[STATEMENT]
lemma condition_1_part_4:
  fixes A::"'a::{field}^'columns::{mod_type}^'rows::{mod_type}" and k::nat
  defines ia:"ia\<equiv>(if \<forall>m. is_zero_row_upt_k m k A then 0 else to_nat (GREATEST n. \<not> is_zero_row_upt_k n k A) + 1)"
  defines B:"B \<equiv>(snd (Gauss_Jordan_column_k (ia,A) k))"
  assumes rref: "reduced_row_echelon_form_upt_k A k"
  and zero_i_suc_k: "is_zero_row_upt_k i (Suc k) B"
  and i_less_j: "i<j"
  and not_zero_m: "\<not> is_zero_row_upt_k m k A"
  and greatest_eq_card: "Suc (to_nat (GREATEST n. \<not> is_zero_row_upt_k n k A)) = nrows A"
  shows "is_zero_row_upt_k j (Suc k) A"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. is_zero_row_upt_k j (Suc k) A
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. is_zero_row_upt_k j (Suc k) A
[PROOF STEP]
have ia2: "ia=to_nat (GREATEST n. \<not> is_zero_row_upt_k n k A) + 1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ia = mod_type_class.to_nat (GREATEST n. \<not> is_zero_row_upt_k n k A) + 1
[PROOF STEP]
unfolding ia
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (if \<forall>m. is_zero_row_upt_k m k A then 0 else mod_type_class.to_nat (GREATEST n. \<not> is_zero_row_upt_k n k A) + 1) = mod_type_class.to_nat (GREATEST n. \<not> is_zero_row_upt_k n k A) + 1
[PROOF STEP]
using not_zero_m
[PROOF STATE]
proof (prove)
using this:
\<not> is_zero_row_upt_k m k A

goal (1 subgoal):
 1. (if \<forall>m. is_zero_row_upt_k m k A then 0 else mod_type_class.to_nat (GREATEST n. \<not> is_zero_row_upt_k n k A) + 1) = mod_type_class.to_nat (GREATEST n. \<not> is_zero_row_upt_k n k A) + 1
[PROOF STEP]
by presburger
[PROOF STATE]
proof (state)
this:
ia = mod_type_class.to_nat (GREATEST n. \<not> is_zero_row_upt_k n k A) + 1

goal (1 subgoal):
 1. is_zero_row_upt_k j (Suc k) A
[PROOF STEP]
have B_eq_A: "B=A"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. B = A
[PROOF STEP]
unfolding B Gauss_Jordan_column_k_def Let_def fst_conv snd_conv ia2
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. snd (if (\<forall>m\<ge>mod_type_class.from_nat (mod_type_class.to_nat (GREATEST n. \<not> is_zero_row_upt_k n k A) + 1). A $ m $ mod_type_class.from_nat k = (0::'a)) \<or> mod_type_class.to_nat (GREATEST n. \<not> is_zero_row_upt_k n k A) + 1 = nrows A then (mod_type_class.to_nat (GREATEST n. \<not> is_zero_row_upt_k n k A) + 1, A) else (mod_type_class.to_nat (GREATEST n. \<not> is_zero_row_upt_k n k A) + 1 + 1, Gauss_Jordan_in_ij A (mod_type_class.from_nat (mod_type_class.to_nat (GREATEST n. \<not> is_zero_row_upt_k n k A) + 1)) (mod_type_class.from_nat k))) = A
[PROOF STEP]
unfolding from_nat_to_nat_greatest
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. snd (if (\<forall>m\<ge>mod_type_class.from_nat (mod_type_class.to_nat (GREATEST n. \<not> is_zero_row_upt_k n k A) + 1). A $ m $ mod_type_class.from_nat k = (0::'a)) \<or> mod_type_class.to_nat (GREATEST n. \<not> is_zero_row_upt_k n k A) + 1 = nrows A then (mod_type_class.to_nat (GREATEST n. \<not> is_zero_row_upt_k n k A) + 1, A) else (mod_type_class.to_nat (GREATEST n. \<not> is_zero_row_upt_k n k A) + 1 + 1, Gauss_Jordan_in_ij A (mod_type_class.from_nat (mod_type_class.to_nat (GREATEST n. \<not> is_zero_row_upt_k n k A) + 1)) (mod_type_class.from_nat k))) = A
[PROOF STEP]
using greatest_eq_card nrows_def
[PROOF STATE]
proof (prove)
using this:
Suc (mod_type_class.to_nat (GREATEST n. \<not> is_zero_row_upt_k n k A)) = nrows A
nrows ?A = CARD(?'rows)

goal (1 subgoal):
 1. snd (if (\<forall>m\<ge>mod_type_class.from_nat (mod_type_class.to_nat (GREATEST n. \<not> is_zero_row_upt_k n k A) + 1). A $ m $ mod_type_class.from_nat k = (0::'a)) \<or> mod_type_class.to_nat (GREATEST n. \<not> is_zero_row_upt_k n k A) + 1 = nrows A then (mod_type_class.to_nat (GREATEST n. \<not> is_zero_row_upt_k n k A) + 1, A) else (mod_type_class.to_nat (GREATEST n. \<not> is_zero_row_upt_k n k A) + 1 + 1, Gauss_Jordan_in_ij A (mod_type_class.from_nat (mod_type_class.to_nat (GREATEST n. \<not> is_zero_row_upt_k n k A) + 1)) (mod_type_class.from_nat k))) = A
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
B = A

goal (1 subgoal):
 1. is_zero_row_upt_k j (Suc k) A
[PROOF STEP]
have rref_Suc: "reduced_row_echelon_form_upt_k A (Suc k)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. reduced_row_echelon_form_upt_k A (Suc k)
[PROOF STEP]
proof (rule rref_suc_if_zero_below_greatest[OF rref])
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<not> (\<forall>a. is_zero_row_upt_k a k A)
 2. \<forall>a>GREATEST m. \<not> is_zero_row_upt_k m k A. is_zero_row_upt_k a (Suc k) A
[PROOF STEP]
show "\<forall>a>GREATEST m. \<not> is_zero_row_upt_k m k A. is_zero_row_upt_k a (Suc k) A"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>a>GREATEST m. \<not> is_zero_row_upt_k m k A. is_zero_row_upt_k a (Suc k) A
[PROOF STEP]
using greatest_eq_card not_less_eq to_nat_less_card to_nat_mono nrows_def
[PROOF STATE]
proof (prove)
using this:
Suc (mod_type_class.to_nat (GREATEST n. \<not> is_zero_row_upt_k n k A)) = nrows A
(\<not> ?m < ?n) = (?n < Suc ?m)
mod_type_class.to_nat ?j < CARD(?'a)
?a < ?b \<Longrightarrow> mod_type_class.to_nat ?a < mod_type_class.to_nat ?b
nrows ?A = CARD(?'rows)

goal (1 subgoal):
 1. \<forall>a>GREATEST m. \<not> is_zero_row_upt_k m k A. is_zero_row_upt_k a (Suc k) A
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
\<forall>a>GREATEST m. \<not> is_zero_row_upt_k m k A. is_zero_row_upt_k a (Suc k) A

goal (1 subgoal):
 1. \<not> (\<forall>a. is_zero_row_upt_k a k A)
[PROOF STEP]
show "\<not> (\<forall>a. is_zero_row_upt_k a k A)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> (\<forall>a. is_zero_row_upt_k a k A)
[PROOF STEP]
using not_zero_m
[PROOF STATE]
proof (prove)
using this:
\<not> is_zero_row_upt_k m k A

goal (1 subgoal):
 1. \<not> (\<forall>a. is_zero_row_upt_k a k A)
[PROOF STEP]
by fast
[PROOF STATE]
proof (state)
this:
\<not> (\<forall>a. is_zero_row_upt_k a k A)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
reduced_row_echelon_form_upt_k A (Suc k)

goal (1 subgoal):
 1. is_zero_row_upt_k j (Suc k) A
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. is_zero_row_upt_k j (Suc k) A
[PROOF STEP]
using zero_i_suc_k
[PROOF STATE]
proof (prove)
using this:
is_zero_row_upt_k i (Suc k) B

goal (1 subgoal):
 1. is_zero_row_upt_k j (Suc k) A
[PROOF STEP]
unfolding B_eq_A
[PROOF STATE]
proof (prove)
using this:
is_zero_row_upt_k i (Suc k) A

goal (1 subgoal):
 1. is_zero_row_upt_k j (Suc k) A
[PROOF STEP]
using rref_upt_condition1[OF rref_Suc] i_less_j
[PROOF STATE]
proof (prove)
using this:
is_zero_row_upt_k i (Suc k) A
\<forall>i. is_zero_row_upt_k i (Suc k) A \<longrightarrow> \<not> (\<exists>j>i. \<not> is_zero_row_upt_k j (Suc k) A)
i < j

goal (1 subgoal):
 1. is_zero_row_upt_k j (Suc k) A
[PROOF STEP]
by fast
[PROOF STATE]
proof (state)
this:
is_zero_row_upt_k j (Suc k) A

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma abs_ge_iff: "((x::real) \<le> abs y) = (x \<le> y \<or> x \<le> -y)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (x \<le> \<bar>y\<bar>) = (x \<le> y \<or> x \<le> - y)
[PROOF STEP]
by linarith


[STATEMENT]
theorem generate_valid_topology_max_topo: "\<lbrakk> valid_reqs M; wf_graph G;
      \<forall>m \<in> set M. \<exists>P. \<forall>G. c_sinvar m G = (\<forall>e \<in> edges G. P e)\<rbrakk> \<Longrightarrow>
      max_topo M (generate_valid_topology M (fully_connected G))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>valid_reqs M; wf_graph G; \<forall>m\<in>set M. \<exists>P. \<forall>G. c_sinvar m G = (\<forall>e\<in>edges G. P e)\<rbrakk> \<Longrightarrow> max_topo M (generate_valid_topology M (fully_connected G))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>valid_reqs M; wf_graph G; \<forall>m\<in>set M. \<exists>P. \<forall>G. c_sinvar m G = (\<forall>e\<in>edges G. P e)\<rbrakk> \<Longrightarrow> max_topo M (generate_valid_topology M (fully_connected G))
[PROOF STEP]
let ?G="(fully_connected G)"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>valid_reqs M; wf_graph G; \<forall>m\<in>set M. \<exists>P. \<forall>G. c_sinvar m G = (\<forall>e\<in>edges G. P e)\<rbrakk> \<Longrightarrow> max_topo M (generate_valid_topology M (fully_connected G))
[PROOF STEP]
assume validRs: "valid_reqs M"
    and    wfG:       "wf_graph G"
    and enf: "\<forall>m \<in> set M. \<exists>P. \<forall>G. c_sinvar m G = (\<forall>e \<in> edges G. P e)"
[PROOF STATE]
proof (state)
this:
valid_reqs M
wf_graph G
\<forall>m\<in>set M. \<exists>P. \<forall>G. c_sinvar m G = (\<forall>e\<in>edges G. P e)

goal (1 subgoal):
 1. \<lbrakk>valid_reqs M; wf_graph G; \<forall>m\<in>set M. \<exists>P. \<forall>G. c_sinvar m G = (\<forall>e\<in>edges G. P e)\<rbrakk> \<Longrightarrow> max_topo M (generate_valid_topology M (fully_connected G))
[PROOF STEP]
obtain V E where VE_prop: "\<lparr> nodes = V, edges = E \<rparr> = generate_valid_topology M ?G"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>V E. \<lparr>nodes = V, edges = E\<rparr> = generate_valid_topology M (fully_connected G) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (metis graph.cases)
[PROOF STATE]
proof (state)
this:
\<lparr>nodes = V, edges = E\<rparr> = generate_valid_topology M (fully_connected G)

goal (1 subgoal):
 1. \<lbrakk>valid_reqs M; wf_graph G; \<forall>m\<in>set M. \<exists>P. \<forall>G. c_sinvar m G = (\<forall>e\<in>edges G. P e)\<rbrakk> \<Longrightarrow> max_topo M (generate_valid_topology M (fully_connected G))
[PROOF STEP]
hence VE_prop_asset:
      "\<lparr> nodes = V, edges = E \<rparr> = \<lparr> nodes = V, edges = V \<times> V - (\<Union>m\<in>set M. \<Union>(c_offending_flows m ?G))\<rparr>"
[PROOF STATE]
proof (prove)
using this:
\<lparr>nodes = V, edges = E\<rparr> = generate_valid_topology M (fully_connected G)

goal (1 subgoal):
 1. \<lparr>nodes = V, edges = E\<rparr> = \<lparr>nodes = V, edges = V \<times> V - (\<Union>m\<in>set M. \<Union> (c_offending_flows m (fully_connected G)))\<rparr>
[PROOF STEP]
by(simp add: fully_connected_def generate_valid_topology_as_set delete_edges_simp2)
[PROOF STATE]
proof (state)
this:
\<lparr>nodes = V, edges = E\<rparr> = \<lparr>nodes = V, edges = V \<times> V - (\<Union>m\<in>set M. \<Union> (c_offending_flows m (fully_connected G)))\<rparr>

goal (1 subgoal):
 1. \<lbrakk>valid_reqs M; wf_graph G; \<forall>m\<in>set M. \<exists>P. \<forall>G. c_sinvar m G = (\<forall>e\<in>edges G. P e)\<rbrakk> \<Longrightarrow> max_topo M (generate_valid_topology M (fully_connected G))
[PROOF STEP]
from VE_prop_asset
[PROOF STATE]
proof (chain)
picking this:
\<lparr>nodes = V, edges = E\<rparr> = \<lparr>nodes = V, edges = V \<times> V - (\<Union>m\<in>set M. \<Union> (c_offending_flows m (fully_connected G)))\<rparr>
[PROOF STEP]
have E_prop: "E =  V \<times> V - (\<Union>m\<in>set M. \<Union>(c_offending_flows m ?G))"
[PROOF STATE]
proof (prove)
using this:
\<lparr>nodes = V, edges = E\<rparr> = \<lparr>nodes = V, edges = V \<times> V - (\<Union>m\<in>set M. \<Union> (c_offending_flows m (fully_connected G)))\<rparr>

goal (1 subgoal):
 1. E = V \<times> V - (\<Union>m\<in>set M. \<Union> (c_offending_flows m (fully_connected G)))
[PROOF STEP]
by fast
[PROOF STATE]
proof (state)
this:
E = V \<times> V - (\<Union>m\<in>set M. \<Union> (c_offending_flows m (fully_connected G)))

goal (1 subgoal):
 1. \<lbrakk>valid_reqs M; wf_graph G; \<forall>m\<in>set M. \<exists>P. \<forall>G. c_sinvar m G = (\<forall>e\<in>edges G. P e)\<rbrakk> \<Longrightarrow> max_topo M (generate_valid_topology M (fully_connected G))
[PROOF STEP]
from VE_prop
[PROOF STATE]
proof (chain)
picking this:
\<lparr>nodes = V, edges = E\<rparr> = generate_valid_topology M (fully_connected G)
[PROOF STEP]
have V_prop: "nodes G = V"
[PROOF STATE]
proof (prove)
using this:
\<lparr>nodes = V, edges = E\<rparr> = generate_valid_topology M (fully_connected G)

goal (1 subgoal):
 1. nodes G = V
[PROOF STEP]
by (simp add: fully_connected_def delete_edges_simp2 generate_valid_topology_def_alt)
[PROOF STATE]
proof (state)
this:
nodes G = V

goal (1 subgoal):
 1. \<lbrakk>valid_reqs M; wf_graph G; \<forall>m\<in>set M. \<exists>P. \<forall>G. c_sinvar m G = (\<forall>e\<in>edges G. P e)\<rbrakk> \<Longrightarrow> max_topo M (generate_valid_topology M (fully_connected G))
[PROOF STEP]
from VE_prop
[PROOF STATE]
proof (chain)
picking this:
\<lparr>nodes = V, edges = E\<rparr> = generate_valid_topology M (fully_connected G)
[PROOF STEP]
have V_full_prop: "nodes (generate_valid_topology M ?G) = V"
[PROOF STATE]
proof (prove)
using this:
\<lparr>nodes = V, edges = E\<rparr> = generate_valid_topology M (fully_connected G)

goal (1 subgoal):
 1. nodes (generate_valid_topology M (fully_connected G)) = V
[PROOF STEP]
by (metis graph.select_convs(1))
[PROOF STATE]
proof (state)
this:
nodes (generate_valid_topology M (fully_connected G)) = V

goal (1 subgoal):
 1. \<lbrakk>valid_reqs M; wf_graph G; \<forall>m\<in>set M. \<exists>P. \<forall>G. c_sinvar m G = (\<forall>e\<in>edges G. P e)\<rbrakk> \<Longrightarrow> max_topo M (generate_valid_topology M (fully_connected G))
[PROOF STEP]
from VE_prop
[PROOF STATE]
proof (chain)
picking this:
\<lparr>nodes = V, edges = E\<rparr> = generate_valid_topology M (fully_connected G)
[PROOF STEP]
have E_full_prop: "edges (generate_valid_topology M ?G) = E"
[PROOF STATE]
proof (prove)
using this:
\<lparr>nodes = V, edges = E\<rparr> = generate_valid_topology M (fully_connected G)

goal (1 subgoal):
 1. edges (generate_valid_topology M (fully_connected G)) = E
[PROOF STEP]
by (metis graph.select_convs(2))
[PROOF STATE]
proof (state)
this:
edges (generate_valid_topology M (fully_connected G)) = E

goal (1 subgoal):
 1. \<lbrakk>valid_reqs M; wf_graph G; \<forall>m\<in>set M. \<exists>P. \<forall>G. c_sinvar m G = (\<forall>e\<in>edges G. P e)\<rbrakk> \<Longrightarrow> max_topo M (generate_valid_topology M (fully_connected G))
[PROOF STEP]
from VE_prop wf_graph_generate_valid_topology[OF fully_connected_wf[OF wfG]]
[PROOF STATE]
proof (chain)
picking this:
\<lparr>nodes = V, edges = E\<rparr> = generate_valid_topology M (fully_connected G)
wf_graph (generate_valid_topology ?M (fully_connected G))
[PROOF STEP]
have wfG_VE: "wf_graph \<lparr> nodes = V, edges = E \<rparr>"
[PROOF STATE]
proof (prove)
using this:
\<lparr>nodes = V, edges = E\<rparr> = generate_valid_topology M (fully_connected G)
wf_graph (generate_valid_topology ?M (fully_connected G))

goal (1 subgoal):
 1. wf_graph \<lparr>nodes = V, edges = E\<rparr>
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
wf_graph \<lparr>nodes = V, edges = E\<rparr>

goal (1 subgoal):
 1. \<lbrakk>valid_reqs M; wf_graph G; \<forall>m\<in>set M. \<exists>P. \<forall>G. c_sinvar m G = (\<forall>e\<in>edges G. P e)\<rbrakk> \<Longrightarrow> max_topo M (generate_valid_topology M (fully_connected G))
[PROOF STEP]
from generate_valid_topology_sound[OF validRs wfG_VE] fully_connected_wf[OF wfG]
[PROOF STATE]
proof (chain)
picking this:
all_security_requirements_fulfilled M (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>)
wf_graph (fully_connected G)
[PROOF STEP]
have VE_all_valid:
      "all_security_requirements_fulfilled M \<lparr> nodes = V, edges = V \<times> V - (\<Union>m\<in>set M. \<Union>(c_offending_flows m ?G))\<rparr>"
[PROOF STATE]
proof (prove)
using this:
all_security_requirements_fulfilled M (generate_valid_topology M \<lparr>nodes = V, edges = E\<rparr>)
wf_graph (fully_connected G)

goal (1 subgoal):
 1. all_security_requirements_fulfilled M \<lparr>nodes = V, edges = V \<times> V - (\<Union>m\<in>set M. \<Union> (c_offending_flows m (fully_connected G)))\<rparr>
[PROOF STEP]
by (metis VE_prop VE_prop_asset fully_connected_def generate_valid_topology_sound validRs)
[PROOF STATE]
proof (state)
this:
all_security_requirements_fulfilled M \<lparr>nodes = V, edges = V \<times> V - (\<Union>m\<in>set M. \<Union> (c_offending_flows m (fully_connected G)))\<rparr>

goal (1 subgoal):
 1. \<lbrakk>valid_reqs M; wf_graph G; \<forall>m\<in>set M. \<exists>P. \<forall>G. c_sinvar m G = (\<forall>e\<in>edges G. P e)\<rbrakk> \<Longrightarrow> max_topo M (generate_valid_topology M (fully_connected G))
[PROOF STEP]
hence goal1: "all_security_requirements_fulfilled M (generate_valid_topology M (fully_connected G))"
[PROOF STATE]
proof (prove)
using this:
all_security_requirements_fulfilled M \<lparr>nodes = V, edges = V \<times> V - (\<Union>m\<in>set M. \<Union> (c_offending_flows m (fully_connected G)))\<rparr>

goal (1 subgoal):
 1. all_security_requirements_fulfilled M (generate_valid_topology M (fully_connected G))
[PROOF STEP]
by (metis VE_prop VE_prop_asset)
[PROOF STATE]
proof (state)
this:
all_security_requirements_fulfilled M (generate_valid_topology M (fully_connected G))

goal (1 subgoal):
 1. \<lbrakk>valid_reqs M; wf_graph G; \<forall>m\<in>set M. \<exists>P. \<forall>G. c_sinvar m G = (\<forall>e\<in>edges G. P e)\<rbrakk> \<Longrightarrow> max_topo M (generate_valid_topology M (fully_connected G))
[PROOF STEP]
from validRs
[PROOF STATE]
proof (chain)
picking this:
valid_reqs M
[PROOF STEP]
have valid_mD:"\<And>m. m \<in> set M \<Longrightarrow> configured_SecurityInvariant m "
[PROOF STATE]
proof (prove)
using this:
valid_reqs M

goal (1 subgoal):
 1. \<And>m. m \<in> set M \<Longrightarrow> configured_SecurityInvariant m
[PROOF STEP]
by(simp add: valid_reqs_def)
[PROOF STATE]
proof (state)
this:
?m \<in> set M \<Longrightarrow> configured_SecurityInvariant ?m

goal (1 subgoal):
 1. \<lbrakk>valid_reqs M; wf_graph G; \<forall>m\<in>set M. \<exists>P. \<forall>G. c_sinvar m G = (\<forall>e\<in>edges G. P e)\<rbrakk> \<Longrightarrow> max_topo M (generate_valid_topology M (fully_connected G))
[PROOF STEP]
from c_offending_flows_subseteq_edges[where G="?G"] validRs
[PROOF STATE]
proof (chain)
picking this:
configured_SecurityInvariant ?m \<Longrightarrow> \<Union> (c_offending_flows ?m (fully_connected G)) \<subseteq> edges (fully_connected G)
valid_reqs M
[PROOF STEP]
have hlp1: "(\<Union>m\<in>set M. \<Union>(c_offending_flows m ?G)) \<subseteq> V \<times> V"
[PROOF STATE]
proof (prove)
using this:
configured_SecurityInvariant ?m \<Longrightarrow> \<Union> (c_offending_flows ?m (fully_connected G)) \<subseteq> edges (fully_connected G)
valid_reqs M

goal (1 subgoal):
 1. (\<Union>m\<in>set M. \<Union> (c_offending_flows m (fully_connected G))) \<subseteq> V \<times> V
[PROOF STEP]
apply(simp add: fully_connected_def V_prop)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<And>m. configured_SecurityInvariant m \<Longrightarrow> \<Union> (c_offending_flows m \<lparr>nodes = V, edges = V \<times> V\<rparr>) \<subseteq> V \<times> V; valid_reqs M\<rbrakk> \<Longrightarrow> (\<Union>x\<in>set M. \<Union> (c_offending_flows x \<lparr>nodes = V, edges = V \<times> V\<rparr>)) \<subseteq> V \<times> V
[PROOF STEP]
using valid_reqs_def
[PROOF STATE]
proof (prove)
using this:
valid_reqs ?M \<equiv> \<forall>m\<in>set ?M. configured_SecurityInvariant m

goal (1 subgoal):
 1. \<lbrakk>\<And>m. configured_SecurityInvariant m \<Longrightarrow> \<Union> (c_offending_flows m \<lparr>nodes = V, edges = V \<times> V\<rparr>) \<subseteq> V \<times> V; valid_reqs M\<rbrakk> \<Longrightarrow> (\<Union>x\<in>set M. \<Union> (c_offending_flows x \<lparr>nodes = V, edges = V \<times> V\<rparr>)) \<subseteq> V \<times> V
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(\<Union>m\<in>set M. \<Union> (c_offending_flows m (fully_connected G))) \<subseteq> V \<times> V

goal (1 subgoal):
 1. \<lbrakk>valid_reqs M; wf_graph G; \<forall>m\<in>set M. \<exists>P. \<forall>G. c_sinvar m G = (\<forall>e\<in>edges G. P e)\<rbrakk> \<Longrightarrow> max_topo M (generate_valid_topology M (fully_connected G))
[PROOF STEP]
have "\<And>A B. A - (A - B) = B \<inter> A"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>A B. A - (A - B) = B \<inter> A
[PROOF STEP]
by fast
[PROOF STATE]
proof (state)
this:
?A - (?A - ?B) = ?B \<inter> ?A

goal (1 subgoal):
 1. \<lbrakk>valid_reqs M; wf_graph G; \<forall>m\<in>set M. \<exists>P. \<forall>G. c_sinvar m G = (\<forall>e\<in>edges G. P e)\<rbrakk> \<Longrightarrow> max_topo M (generate_valid_topology M (fully_connected G))
[PROOF STEP]
from E_prop hlp1
[PROOF STATE]
proof (chain)
picking this:
E = V \<times> V - (\<Union>m\<in>set M. \<Union> (c_offending_flows m (fully_connected G)))
(\<Union>m\<in>set M. \<Union> (c_offending_flows m (fully_connected G))) \<subseteq> V \<times> V
[PROOF STEP]
have "V \<times> V - E = (\<Union>m\<in>set M. \<Union>(c_offending_flows m ?G))"
[PROOF STATE]
proof (prove)
using this:
E = V \<times> V - (\<Union>m\<in>set M. \<Union> (c_offending_flows m (fully_connected G)))
(\<Union>m\<in>set M. \<Union> (c_offending_flows m (fully_connected G))) \<subseteq> V \<times> V

goal (1 subgoal):
 1. V \<times> V - E = (\<Union>m\<in>set M. \<Union> (c_offending_flows m (fully_connected G)))
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
V \<times> V - E = (\<Union>m\<in>set M. \<Union> (c_offending_flows m (fully_connected G)))

goal (1 subgoal):
 1. \<lbrakk>valid_reqs M; wf_graph G; \<forall>m\<in>set M. \<exists>P. \<forall>G. c_sinvar m G = (\<forall>e\<in>edges G. P e)\<rbrakk> \<Longrightarrow> max_topo M (generate_valid_topology M (fully_connected G))
[PROOF STEP]
from enf_not_fulfilled_if_in_offending[OF validRs wfG enf]
[PROOF STATE]
proof (chain)
picking this:
\<forall>x\<in>\<Union>m\<in>set M. \<Union> (c_offending_flows m (fully_connected G)). \<not> all_security_requirements_fulfilled M \<lparr>nodes = ?V, edges = insert x ?E\<rparr>
[PROOF STEP]
have "\<forall>(v1, v2) \<in> (\<Union>m\<in>set M. \<Union>(c_offending_flows m ?G)).
       \<not> all_security_requirements_fulfilled M \<lparr> nodes = V, edges = E \<union> {(v1, v2)}\<rparr>"
[PROOF STATE]
proof (prove)
using this:
\<forall>x\<in>\<Union>m\<in>set M. \<Union> (c_offending_flows m (fully_connected G)). \<not> all_security_requirements_fulfilled M \<lparr>nodes = ?V, edges = insert x ?E\<rparr>

goal (1 subgoal):
 1. \<forall>(v1, v2)\<in>\<Union>m\<in>set M. \<Union> (c_offending_flows m (fully_connected G)). \<not> all_security_requirements_fulfilled M \<lparr>nodes = V, edges = E \<union> {(v1, v2)}\<rparr>
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<forall>(v1, v2)\<in>\<Union>m\<in>set M. \<Union> (c_offending_flows m (fully_connected G)). \<not> all_security_requirements_fulfilled M \<lparr>nodes = V, edges = E \<union> {(v1, v2)}\<rparr>

goal (1 subgoal):
 1. \<lbrakk>valid_reqs M; wf_graph G; \<forall>m\<in>set M. \<exists>P. \<forall>G. c_sinvar m G = (\<forall>e\<in>edges G. P e)\<rbrakk> \<Longrightarrow> max_topo M (generate_valid_topology M (fully_connected G))
[PROOF STEP]
from this \<open>V \<times> V - E = (\<Union>m\<in>set M. \<Union>(c_offending_flows m ?G))\<close>
[PROOF STATE]
proof (chain)
picking this:
\<forall>(v1, v2)\<in>\<Union>m\<in>set M. \<Union> (c_offending_flows m (fully_connected G)). \<not> all_security_requirements_fulfilled M \<lparr>nodes = V, edges = E \<union> {(v1, v2)}\<rparr>
V \<times> V - E = (\<Union>m\<in>set M. \<Union> (c_offending_flows m (fully_connected G)))
[PROOF STEP]
have "\<forall>(v1, v2) \<in> V \<times> V - E.
         \<not> all_security_requirements_fulfilled M \<lparr> nodes = V, edges = E \<union> {(v1, v2)}\<rparr>"
[PROOF STATE]
proof (prove)
using this:
\<forall>(v1, v2)\<in>\<Union>m\<in>set M. \<Union> (c_offending_flows m (fully_connected G)). \<not> all_security_requirements_fulfilled M \<lparr>nodes = V, edges = E \<union> {(v1, v2)}\<rparr>
V \<times> V - E = (\<Union>m\<in>set M. \<Union> (c_offending_flows m (fully_connected G)))

goal (1 subgoal):
 1. \<forall>(v1, v2)\<in>V \<times> V - E. \<not> all_security_requirements_fulfilled M \<lparr>nodes = V, edges = E \<union> {(v1, v2)}\<rparr>
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<forall>(v1, v2)\<in>V \<times> V - E. \<not> all_security_requirements_fulfilled M \<lparr>nodes = V, edges = E \<union> {(v1, v2)}\<rparr>

goal (1 subgoal):
 1. \<lbrakk>valid_reqs M; wf_graph G; \<forall>m\<in>set M. \<exists>P. \<forall>G. c_sinvar m G = (\<forall>e\<in>edges G. P e)\<rbrakk> \<Longrightarrow> max_topo M (generate_valid_topology M (fully_connected G))
[PROOF STEP]
hence goal2: "(\<forall>(v1, v2)\<in>nodes (generate_valid_topology M ?G) \<times> nodes (generate_valid_topology M ?G) -
                edges (generate_valid_topology M ?G).
        \<not> all_security_requirements_fulfilled M (add_edge v1 v2 (generate_valid_topology M ?G)))"
[PROOF STATE]
proof (prove)
using this:
\<forall>(v1, v2)\<in>V \<times> V - E. \<not> all_security_requirements_fulfilled M \<lparr>nodes = V, edges = E \<union> {(v1, v2)}\<rparr>

goal (1 subgoal):
 1. \<forall>(v1, v2)\<in>nodes (generate_valid_topology M (fully_connected G)) \<times> nodes (generate_valid_topology M (fully_connected G)) - edges (generate_valid_topology M (fully_connected G)). \<not> all_security_requirements_fulfilled M (add_edge v1 v2 (generate_valid_topology M (fully_connected G)))
[PROOF STEP]
proof(unfold V_full_prop E_full_prop graph_ops)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<forall>(v1, v2)\<in>V \<times> V - E. \<not> all_security_requirements_fulfilled M \<lparr>nodes = V, edges = E \<union> {(v1, v2)}\<rparr> \<Longrightarrow> \<forall>(v1, v2)\<in>V \<times> V - E. \<not> all_security_requirements_fulfilled M \<lparr>nodes = V \<union> {v1, v2}, edges = {(v1, v2)} \<union> E\<rparr>
[PROOF STEP]
assume a: "\<forall>(v1, v2)\<in>V \<times> V - E. \<not> all_security_requirements_fulfilled M \<lparr>nodes = V, edges = E \<union> {(v1, v2)}\<rparr>"
[PROOF STATE]
proof (state)
this:
\<forall>(v1, v2)\<in>V \<times> V - E. \<not> all_security_requirements_fulfilled M \<lparr>nodes = V, edges = E \<union> {(v1, v2)}\<rparr>

goal (1 subgoal):
 1. \<forall>(v1, v2)\<in>V \<times> V - E. \<not> all_security_requirements_fulfilled M \<lparr>nodes = V, edges = E \<union> {(v1, v2)}\<rparr> \<Longrightarrow> \<forall>(v1, v2)\<in>V \<times> V - E. \<not> all_security_requirements_fulfilled M \<lparr>nodes = V \<union> {v1, v2}, edges = {(v1, v2)} \<union> E\<rparr>
[PROOF STEP]
have "\<forall>(v1, v2)\<in>V \<times> V - E.  V \<union> {v1, v2} = V"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>(v1, v2)\<in>V \<times> V - E. V \<union> {v1, v2} = V
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<forall>(v1, v2)\<in>V \<times> V - E. V \<union> {v1, v2} = V

goal (1 subgoal):
 1. \<forall>(v1, v2)\<in>V \<times> V - E. \<not> all_security_requirements_fulfilled M \<lparr>nodes = V, edges = E \<union> {(v1, v2)}\<rparr> \<Longrightarrow> \<forall>(v1, v2)\<in>V \<times> V - E. \<not> all_security_requirements_fulfilled M \<lparr>nodes = V \<union> {v1, v2}, edges = {(v1, v2)} \<union> E\<rparr>
[PROOF STEP]
hence "\<forall>(v1, v2)\<in>V \<times> V - E. \<lparr>nodes = V \<union> {v1, v2}, edges = {(v1, v2)} \<union> E\<rparr> = \<lparr>nodes = V, edges = E \<union> {(v1, v2)}\<rparr>"
[PROOF STATE]
proof (prove)
using this:
\<forall>(v1, v2)\<in>V \<times> V - E. V \<union> {v1, v2} = V

goal (1 subgoal):
 1. \<forall>(v1, v2)\<in>V \<times> V - E. \<lparr>nodes = V \<union> {v1, v2}, edges = {(v1, v2)} \<union> E\<rparr> = \<lparr>nodes = V, edges = E \<union> {(v1, v2)}\<rparr>
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<forall>(v1, v2)\<in>V \<times> V - E. \<lparr>nodes = V \<union> {v1, v2}, edges = {(v1, v2)} \<union> E\<rparr> = \<lparr>nodes = V, edges = E \<union> {(v1, v2)}\<rparr>

goal (1 subgoal):
 1. \<forall>(v1, v2)\<in>V \<times> V - E. \<not> all_security_requirements_fulfilled M \<lparr>nodes = V, edges = E \<union> {(v1, v2)}\<rparr> \<Longrightarrow> \<forall>(v1, v2)\<in>V \<times> V - E. \<not> all_security_requirements_fulfilled M \<lparr>nodes = V \<union> {v1, v2}, edges = {(v1, v2)} \<union> E\<rparr>
[PROOF STEP]
from this a
[PROOF STATE]
proof (chain)
picking this:
\<forall>(v1, v2)\<in>V \<times> V - E. \<lparr>nodes = V \<union> {v1, v2}, edges = {(v1, v2)} \<union> E\<rparr> = \<lparr>nodes = V, edges = E \<union> {(v1, v2)}\<rparr>
\<forall>(v1, v2)\<in>V \<times> V - E. \<not> all_security_requirements_fulfilled M \<lparr>nodes = V, edges = E \<union> {(v1, v2)}\<rparr>
[PROOF STEP]
show "\<forall>(v1, v2)\<in>V \<times> V - E. \<not> all_security_requirements_fulfilled M \<lparr>nodes = V \<union> {v1, v2}, edges = {(v1, v2)} \<union> E\<rparr>"
        \<comment> \<open>TODO: this should be trivial ...\<close>
[PROOF STATE]
proof (prove)
using this:
\<forall>(v1, v2)\<in>V \<times> V - E. \<lparr>nodes = V \<union> {v1, v2}, edges = {(v1, v2)} \<union> E\<rparr> = \<lparr>nodes = V, edges = E \<union> {(v1, v2)}\<rparr>
\<forall>(v1, v2)\<in>V \<times> V - E. \<not> all_security_requirements_fulfilled M \<lparr>nodes = V, edges = E \<union> {(v1, v2)}\<rparr>

goal (1 subgoal):
 1. \<forall>(v1, v2)\<in>V \<times> V - E. \<not> all_security_requirements_fulfilled M \<lparr>nodes = V \<union> {v1, v2}, edges = {(v1, v2)} \<union> E\<rparr>
[PROOF STEP]
apply(simp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<forall>x\<in>V \<times> V - E. case x of (v1, v2) \<Rightarrow> insert v1 (insert v2 V) = V; \<forall>x\<in>V \<times> V - E. \<not> all_security_requirements_fulfilled M \<lparr>nodes = V, edges = insert x E\<rparr>\<rbrakk> \<Longrightarrow> \<forall>x\<in>V \<times> V - E. case x of (v1, v2) \<Rightarrow> \<not> all_security_requirements_fulfilled M \<lparr>nodes = insert v1 (insert v2 V), edges = insert (v1, v2) E\<rparr>
[PROOF STEP]
apply(rule ballI)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>\<forall>x\<in>V \<times> V - E. case x of (v1, v2) \<Rightarrow> insert v1 (insert v2 V) = V; \<forall>x\<in>V \<times> V - E. \<not> all_security_requirements_fulfilled M \<lparr>nodes = V, edges = insert x E\<rparr>; x \<in> V \<times> V - E\<rbrakk> \<Longrightarrow> case x of (v1, v2) \<Rightarrow> \<not> all_security_requirements_fulfilled M \<lparr>nodes = insert v1 (insert v2 V), edges = insert (v1, v2) E\<rparr>
[PROOF STEP]
apply(erule_tac x=x and A="V \<times> V - E" in ballE)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>\<forall>x\<in>V \<times> V - E. \<not> all_security_requirements_fulfilled M \<lparr>nodes = V, edges = insert x E\<rparr>; x \<in> V \<times> V - E; case x of (v1, v2) \<Rightarrow> insert v1 (insert v2 V) = V\<rbrakk> \<Longrightarrow> case x of (v1, v2) \<Rightarrow> \<not> all_security_requirements_fulfilled M \<lparr>nodes = insert v1 (insert v2 V), edges = insert (v1, v2) E\<rparr>
 2. \<And>x. \<lbrakk>\<forall>x\<in>V \<times> V - E. \<not> all_security_requirements_fulfilled M \<lparr>nodes = V, edges = insert x E\<rparr>; x \<in> V \<times> V - E; x \<notin> V \<times> V - E\<rbrakk> \<Longrightarrow> case x of (v1, v2) \<Rightarrow> \<not> all_security_requirements_fulfilled M \<lparr>nodes = insert v1 (insert v2 V), edges = insert (v1, v2) E\<rparr>
[PROOF STEP]
prefer 2
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>\<forall>x\<in>V \<times> V - E. \<not> all_security_requirements_fulfilled M \<lparr>nodes = V, edges = insert x E\<rparr>; x \<in> V \<times> V - E; x \<notin> V \<times> V - E\<rbrakk> \<Longrightarrow> case x of (v1, v2) \<Rightarrow> \<not> all_security_requirements_fulfilled M \<lparr>nodes = insert v1 (insert v2 V), edges = insert (v1, v2) E\<rparr>
 2. \<And>x. \<lbrakk>\<forall>x\<in>V \<times> V - E. \<not> all_security_requirements_fulfilled M \<lparr>nodes = V, edges = insert x E\<rparr>; x \<in> V \<times> V - E; case x of (v1, v2) \<Rightarrow> insert v1 (insert v2 V) = V\<rbrakk> \<Longrightarrow> case x of (v1, v2) \<Rightarrow> \<not> all_security_requirements_fulfilled M \<lparr>nodes = insert v1 (insert v2 V), edges = insert (v1, v2) E\<rparr>
[PROOF STEP]
apply(simp; fail)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>\<forall>x\<in>V \<times> V - E. \<not> all_security_requirements_fulfilled M \<lparr>nodes = V, edges = insert x E\<rparr>; x \<in> V \<times> V - E; case x of (v1, v2) \<Rightarrow> insert v1 (insert v2 V) = V\<rbrakk> \<Longrightarrow> case x of (v1, v2) \<Rightarrow> \<not> all_security_requirements_fulfilled M \<lparr>nodes = insert v1 (insert v2 V), edges = insert (v1, v2) E\<rparr>
[PROOF STEP]
apply(erule_tac x=x and A="V \<times> V - E" in ballE)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>x \<in> V \<times> V - E; case x of (v1, v2) \<Rightarrow> insert v1 (insert v2 V) = V; \<not> all_security_requirements_fulfilled M \<lparr>nodes = V, edges = insert x E\<rparr>\<rbrakk> \<Longrightarrow> case x of (v1, v2) \<Rightarrow> \<not> all_security_requirements_fulfilled M \<lparr>nodes = insert v1 (insert v2 V), edges = insert (v1, v2) E\<rparr>
 2. \<And>x. \<lbrakk>x \<in> V \<times> V - E; case x of (v1, v2) \<Rightarrow> insert v1 (insert v2 V) = V; x \<notin> V \<times> V - E\<rbrakk> \<Longrightarrow> case x of (v1, v2) \<Rightarrow> \<not> all_security_requirements_fulfilled M \<lparr>nodes = insert v1 (insert v2 V), edges = insert (v1, v2) E\<rparr>
[PROOF STEP]
prefer 2
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>x \<in> V \<times> V - E; case x of (v1, v2) \<Rightarrow> insert v1 (insert v2 V) = V; x \<notin> V \<times> V - E\<rbrakk> \<Longrightarrow> case x of (v1, v2) \<Rightarrow> \<not> all_security_requirements_fulfilled M \<lparr>nodes = insert v1 (insert v2 V), edges = insert (v1, v2) E\<rparr>
 2. \<And>x. \<lbrakk>x \<in> V \<times> V - E; case x of (v1, v2) \<Rightarrow> insert v1 (insert v2 V) = V; \<not> all_security_requirements_fulfilled M \<lparr>nodes = V, edges = insert x E\<rparr>\<rbrakk> \<Longrightarrow> case x of (v1, v2) \<Rightarrow> \<not> all_security_requirements_fulfilled M \<lparr>nodes = insert v1 (insert v2 V), edges = insert (v1, v2) E\<rparr>
[PROOF STEP]
apply(simp; fail)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>x \<in> V \<times> V - E; case x of (v1, v2) \<Rightarrow> insert v1 (insert v2 V) = V; \<not> all_security_requirements_fulfilled M \<lparr>nodes = V, edges = insert x E\<rparr>\<rbrakk> \<Longrightarrow> case x of (v1, v2) \<Rightarrow> \<not> all_security_requirements_fulfilled M \<lparr>nodes = insert v1 (insert v2 V), edges = insert (v1, v2) E\<rparr>
[PROOF STEP]
apply(clarify)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a b. \<lbrakk>insert a (insert b V) = V; \<not> all_security_requirements_fulfilled M \<lparr>nodes = V, edges = insert (a, b) E\<rparr>; (a, b) \<notin> E; a \<in> V; b \<in> V; all_security_requirements_fulfilled M \<lparr>nodes = insert a (insert b V), edges = insert (a, b) E\<rparr>\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
by presburger
[PROOF STATE]
proof (state)
this:
\<forall>(v1, v2)\<in>V \<times> V - E. \<not> all_security_requirements_fulfilled M \<lparr>nodes = V \<union> {v1, v2}, edges = {(v1, v2)} \<union> E\<rparr>

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<forall>(v1, v2)\<in>nodes (generate_valid_topology M (fully_connected G)) \<times> nodes (generate_valid_topology M (fully_connected G)) - edges (generate_valid_topology M (fully_connected G)). \<not> all_security_requirements_fulfilled M (add_edge v1 v2 (generate_valid_topology M (fully_connected G)))

goal (1 subgoal):
 1. \<lbrakk>valid_reqs M; wf_graph G; \<forall>m\<in>set M. \<exists>P. \<forall>G. c_sinvar m G = (\<forall>e\<in>edges G. P e)\<rbrakk> \<Longrightarrow> max_topo M (generate_valid_topology M (fully_connected G))
[PROOF STEP]
from goal1 goal2
[PROOF STATE]
proof (chain)
picking this:
all_security_requirements_fulfilled M (generate_valid_topology M (fully_connected G))
\<forall>(v1, v2)\<in>nodes (generate_valid_topology M (fully_connected G)) \<times> nodes (generate_valid_topology M (fully_connected G)) - edges (generate_valid_topology M (fully_connected G)). \<not> all_security_requirements_fulfilled M (add_edge v1 v2 (generate_valid_topology M (fully_connected G)))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
all_security_requirements_fulfilled M (generate_valid_topology M (fully_connected G))
\<forall>(v1, v2)\<in>nodes (generate_valid_topology M (fully_connected G)) \<times> nodes (generate_valid_topology M (fully_connected G)) - edges (generate_valid_topology M (fully_connected G)). \<not> all_security_requirements_fulfilled M (add_edge v1 v2 (generate_valid_topology M (fully_connected G)))

goal (1 subgoal):
 1. max_topo M (generate_valid_topology M (fully_connected G))
[PROOF STEP]
unfolding max_topo_def
[PROOF STATE]
proof (prove)
using this:
all_security_requirements_fulfilled M (generate_valid_topology M (fully_connected G))
\<forall>(v1, v2)\<in>nodes (generate_valid_topology M (fully_connected G)) \<times> nodes (generate_valid_topology M (fully_connected G)) - edges (generate_valid_topology M (fully_connected G)). \<not> all_security_requirements_fulfilled M (add_edge v1 v2 (generate_valid_topology M (fully_connected G)))

goal (1 subgoal):
 1. all_security_requirements_fulfilled M (generate_valid_topology M (fully_connected G)) \<and> (\<forall>(v1, v2)\<in>nodes (generate_valid_topology M (fully_connected G)) \<times> nodes (generate_valid_topology M (fully_connected G)) - edges (generate_valid_topology M (fully_connected G)). \<not> all_security_requirements_fulfilled M (add_edge v1 v2 (generate_valid_topology M (fully_connected G))))
[PROOF STEP]
by presburger
[PROOF STATE]
proof (state)
this:
max_topo M (generate_valid_topology M (fully_connected G))

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma "(\<forall>x::'a. \<forall>y::'a. q x y = (\<forall>z. p z x \<longleftrightarrow> (p z y)))
  \<longrightarrow> (\<forall>x. (\<forall>y. q x y \<longleftrightarrow> (q y x)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<forall>x y. q x y = (\<forall>z. p z x = p z y)) \<longrightarrow> (\<forall>x y. q x y = q y x)
[PROOF STEP]
by blast


[STATEMENT]
lemma arity_var_ne_infinity_if_\<delta>_gt_0: "\<delta> > 0 \<Longrightarrow> arity_var x \<noteq> \<infinity>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 < \<delta> \<Longrightarrow> arity_var x \<noteq> \<infinity>
[PROOF STEP]
by (metis arity_hd.simps(1) arity_hd_ne_infinity_if_\<delta>_gt_0)


[STATEMENT]
theorem (in code) free_hull_min: assumes "G \<subseteq> \<langle>\<C>\<rangle>" shows "\<langle>G\<rangle>\<^sub>F \<subseteq> \<langle>\<C>\<rangle>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<langle>G\<rangle>\<^sub>F \<subseteq> \<langle>\<C>\<rangle>
[PROOF STEP]
using free_hull_mono[OF \<open>G \<subseteq> \<langle>\<C>\<rangle>\<close>]
[PROOF STATE]
proof (prove)
using this:
\<langle>G\<rangle>\<^sub>F \<subseteq> \<langle>\<langle>\<C>\<rangle>\<rangle>\<^sub>F

goal (1 subgoal):
 1. \<langle>G\<rangle>\<^sub>F \<subseteq> \<langle>\<C>\<rangle>
[PROOF STEP]
unfolding hull_gen_free_hull
[PROOF STATE]
proof (prove)
using this:
\<langle>G\<rangle>\<^sub>F \<subseteq> \<langle>\<C>\<rangle>\<^sub>F

goal (1 subgoal):
 1. \<langle>G\<rangle>\<^sub>F \<subseteq> \<langle>\<C>\<rangle>
[PROOF STEP]
unfolding code_gen_free_hull
[PROOF STATE]
proof (prove)
using this:
\<langle>G\<rangle>\<^sub>F \<subseteq> \<langle>\<C>\<rangle>

goal (1 subgoal):
 1. \<langle>G\<rangle>\<^sub>F \<subseteq> \<langle>\<C>\<rangle>
[PROOF STEP]
.


[STATEMENT]
lemma Rats_solution_QE:
  assumes "a \<in> \<rat>" "b \<in> \<rat>" "a \<noteq> 0"
  and "a*x^2 + b*x + c = 0"
  and "sqrt (discrim a b c) \<in> \<rat>"
  shows "x \<in> \<rat>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x \<in> \<rat>
[PROOF STEP]
using assms(1,2,5) discriminant_iff[THEN iffD1, OF assms(3,4)]
[PROOF STATE]
proof (prove)
using this:
a \<in> \<rat>
b \<in> \<rat>
sqrt (discrim a b c) \<in> \<rat>
0 \<le> discrim a b c \<and> (x = (- b + sqrt (discrim a b c)) / (2 * a) \<or> x = (- b - sqrt (discrim a b c)) / (2 * a))

goal (1 subgoal):
 1. x \<in> \<rat>
[PROOF STEP]
by auto


[STATEMENT]
lemma env_delete_join[simp]: "env_delete x (f \<squnion> (g::('a::type \<Rightarrow> 'b::{Finite_Join_cpo,pcpo}))) = env_delete x f \<squnion> env_delete x g"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. env_delete x (f \<squnion> g) = env_delete x f \<squnion> env_delete x g
[PROOF STEP]
by (metis env_delete_def fun_upd_meet_simp)


[STATEMENT]
lemma contour_integral_bound_exists:
assumes S: "open S"
    and g: "valid_path g"
    and pag: "path_image g \<subseteq> S"
  shows "\<exists>L. 0 < L \<and>
             (\<forall>f B. f holomorphic_on S \<and> (\<forall>z \<in> S. norm(f z) \<le> B)
               \<longrightarrow> norm(contour_integral g f) \<le> L*B)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>L>0. \<forall>f B. f holomorphic_on S \<and> (\<forall>z\<in>S. cmod (f z) \<le> B) \<longrightarrow> cmod (contour_integral g f) \<le> L * B
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<exists>L>0. \<forall>f B. f holomorphic_on S \<and> (\<forall>z\<in>S. cmod (f z) \<le> B) \<longrightarrow> cmod (contour_integral g f) \<le> L * B
[PROOF STEP]
have "path g"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. path g
[PROOF STEP]
using g
[PROOF STATE]
proof (prove)
using this:
valid_path g

goal (1 subgoal):
 1. path g
[PROOF STEP]
by (simp add: valid_path_imp_path)
[PROOF STATE]
proof (state)
this:
path g

goal (1 subgoal):
 1. \<exists>L>0. \<forall>f B. f holomorphic_on S \<and> (\<forall>z\<in>S. cmod (f z) \<le> B) \<longrightarrow> cmod (contour_integral g f) \<le> L * B
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
path g
[PROOF STEP]
obtain d::real and p
    where d: "0 < d"
      and p: "polynomial_function p" "path_image p \<subseteq> S"
      and pi: "\<And>f. f holomorphic_on S \<Longrightarrow> contour_integral g f = contour_integral p f"
[PROOF STATE]
proof (prove)
using this:
path g

goal (1 subgoal):
 1. (\<And>d p. \<lbrakk>0 < d; polynomial_function p; path_image p \<subseteq> S; \<And>f. f holomorphic_on S \<Longrightarrow> contour_integral g f = contour_integral p f\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using contour_integral_nearby_ends [OF S \<open>path g\<close> pag]
[PROOF STATE]
proof (prove)
using this:
path g
\<exists>d>0. \<forall>ga h. valid_path ga \<and> valid_path h \<and> (\<forall>t\<in>{0..1}. cmod (ga t - g t) < d \<and> cmod (h t - g t) < d) \<and> pathstart h = pathstart ga \<and> pathfinish h = pathfinish ga \<longrightarrow> path_image ga \<subseteq> S \<and> path_image h \<subseteq> S \<and> (\<forall>f. f holomorphic_on S \<longrightarrow> contour_integral h f = contour_integral ga f)

goal (1 subgoal):
 1. (\<And>d p. \<lbrakk>0 < d; polynomial_function p; path_image p \<subseteq> S; \<And>f. f holomorphic_on S \<Longrightarrow> contour_integral g f = contour_integral p f\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (metis cancel_comm_monoid_add_class.diff_cancel g norm_zero path_approx_polynomial_function valid_path_polynomial_function)
[PROOF STATE]
proof (state)
this:
0 < d
polynomial_function p
path_image p \<subseteq> S
?f holomorphic_on S \<Longrightarrow> contour_integral g ?f = contour_integral p ?f

goal (1 subgoal):
 1. \<exists>L>0. \<forall>f B. f holomorphic_on S \<and> (\<forall>z\<in>S. cmod (f z) \<le> B) \<longrightarrow> cmod (contour_integral g f) \<le> L * B
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
0 < d
polynomial_function p
path_image p \<subseteq> S
?f holomorphic_on S \<Longrightarrow> contour_integral g ?f = contour_integral p ?f
[PROOF STEP]
obtain p' where p': "polynomial_function p'"
    "\<And>x. (p has_vector_derivative (p' x)) (at x)"
[PROOF STATE]
proof (prove)
using this:
0 < d
polynomial_function p
path_image p \<subseteq> S
?f holomorphic_on S \<Longrightarrow> contour_integral g ?f = contour_integral p ?f

goal (1 subgoal):
 1. (\<And>p'. \<lbrakk>polynomial_function p'; \<And>x. (p has_vector_derivative p' x) (at x)\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (blast intro: has_vector_derivative_polynomial_function that)
[PROOF STATE]
proof (state)
this:
polynomial_function p'
(p has_vector_derivative p' ?x) (at ?x)

goal (1 subgoal):
 1. \<exists>L>0. \<forall>f B. f holomorphic_on S \<and> (\<forall>z\<in>S. cmod (f z) \<le> B) \<longrightarrow> cmod (contour_integral g f) \<le> L * B
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
polynomial_function p'
(p has_vector_derivative p' ?x) (at ?x)
[PROOF STEP]
have "bounded(p' ` {0..1})"
[PROOF STATE]
proof (prove)
using this:
polynomial_function p'
(p has_vector_derivative p' ?x) (at ?x)

goal (1 subgoal):
 1. bounded (p' ` {0..1})
[PROOF STEP]
using continuous_on_polymonial_function
[PROOF STATE]
proof (prove)
using this:
polynomial_function p'
(p has_vector_derivative p' ?x) (at ?x)
polynomial_function ?f \<Longrightarrow> continuous_on ?S ?f

goal (1 subgoal):
 1. bounded (p' ` {0..1})
[PROOF STEP]
by (force simp: intro!: compact_imp_bounded compact_continuous_image)
[PROOF STATE]
proof (state)
this:
bounded (p' ` {0..1})

goal (1 subgoal):
 1. \<exists>L>0. \<forall>f B. f holomorphic_on S \<and> (\<forall>z\<in>S. cmod (f z) \<le> B) \<longrightarrow> cmod (contour_integral g f) \<le> L * B
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
bounded (p' ` {0..1})
[PROOF STEP]
obtain L where L: "L>0" and nop': "\<And>x. \<lbrakk>0 \<le> x; x \<le> 1\<rbrakk> \<Longrightarrow> norm (p' x) \<le> L"
[PROOF STATE]
proof (prove)
using this:
bounded (p' ` {0..1})

goal (1 subgoal):
 1. (\<And>L. \<lbrakk>0 < L; \<And>x. \<lbrakk>0 \<le> x; x \<le> 1\<rbrakk> \<Longrightarrow> cmod (p' x) \<le> L\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (force simp: bounded_pos)
[PROOF STATE]
proof (state)
this:
0 < L
\<lbrakk>0 \<le> ?x; ?x \<le> 1\<rbrakk> \<Longrightarrow> cmod (p' ?x) \<le> L

goal (1 subgoal):
 1. \<exists>L>0. \<forall>f B. f holomorphic_on S \<and> (\<forall>z\<in>S. cmod (f z) \<le> B) \<longrightarrow> cmod (contour_integral g f) \<le> L * B
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
0 < L
\<lbrakk>0 \<le> ?x; ?x \<le> 1\<rbrakk> \<Longrightarrow> cmod (p' ?x) \<le> L

goal (1 subgoal):
 1. \<exists>L>0. \<forall>f B. f holomorphic_on S \<and> (\<forall>z\<in>S. cmod (f z) \<le> B) \<longrightarrow> cmod (contour_integral g f) \<le> L * B
[PROOF STEP]
fix f B
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<exists>L>0. \<forall>f B. f holomorphic_on S \<and> (\<forall>z\<in>S. cmod (f z) \<le> B) \<longrightarrow> cmod (contour_integral g f) \<le> L * B
[PROOF STEP]
assume f: "f holomorphic_on S" and B: "\<And>z. z\<in>S \<Longrightarrow> cmod (f z) \<le> B"
[PROOF STATE]
proof (state)
this:
f holomorphic_on S
?z \<in> S \<Longrightarrow> cmod (f ?z) \<le> B

goal (1 subgoal):
 1. \<exists>L>0. \<forall>f B. f holomorphic_on S \<and> (\<forall>z\<in>S. cmod (f z) \<le> B) \<longrightarrow> cmod (contour_integral g f) \<le> L * B
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
f holomorphic_on S
?z \<in> S \<Longrightarrow> cmod (f ?z) \<le> B
[PROOF STEP]
have "f contour_integrable_on p \<and> valid_path p"
[PROOF STATE]
proof (prove)
using this:
f holomorphic_on S
?z \<in> S \<Longrightarrow> cmod (f ?z) \<le> B

goal (1 subgoal):
 1. f contour_integrable_on p \<and> valid_path p
[PROOF STEP]
using p S
[PROOF STATE]
proof (prove)
using this:
f holomorphic_on S
?z \<in> S \<Longrightarrow> cmod (f ?z) \<le> B
polynomial_function p
path_image p \<subseteq> S
open S

goal (1 subgoal):
 1. f contour_integrable_on p \<and> valid_path p
[PROOF STEP]
by (blast intro: valid_path_polynomial_function contour_integrable_holomorphic_simple holomorphic_on_imp_continuous_on)
[PROOF STATE]
proof (state)
this:
f contour_integrable_on p \<and> valid_path p

goal (1 subgoal):
 1. \<exists>L>0. \<forall>f B. f holomorphic_on S \<and> (\<forall>z\<in>S. cmod (f z) \<le> B) \<longrightarrow> cmod (contour_integral g f) \<le> L * B
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
f contour_integrable_on p \<and> valid_path p

goal (1 subgoal):
 1. \<exists>L>0. \<forall>f B. f holomorphic_on S \<and> (\<forall>z\<in>S. cmod (f z) \<le> B) \<longrightarrow> cmod (contour_integral g f) \<le> L * B
[PROOF STEP]
have "cmod (vector_derivative p (at x)) * cmod (f (p x)) \<le> L * B" if "0 \<le> x" "x \<le> 1" for x
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. cmod (vector_derivative p (at x)) * cmod (f (p x)) \<le> L * B
[PROOF STEP]
proof (rule mult_mono)
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. cmod (vector_derivative p (at x)) \<le> L
 2. cmod (f (p x)) \<le> B
 3. 0 \<le> L
 4. 0 \<le> cmod (f (p x))
[PROOF STEP]
show "cmod (vector_derivative p (at x)) \<le> L"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. cmod (vector_derivative p (at x)) \<le> L
[PROOF STEP]
by (metis nop' p'(2) that vector_derivative_at)
[PROOF STATE]
proof (state)
this:
cmod (vector_derivative p (at x)) \<le> L

goal (3 subgoals):
 1. cmod (f (p x)) \<le> B
 2. 0 \<le> L
 3. 0 \<le> cmod (f (p x))
[PROOF STEP]
show "cmod (f (p x)) \<le> B"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. cmod (f (p x)) \<le> B
[PROOF STEP]
by (metis B atLeastAtMost_iff imageI p(2) path_defs(4) subset_eq that)
[PROOF STATE]
proof (state)
this:
cmod (f (p x)) \<le> B

goal (2 subgoals):
 1. 0 \<le> L
 2. 0 \<le> cmod (f (p x))
[PROOF STEP]
qed (use \<open>L>0\<close> in auto)
[PROOF STATE]
proof (state)
this:
\<lbrakk>0 \<le> ?x; ?x \<le> 1\<rbrakk> \<Longrightarrow> cmod (vector_derivative p (at ?x)) * cmod (f (p ?x)) \<le> L * B

goal (1 subgoal):
 1. \<exists>L>0. \<forall>f B. f holomorphic_on S \<and> (\<forall>z\<in>S. cmod (f z) \<le> B) \<longrightarrow> cmod (contour_integral g f) \<le> L * B
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
f contour_integrable_on p \<and> valid_path p
\<lbrakk>0 \<le> ?x; ?x \<le> 1\<rbrakk> \<Longrightarrow> cmod (vector_derivative p (at ?x)) * cmod (f (p ?x)) \<le> L * B
[PROOF STEP]
have "cmod (integral {0..1} (\<lambda>x. f (p x) * vector_derivative p (at x))) \<le> L * B"
[PROOF STATE]
proof (prove)
using this:
f contour_integrable_on p \<and> valid_path p
\<lbrakk>0 \<le> ?x; ?x \<le> 1\<rbrakk> \<Longrightarrow> cmod (vector_derivative p (at ?x)) * cmod (f (p ?x)) \<le> L * B

goal (1 subgoal):
 1. cmod (integral {0..1} (\<lambda>x. f (p x) * vector_derivative p (at x))) \<le> L * B
[PROOF STEP]
by (intro order_trans [OF integral_norm_bound_integral])
         (auto simp: mult.commute norm_mult contour_integrable_on)
[PROOF STATE]
proof (state)
this:
cmod (integral {0..1} (\<lambda>x. f (p x) * vector_derivative p (at x))) \<le> L * B

goal (1 subgoal):
 1. \<exists>L>0. \<forall>f B. f holomorphic_on S \<and> (\<forall>z\<in>S. cmod (f z) \<le> B) \<longrightarrow> cmod (contour_integral g f) \<le> L * B
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
cmod (integral {0..1} (\<lambda>x. f (p x) * vector_derivative p (at x))) \<le> L * B
[PROOF STEP]
have "cmod (contour_integral g f) \<le> L * B"
[PROOF STATE]
proof (prove)
using this:
cmod (integral {0..1} (\<lambda>x. f (p x) * vector_derivative p (at x))) \<le> L * B

goal (1 subgoal):
 1. cmod (contour_integral g f) \<le> L * B
[PROOF STEP]
using contour_integral_integral f pi
[PROOF STATE]
proof (prove)
using this:
cmod (integral {0..1} (\<lambda>x. f (p x) * vector_derivative p (at x))) \<le> L * B
contour_integral ?g ?f = integral {0..1} (\<lambda>x. ?f (?g x) * vector_derivative ?g (at x))
f holomorphic_on S
?f holomorphic_on S \<Longrightarrow> contour_integral g ?f = contour_integral p ?f

goal (1 subgoal):
 1. cmod (contour_integral g f) \<le> L * B
[PROOF STEP]
by presburger
[PROOF STATE]
proof (state)
this:
cmod (contour_integral g f) \<le> L * B

goal (1 subgoal):
 1. \<exists>L>0. \<forall>f B. f holomorphic_on S \<and> (\<forall>z\<in>S. cmod (f z) \<le> B) \<longrightarrow> cmod (contour_integral g f) \<le> L * B
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
\<lbrakk>?f2 holomorphic_on S; \<And>z. z \<in> S \<Longrightarrow> cmod (?f2 z) \<le> ?B2\<rbrakk> \<Longrightarrow> cmod (contour_integral g ?f2) \<le> L * ?B2

goal (1 subgoal):
 1. \<exists>L>0. \<forall>f B. f holomorphic_on S \<and> (\<forall>z\<in>S. cmod (f z) \<le> B) \<longrightarrow> cmod (contour_integral g f) \<le> L * B
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>?f2 holomorphic_on S; \<And>z. z \<in> S \<Longrightarrow> cmod (?f2 z) \<le> ?B2\<rbrakk> \<Longrightarrow> cmod (contour_integral g ?f2) \<le> L * ?B2
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?f2 holomorphic_on S; \<And>z. z \<in> S \<Longrightarrow> cmod (?f2 z) \<le> ?B2\<rbrakk> \<Longrightarrow> cmod (contour_integral g ?f2) \<le> L * ?B2

goal (1 subgoal):
 1. \<exists>L>0. \<forall>f B. f holomorphic_on S \<and> (\<forall>z\<in>S. cmod (f z) \<le> B) \<longrightarrow> cmod (contour_integral g f) \<le> L * B
[PROOF STEP]
using \<open>L > 0\<close>
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?f2 holomorphic_on S; \<And>z. z \<in> S \<Longrightarrow> cmod (?f2 z) \<le> ?B2\<rbrakk> \<Longrightarrow> cmod (contour_integral g ?f2) \<le> L * ?B2
0 < L

goal (1 subgoal):
 1. \<exists>L>0. \<forall>f B. f holomorphic_on S \<and> (\<forall>z\<in>S. cmod (f z) \<le> B) \<longrightarrow> cmod (contour_integral g f) \<le> L * B
[PROOF STEP]
by (intro exI[of _ L]) auto
[PROOF STATE]
proof (state)
this:
\<exists>L>0. \<forall>f B. f holomorphic_on S \<and> (\<forall>z\<in>S. cmod (f z) \<le> B) \<longrightarrow> cmod (contour_integral g f) \<le> L * B

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma powrat_inject_exp_strong [simp]:
   "\<lbrakk> 0 < x; x \<noteq> 1 \<rbrakk>  \<Longrightarrow> (x pow\<^sub>\<rat> r = x pow\<^sub>\<rat> s) = (s = r)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 < x; x \<noteq> 1\<rbrakk> \<Longrightarrow> (x pow\<^sub>\<rat> r = x pow\<^sub>\<rat> s) = (s = r)
[PROOF STEP]
using powrat_inject_exp_less_one
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>0 < ?x; ?x < 1\<rbrakk> \<Longrightarrow> (?x pow\<^sub>\<rat> ?r = ?x pow\<^sub>\<rat> ?s) = (?s = ?r)

goal (1 subgoal):
 1. \<lbrakk>0 < x; x \<noteq> 1\<rbrakk> \<Longrightarrow> (x pow\<^sub>\<rat> r = x pow\<^sub>\<rat> s) = (s = r)
[PROOF STEP]
by fastforce


[STATEMENT]
lemma word_less_nat_alt: "a < b \<longleftrightarrow> unat a < unat b"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (a < b) = (unat a < unat b)
[PROOF STEP]
by transfer (auto simp add: less_le [of 0])


[STATEMENT]
lemma "\<exists>x::'a::linordered_field. \<forall>y < x. \<exists>z > x + y.
  \<forall>w. 5 * w + 10 * x - z \<ge> y \<longrightarrow> w + 7 * x + 3 * z \<ge> 2 * y"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>x. \<forall>y<x. \<exists>z>x + y. \<forall>w. y \<le> (5::'a) * w + (10::'a) * x - z \<longrightarrow> (2::'a) * y \<le> w + (7::'a) * x + (3::'a) * z
[PROOF STEP]
by ferrack


[STATEMENT]
lemma measure_lborel_box_eq:
  "measure lborel (box l u) = (if \<forall>b\<in>Basis. l \<bullet> b \<le> u \<bullet> b then \<Prod>b\<in>Basis. (u - l) \<bullet> b else 0)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Sigma_Algebra.measure lborel (box l u) = (if \<forall>b\<in>Basis. l \<bullet> b \<le> u \<bullet> b then prod ((\<bullet>) (u - l)) Basis else 0)
[PROOF STEP]
using box_eq_empty(1)[THEN iffD2, of u l]
[PROOF STATE]
proof (prove)
using this:
\<exists>i\<in>Basis. u \<bullet> i \<le> l \<bullet> i \<Longrightarrow> box l u = {}

goal (1 subgoal):
 1. Sigma_Algebra.measure lborel (box l u) = (if \<forall>b\<in>Basis. l \<bullet> b \<le> u \<bullet> b then prod ((\<bullet>) (u - l)) Basis else 0)
[PROOF STEP]
by (auto simp: not_le dest!: less_imp_le) force


[STATEMENT]
lemma cblinfun_compose_scaleC_right[simp]:
  fixes A::"'b::complex_normed_vector \<Rightarrow>\<^sub>C\<^sub>L 'c::complex_normed_vector"
    and B::"'a::complex_normed_vector \<Rightarrow>\<^sub>C\<^sub>L 'b"
  shows \<open>A o\<^sub>C\<^sub>L (a *\<^sub>C B) = a *\<^sub>C (A o\<^sub>C\<^sub>L B)\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. A o\<^sub>C\<^sub>L a *\<^sub>C B = a *\<^sub>C (A o\<^sub>C\<^sub>L B)
[PROOF STEP]
apply transfer
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>A a B. \<lbrakk>bounded_clinear A; bounded_clinear B\<rbrakk> \<Longrightarrow> A \<circ> (\<lambda>x. a *\<^sub>C B x) = (\<lambda>x. a *\<^sub>C (A \<circ> B) x)
[PROOF STEP]
by (auto intro!: ext bounded_clinear.clinear complex_vector.linear_scale)


[STATEMENT]
lemma sint_n1: "sint (- 1) = - 1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. sint (- 1) = - 1
[PROOF STEP]
by (fact signed_minus_1)


[STATEMENT]
lemma enat_add_left_cancel_le: "a + b \<le> a + c \<longleftrightarrow> a = (\<infinity>::enat) \<or> b \<le> c"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (a + b \<le> a + c) = (a = \<infinity> \<or> b \<le> c)
[PROOF STEP]
unfolding plus_enat_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((case a of enat m \<Rightarrow> case b of enat n \<Rightarrow> enat (m + n) | \<infinity> \<Rightarrow> \<infinity> | \<infinity> \<Rightarrow> \<infinity>) \<le> (case a of enat m \<Rightarrow> case c of enat n \<Rightarrow> enat (m + n) | \<infinity> \<Rightarrow> \<infinity> | \<infinity> \<Rightarrow> \<infinity>)) = (a = \<infinity> \<or> b \<le> c)
[PROOF STEP]
by (simp split: enat.split)


[STATEMENT]
lemma eq_qe : "(\<exists>x. ((\<forall>(a, b, c)\<in>set eq. a * x\<^sup>2 + b * x + c = 0) \<and>
         (\<forall>(a, b, c)\<in>set les. a * x\<^sup>2 + b * x + c < 0))) =
    ((\<exists>(a', b', c')\<in>set eq.
         (a' = 0 \<and> b' \<noteq> 0) \<and>
         (\<forall>(d, e, f)\<in>set eq. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f = 0) \<and>
         (\<forall>(d, e, f)\<in>set les. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f < 0) \<or>
         a' \<noteq> 0 \<and>
         - b'\<^sup>2 + 4 * a' * c' \<le> 0 \<and>
         ((\<forall>(d, e, f)\<in>set eq.
              d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 +
              e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) +
              f =
              0) \<and>
          (\<forall>(d, e, f)\<in>set les.
              d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 +
              e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) +
              f
              < 0) \<or>
          (\<forall>(d, e, f)\<in>set eq.
              d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 +
              e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) +
              f =
              0) \<and>
          (\<forall>(d, e, f)\<in>set les.
              d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 +
              e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) +
              f
              < 0))) \<or>
     (\<forall>(d, e, f)\<in>set eq. d = 0 \<and> e = 0 \<and> f = 0) \<and>
     (\<exists>x. \<forall>(a, b, c)\<in>set les. a * x\<^sup>2 + b * x + c < 0))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<exists>x. (\<forall>(a, b, c)\<in>set eq. a * x\<^sup>2 + b * x + c = 0) \<and> (\<forall>(a, b, c)\<in>set les. a * x\<^sup>2 + b * x + c < 0)) = ((\<exists>(a', b', c')\<in>set eq. (a' = 0 \<and> b' \<noteq> 0) \<and> (\<forall>(d, e, f)\<in>set eq. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f < 0) \<or> a' \<noteq> 0 \<and> - b'\<^sup>2 + 4 * a' * c' \<le> 0 \<and> ((\<forall>(d, e, f)\<in>set eq. d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f < 0) \<or> (\<forall>(d, e, f)\<in>set eq. d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f < 0))) \<or> (\<forall>(d, e, f)\<in>set eq. d = 0 \<and> e = 0 \<and> f = 0) \<and> (\<exists>x. \<forall>(a, b, c)\<in>set les. a * x\<^sup>2 + b * x + c < 0))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (\<exists>x. (\<forall>(a, b, c)\<in>set eq. a * x\<^sup>2 + b * x + c = 0) \<and> (\<forall>(a, b, c)\<in>set les. a * x\<^sup>2 + b * x + c < 0)) = ((\<exists>(a', b', c')\<in>set eq. (a' = 0 \<and> b' \<noteq> 0) \<and> (\<forall>(d, e, f)\<in>set eq. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f < 0) \<or> a' \<noteq> 0 \<and> - b'\<^sup>2 + 4 * a' * c' \<le> 0 \<and> ((\<forall>(d, e, f)\<in>set eq. d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f < 0) \<or> (\<forall>(d, e, f)\<in>set eq. d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f < 0))) \<or> (\<forall>(d, e, f)\<in>set eq. d = 0 \<and> e = 0 \<and> f = 0) \<and> (\<exists>x. \<forall>(a, b, c)\<in>set les. a * x\<^sup>2 + b * x + c < 0))
[PROOF STEP]
have h1: "(\<exists>x. (\<forall>(a, b, c)\<in>set eq. a * x\<^sup>2 + b * x + c = 0) \<and>
         (\<forall>(a, b, c)\<in>set les. a * x\<^sup>2 + b * x + c < 0)) \<longrightarrow>
    ((\<exists>(a', b', c')\<in>set eq.
         (a' = 0 \<and> b' \<noteq> 0) \<and>
         (\<forall>(d, e, f)\<in>set eq. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f = 0) \<and>
         (\<forall>(d, e, f)\<in>set les. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f < 0) \<or>
         a' \<noteq> 0 \<and>
         - b'\<^sup>2 + 4 * a' * c' \<le> 0 \<and>
         ((\<forall>(d, e, f)\<in>set eq.
              d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 +
              e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) +
              f =
              0) \<and>
          (\<forall>(d, e, f)\<in>set les.
              d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 +
              e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) +
              f
              < 0) \<or>
          (\<forall>(d, e, f)\<in>set eq.
              d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 +
              e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) +
              f =
              0) \<and>
          (\<forall>(d, e, f)\<in>set les.
              d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 +
              e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) +
              f
              < 0))) \<or>
     (\<forall>(d, e, f)\<in>set eq. d = 0 \<and> e = 0 \<and> f = 0) \<and>
     (\<exists>x. \<forall>(a, b, c)\<in>set les. a * x\<^sup>2 + b * x + c < 0))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<exists>x. (\<forall>(a, b, c)\<in>set eq. a * x\<^sup>2 + b * x + c = 0) \<and> (\<forall>(a, b, c)\<in>set les. a * x\<^sup>2 + b * x + c < 0)) \<longrightarrow> (\<exists>(a', b', c')\<in>set eq. (a' = 0 \<and> b' \<noteq> 0) \<and> (\<forall>(d, e, f)\<in>set eq. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f < 0) \<or> a' \<noteq> 0 \<and> - b'\<^sup>2 + 4 * a' * c' \<le> 0 \<and> ((\<forall>(d, e, f)\<in>set eq. d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f < 0) \<or> (\<forall>(d, e, f)\<in>set eq. d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f < 0))) \<or> (\<forall>(d, e, f)\<in>set eq. d = 0 \<and> e = 0 \<and> f = 0) \<and> (\<exists>x. \<forall>(a, b, c)\<in>set les. a * x\<^sup>2 + b * x + c < 0)
[PROOF STEP]
using eq_qe_forwards
[PROOF STATE]
proof (prove)
using this:
\<exists>x. (\<forall>(a, b, c)\<in>set ?eq. a * x\<^sup>2 + b * x + c = 0) \<and> (\<forall>(a, b, c)\<in>set ?les. a * x\<^sup>2 + b * x + c < 0) \<Longrightarrow> (\<exists>(a', b', c')\<in>set ?eq. (a' = 0 \<and> b' \<noteq> 0) \<and> (\<forall>(d, e, f)\<in>set ?eq. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f = 0) \<and> (\<forall>(d, e, f)\<in>set ?les. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f < 0) \<or> a' \<noteq> 0 \<and> - b'\<^sup>2 + 4 * a' * c' \<le> 0 \<and> ((\<forall>(d, e, f)\<in>set ?eq. d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f = 0) \<and> (\<forall>(d, e, f)\<in>set ?les. d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f < 0) \<or> (\<forall>(d, e, f)\<in>set ?eq. d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f = 0) \<and> (\<forall>(d, e, f)\<in>set ?les. d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f < 0))) \<or> (\<forall>(d, e, f)\<in>set ?eq. d = 0 \<and> e = 0 \<and> f = 0) \<and> (\<exists>x. \<forall>(a, b, c)\<in>set ?les. a * x\<^sup>2 + b * x + c < 0)

goal (1 subgoal):
 1. (\<exists>x. (\<forall>(a, b, c)\<in>set eq. a * x\<^sup>2 + b * x + c = 0) \<and> (\<forall>(a, b, c)\<in>set les. a * x\<^sup>2 + b * x + c < 0)) \<longrightarrow> (\<exists>(a', b', c')\<in>set eq. (a' = 0 \<and> b' \<noteq> 0) \<and> (\<forall>(d, e, f)\<in>set eq. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f < 0) \<or> a' \<noteq> 0 \<and> - b'\<^sup>2 + 4 * a' * c' \<le> 0 \<and> ((\<forall>(d, e, f)\<in>set eq. d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f < 0) \<or> (\<forall>(d, e, f)\<in>set eq. d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f < 0))) \<or> (\<forall>(d, e, f)\<in>set eq. d = 0 \<and> e = 0 \<and> f = 0) \<and> (\<exists>x. \<forall>(a, b, c)\<in>set les. a * x\<^sup>2 + b * x + c < 0)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<exists>x. (\<forall>(a, b, c)\<in>set eq. a * x\<^sup>2 + b * x + c = 0) \<and> (\<forall>(a, b, c)\<in>set les. a * x\<^sup>2 + b * x + c < 0)) \<longrightarrow> (\<exists>(a', b', c')\<in>set eq. (a' = 0 \<and> b' \<noteq> 0) \<and> (\<forall>(d, e, f)\<in>set eq. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f < 0) \<or> a' \<noteq> 0 \<and> - b'\<^sup>2 + 4 * a' * c' \<le> 0 \<and> ((\<forall>(d, e, f)\<in>set eq. d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f < 0) \<or> (\<forall>(d, e, f)\<in>set eq. d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f < 0))) \<or> (\<forall>(d, e, f)\<in>set eq. d = 0 \<and> e = 0 \<and> f = 0) \<and> (\<exists>x. \<forall>(a, b, c)\<in>set les. a * x\<^sup>2 + b * x + c < 0)

goal (1 subgoal):
 1. (\<exists>x. (\<forall>(a, b, c)\<in>set eq. a * x\<^sup>2 + b * x + c = 0) \<and> (\<forall>(a, b, c)\<in>set les. a * x\<^sup>2 + b * x + c < 0)) = ((\<exists>(a', b', c')\<in>set eq. (a' = 0 \<and> b' \<noteq> 0) \<and> (\<forall>(d, e, f)\<in>set eq. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f < 0) \<or> a' \<noteq> 0 \<and> - b'\<^sup>2 + 4 * a' * c' \<le> 0 \<and> ((\<forall>(d, e, f)\<in>set eq. d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f < 0) \<or> (\<forall>(d, e, f)\<in>set eq. d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f < 0))) \<or> (\<forall>(d, e, f)\<in>set eq. d = 0 \<and> e = 0 \<and> f = 0) \<and> (\<exists>x. \<forall>(a, b, c)\<in>set les. a * x\<^sup>2 + b * x + c < 0))
[PROOF STEP]
have h2: "((\<exists>(a', b', c')\<in>set eq.
         (a' = 0 \<and> b' \<noteq> 0) \<and>
         (\<forall>(d, e, f)\<in>set eq. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f = 0) \<and>
         (\<forall>(d, e, f)\<in>set les. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f < 0) \<or>
         a' \<noteq> 0 \<and>
         - b'\<^sup>2 + 4 * a' * c' \<le> 0 \<and>
         ((\<forall>(d, e, f)\<in>set eq.
              d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 +
              e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) +
              f =
              0) \<and>
          (\<forall>(d, e, f)\<in>set les.
              d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 +
              e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) +
              f
              < 0) \<or>
          (\<forall>(d, e, f)\<in>set eq.
              d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 +
              e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) +
              f =
              0) \<and>
          (\<forall>(d, e, f)\<in>set les.
              d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 +
              e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) +
              f
              < 0))) \<or>
     (\<forall>(d, e, f)\<in>set eq. d = 0 \<and> e = 0 \<and> f = 0) \<and>
     (\<exists>x. \<forall>(a, b, c)\<in>set les. a * x\<^sup>2 + b * x + c < 0)) \<longrightarrow> (\<exists>x. (\<forall>(a, b, c)\<in>set eq. a * x\<^sup>2 + b * x + c = 0) \<and>
         (\<forall>(a, b, c)\<in>set les. a * x\<^sup>2 + b * x + c < 0))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<exists>(a', b', c')\<in>set eq. (a' = 0 \<and> b' \<noteq> 0) \<and> (\<forall>(d, e, f)\<in>set eq. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f < 0) \<or> a' \<noteq> 0 \<and> - b'\<^sup>2 + 4 * a' * c' \<le> 0 \<and> ((\<forall>(d, e, f)\<in>set eq. d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f < 0) \<or> (\<forall>(d, e, f)\<in>set eq. d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f < 0))) \<or> (\<forall>(d, e, f)\<in>set eq. d = 0 \<and> e = 0 \<and> f = 0) \<and> (\<exists>x. \<forall>(a, b, c)\<in>set les. a * x\<^sup>2 + b * x + c < 0) \<longrightarrow> (\<exists>x. (\<forall>(a, b, c)\<in>set eq. a * x\<^sup>2 + b * x + c = 0) \<and> (\<forall>(a, b, c)\<in>set les. a * x\<^sup>2 + b * x + c < 0))
[PROOF STEP]
using eq_qe_backwards
[PROOF STATE]
proof (prove)
using this:
(\<exists>(a', b', c')\<in>set ?eq. (a' = 0 \<and> b' \<noteq> 0) \<and> (\<forall>(d, e, f)\<in>set ?eq. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f = 0) \<and> (\<forall>(d, e, f)\<in>set ?les. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f < 0) \<or> a' \<noteq> 0 \<and> - b'\<^sup>2 + 4 * a' * c' \<le> 0 \<and> ((\<forall>(d, e, f)\<in>set ?eq. d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f = 0) \<and> (\<forall>(d, e, f)\<in>set ?les. d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f < 0) \<or> (\<forall>(d, e, f)\<in>set ?eq. d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f = 0) \<and> (\<forall>(d, e, f)\<in>set ?les. d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f < 0))) \<or> (\<forall>(d, e, f)\<in>set ?eq. d = 0 \<and> e = 0 \<and> f = 0) \<and> (\<exists>x. \<forall>(a, b, c)\<in>set ?les. a * x\<^sup>2 + b * x + c < 0) \<Longrightarrow> \<exists>x. (\<forall>(a, b, c)\<in>set ?eq. a * x\<^sup>2 + b * x + c = 0) \<and> (\<forall>(a, b, c)\<in>set ?les. a * x\<^sup>2 + b * x + c < 0)

goal (1 subgoal):
 1. (\<exists>(a', b', c')\<in>set eq. (a' = 0 \<and> b' \<noteq> 0) \<and> (\<forall>(d, e, f)\<in>set eq. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f < 0) \<or> a' \<noteq> 0 \<and> - b'\<^sup>2 + 4 * a' * c' \<le> 0 \<and> ((\<forall>(d, e, f)\<in>set eq. d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f < 0) \<or> (\<forall>(d, e, f)\<in>set eq. d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f < 0))) \<or> (\<forall>(d, e, f)\<in>set eq. d = 0 \<and> e = 0 \<and> f = 0) \<and> (\<exists>x. \<forall>(a, b, c)\<in>set les. a * x\<^sup>2 + b * x + c < 0) \<longrightarrow> (\<exists>x. (\<forall>(a, b, c)\<in>set eq. a * x\<^sup>2 + b * x + c = 0) \<and> (\<forall>(a, b, c)\<in>set les. a * x\<^sup>2 + b * x + c < 0))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<exists>(a', b', c')\<in>set eq. (a' = 0 \<and> b' \<noteq> 0) \<and> (\<forall>(d, e, f)\<in>set eq. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f < 0) \<or> a' \<noteq> 0 \<and> - b'\<^sup>2 + 4 * a' * c' \<le> 0 \<and> ((\<forall>(d, e, f)\<in>set eq. d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f < 0) \<or> (\<forall>(d, e, f)\<in>set eq. d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f < 0))) \<or> (\<forall>(d, e, f)\<in>set eq. d = 0 \<and> e = 0 \<and> f = 0) \<and> (\<exists>x. \<forall>(a, b, c)\<in>set les. a * x\<^sup>2 + b * x + c < 0) \<longrightarrow> (\<exists>x. (\<forall>(a, b, c)\<in>set eq. a * x\<^sup>2 + b * x + c = 0) \<and> (\<forall>(a, b, c)\<in>set les. a * x\<^sup>2 + b * x + c < 0))

goal (1 subgoal):
 1. (\<exists>x. (\<forall>(a, b, c)\<in>set eq. a * x\<^sup>2 + b * x + c = 0) \<and> (\<forall>(a, b, c)\<in>set les. a * x\<^sup>2 + b * x + c < 0)) = ((\<exists>(a', b', c')\<in>set eq. (a' = 0 \<and> b' \<noteq> 0) \<and> (\<forall>(d, e, f)\<in>set eq. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f < 0) \<or> a' \<noteq> 0 \<and> - b'\<^sup>2 + 4 * a' * c' \<le> 0 \<and> ((\<forall>(d, e, f)\<in>set eq. d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f < 0) \<or> (\<forall>(d, e, f)\<in>set eq. d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f < 0))) \<or> (\<forall>(d, e, f)\<in>set eq. d = 0 \<and> e = 0 \<and> f = 0) \<and> (\<exists>x. \<forall>(a, b, c)\<in>set les. a * x\<^sup>2 + b * x + c < 0))
[PROOF STEP]
have h3: "(\<exists>x. (\<forall>(a, b, c)\<in>set eq. a * x\<^sup>2 + b * x + c = 0) \<and>
         (\<forall>(a, b, c)\<in>set les. a * x\<^sup>2 + b * x + c < 0)) \<longleftrightarrow>
    ((\<exists>(a', b', c')\<in>set eq.
         (a' = 0 \<and> b' \<noteq> 0) \<and>
         (\<forall>(d, e, f)\<in>set eq. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f = 0) \<and>
         (\<forall>(d, e, f)\<in>set les. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f < 0) \<or>
         a' \<noteq> 0 \<and>
         - b'\<^sup>2 + 4 * a' * c' \<le> 0 \<and>
         ((\<forall>(d, e, f)\<in>set eq.
              d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 +
              e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) +
              f =
              0) \<and>
          (\<forall>(d, e, f)\<in>set les.
              d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 +
              e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) +
              f
              < 0) \<or>
          (\<forall>(d, e, f)\<in>set eq.
              d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 +
              e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) +
              f =
              0) \<and>
          (\<forall>(d, e, f)\<in>set les.
              d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 +
              e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) +
              f
              < 0))) \<or>
     (\<forall>(d, e, f)\<in>set eq. d = 0 \<and> e = 0 \<and> f = 0) \<and>
     (\<exists>x. \<forall>(a, b, c)\<in>set les. a * x\<^sup>2 + b * x + c < 0))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<exists>x. (\<forall>(a, b, c)\<in>set eq. a * x\<^sup>2 + b * x + c = 0) \<and> (\<forall>(a, b, c)\<in>set les. a * x\<^sup>2 + b * x + c < 0)) = ((\<exists>(a', b', c')\<in>set eq. (a' = 0 \<and> b' \<noteq> 0) \<and> (\<forall>(d, e, f)\<in>set eq. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f < 0) \<or> a' \<noteq> 0 \<and> - b'\<^sup>2 + 4 * a' * c' \<le> 0 \<and> ((\<forall>(d, e, f)\<in>set eq. d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f < 0) \<or> (\<forall>(d, e, f)\<in>set eq. d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f < 0))) \<or> (\<forall>(d, e, f)\<in>set eq. d = 0 \<and> e = 0 \<and> f = 0) \<and> (\<exists>x. \<forall>(a, b, c)\<in>set les. a * x\<^sup>2 + b * x + c < 0))
[PROOF STEP]
using h1 h2
[PROOF STATE]
proof (prove)
using this:
(\<exists>x. (\<forall>(a, b, c)\<in>set eq. a * x\<^sup>2 + b * x + c = 0) \<and> (\<forall>(a, b, c)\<in>set les. a * x\<^sup>2 + b * x + c < 0)) \<longrightarrow> (\<exists>(a', b', c')\<in>set eq. (a' = 0 \<and> b' \<noteq> 0) \<and> (\<forall>(d, e, f)\<in>set eq. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f < 0) \<or> a' \<noteq> 0 \<and> - b'\<^sup>2 + 4 * a' * c' \<le> 0 \<and> ((\<forall>(d, e, f)\<in>set eq. d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f < 0) \<or> (\<forall>(d, e, f)\<in>set eq. d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f < 0))) \<or> (\<forall>(d, e, f)\<in>set eq. d = 0 \<and> e = 0 \<and> f = 0) \<and> (\<exists>x. \<forall>(a, b, c)\<in>set les. a * x\<^sup>2 + b * x + c < 0)
(\<exists>(a', b', c')\<in>set eq. (a' = 0 \<and> b' \<noteq> 0) \<and> (\<forall>(d, e, f)\<in>set eq. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f < 0) \<or> a' \<noteq> 0 \<and> - b'\<^sup>2 + 4 * a' * c' \<le> 0 \<and> ((\<forall>(d, e, f)\<in>set eq. d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f < 0) \<or> (\<forall>(d, e, f)\<in>set eq. d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f < 0))) \<or> (\<forall>(d, e, f)\<in>set eq. d = 0 \<and> e = 0 \<and> f = 0) \<and> (\<exists>x. \<forall>(a, b, c)\<in>set les. a * x\<^sup>2 + b * x + c < 0) \<longrightarrow> (\<exists>x. (\<forall>(a, b, c)\<in>set eq. a * x\<^sup>2 + b * x + c = 0) \<and> (\<forall>(a, b, c)\<in>set les. a * x\<^sup>2 + b * x + c < 0))

goal (1 subgoal):
 1. (\<exists>x. (\<forall>(a, b, c)\<in>set eq. a * x\<^sup>2 + b * x + c = 0) \<and> (\<forall>(a, b, c)\<in>set les. a * x\<^sup>2 + b * x + c < 0)) = ((\<exists>(a', b', c')\<in>set eq. (a' = 0 \<and> b' \<noteq> 0) \<and> (\<forall>(d, e, f)\<in>set eq. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f < 0) \<or> a' \<noteq> 0 \<and> - b'\<^sup>2 + 4 * a' * c' \<le> 0 \<and> ((\<forall>(d, e, f)\<in>set eq. d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f < 0) \<or> (\<forall>(d, e, f)\<in>set eq. d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f < 0))) \<or> (\<forall>(d, e, f)\<in>set eq. d = 0 \<and> e = 0 \<and> f = 0) \<and> (\<exists>x. \<forall>(a, b, c)\<in>set les. a * x\<^sup>2 + b * x + c < 0))
[PROOF STEP]
by smt
[PROOF STATE]
proof (state)
this:
(\<exists>x. (\<forall>(a, b, c)\<in>set eq. a * x\<^sup>2 + b * x + c = 0) \<and> (\<forall>(a, b, c)\<in>set les. a * x\<^sup>2 + b * x + c < 0)) = ((\<exists>(a', b', c')\<in>set eq. (a' = 0 \<and> b' \<noteq> 0) \<and> (\<forall>(d, e, f)\<in>set eq. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f < 0) \<or> a' \<noteq> 0 \<and> - b'\<^sup>2 + 4 * a' * c' \<le> 0 \<and> ((\<forall>(d, e, f)\<in>set eq. d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f < 0) \<or> (\<forall>(d, e, f)\<in>set eq. d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f < 0))) \<or> (\<forall>(d, e, f)\<in>set eq. d = 0 \<and> e = 0 \<and> f = 0) \<and> (\<exists>x. \<forall>(a, b, c)\<in>set les. a * x\<^sup>2 + b * x + c < 0))

goal (1 subgoal):
 1. (\<exists>x. (\<forall>(a, b, c)\<in>set eq. a * x\<^sup>2 + b * x + c = 0) \<and> (\<forall>(a, b, c)\<in>set les. a * x\<^sup>2 + b * x + c < 0)) = ((\<exists>(a', b', c')\<in>set eq. (a' = 0 \<and> b' \<noteq> 0) \<and> (\<forall>(d, e, f)\<in>set eq. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f < 0) \<or> a' \<noteq> 0 \<and> - b'\<^sup>2 + 4 * a' * c' \<le> 0 \<and> ((\<forall>(d, e, f)\<in>set eq. d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f < 0) \<or> (\<forall>(d, e, f)\<in>set eq. d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f < 0))) \<or> (\<forall>(d, e, f)\<in>set eq. d = 0 \<and> e = 0 \<and> f = 0) \<and> (\<exists>x. \<forall>(a, b, c)\<in>set les. a * x\<^sup>2 + b * x + c < 0))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(\<exists>x. (\<forall>(a, b, c)\<in>set eq. a * x\<^sup>2 + b * x + c = 0) \<and> (\<forall>(a, b, c)\<in>set les. a * x\<^sup>2 + b * x + c < 0)) = ((\<exists>(a', b', c')\<in>set eq. (a' = 0 \<and> b' \<noteq> 0) \<and> (\<forall>(d, e, f)\<in>set eq. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f < 0) \<or> a' \<noteq> 0 \<and> - b'\<^sup>2 + 4 * a' * c' \<le> 0 \<and> ((\<forall>(d, e, f)\<in>set eq. d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f < 0) \<or> (\<forall>(d, e, f)\<in>set eq. d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f < 0))) \<or> (\<forall>(d, e, f)\<in>set eq. d = 0 \<and> e = 0 \<and> f = 0) \<and> (\<exists>x. \<forall>(a, b, c)\<in>set les. a * x\<^sup>2 + b * x + c < 0))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
(\<exists>x. (\<forall>(a, b, c)\<in>set eq. a * x\<^sup>2 + b * x + c = 0) \<and> (\<forall>(a, b, c)\<in>set les. a * x\<^sup>2 + b * x + c < 0)) = ((\<exists>(a', b', c')\<in>set eq. (a' = 0 \<and> b' \<noteq> 0) \<and> (\<forall>(d, e, f)\<in>set eq. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f < 0) \<or> a' \<noteq> 0 \<and> - b'\<^sup>2 + 4 * a' * c' \<le> 0 \<and> ((\<forall>(d, e, f)\<in>set eq. d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f < 0) \<or> (\<forall>(d, e, f)\<in>set eq. d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f < 0))) \<or> (\<forall>(d, e, f)\<in>set eq. d = 0 \<and> e = 0 \<and> f = 0) \<and> (\<exists>x. \<forall>(a, b, c)\<in>set les. a * x\<^sup>2 + b * x + c < 0))

goal (1 subgoal):
 1. (\<exists>x. (\<forall>(a, b, c)\<in>set eq. a * x\<^sup>2 + b * x + c = 0) \<and> (\<forall>(a, b, c)\<in>set les. a * x\<^sup>2 + b * x + c < 0)) = ((\<exists>(a', b', c')\<in>set eq. (a' = 0 \<and> b' \<noteq> 0) \<and> (\<forall>(d, e, f)\<in>set eq. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f < 0) \<or> a' \<noteq> 0 \<and> - b'\<^sup>2 + 4 * a' * c' \<le> 0 \<and> ((\<forall>(d, e, f)\<in>set eq. d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f < 0) \<or> (\<forall>(d, e, f)\<in>set eq. d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f < 0))) \<or> (\<forall>(d, e, f)\<in>set eq. d = 0 \<and> e = 0 \<and> f = 0) \<and> (\<exists>x. \<forall>(a, b, c)\<in>set les. a * x\<^sup>2 + b * x + c < 0))
[PROOF STEP]
by (auto)
[PROOF STATE]
proof (state)
this:
(\<exists>x. (\<forall>(a, b, c)\<in>set eq. a * x\<^sup>2 + b * x + c = 0) \<and> (\<forall>(a, b, c)\<in>set les. a * x\<^sup>2 + b * x + c < 0)) = ((\<exists>(a', b', c')\<in>set eq. (a' = 0 \<and> b' \<noteq> 0) \<and> (\<forall>(d, e, f)\<in>set eq. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * (- c' / b')\<^sup>2 + e * (- c' / b') + f < 0) \<or> a' \<noteq> 0 \<and> - b'\<^sup>2 + 4 * a' * c' \<le> 0 \<and> ((\<forall>(d, e, f)\<in>set eq. d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f < 0) \<or> (\<forall>(d, e, f)\<in>set eq. d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f = 0) \<and> (\<forall>(d, e, f)\<in>set les. d * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a'))\<^sup>2 + e * ((- b' + - 1 * sqrt (b'\<^sup>2 - 4 * a' * c')) / (2 * a')) + f < 0))) \<or> (\<forall>(d, e, f)\<in>set eq. d = 0 \<and> e = 0 \<and> f = 0) \<and> (\<exists>x. \<forall>(a, b, c)\<in>set les. a * x\<^sup>2 + b * x + c < 0))

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma InfCard_iff: "InfCard \<kappa> \<longleftrightarrow> Card \<kappa> \<and> infinite (elts \<kappa>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. InfCard \<kappa> = (Card \<kappa> \<and> infinite (elts \<kappa>))
[PROOF STEP]
proof (cases "\<omega> \<le> \<kappa>")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<omega> \<le> \<kappa> \<Longrightarrow> InfCard \<kappa> = (Card \<kappa> \<and> infinite (elts \<kappa>))
 2. \<not> \<omega> \<le> \<kappa> \<Longrightarrow> InfCard \<kappa> = (Card \<kappa> \<and> infinite (elts \<kappa>))
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
\<omega> \<le> \<kappa>

goal (2 subgoals):
 1. \<omega> \<le> \<kappa> \<Longrightarrow> InfCard \<kappa> = (Card \<kappa> \<and> infinite (elts \<kappa>))
 2. \<not> \<omega> \<le> \<kappa> \<Longrightarrow> InfCard \<kappa> = (Card \<kappa> \<and> infinite (elts \<kappa>))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<omega> \<le> \<kappa>
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<omega> \<le> \<kappa>

goal (1 subgoal):
 1. InfCard \<kappa> = (Card \<kappa> \<and> infinite (elts \<kappa>))
[PROOF STEP]
using inj_ord_of_nat lepoll_def less_eq_V_def
[PROOF STATE]
proof (prove)
using this:
\<omega> \<le> \<kappa>
inj ord_of_nat
?A \<lesssim> ?B \<equiv> \<exists>f. inj_on f ?A \<and> f ` ?A \<subseteq> ?B
?x \<le> ?y \<equiv> elts ?x \<subseteq> elts ?y

goal (1 subgoal):
 1. InfCard \<kappa> = (Card \<kappa> \<and> infinite (elts \<kappa>))
[PROOF STEP]
by (auto simp: InfCard_def \<omega>_def infinite_le_lepoll)
[PROOF STATE]
proof (state)
this:
InfCard \<kappa> = (Card \<kappa> \<and> infinite (elts \<kappa>))

goal (1 subgoal):
 1. \<not> \<omega> \<le> \<kappa> \<Longrightarrow> InfCard \<kappa> = (Card \<kappa> \<and> infinite (elts \<kappa>))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> \<omega> \<le> \<kappa> \<Longrightarrow> InfCard \<kappa> = (Card \<kappa> \<and> infinite (elts \<kappa>))
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
\<not> \<omega> \<le> \<kappa>

goal (1 subgoal):
 1. \<not> \<omega> \<le> \<kappa> \<Longrightarrow> InfCard \<kappa> = (Card \<kappa> \<and> infinite (elts \<kappa>))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<not> \<omega> \<le> \<kappa>
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<not> \<omega> \<le> \<kappa>

goal (1 subgoal):
 1. InfCard \<kappa> = (Card \<kappa> \<and> infinite (elts \<kappa>))
[PROOF STEP]
using Card_iff_initial InfCard_def infinite_Ord_omega
[PROOF STATE]
proof (prove)
using this:
\<not> \<omega> \<le> \<kappa>
Card ?\<kappa> = (Ord ?\<kappa> \<and> (\<forall>\<alpha>. Ord \<alpha> \<and> \<alpha> < ?\<kappa> \<longrightarrow> \<not> elts \<alpha> \<approx> elts ?\<kappa>))
InfCard ?\<kappa> \<equiv> Card ?\<kappa> \<and> \<omega> \<le> ?\<kappa>
\<lbrakk>Ord ?\<alpha>; infinite (elts ?\<alpha>)\<rbrakk> \<Longrightarrow> \<omega> \<le> ?\<alpha>

goal (1 subgoal):
 1. InfCard \<kappa> = (Card \<kappa> \<and> infinite (elts \<kappa>))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
InfCard \<kappa> = (Card \<kappa> \<and> infinite (elts \<kappa>))

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma (in CRR_market_viable) disc_call_option_lgeom:
  shows "(discounted_value r (\<lambda>m. (call_option T K)) T w) =
    (det_discount r T) * (max ((lgeom_proc u d init (stake T w)) - K) 0)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. discounted_value r (\<lambda>m. call_option T K) T w = det_discount r T * max (lgeom_proc u d init (stake T w) - K) 0
[PROOF STEP]
using det_discounted[of r "\<lambda>m. call_option T K" T w] call_option_lgeom[of T K w]
[PROOF STATE]
proof (prove)
using this:
discounted_value r (\<lambda>m. call_option T K) T w = det_discount r T * call_option T K w
call_option T K w = max (lgeom_proc u d init (stake T w) - K) 0

goal (1 subgoal):
 1. discounted_value r (\<lambda>m. call_option T K) T w = det_discount r T * max (lgeom_proc u d init (stake T w) - K) 0
[PROOF STEP]
by simp