[STATEMENT]
lemma (in group) trivial_group: "trivial_group G \<longleftrightarrow> (\<exists>a. carrier G = {a})"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. trivial_group G = (\<exists>a. carrier G = {a})
[PROOF STEP]
unfolding trivial_group_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (Group.group G \<and> carrier G = {\<one>}) = (\<exists>a. carrier G = {a})
[PROOF STEP]
using one_closed is_group
[PROOF STATE]
proof (prove)
using this:
\<one> \<in> carrier G
Group.group G

goal (1 subgoal):
 1. (Group.group G \<and> carrier G = {\<one>}) = (\<exists>a. carrier G = {a})
[PROOF STEP]
by fastforce


[STATEMENT]
lemma (in module) lincomb_cong:
  assumes h2: "A=B" and h3: "A \<subseteq> carrier M"
    and h4: "\<And>v. v\<in>A \<Longrightarrow> a v = b v" and h5: "b\<in> B\<rightarrow>carrier R"
  shows "lincomb a A = lincomb b B"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. lincomb a A = lincomb b B
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
A = B
A \<subseteq> carrier M
?v \<in> A \<Longrightarrow> a ?v = b ?v
b \<in> B \<rightarrow> carrier R

goal (1 subgoal):
 1. lincomb a A = lincomb b B
[PROOF STEP]
by (simp cong: finsum_cong2 add: lincomb_def summands_valid ring_subset_carrier)


[STATEMENT]
lemma approx_HComplex:
  "\<lbrakk>a \<approx> b; c \<approx> d\<rbrakk> \<Longrightarrow> HComplex a c \<approx> HComplex b d"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>a \<approx> b; c \<approx> d\<rbrakk> \<Longrightarrow> HComplex a c \<approx> HComplex b d
[PROOF STEP]
unfolding approx_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>a - b \<in> Infinitesimal; c - d \<in> Infinitesimal\<rbrakk> \<Longrightarrow> HComplex a c - HComplex b d \<in> Infinitesimal
[PROOF STEP]
by (simp add: Infinitesimal_HComplex)


[STATEMENT]
lemma step_pop_size_new_big [simp]: "\<lbrakk>
  invar (States dir big small);
  0 < size big; Big.pop big = (x, bigP);
  step (States dir bigP small) = States dir' big' small'
\<rbrakk> \<Longrightarrow> Suc (size_new big') = size_new big"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invar (States dir big small); 0 < size big; Big.pop big = (x, bigP); step (States dir bigP small) = States dir' big' small'\<rbrakk> \<Longrightarrow> Suc (size_new big') = size_new big
[PROOF STEP]
using
    invar_pop_big[of dir big small x bigP]
    Big_Proof.size_size_new[of big]
    step_size_new_big[of dir bigP small dir' big' small']
    Big_Proof.size_new_pop[of big x bigP]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>invar (States dir big small); 0 < size big; Big.pop big = (x, bigP)\<rbrakk> \<Longrightarrow> invar (States dir bigP small)
\<lbrakk>invar big; 0 < size big\<rbrakk> \<Longrightarrow> 0 < size_new big
\<lbrakk>invar (States dir bigP small); step (States dir bigP small) = States dir' big' small'\<rbrakk> \<Longrightarrow> size_new big' = size_new bigP
\<lbrakk>invar big; 0 < size_new big; Big.pop big = (x, bigP)\<rbrakk> \<Longrightarrow> Suc (size_new bigP) = size_new big

goal (1 subgoal):
 1. \<lbrakk>invar (States dir big small); 0 < size big; Big.pop big = (x, bigP); step (States dir bigP small) = States dir' big' small'\<rbrakk> \<Longrightarrow> Suc (size_new big') = size_new big
[PROOF STEP]
by simp


[STATEMENT]
lemma bounded_apply_bfun':
  assumes "bounded ((F :: 'c \<Rightarrow> 'd \<Rightarrow>\<^sub>b 'b::real_normed_vector) ` S)"
  shows "bounded ((\<lambda>b. (F b) x) ` S)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. bounded ((\<lambda>b. apply_bfun (F b) x) ` S)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. bounded ((\<lambda>b. apply_bfun (F b) x) ` S)
[PROOF STEP]
obtain b where "\<forall>x\<in>S. norm (F x) \<le> b"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>b. \<forall>x\<in>S. norm (F x) \<le> b \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (meson assms bounded_pos image_eqI)
[PROOF STATE]
proof (state)
this:
\<forall>x\<in>S. norm (F x) \<le> b

goal (1 subgoal):
 1. bounded ((\<lambda>b. apply_bfun (F b) x) ` S)
[PROOF STEP]
thus "bounded ((\<lambda>b. (F b) x) ` S)"
[PROOF STATE]
proof (prove)
using this:
\<forall>x\<in>S. norm (F x) \<le> b

goal (1 subgoal):
 1. bounded ((\<lambda>b. apply_bfun (F b) x) ` S)
[PROOF STEP]
by (fastforce intro: norm_le_norm_bfun dual_order.trans boundedI[of _ b])
[PROOF STATE]
proof (state)
this:
bounded ((\<lambda>b. apply_bfun (F b) x) ` S)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma variation_0[simp]: "variation 0 y=0" "variation x 0=0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. variation 0 y = 0 &&& variation x 0 = 0
[PROOF STEP]
unfolding variation_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (if 0 \<le> 0 * y then 0 else if 0 < y then 1 else - 1) = 0 &&& (if 0 \<le> x * 0 then 0 else if x < 0 then 1 else - 1) = 0
[PROOF STEP]
by auto


[STATEMENT]
lemma cf_bcomp_Hom_ObjMap_vdomain[cat_cs_simps]:
  assumes "\<FF> : \<AA> \<mapsto>\<mapsto>\<^sub>C\<^bsub>\<alpha>\<^esub> \<CC>" and "\<GG> : \<BB> \<mapsto>\<mapsto>\<^sub>C\<^bsub>\<alpha>\<^esub> \<CC>"
  shows "\<D>\<^sub>\<circ> (Hom\<^sub>O\<^sub>.\<^sub>C\<^bsub>\<alpha>\<^esub>\<CC>(\<FF>-,\<GG>-)\<lparr>ObjMap\<rparr>) = (op_cat \<AA> \<times>\<^sub>C \<BB>)\<lparr>Obj\<rparr>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<D>\<^sub>\<circ> (Hom\<^sub>O\<^sub>.\<^sub>C\<^bsub>\<alpha>\<^esub>\<CC>(\<FF>-,\<GG>-)\<lparr>ObjMap\<rparr>) = (op_cat \<AA> \<times>\<^sub>C \<BB>)\<lparr>Obj\<rparr>
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
\<FF> : \<AA> \<mapsto>\<mapsto>\<^sub>C\<^bsub>\<alpha>\<^esub> \<CC>
\<GG> : \<BB> \<mapsto>\<mapsto>\<^sub>C\<^bsub>\<alpha>\<^esub> \<CC>

goal (1 subgoal):
 1. \<D>\<^sub>\<circ> (Hom\<^sub>O\<^sub>.\<^sub>C\<^bsub>\<alpha>\<^esub>\<CC>(\<FF>-,\<GG>-)\<lparr>ObjMap\<rparr>) = (op_cat \<AA> \<times>\<^sub>C \<BB>)\<lparr>Obj\<rparr>
[PROOF STEP]
unfolding cf_bcomp_Hom_def
[PROOF STATE]
proof (prove)
using this:
\<FF> : \<AA> \<mapsto>\<mapsto>\<^sub>C\<^bsub>\<alpha>\<^esub> \<CC>
\<GG> : \<BB> \<mapsto>\<mapsto>\<^sub>C\<^bsub>\<alpha>\<^esub> \<CC>

goal (1 subgoal):
 1. \<D>\<^sub>\<circ> (cf_cn_cov_bcomp Hom\<^sub>O\<^sub>.\<^sub>C\<^bsub>\<alpha>\<^esub>\<CC>(-,-) \<FF> \<GG>\<lparr>ObjMap\<rparr>) = (op_cat \<AA> \<times>\<^sub>C \<BB>)\<lparr>Obj\<rparr>
[PROOF STEP]
by (rule cf_cn_cov_bcomp_ObjMap_vdomain)


[STATEMENT]
lemma rev_zip: "length xs = length ys \<Longrightarrow> rev (zip xs ys) = zip (rev xs) (rev ys)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. length xs = length ys \<Longrightarrow> rev (zip xs ys) = zip (rev xs) (rev ys)
[PROOF STEP]
by (induct xs ys rule: list_induct2) auto


[STATEMENT]
lemma norm_mult_numeral1 [simp]: "norm (numeral w * a) = numeral w * norm a"
  for a b :: "'a::{real_normed_field,field}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. norm (numeral w * a) = numeral w * norm a
[PROOF STEP]
by (simp add: norm_mult)


[STATEMENT]
theorem is_pole_hurwitz_zeta:
  assumes "a > 0"
  shows   "is_pole (hurwitz_zeta a) 1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. is_pole (hurwitz_zeta a) 1
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. is_pole (hurwitz_zeta a) 1
[PROOF STEP]
from assms
[PROOF STATE]
proof (chain)
picking this:
0 < a
[PROOF STEP]
have "continuous_on UNIV (pre_zeta a)"
[PROOF STATE]
proof (prove)
using this:
0 < a

goal (1 subgoal):
 1. continuous_on UNIV (pre_zeta a)
[PROOF STEP]
by (intro holomorphic_on_imp_continuous_on analytic_imp_holomorphic analytic_pre_zeta)
[PROOF STATE]
proof (state)
this:
continuous_on UNIV (pre_zeta a)

goal (1 subgoal):
 1. is_pole (hurwitz_zeta a) 1
[PROOF STEP]
hence "isCont (pre_zeta a) 1"
[PROOF STATE]
proof (prove)
using this:
continuous_on UNIV (pre_zeta a)

goal (1 subgoal):
 1. isCont (pre_zeta a) 1
[PROOF STEP]
by (auto simp: continuous_on_eq_continuous_at)
[PROOF STATE]
proof (state)
this:
isCont (pre_zeta a) 1

goal (1 subgoal):
 1. is_pole (hurwitz_zeta a) 1
[PROOF STEP]
hence *: "pre_zeta a \<midarrow>1\<rightarrow> pre_zeta a 1"
[PROOF STATE]
proof (prove)
using this:
isCont (pre_zeta a) 1

goal (1 subgoal):
 1. pre_zeta a \<midarrow>1\<rightarrow> pre_zeta a 1
[PROOF STEP]
by (simp add: isCont_def)
[PROOF STATE]
proof (state)
this:
pre_zeta a \<midarrow>1\<rightarrow> pre_zeta a 1

goal (1 subgoal):
 1. is_pole (hurwitz_zeta a) 1
[PROOF STEP]
from assms
[PROOF STATE]
proof (chain)
picking this:
0 < a
[PROOF STEP]
have "isCont (\<lambda>s. complex_of_real a powr (1 - s)) 1"
[PROOF STATE]
proof (prove)
using this:
0 < a

goal (1 subgoal):
 1. isCont (\<lambda>s. complex_of_real a powr (1 - s)) 1
[PROOF STEP]
by (intro isCont_powr_complex) auto
[PROOF STATE]
proof (state)
this:
isCont (\<lambda>s. complex_of_real a powr (1 - s)) 1

goal (1 subgoal):
 1. is_pole (hurwitz_zeta a) 1
[PROOF STEP]
with assms
[PROOF STATE]
proof (chain)
picking this:
0 < a
isCont (\<lambda>s. complex_of_real a powr (1 - s)) 1
[PROOF STEP]
have **: "(\<lambda>s. complex_of_real a powr (1 - s)) \<midarrow>1\<rightarrow> 1"
[PROOF STATE]
proof (prove)
using this:
0 < a
isCont (\<lambda>s. complex_of_real a powr (1 - s)) 1

goal (1 subgoal):
 1. (\<lambda>s. complex_of_real a powr (1 - s)) \<midarrow>1\<rightarrow> 1
[PROOF STEP]
by (simp add: isCont_def)
[PROOF STATE]
proof (state)
this:
(\<lambda>s. complex_of_real a powr (1 - s)) \<midarrow>1\<rightarrow> 1

goal (1 subgoal):
 1. is_pole (hurwitz_zeta a) 1
[PROOF STEP]
have "(\<lambda>s::complex. s - 1) \<midarrow>1\<rightarrow> 1 - 1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lambda>s. s - 1) \<midarrow>1\<rightarrow> 1 - 1
[PROOF STEP]
by (intro tendsto_intros)
[PROOF STATE]
proof (state)
this:
(\<lambda>s. s - 1) \<midarrow>1\<rightarrow> 1 - 1

goal (1 subgoal):
 1. is_pole (hurwitz_zeta a) 1
[PROOF STEP]
hence "filterlim (\<lambda>s::complex. s - 1) (at 0) (at 1)"
[PROOF STATE]
proof (prove)
using this:
(\<lambda>s. s - 1) \<midarrow>1\<rightarrow> 1 - 1

goal (1 subgoal):
 1. LIM s at 1. s - 1 :> at 0
[PROOF STEP]
by (auto simp: filterlim_at eventually_at_filter)
[PROOF STATE]
proof (state)
this:
LIM s at 1. s - 1 :> at 0

goal (1 subgoal):
 1. is_pole (hurwitz_zeta a) 1
[PROOF STEP]
hence ***: "filterlim (\<lambda>s :: complex. a powr (1 - s) / (s - 1)) at_infinity (at 1)"
[PROOF STATE]
proof (prove)
using this:
LIM s at 1. s - 1 :> at 0

goal (1 subgoal):
 1. LIM s at 1. complex_of_real a powr (1 - s) / (s - 1) :> at_infinity
[PROOF STEP]
by (intro filterlim_divide_at_infinity [OF **]) auto
[PROOF STATE]
proof (state)
this:
LIM s at 1. complex_of_real a powr (1 - s) / (s - 1) :> at_infinity

goal (1 subgoal):
 1. is_pole (hurwitz_zeta a) 1
[PROOF STEP]
have "is_pole (\<lambda>s. pre_zeta a s + complex_of_real a powr (1 - s) / (s - 1)) 1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. is_pole (\<lambda>s. pre_zeta a s + complex_of_real a powr (1 - s) / (s - 1)) 1
[PROOF STEP]
unfolding is_pole_def hurwitz_zeta_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. LIM s at 1. pre_zeta a s + complex_of_real a powr (1 - s) / (s - 1) :> at_infinity
[PROOF STEP]
by (rule tendsto_add_filterlim_at_infinity * ***)+
[PROOF STATE]
proof (state)
this:
is_pole (\<lambda>s. pre_zeta a s + complex_of_real a powr (1 - s) / (s - 1)) 1

goal (1 subgoal):
 1. is_pole (hurwitz_zeta a) 1
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
is_pole (\<lambda>s. pre_zeta a s + complex_of_real a powr (1 - s) / (s - 1)) 1

goal (1 subgoal):
 1. is_pole (hurwitz_zeta a) 1
[PROOF STEP]
have "?this \<longleftrightarrow> ?thesis"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. is_pole (\<lambda>s. pre_zeta a s + complex_of_real a powr (1 - s) / (s - 1)) 1 = is_pole (hurwitz_zeta a) 1
[PROOF STEP]
unfolding is_pole_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (LIM s at 1. pre_zeta a s + complex_of_real a powr (1 - s) / (s - 1) :> at_infinity) = filterlim (hurwitz_zeta a) at_infinity (at 1)
[PROOF STEP]
by (intro filterlim_cong refl) (auto simp: eventually_at_filter hurwitz_zeta_def)
[PROOF STATE]
proof (state)
this:
is_pole (\<lambda>s. pre_zeta a s + complex_of_real a powr (1 - s) / (s - 1)) 1 = is_pole (hurwitz_zeta a) 1

goal (1 subgoal):
 1. is_pole (hurwitz_zeta a) 1
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
is_pole (hurwitz_zeta a) 1
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
is_pole (hurwitz_zeta a) 1

goal (1 subgoal):
 1. is_pole (hurwitz_zeta a) 1
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
is_pole (hurwitz_zeta a) 1

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma neg_less_minus_divide_eq [field_simps]: "c < 0 \<Longrightarrow> a < - (b / c) \<longleftrightarrow> - b < a * c"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. c < (0::'a) \<Longrightarrow> (a < - (b / c)) = (- b < a * c)
[PROOF STEP]
unfolding minus_divide_left
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. c < (0::'a) \<Longrightarrow> (a < - b / c) = (- b < a * c)
[PROOF STEP]
by (rule neg_less_divide_eq)


[STATEMENT]
lemma (in vectorspace) func_space_is_vs:
  fixes S
  shows "vectorspace K (func_space S)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vectorspace K (func_space S)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. vectorspace K (func_space S)
[PROOF STEP]
have 0: "field K"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. field K
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
field K

goal (1 subgoal):
 1. vectorspace K (func_space S)
[PROOF STEP]
have 1: "module K (func_space S)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. module K (func_space S)
[PROOF STEP]
by (rule func_space_is_module)
[PROOF STATE]
proof (state)
this:
module K (func_space S)

goal (1 subgoal):
 1. vectorspace K (func_space S)
[PROOF STEP]
from 0 1
[PROOF STATE]
proof (chain)
picking this:
field K
module K (func_space S)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
field K
module K (func_space S)

goal (1 subgoal):
 1. vectorspace K (func_space S)
[PROOF STEP]
by (unfold vectorspace_def module_def, auto)
[PROOF STATE]
proof (state)
this:
vectorspace K (func_space S)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma finfun_eq_finite_UNIV: "finite (UNIV :: 'a set) \<Longrightarrow> (finfun :: ('a \<Rightarrow> 'b) set) = UNIV"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. finite UNIV \<Longrightarrow> finfun = UNIV
[PROOF STEP]
unfolding finfun_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. finite UNIV \<Longrightarrow> {f. \<exists>b. finite {a. f a \<noteq> b}} = UNIV
[PROOF STEP]
by(auto intro: finite_subset)


[STATEMENT]
lemma neg_numeral_le_ceiling [simp]: "- numeral v \<le> \<lceil>x\<rceil> \<longleftrightarrow> - numeral v - 1 < x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (- numeral v \<le> \<lceil>x\<rceil>) = (- numeral v - (1::'a) < x)
[PROOF STEP]
by (simp add: le_ceiling_iff)


[STATEMENT]
lemma ex_mset_zip_right:
  assumes "length xs = length ys" "mset ys' = mset ys"
  shows "\<exists>xs'. length ys' = length xs' \<and> mset (zip xs' ys') = mset (zip xs ys)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>xs'. length ys' = length xs' \<and> mset (zip xs' ys') = mset (zip xs ys)
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
length xs = length ys
mset ys' = mset ys

goal (1 subgoal):
 1. \<exists>xs'. length ys' = length xs' \<and> mset (zip xs' ys') = mset (zip xs ys)
[PROOF STEP]
proof (induct xs ys arbitrary: ys' rule: list_induct2)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>ys'. mset ys' = mset [] \<Longrightarrow> \<exists>xs'. length ys' = length xs' \<and> mset (zip xs' ys') = mset (zip [] [])
 2. \<And>x xs y ys ys'. \<lbrakk>length xs = length ys; \<And>ys'. mset ys' = mset ys \<Longrightarrow> \<exists>xs'. length ys' = length xs' \<and> mset (zip xs' ys') = mset (zip xs ys); mset ys' = mset (y # ys)\<rbrakk> \<Longrightarrow> \<exists>xs'. length ys' = length xs' \<and> mset (zip xs' ys') = mset (zip (x # xs) (y # ys))
[PROOF STEP]
case Nil
[PROOF STATE]
proof (state)
this:
mset ys' = mset []

goal (2 subgoals):
 1. \<And>ys'. mset ys' = mset [] \<Longrightarrow> \<exists>xs'. length ys' = length xs' \<and> mset (zip xs' ys') = mset (zip [] [])
 2. \<And>x xs y ys ys'. \<lbrakk>length xs = length ys; \<And>ys'. mset ys' = mset ys \<Longrightarrow> \<exists>xs'. length ys' = length xs' \<and> mset (zip xs' ys') = mset (zip xs ys); mset ys' = mset (y # ys)\<rbrakk> \<Longrightarrow> \<exists>xs'. length ys' = length xs' \<and> mset (zip xs' ys') = mset (zip (x # xs) (y # ys))
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
mset ys' = mset []

goal (1 subgoal):
 1. \<exists>xs'. length ys' = length xs' \<and> mset (zip xs' ys') = mset (zip [] [])
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<exists>xs'. length ys' = length xs' \<and> mset (zip xs' ys') = mset (zip [] [])

goal (1 subgoal):
 1. \<And>x xs y ys ys'. \<lbrakk>length xs = length ys; \<And>ys'. mset ys' = mset ys \<Longrightarrow> \<exists>xs'. length ys' = length xs' \<and> mset (zip xs' ys') = mset (zip xs ys); mset ys' = mset (y # ys)\<rbrakk> \<Longrightarrow> \<exists>xs'. length ys' = length xs' \<and> mset (zip xs' ys') = mset (zip (x # xs) (y # ys))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x xs y ys ys'. \<lbrakk>length xs = length ys; \<And>ys'. mset ys' = mset ys \<Longrightarrow> \<exists>xs'. length ys' = length xs' \<and> mset (zip xs' ys') = mset (zip xs ys); mset ys' = mset (y # ys)\<rbrakk> \<Longrightarrow> \<exists>xs'. length ys' = length xs' \<and> mset (zip xs' ys') = mset (zip (x # xs) (y # ys))
[PROOF STEP]
case (Cons x xs y ys ys')
[PROOF STATE]
proof (state)
this:
length xs = length ys
mset ?ys' = mset ys \<Longrightarrow> \<exists>xs'. length ?ys' = length xs' \<and> mset (zip xs' ?ys') = mset (zip xs ys)
mset ys' = mset (y # ys)

goal (1 subgoal):
 1. \<And>x xs y ys ys'. \<lbrakk>length xs = length ys; \<And>ys'. mset ys' = mset ys \<Longrightarrow> \<exists>xs'. length ys' = length xs' \<and> mset (zip xs' ys') = mset (zip xs ys); mset ys' = mset (y # ys)\<rbrakk> \<Longrightarrow> \<exists>xs'. length ys' = length xs' \<and> mset (zip xs' ys') = mset (zip (x # xs) (y # ys))
[PROOF STEP]
obtain j where j_len: "j < length ys'" and nth_j: "ys' ! j = y"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>j. \<lbrakk>j < length ys'; ys' ! j = y\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (metis Cons.prems in_set_conv_nth list.set_intros(1) mset_eq_setD)
[PROOF STATE]
proof (state)
this:
j < length ys'
ys' ! j = y

goal (1 subgoal):
 1. \<And>x xs y ys ys'. \<lbrakk>length xs = length ys; \<And>ys'. mset ys' = mset ys \<Longrightarrow> \<exists>xs'. length ys' = length xs' \<and> mset (zip xs' ys') = mset (zip xs ys); mset ys' = mset (y # ys)\<rbrakk> \<Longrightarrow> \<exists>xs'. length ys' = length xs' \<and> mset (zip xs' ys') = mset (zip (x # xs) (y # ys))
[PROOF STEP]
define ysa where "ysa = take j ys' @ drop (Suc j) ys'"
[PROOF STATE]
proof (state)
this:
ysa = take j ys' @ drop (Suc j) ys'

goal (1 subgoal):
 1. \<And>x xs y ys ys'. \<lbrakk>length xs = length ys; \<And>ys'. mset ys' = mset ys \<Longrightarrow> \<exists>xs'. length ys' = length xs' \<and> mset (zip xs' ys') = mset (zip xs ys); mset ys' = mset (y # ys)\<rbrakk> \<Longrightarrow> \<exists>xs'. length ys' = length xs' \<and> mset (zip xs' ys') = mset (zip (x # xs) (y # ys))
[PROOF STEP]
have "mset ys' = {#y#} + mset ysa"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mset ys' = {#y#} + mset ysa
[PROOF STEP]
unfolding ysa_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mset ys' = {#y#} + mset (take j ys' @ drop (Suc j) ys')
[PROOF STEP]
using j_len nth_j
[PROOF STATE]
proof (prove)
using this:
j < length ys'
ys' ! j = y

goal (1 subgoal):
 1. mset ys' = {#y#} + mset (take j ys' @ drop (Suc j) ys')
[PROOF STEP]
by (metis Cons_nth_drop_Suc union_mset_add_mset_right add_mset_remove_trivial add_diff_cancel_left'
        append_take_drop_id mset.simps(2) mset_append)
[PROOF STATE]
proof (state)
this:
mset ys' = {#y#} + mset ysa

goal (1 subgoal):
 1. \<And>x xs y ys ys'. \<lbrakk>length xs = length ys; \<And>ys'. mset ys' = mset ys \<Longrightarrow> \<exists>xs'. length ys' = length xs' \<and> mset (zip xs' ys') = mset (zip xs ys); mset ys' = mset (y # ys)\<rbrakk> \<Longrightarrow> \<exists>xs'. length ys' = length xs' \<and> mset (zip xs' ys') = mset (zip (x # xs) (y # ys))
[PROOF STEP]
hence ms_y: "mset ysa = mset ys"
[PROOF STATE]
proof (prove)
using this:
mset ys' = {#y#} + mset ysa

goal (1 subgoal):
 1. mset ysa = mset ys
[PROOF STEP]
by (simp add: Cons.prems)
[PROOF STATE]
proof (state)
this:
mset ysa = mset ys

goal (1 subgoal):
 1. \<And>x xs y ys ys'. \<lbrakk>length xs = length ys; \<And>ys'. mset ys' = mset ys \<Longrightarrow> \<exists>xs'. length ys' = length xs' \<and> mset (zip xs' ys') = mset (zip xs ys); mset ys' = mset (y # ys)\<rbrakk> \<Longrightarrow> \<exists>xs'. length ys' = length xs' \<and> mset (zip xs' ys') = mset (zip (x # xs) (y # ys))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
mset ysa = mset ys
[PROOF STEP]
obtain xsa where
    len_a: "length ysa = length xsa" and ms_a: "mset (zip xsa ysa) = mset (zip xs ys)"
[PROOF STATE]
proof (prove)
using this:
mset ysa = mset ys

goal (1 subgoal):
 1. (\<And>xsaa. \<lbrakk>length ysa = length xsaa; mset (zip xsaa ysa) = mset (zip xs ys)\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using Cons.hyps(2)
[PROOF STATE]
proof (prove)
using this:
mset ysa = mset ys
mset ?ys' = mset ys \<Longrightarrow> \<exists>xs'. length ?ys' = length xs' \<and> mset (zip xs' ?ys') = mset (zip xs ys)

goal (1 subgoal):
 1. (\<And>xsaa. \<lbrakk>length ysa = length xsaa; mset (zip xsaa ysa) = mset (zip xs ys)\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
length ysa = length xsa
mset (zip xsa ysa) = mset (zip xs ys)

goal (1 subgoal):
 1. \<And>x xs y ys ys'. \<lbrakk>length xs = length ys; \<And>ys'. mset ys' = mset ys \<Longrightarrow> \<exists>xs'. length ys' = length xs' \<and> mset (zip xs' ys') = mset (zip xs ys); mset ys' = mset (y # ys)\<rbrakk> \<Longrightarrow> \<exists>xs'. length ys' = length xs' \<and> mset (zip xs' ys') = mset (zip (x # xs) (y # ys))
[PROOF STEP]
define xs' where "xs' = take j xsa @ x # drop j xsa"
[PROOF STATE]
proof (state)
this:
xs' = take j xsa @ x # drop j xsa

goal (1 subgoal):
 1. \<And>x xs y ys ys'. \<lbrakk>length xs = length ys; \<And>ys'. mset ys' = mset ys \<Longrightarrow> \<exists>xs'. length ys' = length xs' \<and> mset (zip xs' ys') = mset (zip xs ys); mset ys' = mset (y # ys)\<rbrakk> \<Longrightarrow> \<exists>xs'. length ys' = length xs' \<and> mset (zip xs' ys') = mset (zip (x # xs) (y # ys))
[PROOF STEP]
have ys': "ys' = take j ysa @ y # drop j ysa"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ys' = take j ysa @ y # drop j ysa
[PROOF STEP]
using ms_y j_len nth_j Cons.prems ysa_def
[PROOF STATE]
proof (prove)
using this:
mset ysa = mset ys
j < length ys'
ys' ! j = y
mset ys' = mset (y # ys)
ysa = take j ys' @ drop (Suc j) ys'

goal (1 subgoal):
 1. ys' = take j ysa @ y # drop j ysa
[PROOF STEP]
by (metis append_eq_append_conv append_take_drop_id diff_Suc_Suc Cons_nth_drop_Suc length_Cons
      length_drop size_mset)
[PROOF STATE]
proof (state)
this:
ys' = take j ysa @ y # drop j ysa

goal (1 subgoal):
 1. \<And>x xs y ys ys'. \<lbrakk>length xs = length ys; \<And>ys'. mset ys' = mset ys \<Longrightarrow> \<exists>xs'. length ys' = length xs' \<and> mset (zip xs' ys') = mset (zip xs ys); mset ys' = mset (y # ys)\<rbrakk> \<Longrightarrow> \<exists>xs'. length ys' = length xs' \<and> mset (zip xs' ys') = mset (zip (x # xs) (y # ys))
[PROOF STEP]
have j_len': "j \<le> length ysa"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. j \<le> length ysa
[PROOF STEP]
using j_len ys' ysa_def
[PROOF STATE]
proof (prove)
using this:
j < length ys'
ys' = take j ysa @ y # drop j ysa
ysa = take j ys' @ drop (Suc j) ys'

goal (1 subgoal):
 1. j \<le> length ysa
[PROOF STEP]
by (metis add_Suc_right append_take_drop_id length_Cons length_append less_eq_Suc_le not_less)
[PROOF STATE]
proof (state)
this:
j \<le> length ysa

goal (1 subgoal):
 1. \<And>x xs y ys ys'. \<lbrakk>length xs = length ys; \<And>ys'. mset ys' = mset ys \<Longrightarrow> \<exists>xs'. length ys' = length xs' \<and> mset (zip xs' ys') = mset (zip xs ys); mset ys' = mset (y # ys)\<rbrakk> \<Longrightarrow> \<exists>xs'. length ys' = length xs' \<and> mset (zip xs' ys') = mset (zip (x # xs) (y # ys))
[PROOF STEP]
have "length ys' = length xs'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. length ys' = length xs'
[PROOF STEP]
unfolding xs'_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. length ys' = length (take j xsa @ x # drop j xsa)
[PROOF STEP]
using Cons.prems len_a ms_y
[PROOF STATE]
proof (prove)
using this:
mset ys' = mset (y # ys)
length ysa = length xsa
mset ysa = mset ys

goal (1 subgoal):
 1. length ys' = length (take j xsa @ x # drop j xsa)
[PROOF STEP]
by (metis add_Suc_right append_take_drop_id length_Cons length_append mset_eq_length)
[PROOF STATE]
proof (state)
this:
length ys' = length xs'

goal (1 subgoal):
 1. \<And>x xs y ys ys'. \<lbrakk>length xs = length ys; \<And>ys'. mset ys' = mset ys \<Longrightarrow> \<exists>xs'. length ys' = length xs' \<and> mset (zip xs' ys') = mset (zip xs ys); mset ys' = mset (y # ys)\<rbrakk> \<Longrightarrow> \<exists>xs'. length ys' = length xs' \<and> mset (zip xs' ys') = mset (zip (x # xs) (y # ys))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
length ys' = length xs'

goal (1 subgoal):
 1. \<And>x xs y ys ys'. \<lbrakk>length xs = length ys; \<And>ys'. mset ys' = mset ys \<Longrightarrow> \<exists>xs'. length ys' = length xs' \<and> mset (zip xs' ys') = mset (zip xs ys); mset ys' = mset (y # ys)\<rbrakk> \<Longrightarrow> \<exists>xs'. length ys' = length xs' \<and> mset (zip xs' ys') = mset (zip (x # xs) (y # ys))
[PROOF STEP]
have "mset (zip xs' ys') = mset (zip (x # xs) (y # ys))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mset (zip xs' ys') = mset (zip (x # xs) (y # ys))
[PROOF STEP]
unfolding ys' xs'_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mset (zip (take j xsa @ x # drop j xsa) (take j ysa @ y # drop j ysa)) = mset (zip (x # xs) (y # ys))
[PROOF STEP]
apply (rule HOL.trans[OF mset_zip_take_Cons_drop_twice])
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. length xsa = length ysa
 2. j \<le> length xsa
 3. add_mset (x, y) (mset (zip xsa ysa)) = mset (zip (x # xs) (y # ys))
[PROOF STEP]
using j_len'
[PROOF STATE]
proof (prove)
using this:
j \<le> length ysa

goal (3 subgoals):
 1. length xsa = length ysa
 2. j \<le> length xsa
 3. add_mset (x, y) (mset (zip xsa ysa)) = mset (zip (x # xs) (y # ys))
[PROOF STEP]
by (auto simp: len_a ms_a)
[PROOF STATE]
proof (state)
this:
mset (zip xs' ys') = mset (zip (x # xs) (y # ys))

goal (1 subgoal):
 1. \<And>x xs y ys ys'. \<lbrakk>length xs = length ys; \<And>ys'. mset ys' = mset ys \<Longrightarrow> \<exists>xs'. length ys' = length xs' \<and> mset (zip xs' ys') = mset (zip xs ys); mset ys' = mset (y # ys)\<rbrakk> \<Longrightarrow> \<exists>xs'. length ys' = length xs' \<and> mset (zip xs' ys') = mset (zip (x # xs) (y # ys))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
length ys' = length xs'
mset (zip xs' ys') = mset (zip (x # xs) (y # ys))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
length ys' = length xs'
mset (zip xs' ys') = mset (zip (x # xs) (y # ys))

goal (1 subgoal):
 1. \<exists>xs'. length ys' = length xs' \<and> mset (zip xs' ys') = mset (zip (x # xs) (y # ys))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>xs'. length ys' = length xs' \<and> mset (zip xs' ys') = mset (zip (x # xs) (y # ys))

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma add_right_strict_mono: "strict_mono (\<lambda>x. x + (n::'a::ordered_cancel_ab_semigroup_add))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. strict_mono (\<lambda>x. x + n)
[PROOF STEP]
by (unfold strict_mono_def, clarify, rule add_strict_right_mono)


[STATEMENT]
lemma (in abelian_group) a_coset_add_inv2:
     "[| M +> x = M +> y;  x \<in> carrier G;  y \<in> carrier G;  M \<subseteq> carrier G |]
      ==> M +> (x \<oplus> (\<ominus> y)) = M"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>M +> x = M +> y; x \<in> carrier G; y \<in> carrier G; M \<subseteq> carrier G\<rbrakk> \<Longrightarrow> M +> x \<oplus> \<ominus> y = M
[PROOF STEP]
by (rule group.coset_mult_inv2 [OF a_group,
    folded a_r_coset_def a_inv_def, simplified monoid_record_simps])


[STATEMENT]
lemma eventually_going_to_at_top_dense:
  fixes f :: "'a \<Rightarrow> 'b :: {linorder,no_top}"
  shows "eventually P (f going_to at_top within A) \<longleftrightarrow> (\<exists>C. \<forall>x\<in>A. f x > C \<longrightarrow> P x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. eventually P (f going_to at_top within A) = (\<exists>C. \<forall>x\<in>A. C < f x \<longrightarrow> P x)
[PROOF STEP]
unfolding going_to_within_def eventually_filtercomap
    eventually_inf_principal eventually_at_top_dense
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<exists>Q. (\<exists>N. \<forall>n>N. Q n) \<and> (\<forall>x. Q (f x) \<longrightarrow> x \<in> A \<longrightarrow> P x)) = (\<exists>C. \<forall>x\<in>A. C < f x \<longrightarrow> P x)
[PROOF STEP]
by fast


[STATEMENT]
lemma sum_list_extract_last: "(\<Sum>x\<leftarrow>[0..<Suc n]. f x) = (\<Sum>x\<leftarrow>[0..<n]. f x) + f n"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. sum_list (map f [0..<Suc n]) = sum_list (map f [0..<n]) + f n
[PROOF STEP]
by(induct n) (auto simp: add.assoc)


[STATEMENT]
lemma bnds_cos_lower: "\<And>x. real_of_float xl \<le> x \<Longrightarrow> x \<le> real_of_float xu \<Longrightarrow> cos x \<le> y \<Longrightarrow> real_of_float (fst (bnds_cos prec xl xu)) \<le> y"
  and bnds_cos_upper: "\<And>x. real_of_float xl \<le> x \<Longrightarrow> x \<le> real_of_float xu \<Longrightarrow> y \<le> cos x \<Longrightarrow> y \<le> real_of_float (snd (bnds_cos prec xl xu))"
  for xl xu::float and y::real
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>x. \<lbrakk>real_of_float xl \<le> x; x \<le> real_of_float xu; cos x \<le> y\<rbrakk> \<Longrightarrow> real_of_float (fst (bnds_cos prec xl xu)) \<le> y) &&& (\<And>x. \<lbrakk>real_of_float xl \<le> x; x \<le> real_of_float xu; y \<le> cos x\<rbrakk> \<Longrightarrow> y \<le> real_of_float (snd (bnds_cos prec xl xu)))
[PROOF STEP]
using bnds_cos[of "fst (bnds_cos prec xl xu)" "snd (bnds_cos prec xl xu)" prec]
[PROOF STATE]
proof (prove)
using this:
\<forall>x lx ux. (fst (bnds_cos prec xl xu), snd (bnds_cos prec xl xu)) = bnds_cos prec lx ux \<and> x \<in> {real_of_float lx..real_of_float ux} \<longrightarrow> real_of_float (fst (bnds_cos prec xl xu)) \<le> cos x \<and> cos x \<le> real_of_float (snd (bnds_cos prec xl xu))

goal (1 subgoal):
 1. (\<And>x. \<lbrakk>real_of_float xl \<le> x; x \<le> real_of_float xu; cos x \<le> y\<rbrakk> \<Longrightarrow> real_of_float (fst (bnds_cos prec xl xu)) \<le> y) &&& (\<And>x. \<lbrakk>real_of_float xl \<le> x; x \<le> real_of_float xu; y \<le> cos x\<rbrakk> \<Longrightarrow> y \<le> real_of_float (snd (bnds_cos prec xl xu)))
[PROOF STEP]
by force+


[STATEMENT]
lemma rel_interior_eq_between:
  fixes S T :: "('m::euclidean_space) set"
  assumes "convex S" "convex T"
  shows "(rel_interior S = rel_interior T) \<longleftrightarrow> (rel_interior S \<le> T \<and> T \<le> closure S)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (rel_interior S = rel_interior T) = (rel_interior S \<subseteq> T \<and> T \<subseteq> closure S)
[PROOF STEP]
by (metis assms closure_eq_between convex_closure_rel_interior convex_rel_interior_closure)


[STATEMENT]
lemma interval_union_commute: "sup A B = sup B A" for A::"'a::lattice interval"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. sup A B = sup B A
[PROOF STEP]
by (auto simp add: interval_eq_iff inf.commute sup.commute)


[STATEMENT]
lemma N_col_def: "j < \<b> \<Longrightarrow> i < \<v> \<Longrightarrow> (col N j) $ i = (if (\<V>s ! i \<in> \<B>s ! j) then 1 else 0)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>j < \<b>; i < \<v>\<rbrakk> \<Longrightarrow> col N j $ i = (if \<V>s ! i \<in> \<B>s ! j then 1 else 0)
[PROOF STEP]
by (metis inc_mat_col_def points_list_length blocks_list_length)


[STATEMENT]
lemma compactin_path_image: "pathin X g \<Longrightarrow> compactin X (g ` ({0..1}))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pathin X g \<Longrightarrow> compactin X (g ` {0..1})
[PROOF STEP]
unfolding pathin_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. continuous_map (top_of_set {0..1}) X g \<Longrightarrow> compactin X (g ` {0..1})
[PROOF STEP]
by (rule image_compactin [of "top_of_set {0..1}"]) auto


[STATEMENT]
lemma prv_imp_imp_exi:
  assumes "x \<in> var" and "\<phi> \<in> fmla" and "\<chi> \<in> fmla"
  assumes "x \<notin> Fvars \<phi>"
  shows "prv (imp (exi x (imp \<phi> \<chi>)) (imp \<phi> (exi x \<chi>)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. prv (imp (exi x (imp \<phi> \<chi>)) (imp \<phi> (exi x \<chi>)))
[PROOF STEP]
using assms imp exi Fvars_exi Fvars_imp Un_iff assms prv_exi_imp_gen prv_exi_inst prv_imp_mp
    prv_imp_trans1 member_remove remove_def subst_same_Var
[PROOF STATE]
proof (prove)
using this:
x \<in> var
\<phi> \<in> fmla
\<chi> \<in> fmla
x \<notin> Fvars \<phi>
\<lbrakk>?\<phi>1.0 \<in> fmla; ?\<phi>2.0 \<in> fmla\<rbrakk> \<Longrightarrow> imp ?\<phi>1.0 ?\<phi>2.0 \<in> fmla
\<lbrakk>?x \<in> var; ?\<phi> \<in> fmla\<rbrakk> \<Longrightarrow> exi ?x ?\<phi> \<in> fmla
\<lbrakk>?x \<in> var; ?\<phi> \<in> fmla\<rbrakk> \<Longrightarrow> Fvars (exi ?x ?\<phi>) = Fvars ?\<phi> - {?x}
\<lbrakk>?\<phi> \<in> fmla; ?\<chi> \<in> fmla\<rbrakk> \<Longrightarrow> Fvars (imp ?\<phi> ?\<chi>) = Fvars ?\<phi> \<union> Fvars ?\<chi>
(?c \<in> ?A \<union> ?B) = (?c \<in> ?A \<or> ?c \<in> ?B)
x \<in> var
\<phi> \<in> fmla
\<chi> \<in> fmla
x \<notin> Fvars \<phi>
\<lbrakk>?x \<in> var; ?\<phi> \<in> fmla; ?\<chi> \<in> fmla; ?x \<notin> Fvars ?\<chi>; prv (imp ?\<phi> ?\<chi>)\<rbrakk> \<Longrightarrow> prv (imp (exi ?x ?\<phi>) ?\<chi>)
\<lbrakk>?x \<in> var; ?\<phi> \<in> fmla; ?t \<in> trm\<rbrakk> \<Longrightarrow> prv (imp (subst ?\<phi> ?t ?x) (exi ?x ?\<phi>))
\<lbrakk>?\<phi> \<in> fmla; ?\<chi> \<in> fmla; prv (imp ?\<phi> ?\<chi>); prv ?\<phi>\<rbrakk> \<Longrightarrow> prv ?\<chi>
\<lbrakk>?\<phi> \<in> fmla; ?\<chi> \<in> fmla; ?\<psi> \<in> fmla\<rbrakk> \<Longrightarrow> prv (imp (imp ?\<chi> ?\<psi>) (imp (imp ?\<phi> ?\<chi>) (imp ?\<phi> ?\<psi>)))
(?x \<in> Set.remove ?y ?A) = (?x \<in> ?A \<and> ?x \<noteq> ?y)
Set.remove ?x ?A = ?A - {?x}
\<lbrakk>?\<phi> \<in> fmla; ?x \<in> var\<rbrakk> \<Longrightarrow> subst ?\<phi> (Var ?x) ?x = ?\<phi>

goal (1 subgoal):
 1. prv (imp (exi x (imp \<phi> \<chi>)) (imp \<phi> (exi x \<chi>)))
[PROOF STEP]
by (metis (full_types) Var)


[STATEMENT]
lemma in_deg_one_imp_not_root: "\<lbrakk> v \<in> verts T; in_degree T v = 1 \<rbrakk>  \<Longrightarrow> v \<noteq> root"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>v \<in> verts T; in_degree T v = 1\<rbrakk> \<Longrightarrow> v \<noteq> root
[PROOF STEP]
using in_degree_root_zero
[PROOF STATE]
proof (prove)
using this:
in_degree T root = 0

goal (1 subgoal):
 1. \<lbrakk>v \<in> verts T; in_degree T v = 1\<rbrakk> \<Longrightarrow> v \<noteq> root
[PROOF STEP]
by auto


[STATEMENT]
lemma bigo_const_mult3: "(c::'a::linordered_field) \<noteq> 0 \<Longrightarrow> f \<in> O(\<lambda>x. c * f x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. c \<noteq> (0::'a) \<Longrightarrow> f \<in> O(\<lambda>x. c * f x)
[PROOF STEP]
apply (simp add: bigo_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. c \<noteq> (0::'a) \<Longrightarrow> \<exists>ca. \<forall>x. \<bar>f x\<bar> \<le> ca * \<bar>c * f x\<bar>
[PROOF STEP]
by (metis (no_types) abs_mult mult.assoc mult_1 order_refl left_inverse)


[STATEMENT]
lemma not_is_Msg: "(\<not> is_Msg m) = is_NoMsg m"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<not> is_Msg m) = is_NoMsg m
[PROOF STEP]
by (simp add: is_NoMsg_defs)


[STATEMENT]
lemma algebraicI: "(\<And>i. coeff p i \<in> \<int>) \<Longrightarrow> p \<noteq> 0 \<Longrightarrow> poly p x = 0 \<Longrightarrow> algebraic x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<And>i. coeff p i \<in> \<int>; p \<noteq> 0; poly p x = (0::'a)\<rbrakk> \<Longrightarrow> algebraic x
[PROOF STEP]
unfolding algebraic_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<And>i. coeff p i \<in> \<int>; p \<noteq> 0; poly p x = (0::'a)\<rbrakk> \<Longrightarrow> \<exists>p. (\<forall>i. coeff p i \<in> \<int>) \<and> p \<noteq> 0 \<and> poly p x = (0::'a)
[PROOF STEP]
by blast


[STATEMENT]
lemma  consecutiveRes:" |res ts  c| =2 \<longrightarrow> (\<exists>n . Rep_nat_int (res ts c) = {n,n+1})"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. |res ts c| = 2 \<longrightarrow> (\<exists>n. Rep_nat_int (res ts c) = {n, n + 1})
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. |res ts c| = 2 \<Longrightarrow> \<exists>n. Rep_nat_int (res ts c) = {n, n + 1}
[PROOF STEP]
assume assump:"|res ts  c| =2"
[PROOF STATE]
proof (state)
this:
|res ts c| = 2

goal (1 subgoal):
 1. |res ts c| = 2 \<Longrightarrow> \<exists>n. Rep_nat_int (res ts c) = {n, n + 1}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
|res ts c| = 2
[PROOF STEP]
have not_empty:"(res ts c) \<noteq> \<emptyset>"
[PROOF STATE]
proof (prove)
using this:
|res ts c| = 2

goal (1 subgoal):
 1. res ts c \<noteq> bot
[PROOF STEP]
by (simp add: card_non_empty_geq_one)
[PROOF STATE]
proof (state)
this:
res ts c \<noteq> bot

goal (1 subgoal):
 1. |res ts c| = 2 \<Longrightarrow> \<exists>n. Rep_nat_int (res ts c) = {n, n + 1}
[PROOF STEP]
from assump and card_seq
[PROOF STATE]
proof (chain)
picking this:
|res ts c| = 2
\<forall>i. |i| = ?x \<longrightarrow> Rep_nat_int i = {} \<or> (\<exists>n. Rep_nat_int i = {n..n + (?x - 1)})
[PROOF STEP]
have "Rep_nat_int (res ts  c) = {} \<or> (\<exists>n . Rep_nat_int (res ts c) = {n,n+1})"
[PROOF STATE]
proof (prove)
using this:
|res ts c| = 2
\<forall>i. |i| = ?x \<longrightarrow> Rep_nat_int i = {} \<or> (\<exists>n. Rep_nat_int i = {n..n + (?x - 1)})

goal (1 subgoal):
 1. Rep_nat_int (res ts c) = {} \<or> (\<exists>n. Rep_nat_int (res ts c) = {n, n + 1})
[PROOF STEP]
by (metis add_diff_cancel_left' atLeastAtMost_singleton insert_is_Un nat_int.un_consec_seq
        one_add_one order_refl)
[PROOF STATE]
proof (state)
this:
Rep_nat_int (res ts c) = {} \<or> (\<exists>n. Rep_nat_int (res ts c) = {n, n + 1})

goal (1 subgoal):
 1. |res ts c| = 2 \<Longrightarrow> \<exists>n. Rep_nat_int (res ts c) = {n, n + 1}
[PROOF STEP]
with assump
[PROOF STATE]
proof (chain)
picking this:
|res ts c| = 2
Rep_nat_int (res ts c) = {} \<or> (\<exists>n. Rep_nat_int (res ts c) = {n, n + 1})
[PROOF STEP]
show "(\<exists>n . Rep_nat_int (res ts c) = {n,n+1})"
[PROOF STATE]
proof (prove)
using this:
|res ts c| = 2
Rep_nat_int (res ts c) = {} \<or> (\<exists>n. Rep_nat_int (res ts c) = {n, n + 1})

goal (1 subgoal):
 1. \<exists>n. Rep_nat_int (res ts c) = {n, n + 1}
[PROOF STEP]
using Rep_nat_int_inject bot_nat_int.rep_eq card_non_empty_geq_one
[PROOF STATE]
proof (prove)
using this:
|res ts c| = 2
Rep_nat_int (res ts c) = {} \<or> (\<exists>n. Rep_nat_int (res ts c) = {n, n + 1})
(Rep_nat_int ?x = Rep_nat_int ?y) = (?x = ?y)
Rep_nat_int bot = {}
(?i \<noteq> bot) = (1 \<le> |?i|)

goal (1 subgoal):
 1. \<exists>n. Rep_nat_int (res ts c) = {n, n + 1}
[PROOF STEP]
by (metis not_empty)
[PROOF STATE]
proof (state)
this:
\<exists>n. Rep_nat_int (res ts c) = {n, n + 1}

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma sums_ereal: "(\<lambda>x. ereal (f x)) sums ereal x \<longleftrightarrow> f sums x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lambda>x. ereal (f x)) sums ereal x = f sums x
[PROOF STEP]
unfolding sums_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lambda>n. \<Sum>x<n. ereal (f x)) \<longlonglongrightarrow> ereal x = (\<lambda>n. sum f {..<n}) \<longlonglongrightarrow> x
[PROOF STEP]
by simp


[STATEMENT]
theorem alw_valid_iff_valid: "(\<turnstile> \<box>F) = (\<turnstile> F)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<turnstile> \<box>F) = (\<turnstile> F)
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<turnstile> \<box>F \<Longrightarrow> \<turnstile> F
 2. \<turnstile> F \<Longrightarrow> \<turnstile> \<box>F
[PROOF STEP]
assume "\<turnstile> \<box>F"
[PROOF STATE]
proof (state)
this:
\<turnstile> \<box>F

goal (2 subgoals):
 1. \<turnstile> \<box>F \<Longrightarrow> \<turnstile> F
 2. \<turnstile> F \<Longrightarrow> \<turnstile> \<box>F
[PROOF STEP]
from this ax1
[PROOF STATE]
proof (chain)
picking this:
\<turnstile> \<box>F
\<turnstile> \<box>?F \<longrightarrow> ?F
[PROOF STEP]
show "\<turnstile> F"
[PROOF STATE]
proof (prove)
using this:
\<turnstile> \<box>F
\<turnstile> \<box>?F \<longrightarrow> ?F

goal (1 subgoal):
 1. \<turnstile> F
[PROOF STEP]
by (rule fmp)
[PROOF STATE]
proof (state)
this:
\<turnstile> F

goal (1 subgoal):
 1. \<turnstile> F \<Longrightarrow> \<turnstile> \<box>F
[PROOF STEP]
qed (rule alw)


[STATEMENT]
lemma fml_sem_implies [simp]: "fml_sem I (Implies \<phi> \<psi>) = (-fml_sem I \<phi>) \<union> fml_sem I \<psi>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fml_sem I (\<phi> \<rightarrow> \<psi>) = - fml_sem I \<phi> \<union> fml_sem I \<psi>
[PROOF STEP]
unfolding Implies_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fml_sem I (\<psi> || ! \<phi>) = - fml_sem I \<phi> \<union> fml_sem I \<psi>
[PROOF STEP]
by auto


[STATEMENT]
lemma degree_m_mult_le: "degree_m (f * g) \<le> degree_m f + degree_m g"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. degree_m (f * g) \<le> degree_m f + degree_m g
[PROOF STEP]
using degree_m_mult_le
[PROOF STATE]
proof (prove)
using this:
?f =m ?g * ?h \<Longrightarrow> degree_m ?f \<le> degree_m ?g + degree_m ?h

goal (1 subgoal):
 1. degree_m (f * g) \<le> degree_m f + degree_m g
[PROOF STEP]
by auto


[STATEMENT]
lemma ce_set_lm_5: "\<lbrakk> A \<in> ce_sets; p \<in> PrimRec1 \<rbrakk> \<Longrightarrow> { x . p x \<in> A } \<in> ce_sets"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>A \<in> ce_sets; p \<in> PrimRec1\<rbrakk> \<Longrightarrow> {x. p x \<in> A} \<in> ce_sets
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>A \<in> ce_sets; p \<in> PrimRec1\<rbrakk> \<Longrightarrow> {x. p x \<in> A} \<in> ce_sets
[PROOF STEP]
assume A1: "A \<in> ce_sets"
[PROOF STATE]
proof (state)
this:
A \<in> ce_sets

goal (1 subgoal):
 1. \<lbrakk>A \<in> ce_sets; p \<in> PrimRec1\<rbrakk> \<Longrightarrow> {x. p x \<in> A} \<in> ce_sets
[PROOF STEP]
assume A2: "p \<in> PrimRec1"
[PROOF STATE]
proof (state)
this:
p \<in> PrimRec1

goal (1 subgoal):
 1. \<lbrakk>A \<in> ce_sets; p \<in> PrimRec1\<rbrakk> \<Longrightarrow> {x. p x \<in> A} \<in> ce_sets
[PROOF STEP]
from A1
[PROOF STATE]
proof (chain)
picking this:
A \<in> ce_sets
[PROOF STEP]
have "\<exists> pA \<in> PrimRec2. A = fn_to_set pA"
[PROOF STATE]
proof (prove)
using this:
A \<in> ce_sets

goal (1 subgoal):
 1. \<exists>pA\<in>PrimRec2. A = fn_to_set pA
[PROOF STEP]
by (rule ce_set_lm_3)
[PROOF STATE]
proof (state)
this:
\<exists>pA\<in>PrimRec2. A = fn_to_set pA

goal (1 subgoal):
 1. \<lbrakk>A \<in> ce_sets; p \<in> PrimRec1\<rbrakk> \<Longrightarrow> {x. p x \<in> A} \<in> ce_sets
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<exists>pA\<in>PrimRec2. A = fn_to_set pA
[PROOF STEP]
obtain pA where pA_is_pr: "pA \<in> PrimRec2" and S1: "A = fn_to_set pA"
[PROOF STATE]
proof (prove)
using this:
\<exists>pA\<in>PrimRec2. A = fn_to_set pA

goal (1 subgoal):
 1. (\<And>pA. \<lbrakk>pA \<in> PrimRec2; A = fn_to_set pA\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
pA \<in> PrimRec2
A = fn_to_set pA

goal (1 subgoal):
 1. \<lbrakk>A \<in> ce_sets; p \<in> PrimRec1\<rbrakk> \<Longrightarrow> {x. p x \<in> A} \<in> ce_sets
[PROOF STEP]
from S1
[PROOF STATE]
proof (chain)
picking this:
A = fn_to_set pA
[PROOF STEP]
have S2: "A = { x . \<exists> y. pA x y = 0 }"
[PROOF STATE]
proof (prove)
using this:
A = fn_to_set pA

goal (1 subgoal):
 1. A = {x. \<exists>y. pA x y = 0}
[PROOF STEP]
by (simp add: fn_to_set_def)
[PROOF STATE]
proof (state)
this:
A = {x. \<exists>y. pA x y = 0}

goal (1 subgoal):
 1. \<lbrakk>A \<in> ce_sets; p \<in> PrimRec1\<rbrakk> \<Longrightarrow> {x. p x \<in> A} \<in> ce_sets
[PROOF STEP]
define q where "q x y = pA (p x) y" for x y
[PROOF STATE]
proof (state)
this:
q ?x ?y = pA (p ?x) ?y

goal (1 subgoal):
 1. \<lbrakk>A \<in> ce_sets; p \<in> PrimRec1\<rbrakk> \<Longrightarrow> {x. p x \<in> A} \<in> ce_sets
[PROOF STEP]
from pA_is_pr A2
[PROOF STATE]
proof (chain)
picking this:
pA \<in> PrimRec2
p \<in> PrimRec1
[PROOF STEP]
have q_is_pr: "q \<in> PrimRec2"
[PROOF STATE]
proof (prove)
using this:
pA \<in> PrimRec2
p \<in> PrimRec1

goal (1 subgoal):
 1. q \<in> PrimRec2
[PROOF STEP]
unfolding q_def
[PROOF STATE]
proof (prove)
using this:
pA \<in> PrimRec2
p \<in> PrimRec1

goal (1 subgoal):
 1. (\<lambda>x. pA (p x)) \<in> PrimRec2
[PROOF STEP]
by prec
[PROOF STATE]
proof (state)
this:
q \<in> PrimRec2

goal (1 subgoal):
 1. \<lbrakk>A \<in> ce_sets; p \<in> PrimRec1\<rbrakk> \<Longrightarrow> {x. p x \<in> A} \<in> ce_sets
[PROOF STEP]
have "\<And> x. (p x \<in> A) = (\<exists> y. q x y = 0)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. (p x \<in> A) = (\<exists>y. q x y = 0)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x. (p x \<in> A) = (\<exists>y. q x y = 0)
[PROOF STEP]
fix x
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x. (p x \<in> A) = (\<exists>y. q x y = 0)
[PROOF STEP]
show "(p x \<in> A) = (\<exists> y. q x y = 0)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (p x \<in> A) = (\<exists>y. q x y = 0)
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. p x \<in> A \<Longrightarrow> \<exists>y. q x y = 0
 2. \<exists>y. q x y = 0 \<Longrightarrow> p x \<in> A
[PROOF STEP]
assume A: "p x \<in> A"
[PROOF STATE]
proof (state)
this:
p x \<in> A

goal (2 subgoals):
 1. p x \<in> A \<Longrightarrow> \<exists>y. q x y = 0
 2. \<exists>y. q x y = 0 \<Longrightarrow> p x \<in> A
[PROOF STEP]
with S2
[PROOF STATE]
proof (chain)
picking this:
A = {x. \<exists>y. pA x y = 0}
p x \<in> A
[PROOF STEP]
obtain y where L1: "pA (p x) y = 0"
[PROOF STATE]
proof (prove)
using this:
A = {x. \<exists>y. pA x y = 0}
p x \<in> A

goal (1 subgoal):
 1. (\<And>y. pA (p x) y = 0 \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
pA (p x) y = 0

goal (2 subgoals):
 1. p x \<in> A \<Longrightarrow> \<exists>y. q x y = 0
 2. \<exists>y. q x y = 0 \<Longrightarrow> p x \<in> A
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
pA (p x) y = 0
[PROOF STEP]
have "q x y = 0"
[PROOF STATE]
proof (prove)
using this:
pA (p x) y = 0

goal (1 subgoal):
 1. q x y = 0
[PROOF STEP]
by (simp add: q_def)
[PROOF STATE]
proof (state)
this:
q x y = 0

goal (2 subgoals):
 1. p x \<in> A \<Longrightarrow> \<exists>y. q x y = 0
 2. \<exists>y. q x y = 0 \<Longrightarrow> p x \<in> A
[PROOF STEP]
thus "\<exists> y. q x y = 0"
[PROOF STATE]
proof (prove)
using this:
q x y = 0

goal (1 subgoal):
 1. \<exists>y. q x y = 0
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
\<exists>y. q x y = 0

goal (1 subgoal):
 1. \<exists>y. q x y = 0 \<Longrightarrow> p x \<in> A
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<exists>y. q x y = 0 \<Longrightarrow> p x \<in> A
[PROOF STEP]
assume A: "\<exists>y. q x y = 0"
[PROOF STATE]
proof (state)
this:
\<exists>y. q x y = 0

goal (1 subgoal):
 1. \<exists>y. q x y = 0 \<Longrightarrow> p x \<in> A
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<exists>y. q x y = 0
[PROOF STEP]
obtain y where L1: "q x y = 0"
[PROOF STATE]
proof (prove)
using this:
\<exists>y. q x y = 0

goal (1 subgoal):
 1. (\<And>y. q x y = 0 \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
q x y = 0

goal (1 subgoal):
 1. \<exists>y. q x y = 0 \<Longrightarrow> p x \<in> A
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
q x y = 0
[PROOF STEP]
have "pA (p x) y = 0"
[PROOF STATE]
proof (prove)
using this:
q x y = 0

goal (1 subgoal):
 1. pA (p x) y = 0
[PROOF STEP]
by (simp add: q_def)
[PROOF STATE]
proof (state)
this:
pA (p x) y = 0

goal (1 subgoal):
 1. \<exists>y. q x y = 0 \<Longrightarrow> p x \<in> A
[PROOF STEP]
with S2
[PROOF STATE]
proof (chain)
picking this:
A = {x. \<exists>y. pA x y = 0}
pA (p x) y = 0
[PROOF STEP]
show "p x \<in> A"
[PROOF STATE]
proof (prove)
using this:
A = {x. \<exists>y. pA x y = 0}
pA (p x) y = 0

goal (1 subgoal):
 1. p x \<in> A
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
p x \<in> A

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
(p x \<in> A) = (\<exists>y. q x y = 0)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
(p ?x \<in> A) = (\<exists>y. q ?x y = 0)

goal (1 subgoal):
 1. \<lbrakk>A \<in> ce_sets; p \<in> PrimRec1\<rbrakk> \<Longrightarrow> {x. p x \<in> A} \<in> ce_sets
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(p ?x \<in> A) = (\<exists>y. q ?x y = 0)
[PROOF STEP]
have "{ x . p x \<in> A } = { x. \<exists> y. q x y = 0 }"
[PROOF STATE]
proof (prove)
using this:
(p ?x \<in> A) = (\<exists>y. q ?x y = 0)

goal (1 subgoal):
 1. {x. p x \<in> A} = {x. \<exists>y. q x y = 0}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
{x. p x \<in> A} = {x. \<exists>y. q x y = 0}

goal (1 subgoal):
 1. \<lbrakk>A \<in> ce_sets; p \<in> PrimRec1\<rbrakk> \<Longrightarrow> {x. p x \<in> A} \<in> ce_sets
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
{x. p x \<in> A} = {x. \<exists>y. q x y = 0}
[PROOF STEP]
have "{ x . p x \<in> A } = fn_to_set q"
[PROOF STATE]
proof (prove)
using this:
{x. p x \<in> A} = {x. \<exists>y. q x y = 0}

goal (1 subgoal):
 1. {x. p x \<in> A} = fn_to_set q
[PROOF STEP]
by (simp add: fn_to_set_def)
[PROOF STATE]
proof (state)
this:
{x. p x \<in> A} = fn_to_set q

goal (1 subgoal):
 1. \<lbrakk>A \<in> ce_sets; p \<in> PrimRec1\<rbrakk> \<Longrightarrow> {x. p x \<in> A} \<in> ce_sets
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
{x. p x \<in> A} = fn_to_set q

goal (1 subgoal):
 1. \<lbrakk>A \<in> ce_sets; p \<in> PrimRec1\<rbrakk> \<Longrightarrow> {x. p x \<in> A} \<in> ce_sets
[PROOF STEP]
from q_is_pr
[PROOF STATE]
proof (chain)
picking this:
q \<in> PrimRec2
[PROOF STEP]
have "fn_to_set q \<in> ce_sets"
[PROOF STATE]
proof (prove)
using this:
q \<in> PrimRec2

goal (1 subgoal):
 1. fn_to_set q \<in> ce_sets
[PROOF STEP]
by (rule ce_set_lm_1)
[PROOF STATE]
proof (state)
this:
fn_to_set q \<in> ce_sets

goal (1 subgoal):
 1. \<lbrakk>A \<in> ce_sets; p \<in> PrimRec1\<rbrakk> \<Longrightarrow> {x. p x \<in> A} \<in> ce_sets
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
{x. p x \<in> A} = fn_to_set q
fn_to_set q \<in> ce_sets
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
{x. p x \<in> A} = fn_to_set q
fn_to_set q \<in> ce_sets

goal (1 subgoal):
 1. {x. p x \<in> A} \<in> ce_sets
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
{x. p x \<in> A} \<in> ce_sets

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma ord0_Lim_ord0rel:
"\<forall>n. (f n, g n) \<in> ord0rel \<Longrightarrow> (ord0_Lim f, ord0_Lim g) \<in> ord0rel"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>n. (f n, g n) \<in> ord0rel \<Longrightarrow> (ord0_Lim f, ord0_Lim g) \<in> ord0rel
[PROOF STEP]
by (simp add: ord0rel_def ord0_Lim_le)


[STATEMENT]
lemma nn_integral_mult_bounded_inf:
  assumes f: "f \<in> borel_measurable M" "(\<integral>\<^sup>+x. f x \<partial>M) < \<infinity>" and c: "c \<noteq> \<infinity>" and ae: "AE x in M. g x \<le> c * f x"
  shows "(\<integral>\<^sup>+x. g x \<partial>M) < \<infinity>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. integral\<^sup>N M g < \<infinity>
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. integral\<^sup>N M g < \<infinity>
[PROOF STEP]
have "(\<integral>\<^sup>+x. g x \<partial>M) \<le> (\<integral>\<^sup>+x. c * f x \<partial>M)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. integral\<^sup>N M g \<le> \<integral>\<^sup>+ x. c * f x \<partial>M
[PROOF STEP]
by (intro nn_integral_mono_AE ae)
[PROOF STATE]
proof (state)
this:
integral\<^sup>N M g \<le> \<integral>\<^sup>+ x. c * f x \<partial>M

goal (1 subgoal):
 1. integral\<^sup>N M g < \<infinity>
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
integral\<^sup>N M g \<le> \<integral>\<^sup>+ x. c * f x \<partial>M

goal (1 subgoal):
 1. integral\<^sup>N M g < \<infinity>
[PROOF STEP]
have "(\<integral>\<^sup>+x. c * f x \<partial>M) < \<infinity>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<integral>\<^sup>+ x. c * f x \<partial>M < \<infinity>
[PROOF STEP]
using c f
[PROOF STATE]
proof (prove)
using this:
c \<noteq> \<infinity>
f \<in> borel_measurable M
integral\<^sup>N M f < \<infinity>

goal (1 subgoal):
 1. \<integral>\<^sup>+ x. c * f x \<partial>M < \<infinity>
[PROOF STEP]
by (subst nn_integral_cmult) (auto simp: ennreal_mult_less_top top_unique not_less)
[PROOF STATE]
proof (state)
this:
\<integral>\<^sup>+ x. c * f x \<partial>M < \<infinity>

goal (1 subgoal):
 1. integral\<^sup>N M g < \<infinity>
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
integral\<^sup>N M g < \<infinity>
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
integral\<^sup>N M g < \<infinity>

goal (1 subgoal):
 1. integral\<^sup>N M g < \<infinity>
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
integral\<^sup>N M g < \<infinity>

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma emeasure_uniform_measure[simp]:
  assumes A: "A \<in> sets M" and B: "B \<in> sets M"
  shows "emeasure (uniform_measure M A) B = emeasure M (A \<inter> B) / emeasure M A"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. emeasure (uniform_measure M A) B = emeasure M (A \<inter> B) / emeasure M A
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. emeasure (uniform_measure M A) B = emeasure M (A \<inter> B) / emeasure M A
[PROOF STEP]
from A B
[PROOF STATE]
proof (chain)
picking this:
A \<in> sets M
B \<in> sets M
[PROOF STEP]
have "emeasure (uniform_measure M A) B = (\<integral>\<^sup>+x. (1 / emeasure M A) * indicator (A \<inter> B) x \<partial>M)"
[PROOF STATE]
proof (prove)
using this:
A \<in> sets M
B \<in> sets M

goal (1 subgoal):
 1. emeasure (uniform_measure M A) B = \<integral>\<^sup>+ x. 1 / emeasure M A * indicator (A \<inter> B) x \<partial>M
[PROOF STEP]
by (auto simp add: uniform_measure_def emeasure_density divide_ennreal_def split: split_indicator
             intro!: nn_integral_cong)
[PROOF STATE]
proof (state)
this:
emeasure (uniform_measure M A) B = \<integral>\<^sup>+ x. 1 / emeasure M A * indicator (A \<inter> B) x \<partial>M

goal (1 subgoal):
 1. emeasure (uniform_measure M A) B = emeasure M (A \<inter> B) / emeasure M A
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
emeasure (uniform_measure M A) B = \<integral>\<^sup>+ x. 1 / emeasure M A * indicator (A \<inter> B) x \<partial>M

goal (1 subgoal):
 1. emeasure (uniform_measure M A) B = emeasure M (A \<inter> B) / emeasure M A
[PROOF STEP]
have "\<dots> = emeasure M (A \<inter> B) / emeasure M A"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<integral>\<^sup>+ x. 1 / emeasure M A * indicator (A \<inter> B) x \<partial>M = emeasure M (A \<inter> B) / emeasure M A
[PROOF STEP]
using A B
[PROOF STATE]
proof (prove)
using this:
A \<in> sets M
B \<in> sets M

goal (1 subgoal):
 1. \<integral>\<^sup>+ x. 1 / emeasure M A * indicator (A \<inter> B) x \<partial>M = emeasure M (A \<inter> B) / emeasure M A
[PROOF STEP]
by (subst nn_integral_cmult_indicator) (simp_all add: sets.Int divide_ennreal_def mult.commute)
[PROOF STATE]
proof (state)
this:
\<integral>\<^sup>+ x. 1 / emeasure M A * indicator (A \<inter> B) x \<partial>M = emeasure M (A \<inter> B) / emeasure M A

goal (1 subgoal):
 1. emeasure (uniform_measure M A) B = emeasure M (A \<inter> B) / emeasure M A
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
emeasure (uniform_measure M A) B = emeasure M (A \<inter> B) / emeasure M A
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
emeasure (uniform_measure M A) B = emeasure M (A \<inter> B) / emeasure M A

goal (1 subgoal):
 1. emeasure (uniform_measure M A) B = emeasure M (A \<inter> B) / emeasure M A
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
emeasure (uniform_measure M A) B = emeasure M (A \<inter> B) / emeasure M A

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma closedin_Hausdorff_finite_eq:
   "\<lbrakk>Hausdorff_space X; finite S\<rbrakk> \<Longrightarrow> closedin X S \<longleftrightarrow> S \<subseteq> topspace X"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Hausdorff_space X; finite S\<rbrakk> \<Longrightarrow> closedin X S = (S \<subseteq> topspace X)
[PROOF STEP]
by (meson closedin_Hausdorff_finite closedin_def)


[STATEMENT]
lemma poly_div:
  assumes "poly q x \<noteq> 0" and "(q::'a :: field poly) dvd p"
  shows "poly (p div q) x = poly p x / poly q x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. poly (p div q) x = poly p x / poly q x
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. poly (p div q) x = poly p x / poly q x
[PROOF STEP]
from assms
[PROOF STATE]
proof (chain)
picking this:
poly q x \<noteq> (0::'a)
q dvd p
[PROOF STEP]
have [simp]: "q \<noteq> 0"
[PROOF STATE]
proof (prove)
using this:
poly q x \<noteq> (0::'a)
q dvd p

goal (1 subgoal):
 1. q \<noteq> 0
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
q \<noteq> 0

goal (1 subgoal):
 1. poly (p div q) x = poly p x / poly q x
[PROOF STEP]
have "poly q x * poly (p div q) x = poly (q * (p div q)) x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. poly q x * poly (p div q) x = poly (q * (p div q)) x
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
poly q x * poly (p div q) x = poly (q * (p div q)) x

goal (1 subgoal):
 1. poly (p div q) x = poly p x / poly q x
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
poly q x * poly (p div q) x = poly (q * (p div q)) x

goal (1 subgoal):
 1. poly (p div q) x = poly p x / poly q x
[PROOF STEP]
have "q * (p div q) = p"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. q * (p div q) = p
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
poly q x \<noteq> (0::'a)
q dvd p

goal (1 subgoal):
 1. q * (p div q) = p
[PROOF STEP]
by (simp add: div_mult_swap)
[PROOF STATE]
proof (state)
this:
q * (p div q) = p

goal (1 subgoal):
 1. poly (p div q) x = poly p x / poly q x
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
poly q x * poly (p div q) x = poly p x
[PROOF STEP]
show "poly (p div q) x = poly p x / poly q x"
[PROOF STATE]
proof (prove)
using this:
poly q x * poly (p div q) x = poly p x

goal (1 subgoal):
 1. poly (p div q) x = poly p x / poly q x
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
poly q x * poly (p div q) x = poly p x
poly q x \<noteq> (0::'a)
q dvd p

goal (1 subgoal):
 1. poly (p div q) x = poly p x / poly q x
[PROOF STEP]
by (simp add: field_simps)
[PROOF STATE]
proof (state)
this:
poly (p div q) x = poly p x / poly q x

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma upright_sum_upright: "finite X \<Longrightarrow> \<forall>x. upright (A x) \<Longrightarrow> upright (\<Sum>x\<in>X. A x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>finite X; \<forall>x. upright (A x)\<rbrakk> \<Longrightarrow> upright (sum A X)
[PROOF STEP]
by (induct X rule: finite_induct) (auto simp: upright_0 upright_vec_add)


[STATEMENT]
lemma takeWhile_takes_all: "length xs = m \<Longrightarrow> m \<le> length (takeWhile P xs) \<longleftrightarrow> Ball (set xs) P"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. length xs = m \<Longrightarrow> (m \<le> length (takeWhile P xs)) = Ball (set xs) P
[PROOF STEP]
by hypsubst_thin (induct xs, auto)


[STATEMENT]
lemma ev_HLD_sset: "ev (HLD A) w \<longleftrightarrow> sset w \<inter> A \<noteq> {}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ev (HLD A) w = (sset w \<inter> A \<noteq> {})
[PROOF STEP]
unfolding HLD_def ev_holds_sset
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<exists>x\<in>sset w. x \<in> A) = (sset w \<inter> A \<noteq> {})
[PROOF STEP]
by auto


[STATEMENT]
lemma degree_div:
  fixes p q::"('a::idom_divide) poly"
  assumes "q dvd p"
  shows "degree (p div q) = degree p - degree q"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. degree (p div q) = degree p - degree q
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
q dvd p

goal (1 subgoal):
 1. degree (p div q) = degree p - degree q
[PROOF STEP]
by (metis (no_types, lifting) add_diff_cancel_left' degree_0 degree_mult_eq
      diff_add_zero diff_zero div_by_0 dvd_div_eq_0_iff dvd_mult_div_cancel)


[STATEMENT]
lemma zero_less_oFix_eq: "(0 < oFix F 0) = (0 < F 0)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (0 < oFix F 0) = (0 < F 0)
[PROOF STEP]
apply (safe)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. 0 < oFix F 0 \<Longrightarrow> 0 < F 0
 2. 0 < F 0 \<Longrightarrow> 0 < oFix F 0
[PROOF STEP]
apply (erule contrapos_pp)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<not> 0 < F 0 \<Longrightarrow> \<not> 0 < oFix F 0
 2. 0 < F 0 \<Longrightarrow> 0 < oFix F 0
[PROOF STEP]
apply (simp only: linorder_not_less oFix_def)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. F 0 \<le> 0 \<Longrightarrow> oLimit (\<lambda>n. iter n F 0) \<le> 0
 2. 0 < F 0 \<Longrightarrow> 0 < oFix F 0
[PROOF STEP]
apply (rule oLimit_leI[rule_format])
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>n. F 0 \<le> 0 \<Longrightarrow> iter n F 0 \<le> 0
 2. 0 < F 0 \<Longrightarrow> 0 < oFix F 0
[PROOF STEP]
apply (induct_tac n, simp, simp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 < F 0 \<Longrightarrow> 0 < oFix F 0
[PROOF STEP]
apply (erule less_oFixI)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma incoming_s_empty[simp]: "incoming s = {}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. incoming s = {}
[PROOF STEP]
unfolding incoming_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {(u, s) |u. (u, s) \<in> E} = {}
[PROOF STEP]
using no_incoming_s
[PROOF STATE]
proof (prove)
using this:
\<forall>u. (u, s) \<notin> E

goal (1 subgoal):
 1. {(u, s) |u. (u, s) \<in> E} = {}
[PROOF STEP]
by auto


[STATEMENT]
lemma exp_lower_taylor_3:
  fixes x::real
  shows "1 + x + (1/2)*x^2 + (1/6)*x^3 + (1/24)*x^4 + (1/120)*x^5 \<le> exp x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 1 + x + 1 / 2 * x\<^sup>2 + 1 / 6 * x ^ 3 + 1 / 24 * x ^ 4 + 1 / 120 * x ^ 5 \<le> exp x
[PROOF STEP]
by (rule order_trans [OF _ exp_lower_taylor_even [of 6]])
     (auto simp: lessThan_nat_numeral fact_numeral)


[STATEMENT]
lemma incseq_nn_integral:
  assumes "incseq f" shows "incseq (\<lambda>i. integral\<^sup>N M (f i))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. incseq (\<lambda>i. integral\<^sup>N M (f i))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. incseq (\<lambda>i. integral\<^sup>N M (f i))
[PROOF STEP]
have "\<And>i x. f i x \<le> f (Suc i) x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>i x. f i x \<le> f (Suc i) x
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
incseq f

goal (1 subgoal):
 1. \<And>i x. f i x \<le> f (Suc i) x
[PROOF STEP]
by (auto dest!: incseq_SucD simp: le_fun_def)
[PROOF STATE]
proof (state)
this:
f ?i ?x \<le> f (Suc ?i) ?x

goal (1 subgoal):
 1. incseq (\<lambda>i. integral\<^sup>N M (f i))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
f ?i ?x \<le> f (Suc ?i) ?x
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
f ?i ?x \<le> f (Suc ?i) ?x

goal (1 subgoal):
 1. incseq (\<lambda>i. integral\<^sup>N M (f i))
[PROOF STEP]
by (auto intro!: incseq_SucI nn_integral_mono)
[PROOF STATE]
proof (state)
this:
incseq (\<lambda>i. integral\<^sup>N M (f i))

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma (in Module) sc_minus_am:"\<lbrakk>a \<in> carrier R; m \<in> carrier M\<rbrakk>
                     \<Longrightarrow> -\<^sub>a (a \<cdot>\<^sub>s m) = a \<cdot>\<^sub>s (-\<^sub>a m)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>a \<in> carrier R; m \<in> carrier M\<rbrakk> \<Longrightarrow> -\<^sub>a a \<cdot>\<^sub>s m = a \<cdot>\<^sub>s (-\<^sub>a m)
[PROOF STEP]
apply (frule ag_mOp_closed [of m],
       frule sc_r_distr[of a m "-\<^sub>a m"], assumption+,
       simp add:ag_r_inv1,
       simp add:sc_a_0, frule sym,
       thin_tac "\<zero> = a \<cdot>\<^sub>s m \<plusminus> a \<cdot>\<^sub>s (-\<^sub>a m)")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>a \<in> carrier R; m \<in> carrier M; -\<^sub>a m \<in> carrier M; a \<cdot>\<^sub>s m \<plusminus> a \<cdot>\<^sub>s (-\<^sub>a m) = \<zero>\<rbrakk> \<Longrightarrow> -\<^sub>a a \<cdot>\<^sub>s m = a \<cdot>\<^sub>s (-\<^sub>a m)
[PROOF STEP]
apply (frule sc_mem [of a m], assumption+,
        frule sc_mem [of a "-\<^sub>a m"], assumption+,
        frule ag_eq_sol1 [of "a \<cdot>\<^sub>s m" "a \<cdot>\<^sub>s (-\<^sub>a m)" "\<zero>"], assumption+,
        simp add:ag_inc_zero, assumption)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>a \<in> carrier R; m \<in> carrier M; -\<^sub>a m \<in> carrier M; a \<cdot>\<^sub>s m \<plusminus> a \<cdot>\<^sub>s (-\<^sub>a m) = \<zero>; a \<cdot>\<^sub>s m \<in> carrier M; a \<cdot>\<^sub>s (-\<^sub>a m) \<in> carrier M; a \<cdot>\<^sub>s (-\<^sub>a m) = -\<^sub>a a \<cdot>\<^sub>s m \<plusminus> \<zero>\<rbrakk> \<Longrightarrow> -\<^sub>a a \<cdot>\<^sub>s m = a \<cdot>\<^sub>s (-\<^sub>a m)
[PROOF STEP]
apply (frule ag_mOp_closed [of "a \<cdot>\<^sub>s m"],
        simp add:ag_r_zero)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma remove_prefix_Some:
  assumes "remove_prefix xs ys = Some zs"
  shows "ys = xs @ zs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ys = xs @ zs
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
remove_prefix xs ys = Some zs

goal (1 subgoal):
 1. ys = xs @ zs
[PROOF STEP]
proof (induct xs arbitrary: ys)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>ys. remove_prefix [] ys = Some zs \<Longrightarrow> ys = [] @ zs
 2. \<And>a xs ys. \<lbrakk>\<And>ys. remove_prefix xs ys = Some zs \<Longrightarrow> ys = xs @ zs; remove_prefix (a # xs) ys = Some zs\<rbrakk> \<Longrightarrow> ys = (a # xs) @ zs
[PROOF STEP]
case (Cons x xs)
[PROOF STATE]
proof (state)
this:
remove_prefix xs ?ys = Some zs \<Longrightarrow> ?ys = xs @ zs
remove_prefix (x # xs) ys = Some zs

goal (2 subgoals):
 1. \<And>ys. remove_prefix [] ys = Some zs \<Longrightarrow> ys = [] @ zs
 2. \<And>a xs ys. \<lbrakk>\<And>ys. remove_prefix xs ys = Some zs \<Longrightarrow> ys = xs @ zs; remove_prefix (a # xs) ys = Some zs\<rbrakk> \<Longrightarrow> ys = (a # xs) @ zs
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ys = (x # xs) @ zs
[PROOF STEP]
using Cons(1)[of "tl ys"] Cons(2)
[PROOF STATE]
proof (prove)
using this:
remove_prefix xs (tl ys) = Some zs \<Longrightarrow> tl ys = xs @ zs
remove_prefix (x # xs) ys = Some zs

goal (1 subgoal):
 1. ys = (x # xs) @ zs
[PROOF STEP]
by (cases ys) (auto split: if_splits)
[PROOF STATE]
proof (state)
this:
ys = (x # xs) @ zs

goal (1 subgoal):
 1. \<And>ys. remove_prefix [] ys = Some zs \<Longrightarrow> ys = [] @ zs
[PROOF STEP]
qed auto


[STATEMENT]
theorem union_sets_2:
  "VARS p r s
  [ union_sets_precondition p x y \<and> p0 = p ]
  r := find_set p x;
  p := path_compression p x r;
  s := find_set p y;
  p := path_compression p y s;
  p[r] := s
  [ union_sets_postcondition p x y p0 ]"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. [union_sets_precondition p x y \<and> p0 = p]
r := find_set p x; p := path_compression p x r; s := find_set p y; p := path_compression p y s; p := (p[r\<longmapsto>s])
[union_sets_postcondition p x y p0]
[PROOF STEP]
proof vcg_tc_simp
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. union_sets_precondition p0 x y \<Longrightarrow> union_sets_postcondition (path_compression (path_compression p0 x (find_set p0 x)) y (find_set (path_compression p0 x (find_set p0 x)) y)[find_set p0 x\<longmapsto>find_set (path_compression p0 x (find_set p0 x)) y]) x y p0
[PROOF STEP]
let ?r = "find_set p0 x"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. union_sets_precondition p0 x y \<Longrightarrow> union_sets_postcondition (path_compression (path_compression p0 x (find_set p0 x)) y (find_set (path_compression p0 x (find_set p0 x)) y)[find_set p0 x\<longmapsto>find_set (path_compression p0 x (find_set p0 x)) y]) x y p0
[PROOF STEP]
let ?p1 = "path_compression p0 x ?r"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. union_sets_precondition p0 x y \<Longrightarrow> union_sets_postcondition (path_compression (path_compression p0 x (find_set p0 x)) y (find_set (path_compression p0 x (find_set p0 x)) y)[find_set p0 x\<longmapsto>find_set (path_compression p0 x (find_set p0 x)) y]) x y p0
[PROOF STEP]
let ?s = "find_set ?p1 y"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. union_sets_precondition p0 x y \<Longrightarrow> union_sets_postcondition (path_compression (path_compression p0 x (find_set p0 x)) y (find_set (path_compression p0 x (find_set p0 x)) y)[find_set p0 x\<longmapsto>find_set (path_compression p0 x (find_set p0 x)) y]) x y p0
[PROOF STEP]
let ?p2 = "path_compression ?p1 y ?s"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. union_sets_precondition p0 x y \<Longrightarrow> union_sets_postcondition (path_compression (path_compression p0 x (find_set p0 x)) y (find_set (path_compression p0 x (find_set p0 x)) y)[find_set p0 x\<longmapsto>find_set (path_compression p0 x (find_set p0 x)) y]) x y p0
[PROOF STEP]
assume 1: "union_sets_precondition p0 x y"
[PROOF STATE]
proof (state)
this:
union_sets_precondition p0 x y

goal (1 subgoal):
 1. union_sets_precondition p0 x y \<Longrightarrow> union_sets_postcondition (path_compression (path_compression p0 x (find_set p0 x)) y (find_set (path_compression p0 x (find_set p0 x)) y)[find_set p0 x\<longmapsto>find_set (path_compression p0 x (find_set p0 x)) y]) x y p0
[PROOF STEP]
hence 2: "path_compression_postcondition ?p1 x ?r p0"
[PROOF STATE]
proof (prove)
using this:
union_sets_precondition p0 x y

goal (1 subgoal):
 1. path_compression_postcondition (path_compression p0 x (find_set p0 x)) x (find_set p0 x) p0
[PROOF STEP]
using find_set_function find_set_postcondition_def find_set_precondition_def path_compression_function path_compression_precondition_def union_sets_precondition_def
[PROOF STATE]
proof (prove)
using this:
union_sets_precondition p0 x y
\<lbrakk>find_set_precondition ?p ?x; ?y = find_set ?p ?x\<rbrakk> \<Longrightarrow> find_set_postcondition ?p ?x ?y
find_set_postcondition ?p ?x ?y \<equiv> point ?y \<and> ?y = root ?p ?x
find_set_precondition ?p ?x \<equiv> ((coreflexive (?p[[?p]]) \<and> times_top_class.total ?p) \<and> pd_kleene_allegory_class.acyclic (?p - (1::'a))) \<and> point ?x
\<lbrakk>path_compression_precondition ?p ?x ?y; ?p' = path_compression ?p ?x ?y\<rbrakk> \<Longrightarrow> path_compression_postcondition ?p' ?x ?y ?p
path_compression_precondition ?p ?x ?y \<equiv> ((coreflexive (?p[[?p]]) \<and> times_top_class.total ?p) \<and> pd_kleene_allegory_class.acyclic (?p - (1::'a))) \<and> point ?x \<and> point ?y \<and> ?y = root ?p ?x
union_sets_precondition ?p ?x ?y \<equiv> ((coreflexive (?p[[?p]]) \<and> times_top_class.total ?p) \<and> pd_kleene_allegory_class.acyclic (?p - (1::'a))) \<and> point ?x \<and> point ?y

goal (1 subgoal):
 1. path_compression_postcondition (path_compression p0 x (find_set p0 x)) x (find_set p0 x) p0
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
path_compression_postcondition (path_compression p0 x (find_set p0 x)) x (find_set p0 x) p0

goal (1 subgoal):
 1. union_sets_precondition p0 x y \<Longrightarrow> union_sets_postcondition (path_compression (path_compression p0 x (find_set p0 x)) y (find_set (path_compression p0 x (find_set p0 x)) y)[find_set p0 x\<longmapsto>find_set (path_compression p0 x (find_set p0 x)) y]) x y p0
[PROOF STEP]
hence "path_compression_postcondition ?p2 y ?s ?p1"
[PROOF STATE]
proof (prove)
using this:
path_compression_postcondition (path_compression p0 x (find_set p0 x)) x (find_set p0 x) p0

goal (1 subgoal):
 1. path_compression_postcondition (path_compression (path_compression p0 x (find_set p0 x)) y (find_set (path_compression p0 x (find_set p0 x)) y)) y (find_set (path_compression p0 x (find_set p0 x)) y) (path_compression p0 x (find_set p0 x))
[PROOF STEP]
using 1 find_set_function find_set_postcondition_def find_set_precondition_def path_compression_function path_compression_precondition_def union_sets_precondition_def path_compression_postcondition_def
[PROOF STATE]
proof (prove)
using this:
path_compression_postcondition (path_compression p0 x (find_set p0 x)) x (find_set p0 x) p0
union_sets_precondition p0 x y
\<lbrakk>find_set_precondition ?p ?x; ?y = find_set ?p ?x\<rbrakk> \<Longrightarrow> find_set_postcondition ?p ?x ?y
find_set_postcondition ?p ?x ?y \<equiv> point ?y \<and> ?y = root ?p ?x
find_set_precondition ?p ?x \<equiv> ((coreflexive (?p[[?p]]) \<and> times_top_class.total ?p) \<and> pd_kleene_allegory_class.acyclic (?p - (1::'a))) \<and> point ?x
\<lbrakk>path_compression_precondition ?p ?x ?y; ?p' = path_compression ?p ?x ?y\<rbrakk> \<Longrightarrow> path_compression_postcondition ?p' ?x ?y ?p
path_compression_precondition ?p ?x ?y \<equiv> ((coreflexive (?p[[?p]]) \<and> times_top_class.total ?p) \<and> pd_kleene_allegory_class.acyclic (?p - (1::'a))) \<and> point ?x \<and> point ?y \<and> ?y = root ?p ?x
union_sets_precondition ?p ?x ?y \<equiv> ((coreflexive (?p[[?p]]) \<and> times_top_class.total ?p) \<and> pd_kleene_allegory_class.acyclic (?p - (1::'a))) \<and> point ?x \<and> point ?y
path_compression_postcondition ?p ?x ?y ?p0.0 \<equiv> path_compression_precondition ?p ?x ?y \<and> ?p \<sqinter> (1::'a) = ?p0.0 \<sqinter> (1::'a) \<and> fc ?p = fc ?p0.0 \<and> ?p0.0[?p0.0\<^sup>T\<^sup>\<star> * ?x\<longmapsto>?y] = ?p

goal (1 subgoal):
 1. path_compression_postcondition (path_compression (path_compression p0 x (find_set p0 x)) y (find_set (path_compression p0 x (find_set p0 x)) y)) y (find_set (path_compression p0 x (find_set p0 x)) y) (path_compression p0 x (find_set p0 x))
[PROOF STEP]
by meson
[PROOF STATE]
proof (state)
this:
path_compression_postcondition (path_compression (path_compression p0 x (find_set p0 x)) y (find_set (path_compression p0 x (find_set p0 x)) y)) y (find_set (path_compression p0 x (find_set p0 x)) y) (path_compression p0 x (find_set p0 x))

goal (1 subgoal):
 1. union_sets_precondition p0 x y \<Longrightarrow> union_sets_postcondition (path_compression (path_compression p0 x (find_set p0 x)) y (find_set (path_compression p0 x (find_set p0 x)) y)[find_set p0 x\<longmapsto>find_set (path_compression p0 x (find_set p0 x)) y]) x y p0
[PROOF STEP]
thus "union_sets_postcondition (?p2[?r\<longmapsto>?s]) x y p0"
[PROOF STATE]
proof (prove)
using this:
path_compression_postcondition (path_compression (path_compression p0 x (find_set p0 x)) y (find_set (path_compression p0 x (find_set p0 x)) y)) y (find_set (path_compression p0 x (find_set p0 x)) y) (path_compression p0 x (find_set p0 x))

goal (1 subgoal):
 1. union_sets_postcondition (path_compression (path_compression p0 x (find_set p0 x)) y (find_set (path_compression p0 x (find_set p0 x)) y)[find_set p0 x\<longmapsto>find_set (path_compression p0 x (find_set p0 x)) y]) x y p0
[PROOF STEP]
using 1 2
[PROOF STATE]
proof (prove)
using this:
path_compression_postcondition (path_compression (path_compression p0 x (find_set p0 x)) y (find_set (path_compression p0 x (find_set p0 x)) y)) y (find_set (path_compression p0 x (find_set p0 x)) y) (path_compression p0 x (find_set p0 x))
union_sets_precondition p0 x y
path_compression_postcondition (path_compression p0 x (find_set p0 x)) x (find_set p0 x) p0

goal (1 subgoal):
 1. union_sets_postcondition (path_compression (path_compression p0 x (find_set p0 x)) y (find_set (path_compression p0 x (find_set p0 x)) y)[find_set p0 x\<longmapsto>find_set (path_compression p0 x (find_set p0 x)) y]) x y p0
[PROOF STEP]
by (simp add: union_sets_1)
[PROOF STATE]
proof (state)
this:
union_sets_postcondition (path_compression (path_compression p0 x (find_set p0 x)) y (find_set (path_compression p0 x (find_set p0 x)) y)[find_set p0 x\<longmapsto>find_set (path_compression p0 x (find_set p0 x)) y]) x y p0

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma distinct_if_distinct_map: "distinct (map f xs) \<Longrightarrow> distinct xs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. distinct (map f xs) \<Longrightarrow> distinct xs
[PROOF STEP]
using inj_on
[PROOF STATE]
proof (prove)
using this:
inj_on f S

goal (1 subgoal):
 1. distinct (map f xs) \<Longrightarrow> distinct xs
[PROOF STEP]
by (simp add: distinct_map)


[STATEMENT]
theorem tree_enum_distinct: "distinct(tree_enum n)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. distinct (tree_enum n)
[PROOF STEP]
proof(induct n rule: tree_enum.induct)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. distinct (tree_enum 0)
 2. \<And>n. \<lbrakk>\<And>x. x \<in> set [0..<Suc n] \<Longrightarrow> distinct (tree_enum x); \<And>x xa. \<lbrakk>x \<in> set [0..<Suc n]; xa \<in> set (tree_enum x)\<rbrakk> \<Longrightarrow> distinct (tree_enum (n - x))\<rbrakk> \<Longrightarrow> distinct (tree_enum (Suc n))
[PROOF STEP]
case 1
[PROOF STATE]
proof (state)
this:

goal (2 subgoals):
 1. distinct (tree_enum 0)
 2. \<And>n. \<lbrakk>\<And>x. x \<in> set [0..<Suc n] \<Longrightarrow> distinct (tree_enum x); \<And>x xa. \<lbrakk>x \<in> set [0..<Suc n]; xa \<in> set (tree_enum x)\<rbrakk> \<Longrightarrow> distinct (tree_enum (n - x))\<rbrakk> \<Longrightarrow> distinct (tree_enum (Suc n))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. distinct (tree_enum 0)
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
distinct (tree_enum 0)

goal (1 subgoal):
 1. \<And>n. \<lbrakk>\<And>x. x \<in> set [0..<Suc n] \<Longrightarrow> distinct (tree_enum x); \<And>x xa. \<lbrakk>x \<in> set [0..<Suc n]; xa \<in> set (tree_enum x)\<rbrakk> \<Longrightarrow> distinct (tree_enum (n - x))\<rbrakk> \<Longrightarrow> distinct (tree_enum (Suc n))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>n. \<lbrakk>\<And>x. x \<in> set [0..<Suc n] \<Longrightarrow> distinct (tree_enum x); \<And>x xa. \<lbrakk>x \<in> set [0..<Suc n]; xa \<in> set (tree_enum x)\<rbrakk> \<Longrightarrow> distinct (tree_enum (n - x))\<rbrakk> \<Longrightarrow> distinct (tree_enum (Suc n))
[PROOF STEP]
case (2 n)
[PROOF STATE]
proof (state)
this:
?x \<in> set [0..<Suc n] \<Longrightarrow> distinct (tree_enum ?x)
\<lbrakk>?x \<in> set [0..<Suc n]; ?xa \<in> set (tree_enum ?x)\<rbrakk> \<Longrightarrow> distinct (tree_enum (n - ?x))

goal (1 subgoal):
 1. \<And>n. \<lbrakk>\<And>x. x \<in> set [0..<Suc n] \<Longrightarrow> distinct (tree_enum x); \<And>x xa. \<lbrakk>x \<in> set [0..<Suc n]; xa \<in> set (tree_enum x)\<rbrakk> \<Longrightarrow> distinct (tree_enum (n - x))\<rbrakk> \<Longrightarrow> distinct (tree_enum (Suc n))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
?x \<in> set [0..<Suc n] \<Longrightarrow> distinct (tree_enum ?x)
\<lbrakk>?x \<in> set [0..<Suc n]; ?xa \<in> set (tree_enum ?x)\<rbrakk> \<Longrightarrow> distinct (tree_enum (n - ?x))
[PROOF STEP]
have Ir: "i < Suc n \<Longrightarrow> distinct (tree_enum i)" for i
[PROOF STATE]
proof (prove)
using this:
?x \<in> set [0..<Suc n] \<Longrightarrow> distinct (tree_enum ?x)
\<lbrakk>?x \<in> set [0..<Suc n]; ?xa \<in> set (tree_enum ?x)\<rbrakk> \<Longrightarrow> distinct (tree_enum (n - ?x))

goal (1 subgoal):
 1. i < Suc n \<Longrightarrow> distinct (tree_enum i)
[PROOF STEP]
by (metis atLeastLessThan_iff set_upt zero_le)
[PROOF STATE]
proof (state)
this:
?i < Suc n \<Longrightarrow> distinct (tree_enum ?i)

goal (1 subgoal):
 1. \<And>n. \<lbrakk>\<And>x. x \<in> set [0..<Suc n] \<Longrightarrow> distinct (tree_enum x); \<And>x xa. \<lbrakk>x \<in> set [0..<Suc n]; xa \<in> set (tree_enum x)\<rbrakk> \<Longrightarrow> distinct (tree_enum (n - x))\<rbrakk> \<Longrightarrow> distinct (tree_enum (Suc n))
[PROOF STEP]
have c1: "distinct (concat (map (\<lambda>i. [\<langle>l, (), r\<rangle>. l \<leftarrow> tree_enum i, r \<leftarrow> tree_enum (n-i)]) [0..<n]))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. distinct (concat (map (\<lambda>i. concat (map (\<lambda>l. map (Node l ()) (tree_enum (n - i))) (tree_enum i))) [0..<n]))
[PROOF STEP]
proof(rule distinct_concat)
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. distinct (map (\<lambda>i. concat (map (\<lambda>l. map (Node l ()) (tree_enum (n - i))) (tree_enum i))) [0..<n])
 2. \<And>ys. ys \<in> set (map (\<lambda>i. concat (map (\<lambda>l. map (Node l ()) (tree_enum (n - i))) (tree_enum i))) [0..<n]) \<Longrightarrow> distinct ys
 3. \<And>ys zs. \<lbrakk>ys \<in> set (map (\<lambda>i. concat (map (\<lambda>l. map (Node l ()) (tree_enum (n - i))) (tree_enum i))) [0..<n]); zs \<in> set (map (\<lambda>i. concat (map (\<lambda>l. map (Node l ()) (tree_enum (n - i))) (tree_enum i))) [0..<n]); ys \<noteq> zs\<rbrakk> \<Longrightarrow> set ys \<inter> set zs = {}
[PROOF STEP]
show "distinct (map (\<lambda>i. [\<langle>l, (), r\<rangle>. l \<leftarrow> tree_enum i, r \<leftarrow> tree_enum (n-i)]) [0..<n])"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. distinct (map (\<lambda>i. concat (map (\<lambda>l. map (Node l ()) (tree_enum (n - i))) (tree_enum i))) [0..<n])
[PROOF STEP]
apply(rule tree_enum_distinct_aux_outer)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<forall>i\<le>n. distinct (tree_enum i)
 2. distinct [0..<n]
 3. \<forall>i\<in>set [0..<n]. i < n
 4. sorted_wrt (<) [0..<n]
[PROOF STEP]
using Ir
[PROOF STATE]
proof (prove)
using this:
?i < Suc n \<Longrightarrow> distinct (tree_enum ?i)

goal (4 subgoals):
 1. \<forall>i\<le>n. distinct (tree_enum i)
 2. distinct [0..<n]
 3. \<forall>i\<in>set [0..<n]. i < n
 4. sorted_wrt (<) [0..<n]
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
distinct (map (\<lambda>i. concat (map (\<lambda>l. map (Node l ()) (tree_enum (n - i))) (tree_enum i))) [0..<n])

goal (2 subgoals):
 1. \<And>ys. ys \<in> set (map (\<lambda>i. concat (map (\<lambda>l. map (Node l ()) (tree_enum (n - i))) (tree_enum i))) [0..<n]) \<Longrightarrow> distinct ys
 2. \<And>ys zs. \<lbrakk>ys \<in> set (map (\<lambda>i. concat (map (\<lambda>l. map (Node l ()) (tree_enum (n - i))) (tree_enum i))) [0..<n]); zs \<in> set (map (\<lambda>i. concat (map (\<lambda>l. map (Node l ()) (tree_enum (n - i))) (tree_enum i))) [0..<n]); ys \<noteq> zs\<rbrakk> \<Longrightarrow> set ys \<inter> set zs = {}
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>ys. ys \<in> set (map (\<lambda>i. concat (map (\<lambda>l. map (Node l ()) (tree_enum (n - i))) (tree_enum i))) [0..<n]) \<Longrightarrow> distinct ys
 2. \<And>ys zs. \<lbrakk>ys \<in> set (map (\<lambda>i. concat (map (\<lambda>l. map (Node l ()) (tree_enum (n - i))) (tree_enum i))) [0..<n]); zs \<in> set (map (\<lambda>i. concat (map (\<lambda>l. map (Node l ()) (tree_enum (n - i))) (tree_enum i))) [0..<n]); ys \<noteq> zs\<rbrakk> \<Longrightarrow> set ys \<inter> set zs = {}
[PROOF STEP]
have "\<And>x. x < n \<Longrightarrow> distinct ([\<langle>l, (), r\<rangle>. l \<leftarrow> tree_enum x, r \<leftarrow> tree_enum (n-x)])"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. x < n \<Longrightarrow> distinct (concat (map (\<lambda>l. map (Node l ()) (tree_enum (n - x))) (tree_enum x)))
[PROOF STEP]
using Ir
[PROOF STATE]
proof (prove)
using this:
?i < Suc n \<Longrightarrow> distinct (tree_enum ?i)

goal (1 subgoal):
 1. \<And>x. x < n \<Longrightarrow> distinct (concat (map (\<lambda>l. map (Node l ()) (tree_enum (n - x))) (tree_enum x)))
[PROOF STEP]
by (simp add: Node_right_distinct_concat_map)
[PROOF STATE]
proof (state)
this:
?x < n \<Longrightarrow> distinct (concat (map (\<lambda>l. map (Node l ()) (tree_enum (n - ?x))) (tree_enum ?x)))

goal (2 subgoals):
 1. \<And>ys. ys \<in> set (map (\<lambda>i. concat (map (\<lambda>l. map (Node l ()) (tree_enum (n - i))) (tree_enum i))) [0..<n]) \<Longrightarrow> distinct ys
 2. \<And>ys zs. \<lbrakk>ys \<in> set (map (\<lambda>i. concat (map (\<lambda>l. map (Node l ()) (tree_enum (n - i))) (tree_enum i))) [0..<n]); zs \<in> set (map (\<lambda>i. concat (map (\<lambda>l. map (Node l ()) (tree_enum (n - i))) (tree_enum i))) [0..<n]); ys \<noteq> zs\<rbrakk> \<Longrightarrow> set ys \<inter> set zs = {}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
?x < n \<Longrightarrow> distinct (concat (map (\<lambda>l. map (Node l ()) (tree_enum (n - ?x))) (tree_enum ?x)))
[PROOF STEP]
show "\<And>ys. ys \<in> set (map (\<lambda>i. [\<langle>l, (), r\<rangle>. l \<leftarrow> tree_enum i, r \<leftarrow> tree_enum (n-i)]) [0..<n]) \<Longrightarrow> distinct ys"
[PROOF STATE]
proof (prove)
using this:
?x < n \<Longrightarrow> distinct (concat (map (\<lambda>l. map (Node l ()) (tree_enum (n - ?x))) (tree_enum ?x)))

goal (1 subgoal):
 1. \<And>ys. ys \<in> set (map (\<lambda>i. concat (map (\<lambda>l. map (Node l ()) (tree_enum (n - i))) (tree_enum i))) [0..<n]) \<Longrightarrow> distinct ys
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
?ys \<in> set (map (\<lambda>i. concat (map (\<lambda>l. map (Node l ()) (tree_enum (n - i))) (tree_enum i))) [0..<n]) \<Longrightarrow> distinct ?ys

goal (1 subgoal):
 1. \<And>ys zs. \<lbrakk>ys \<in> set (map (\<lambda>i. concat (map (\<lambda>l. map (Node l ()) (tree_enum (n - i))) (tree_enum i))) [0..<n]); zs \<in> set (map (\<lambda>i. concat (map (\<lambda>l. map (Node l ()) (tree_enum (n - i))) (tree_enum i))) [0..<n]); ys \<noteq> zs\<rbrakk> \<Longrightarrow> set ys \<inter> set zs = {}
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>ys zs. \<lbrakk>ys \<in> set (map (\<lambda>i. concat (map (\<lambda>l. map (Node l ()) (tree_enum (n - i))) (tree_enum i))) [0..<n]); zs \<in> set (map (\<lambda>i. concat (map (\<lambda>l. map (Node l ()) (tree_enum (n - i))) (tree_enum i))) [0..<n]); ys \<noteq> zs\<rbrakk> \<Longrightarrow> set ys \<inter> set zs = {}
[PROOF STEP]
have "\<lbrakk>[\<langle>l, (), r\<rangle>. l \<leftarrow> tree_enum x, r \<leftarrow> tree_enum (n-x)] \<noteq>
        [\<langle>l, (), r\<rangle>. l \<leftarrow> tree_enum z, r \<leftarrow> tree_enum (n-z)];
        y \<in> set (tree_enum x); y \<in> set (tree_enum z)\<rbrakk>
       \<Longrightarrow> False" for x z y
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>concat (map (\<lambda>l. map (Node l ()) (tree_enum (n - x))) (tree_enum x)) \<noteq> concat (map (\<lambda>l. map (Node l ()) (tree_enum (n - z))) (tree_enum z)); y \<in> set (tree_enum x); y \<in> set (tree_enum z)\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
using tree_enum_elem_injective2
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?x \<in> set (tree_enum ?n); ?y \<in> set (tree_enum ?m); ?x = ?y\<rbrakk> \<Longrightarrow> ?n = ?m

goal (1 subgoal):
 1. \<lbrakk>concat (map (\<lambda>l. map (Node l ()) (tree_enum (n - x))) (tree_enum x)) \<noteq> concat (map (\<lambda>l. map (Node l ()) (tree_enum (n - z))) (tree_enum z)); y \<in> set (tree_enum x); y \<in> set (tree_enum z)\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<lbrakk>concat (map (\<lambda>l. map (Node l ()) (tree_enum (n - ?x))) (tree_enum ?x)) \<noteq> concat (map (\<lambda>l. map (Node l ()) (tree_enum (n - ?z))) (tree_enum ?z)); ?y \<in> set (tree_enum ?x); ?y \<in> set (tree_enum ?z)\<rbrakk> \<Longrightarrow> False

goal (1 subgoal):
 1. \<And>ys zs. \<lbrakk>ys \<in> set (map (\<lambda>i. concat (map (\<lambda>l. map (Node l ()) (tree_enum (n - i))) (tree_enum i))) [0..<n]); zs \<in> set (map (\<lambda>i. concat (map (\<lambda>l. map (Node l ()) (tree_enum (n - i))) (tree_enum i))) [0..<n]); ys \<noteq> zs\<rbrakk> \<Longrightarrow> set ys \<inter> set zs = {}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>concat (map (\<lambda>l. map (Node l ()) (tree_enum (n - ?x))) (tree_enum ?x)) \<noteq> concat (map (\<lambda>l. map (Node l ()) (tree_enum (n - ?z))) (tree_enum ?z)); ?y \<in> set (tree_enum ?x); ?y \<in> set (tree_enum ?z)\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
show  "\<And>ys zs.
       \<lbrakk>ys \<in> set (map (\<lambda>i. [\<langle>l, (), r\<rangle>. l \<leftarrow> tree_enum i, r \<leftarrow> tree_enum (n-i)]) [0..<n]);
        zs \<in> set (map (\<lambda>i. [\<langle>l, (), r\<rangle>. l \<leftarrow> tree_enum i, r \<leftarrow> tree_enum (n-i)]) [0..<n]); ys \<noteq> zs\<rbrakk>
       \<Longrightarrow> set ys \<inter> set zs = {}"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>concat (map (\<lambda>l. map (Node l ()) (tree_enum (n - ?x))) (tree_enum ?x)) \<noteq> concat (map (\<lambda>l. map (Node l ()) (tree_enum (n - ?z))) (tree_enum ?z)); ?y \<in> set (tree_enum ?x); ?y \<in> set (tree_enum ?z)\<rbrakk> \<Longrightarrow> False

goal (1 subgoal):
 1. \<And>ys zs. \<lbrakk>ys \<in> set (map (\<lambda>i. concat (map (\<lambda>l. map (Node l ()) (tree_enum (n - i))) (tree_enum i))) [0..<n]); zs \<in> set (map (\<lambda>i. concat (map (\<lambda>l. map (Node l ()) (tree_enum (n - i))) (tree_enum i))) [0..<n]); ys \<noteq> zs\<rbrakk> \<Longrightarrow> set ys \<inter> set zs = {}
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
\<lbrakk>?ys \<in> set (map (\<lambda>i. concat (map (\<lambda>l. map (Node l ()) (tree_enum (n - i))) (tree_enum i))) [0..<n]); ?zs \<in> set (map (\<lambda>i. concat (map (\<lambda>l. map (Node l ()) (tree_enum (n - i))) (tree_enum i))) [0..<n]); ?ys \<noteq> ?zs\<rbrakk> \<Longrightarrow> set ?ys \<inter> set ?zs = {}

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
distinct (concat (map (\<lambda>i. concat (map (\<lambda>l. map (Node l ()) (tree_enum (n - i))) (tree_enum i))) [0..<n]))

goal (1 subgoal):
 1. \<And>n. \<lbrakk>\<And>x. x \<in> set [0..<Suc n] \<Longrightarrow> distinct (tree_enum x); \<And>x xa. \<lbrakk>x \<in> set [0..<Suc n]; xa \<in> set (tree_enum x)\<rbrakk> \<Longrightarrow> distinct (tree_enum (n - x))\<rbrakk> \<Longrightarrow> distinct (tree_enum (Suc n))
[PROOF STEP]
have "distinct (tree_enum n)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. distinct (tree_enum n)
[PROOF STEP]
using 2
[PROOF STATE]
proof (prove)
using this:
?x \<in> set [0..<Suc n] \<Longrightarrow> distinct (tree_enum ?x)
\<lbrakk>?x \<in> set [0..<Suc n]; ?xa \<in> set (tree_enum ?x)\<rbrakk> \<Longrightarrow> distinct (tree_enum (n - ?x))

goal (1 subgoal):
 1. distinct (tree_enum n)
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
distinct (tree_enum n)

goal (1 subgoal):
 1. \<And>n. \<lbrakk>\<And>x. x \<in> set [0..<Suc n] \<Longrightarrow> distinct (tree_enum x); \<And>x xa. \<lbrakk>x \<in> set [0..<Suc n]; xa \<in> set (tree_enum x)\<rbrakk> \<Longrightarrow> distinct (tree_enum (n - x))\<rbrakk> \<Longrightarrow> distinct (tree_enum (Suc n))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
distinct (tree_enum n)
[PROOF STEP]
have c2: "distinct (map (\<lambda>t1. \<langle>t1, (), \<langle>\<rangle>\<rangle>) (tree_enum n))"
[PROOF STATE]
proof (prove)
using this:
distinct (tree_enum n)

goal (1 subgoal):
 1. distinct (map (\<lambda>t1. \<langle>t1, (), \<langle>\<rangle>\<rangle>) (tree_enum n))
[PROOF STEP]
using Node_left_distinct_map
[PROOF STATE]
proof (prove)
using this:
distinct (tree_enum n)
distinct ?xs = distinct (map (\<lambda>l. \<langle>l, (), ?r\<rangle>) ?xs)

goal (1 subgoal):
 1. distinct (map (\<lambda>t1. \<langle>t1, (), \<langle>\<rangle>\<rangle>) (tree_enum n))
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
distinct (map (\<lambda>t1. \<langle>t1, (), \<langle>\<rangle>\<rangle>) (tree_enum n))

goal (1 subgoal):
 1. \<And>n. \<lbrakk>\<And>x. x \<in> set [0..<Suc n] \<Longrightarrow> distinct (tree_enum x); \<And>x xa. \<lbrakk>x \<in> set [0..<Suc n]; xa \<in> set (tree_enum x)\<rbrakk> \<Longrightarrow> distinct (tree_enum (n - x))\<rbrakk> \<Longrightarrow> distinct (tree_enum (Suc n))
[PROOF STEP]
have c3: "\<And>xa xb. \<lbrakk>xa < n; xb \<in> set (tree_enum xa); xb \<in> set (tree_enum n); \<langle>\<rangle> \<in> set (tree_enum (n - xa))\<rbrakk> \<Longrightarrow> False"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>xa xb. \<lbrakk>xa < n; xb \<in> set (tree_enum xa); xb \<in> set (tree_enum n); \<langle>\<rangle> \<in> set (tree_enum (n - xa))\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
by (simp add: tree_enum_Leaf)
[PROOF STATE]
proof (state)
this:
\<lbrakk>?xa < n; ?xb \<in> set (tree_enum ?xa); ?xb \<in> set (tree_enum n); \<langle>\<rangle> \<in> set (tree_enum (n - ?xa))\<rbrakk> \<Longrightarrow> False

goal (1 subgoal):
 1. \<And>n. \<lbrakk>\<And>x. x \<in> set [0..<Suc n] \<Longrightarrow> distinct (tree_enum x); \<And>x xa. \<lbrakk>x \<in> set [0..<Suc n]; xa \<in> set (tree_enum x)\<rbrakk> \<Longrightarrow> distinct (tree_enum (n - x))\<rbrakk> \<Longrightarrow> distinct (tree_enum (Suc n))
[PROOF STEP]
from c1 c2 c3
[PROOF STATE]
proof (chain)
picking this:
distinct (concat (map (\<lambda>i. concat (map (\<lambda>l. map (Node l ()) (tree_enum (n - i))) (tree_enum i))) [0..<n]))
distinct (map (\<lambda>t1. \<langle>t1, (), \<langle>\<rangle>\<rangle>) (tree_enum n))
\<lbrakk>?xa < n; ?xb \<in> set (tree_enum ?xa); ?xb \<in> set (tree_enum n); \<langle>\<rangle> \<in> set (tree_enum (n - ?xa))\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
distinct (concat (map (\<lambda>i. concat (map (\<lambda>l. map (Node l ()) (tree_enum (n - i))) (tree_enum i))) [0..<n]))
distinct (map (\<lambda>t1. \<langle>t1, (), \<langle>\<rangle>\<rangle>) (tree_enum n))
\<lbrakk>?xa < n; ?xb \<in> set (tree_enum ?xa); ?xb \<in> set (tree_enum n); \<langle>\<rangle> \<in> set (tree_enum (n - ?xa))\<rbrakk> \<Longrightarrow> False

goal (1 subgoal):
 1. distinct (tree_enum (Suc n))
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
distinct (tree_enum (Suc n))

goal:
No subgoals!
[PROOF STEP]
qed