[STATEMENT]
lemma abs_\<nu>_trace_fin_le: "\<bar>\<nu>_trace_fin t N\<bar> \<le> (\<Sum>i < N. l^i * r\<^sub>M)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<bar>\<nu>_trace_fin t N\<bar> \<le> (\<Sum>i<N. l ^ i * r\<^sub>M)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<bar>\<nu>_trace_fin t N\<bar> \<le> (\<Sum>i<N. l ^ i * r\<^sub>M)
[PROOF STEP]
have "\<bar>\<nu>_trace_fin t N\<bar> \<le> (\<Sum>i < N. \<bar>l ^ i * r (t !! i)\<bar>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<bar>\<nu>_trace_fin t N\<bar> \<le> (\<Sum>i<N. \<bar>l ^ i * r (t !! i)\<bar>)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<bar>\<nu>_trace_fin t N\<bar> \<le> (\<Sum>i<N. \<bar>l ^ i * r (t !! i)\<bar>)

goal (1 subgoal):
 1. \<bar>\<nu>_trace_fin t N\<bar> \<le> (\<Sum>i<N. l ^ i * r\<^sub>M)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
\<bar>\<nu>_trace_fin t N\<bar> \<le> (\<Sum>i<N. \<bar>l ^ i * r (t !! i)\<bar>)

goal (1 subgoal):
 1. \<bar>\<nu>_trace_fin t N\<bar> \<le> (\<Sum>i<N. l ^ i * r\<^sub>M)
[PROOF STEP]
have "\<dots> \<le> (\<Sum>i < N. l ^ i * r\<^sub>M)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Sum>i<N. \<bar>l ^ i * r (t !! i)\<bar>) \<le> (\<Sum>i<N. l ^ i * r\<^sub>M)
[PROOF STEP]
by (auto intro: sum_mono simp: mult_left_mono abs_r_le_r\<^sub>M)
[PROOF STATE]
proof (state)
this:
(\<Sum>i<N. \<bar>l ^ i * r (t !! i)\<bar>) \<le> (\<Sum>i<N. l ^ i * r\<^sub>M)

goal (1 subgoal):
 1. \<bar>\<nu>_trace_fin t N\<bar> \<le> (\<Sum>i<N. l ^ i * r\<^sub>M)
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
\<bar>\<nu>_trace_fin t N\<bar> \<le> (\<Sum>i<N. l ^ i * r\<^sub>M)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<bar>\<nu>_trace_fin t N\<bar> \<le> (\<Sum>i<N. l ^ i * r\<^sub>M)

goal (1 subgoal):
 1. \<bar>\<nu>_trace_fin t N\<bar> \<le> (\<Sum>i<N. l ^ i * r\<^sub>M)
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
\<bar>\<nu>_trace_fin t N\<bar> \<le> (\<Sum>i<N. l ^ i * r\<^sub>M)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma vE_push: "\<lbrakk> (u,v)\<in>pE; u\<in>last p; v\<notin>\<Union>(set p); v\<notin>D \<rbrakk>
    \<Longrightarrow> vE (p @ [{v}]) D ((pE - {(u,v)}) \<union> E\<inter>{v}\<times>UNIV) = insert (u,v) lvE"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(u, v) \<in> pE; u \<in> last p; v \<notin> \<Union> (set p); v \<notin> D\<rbrakk> \<Longrightarrow> vE (p @ [{v}]) D (pE - {(u, v)} \<union> E \<inter> {v} \<times> UNIV) = insert (u, v) lvE
[PROOF STEP]
unfolding vE_def touched_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(u, v) \<in> pE; u \<in> last p; v \<notin> \<Union> (set p); v \<notin> D\<rbrakk> \<Longrightarrow> E \<inter> (D \<union> \<Union> (set (p @ [{v}]))) \<times> UNIV - (pE - {(u, v)} \<union> E \<inter> {v} \<times> UNIV) = insert (u, v) (E \<inter> (D \<union> \<Union> (set p)) \<times> UNIV - pE)
[PROOF STEP]
using pE_E_from_p
[PROOF STATE]
proof (prove)
using this:
pE \<subseteq> E \<inter> \<Union> (set p) \<times> UNIV

goal (1 subgoal):
 1. \<lbrakk>(u, v) \<in> pE; u \<in> last p; v \<notin> \<Union> (set p); v \<notin> D\<rbrakk> \<Longrightarrow> E \<inter> (D \<union> \<Union> (set (p @ [{v}]))) \<times> UNIV - (pE - {(u, v)} \<union> E \<inter> {v} \<times> UNIV) = insert (u, v) (E \<inter> (D \<union> \<Union> (set p)) \<times> UNIV - pE)
[PROOF STEP]
by auto


[STATEMENT]
lemma del_Node[simp]: "del x (Node l y r) =
  (case cmp x y of
     LT \<Rightarrow> let l' = del x l in up_d y r False l' |
     EQ \<Rightarrow> if r = Leaf then Some l
           else let (a',r') = split_min r in Some(Node l a' r') |
     GT \<Rightarrow> let r' = del x r in up_d y l True r')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. del x \<langle>l, y, r\<rangle> = (case cmp x y of LT \<Rightarrow> Let (del x l) (up_d y r False) | EQ \<Rightarrow> if r = \<langle>\<rangle> then Some l else let (a', r') = Root_Balanced_Tree.split_min r in Some \<langle>l, a', r'\<rangle> | GT \<Rightarrow> Let (del x r) (up_d y l True))
[PROOF STEP]
using val_cong[OF del_tm.simps(2)]
[PROOF STATE]
proof (prove)
using this:
Time_Monad.val (del_tm ?x1 \<langle>?l1, ?y1, ?r1\<rangle>) = Time_Monad.val ((case cmp ?x1 ?y1 of LT \<Rightarrow> del_tm ?x1 ?l1 \<bind> (\<lambda>l'. return (up_d ?y1 ?r1 False l')) | EQ \<Rightarrow> if ?r1 = \<langle>\<rangle> then return (Some ?l1) else split_min_tm ?r1 \<bind> (\<lambda>(a', r'). return (Some \<langle>?l1, a', r'\<rangle>)) | GT \<Rightarrow> del_tm ?x1 ?r1 \<bind> (\<lambda>r'. return (up_d ?y1 ?l1 True r'))) \<bind> tick)

goal (1 subgoal):
 1. del x \<langle>l, y, r\<rangle> = (case cmp x y of LT \<Rightarrow> Let (del x l) (up_d y r False) | EQ \<Rightarrow> if r = \<langle>\<rangle> then Some l else let (a', r') = Root_Balanced_Tree.split_min r in Some \<langle>l, a', r'\<rangle> | GT \<Rightarrow> Let (del x r) (up_d y l True))
[PROOF STEP]
by(simp only: del_def split_min_def val_simps cmp_val.case_distrib[of val])


[STATEMENT]
lemma fund_sol_code:
  assumes "\<not>is_square (D :: nat)"
  shows   "pell.fund_sol D = sum.projr (while isl (find_fund_sol_step D) (Inl (Suc 0, Suc D)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pell.fund_sol D = projr (while isl (find_fund_sol_step D) (Inl (Suc 0, Suc D)))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. pell.fund_sol D = projr (while isl (find_fund_sol_step D) (Inl (Suc 0, Suc D)))
[PROOF STEP]
from assms
[PROOF STATE]
proof (chain)
picking this:
\<not> is_square D
[PROOF STEP]
interpret pell D
[PROOF STATE]
proof (prove)
using this:
\<not> is_square D

goal (1 subgoal):
 1. pell D
[PROOF STEP]
by unfold_locales
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. fund_sol = projr (while isl (find_fund_sol_step D) (Inl (Suc 0, Suc D)))
[PROOF STEP]
note [simp] = find_fund_sol_step_def
[PROOF STATE]
proof (state)
this:
find_fund_sol_step ?D = (\<lambda>x. case x of Inl (y, y') \<Rightarrow> case get_nat_sqrt y' of None \<Rightarrow> Inl (y + 1, y' + ?D * (2 * y + 1)) | Some x \<Rightarrow> Inr (x, y))

goal (1 subgoal):
 1. fund_sol = projr (while isl (find_fund_sol_step D) (Inl (Suc 0, Suc D)))
[PROOF STEP]
define f where "f = find_fund_sol_step D"
[PROOF STATE]
proof (state)
this:
f = find_fund_sol_step D

goal (1 subgoal):
 1. fund_sol = projr (while isl (find_fund_sol_step D) (Inl (Suc 0, Suc D)))
[PROOF STEP]
define P :: "nat \<Rightarrow> bool" where "P = (\<lambda>y. y > 0 \<and> is_square (y^2 * D + 1))"
[PROOF STATE]
proof (state)
this:
P = (\<lambda>y. 0 < y \<and> is_square (y\<^sup>2 * D + 1))

goal (1 subgoal):
 1. fund_sol = projr (while isl (find_fund_sol_step D) (Inl (Suc 0, Suc D)))
[PROOF STEP]
define Q :: "nat \<times> nat \<Rightarrow> bool" where
    "Q = (\<lambda>(x,y). P y \<and> (\<forall>y'\<in>{0<..<y}. \<not>P y') \<and> x = Discrete.sqrt (y^2 * D + 1))"
[PROOF STATE]
proof (state)
this:
Q = (\<lambda>(x, y). P y \<and> (\<forall>y'\<in>{0<..<y}. \<not> P y') \<and> x = Discrete.sqrt (y\<^sup>2 * D + 1))

goal (1 subgoal):
 1. fund_sol = projr (while isl (find_fund_sol_step D) (Inl (Suc 0, Suc D)))
[PROOF STEP]
define R :: "nat \<times> nat + nat \<times> nat \<Rightarrow> bool"
    where "R = (\<lambda>s. case s of
                      Inl (m, m') \<Rightarrow> m > 0 \<and> (m' = m^2 * D + 1) \<and> (\<forall>y\<in>{0<..<m}. \<not>is_square (y^2 * D + 1))
                    | Inr x \<Rightarrow> Q x)"
[PROOF STATE]
proof (state)
this:
R = (\<lambda>s. case s of Inl (m, m') \<Rightarrow> 0 < m \<and> m' = m\<^sup>2 * D + 1 \<and> (\<forall>y\<in>{0<..<m}. \<not> is_square (y\<^sup>2 * D + 1)) | Inr x \<Rightarrow> Q x)

goal (1 subgoal):
 1. fund_sol = projr (while isl (find_fund_sol_step D) (Inl (Suc 0, Suc D)))
[PROOF STEP]
define rel :: "((nat \<times> nat + nat \<times> nat) \<times> (nat \<times> nat + nat \<times> nat)) set"
    where "rel = {(A,B). (case (A, B) of
                           (Inl (m, _), Inl (m', _)) \<Rightarrow> m' > 0 \<and> m > m' \<and> m \<le> snd fund_sol
                         | (Inr _, Inl (m', _)) \<Rightarrow> m' \<le> snd fund_sol
                         | _ \<Rightarrow> False) \<and> A = f B}"
[PROOF STATE]
proof (state)
this:
rel = {(A, B). (case (A, B) of (Inl (m, x), Inl (m', xa)) \<Rightarrow> 0 < m' \<and> m' < m \<and> m \<le> snd fund_sol | (Inl (m, x), Inr ba) \<Rightarrow> False | (Inr x, Inl (m', xa)) \<Rightarrow> m' \<le> snd fund_sol | (Inr x, Inr ba) \<Rightarrow> False) \<and> A = f B}

goal (1 subgoal):
 1. fund_sol = projr (while isl (find_fund_sol_step D) (Inl (Suc 0, Suc D)))
[PROOF STEP]
obtain x y where xy: "sum.projr (while isl f (Inl (Suc 0, Suc D))) = (x, y)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>x y. projr (while isl f (Inl (Suc 0, Suc D))) = (x, y) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (cases "sum.projr (while isl f (Inl (Suc 0, Suc D)))")
[PROOF STATE]
proof (state)
this:
projr (while isl f (Inl (Suc 0, Suc D))) = (x, y)

goal (1 subgoal):
 1. fund_sol = projr (while isl (find_fund_sol_step D) (Inl (Suc 0, Suc D)))
[PROOF STEP]
have neq_fund_solI: "y \<noteq> snd fund_sol" if "\<not> is_square (Suc (y\<^sup>2 * D))" for y
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. y \<noteq> snd fund_sol
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. y = snd fund_sol \<Longrightarrow> False
[PROOF STEP]
assume "y = snd fund_sol"
[PROOF STATE]
proof (state)
this:
y = snd fund_sol

goal (1 subgoal):
 1. y = snd fund_sol \<Longrightarrow> False
[PROOF STEP]
with fund_sol_is_nontriv_solution
[PROOF STATE]
proof (chain)
picking this:
nontriv_solution fund_sol
y = snd fund_sol
[PROOF STEP]
have "Suc (y\<^sup>2 * D) = fst fund_sol ^ 2"
[PROOF STATE]
proof (prove)
using this:
nontriv_solution fund_sol
y = snd fund_sol

goal (1 subgoal):
 1. Suc (y\<^sup>2 * D) = (fst fund_sol)\<^sup>2
[PROOF STEP]
by (simp add: nontriv_solution_def case_prod_unfold)
[PROOF STATE]
proof (state)
this:
Suc (y\<^sup>2 * D) = (fst fund_sol)\<^sup>2

goal (1 subgoal):
 1. y = snd fund_sol \<Longrightarrow> False
[PROOF STEP]
hence "is_square (Suc (y\<^sup>2 * D))"
[PROOF STATE]
proof (prove)
using this:
Suc (y\<^sup>2 * D) = (fst fund_sol)\<^sup>2

goal (1 subgoal):
 1. is_square (Suc (y\<^sup>2 * D))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
is_square (Suc (y\<^sup>2 * D))

goal (1 subgoal):
 1. y = snd fund_sol \<Longrightarrow> False
[PROOF STEP]
with that
[PROOF STATE]
proof (chain)
picking this:
\<not> is_square (Suc (y\<^sup>2 * D))
is_square (Suc (y\<^sup>2 * D))
[PROOF STEP]
show False
[PROOF STATE]
proof (prove)
using this:
\<not> is_square (Suc (y\<^sup>2 * D))
is_square (Suc (y\<^sup>2 * D))

goal (1 subgoal):
 1. False
[PROOF STEP]
by contradiction
[PROOF STATE]
proof (state)
this:
False

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<not> is_square (Suc (?y1\<^sup>2 * D)) \<Longrightarrow> ?y1 \<noteq> snd fund_sol

goal (1 subgoal):
 1. fund_sol = projr (while isl (find_fund_sol_step D) (Inl (Suc 0, Suc D)))
[PROOF STEP]
have "case_sum (\<lambda>_. False) Q (while sum.isl f (Inl (m, m^2 * D + 1)))"
    if "\<forall>y\<in>{0<..<m}. \<not>is_square (y^2 * D + 1)" "m > 0" for m
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. case while isl f (Inl (m, m\<^sup>2 * D + 1)) of Inl uu_ \<Rightarrow> False | Inr x \<Rightarrow> Q x
[PROOF STEP]
proof (rule while_rule[where b = sum.isl])
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. ?P (Inl (m, m\<^sup>2 * D + 1))
 2. \<And>s. \<lbrakk>?P s; isl s\<rbrakk> \<Longrightarrow> ?P (f s)
 3. \<And>s. \<lbrakk>?P s; \<not> isl s\<rbrakk> \<Longrightarrow> case s of Inl uu_ \<Rightarrow> False | Inr a \<Rightarrow> Q a
 4. wf ?r
 5. \<And>s. \<lbrakk>?P s; isl s\<rbrakk> \<Longrightarrow> (f s, s) \<in> ?r
[PROOF STEP]
show "R (Inl (m, m\<^sup>2 * D + 1))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. R (Inl (m, m\<^sup>2 * D + 1))
[PROOF STEP]
using that
[PROOF STATE]
proof (prove)
using this:
\<forall>y\<in>{0<..<m}. \<not> is_square (y\<^sup>2 * D + 1)
0 < m

goal (1 subgoal):
 1. R (Inl (m, m\<^sup>2 * D + 1))
[PROOF STEP]
by (auto simp: R_def)
[PROOF STATE]
proof (state)
this:
R (Inl (m, m\<^sup>2 * D + 1))

goal (4 subgoals):
 1. \<And>s. \<lbrakk>R s; isl s\<rbrakk> \<Longrightarrow> R (f s)
 2. \<And>s. \<lbrakk>R s; \<not> isl s\<rbrakk> \<Longrightarrow> case s of Inl uu_ \<Rightarrow> False | Inr a \<Rightarrow> Q a
 3. wf ?r
 4. \<And>s. \<lbrakk>R s; isl s\<rbrakk> \<Longrightarrow> (f s, s) \<in> ?r
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>R s; isl s\<rbrakk> \<Longrightarrow> R (f s)
 2. \<And>s. \<lbrakk>R s; \<not> isl s\<rbrakk> \<Longrightarrow> case s of Inl uu_ \<Rightarrow> False | Inr a \<Rightarrow> Q a
 3. wf ?r
 4. \<And>s. \<lbrakk>R s; isl s\<rbrakk> \<Longrightarrow> (f s, s) \<in> ?r
[PROOF STEP]
fix s
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>R s; isl s\<rbrakk> \<Longrightarrow> R (f s)
 2. \<And>s. \<lbrakk>R s; \<not> isl s\<rbrakk> \<Longrightarrow> case s of Inl uu_ \<Rightarrow> False | Inr a \<Rightarrow> Q a
 3. wf ?r
 4. \<And>s. \<lbrakk>R s; isl s\<rbrakk> \<Longrightarrow> (f s, s) \<in> ?r
[PROOF STEP]
assume "R s" "isl s"
[PROOF STATE]
proof (state)
this:
R s
isl s

goal (4 subgoals):
 1. \<And>s. \<lbrakk>R s; isl s\<rbrakk> \<Longrightarrow> R (f s)
 2. \<And>s. \<lbrakk>R s; \<not> isl s\<rbrakk> \<Longrightarrow> case s of Inl uu_ \<Rightarrow> False | Inr a \<Rightarrow> Q a
 3. wf ?r
 4. \<And>s. \<lbrakk>R s; isl s\<rbrakk> \<Longrightarrow> (f s, s) \<in> ?r
[PROOF STEP]
thus "R (f s)"
[PROOF STATE]
proof (prove)
using this:
R s
isl s

goal (1 subgoal):
 1. R (f s)
[PROOF STEP]
by (auto simp: not_less_less_Suc_eq Q_def P_def R_def f_def get_nat_sqrt_def
                     power2_eq_square algebra_simps split: sum.splits prod.splits)
[PROOF STATE]
proof (state)
this:
R (f s)

goal (3 subgoals):
 1. \<And>s. \<lbrakk>R s; \<not> isl s\<rbrakk> \<Longrightarrow> case s of Inl uu_ \<Rightarrow> False | Inr a \<Rightarrow> Q a
 2. wf ?r
 3. \<And>s. \<lbrakk>R s; isl s\<rbrakk> \<Longrightarrow> (f s, s) \<in> ?r
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>R s; \<not> isl s\<rbrakk> \<Longrightarrow> case s of Inl uu_ \<Rightarrow> False | Inr a \<Rightarrow> Q a
 2. wf ?r
 3. \<And>s. \<lbrakk>R s; isl s\<rbrakk> \<Longrightarrow> (f s, s) \<in> ?r
[PROOF STEP]
fix s
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>R s; \<not> isl s\<rbrakk> \<Longrightarrow> case s of Inl uu_ \<Rightarrow> False | Inr a \<Rightarrow> Q a
 2. wf ?r
 3. \<And>s. \<lbrakk>R s; isl s\<rbrakk> \<Longrightarrow> (f s, s) \<in> ?r
[PROOF STEP]
assume "R s" "\<not>isl s"
[PROOF STATE]
proof (state)
this:
R s
\<not> isl s

goal (3 subgoals):
 1. \<And>s. \<lbrakk>R s; \<not> isl s\<rbrakk> \<Longrightarrow> case s of Inl uu_ \<Rightarrow> False | Inr a \<Rightarrow> Q a
 2. wf ?r
 3. \<And>s. \<lbrakk>R s; isl s\<rbrakk> \<Longrightarrow> (f s, s) \<in> ?r
[PROOF STEP]
thus "case s of Inl _ \<Rightarrow> False | Inr x \<Rightarrow> Q x"
[PROOF STATE]
proof (prove)
using this:
R s
\<not> isl s

goal (1 subgoal):
 1. case s of Inl x \<Rightarrow> False | Inr x \<Rightarrow> Q x
[PROOF STEP]
by (auto simp: R_def split: sum.splits)
[PROOF STATE]
proof (state)
this:
case s of Inl x \<Rightarrow> False | Inr x \<Rightarrow> Q x

goal (2 subgoals):
 1. wf ?r
 2. \<And>s. \<lbrakk>R s; isl s\<rbrakk> \<Longrightarrow> (f s, s) \<in> ?r
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. wf ?r
 2. \<And>s. \<lbrakk>R s; isl s\<rbrakk> \<Longrightarrow> (f s, s) \<in> ?r
[PROOF STEP]
fix s
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. wf ?r
 2. \<And>s. \<lbrakk>R s; isl s\<rbrakk> \<Longrightarrow> (f s, s) \<in> ?r
[PROOF STEP]
assume s: "R s" "isl s"
[PROOF STATE]
proof (state)
this:
R s
isl s

goal (2 subgoals):
 1. wf ?r
 2. \<And>s. \<lbrakk>R s; isl s\<rbrakk> \<Longrightarrow> (f s, s) \<in> ?r
[PROOF STEP]
show "(f s, s) \<in> rel"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (f s, s) \<in> rel
[PROOF STEP]
proof (cases s)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>a. s = Inl a \<Longrightarrow> (f s, s) \<in> rel
 2. \<And>b. s = Inr b \<Longrightarrow> (f s, s) \<in> rel
[PROOF STEP]
case [simp]: (Inl s')
[PROOF STATE]
proof (state)
this:
s = Inl s'

goal (2 subgoals):
 1. \<And>a. s = Inl a \<Longrightarrow> (f s, s) \<in> rel
 2. \<And>b. s = Inr b \<Longrightarrow> (f s, s) \<in> rel
[PROOF STEP]
obtain a b where [simp]: "s' = (a, b)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>a b. s' = (a, b) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (cases s')
[PROOF STATE]
proof (state)
this:
s' = (a, b)

goal (2 subgoals):
 1. \<And>a. s = Inl a \<Longrightarrow> (f s, s) \<in> rel
 2. \<And>b. s = Inr b \<Longrightarrow> (f s, s) \<in> rel
[PROOF STEP]
from s
[PROOF STATE]
proof (chain)
picking this:
R s
isl s
[PROOF STEP]
have *: "a > 0" "b = Suc (a\<^sup>2 * D)" "\<And>y. y \<in> {0<..<a} \<Longrightarrow> \<not> is_square (Suc (y\<^sup>2 * D))"
[PROOF STATE]
proof (prove)
using this:
R s
isl s

goal (1 subgoal):
 1. 0 < a &&& b = Suc (a\<^sup>2 * D) &&& (\<And>y. y \<in> {0<..<a} \<Longrightarrow> \<not> is_square (Suc (y\<^sup>2 * D)))
[PROOF STEP]
by (auto simp: R_def)
[PROOF STATE]
proof (state)
this:
0 < a
b = Suc (a\<^sup>2 * D)
?y1 \<in> {0<..<a} \<Longrightarrow> \<not> is_square (Suc (?y1\<^sup>2 * D))

goal (2 subgoals):
 1. \<And>a. s = Inl a \<Longrightarrow> (f s, s) \<in> rel
 2. \<And>b. s = Inr b \<Longrightarrow> (f s, s) \<in> rel
[PROOF STEP]
have "a < snd fund_sol" if **: "\<not> is_square (Suc (a\<^sup>2 * D))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. a < snd fund_sol
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. a < snd fund_sol
[PROOF STEP]
from neq_fund_solI
[PROOF STATE]
proof (chain)
picking this:
\<not> is_square (Suc (?y1\<^sup>2 * D)) \<Longrightarrow> ?y1 \<noteq> snd fund_sol
[PROOF STEP]
have "y' \<noteq> snd fund_sol" if "y' \<in> {0<..<Suc a}" for y'
[PROOF STATE]
proof (prove)
using this:
\<not> is_square (Suc (?y1\<^sup>2 * D)) \<Longrightarrow> ?y1 \<noteq> snd fund_sol

goal (1 subgoal):
 1. y' \<noteq> snd fund_sol
[PROOF STEP]
using * ** that
[PROOF STATE]
proof (prove)
using this:
\<not> is_square (Suc (?y1\<^sup>2 * D)) \<Longrightarrow> ?y1 \<noteq> snd fund_sol
0 < a
b = Suc (a\<^sup>2 * D)
?y1 \<in> {0<..<a} \<Longrightarrow> \<not> is_square (Suc (?y1\<^sup>2 * D))
\<not> is_square (Suc (a\<^sup>2 * D))
y' \<in> {0<..<Suc a}

goal (1 subgoal):
 1. y' \<noteq> snd fund_sol
[PROOF STEP]
by (cases "y' = a") auto
[PROOF STATE]
proof (state)
this:
?y'1 \<in> {0<..<Suc a} \<Longrightarrow> ?y'1 \<noteq> snd fund_sol

goal (1 subgoal):
 1. a < snd fund_sol
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
?y'1 \<in> {0<..<Suc a} \<Longrightarrow> ?y'1 \<noteq> snd fund_sol

goal (1 subgoal):
 1. a < snd fund_sol
[PROOF STEP]
have "snd fund_sol \<noteq> 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. snd fund_sol \<noteq> 0
[PROOF STEP]
using fund_sol_is_nontriv_solution
[PROOF STATE]
proof (prove)
using this:
nontriv_solution fund_sol

goal (1 subgoal):
 1. snd fund_sol \<noteq> 0
[PROOF STEP]
by (intro notI, cases fund_sol) (auto simp: nontriv_solution_altdef)
[PROOF STATE]
proof (state)
this:
snd fund_sol \<noteq> 0

goal (1 subgoal):
 1. a < snd fund_sol
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
?y'1 \<in> {0<..<Suc a} \<Longrightarrow> ?y'1 \<noteq> snd fund_sol
snd fund_sol \<noteq> 0
[PROOF STEP]
have "\<forall>y'\<le>a. y' \<noteq> snd fund_sol"
[PROOF STATE]
proof (prove)
using this:
?y'1 \<in> {0<..<Suc a} \<Longrightarrow> ?y'1 \<noteq> snd fund_sol
snd fund_sol \<noteq> 0

goal (1 subgoal):
 1. \<forall>y'\<le>a. y' \<noteq> snd fund_sol
[PROOF STEP]
by (auto simp: less_Suc_eq_le)
[PROOF STATE]
proof (state)
this:
\<forall>y'\<le>a. y' \<noteq> snd fund_sol

goal (1 subgoal):
 1. a < snd fund_sol
[PROOF STEP]
thus "snd fund_sol > a"
[PROOF STATE]
proof (prove)
using this:
\<forall>y'\<le>a. y' \<noteq> snd fund_sol

goal (1 subgoal):
 1. a < snd fund_sol
[PROOF STEP]
by (cases "a < snd fund_sol") (auto simp: not_less)
[PROOF STATE]
proof (state)
this:
a < snd fund_sol

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<not> is_square (Suc (a\<^sup>2 * D)) \<Longrightarrow> a < snd fund_sol

goal (2 subgoals):
 1. \<And>a. s = Inl a \<Longrightarrow> (f s, s) \<in> rel
 2. \<And>b. s = Inr b \<Longrightarrow> (f s, s) \<in> rel
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<not> is_square (Suc (a\<^sup>2 * D)) \<Longrightarrow> a < snd fund_sol

goal (2 subgoals):
 1. \<And>a. s = Inl a \<Longrightarrow> (f s, s) \<in> rel
 2. \<And>b. s = Inr b \<Longrightarrow> (f s, s) \<in> rel
[PROOF STEP]
have "a \<le> snd fund_sol"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. a \<le> snd fund_sol
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. a \<le> snd fund_sol
[PROOF STEP]
have "\<forall>y'\<in>{0<..<a}. y' \<noteq> snd fund_sol"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>y'\<in>{0<..<a}. y' \<noteq> snd fund_sol
[PROOF STEP]
using neq_fund_solI *
[PROOF STATE]
proof (prove)
using this:
\<not> is_square (Suc (?y1\<^sup>2 * D)) \<Longrightarrow> ?y1 \<noteq> snd fund_sol
0 < a
b = Suc (a\<^sup>2 * D)
?y1 \<in> {0<..<a} \<Longrightarrow> \<not> is_square (Suc (?y1\<^sup>2 * D))

goal (1 subgoal):
 1. \<forall>y'\<in>{0<..<a}. y' \<noteq> snd fund_sol
[PROOF STEP]
by (auto simp: less_Suc_eq_le)
[PROOF STATE]
proof (state)
this:
\<forall>y'\<in>{0<..<a}. y' \<noteq> snd fund_sol

goal (1 subgoal):
 1. a \<le> snd fund_sol
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<forall>y'\<in>{0<..<a}. y' \<noteq> snd fund_sol

goal (1 subgoal):
 1. a \<le> snd fund_sol
[PROOF STEP]
have "snd fund_sol \<noteq> 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. snd fund_sol \<noteq> 0
[PROOF STEP]
using fund_sol_is_nontriv_solution
[PROOF STATE]
proof (prove)
using this:
nontriv_solution fund_sol

goal (1 subgoal):
 1. snd fund_sol \<noteq> 0
[PROOF STEP]
by (intro notI, cases fund_sol) (auto simp: nontriv_solution_altdef)
[PROOF STATE]
proof (state)
this:
snd fund_sol \<noteq> 0

goal (1 subgoal):
 1. a \<le> snd fund_sol
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<forall>y'\<in>{0<..<a}. y' \<noteq> snd fund_sol
snd fund_sol \<noteq> 0
[PROOF STEP]
have "\<forall>y'<a. y' \<noteq> snd fund_sol"
[PROOF STATE]
proof (prove)
using this:
\<forall>y'\<in>{0<..<a}. y' \<noteq> snd fund_sol
snd fund_sol \<noteq> 0

goal (1 subgoal):
 1. \<forall>y'<a. y' \<noteq> snd fund_sol
[PROOF STEP]
by (auto simp: less_Suc_eq_le)
[PROOF STATE]
proof (state)
this:
\<forall>y'<a. y' \<noteq> snd fund_sol

goal (1 subgoal):
 1. a \<le> snd fund_sol
[PROOF STEP]
thus "snd fund_sol \<ge> a"
[PROOF STATE]
proof (prove)
using this:
\<forall>y'<a. y' \<noteq> snd fund_sol

goal (1 subgoal):
 1. a \<le> snd fund_sol
[PROOF STEP]
by (cases "a \<le> snd fund_sol") (auto simp: not_less)
[PROOF STATE]
proof (state)
this:
a \<le> snd fund_sol

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
a \<le> snd fund_sol

goal (2 subgoals):
 1. \<And>a. s = Inl a \<Longrightarrow> (f s, s) \<in> rel
 2. \<And>b. s = Inr b \<Longrightarrow> (f s, s) \<in> rel
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<not> is_square (Suc (a\<^sup>2 * D)) \<Longrightarrow> a < snd fund_sol
a \<le> snd fund_sol
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<not> is_square (Suc (a\<^sup>2 * D)) \<Longrightarrow> a < snd fund_sol
a \<le> snd fund_sol

goal (1 subgoal):
 1. (f s, s) \<in> rel
[PROOF STEP]
using *
[PROOF STATE]
proof (prove)
using this:
\<not> is_square (Suc (a\<^sup>2 * D)) \<Longrightarrow> a < snd fund_sol
a \<le> snd fund_sol
0 < a
b = Suc (a\<^sup>2 * D)
?y1 \<in> {0<..<a} \<Longrightarrow> \<not> is_square (Suc (?y1\<^sup>2 * D))

goal (1 subgoal):
 1. (f s, s) \<in> rel
[PROOF STEP]
by (auto simp: f_def get_nat_sqrt_def rel_def)
[PROOF STATE]
proof (state)
this:
(f s, s) \<in> rel

goal (1 subgoal):
 1. \<And>b. s = Inr b \<Longrightarrow> (f s, s) \<in> rel
[PROOF STEP]
qed (insert s, auto)
[PROOF STATE]
proof (state)
this:
(f s, s) \<in> rel

goal (1 subgoal):
 1. wf rel
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. wf rel
[PROOF STEP]
define rel'
      where "rel' = {(y, x). (case x of Inl (m, _) \<Rightarrow> m \<le> snd fund_sol | Inr _ \<Rightarrow> False) \<and> y = f x}"
[PROOF STATE]
proof (state)
this:
rel' = {(y, x). (case x of Inl (m, x) \<Rightarrow> m \<le> snd fund_sol | Inr x \<Rightarrow> False) \<and> y = f x}

goal (1 subgoal):
 1. wf rel
[PROOF STEP]
have "wf rel'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. wf rel'
[PROOF STEP]
unfolding rel'_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. wf {(y, x). (case x of Inl (m, xa) \<Rightarrow> m \<le> snd fund_sol | Inr x \<Rightarrow> False) \<and> y = f x}
[PROOF STEP]
by (rule wf_if_measure[where f = "\<lambda>z. case z of Inl (m, _) \<Rightarrow> Suc (snd fund_sol) - m | _ \<Rightarrow> 0"])
         (auto split: prod.splits sum.splits simp: f_def get_nat_sqrt_def)
[PROOF STATE]
proof (state)
this:
wf rel'

goal (1 subgoal):
 1. wf rel
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
wf rel'

goal (1 subgoal):
 1. wf rel
[PROOF STEP]
have "rel \<subseteq> rel'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. rel \<subseteq> rel'
[PROOF STEP]
proof safe
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a b. (a, b) \<in> rel \<Longrightarrow> (a, b) \<in> rel'
[PROOF STEP]
fix w z
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a b. (a, b) \<in> rel \<Longrightarrow> (a, b) \<in> rel'
[PROOF STEP]
assume "(w, z) \<in> rel"
[PROOF STATE]
proof (state)
this:
(w, z) \<in> rel

goal (1 subgoal):
 1. \<And>a b. (a, b) \<in> rel \<Longrightarrow> (a, b) \<in> rel'
[PROOF STEP]
thus "(w, z) \<in> rel'"
[PROOF STATE]
proof (prove)
using this:
(w, z) \<in> rel

goal (1 subgoal):
 1. (w, z) \<in> rel'
[PROOF STEP]
by (cases w; cases z) (auto simp: rel_def rel'_def)
[PROOF STATE]
proof (state)
this:
(w, z) \<in> rel'

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
rel \<subseteq> rel'

goal (1 subgoal):
 1. wf rel
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
wf rel'
rel \<subseteq> rel'
[PROOF STEP]
show "wf rel"
[PROOF STATE]
proof (prove)
using this:
wf rel'
rel \<subseteq> rel'

goal (1 subgoal):
 1. wf rel
[PROOF STEP]
by (rule wf_subset)
[PROOF STATE]
proof (state)
this:
wf rel

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>\<forall>y\<in>{0<..<?m1}. \<not> is_square (y\<^sup>2 * D + 1); 0 < ?m1\<rbrakk> \<Longrightarrow> case while isl f (Inl (?m1, ?m1\<^sup>2 * D + 1)) of Inl uu_ \<Rightarrow> False | Inr x \<Rightarrow> Q x

goal (1 subgoal):
 1. fund_sol = projr (while isl (find_fund_sol_step D) (Inl (Suc 0, Suc D)))
[PROOF STEP]
from this[of 1] and xy
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>\<forall>y\<in>{0<..<1}. \<not> is_square (y\<^sup>2 * D + 1); 0 < 1\<rbrakk> \<Longrightarrow> case while isl f (Inl (1, 1\<^sup>2 * D + 1)) of Inl uu_ \<Rightarrow> False | Inr x \<Rightarrow> Q x
projr (while isl f (Inl (Suc 0, Suc D))) = (x, y)
[PROOF STEP]
have *: "Q (x, y)"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<forall>y\<in>{0<..<1}. \<not> is_square (y\<^sup>2 * D + 1); 0 < 1\<rbrakk> \<Longrightarrow> case while isl f (Inl (1, 1\<^sup>2 * D + 1)) of Inl uu_ \<Rightarrow> False | Inr x \<Rightarrow> Q x
projr (while isl f (Inl (Suc 0, Suc D))) = (x, y)

goal (1 subgoal):
 1. Q (x, y)
[PROOF STEP]
by (auto split: sum.splits)
[PROOF STATE]
proof (state)
this:
Q (x, y)

goal (1 subgoal):
 1. fund_sol = projr (while isl (find_fund_sol_step D) (Inl (Suc 0, Suc D)))
[PROOF STEP]
from *
[PROOF STATE]
proof (chain)
picking this:
Q (x, y)
[PROOF STEP]
have "is_square (Suc (y\<^sup>2 * D))"
[PROOF STATE]
proof (prove)
using this:
Q (x, y)

goal (1 subgoal):
 1. is_square (Suc (y\<^sup>2 * D))
[PROOF STEP]
by (simp add: Q_def P_def)
[PROOF STATE]
proof (state)
this:
is_square (Suc (y\<^sup>2 * D))

goal (1 subgoal):
 1. fund_sol = projr (while isl (find_fund_sol_step D) (Inl (Suc 0, Suc D)))
[PROOF STEP]
with *
[PROOF STATE]
proof (chain)
picking this:
Q (x, y)
is_square (Suc (y\<^sup>2 * D))
[PROOF STEP]
have "x\<^sup>2 = Suc (y\<^sup>2 * D)" "y > 0"
[PROOF STATE]
proof (prove)
using this:
Q (x, y)
is_square (Suc (y\<^sup>2 * D))

goal (1 subgoal):
 1. x\<^sup>2 = Suc (y\<^sup>2 * D) &&& 0 < y
[PROOF STEP]
by (auto simp: Q_def P_def Discrete_sqrt_square_is_square)
[PROOF STATE]
proof (state)
this:
x\<^sup>2 = Suc (y\<^sup>2 * D)
0 < y

goal (1 subgoal):
 1. fund_sol = projr (while isl (find_fund_sol_step D) (Inl (Suc 0, Suc D)))
[PROOF STEP]
hence "nontriv_solution (x, y)"
[PROOF STATE]
proof (prove)
using this:
x\<^sup>2 = Suc (y\<^sup>2 * D)
0 < y

goal (1 subgoal):
 1. nontriv_solution (x, y)
[PROOF STEP]
by (auto simp: nontriv_solution_def)
[PROOF STATE]
proof (state)
this:
nontriv_solution (x, y)

goal (1 subgoal):
 1. fund_sol = projr (while isl (find_fund_sol_step D) (Inl (Suc 0, Suc D)))
[PROOF STEP]
from this
[PROOF STATE]
proof (chain)
picking this:
nontriv_solution (x, y)
[PROOF STEP]
have "snd fund_sol \<le> snd (x, y)"
[PROOF STATE]
proof (prove)
using this:
nontriv_solution (x, y)

goal (1 subgoal):
 1. snd fund_sol \<le> snd (x, y)
[PROOF STEP]
by (rule fund_sol_minimal'')
[PROOF STATE]
proof (state)
this:
snd fund_sol \<le> snd (x, y)

goal (1 subgoal):
 1. fund_sol = projr (while isl (find_fund_sol_step D) (Inl (Suc 0, Suc D)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
snd fund_sol \<le> snd (x, y)

goal (1 subgoal):
 1. fund_sol = projr (while isl (find_fund_sol_step D) (Inl (Suc 0, Suc D)))
[PROOF STEP]
have "snd fund_sol \<ge> y"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. y \<le> snd fund_sol
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. y \<le> snd fund_sol
[PROOF STEP]
from *
[PROOF STATE]
proof (chain)
picking this:
Q (x, y)
[PROOF STEP]
have "(\<forall>y'\<in>{0<..<y}. \<not> is_square (Suc (y'\<^sup>2 * D)))"
[PROOF STATE]
proof (prove)
using this:
Q (x, y)

goal (1 subgoal):
 1. \<forall>y'\<in>{0<..<y}. \<not> is_square (Suc (y'\<^sup>2 * D))
[PROOF STEP]
by (simp add: Q_def P_def)
[PROOF STATE]
proof (state)
this:
\<forall>y'\<in>{0<..<y}. \<not> is_square (Suc (y'\<^sup>2 * D))

goal (1 subgoal):
 1. y \<le> snd fund_sol
[PROOF STEP]
with neq_fund_solI
[PROOF STATE]
proof (chain)
picking this:
\<not> is_square (Suc (?y1\<^sup>2 * D)) \<Longrightarrow> ?y1 \<noteq> snd fund_sol
\<forall>y'\<in>{0<..<y}. \<not> is_square (Suc (y'\<^sup>2 * D))
[PROOF STEP]
have "(\<forall>y'\<in>{0<..<y}. y' \<noteq> snd fund_sol)"
[PROOF STATE]
proof (prove)
using this:
\<not> is_square (Suc (?y1\<^sup>2 * D)) \<Longrightarrow> ?y1 \<noteq> snd fund_sol
\<forall>y'\<in>{0<..<y}. \<not> is_square (Suc (y'\<^sup>2 * D))

goal (1 subgoal):
 1. \<forall>y'\<in>{0<..<y}. y' \<noteq> snd fund_sol
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<forall>y'\<in>{0<..<y}. y' \<noteq> snd fund_sol

goal (1 subgoal):
 1. y \<le> snd fund_sol
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<forall>y'\<in>{0<..<y}. y' \<noteq> snd fund_sol

goal (1 subgoal):
 1. y \<le> snd fund_sol
[PROOF STEP]
have "snd fund_sol \<noteq> 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. snd fund_sol \<noteq> 0
[PROOF STEP]
using fund_sol_is_nontriv_solution
[PROOF STATE]
proof (prove)
using this:
nontriv_solution fund_sol

goal (1 subgoal):
 1. snd fund_sol \<noteq> 0
[PROOF STEP]
by (cases fund_sol) (auto intro!: Nat.gr0I simp: nontriv_solution_altdef)
[PROOF STATE]
proof (state)
this:
snd fund_sol \<noteq> 0

goal (1 subgoal):
 1. y \<le> snd fund_sol
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<forall>y'\<in>{0<..<y}. y' \<noteq> snd fund_sol
snd fund_sol \<noteq> 0
[PROOF STEP]
have "(\<forall>y'<y. y' \<noteq> snd fund_sol)"
[PROOF STATE]
proof (prove)
using this:
\<forall>y'\<in>{0<..<y}. y' \<noteq> snd fund_sol
snd fund_sol \<noteq> 0

goal (1 subgoal):
 1. \<forall>y'<y. y' \<noteq> snd fund_sol
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<forall>y'<y. y' \<noteq> snd fund_sol

goal (1 subgoal):
 1. y \<le> snd fund_sol
[PROOF STEP]
thus "snd fund_sol \<ge> y"
[PROOF STATE]
proof (prove)
using this:
\<forall>y'<y. y' \<noteq> snd fund_sol

goal (1 subgoal):
 1. y \<le> snd fund_sol
[PROOF STEP]
by (cases "snd fund_sol \<ge> y") (auto simp: not_less)
[PROOF STATE]
proof (state)
this:
y \<le> snd fund_sol

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
y \<le> snd fund_sol

goal (1 subgoal):
 1. fund_sol = projr (while isl (find_fund_sol_step D) (Inl (Suc 0, Suc D)))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
snd fund_sol \<le> snd (x, y)
y \<le> snd fund_sol
[PROOF STEP]
have "snd fund_sol = y"
[PROOF STATE]
proof (prove)
using this:
snd fund_sol \<le> snd (x, y)
y \<le> snd fund_sol

goal (1 subgoal):
 1. snd fund_sol = y
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
snd fund_sol = y

goal (1 subgoal):
 1. fund_sol = projr (while isl (find_fund_sol_step D) (Inl (Suc 0, Suc D)))
[PROOF STEP]
with solutions_linorder_strict[of x y "fst fund_sol" "snd fund_sol"]
       fund_sol_is_nontriv_solution \<open>nontriv_solution (x, y)\<close>
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>solution (x, y); solution (fst fund_sol, snd fund_sol)\<rbrakk> \<Longrightarrow> (x, y) = (fst fund_sol, snd fund_sol) \<or> x < fst fund_sol \<and> y < snd fund_sol \<or> fst fund_sol < x \<and> snd fund_sol < y
nontriv_solution fund_sol
nontriv_solution (x, y)
snd fund_sol = y
[PROOF STEP]
have "fst fund_sol = x"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>solution (x, y); solution (fst fund_sol, snd fund_sol)\<rbrakk> \<Longrightarrow> (x, y) = (fst fund_sol, snd fund_sol) \<or> x < fst fund_sol \<and> y < snd fund_sol \<or> fst fund_sol < x \<and> snd fund_sol < y
nontriv_solution fund_sol
nontriv_solution (x, y)
snd fund_sol = y

goal (1 subgoal):
 1. fst fund_sol = x
[PROOF STEP]
by (cases fund_sol) (auto simp: nontriv_solution_altdef)
[PROOF STATE]
proof (state)
this:
fst fund_sol = x

goal (1 subgoal):
 1. fund_sol = projr (while isl (find_fund_sol_step D) (Inl (Suc 0, Suc D)))
[PROOF STEP]
with \<open>snd fund_sol = y\<close>
[PROOF STATE]
proof (chain)
picking this:
snd fund_sol = y
fst fund_sol = x
[PROOF STEP]
have "fund_sol = (x, y)"
[PROOF STATE]
proof (prove)
using this:
snd fund_sol = y
fst fund_sol = x

goal (1 subgoal):
 1. fund_sol = (x, y)
[PROOF STEP]
by (cases fund_sol) simp
[PROOF STATE]
proof (state)
this:
fund_sol = (x, y)

goal (1 subgoal):
 1. fund_sol = projr (while isl (find_fund_sol_step D) (Inl (Suc 0, Suc D)))
[PROOF STEP]
with xy
[PROOF STATE]
proof (chain)
picking this:
projr (while isl f (Inl (Suc 0, Suc D))) = (x, y)
fund_sol = (x, y)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
projr (while isl f (Inl (Suc 0, Suc D))) = (x, y)
fund_sol = (x, y)

goal (1 subgoal):
 1. fund_sol = projr (while isl (find_fund_sol_step D) (Inl (Suc 0, Suc D)))
[PROOF STEP]
by (simp add: f_def)
[PROOF STATE]
proof (state)
this:
fund_sol = projr (while isl (find_fund_sol_step D) (Inl (Suc 0, Suc D)))

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma Conjunctive_conj:
  assumes "Conjunctive(HC)"
  shows "HC(P \<and> Q) = (HC(P) \<and> Q)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. HC (P \<and> Q) = (HC P \<and> Q)
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
Conjunctive HC

goal (1 subgoal):
 1. HC (P \<and> Q) = (HC P \<and> Q)
[PROOF STEP]
unfolding Conjunctive_def
[PROOF STATE]
proof (prove)
using this:
\<exists>Q. \<forall>P. HC P = (P \<and> Q)

goal (1 subgoal):
 1. HC (P \<and> Q) = (HC P \<and> Q)
[PROOF STEP]
by (metis utp_pred_laws.inf.assoc utp_pred_laws.inf.commute)


[STATEMENT]
lemma Nil_in_Prefixes_iff [simp]: "[] \<in> Prefixes A \<longleftrightarrow> A \<noteq> {}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ([] \<in> Prefixes A) = (A \<noteq> {})
[PROOF STEP]
by (auto simp: Prefixes_def)


[STATEMENT]
lemma sum_mset_image_mset_singleton: "sum_mset (image_mset (\<lambda>x. {#f x#}) A) = image_mset f A"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Sum>x\<in>#A. {#f x#}) = image_mset f A
[PROOF STEP]
by (induction A) auto


[STATEMENT]
lemma Rep_formula_inf:
  "Rep_formula (x \<sqinter> y) = Rep_formula x \<inter> Rep_formula y"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Rep_formula (x \<sqinter> y) = Rep_formula x \<inter> Rep_formula y
[PROOF STEP]
unfolding inf_formula_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Rep_formula (Abs_formula (Rep_formula x \<inter> Rep_formula y)) = Rep_formula x \<inter> Rep_formula y
[PROOF STEP]
by (intro Abs_formula_inverse fba.inter Rep_formula)


[STATEMENT]
lemma (in group_action) stabilizer_subset:
  "stabilizer G \<phi> x \<subseteq> carrier G"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. stabilizer G \<phi> x \<subseteq> carrier G
[PROOF STEP]
by (metis (no_types, lifting) mem_Collect_eq stabilizer_def subsetI)


[STATEMENT]
lemma leadsTo_UN_distrib:
     "F \<in> (\<Union>i \<in> I. A i) leadsTo B  =  (\<forall>i \<in> I. F \<in> (A i) leadsTo B)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (F \<in> \<Union> (A ` I) \<longmapsto> B) = (\<forall>i\<in>I. F \<in> A i \<longmapsto> B)
[PROOF STEP]
by (blast intro: leadsTo_UN leadsTo_weaken_L)


[STATEMENT]
lemma simplex_map_compose:
   "simplex_map p (h \<circ> g) = simplex_map p h \<circ> simplex_map p g"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. simplex_map p (h \<circ> g) = simplex_map p h \<circ> simplex_map p g
[PROOF STEP]
unfolding simplex_map_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lambda>c. restrict (h \<circ> g \<circ> c) (standard_simplex p)) = (\<lambda>c. restrict (h \<circ> c) (standard_simplex p)) \<circ> (\<lambda>c. restrict (g \<circ> c) (standard_simplex p))
[PROOF STEP]
by force


[STATEMENT]
lemma bounded_integrable:
  assumes "bounded (range v)" "v \<in> borel_measurable (measure_pmf p)"
  shows "integrable (measure_pmf p) (v :: 'c \<Rightarrow> real)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. integrable (measure_pmf p) v
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
bounded (range v)
measure_pmf.random_variable p borel v

goal (1 subgoal):
 1. integrable (measure_pmf p) v
[PROOF STEP]
by (auto simp: bounded_iff AE_measure_pmf_iff intro!: measure_pmf.integrable_const_bound)


[STATEMENT]
lemma list_assn_mono:
  "\<lbrakk>\<And>x x'. P x x'\<Longrightarrow>\<^sub>AP' x x'\<rbrakk> \<Longrightarrow> list_assn P l l' \<Longrightarrow>\<^sub>A list_assn P' l l'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>x x'. P x x' \<Longrightarrow>\<^sub>A P' x x') \<Longrightarrow> list_assn P l l' \<Longrightarrow>\<^sub>A list_assn P' l l'
[PROOF STEP]
apply (induct P l l' rule: list_assn.induct)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>P. (\<And>x x'. P x x' \<Longrightarrow>\<^sub>A P' x x') \<Longrightarrow> list_assn P [] [] \<Longrightarrow>\<^sub>A list_assn P' [] []
 2. \<And>P a as c cs. \<lbrakk>(\<And>x x'. P x x' \<Longrightarrow>\<^sub>A P' x x') \<Longrightarrow> list_assn P as cs \<Longrightarrow>\<^sub>A list_assn P' as cs; \<And>x x'. P x x' \<Longrightarrow>\<^sub>A P' x x'\<rbrakk> \<Longrightarrow> list_assn P (a # as) (c # cs) \<Longrightarrow>\<^sub>A list_assn P' (a # as) (c # cs)
 3. \<And>uu_ v va. (\<And>x x'. uu_ x x' \<Longrightarrow>\<^sub>A P' x x') \<Longrightarrow> list_assn uu_ (v # va) [] \<Longrightarrow>\<^sub>A list_assn P' (v # va) []
 4. \<And>uu_ v va. (\<And>x x'. uu_ x x' \<Longrightarrow>\<^sub>A P' x x') \<Longrightarrow> list_assn uu_ [] (v # va) \<Longrightarrow>\<^sub>A list_assn P' [] (v # va)
[PROOF STEP]
by (auto intro: ent_star_mono)


[STATEMENT]
lemma differentiable_at_imp_differentiable_on:
  "(\<And>x. x \<in> s \<Longrightarrow> f differentiable at x) \<Longrightarrow> f differentiable_on s"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>x. x \<in> s \<Longrightarrow> f differentiable at x) \<Longrightarrow> f differentiable_on s
[PROOF STEP]
by (metis differentiable_at_withinI differentiable_on_def)


[STATEMENT]
lemma monom_mult_atomize:
  "monom_mult c t (atomize_poly p) = atomize_poly (MPoly_Type_Class.punit.monom_mult (monomial c t) 0 p)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. monom_mult c t (atomize_poly p) = atomize_poly (MPoly_Type_Class.punit.monom_mult (monomial c t) 0 p)
[PROOF STEP]
by (rule poly_mapping_eqI_proj, simp add: proj_monom_mult proj_atomize_poly
      MPoly_Type_Class.punit.lookup_monom_mult times_monomial_left)


[STATEMENT]
lemma (in semilattice_inf) residuated_inf: "residuated f \<Longrightarrow> residual f (x \<sqinter> y) = residual f x \<sqinter> residual f y"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. residuated f \<Longrightarrow> residual f (x \<sqinter> y) = residual f x \<sqinter> residual f y
[PROOF STEP]
proof (rule order.antisym)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. residuated f \<Longrightarrow> residual f (x \<sqinter> y) \<le> residual f x \<sqinter> residual f y
 2. residuated f \<Longrightarrow> residual f x \<sqinter> residual f y \<le> residual f (x \<sqinter> y)
[PROOF STEP]
assume assm: "residuated f"
[PROOF STATE]
proof (state)
this:
residuated f

goal (2 subgoals):
 1. residuated f \<Longrightarrow> residual f (x \<sqinter> y) \<le> residual f x \<sqinter> residual f y
 2. residuated f \<Longrightarrow> residual f x \<sqinter> residual f y \<le> residual f (x \<sqinter> y)
[PROOF STEP]
thus "residual f (x \<sqinter> y) \<le> residual f x \<sqinter> residual f y"
[PROOF STATE]
proof (prove)
using this:
residuated f

goal (1 subgoal):
 1. residual f (x \<sqinter> y) \<le> residual f x \<sqinter> residual f y
[PROOF STEP]
by (metis local.inf.boundedI local.inf.cobounded1 local.inf.cobounded2 local.res_residual_iso)
[PROOF STATE]
proof (state)
this:
residual f (x \<sqinter> y) \<le> residual f x \<sqinter> residual f y

goal (1 subgoal):
 1. residuated f \<Longrightarrow> residual f x \<sqinter> residual f y \<le> residual f (x \<sqinter> y)
[PROOF STEP]
show "residual f x \<sqinter> residual f y \<le> residual f (x \<sqinter> y)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. residual f x \<sqinter> residual f y \<le> residual f (x \<sqinter> y)
[PROOF STEP]
by (metis assm local.inf.bounded_iff local.inf.cobounded1 local.inf.cobounded2 local.residual_galoisI1 local.residual_galoisI2)
[PROOF STATE]
proof (state)
this:
residual f x \<sqinter> residual f y \<le> residual f (x \<sqinter> y)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma has_field_derivative_complex_powr_right:
  "w \<noteq> 0 \<Longrightarrow> ((\<lambda>z. w powr z) has_field_derivative Ln w * w powr z) (at z within A)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. w \<noteq> 0 \<Longrightarrow> ((powr) w has_field_derivative Ln w * w powr z) (at z within A)
[PROOF STEP]
by (rule DERIV_subset, rule has_field_derivative_powr_right) auto


[STATEMENT]
lemma set_vebt_succ'[vebt_simps]: "invar_vebt t n \<Longrightarrow> vebt_succ t x = (if \<exists>  y \<in> set_vebt t. y > x then Some (LEAST y \<in> set_vebt t. y > x) else None)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. invar_vebt t n \<Longrightarrow> vebt_succ t x = (if \<exists>y\<in>set_vebt t. x < y then Some (LEAST y. y \<in> set_vebt t \<and> x < y) else None)
[PROOF STEP]
apply (clarsimp;safe)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>y. \<lbrakk>invar_vebt t n; y \<in> set_vebt t; x < y\<rbrakk> \<Longrightarrow> vebt_succ t x = Some (LEAST y. y \<in> set_vebt t \<and> x < y)
 2. \<lbrakk>invar_vebt t n; \<forall>xa\<in>set_vebt t. \<not> x < xa\<rbrakk> \<Longrightarrow> vebt_succ t x = None
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invar_vebt t n; y_ \<in> set_vebt t; x < y_\<rbrakk> \<Longrightarrow> vebt_succ t x = Some (LEAST y. y \<in> set_vebt t \<and> x < y)
[PROOF STEP]
apply(clarsimp simp add: succ_correct is_succ_in_set_def Least_le)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invar_vebt t n; y_ \<in> set_vebt t; x < y_\<rbrakk> \<Longrightarrow> (LEAST y. y \<in> set_vebt t \<and> x < y) \<in> set_vebt t \<and> x < (LEAST y. y \<in> set_vebt t \<and> x < y)
[PROOF STEP]
by (metis (no_types, lifting) LeastI_ex)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invar_vebt t n; \<forall>xa\<in>set_vebt t. \<not> x < xa\<rbrakk> \<Longrightarrow> vebt_succ t x = None
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invar_vebt t n; \<forall>xa\<in>set_vebt t. \<not> x < xa\<rbrakk> \<Longrightarrow> vebt_succ t x = None
[PROOF STEP]
by (meson succ_correct is_succ_in_set_def option.exhaust_sel)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma integrable_real_mult_indicator:
  fixes f :: "'a \<Rightarrow> real"
  shows "A \<in> sets M \<Longrightarrow> integrable M f \<Longrightarrow> integrable M (\<lambda>x. f x * indicator A x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>A \<in> sets M; integrable M f\<rbrakk> \<Longrightarrow> integrable M (\<lambda>x. f x * indicat_real A x)
[PROOF STEP]
using integrable_mult_indicator[of A M f]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>A \<in> sets M; integrable M f\<rbrakk> \<Longrightarrow> integrable M (\<lambda>x. indicat_real A x *\<^sub>R f x)

goal (1 subgoal):
 1. \<lbrakk>A \<in> sets M; integrable M f\<rbrakk> \<Longrightarrow> integrable M (\<lambda>x. f x * indicat_real A x)
[PROOF STEP]
by (simp add: mult_ac)


[STATEMENT]
lemma eqMinimumI:
  assumes "x \<in> S"
  and "\<And> y. y \<in> S \<Longrightarrow> x \<le> y"
shows "Minimum S = x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Minimum S = x
[PROOF STEP]
unfolding Minimum_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (THE x. x \<in> S \<and> Ball S ((\<le>) x)) = x
[PROOF STEP]
by (standard, insert assms, auto, fastforce)


[STATEMENT]
theorem not_finite_prime: "infinite {p::nat. prime p}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. infinite {p. prime p}
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. infinite {p. prime p}
[PROOF STEP]
obtain N k where N: "\<forall>n\<in>- {0}. hypnat_of_nat n dvd N" "k\<in>starprime" "k dvd N + 1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>N k. \<lbrakk>\<forall>n\<in>- {0}. hypnat_of_nat n dvd N; k \<in> starprime; k dvd N + 1\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (meson hyperprime_factor_exists hypnat_add_one_gt_one hypnat_dvd_all_hypnat_of_nat)
[PROOF STATE]
proof (state)
this:
\<forall>n\<in>- {0}. hypnat_of_nat n dvd N
k \<in> starprime
k dvd N + 1

goal (1 subgoal):
 1. infinite {p. prime p}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<forall>n\<in>- {0}. hypnat_of_nat n dvd N
k \<in> starprime
k dvd N + 1
[PROOF STEP]
have "k \<noteq> 1"
[PROOF STATE]
proof (prove)
using this:
\<forall>n\<in>- {0}. hypnat_of_nat n dvd N
k \<in> starprime
k dvd N + 1

goal (1 subgoal):
 1. k \<noteq> 1
[PROOF STEP]
using \<open>k \<in> starprime\<close>
[PROOF STATE]
proof (prove)
using this:
\<forall>n\<in>- {0}. hypnat_of_nat n dvd N
k \<in> starprime
k dvd N + 1
k \<in> starprime

goal (1 subgoal):
 1. k \<noteq> 1
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
k \<noteq> 1

goal (1 subgoal):
 1. infinite {p. prime p}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
k \<noteq> 1
[PROOF STEP]
have "k \<notin> hypnat_of_nat ` {p. prime p}"
[PROOF STATE]
proof (prove)
using this:
k \<noteq> 1

goal (1 subgoal):
 1. k \<notin> hypnat_of_nat ` {p. prime p}
[PROOF STEP]
using N dvd_add_right_iff hdvd_one_eq_one not_prime_0
[PROOF STATE]
proof (prove)
using this:
k \<noteq> 1
\<forall>n\<in>- {0}. hypnat_of_nat n dvd N
k \<in> starprime
k dvd N + 1
?a dvd ?b \<Longrightarrow> (?a dvd ?b + ?c) = (?a dvd ?c)
is_unit ?x \<Longrightarrow> ?x = 1
\<not> prime (0::?'a)

goal (1 subgoal):
 1. k \<notin> hypnat_of_nat ` {p. prime p}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
k \<notin> hypnat_of_nat ` {p. prime p}

goal (1 subgoal):
 1. infinite {p. prime p}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
k \<notin> hypnat_of_nat ` {p. prime p}
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
k \<notin> hypnat_of_nat ` {p. prime p}

goal (1 subgoal):
 1. infinite {p. prime p}
[PROOF STEP]
by (metis \<open>k \<in> starprime\<close> finite_starsetNat_iff starprime_def)
[PROOF STATE]
proof (state)
this:
infinite {p. prime p}

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma preimage_range: "preimage f (ran f) = dom f"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. preimage f (ran f) = dom f
[PROOF STEP]
by (auto simp add: preimage_def ran_def)