[STATEMENT]
lemma poly_x_mult_y_code[code]: "poly_x_mult_y p = (let cs = coeffs p
  in poly_of_list (map (\<lambda> (i, ai). monom ai i) (zip [0 ..< length cs] cs)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. poly_x_mult_y p = (let cs = coeffs p in poly_of_list (map2 (\<lambda>i ai. monom ai i) [0..<length cs] cs))
[PROOF STEP]
unfolding Let_def poly_of_list_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. poly_x_mult_y p = Poly (map2 (\<lambda>i ai. monom ai i) [0..<length (coeffs p)] (coeffs p))
[PROOF STEP]
proof (rule poly_eqI, unfold coeff_poly_x_mult_y)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>n. monom (coeff p n) n = coeff (Poly (map2 (\<lambda>i ai. monom ai i) [0..<length (coeffs p)] (coeffs p))) n
[PROOF STEP]
fix n
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>n. monom (coeff p n) n = coeff (Poly (map2 (\<lambda>i ai. monom ai i) [0..<length (coeffs p)] (coeffs p))) n
[PROOF STEP]
let ?xs = "zip [0..<length (coeffs p)] (coeffs p)"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>n. monom (coeff p n) n = coeff (Poly (map2 (\<lambda>i ai. monom ai i) [0..<length (coeffs p)] (coeffs p))) n
[PROOF STEP]
let ?f = "(\<lambda>(i, ai). monom ai i)"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>n. monom (coeff p n) n = coeff (Poly (map2 (\<lambda>i ai. monom ai i) [0..<length (coeffs p)] (coeffs p))) n
[PROOF STEP]
show "monom (coeff p n) n = coeff (Poly (map ?f ?xs)) n"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. monom (coeff p n) n = coeff (Poly (map2 (\<lambda>i ai. monom ai i) [0..<length (coeffs p)] (coeffs p))) n
[PROOF STEP]
proof (cases "n < length (coeffs p)")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. n < length (coeffs p) \<Longrightarrow> monom (coeff p n) n = coeff (Poly (map2 (\<lambda>i ai. monom ai i) [0..<length (coeffs p)] (coeffs p))) n
 2. \<not> n < length (coeffs p) \<Longrightarrow> monom (coeff p n) n = coeff (Poly (map2 (\<lambda>i ai. monom ai i) [0..<length (coeffs p)] (coeffs p))) n
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
n < length (coeffs p)

goal (2 subgoals):
 1. n < length (coeffs p) \<Longrightarrow> monom (coeff p n) n = coeff (Poly (map2 (\<lambda>i ai. monom ai i) [0..<length (coeffs p)] (coeffs p))) n
 2. \<not> n < length (coeffs p) \<Longrightarrow> monom (coeff p n) n = coeff (Poly (map2 (\<lambda>i ai. monom ai i) [0..<length (coeffs p)] (coeffs p))) n
[PROOF STEP]
hence n: "n < length (map ?f ?xs)" and nn: "n < length ?xs"
[PROOF STATE]
proof (prove)
using this:
n < length (coeffs p)

goal (1 subgoal):
 1. n < length (map2 (\<lambda>i ai. monom ai i) [0..<length (coeffs p)] (coeffs p)) &&& n < length (zip [0..<length (coeffs p)] (coeffs p))
[PROOF STEP]
unfolding degree_eq_length_coeffs
[PROOF STATE]
proof (prove)
using this:
n < length (coeffs p)

goal (1 subgoal):
 1. n < length (map2 (\<lambda>i ai. monom ai i) [0..<length (coeffs p)] (coeffs p)) &&& n < length (zip [0..<length (coeffs p)] (coeffs p))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
n < length (map2 (\<lambda>i ai. monom ai i) [0..<length (coeffs p)] (coeffs p))
n < length (zip [0..<length (coeffs p)] (coeffs p))

goal (2 subgoals):
 1. n < length (coeffs p) \<Longrightarrow> monom (coeff p n) n = coeff (Poly (map2 (\<lambda>i ai. monom ai i) [0..<length (coeffs p)] (coeffs p))) n
 2. \<not> n < length (coeffs p) \<Longrightarrow> monom (coeff p n) n = coeff (Poly (map2 (\<lambda>i ai. monom ai i) [0..<length (coeffs p)] (coeffs p))) n
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. monom (coeff p n) n = coeff (Poly (map2 (\<lambda>i ai. monom ai i) [0..<length (coeffs p)] (coeffs p))) n
[PROOF STEP]
unfolding coeff_Poly nth_default_nth[OF n] nth_map[OF nn]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. monom (coeff p n) n = (case zip [0..<length (coeffs p)] (coeffs p) ! n of (i, ai) \<Rightarrow> monom ai i)
[PROOF STEP]
using True
[PROOF STATE]
proof (prove)
using this:
n < length (coeffs p)

goal (1 subgoal):
 1. monom (coeff p n) n = (case zip [0..<length (coeffs p)] (coeffs p) ! n of (i, ai) \<Rightarrow> monom ai i)
[PROOF STEP]
by (simp add: nth_coeffs_coeff)
[PROOF STATE]
proof (state)
this:
monom (coeff p n) n = coeff (Poly (map2 (\<lambda>i ai. monom ai i) [0..<length (coeffs p)] (coeffs p))) n

goal (1 subgoal):
 1. \<not> n < length (coeffs p) \<Longrightarrow> monom (coeff p n) n = coeff (Poly (map2 (\<lambda>i ai. monom ai i) [0..<length (coeffs p)] (coeffs p))) n
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> n < length (coeffs p) \<Longrightarrow> monom (coeff p n) n = coeff (Poly (map2 (\<lambda>i ai. monom ai i) [0..<length (coeffs p)] (coeffs p))) n
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
\<not> n < length (coeffs p)

goal (1 subgoal):
 1. \<not> n < length (coeffs p) \<Longrightarrow> monom (coeff p n) n = coeff (Poly (map2 (\<lambda>i ai. monom ai i) [0..<length (coeffs p)] (coeffs p))) n
[PROOF STEP]
hence id: "coeff (Poly (map ?f ?xs)) n = 0"
[PROOF STATE]
proof (prove)
using this:
\<not> n < length (coeffs p)

goal (1 subgoal):
 1. coeff (Poly (map2 (\<lambda>i ai. monom ai i) [0..<length (coeffs p)] (coeffs p))) n = 0
[PROOF STEP]
unfolding coeff_Poly
[PROOF STATE]
proof (prove)
using this:
\<not> n < length (coeffs p)

goal (1 subgoal):
 1. nth_default 0 (map2 (\<lambda>i ai. monom ai i) [0..<length (coeffs p)] (coeffs p)) n = 0
[PROOF STEP]
by (subst nth_default_beyond, auto)
[PROOF STATE]
proof (state)
this:
coeff (Poly (map2 (\<lambda>i ai. monom ai i) [0..<length (coeffs p)] (coeffs p))) n = 0

goal (1 subgoal):
 1. \<not> n < length (coeffs p) \<Longrightarrow> monom (coeff p n) n = coeff (Poly (map2 (\<lambda>i ai. monom ai i) [0..<length (coeffs p)] (coeffs p))) n
[PROOF STEP]
from False
[PROOF STATE]
proof (chain)
picking this:
\<not> n < length (coeffs p)
[PROOF STEP]
have "n > degree p \<or> p = 0"
[PROOF STATE]
proof (prove)
using this:
\<not> n < length (coeffs p)

goal (1 subgoal):
 1. degree p < n \<or> p = 0
[PROOF STEP]
unfolding degree_eq_length_coeffs
[PROOF STATE]
proof (prove)
using this:
\<not> n < length (coeffs p)

goal (1 subgoal):
 1. length (coeffs p) - 1 < n \<or> p = 0
[PROOF STEP]
by (cases n, auto)
[PROOF STATE]
proof (state)
this:
degree p < n \<or> p = 0

goal (1 subgoal):
 1. \<not> n < length (coeffs p) \<Longrightarrow> monom (coeff p n) n = coeff (Poly (map2 (\<lambda>i ai. monom ai i) [0..<length (coeffs p)] (coeffs p))) n
[PROOF STEP]
hence "monom (coeff p n) n = 0"
[PROOF STATE]
proof (prove)
using this:
degree p < n \<or> p = 0

goal (1 subgoal):
 1. monom (coeff p n) n = 0
[PROOF STEP]
using coeff_eq_0[of p n]
[PROOF STATE]
proof (prove)
using this:
degree p < n \<or> p = 0
degree p < n \<Longrightarrow> coeff p n = (0::'a)

goal (1 subgoal):
 1. monom (coeff p n) n = 0
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
monom (coeff p n) n = 0

goal (1 subgoal):
 1. \<not> n < length (coeffs p) \<Longrightarrow> monom (coeff p n) n = coeff (Poly (map2 (\<lambda>i ai. monom ai i) [0..<length (coeffs p)] (coeffs p))) n
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
monom (coeff p n) n = 0

goal (1 subgoal):
 1. monom (coeff p n) n = coeff (Poly (map2 (\<lambda>i ai. monom ai i) [0..<length (coeffs p)] (coeffs p))) n
[PROOF STEP]
unfolding id
[PROOF STATE]
proof (prove)
using this:
monom (coeff p n) n = 0

goal (1 subgoal):
 1. monom (coeff p n) n = 0
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
monom (coeff p n) n = coeff (Poly (map2 (\<lambda>i ai. monom ai i) [0..<length (coeffs p)] (coeffs p))) n

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
monom (coeff p n) n = coeff (Poly (map2 (\<lambda>i ai. monom ai i) [0..<length (coeffs p)] (coeffs p))) n

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma zmult_div_pos_le:"
  \<lbrakk> (0::int) \<le> a; 0 \<le> b; b \<le> c \<rbrakk> \<Longrightarrow> a * b div c \<le> a"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> a; 0 \<le> b; b \<le> c\<rbrakk> \<Longrightarrow> a * b div c \<le> a
[PROOF STEP]
apply (case_tac "b = 0", simp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> a; 0 \<le> b; b \<le> c; b \<noteq> 0\<rbrakk> \<Longrightarrow> a * b div c \<le> a
[PROOF STEP]
apply (subgoal_tac "b * a \<le> c * a")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>0 \<le> a; 0 \<le> b; b \<le> c; b \<noteq> 0; b * a \<le> c * a\<rbrakk> \<Longrightarrow> a * b div c \<le> a
 2. \<lbrakk>0 \<le> a; 0 \<le> b; b \<le> c; b \<noteq> 0\<rbrakk> \<Longrightarrow> b * a \<le> c * a
[PROOF STEP]
prefer 2
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>0 \<le> a; 0 \<le> b; b \<le> c; b \<noteq> 0\<rbrakk> \<Longrightarrow> b * a \<le> c * a
 2. \<lbrakk>0 \<le> a; 0 \<le> b; b \<le> c; b \<noteq> 0; b * a \<le> c * a\<rbrakk> \<Longrightarrow> a * b div c \<le> a
[PROOF STEP]
apply (simp only: mult_right_mono)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> a; 0 \<le> b; b \<le> c; b \<noteq> 0; b * a \<le> c * a\<rbrakk> \<Longrightarrow> a * b div c \<le> a
[PROOF STEP]
apply (simp only: mult.commute)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> a; 0 \<le> b; b \<le> c; b \<noteq> 0; a * b \<le> a * c\<rbrakk> \<Longrightarrow> a * b div c \<le> a
[PROOF STEP]
apply (subgoal_tac "a * b div c \<le> a * c div c")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>0 \<le> a; 0 \<le> b; b \<le> c; b \<noteq> 0; a * b \<le> a * c; a * b div c \<le> a * c div c\<rbrakk> \<Longrightarrow> a * b div c \<le> a
 2. \<lbrakk>0 \<le> a; 0 \<le> b; b \<le> c; b \<noteq> 0; a * b \<le> a * c\<rbrakk> \<Longrightarrow> a * b div c \<le> a * c div c
[PROOF STEP]
prefer 2
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>0 \<le> a; 0 \<le> b; b \<le> c; b \<noteq> 0; a * b \<le> a * c\<rbrakk> \<Longrightarrow> a * b div c \<le> a * c div c
 2. \<lbrakk>0 \<le> a; 0 \<le> b; b \<le> c; b \<noteq> 0; a * b \<le> a * c; a * b div c \<le> a * c div c\<rbrakk> \<Longrightarrow> a * b div c \<le> a
[PROOF STEP]
apply (simp only: zdiv_mono1)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 \<le> a; 0 \<le> b; b \<le> c; b \<noteq> 0; a * b \<le> a * c; a * b div c \<le> a * c div c\<rbrakk> \<Longrightarrow> a * b div c \<le> a
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma sign_simps[simp]:
  "x>0 \<Longrightarrow> sign x=1"
  "x=0 \<Longrightarrow> sign x=0"
  "x<0 \<Longrightarrow> sign x=-1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((0::'a) < x \<Longrightarrow> sign x = 1) &&& (x = (0::'a) \<Longrightarrow> sign x = 0) &&& (x < (0::'a) \<Longrightarrow> sign x = - 1)
[PROOF STEP]
unfolding sign_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((0::'a) < x \<Longrightarrow> (if (0::'a) < x then 1 else if x = (0::'a) then 0 else - 1) = 1) &&& (x = (0::'a) \<Longrightarrow> (if (0::'a) < x then 1 else if x = (0::'a) then 0 else - 1) = 0) &&& (x < (0::'a) \<Longrightarrow> (if (0::'a) < x then 1 else if x = (0::'a) then 0 else - 1) = - 1)
[PROOF STEP]
by auto


[STATEMENT]
lemma map_add_map_of_fold:
    fixes ps and m :: "'a \<rightharpoonup> 'b"
    assumes "distinct (map fst ps)"
    shows "m ++ map_of ps = fold (\<lambda>(k, v) m. m(k \<mapsto> v)) ps m"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. m ++ map_of ps = fold (\<lambda>(k, v) m. m(k \<mapsto> v)) ps m
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. m ++ map_of ps = fold (\<lambda>(k, v) m. m(k \<mapsto> v)) ps m
[PROOF STEP]
have X1: "fold (\<lambda>(k, v) m. m(k \<mapsto> v)) ps m(a \<mapsto> b)
            = fold (\<lambda>(k, v) m. m(k \<mapsto> v)) ps (m(a \<mapsto> b))"
      if "a \<notin> fst ` set ps"
      for a b ps and m :: "'a \<rightharpoonup> 'b"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fold (\<lambda>(k, v) m. m(k \<mapsto> v)) ps m(a \<mapsto> b) = fold (\<lambda>(k, v) m. m(k \<mapsto> v)) ps (m(a \<mapsto> b))
[PROOF STEP]
using that
[PROOF STATE]
proof (prove)
using this:
a \<notin> fst ` set ps

goal (1 subgoal):
 1. fold (\<lambda>(k, v) m. m(k \<mapsto> v)) ps m(a \<mapsto> b) = fold (\<lambda>(k, v) m. m(k \<mapsto> v)) ps (m(a \<mapsto> b))
[PROOF STEP]
by (induction ps arbitrary: m) (auto simp: fun_upd_twist)
[PROOF STATE]
proof (state)
this:
?a \<notin> fst ` set ?ps \<Longrightarrow> fold (\<lambda>(k, v) m. m(k \<mapsto> v)) ?ps ?m(?a \<mapsto> ?b) = fold (\<lambda>(k, v) m. m(k \<mapsto> v)) ?ps (?m(?a \<mapsto> ?b))

goal (1 subgoal):
 1. m ++ map_of ps = fold (\<lambda>(k, v) m. m(k \<mapsto> v)) ps m
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. m ++ map_of ps = fold (\<lambda>(k, v) m. m(k \<mapsto> v)) ps m
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
distinct (map fst ps)

goal (1 subgoal):
 1. m ++ map_of ps = fold (\<lambda>(k, v) m. m(k \<mapsto> v)) ps m
[PROOF STEP]
by (induction ps arbitrary: m) (auto simp: X1)
[PROOF STATE]
proof (state)
this:
m ++ map_of ps = fold (\<lambda>(k, v) m. m(k \<mapsto> v)) ps m

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma filter_partition_by_median:
  assumes "(l, m, r) = partition_by_median k ps"
  shows "\<forall>p \<in> set l. p$k \<le> m"
    and "\<forall>p \<in> set r. \<not>p$k \<le> m"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>p\<in>set l. p $ k \<le> m &&& \<forall>p\<in>set r. \<not> p $ k \<le> m
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
(l, m, r) = partition_by_median k ps

goal (1 subgoal):
 1. \<forall>p\<in>set l. p $ k \<le> m &&& \<forall>p\<in>set r. \<not> p $ k \<le> m
[PROOF STEP]
unfolding partition_by_median_def
[PROOF STATE]
proof (prove)
using this:
(l, m, r) = (let m = axis_median k ps; (l, r) = partition (\<lambda>p. p $ k \<le> m) ps in (l, m, r))

goal (1 subgoal):
 1. \<forall>p\<in>set l. p $ k \<le> m &&& \<forall>p\<in>set r. \<not> p $ k \<le> m
[PROOF STEP]
by (auto simp: Let_def)


[STATEMENT]
lemma word_atLeastAtMost_Suc_greaterThanAtMost:
  \<open>{m<..u} = {m + 1..u}\<close> if \<open>m \<noteq> - 1\<close> for m :: \<open>'a::len word\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {m<..u} = {m + 1..u}
[PROOF STEP]
using that
[PROOF STATE]
proof (prove)
using this:
m \<noteq> - 1

goal (1 subgoal):
 1. {m<..u} = {m + 1..u}
[PROOF STEP]
by (simp add: greaterThanAtMost_def greaterThan_def atLeastAtMost_def atLeast_def word_Suc_le)


[STATEMENT]
lemma esqrt_mono2 [mono_intros]:
  assumes "x \<le> y"
  shows "esqrt x \<le> esqrt y"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. esqrt x \<le> esqrt y
[PROOF STEP]
using esqrt_mono assms
[PROOF STATE]
proof (prove)
using this:
mono esqrt
x \<le> y

goal (1 subgoal):
 1. esqrt x \<le> esqrt y
[PROOF STEP]
unfolding mono_def
[PROOF STATE]
proof (prove)
using this:
\<forall>x y. x \<le> y \<longrightarrow> esqrt x \<le> esqrt y
x \<le> y

goal (1 subgoal):
 1. esqrt x \<le> esqrt y
[PROOF STEP]
by auto


[STATEMENT]
lemma not_elem_out_0: "v \<notin> verts G \<Longrightarrow> out_degree G v = 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. v \<notin> verts G \<Longrightarrow> out_degree G v = 0
[PROOF STEP]
unfolding out_degree_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. v \<notin> verts G \<Longrightarrow> card (out_arcs G v) = 0
[PROOF STEP]
using not_elem_no_out_arcs
[PROOF STATE]
proof (prove)
using this:
?v \<notin> verts G \<Longrightarrow> out_arcs G ?v = {}

goal (1 subgoal):
 1. v \<notin> verts G \<Longrightarrow> card (out_arcs G v) = 0
[PROOF STEP]
by simp


[STATEMENT]
lemma interior_Times: "interior (A \<times> B) = interior A \<times> interior B"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. interior (A \<times> B) = interior A \<times> interior B
[PROOF STEP]
proof (rule interior_unique)
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. interior A \<times> interior B \<subseteq> A \<times> B
 2. open (interior A \<times> interior B)
 3. \<And>T'. \<lbrakk>T' \<subseteq> A \<times> B; open T'\<rbrakk> \<Longrightarrow> T' \<subseteq> interior A \<times> interior B
[PROOF STEP]
show "interior A \<times> interior B \<subseteq> A \<times> B"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. interior A \<times> interior B \<subseteq> A \<times> B
[PROOF STEP]
by (intro Sigma_mono interior_subset)
[PROOF STATE]
proof (state)
this:
interior A \<times> interior B \<subseteq> A \<times> B

goal (2 subgoals):
 1. open (interior A \<times> interior B)
 2. \<And>T'. \<lbrakk>T' \<subseteq> A \<times> B; open T'\<rbrakk> \<Longrightarrow> T' \<subseteq> interior A \<times> interior B
[PROOF STEP]
show "open (interior A \<times> interior B)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. open (interior A \<times> interior B)
[PROOF STEP]
by (intro open_Times open_interior)
[PROOF STATE]
proof (state)
this:
open (interior A \<times> interior B)

goal (1 subgoal):
 1. \<And>T'. \<lbrakk>T' \<subseteq> A \<times> B; open T'\<rbrakk> \<Longrightarrow> T' \<subseteq> interior A \<times> interior B
[PROOF STEP]
fix T
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>T'. \<lbrakk>T' \<subseteq> A \<times> B; open T'\<rbrakk> \<Longrightarrow> T' \<subseteq> interior A \<times> interior B
[PROOF STEP]
assume "T \<subseteq> A \<times> B" and "open T"
[PROOF STATE]
proof (state)
this:
T \<subseteq> A \<times> B
open T

goal (1 subgoal):
 1. \<And>T'. \<lbrakk>T' \<subseteq> A \<times> B; open T'\<rbrakk> \<Longrightarrow> T' \<subseteq> interior A \<times> interior B
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
T \<subseteq> A \<times> B
open T
[PROOF STEP]
show "T \<subseteq> interior A \<times> interior B"
[PROOF STATE]
proof (prove)
using this:
T \<subseteq> A \<times> B
open T

goal (1 subgoal):
 1. T \<subseteq> interior A \<times> interior B
[PROOF STEP]
proof safe
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>a b. \<lbrakk>T \<subseteq> A \<times> B; open T; (a, b) \<in> T\<rbrakk> \<Longrightarrow> a \<in> interior A
 2. \<And>a b. \<lbrakk>T \<subseteq> A \<times> B; open T; (a, b) \<in> T\<rbrakk> \<Longrightarrow> b \<in> interior B
[PROOF STEP]
fix x y
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>a b. \<lbrakk>T \<subseteq> A \<times> B; open T; (a, b) \<in> T\<rbrakk> \<Longrightarrow> a \<in> interior A
 2. \<And>a b. \<lbrakk>T \<subseteq> A \<times> B; open T; (a, b) \<in> T\<rbrakk> \<Longrightarrow> b \<in> interior B
[PROOF STEP]
assume "(x, y) \<in> T"
[PROOF STATE]
proof (state)
this:
(x, y) \<in> T

goal (2 subgoals):
 1. \<And>a b. \<lbrakk>T \<subseteq> A \<times> B; open T; (a, b) \<in> T\<rbrakk> \<Longrightarrow> a \<in> interior A
 2. \<And>a b. \<lbrakk>T \<subseteq> A \<times> B; open T; (a, b) \<in> T\<rbrakk> \<Longrightarrow> b \<in> interior B
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(x, y) \<in> T
[PROOF STEP]
obtain C D where "open C" "open D" "C \<times> D \<subseteq> T" "x \<in> C" "y \<in> D"
[PROOF STATE]
proof (prove)
using this:
(x, y) \<in> T

goal (1 subgoal):
 1. (\<And>C D. \<lbrakk>open C; open D; C \<times> D \<subseteq> T; x \<in> C; y \<in> D\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using \<open>open T\<close>
[PROOF STATE]
proof (prove)
using this:
(x, y) \<in> T
open T

goal (1 subgoal):
 1. (\<And>C D. \<lbrakk>open C; open D; C \<times> D \<subseteq> T; x \<in> C; y \<in> D\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
unfolding open_prod_def
[PROOF STATE]
proof (prove)
using this:
(x, y) \<in> T
\<forall>x\<in>T. \<exists>A B. open A \<and> open B \<and> x \<in> A \<times> B \<and> A \<times> B \<subseteq> T

goal (1 subgoal):
 1. (\<And>C D. \<lbrakk>open C; open D; C \<times> D \<subseteq> T; x \<in> C; y \<in> D\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by fast
[PROOF STATE]
proof (state)
this:
open C
open D
C \<times> D \<subseteq> T
x \<in> C
y \<in> D

goal (2 subgoals):
 1. \<And>a b. \<lbrakk>T \<subseteq> A \<times> B; open T; (a, b) \<in> T\<rbrakk> \<Longrightarrow> a \<in> interior A
 2. \<And>a b. \<lbrakk>T \<subseteq> A \<times> B; open T; (a, b) \<in> T\<rbrakk> \<Longrightarrow> b \<in> interior B
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
open C
open D
C \<times> D \<subseteq> T
x \<in> C
y \<in> D
[PROOF STEP]
have "open C" "open D" "C \<subseteq> A" "D \<subseteq> B" "x \<in> C" "y \<in> D"
[PROOF STATE]
proof (prove)
using this:
open C
open D
C \<times> D \<subseteq> T
x \<in> C
y \<in> D

goal (1 subgoal):
 1. (open C &&& open D &&& C \<subseteq> A) &&& D \<subseteq> B &&& x \<in> C &&& y \<in> D
[PROOF STEP]
using \<open>T \<subseteq> A \<times> B\<close>
[PROOF STATE]
proof (prove)
using this:
open C
open D
C \<times> D \<subseteq> T
x \<in> C
y \<in> D
T \<subseteq> A \<times> B

goal (1 subgoal):
 1. (open C &&& open D &&& C \<subseteq> A) &&& D \<subseteq> B &&& x \<in> C &&& y \<in> D
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
open C
open D
C \<subseteq> A
D \<subseteq> B
x \<in> C
y \<in> D

goal (2 subgoals):
 1. \<And>a b. \<lbrakk>T \<subseteq> A \<times> B; open T; (a, b) \<in> T\<rbrakk> \<Longrightarrow> a \<in> interior A
 2. \<And>a b. \<lbrakk>T \<subseteq> A \<times> B; open T; (a, b) \<in> T\<rbrakk> \<Longrightarrow> b \<in> interior B
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
open C
open D
C \<subseteq> A
D \<subseteq> B
x \<in> C
y \<in> D
[PROOF STEP]
show "x \<in> interior A" and "y \<in> interior B"
[PROOF STATE]
proof (prove)
using this:
open C
open D
C \<subseteq> A
D \<subseteq> B
x \<in> C
y \<in> D

goal (1 subgoal):
 1. x \<in> interior A &&& y \<in> interior B
[PROOF STEP]
by (auto intro: interiorI)
[PROOF STATE]
proof (state)
this:
x \<in> interior A
y \<in> interior B

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
T \<subseteq> interior A \<times> interior B

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma list_middle_eq:
  "length xs = length ys \<Longrightarrow> hd xs = hd ys \<Longrightarrow> last xs = last ys
    \<Longrightarrow> butlast (tl xs) = butlast (tl ys) \<Longrightarrow> xs = ys"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>length xs = length ys; hd xs = hd ys; last xs = last ys; butlast (tl xs) = butlast (tl ys)\<rbrakk> \<Longrightarrow> xs = ys
[PROOF STEP]
apply (induct xs ys rule: list_induct2, simp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x xs y ys. \<lbrakk>length xs = length ys; \<lbrakk>hd xs = hd ys; last xs = last ys; butlast (tl xs) = butlast (tl ys)\<rbrakk> \<Longrightarrow> xs = ys; hd (x # xs) = hd (y # ys); last (x # xs) = last (y # ys); butlast (tl (x # xs)) = butlast (tl (y # ys))\<rbrakk> \<Longrightarrow> x # xs = y # ys
[PROOF STEP]
by (metis append_butlast_last_id butlast.simps(1) butlast.simps(2) butlast_tl hd_Cons_tl
      impossible_Cons le_refl list.sel(3) neq_Nil_conv)


[STATEMENT]
lemma coplanar_perm_5:
  assumes "Coplanar A B C D"
  shows "Coplanar A D C B"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Coplanar A D C B
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. Coplanar A D C B
[PROOF STEP]
obtain X where P1: "(Col A B X \<and> Col C D X) \<or> (Col A C X \<and> Col B D X) \<or> (Col A D X \<and> Col B C X)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>X. Col A B X \<and> Col C D X \<or> Col A C X \<and> Col B D X \<or> Col A D X \<and> Col B C X \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using Coplanar_def assms
[PROOF STATE]
proof (prove)
using this:
Coplanar ?A ?B ?C ?D \<equiv> \<exists>X. Col ?A ?B X \<and> Col ?C ?D X \<or> Col ?A ?C X \<and> Col ?B ?D X \<or> Col ?A ?D X \<and> Col ?B ?C X
Coplanar A B C D

goal (1 subgoal):
 1. (\<And>X. Col A B X \<and> Col C D X \<or> Col A C X \<and> Col B D X \<or> Col A D X \<and> Col B C X \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
Col A B X \<and> Col C D X \<or> Col A C X \<and> Col B D X \<or> Col A D X \<and> Col B C X

goal (1 subgoal):
 1. Coplanar A D C B
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
Col A B X \<and> Col C D X \<or> Col A C X \<and> Col B D X \<or> Col A D X \<and> Col B C X
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
Col A B X \<and> Col C D X \<or> Col A C X \<and> Col B D X \<or> Col A D X \<and> Col B C X

goal (1 subgoal):
 1. Coplanar A D C B
[PROOF STEP]
using Coplanar_def col_permutation_4
[PROOF STATE]
proof (prove)
using this:
Col A B X \<and> Col C D X \<or> Col A C X \<and> Col B D X \<or> Col A D X \<and> Col B C X
Coplanar ?A ?B ?C ?D \<equiv> \<exists>X. Col ?A ?B X \<and> Col ?C ?D X \<or> Col ?A ?C X \<and> Col ?B ?D X \<or> Col ?A ?D X \<and> Col ?B ?C X
Col ?A ?B ?C \<Longrightarrow> Col ?B ?A ?C

goal (1 subgoal):
 1. Coplanar A D C B
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
Coplanar A D C B

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma monoseq_minus:
  fixes a :: "nat \<Rightarrow> 'a::ordered_ab_group_add"
  assumes "monoseq a"
  shows "monoseq (\<lambda> n. - a n)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. monoseq (\<lambda>n. - a n)
[PROOF STEP]
proof (cases "\<forall>m. \<forall>n \<ge> m. a m \<le> a n")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<forall>m n. m \<le> n \<longrightarrow> a m \<le> a n \<Longrightarrow> monoseq (\<lambda>n. - a n)
 2. \<not> (\<forall>m n. m \<le> n \<longrightarrow> a m \<le> a n) \<Longrightarrow> monoseq (\<lambda>n. - a n)
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
\<forall>m n. m \<le> n \<longrightarrow> a m \<le> a n

goal (2 subgoals):
 1. \<forall>m n. m \<le> n \<longrightarrow> a m \<le> a n \<Longrightarrow> monoseq (\<lambda>n. - a n)
 2. \<not> (\<forall>m n. m \<le> n \<longrightarrow> a m \<le> a n) \<Longrightarrow> monoseq (\<lambda>n. - a n)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<forall>m n. m \<le> n \<longrightarrow> a m \<le> a n
[PROOF STEP]
have "\<forall>m. \<forall>n \<ge> m. - a n \<le> - a m"
[PROOF STATE]
proof (prove)
using this:
\<forall>m n. m \<le> n \<longrightarrow> a m \<le> a n

goal (1 subgoal):
 1. \<forall>m n. m \<le> n \<longrightarrow> - a n \<le> - a m
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<forall>m n. m \<le> n \<longrightarrow> - a n \<le> - a m

goal (2 subgoals):
 1. \<forall>m n. m \<le> n \<longrightarrow> a m \<le> a n \<Longrightarrow> monoseq (\<lambda>n. - a n)
 2. \<not> (\<forall>m n. m \<le> n \<longrightarrow> a m \<le> a n) \<Longrightarrow> monoseq (\<lambda>n. - a n)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<forall>m n. m \<le> n \<longrightarrow> - a n \<le> - a m
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<forall>m n. m \<le> n \<longrightarrow> - a n \<le> - a m

goal (1 subgoal):
 1. monoseq (\<lambda>n. - a n)
[PROOF STEP]
by (rule monoI2)
[PROOF STATE]
proof (state)
this:
monoseq (\<lambda>n. - a n)

goal (1 subgoal):
 1. \<not> (\<forall>m n. m \<le> n \<longrightarrow> a m \<le> a n) \<Longrightarrow> monoseq (\<lambda>n. - a n)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> (\<forall>m n. m \<le> n \<longrightarrow> a m \<le> a n) \<Longrightarrow> monoseq (\<lambda>n. - a n)
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
\<not> (\<forall>m n. m \<le> n \<longrightarrow> a m \<le> a n)

goal (1 subgoal):
 1. \<not> (\<forall>m n. m \<le> n \<longrightarrow> a m \<le> a n) \<Longrightarrow> monoseq (\<lambda>n. - a n)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<not> (\<forall>m n. m \<le> n \<longrightarrow> a m \<le> a n)
[PROOF STEP]
have "\<forall>m. \<forall>n \<ge> m. - a m \<le> - a n"
[PROOF STATE]
proof (prove)
using this:
\<not> (\<forall>m n. m \<le> n \<longrightarrow> a m \<le> a n)

goal (1 subgoal):
 1. \<forall>m n. m \<le> n \<longrightarrow> - a m \<le> - a n
[PROOF STEP]
using \<open>monoseq a\<close>[unfolded monoseq_def]
[PROOF STATE]
proof (prove)
using this:
\<not> (\<forall>m n. m \<le> n \<longrightarrow> a m \<le> a n)
(\<forall>m n. m \<le> n \<longrightarrow> a m \<le> a n) \<or> (\<forall>m n. m \<le> n \<longrightarrow> a n \<le> a m)

goal (1 subgoal):
 1. \<forall>m n. m \<le> n \<longrightarrow> - a m \<le> - a n
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<forall>m n. m \<le> n \<longrightarrow> - a m \<le> - a n

goal (1 subgoal):
 1. \<not> (\<forall>m n. m \<le> n \<longrightarrow> a m \<le> a n) \<Longrightarrow> monoseq (\<lambda>n. - a n)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<forall>m n. m \<le> n \<longrightarrow> - a m \<le> - a n
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<forall>m n. m \<le> n \<longrightarrow> - a m \<le> - a n

goal (1 subgoal):
 1. monoseq (\<lambda>n. - a n)
[PROOF STEP]
by (rule monoI1)
[PROOF STATE]
proof (state)
this:
monoseq (\<lambda>n. - a n)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma
  assumes non_exec_stop[simp]: "\<not> exec_stop \<sigma>\<^sub>0"
   and    pos : "0 \<le> (a::int)"
   and    annotated_program:
          "\<sigma>\<^sub>0 \<Turnstile> \<open>tm := 1\<close> ;-
                \<open>sqsum := 1\<close> ;-
                \<open>i := 0\<close> ;-
                (while\<^sub>S\<^sub>E \<open>sqsum <= a\<close> do
                   \<open>i := i+1\<close> ;-
                   \<open>tm := tm + 2\<close> ;-
                   \<open>sqsum := tm + sqsum\<close>
                od) ;-
                assert\<^sub>S\<^sub>E(\<lambda>\<sigma>. \<sigma>=\<sigma>\<^sub>R)"

       shows "\<sigma>\<^sub>R \<Turnstile>assert\<^sub>S\<^sub>E \<open>i\<^sup>2  \<le> a \<and> a < (i + 1)\<^sup>2\<close> "
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
[PROOF STEP]
apply(insert annotated_program)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<sigma>\<^sub>0 \<Turnstile> tm_update :==\<^sub>G (\<lambda>\<sigma>. 1) ;- sqsum_update :==\<^sub>G (\<lambda>\<sigma>. 1) ;- i_update :==\<^sub>G (\<lambda>\<sigma>. 0) ;- _while_SE (\<lambda>\<sigma>. sqsum \<sigma> \<le> a) (i_update :==\<^sub>G (\<lambda>\<sigma>. i \<sigma> + 1) ;- tm_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + 2) ;- sqsum_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + sqsum \<sigma>)) ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R) \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
[PROOF STEP]
apply(tactic "dmatch_tac @{context} [@{thm \"non_exec_assign_globalD'_tm\"}] 1",simp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<sigma>\<^sub>0\<lparr>tm := 1\<rparr> \<Turnstile> sqsum_update :==\<^sub>G (\<lambda>\<sigma>. 1) ;- i_update :==\<^sub>G (\<lambda>\<sigma>. 0) ;- _while_SE (\<lambda>\<sigma>. sqsum \<sigma> \<le> a) (i_update :==\<^sub>G (\<lambda>\<sigma>. i \<sigma> + 1) ;- tm_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + 2) ;- sqsum_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + sqsum \<sigma>)) ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R) \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
[PROOF STEP]
apply(tactic "dmatch_tac @{context} [@{thm \"non_exec_assign_globalD'_sqsum\"}] 1",simp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1\<rparr> \<Turnstile> i_update :==\<^sub>G (\<lambda>\<sigma>. 0) ;- _while_SE (\<lambda>\<sigma>. sqsum \<sigma> \<le> a) (i_update :==\<^sub>G (\<lambda>\<sigma>. i \<sigma> + 1) ;- tm_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + 2) ;- sqsum_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + sqsum \<sigma>)) ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R) \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
[PROOF STEP]
apply(tactic "dmatch_tac @{context} [@{thm \"non_exec_assign_globalD'_i\"}] 1",simp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr> \<Turnstile> _while_SE (\<lambda>\<sigma>. sqsum \<sigma> \<le> a) (i_update :==\<^sub>G (\<lambda>\<sigma>. i \<sigma> + 1) ;- tm_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + 2) ;- sqsum_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + sqsum \<sigma>)) ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R) \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
[PROOF STEP]
apply(tactic "dmatch_tac @{context} [@{thm \"exec_whileD\"}] 1")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr> \<Turnstile> _if_SE (\<lambda>\<sigma>. sqsum \<sigma> \<le> a) ((i_update :==\<^sub>G (\<lambda>\<sigma>. i \<sigma> + 1) ;- tm_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + 2) ;- sqsum_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + sqsum \<sigma>)) ;- _while_SE (\<lambda>\<sigma>. sqsum \<sigma> \<le> a) (i_update :==\<^sub>G (\<lambda>\<sigma>. i \<sigma> + 1) ;- tm_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + 2) ;- sqsum_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + sqsum \<sigma>))) (unit\<^sub>S\<^sub>E ()) ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R) \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
[PROOF STEP]
apply(tactic "ematch_tac @{context} [@{thm \"if_SE_execE''\"}] 1")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>sqsum (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr>) \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr> \<Turnstile> ((i_update :==\<^sub>G (\<lambda>\<sigma>. i \<sigma> + 1) ;- tm_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + 2) ;- sqsum_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + sqsum \<sigma>)) ;- _while_SE (\<lambda>\<sigma>. sqsum \<sigma> \<le> a) (i_update :==\<^sub>G (\<lambda>\<sigma>. i \<sigma> + 1) ;- tm_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + 2) ;- sqsum_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + sqsum \<sigma>))) ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
 2. \<lbrakk>\<not> sqsum (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr>) \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr> \<Turnstile> unit\<^sub>S\<^sub>E () ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
[PROOF STEP]
apply(simp_all only: memory_theory MonadSE.bind_assoc')
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>1 \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr> \<Turnstile> i_update :==\<^sub>G (\<lambda>\<sigma>. i \<sigma> + 1) ;- tm_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + 2) ;- sqsum_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + sqsum \<sigma>) ;- _while_SE (\<lambda>\<sigma>. sqsum \<sigma> \<le> a) (i_update :==\<^sub>G (\<lambda>\<sigma>. i \<sigma> + 1) ;- tm_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + 2) ;- sqsum_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + sqsum \<sigma>)) ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
 2. \<lbrakk>\<not> 1 \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr> \<Turnstile> unit\<^sub>S\<^sub>E () ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
[PROOF STEP]
apply(tactic "dmatch_tac @{context} [@{thm \"non_exec_assign_globalD'_i\"}] 1",simp)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>1 \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr>) + 1\<rparr> \<Turnstile> tm_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + 2) ;- sqsum_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + sqsum \<sigma>) ;- _while_SE (\<lambda>\<sigma>. sqsum \<sigma> \<le> a) (i_update :==\<^sub>G (\<lambda>\<sigma>. i \<sigma> + 1) ;- tm_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + 2) ;- sqsum_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + sqsum \<sigma>)) ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
 2. \<lbrakk>\<not> 1 \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr> \<Turnstile> unit\<^sub>S\<^sub>E () ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
[PROOF STEP]
apply(tactic "dmatch_tac @{context} [@{thm \"non_exec_assign_globalD'_tm\"}] 1",simp)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>1 \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr>) + 1, tm := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr>) + 1\<rparr>) + 2\<rparr> \<Turnstile> sqsum_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + sqsum \<sigma>) ;- _while_SE (\<lambda>\<sigma>. sqsum \<sigma> \<le> a) (i_update :==\<^sub>G (\<lambda>\<sigma>. i \<sigma> + 1) ;- tm_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + 2) ;- sqsum_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + sqsum \<sigma>)) ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
 2. \<lbrakk>\<not> 1 \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr> \<Turnstile> unit\<^sub>S\<^sub>E () ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
[PROOF STEP]
apply(tactic "dmatch_tac @{context} [@{thm \"non_exec_assign_globalD'_sqsum\"}] 1",simp)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>1 \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr>) + 1, tm := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr>) + 1\<rparr>) + 2, sqsum := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr>) + 1, tm := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr>) + 1\<rparr>) + 2\<rparr>) + sqsum (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr>) + 1, tm := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr>) + 1\<rparr>) + 2\<rparr>)\<rparr> \<Turnstile> _while_SE (\<lambda>\<sigma>. sqsum \<sigma> \<le> a) (i_update :==\<^sub>G (\<lambda>\<sigma>. i \<sigma> + 1) ;- tm_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + 2) ;- sqsum_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + sqsum \<sigma>)) ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
 2. \<lbrakk>\<not> 1 \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr> \<Turnstile> unit\<^sub>S\<^sub>E () ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
[PROOF STEP]
apply(tactic "dmatch_tac @{context} [@{thm \"exec_whileD\"}] 1")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>1 \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr>) + 1, tm := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr>) + 1\<rparr>) + 2, sqsum := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr>) + 1, tm := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr>) + 1\<rparr>) + 2\<rparr>) + sqsum (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr>) + 1, tm := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr>) + 1\<rparr>) + 2\<rparr>)\<rparr> \<Turnstile> _if_SE (\<lambda>\<sigma>. sqsum \<sigma> \<le> a) ((i_update :==\<^sub>G (\<lambda>\<sigma>. i \<sigma> + 1) ;- tm_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + 2) ;- sqsum_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + sqsum \<sigma>)) ;- _while_SE (\<lambda>\<sigma>. sqsum \<sigma> \<le> a) (i_update :==\<^sub>G (\<lambda>\<sigma>. i \<sigma> + 1) ;- tm_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + 2) ;- sqsum_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + sqsum \<sigma>))) (unit\<^sub>S\<^sub>E ()) ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
 2. \<lbrakk>\<not> 1 \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr> \<Turnstile> unit\<^sub>S\<^sub>E () ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
[PROOF STEP]
apply(tactic "ematch_tac @{context} [@{thm \"if_SE_execE''\"}] 1")
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<lbrakk>1 \<le> a; sqsum (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr>) + 1, tm := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr>) + 1\<rparr>) + 2, sqsum := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr>) + 1, tm := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr>) + 1\<rparr>) + 2\<rparr>) + sqsum (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr>) + 1, tm := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr>) + 1\<rparr>) + 2\<rparr>)\<rparr>) \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr>) + 1, tm := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr>) + 1\<rparr>) + 2, sqsum := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr>) + 1, tm := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr>) + 1\<rparr>) + 2\<rparr>) + sqsum (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr>) + 1, tm := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr>) + 1\<rparr>) + 2\<rparr>)\<rparr> \<Turnstile> ((i_update :==\<^sub>G (\<lambda>\<sigma>. i \<sigma> + 1) ;- tm_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + 2) ;- sqsum_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + sqsum \<sigma>)) ;- _while_SE (\<lambda>\<sigma>. sqsum \<sigma> \<le> a) (i_update :==\<^sub>G (\<lambda>\<sigma>. i \<sigma> + 1) ;- tm_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + 2) ;- sqsum_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + sqsum \<sigma>))) ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
 2. \<lbrakk>1 \<le> a; \<not> sqsum (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr>) + 1, tm := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr>) + 1\<rparr>) + 2, sqsum := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr>) + 1, tm := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr>) + 1\<rparr>) + 2\<rparr>) + sqsum (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr>) + 1, tm := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr>) + 1\<rparr>) + 2\<rparr>)\<rparr>) \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr>) + 1, tm := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr>) + 1\<rparr>) + 2, sqsum := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr>) + 1, tm := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr>) + 1\<rparr>) + 2\<rparr>) + sqsum (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr>) + 1, tm := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr>) + 1\<rparr>) + 2\<rparr>)\<rparr> \<Turnstile> unit\<^sub>S\<^sub>E () ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
 3. \<lbrakk>\<not> 1 \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr> \<Turnstile> unit\<^sub>S\<^sub>E () ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
[PROOF STEP]
apply(simp_all only: memory_theory MonadSE.bind_assoc')
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<lbrakk>1 \<le> a; 1 + 2 + 1 \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1\<rparr> \<Turnstile> i_update :==\<^sub>G (\<lambda>\<sigma>. i \<sigma> + 1) ;- tm_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + 2) ;- sqsum_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + sqsum \<sigma>) ;- _while_SE (\<lambda>\<sigma>. sqsum \<sigma> \<le> a) (i_update :==\<^sub>G (\<lambda>\<sigma>. i \<sigma> + 1) ;- tm_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + 2) ;- sqsum_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + sqsum \<sigma>)) ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
 2. \<lbrakk>1 \<le> a; \<not> 1 + 2 + 1 \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1\<rparr> \<Turnstile> unit\<^sub>S\<^sub>E () ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
 3. \<lbrakk>\<not> 1 \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr> \<Turnstile> unit\<^sub>S\<^sub>E () ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
[PROOF STEP]
apply(tactic "dmatch_tac @{context} [@{thm \"non_exec_assign_globalD'_i\"}] 1",simp)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<lbrakk>1 \<le> a; 1 + 2 + 1 \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1\<rparr>) + 1\<rparr> \<Turnstile> tm_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + 2) ;- sqsum_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + sqsum \<sigma>) ;- _while_SE (\<lambda>\<sigma>. sqsum \<sigma> \<le> a) (i_update :==\<^sub>G (\<lambda>\<sigma>. i \<sigma> + 1) ;- tm_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + 2) ;- sqsum_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + sqsum \<sigma>)) ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
 2. \<lbrakk>1 \<le> a; \<not> 1 + 2 + 1 \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1\<rparr> \<Turnstile> unit\<^sub>S\<^sub>E () ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
 3. \<lbrakk>\<not> 1 \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr> \<Turnstile> unit\<^sub>S\<^sub>E () ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
[PROOF STEP]
apply(tactic "dmatch_tac @{context} [@{thm \"non_exec_assign_globalD'_tm\"}] 1",simp)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<lbrakk>1 \<le> a; 1 + 2 + 1 \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1\<rparr>) + 1, tm := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1\<rparr>) + 1\<rparr>) + 2\<rparr> \<Turnstile> sqsum_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + sqsum \<sigma>) ;- _while_SE (\<lambda>\<sigma>. sqsum \<sigma> \<le> a) (i_update :==\<^sub>G (\<lambda>\<sigma>. i \<sigma> + 1) ;- tm_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + 2) ;- sqsum_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + sqsum \<sigma>)) ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
 2. \<lbrakk>1 \<le> a; \<not> 1 + 2 + 1 \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1\<rparr> \<Turnstile> unit\<^sub>S\<^sub>E () ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
 3. \<lbrakk>\<not> 1 \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr> \<Turnstile> unit\<^sub>S\<^sub>E () ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
[PROOF STEP]
apply(tactic "dmatch_tac @{context} [@{thm \"non_exec_assign_globalD'_sqsum\"}] 1",simp)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<lbrakk>1 \<le> a; 1 + 2 + 1 \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1\<rparr>) + 1, tm := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1\<rparr>) + 1\<rparr>) + 2, sqsum := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1\<rparr>) + 1, tm := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1\<rparr>) + 1\<rparr>) + 2\<rparr>) + sqsum (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1\<rparr>) + 1, tm := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1\<rparr>) + 1\<rparr>) + 2\<rparr>)\<rparr> \<Turnstile> _while_SE (\<lambda>\<sigma>. sqsum \<sigma> \<le> a) (i_update :==\<^sub>G (\<lambda>\<sigma>. i \<sigma> + 1) ;- tm_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + 2) ;- sqsum_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + sqsum \<sigma>)) ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
 2. \<lbrakk>1 \<le> a; \<not> 1 + 2 + 1 \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1\<rparr> \<Turnstile> unit\<^sub>S\<^sub>E () ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
 3. \<lbrakk>\<not> 1 \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr> \<Turnstile> unit\<^sub>S\<^sub>E () ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
[PROOF STEP]
apply(tactic "dmatch_tac @{context} [@{thm \"exec_whileD\"}] 1")
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<lbrakk>1 \<le> a; 1 + 2 + 1 \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1\<rparr>) + 1, tm := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1\<rparr>) + 1\<rparr>) + 2, sqsum := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1\<rparr>) + 1, tm := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1\<rparr>) + 1\<rparr>) + 2\<rparr>) + sqsum (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1\<rparr>) + 1, tm := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1\<rparr>) + 1\<rparr>) + 2\<rparr>)\<rparr> \<Turnstile> _if_SE (\<lambda>\<sigma>. sqsum \<sigma> \<le> a) ((i_update :==\<^sub>G (\<lambda>\<sigma>. i \<sigma> + 1) ;- tm_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + 2) ;- sqsum_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + sqsum \<sigma>)) ;- _while_SE (\<lambda>\<sigma>. sqsum \<sigma> \<le> a) (i_update :==\<^sub>G (\<lambda>\<sigma>. i \<sigma> + 1) ;- tm_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + 2) ;- sqsum_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + sqsum \<sigma>))) (unit\<^sub>S\<^sub>E ()) ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
 2. \<lbrakk>1 \<le> a; \<not> 1 + 2 + 1 \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1\<rparr> \<Turnstile> unit\<^sub>S\<^sub>E () ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
 3. \<lbrakk>\<not> 1 \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr> \<Turnstile> unit\<^sub>S\<^sub>E () ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
[PROOF STEP]
apply(tactic "ematch_tac @{context} [@{thm \"if_SE_execE''\"}] 1")
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<lbrakk>1 \<le> a; 1 + 2 + 1 \<le> a; sqsum (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1\<rparr>) + 1, tm := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1\<rparr>) + 1\<rparr>) + 2, sqsum := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1\<rparr>) + 1, tm := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1\<rparr>) + 1\<rparr>) + 2\<rparr>) + sqsum (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1\<rparr>) + 1, tm := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1\<rparr>) + 1\<rparr>) + 2\<rparr>)\<rparr>) \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1\<rparr>) + 1, tm := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1\<rparr>) + 1\<rparr>) + 2, sqsum := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1\<rparr>) + 1, tm := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1\<rparr>) + 1\<rparr>) + 2\<rparr>) + sqsum (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1\<rparr>) + 1, tm := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1\<rparr>) + 1\<rparr>) + 2\<rparr>)\<rparr> \<Turnstile> ((i_update :==\<^sub>G (\<lambda>\<sigma>. i \<sigma> + 1) ;- tm_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + 2) ;- sqsum_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + sqsum \<sigma>)) ;- _while_SE (\<lambda>\<sigma>. sqsum \<sigma> \<le> a) (i_update :==\<^sub>G (\<lambda>\<sigma>. i \<sigma> + 1) ;- tm_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + 2) ;- sqsum_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + sqsum \<sigma>))) ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
 2. \<lbrakk>1 \<le> a; 1 + 2 + 1 \<le> a; \<not> sqsum (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1\<rparr>) + 1, tm := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1\<rparr>) + 1\<rparr>) + 2, sqsum := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1\<rparr>) + 1, tm := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1\<rparr>) + 1\<rparr>) + 2\<rparr>) + sqsum (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1\<rparr>) + 1, tm := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1\<rparr>) + 1\<rparr>) + 2\<rparr>)\<rparr>) \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1\<rparr>) + 1, tm := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1\<rparr>) + 1\<rparr>) + 2, sqsum := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1\<rparr>) + 1, tm := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1\<rparr>) + 1\<rparr>) + 2\<rparr>) + sqsum (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1\<rparr>) + 1, tm := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1\<rparr>) + 1\<rparr>) + 2\<rparr>)\<rparr> \<Turnstile> unit\<^sub>S\<^sub>E () ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
 3. \<lbrakk>1 \<le> a; \<not> 1 + 2 + 1 \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1\<rparr> \<Turnstile> unit\<^sub>S\<^sub>E () ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
 4. \<lbrakk>\<not> 1 \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr> \<Turnstile> unit\<^sub>S\<^sub>E () ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
[PROOF STEP]
apply(simp_all only: memory_theory MonadSE.bind_assoc')
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<lbrakk>1 \<le> a; 1 + 2 + 1 \<le> a; 1 + 2 + 2 + (1 + 2 + 1) \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := 0 + 1 + 1, tm := 1 + 2 + 2, sqsum := 1 + 2 + 2 + (1 + 2 + 1)\<rparr> \<Turnstile> i_update :==\<^sub>G (\<lambda>\<sigma>. i \<sigma> + 1) ;- tm_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + 2) ;- sqsum_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + sqsum \<sigma>) ;- _while_SE (\<lambda>\<sigma>. sqsum \<sigma> \<le> a) (i_update :==\<^sub>G (\<lambda>\<sigma>. i \<sigma> + 1) ;- tm_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + 2) ;- sqsum_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + sqsum \<sigma>)) ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
 2. \<lbrakk>1 \<le> a; 1 + 2 + 1 \<le> a; \<not> 1 + 2 + 2 + (1 + 2 + 1) \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := 0 + 1 + 1, tm := 1 + 2 + 2, sqsum := 1 + 2 + 2 + (1 + 2 + 1)\<rparr> \<Turnstile> unit\<^sub>S\<^sub>E () ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
 3. \<lbrakk>1 \<le> a; \<not> 1 + 2 + 1 \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1\<rparr> \<Turnstile> unit\<^sub>S\<^sub>E () ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
 4. \<lbrakk>\<not> 1 \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr> \<Turnstile> unit\<^sub>S\<^sub>E () ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
[PROOF STEP]
apply(tactic "dmatch_tac @{context} [@{thm \"non_exec_assign_globalD'_i\"}] 1",simp)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<lbrakk>1 \<le> a; 1 + 2 + 1 \<le> a; 1 + 2 + 2 + (1 + 2 + 1) \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := 0 + 1 + 1, tm := 1 + 2 + 2, sqsum := 1 + 2 + 2 + (1 + 2 + 1), i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := 0 + 1 + 1, tm := 1 + 2 + 2, sqsum := 1 + 2 + 2 + (1 + 2 + 1)\<rparr>) + 1\<rparr> \<Turnstile> tm_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + 2) ;- sqsum_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + sqsum \<sigma>) ;- _while_SE (\<lambda>\<sigma>. sqsum \<sigma> \<le> a) (i_update :==\<^sub>G (\<lambda>\<sigma>. i \<sigma> + 1) ;- tm_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + 2) ;- sqsum_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + sqsum \<sigma>)) ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
 2. \<lbrakk>1 \<le> a; 1 + 2 + 1 \<le> a; \<not> 1 + 2 + 2 + (1 + 2 + 1) \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := 0 + 1 + 1, tm := 1 + 2 + 2, sqsum := 1 + 2 + 2 + (1 + 2 + 1)\<rparr> \<Turnstile> unit\<^sub>S\<^sub>E () ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
 3. \<lbrakk>1 \<le> a; \<not> 1 + 2 + 1 \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1\<rparr> \<Turnstile> unit\<^sub>S\<^sub>E () ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
 4. \<lbrakk>\<not> 1 \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr> \<Turnstile> unit\<^sub>S\<^sub>E () ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
[PROOF STEP]
apply(tactic "dmatch_tac @{context} [@{thm \"non_exec_assign_globalD'_tm\"}] 1",simp)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<lbrakk>1 \<le> a; 1 + 2 + 1 \<le> a; 1 + 2 + 2 + (1 + 2 + 1) \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := 0 + 1 + 1, tm := 1 + 2 + 2, sqsum := 1 + 2 + 2 + (1 + 2 + 1), i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := 0 + 1 + 1, tm := 1 + 2 + 2, sqsum := 1 + 2 + 2 + (1 + 2 + 1)\<rparr>) + 1, tm := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := 0 + 1 + 1, tm := 1 + 2 + 2, sqsum := 1 + 2 + 2 + (1 + 2 + 1), i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := 0 + 1 + 1, tm := 1 + 2 + 2, sqsum := 1 + 2 + 2 + (1 + 2 + 1)\<rparr>) + 1\<rparr>) + 2\<rparr> \<Turnstile> sqsum_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + sqsum \<sigma>) ;- _while_SE (\<lambda>\<sigma>. sqsum \<sigma> \<le> a) (i_update :==\<^sub>G (\<lambda>\<sigma>. i \<sigma> + 1) ;- tm_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + 2) ;- sqsum_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + sqsum \<sigma>)) ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
 2. \<lbrakk>1 \<le> a; 1 + 2 + 1 \<le> a; \<not> 1 + 2 + 2 + (1 + 2 + 1) \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := 0 + 1 + 1, tm := 1 + 2 + 2, sqsum := 1 + 2 + 2 + (1 + 2 + 1)\<rparr> \<Turnstile> unit\<^sub>S\<^sub>E () ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
 3. \<lbrakk>1 \<le> a; \<not> 1 + 2 + 1 \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1\<rparr> \<Turnstile> unit\<^sub>S\<^sub>E () ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
 4. \<lbrakk>\<not> 1 \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr> \<Turnstile> unit\<^sub>S\<^sub>E () ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
[PROOF STEP]
apply(tactic "dmatch_tac @{context} [@{thm \"non_exec_assign_globalD'_sqsum\"}] 1",simp)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<lbrakk>1 \<le> a; 1 + 2 + 1 \<le> a; 1 + 2 + 2 + (1 + 2 + 1) \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := 0 + 1 + 1, tm := 1 + 2 + 2, sqsum := 1 + 2 + 2 + (1 + 2 + 1), i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := 0 + 1 + 1, tm := 1 + 2 + 2, sqsum := 1 + 2 + 2 + (1 + 2 + 1)\<rparr>) + 1, tm := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := 0 + 1 + 1, tm := 1 + 2 + 2, sqsum := 1 + 2 + 2 + (1 + 2 + 1), i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := 0 + 1 + 1, tm := 1 + 2 + 2, sqsum := 1 + 2 + 2 + (1 + 2 + 1)\<rparr>) + 1\<rparr>) + 2, sqsum := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := 0 + 1 + 1, tm := 1 + 2 + 2, sqsum := 1 + 2 + 2 + (1 + 2 + 1), i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := 0 + 1 + 1, tm := 1 + 2 + 2, sqsum := 1 + 2 + 2 + (1 + 2 + 1)\<rparr>) + 1, tm := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := 0 + 1 + 1, tm := 1 + 2 + 2, sqsum := 1 + 2 + 2 + (1 + 2 + 1), i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := 0 + 1 + 1, tm := 1 + 2 + 2, sqsum := 1 + 2 + 2 + (1 + 2 + 1)\<rparr>) + 1\<rparr>) + 2\<rparr>) + sqsum (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := 0 + 1 + 1, tm := 1 + 2 + 2, sqsum := 1 + 2 + 2 + (1 + 2 + 1), i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := 0 + 1 + 1, tm := 1 + 2 + 2, sqsum := 1 + 2 + 2 + (1 + 2 + 1)\<rparr>) + 1, tm := tm (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := 0 + 1 + 1, tm := 1 + 2 + 2, sqsum := 1 + 2 + 2 + (1 + 2 + 1), i := i (\<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := 0 + 1 + 1, tm := 1 + 2 + 2, sqsum := 1 + 2 + 2 + (1 + 2 + 1)\<rparr>) + 1\<rparr>) + 2\<rparr>)\<rparr> \<Turnstile> _while_SE (\<lambda>\<sigma>. sqsum \<sigma> \<le> a) (i_update :==\<^sub>G (\<lambda>\<sigma>. i \<sigma> + 1) ;- tm_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + 2) ;- sqsum_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + sqsum \<sigma>)) ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
 2. \<lbrakk>1 \<le> a; 1 + 2 + 1 \<le> a; \<not> 1 + 2 + 2 + (1 + 2 + 1) \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1, i := 0 + 1 + 1, tm := 1 + 2 + 2, sqsum := 1 + 2 + 2 + (1 + 2 + 1)\<rparr> \<Turnstile> unit\<^sub>S\<^sub>E () ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
 3. \<lbrakk>1 \<le> a; \<not> 1 + 2 + 1 \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0, i := 0 + 1, tm := 1 + 2, sqsum := 1 + 2 + 1\<rparr> \<Turnstile> unit\<^sub>S\<^sub>E () ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
 4. \<lbrakk>\<not> 1 \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr> \<Turnstile> unit\<^sub>S\<^sub>E () ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
[PROOF STEP]
apply(simp_all)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<lbrakk>9 \<le> a; \<sigma>\<^sub>0\<lparr>i := 3, tm := 7, sqsum := 16\<rparr> \<Turnstile> _while_SE (\<lambda>\<sigma>. sqsum \<sigma> \<le> a) (i_update :==\<^sub>G (\<lambda>\<sigma>. i \<sigma> + 1) ;- tm_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + 2) ;- sqsum_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + sqsum \<sigma>)) ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
 2. \<lbrakk>4 \<le> a; \<not> 9 \<le> a; \<sigma>\<^sub>0\<lparr>i := 2, tm := 5, sqsum := 9\<rparr> \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
 3. \<lbrakk>1 \<le> a; \<not> 4 \<le> a; \<sigma>\<^sub>0\<lparr>i := 1, tm := 3, sqsum := 4\<rparr> \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
 4. \<lbrakk>\<not> 1 \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr> \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
[PROOF STEP]
text\<open>Here are all abstract test-cases explicit. Each subgoal correstponds to
       a path taken through the loop.\<close>
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<lbrakk>9 \<le> a; \<sigma>\<^sub>0\<lparr>i := 3, tm := 7, sqsum := 16\<rparr> \<Turnstile> _while_SE (\<lambda>\<sigma>. sqsum \<sigma> \<le> a) (i_update :==\<^sub>G (\<lambda>\<sigma>. i \<sigma> + 1) ;- tm_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + 2) ;- sqsum_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + sqsum \<sigma>)) ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
 2. \<lbrakk>4 \<le> a; \<not> 9 \<le> a; \<sigma>\<^sub>0\<lparr>i := 2, tm := 5, sqsum := 9\<rparr> \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
 3. \<lbrakk>1 \<le> a; \<not> 4 \<le> a; \<sigma>\<^sub>0\<lparr>i := 1, tm := 3, sqsum := 4\<rparr> \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
 4. \<lbrakk>\<not> 1 \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr> \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
[PROOF STEP]
txt\<open>push away the test-hyp: postcond is true for programs with more than
    three loop traversals (criterion: all-paths(k). This reveals explicitly
    the three test-cases for  @{term "k<3"}. \<close>
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<lbrakk>9 \<le> a; \<sigma>\<^sub>0\<lparr>i := 3, tm := 7, sqsum := 16\<rparr> \<Turnstile> _while_SE (\<lambda>\<sigma>. sqsum \<sigma> \<le> a) (i_update :==\<^sub>G (\<lambda>\<sigma>. i \<sigma> + 1) ;- tm_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + 2) ;- sqsum_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + sqsum \<sigma>)) ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
 2. \<lbrakk>4 \<le> a; \<not> 9 \<le> a; \<sigma>\<^sub>0\<lparr>i := 2, tm := 5, sqsum := 9\<rparr> \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
 3. \<lbrakk>1 \<le> a; \<not> 4 \<le> a; \<sigma>\<^sub>0\<lparr>i := 1, tm := 3, sqsum := 4\<rparr> \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
 4. \<lbrakk>\<not> 1 \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr> \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
[PROOF STEP]
defer 1
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<lbrakk>4 \<le> a; \<not> 9 \<le> a; \<sigma>\<^sub>0\<lparr>i := 2, tm := 5, sqsum := 9\<rparr> \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
 2. \<lbrakk>1 \<le> a; \<not> 4 \<le> a; \<sigma>\<^sub>0\<lparr>i := 1, tm := 3, sqsum := 4\<rparr> \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
 3. \<lbrakk>\<not> 1 \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr> \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
 4. \<lbrakk>9 \<le> a; \<sigma>\<^sub>0\<lparr>i := 3, tm := 7, sqsum := 16\<rparr> \<Turnstile> _while_SE (\<lambda>\<sigma>. sqsum \<sigma> \<le> a) (i_update :==\<^sub>G (\<lambda>\<sigma>. i \<sigma> + 1) ;- tm_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + 2) ;- sqsum_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + sqsum \<sigma>)) ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
[PROOF STEP]
(*
txt\<open>Instead of testing, we @{emph \<open>prove\<close>} that the test cases satisfy the
    post-condition for all @{term "k<3"} loop traversals and @{emph \<open>all\<close>}
    positive inputs @{term "a "}.\<close>
   apply(auto  simp: assert_simp)
 *)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<lbrakk>4 \<le> a; \<not> 9 \<le> a; \<sigma>\<^sub>0\<lparr>i := 2, tm := 5, sqsum := 9\<rparr> \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
 2. \<lbrakk>1 \<le> a; \<not> 4 \<le> a; \<sigma>\<^sub>0\<lparr>i := 1, tm := 3, sqsum := 4\<rparr> \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
 3. \<lbrakk>\<not> 1 \<le> a; \<sigma>\<^sub>0\<lparr>tm := 1, sqsum := 1, i := 0\<rparr> \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
 4. \<lbrakk>9 \<le> a; \<sigma>\<^sub>0\<lparr>i := 3, tm := 7, sqsum := 16\<rparr> \<Turnstile> _while_SE (\<lambda>\<sigma>. sqsum \<sigma> \<le> a) (i_update :==\<^sub>G (\<lambda>\<sigma>. i \<sigma> + 1) ;- tm_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + 2) ;- sqsum_update :==\<^sub>G (\<lambda>\<sigma>. tm \<sigma> + sqsum \<sigma>)) ;- assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. \<sigma> = \<sigma>\<^sub>R)\<rbrakk> \<Longrightarrow> \<sigma>\<^sub>R \<Turnstile> assert\<^sub>S\<^sub>E (\<lambda>\<sigma>. (i \<sigma>)\<^sup>2 \<le> a \<and> a < (i \<sigma> + 1)\<^sup>2)
[PROOF STEP]
oops


[STATEMENT]
lemma algebraic_int_nth_root_real_iff:
  "algebraic_int (root n x) \<longleftrightarrow> n = 0 \<or> algebraic_int x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. algebraic_int (root n x) = (n = 0 \<or> algebraic_int x)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. algebraic_int (root n x) = (n = 0 \<or> algebraic_int x)
[PROOF STEP]
have "algebraic_int x" if "algebraic_int (root n x)" "n \<noteq> 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. algebraic_int x
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. algebraic_int x
[PROOF STEP]
from that(1)
[PROOF STATE]
proof (chain)
picking this:
algebraic_int (root n x)
[PROOF STEP]
have "algebraic_int (root n x ^ n)"
[PROOF STATE]
proof (prove)
using this:
algebraic_int (root n x)

goal (1 subgoal):
 1. algebraic_int (root n x ^ n)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
algebraic_int (root n x ^ n)

goal (1 subgoal):
 1. algebraic_int x
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
algebraic_int (root n x ^ n)

goal (1 subgoal):
 1. algebraic_int x
[PROOF STEP]
have "root n x ^ n = (if even n then \<bar>x\<bar> else x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. root n x ^ n = (if even n then \<bar>x\<bar> else x)
[PROOF STEP]
using sgn_power_root[of n x] that(2)
[PROOF STATE]
proof (prove)
using this:
0 < n \<Longrightarrow> sgn (root n x) * \<bar>root n x\<bar> ^ n = x
n \<noteq> 0

goal (1 subgoal):
 1. root n x ^ n = (if even n then \<bar>x\<bar> else x)
[PROOF STEP]
by (auto simp: sgn_if split: if_splits)
[PROOF STATE]
proof (state)
this:
root n x ^ n = (if even n then \<bar>x\<bar> else x)

goal (1 subgoal):
 1. algebraic_int x
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
algebraic_int (if even n then \<bar>x\<bar> else x)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
algebraic_int (if even n then \<bar>x\<bar> else x)

goal (1 subgoal):
 1. algebraic_int x
[PROOF STEP]
by (auto split: if_splits)
[PROOF STATE]
proof (state)
this:
algebraic_int x

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>algebraic_int (root n x); n \<noteq> 0\<rbrakk> \<Longrightarrow> algebraic_int x

goal (1 subgoal):
 1. algebraic_int (root n x) = (n = 0 \<or> algebraic_int x)
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>algebraic_int (root n x); n \<noteq> 0\<rbrakk> \<Longrightarrow> algebraic_int x

goal (1 subgoal):
 1. algebraic_int (root n x) = (n = 0 \<or> algebraic_int x)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
algebraic_int (root n x) = (n = 0 \<or> algebraic_int x)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma cbox_point_def:
  fixes p\<^sub>0 :: "('k::finite) point"
  shows "cbox p\<^sub>0 p\<^sub>1 = { p. \<forall>k. p\<^sub>0$k \<le> p$k \<and> p$k \<le> p\<^sub>1$k }"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. cbox p\<^sub>0 p\<^sub>1 = {p. \<forall>k. p\<^sub>0 $ k \<le> p $ k \<and> p $ k \<le> p\<^sub>1 $ k}
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. cbox p\<^sub>0 p\<^sub>1 = {p. \<forall>k. p\<^sub>0 $ k \<le> p $ k \<and> p $ k \<le> p\<^sub>1 $ k}
[PROOF STEP]
have "cbox p\<^sub>0 p\<^sub>1 = { p. \<forall>k. p\<^sub>0 \<bullet> axis k 1 \<le> p \<bullet> axis k 1 \<and> p \<bullet> axis k 1 \<le> p\<^sub>1 \<bullet> axis k 1 }"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. cbox p\<^sub>0 p\<^sub>1 = {p. \<forall>k. p\<^sub>0 \<bullet> axis k 1 \<le> p \<bullet> axis k 1 \<and> p \<bullet> axis k 1 \<le> p\<^sub>1 \<bullet> axis k 1}
[PROOF STEP]
unfolding cbox_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {x. \<forall>i\<in>Basis. p\<^sub>0 \<bullet> i \<le> x \<bullet> i \<and> x \<bullet> i \<le> p\<^sub>1 \<bullet> i} = {p. \<forall>k. p\<^sub>0 \<bullet> axis k 1 \<le> p \<bullet> axis k 1 \<and> p \<bullet> axis k 1 \<le> p\<^sub>1 \<bullet> axis k 1}
[PROOF STEP]
using axis_inverse
[PROOF STATE]
proof (prove)
using this:
?v \<in> Basis \<Longrightarrow> \<exists>i. ?v = axis i 1

goal (1 subgoal):
 1. {x. \<forall>i\<in>Basis. p\<^sub>0 \<bullet> i \<le> x \<bullet> i \<and> x \<bullet> i \<le> p\<^sub>1 \<bullet> i} = {p. \<forall>k. p\<^sub>0 \<bullet> axis k 1 \<le> p \<bullet> axis k 1 \<and> p \<bullet> axis k 1 \<le> p\<^sub>1 \<bullet> axis k 1}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
cbox p\<^sub>0 p\<^sub>1 = {p. \<forall>k. p\<^sub>0 \<bullet> axis k 1 \<le> p \<bullet> axis k 1 \<and> p \<bullet> axis k 1 \<le> p\<^sub>1 \<bullet> axis k 1}

goal (1 subgoal):
 1. cbox p\<^sub>0 p\<^sub>1 = {p. \<forall>k. p\<^sub>0 $ k \<le> p $ k \<and> p $ k \<le> p\<^sub>1 $ k}
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
cbox p\<^sub>0 p\<^sub>1 = {p. \<forall>k. p\<^sub>0 \<bullet> axis k 1 \<le> p \<bullet> axis k 1 \<and> p \<bullet> axis k 1 \<le> p\<^sub>1 \<bullet> axis k 1}

goal (1 subgoal):
 1. cbox p\<^sub>0 p\<^sub>1 = {p. \<forall>k. p\<^sub>0 $ k \<le> p $ k \<and> p $ k \<le> p\<^sub>1 $ k}
[PROOF STEP]
have "... = { p. \<forall>k. p\<^sub>0$k \<bullet> 1 \<le> p$k \<bullet> 1 \<and> p$k \<bullet> 1 \<le> p\<^sub>1$k \<bullet> 1 }"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {p. \<forall>k. p\<^sub>0 \<bullet> axis k 1 \<le> p \<bullet> axis k 1 \<and> p \<bullet> axis k 1 \<le> p\<^sub>1 \<bullet> axis k 1} = {p. \<forall>k. p\<^sub>0 $ k \<bullet> 1 \<le> p $ k \<bullet> 1 \<and> p $ k \<bullet> 1 \<le> p\<^sub>1 $ k \<bullet> 1}
[PROOF STEP]
using inner_axis[of _ _ 1]
[PROOF STATE]
proof (prove)
using this:
?x \<bullet> axis ?i (1::?'a1) = ?x $ ?i \<bullet> (1::?'a1)

goal (1 subgoal):
 1. {p. \<forall>k. p\<^sub>0 \<bullet> axis k 1 \<le> p \<bullet> axis k 1 \<and> p \<bullet> axis k 1 \<le> p\<^sub>1 \<bullet> axis k 1} = {p. \<forall>k. p\<^sub>0 $ k \<bullet> 1 \<le> p $ k \<bullet> 1 \<and> p $ k \<bullet> 1 \<le> p\<^sub>1 $ k \<bullet> 1}
[PROOF STEP]
by (smt Collect_cong)
[PROOF STATE]
proof (state)
this:
{p. \<forall>k. p\<^sub>0 \<bullet> axis k 1 \<le> p \<bullet> axis k 1 \<and> p \<bullet> axis k 1 \<le> p\<^sub>1 \<bullet> axis k 1} = {p. \<forall>k. p\<^sub>0 $ k \<bullet> 1 \<le> p $ k \<bullet> 1 \<and> p $ k \<bullet> 1 \<le> p\<^sub>1 $ k \<bullet> 1}

goal (1 subgoal):
 1. cbox p\<^sub>0 p\<^sub>1 = {p. \<forall>k. p\<^sub>0 $ k \<le> p $ k \<and> p $ k \<le> p\<^sub>1 $ k}
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
{p. \<forall>k. p\<^sub>0 \<bullet> axis k 1 \<le> p \<bullet> axis k 1 \<and> p \<bullet> axis k 1 \<le> p\<^sub>1 \<bullet> axis k 1} = {p. \<forall>k. p\<^sub>0 $ k \<bullet> 1 \<le> p $ k \<bullet> 1 \<and> p $ k \<bullet> 1 \<le> p\<^sub>1 $ k \<bullet> 1}

goal (1 subgoal):
 1. cbox p\<^sub>0 p\<^sub>1 = {p. \<forall>k. p\<^sub>0 $ k \<le> p $ k \<and> p $ k \<le> p\<^sub>1 $ k}
[PROOF STEP]
have "... = { p. \<forall>k. p\<^sub>0$k \<le> p$k \<and> p$k \<le> p\<^sub>1$k }"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {p. \<forall>k. p\<^sub>0 $ k \<bullet> 1 \<le> p $ k \<bullet> 1 \<and> p $ k \<bullet> 1 \<le> p\<^sub>1 $ k \<bullet> 1} = {p. \<forall>k. p\<^sub>0 $ k \<le> p $ k \<and> p $ k \<le> p\<^sub>1 $ k}
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
{p. \<forall>k. p\<^sub>0 $ k \<bullet> 1 \<le> p $ k \<bullet> 1 \<and> p $ k \<bullet> 1 \<le> p\<^sub>1 $ k \<bullet> 1} = {p. \<forall>k. p\<^sub>0 $ k \<le> p $ k \<and> p $ k \<le> p\<^sub>1 $ k}

goal (1 subgoal):
 1. cbox p\<^sub>0 p\<^sub>1 = {p. \<forall>k. p\<^sub>0 $ k \<le> p $ k \<and> p $ k \<le> p\<^sub>1 $ k}
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
cbox p\<^sub>0 p\<^sub>1 = {p. \<forall>k. p\<^sub>0 $ k \<le> p $ k \<and> p $ k \<le> p\<^sub>1 $ k}
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
cbox p\<^sub>0 p\<^sub>1 = {p. \<forall>k. p\<^sub>0 $ k \<le> p $ k \<and> p $ k \<le> p\<^sub>1 $ k}

goal (1 subgoal):
 1. cbox p\<^sub>0 p\<^sub>1 = {p. \<forall>k. p\<^sub>0 $ k \<le> p $ k \<and> p $ k \<le> p\<^sub>1 $ k}
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
cbox p\<^sub>0 p\<^sub>1 = {p. \<forall>k. p\<^sub>0 $ k \<le> p $ k \<and> p $ k \<le> p\<^sub>1 $ k}

goal:
No subgoals!
[PROOF STEP]
qed