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(\<lambda>i. emeasure M (A i)) sums emeasure M (\<Union> (range A))

goal (1 subgoal):
 1. (\<lambda>i. Sigma_Algebra.measure M (A i)) sums Sigma_Algebra.measure M (\<Union> (range A))
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
(\<lambda>i. emeasure M (A i)) sums emeasure M (\<Union> (range A))

goal (1 subgoal):
 1. (\<lambda>i. Sigma_Algebra.measure M (A i)) sums Sigma_Algebra.measure M (\<Union> (range A))
[PROOF STEP]
fix i
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (\<lambda>i. Sigma_Algebra.measure M (A i)) sums Sigma_Algebra.measure M (\<Union> (range A))
[PROOF STEP]
have "emeasure M (A i) \<le> emeasure M (\<Union>i. A i)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. emeasure M (A i) \<le> emeasure M (\<Union> (range A))
[PROOF STEP]
using measurable
[PROOF STATE]
proof (prove)
using this:
range A \<subseteq> sets M
disjoint_family A

goal (1 subgoal):
 1. emeasure M (A i) \<le> emeasure M (\<Union> (range A))
[PROOF STEP]
by (auto intro!: emeasure_mono)
[PROOF STATE]
proof (state)
this:
emeasure M (A i) \<le> emeasure M (\<Union> (range A))

goal (1 subgoal):
 1. (\<lambda>i. Sigma_Algebra.measure M (A i)) sums Sigma_Algebra.measure M (\<Union> (range A))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
emeasure M (A i) \<le> emeasure M (\<Union> (range A))
[PROOF STEP]
have "emeasure M (A i) = ennreal ((measure M (A i)))"
[PROOF STATE]
proof (prove)
using this:
emeasure M (A i) \<le> emeasure M (\<Union> (range A))

goal (1 subgoal):
 1. emeasure M (A i) = ennreal (Sigma_Algebra.measure M (A i))
[PROOF STEP]
using finite
[PROOF STATE]
proof (prove)
using this:
emeasure M (A i) \<le> emeasure M (\<Union> (range A))
emeasure M (\<Union> (range A)) \<noteq> \<infinity>

goal (1 subgoal):
 1. emeasure M (A i) = ennreal (Sigma_Algebra.measure M (A i))
[PROOF STEP]
by (intro emeasure_eq_ennreal_measure) (auto simp: top_unique)
[PROOF STATE]
proof (state)
this:
emeasure M (A i) = ennreal (Sigma_Algebra.measure M (A i))

goal (1 subgoal):
 1. (\<lambda>i. Sigma_Algebra.measure M (A i)) sums Sigma_Algebra.measure M (\<Union> (range A))
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
emeasure M (A ?i2) = ennreal (Sigma_Algebra.measure M (A ?i2))

goal (1 subgoal):
 1. (\<lambda>i. Sigma_Algebra.measure M (A i)) sums Sigma_Algebra.measure M (\<Union> (range A))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
(\<lambda>i. emeasure M (A i)) sums emeasure M (\<Union> (range A))
emeasure M (A ?i2) = ennreal (Sigma_Algebra.measure M (A ?i2))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
(\<lambda>i. emeasure M (A i)) sums emeasure M (\<Union> (range A))
emeasure M (A ?i2) = ennreal (Sigma_Algebra.measure M (A ?i2))

goal (1 subgoal):
 1. (\<lambda>i. Sigma_Algebra.measure M (A i)) sums Sigma_Algebra.measure M (\<Union> (range A))
[PROOF STEP]
using finite
[PROOF STATE]
proof (prove)
using this:
(\<lambda>i. emeasure M (A i)) sums emeasure M (\<Union> (range A))
emeasure M (A ?i2) = ennreal (Sigma_Algebra.measure M (A ?i2))
emeasure M (\<Union> (range A)) \<noteq> \<infinity>

goal (1 subgoal):
 1. (\<lambda>i. Sigma_Algebra.measure M (A i)) sums Sigma_Algebra.measure M (\<Union> (range A))
[PROOF STEP]
by (subst (asm) (2) emeasure_eq_ennreal_measure) simp_all
[PROOF STATE]
proof (state)
this:
(\<lambda>i. Sigma_Algebra.measure M (A i)) sums Sigma_Algebra.measure M (\<Union> (range A))

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma sameCC_reachable: "E' \<subseteq> E \<Longrightarrow> u\<in>V \<Longrightarrow> v\<in>V \<Longrightarrow> CC E' u = CC E' v \<longleftrightarrow> (u,v) \<in> connected E'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>E' \<subseteq> E; u \<in> V; v \<in> V\<rbrakk> \<Longrightarrow> (CC E' u = CC E' v) = ((u, v) \<in> connected E')
[PROOF STEP]
unfolding CC_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>E' \<subseteq> E; u \<in> V; v \<in> V\<rbrakk> \<Longrightarrow> (connected E' `` {u} = connected E' `` {v}) = ((u, v) \<in> connected E')
[PROOF STEP]
using  equiv_class_eq_iff[OF equiv ]
[PROOF STATE]
proof (prove)
using this:
?F1 \<subseteq> E \<Longrightarrow> ((?x, ?y) \<in> connected ?F1) = (connected ?F1 `` {?x} = connected ?F1 `` {?y} \<and> ?x \<in> V \<and> ?y \<in> V)

goal (1 subgoal):
 1. \<lbrakk>E' \<subseteq> E; u \<in> V; v \<in> V\<rbrakk> \<Longrightarrow> (connected E' `` {u} = connected E' `` {v}) = ((u, v) \<in> connected E')
[PROOF STEP]
by auto


[STATEMENT]
lemma disjoint_terminal_Collect:
  assumes "s \<noteq> t"
  assumes "\<And>x x'. S x \<and> T x' \<Longrightarrow> x = x' \<Longrightarrow> s = t"
  shows "{x. S x} \<inter> {x. T x} = {}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {x. S x} \<inter> {x. T x} = {}
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
s \<noteq> t
\<lbrakk>S ?x \<and> T ?x'; ?x = ?x'\<rbrakk> \<Longrightarrow> s = t

goal (1 subgoal):
 1. {x. S x} \<inter> {x. T x} = {}
[PROOF STEP]
by auto


[STATEMENT]
lemma finite_sumset:
  assumes "finite A" "finite B"  shows "finite (sumset A B)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. finite (sumset A B)
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
finite A
finite B

goal (1 subgoal):
 1. finite (sumset A B)
[PROOF STEP]
by (auto simp: sumset_eq)


[STATEMENT]
lemma strict_sorted_iff: "sorted_wrt (<) l \<longleftrightarrow> sorted l \<and> distinct l"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. sorted_wrt (<) l = (sorted l \<and> distinct l)
[PROOF STEP]
by (induction l) (auto iff: antisym_conv1)


[STATEMENT]
lemma (in comm_monoid_mult) prod_list_multf:
  "(\<Prod>x\<leftarrow>xs. f x * g x) = prod_list (map f xs) * prod_list (map g xs)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Prod>x\<leftarrow>xs. f x * g x) = prod_list (map f xs) * prod_list (map g xs)
[PROOF STEP]
by (induct xs) (simp_all add: algebra_simps)


[STATEMENT]
lemma robdd_\<alpha>_invar_greater :
assumes invar_vars: "robdd_invar_vars_greater n b"
    and a_equiv: "\<And>v. v \<ge> n \<Longrightarrow> a1 v = a2 v"
shows  "robdd_\<alpha> b a1 = robdd_\<alpha> b a2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. robdd_\<alpha> b a1 = robdd_\<alpha> b a2
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
robdd_invar_vars_greater n b
n \<le> ?v \<Longrightarrow> a1 ?v = a2 ?v

goal (1 subgoal):
 1. robdd_\<alpha> b a1 = robdd_\<alpha> b a2
[PROOF STEP]
apply (induct b)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>robdd_invar_vars_greater n (robdd_leaf x); \<And>v. n \<le> v \<Longrightarrow> a1 v = a2 v\<rbrakk> \<Longrightarrow> robdd_\<alpha> (robdd_leaf x) a1 = robdd_\<alpha> (robdd_leaf x) a2
 2. \<And>x1a b1 x3 b2. \<lbrakk>\<lbrakk>robdd_invar_vars_greater n b1; \<And>v. n \<le> v \<Longrightarrow> a1 v = a2 v\<rbrakk> \<Longrightarrow> robdd_\<alpha> b1 a1 = robdd_\<alpha> b1 a2; \<lbrakk>robdd_invar_vars_greater n b2; \<And>v. n \<le> v \<Longrightarrow> a1 v = a2 v\<rbrakk> \<Longrightarrow> robdd_\<alpha> b2 a1 = robdd_\<alpha> b2 a2; robdd_invar_vars_greater n (robdd_var x1a b1 x3 b2); \<And>v. n \<le> v \<Longrightarrow> a1 v = a2 v\<rbrakk> \<Longrightarrow> robdd_\<alpha> (robdd_var x1a b1 x3 b2) a1 = robdd_\<alpha> (robdd_var x1a b1 x3 b2) a2
[PROOF STEP]
apply (simp_all)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>b1 x3 b2. \<lbrakk>robdd_invar_vars_greater n b1 \<Longrightarrow> robdd_\<alpha> b1 a1 = robdd_\<alpha> b1 a2; robdd_invar_vars_greater n b2 \<Longrightarrow> robdd_\<alpha> b2 a1 = robdd_\<alpha> b2 a2; n \<le> x3 \<and> robdd_invar_vars_greater (Suc x3) b1 \<and> robdd_invar_vars_greater (Suc x3) b2; \<And>v. n \<le> v \<Longrightarrow> a1 v = a2 v\<rbrakk> \<Longrightarrow> (a2 x3 \<longrightarrow> robdd_\<alpha> b1 a1 = robdd_\<alpha> b1 a2) \<and> (\<not> a2 x3 \<longrightarrow> robdd_\<alpha> b2 a1 = robdd_\<alpha> b2 a2)
[PROOF STEP]
apply (metis le_Suc_eq robdd_invar_vars_greater___weaken)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma rcis_zero_mod [simp]: "rcis 0 a = 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. rcis 0 a = 0
[PROOF STEP]
by (simp add: rcis_def)


[STATEMENT]
lemma arctan_conv_pre_arctan:
  assumes "norm x < 1"
  shows   "arctan x = x * powser (msllist_of_msstream arctan_series_stream) (x ^ 2)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. arctan x = x * powser (msllist_of_msstream arctan_series_stream) (x\<^sup>2)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. arctan x = x * powser (msllist_of_msstream arctan_series_stream) (x\<^sup>2)
[PROOF STEP]
from assms
[PROOF STATE]
proof (chain)
picking this:
norm x < 1
[PROOF STEP]
have "norm x * norm x < 1 * 1"
[PROOF STATE]
proof (prove)
using this:
norm x < 1

goal (1 subgoal):
 1. norm x * norm x < 1 * 1
[PROOF STEP]
by (intro mult_strict_mono) auto
[PROOF STATE]
proof (state)
this:
norm x * norm x < 1 * 1

goal (1 subgoal):
 1. arctan x = x * powser (msllist_of_msstream arctan_series_stream) (x\<^sup>2)
[PROOF STEP]
hence norm_less: "norm (x ^ 2) < 1"
[PROOF STATE]
proof (prove)
using this:
norm x * norm x < 1 * 1

goal (1 subgoal):
 1. norm (x\<^sup>2) < 1
[PROOF STEP]
by (simp add: power2_eq_square)
[PROOF STATE]
proof (state)
this:
norm (x\<^sup>2) < 1

goal (1 subgoal):
 1. arctan x = x * powser (msllist_of_msstream arctan_series_stream) (x\<^sup>2)
[PROOF STEP]
have "(\<lambda>n. arctan_coeffs n * x ^ n) sums arctan x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lambda>n. arctan_coeffs n * x ^ n) sums arctan x
[PROOF STEP]
by (intro arctan_converges assms)
[PROOF STATE]
proof (state)
this:
(\<lambda>n. arctan_coeffs n * x ^ n) sums arctan x

goal (1 subgoal):
 1. arctan x = x * powser (msllist_of_msstream arctan_series_stream) (x\<^sup>2)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(\<lambda>n. arctan_coeffs n * x ^ n) sums arctan x

goal (1 subgoal):
 1. arctan x = x * powser (msllist_of_msstream arctan_series_stream) (x\<^sup>2)
[PROOF STEP]
have "?this \<longleftrightarrow> (\<lambda>n. arctan_coeffs (2 * n + 1) * x ^ (2 * n + 1)) sums arctan x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lambda>n. arctan_coeffs n * x ^ n) sums arctan x = (\<lambda>n. arctan_coeffs (2 * n + 1) * x ^ (2 * n + 1)) sums arctan x
[PROOF STEP]
by (intro sums_mono_reindex [symmetric])
       (auto simp: arctan_coeffs_def strict_mono_def elim!: oddE)
[PROOF STATE]
proof (state)
this:
(\<lambda>n. arctan_coeffs n * x ^ n) sums arctan x = (\<lambda>n. arctan_coeffs (2 * n + 1) * x ^ (2 * n + 1)) sums arctan x

goal (1 subgoal):
 1. arctan x = x * powser (msllist_of_msstream arctan_series_stream) (x\<^sup>2)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(\<lambda>n. arctan_coeffs n * x ^ n) sums arctan x = (\<lambda>n. arctan_coeffs (2 * n + 1) * x ^ (2 * n + 1)) sums arctan x

goal (1 subgoal):
 1. arctan x = x * powser (msllist_of_msstream arctan_series_stream) (x\<^sup>2)
[PROOF STEP]
have "(\<lambda>n. arctan_coeffs (2 * n + 1) * x ^ (2 * n + 1)) =
               (\<lambda>n. x * mssnth arctan_series_stream n * (x ^ 2) ^ n)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lambda>n. arctan_coeffs (2 * n + 1) * x ^ (2 * n + 1)) = (\<lambda>n. x * mssnth arctan_series_stream n * x\<^sup>2 ^ n)
[PROOF STEP]
by (simp add: fun_eq_iff mssnth_arctan_series_stream
                  power_mult [symmetric] arctan_coeffs_def mult_ac)
[PROOF STATE]
proof (state)
this:
(\<lambda>n. arctan_coeffs (2 * n + 1) * x ^ (2 * n + 1)) = (\<lambda>n. x * mssnth arctan_series_stream n * x\<^sup>2 ^ n)

goal (1 subgoal):
 1. arctan x = x * powser (msllist_of_msstream arctan_series_stream) (x\<^sup>2)
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
(\<lambda>n. x * mssnth arctan_series_stream n * x\<^sup>2 ^ n) sums arctan x
[PROOF STEP]
have "(\<lambda>n. x * mssnth arctan_series_stream n * x\<^sup>2 ^ n) sums arctan x"
[PROOF STATE]
proof (prove)
using this:
(\<lambda>n. x * mssnth arctan_series_stream n * x\<^sup>2 ^ n) sums arctan x

goal (1 subgoal):
 1. (\<lambda>n. x * mssnth arctan_series_stream n * x\<^sup>2 ^ n) sums arctan x
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
(\<lambda>n. x * mssnth arctan_series_stream n * x\<^sup>2 ^ n) sums arctan x

goal (1 subgoal):
 1. arctan x = x * powser (msllist_of_msstream arctan_series_stream) (x\<^sup>2)
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
(\<lambda>n. x * mssnth arctan_series_stream n * x\<^sup>2 ^ n) sums arctan x

goal (1 subgoal):
 1. arctan x = x * powser (msllist_of_msstream arctan_series_stream) (x\<^sup>2)
[PROOF STEP]
using summable_pre_arctan[OF norm_less] assms
[PROOF STATE]
proof (prove)
using this:
(\<lambda>n. x * mssnth arctan_series_stream n * x\<^sup>2 ^ n) sums arctan x
summable (\<lambda>n. mssnth arctan_series_stream n * x\<^sup>2 ^ n)
norm x < 1

goal (1 subgoal):
 1. arctan x = x * powser (msllist_of_msstream arctan_series_stream) (x\<^sup>2)
[PROOF STEP]
by (simp add: powser_def sums_iff suminf_mult [symmetric] mult.assoc)
[PROOF STATE]
proof (state)
this:
arctan x = x * powser (msllist_of_msstream arctan_series_stream) (x\<^sup>2)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma tensor_op_ket:
  fixes a :: \<open>'a::finite\<close> and b :: \<open>'b\<close> and c :: \<open>'c::finite\<close> and d :: \<open>'d\<close>
  shows \<open>tensor_op M N *\<^sub>V (ket (a,c)) = tensor_ell2 (M *\<^sub>V ket a) (N *\<^sub>V ket c)\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (M \<otimes>\<^sub>o N) *\<^sub>V ket (a, c) = (M *\<^sub>V ket a) \<otimes>\<^sub>s N *\<^sub>V ket c
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (M \<otimes>\<^sub>o N) *\<^sub>V ket (a, c) = (M *\<^sub>V ket a) \<otimes>\<^sub>s N *\<^sub>V ket c
[PROOF STEP]
define S :: \<open>('a\<times>'c) ell2 set\<close> where "S = ket ` UNIV"
[PROOF STATE]
proof (state)
this:
S = range ket

goal (1 subgoal):
 1. (M \<otimes>\<^sub>o N) *\<^sub>V ket (a, c) = (M *\<^sub>V ket a) \<otimes>\<^sub>s N *\<^sub>V ket c
[PROOF STEP]
define \<phi> where \<open>\<phi> = (\<lambda>(a,c). tensor_ell2 (M *\<^sub>V ket a) (N *\<^sub>V ket c))\<close>
[PROOF STATE]
proof (state)
this:
\<phi> = (\<lambda>(a, c). (M *\<^sub>V ket a) \<otimes>\<^sub>s N *\<^sub>V ket c)

goal (1 subgoal):
 1. (M \<otimes>\<^sub>o N) *\<^sub>V ket (a, c) = (M *\<^sub>V ket a) \<otimes>\<^sub>s N *\<^sub>V ket c
[PROOF STEP]
define \<phi>' where \<open>\<phi>' = \<phi> \<circ> inv ket\<close>
[PROOF STATE]
proof (state)
this:
\<phi>' = \<phi> \<circ> inv ket

goal (1 subgoal):
 1. (M \<otimes>\<^sub>o N) *\<^sub>V ket (a, c) = (M *\<^sub>V ket a) \<otimes>\<^sub>s N *\<^sub>V ket c
[PROOF STEP]
have def: \<open>tensor_op M N = (SOME P. \<forall>a c. P *\<^sub>V (ket (a,c)) = \<phi> (a,c))\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. M \<otimes>\<^sub>o N = (SOME P. \<forall>a c. P *\<^sub>V ket (a, c) = \<phi> (a, c))
[PROOF STEP]
unfolding tensor_op_def \<phi>_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (SOME P. \<forall>a c. P *\<^sub>V ket (a, c) = (M *\<^sub>V ket a) \<otimes>\<^sub>s N *\<^sub>V ket c) = (SOME P. \<forall>a c. P *\<^sub>V ket (a, c) = (case (a, c) of (a, c) \<Rightarrow> (M *\<^sub>V ket a) \<otimes>\<^sub>s N *\<^sub>V ket c))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
M \<otimes>\<^sub>o N = (SOME P. \<forall>a c. P *\<^sub>V ket (a, c) = \<phi> (a, c))

goal (1 subgoal):
 1. (M \<otimes>\<^sub>o N) *\<^sub>V ket (a, c) = (M *\<^sub>V ket a) \<otimes>\<^sub>s N *\<^sub>V ket c
[PROOF STEP]
have \<open>cindependent S\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. cindependent S
[PROOF STEP]
using S_def cindependent_ket
[PROOF STATE]
proof (prove)
using this:
S = range ket
cindependent (range ket)

goal (1 subgoal):
 1. cindependent S
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
cindependent S

goal (1 subgoal):
 1. (M \<otimes>\<^sub>o N) *\<^sub>V ket (a, c) = (M *\<^sub>V ket a) \<otimes>\<^sub>s N *\<^sub>V ket c
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
cindependent S

goal (1 subgoal):
 1. (M \<otimes>\<^sub>o N) *\<^sub>V ket (a, c) = (M *\<^sub>V ket a) \<otimes>\<^sub>s N *\<^sub>V ket c
[PROOF STEP]
have \<open>cspan S = UNIV\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. cspan S = UNIV
[PROOF STEP]
using S_def cspan_range_ket_finite
[PROOF STATE]
proof (prove)
using this:
S = range ket
cspan (range ket) = UNIV

goal (1 subgoal):
 1. cspan S = UNIV
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
cspan S = UNIV

goal (1 subgoal):
 1. (M \<otimes>\<^sub>o N) *\<^sub>V ket (a, c) = (M *\<^sub>V ket a) \<otimes>\<^sub>s N *\<^sub>V ket c
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
cindependent S
cspan S = UNIV
[PROOF STEP]
have "cblinfun_extension_exists S \<phi>'"
[PROOF STATE]
proof (prove)
using this:
cindependent S
cspan S = UNIV

goal (1 subgoal):
 1. cblinfun_extension_exists S \<phi>'
[PROOF STEP]
by (rule cblinfun_extension_exists_finite_dim)
[PROOF STATE]
proof (state)
this:
cblinfun_extension_exists S \<phi>'

goal (1 subgoal):
 1. (M \<otimes>\<^sub>o N) *\<^sub>V ket (a, c) = (M *\<^sub>V ket a) \<otimes>\<^sub>s N *\<^sub>V ket c
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
cblinfun_extension_exists S \<phi>'
[PROOF STEP]
have "\<exists>P. \<forall>x\<in>S. P *\<^sub>V x = \<phi>' x"
[PROOF STATE]
proof (prove)
using this:
cblinfun_extension_exists S \<phi>'

goal (1 subgoal):
 1. \<exists>P. \<forall>x\<in>S. P *\<^sub>V x = \<phi>' x
[PROOF STEP]
unfolding cblinfun_extension_exists_def
[PROOF STATE]
proof (prove)
using this:
\<exists>B. \<forall>x\<in>S. B *\<^sub>V x = \<phi>' x

goal (1 subgoal):
 1. \<exists>P. \<forall>x\<in>S. P *\<^sub>V x = \<phi>' x
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<exists>P. \<forall>x\<in>S. P *\<^sub>V x = \<phi>' x

goal (1 subgoal):
 1. (M \<otimes>\<^sub>o N) *\<^sub>V ket (a, c) = (M *\<^sub>V ket a) \<otimes>\<^sub>s N *\<^sub>V ket c
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<exists>P. \<forall>x\<in>S. P *\<^sub>V x = \<phi>' x
[PROOF STEP]
have ex: \<open>\<exists>P. \<forall>a c. P *\<^sub>V ket (a,c) = \<phi> (a,c)\<close>
[PROOF STATE]
proof (prove)
using this:
\<exists>P. \<forall>x\<in>S. P *\<^sub>V x = \<phi>' x

goal (1 subgoal):
 1. \<exists>P. \<forall>a c. P *\<^sub>V ket (a, c) = \<phi> (a, c)
[PROOF STEP]
by (metis S_def \<phi>'_def comp_eq_dest_lhs inj_ket inv_f_f rangeI)
[PROOF STATE]
proof (state)
this:
\<exists>P. \<forall>a c. P *\<^sub>V ket (a, c) = \<phi> (a, c)

goal (1 subgoal):
 1. (M \<otimes>\<^sub>o N) *\<^sub>V ket (a, c) = (M *\<^sub>V ket a) \<otimes>\<^sub>s N *\<^sub>V ket c
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<exists>P. \<forall>a c. P *\<^sub>V ket (a, c) = \<phi> (a, c)
[PROOF STEP]
have \<open>tensor_op M N *\<^sub>V (ket (a,c)) = \<phi> (a,c)\<close>
[PROOF STATE]
proof (prove)
using this:
\<exists>P. \<forall>a c. P *\<^sub>V ket (a, c) = \<phi> (a, c)

goal (1 subgoal):
 1. (M \<otimes>\<^sub>o N) *\<^sub>V ket (a, c) = \<phi> (a, c)
[PROOF STEP]
unfolding def
[PROOF STATE]
proof (prove)
using this:
\<exists>P. \<forall>a c. P *\<^sub>V ket (a, c) = \<phi> (a, c)

goal (1 subgoal):
 1. (SOME P. \<forall>a c. P *\<^sub>V ket (a, c) = \<phi> (a, c)) *\<^sub>V ket (a, c) = \<phi> (a, c)
[PROOF STEP]
apply (rule someI2_ex[where P=\<open>\<lambda>P. \<forall>a c. P *\<^sub>V (ket (a,c)) = \<phi> (a,c)\<close>])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. \<forall>a c. x *\<^sub>V ket (a, c) = \<phi> (a, c) \<Longrightarrow> x *\<^sub>V ket (a, c) = \<phi> (a, c)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(M \<otimes>\<^sub>o N) *\<^sub>V ket (a, c) = \<phi> (a, c)

goal (1 subgoal):
 1. (M \<otimes>\<^sub>o N) *\<^sub>V ket (a, c) = (M *\<^sub>V ket a) \<otimes>\<^sub>s N *\<^sub>V ket c
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(M \<otimes>\<^sub>o N) *\<^sub>V ket (a, c) = \<phi> (a, c)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
(M \<otimes>\<^sub>o N) *\<^sub>V ket (a, c) = \<phi> (a, c)

goal (1 subgoal):
 1. (M \<otimes>\<^sub>o N) *\<^sub>V ket (a, c) = (M *\<^sub>V ket a) \<otimes>\<^sub>s N *\<^sub>V ket c
[PROOF STEP]
unfolding \<phi>_def
[PROOF STATE]
proof (prove)
using this:
(M \<otimes>\<^sub>o N) *\<^sub>V ket (a, c) = (case (a, c) of (a, c) \<Rightarrow> (M *\<^sub>V ket a) \<otimes>\<^sub>s N *\<^sub>V ket c)

goal (1 subgoal):
 1. (M \<otimes>\<^sub>o N) *\<^sub>V ket (a, c) = (M *\<^sub>V ket a) \<otimes>\<^sub>s N *\<^sub>V ket c
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(M \<otimes>\<^sub>o N) *\<^sub>V ket (a, c) = (M *\<^sub>V ket a) \<otimes>\<^sub>s N *\<^sub>V ket c

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma set_restriction_fun_is_set_restriction: "
  set_restriction (set_restriction_fun P)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. set_restriction (set_restriction_fun P)
[PROOF STEP]
unfolding set_restriction_def set_restriction_fun_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>Pa. \<forall>A. {x \<in> A. P x} = {x \<in> A. Pa x}
[PROOF STEP]
by blast


[STATEMENT]
lemma register_pair_apply:
  assumes \<open>compatible F G\<close>
  shows \<open>(F; G) (a \<otimes>\<^sub>u b) = (F a) *\<^sub>u (G b)\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (F;G) (a \<otimes>\<^sub>u b) = F a *\<^sub>u G b
[PROOF STEP]
apply (rule register_pair_apply)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. register F
 2. register G
 3. \<And>a b. F a *\<^sub>u G b = G b *\<^sub>u F a
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
compatible F G

goal (3 subgoals):
 1. register F
 2. register G
 3. \<And>a b. F a *\<^sub>u G b = G b *\<^sub>u F a
[PROOF STEP]
unfolding compatible_def
[PROOF STATE]
proof (prove)
using this:
register F \<and> register G \<and> (\<forall>a b. F a *\<^sub>u G b = G b *\<^sub>u F a)

goal (3 subgoals):
 1. register F
 2. register G
 3. \<And>a b. F a *\<^sub>u G b = G b *\<^sub>u F a
[PROOF STEP]
by metis+