[STATEMENT]
theorem generate_valid_topology_some_sound:
    "\<lbrakk> valid_reqs M; wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es \<rbrakk> \<Longrightarrow>
    all_security_requirements_fulfilled M (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>valid_reqs M; wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
proof(induction M)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<lbrakk>valid_reqs []; wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled [] (generate_valid_topology_some [] Es \<lparr>nodes = V, edges = E\<rparr>)
 2. \<And>a M. \<lbrakk>\<lbrakk>valid_reqs M; wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>); valid_reqs (a # M); wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled (a # M) (generate_valid_topology_some (a # M) Es \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
case Nil
[PROOF STATE]
proof (state)
this:
valid_reqs []
wf_graph \<lparr>nodes = V, edges = E\<rparr>
set Es = E
distinct Es

goal (2 subgoals):
 1. \<lbrakk>valid_reqs []; wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled [] (generate_valid_topology_some [] Es \<lparr>nodes = V, edges = E\<rparr>)
 2. \<And>a M. \<lbrakk>\<lbrakk>valid_reqs M; wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>); valid_reqs (a # M); wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled (a # M) (generate_valid_topology_some (a # M) Es \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
valid_reqs []
wf_graph \<lparr>nodes = V, edges = E\<rparr>
set Es = E
distinct Es

goal (1 subgoal):
 1. all_security_requirements_fulfilled [] (generate_valid_topology_some [] Es \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
by(simp add: all_security_requirements_fulfilled_def)
[PROOF STATE]
proof (state)
this:
all_security_requirements_fulfilled [] (generate_valid_topology_some [] Es \<lparr>nodes = V, edges = E\<rparr>)

goal (1 subgoal):
 1. \<And>a M. \<lbrakk>\<lbrakk>valid_reqs M; wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>); valid_reqs (a # M); wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled (a # M) (generate_valid_topology_some (a # M) Es \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a M. \<lbrakk>\<lbrakk>valid_reqs M; wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>); valid_reqs (a # M); wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled (a # M) (generate_valid_topology_some (a # M) Es \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
case (Cons m M)
[PROOF STATE]
proof (state)
this:
\<lbrakk>valid_reqs M; wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>)
valid_reqs (m # M)
wf_graph \<lparr>nodes = V, edges = E\<rparr>
set Es = E
distinct Es

goal (1 subgoal):
 1. \<And>a M. \<lbrakk>\<lbrakk>valid_reqs M; wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>); valid_reqs (a # M); wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled (a # M) (generate_valid_topology_some (a # M) Es \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
from valid_reqs1[OF Cons(2)]
[PROOF STATE]
proof (chain)
picking this:
configured_SecurityInvariant m
[PROOF STEP]
have validReq: "configured_SecurityInvariant m"
[PROOF STATE]
proof (prove)
using this:
configured_SecurityInvariant m

goal (1 subgoal):
 1. configured_SecurityInvariant m
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
configured_SecurityInvariant m

goal (1 subgoal):
 1. \<And>a M. \<lbrakk>\<lbrakk>valid_reqs M; wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>); valid_reqs (a # M); wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled (a # M) (generate_valid_topology_some (a # M) Es \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
from configured_SecurityInvariant.sinvar_valid_remove_minimalize_offending_overapprox[OF
          validReq Cons.prems(2) _  Cons.prems(3) Cons.prems(4)]
[PROOF STATE]
proof (chain)
picking this:
\<not> c_sinvar m \<lparr>nodes = V, edges = E\<rparr> \<Longrightarrow> c_sinvar m \<lparr>nodes = V, edges = E - set (SecurityInvariant_withOffendingFlows.minimalize_offending_overapprox (\<lambda>G nP. c_sinvar m G) Es [] \<lparr>nodes = V, edges = E\<rparr> ?nP)\<rparr>
[PROOF STEP]
have rm_off_valid:
         "\<not> c_sinvar m \<lparr>nodes = V, edges = E\<rparr>\<Longrightarrow>
           c_sinvar m \<lparr>nodes = V, edges = E - (set (minimalize_offending_overapprox (c_sinvar m) Es [] \<lparr>nodes = V, edges = E\<rparr>))\<rparr>"
[PROOF STATE]
proof (prove)
using this:
\<not> c_sinvar m \<lparr>nodes = V, edges = E\<rparr> \<Longrightarrow> c_sinvar m \<lparr>nodes = V, edges = E - set (SecurityInvariant_withOffendingFlows.minimalize_offending_overapprox (\<lambda>G nP. c_sinvar m G) Es [] \<lparr>nodes = V, edges = E\<rparr> ?nP)\<rparr>

goal (1 subgoal):
 1. \<not> c_sinvar m \<lparr>nodes = V, edges = E\<rparr> \<Longrightarrow> c_sinvar m \<lparr>nodes = V, edges = E - set (minimalize_offending_overapprox (c_sinvar m) Es [] \<lparr>nodes = V, edges = E\<rparr>)\<rparr>
[PROOF STEP]
apply(subst(asm) minimalize_offending_overapprox_boundnP[symmetric])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<not> c_sinvar m \<lparr>nodes = V, edges = E\<rparr>; \<And>nP. \<not> c_sinvar m \<lparr>nodes = V, edges = E\<rparr> \<Longrightarrow> c_sinvar m \<lparr>nodes = V, edges = E - set (minimalize_offending_overapprox (c_sinvar m) Es [] \<lparr>nodes = V, edges = E\<rparr>)\<rparr>\<rbrakk> \<Longrightarrow> c_sinvar m \<lparr>nodes = V, edges = E - set (minimalize_offending_overapprox (c_sinvar m) Es [] \<lparr>nodes = V, edges = E\<rparr>)\<rparr>
[PROOF STEP]
(*TODO: type for nP unspecified!*)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<not> c_sinvar m \<lparr>nodes = V, edges = E\<rparr>; \<And>nP. \<not> c_sinvar m \<lparr>nodes = V, edges = E\<rparr> \<Longrightarrow> c_sinvar m \<lparr>nodes = V, edges = E - set (minimalize_offending_overapprox (c_sinvar m) Es [] \<lparr>nodes = V, edges = E\<rparr>)\<rparr>\<rbrakk> \<Longrightarrow> c_sinvar m \<lparr>nodes = V, edges = E - set (minimalize_offending_overapprox (c_sinvar m) Es [] \<lparr>nodes = V, edges = E\<rparr>)\<rparr>
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<not> c_sinvar m \<lparr>nodes = V, edges = E\<rparr> \<Longrightarrow> c_sinvar m \<lparr>nodes = V, edges = E - set (minimalize_offending_overapprox (c_sinvar m) Es [] \<lparr>nodes = V, edges = E\<rparr>)\<rparr>

goal (1 subgoal):
 1. \<And>a M. \<lbrakk>\<lbrakk>valid_reqs M; wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>); valid_reqs (a # M); wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled (a # M) (generate_valid_topology_some (a # M) Es \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
have generate_valid_topology_some_nodes: "nodes (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>) = V"
          for M::"'a SecurityInvariant_configured list" and V E
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. nodes (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>) = V
[PROOF STEP]
proof(induction M)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. nodes (generate_valid_topology_some [] Es \<lparr>nodes = V, edges = E\<rparr>) = V
 2. \<And>a M. nodes (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>) = V \<Longrightarrow> nodes (generate_valid_topology_some (a # M) Es \<lparr>nodes = V, edges = E\<rparr>) = V
[PROOF STEP]
qed(simp_all add: delete_edges_simp2)
[PROOF STATE]
proof (state)
this:
nodes (generate_valid_topology_some ?M Es \<lparr>nodes = ?V, edges = ?E\<rparr>) = ?V

goal (1 subgoal):
 1. \<And>a M. \<lbrakk>\<lbrakk>valid_reqs M; wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>); valid_reqs (a # M); wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled (a # M) (generate_valid_topology_some (a # M) Es \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
have generate_valid_topology_some_edges: "edges (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>) \<subseteq> E"
          for M::"'a SecurityInvariant_configured list" and V E
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. edges (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>) \<subseteq> E
[PROOF STEP]
proof(induction M)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. edges (generate_valid_topology_some [] Es \<lparr>nodes = V, edges = E\<rparr>) \<subseteq> E
 2. \<And>a M. edges (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>) \<subseteq> E \<Longrightarrow> edges (generate_valid_topology_some (a # M) Es \<lparr>nodes = V, edges = E\<rparr>) \<subseteq> E
[PROOF STEP]
qed(auto simp add: delete_edges_simp2)
[PROOF STATE]
proof (state)
this:
edges (generate_valid_topology_some ?M Es \<lparr>nodes = ?V, edges = ?E\<rparr>) \<subseteq> ?E

goal (1 subgoal):
 1. \<And>a M. \<lbrakk>\<lbrakk>valid_reqs M; wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>); valid_reqs (a # M); wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled (a # M) (generate_valid_topology_some (a # M) Es \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
from configured_SecurityInvariant.mono_sinvar[OF validReq Cons.prems(2),
              of "edges (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>)"]
            generate_valid_topology_some_edges
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>edges (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>) \<subseteq> E; c_sinvar m \<lparr>nodes = V, edges = E\<rparr>\<rbrakk> \<Longrightarrow> c_sinvar m \<lparr>nodes = V, edges = edges (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>)\<rparr>
edges (generate_valid_topology_some ?M Es \<lparr>nodes = ?V, edges = ?E\<rparr>) \<subseteq> ?E
[PROOF STEP]
have "c_sinvar m \<lparr>nodes = V, edges = E\<rparr> \<Longrightarrow>
            c_sinvar m \<lparr>nodes = V, edges = edges (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>)\<rparr>"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>edges (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>) \<subseteq> E; c_sinvar m \<lparr>nodes = V, edges = E\<rparr>\<rbrakk> \<Longrightarrow> c_sinvar m \<lparr>nodes = V, edges = edges (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>)\<rparr>
edges (generate_valid_topology_some ?M Es \<lparr>nodes = ?V, edges = ?E\<rparr>) \<subseteq> ?E

goal (1 subgoal):
 1. c_sinvar m \<lparr>nodes = V, edges = E\<rparr> \<Longrightarrow> c_sinvar m \<lparr>nodes = V, edges = edges (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>)\<rparr>
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
c_sinvar m \<lparr>nodes = V, edges = E\<rparr> \<Longrightarrow> c_sinvar m \<lparr>nodes = V, edges = edges (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>)\<rparr>

goal (1 subgoal):
 1. \<And>a M. \<lbrakk>\<lbrakk>valid_reqs M; wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>); valid_reqs (a # M); wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled (a # M) (generate_valid_topology_some (a # M) Es \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
c_sinvar m \<lparr>nodes = V, edges = E\<rparr> \<Longrightarrow> c_sinvar m \<lparr>nodes = V, edges = edges (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>)\<rparr>

goal (1 subgoal):
 1. \<And>a M. \<lbrakk>\<lbrakk>valid_reqs M; wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>); valid_reqs (a # M); wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled (a # M) (generate_valid_topology_some (a # M) Es \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
from configured_SecurityInvariant.defined_offending'[OF validReq Cons.prems(2)]
[PROOF STATE]
proof (chain)
picking this:
\<not> c_sinvar m \<lparr>nodes = V, edges = E\<rparr> \<Longrightarrow> c_offending_flows m \<lparr>nodes = V, edges = E\<rparr> \<noteq> {}
[PROOF STEP]
have not_sinvar_off:
          "\<not> c_sinvar m \<lparr>nodes = V, edges = E\<rparr> \<Longrightarrow> c_offending_flows m \<lparr>nodes = V, edges = E\<rparr> \<noteq> {}"
[PROOF STATE]
proof (prove)
using this:
\<not> c_sinvar m \<lparr>nodes = V, edges = E\<rparr> \<Longrightarrow> c_offending_flows m \<lparr>nodes = V, edges = E\<rparr> \<noteq> {}

goal (1 subgoal):
 1. \<not> c_sinvar m \<lparr>nodes = V, edges = E\<rparr> \<Longrightarrow> c_offending_flows m \<lparr>nodes = V, edges = E\<rparr> \<noteq> {}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<not> c_sinvar m \<lparr>nodes = V, edges = E\<rparr> \<Longrightarrow> c_offending_flows m \<lparr>nodes = V, edges = E\<rparr> \<noteq> {}

goal (1 subgoal):
 1. \<And>a M. \<lbrakk>\<lbrakk>valid_reqs M; wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>); valid_reqs (a # M); wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled (a # M) (generate_valid_topology_some (a # M) Es \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
c_sinvar m \<lparr>nodes = V, edges = E\<rparr> \<Longrightarrow> c_sinvar m \<lparr>nodes = V, edges = edges (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>)\<rparr>
\<not> c_sinvar m \<lparr>nodes = V, edges = E\<rparr> \<Longrightarrow> c_offending_flows m \<lparr>nodes = V, edges = E\<rparr> \<noteq> {}
[PROOF STEP]
have goal_sinvar_m:
          "c_offending_flows m \<lparr>nodes = V, edges = E\<rparr> = {} \<Longrightarrow>
              c_sinvar m (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>)"
[PROOF STATE]
proof (prove)
using this:
c_sinvar m \<lparr>nodes = V, edges = E\<rparr> \<Longrightarrow> c_sinvar m \<lparr>nodes = V, edges = edges (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>)\<rparr>
\<not> c_sinvar m \<lparr>nodes = V, edges = E\<rparr> \<Longrightarrow> c_offending_flows m \<lparr>nodes = V, edges = E\<rparr> \<noteq> {}

goal (1 subgoal):
 1. c_offending_flows m \<lparr>nodes = V, edges = E\<rparr> = {} \<Longrightarrow> c_sinvar m (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
using generate_valid_topology_some_nodes
[PROOF STATE]
proof (prove)
using this:
c_sinvar m \<lparr>nodes = V, edges = E\<rparr> \<Longrightarrow> c_sinvar m \<lparr>nodes = V, edges = edges (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>)\<rparr>
\<not> c_sinvar m \<lparr>nodes = V, edges = E\<rparr> \<Longrightarrow> c_offending_flows m \<lparr>nodes = V, edges = E\<rparr> \<noteq> {}
nodes (generate_valid_topology_some ?M Es \<lparr>nodes = ?V, edges = ?E\<rparr>) = ?V

goal (1 subgoal):
 1. c_offending_flows m \<lparr>nodes = V, edges = E\<rparr> = {} \<Longrightarrow> c_sinvar m (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
by (metis graph.select_convs(1) graph.select_convs(2) graph_eq_intro)
[PROOF STATE]
proof (state)
this:
c_offending_flows m \<lparr>nodes = V, edges = E\<rparr> = {} \<Longrightarrow> c_sinvar m (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>)

goal (1 subgoal):
 1. \<And>a M. \<lbrakk>\<lbrakk>valid_reqs M; wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>); valid_reqs (a # M); wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled (a # M) (generate_valid_topology_some (a # M) Es \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
from valid_reqs2[OF Cons(2)]
[PROOF STATE]
proof (chain)
picking this:
valid_reqs M
[PROOF STEP]
have "valid_reqs M"
[PROOF STATE]
proof (prove)
using this:
valid_reqs M

goal (1 subgoal):
 1. valid_reqs M
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
valid_reqs M

goal (1 subgoal):
 1. \<And>a M. \<lbrakk>\<lbrakk>valid_reqs M; wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>); valid_reqs (a # M); wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled (a # M) (generate_valid_topology_some (a # M) Es \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
from Cons.IH[OF \<open>valid_reqs M\<close> Cons(3)] Cons.prems
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>)
valid_reqs (m # M)
wf_graph \<lparr>nodes = V, edges = E\<rparr>
set Es = E
distinct Es
[PROOF STEP]
have IH:
          "all_security_requirements_fulfilled M (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>)"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>)
valid_reqs (m # M)
wf_graph \<lparr>nodes = V, edges = E\<rparr>
set Es = E
distinct Es

goal (1 subgoal):
 1. all_security_requirements_fulfilled M (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
all_security_requirements_fulfilled M (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>)

goal (1 subgoal):
 1. \<And>a M. \<lbrakk>\<lbrakk>valid_reqs M; wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>); valid_reqs (a # M); wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled (a # M) (generate_valid_topology_some (a # M) Es \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
have wf_graph_generate_valid_topology_some: "wf_graph G \<Longrightarrow> wf_graph (generate_valid_topology_some M Es G)"
          for G
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. wf_graph G \<Longrightarrow> wf_graph (generate_valid_topology_some M Es G)
[PROOF STEP]
(*TODO: tune*)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. wf_graph G \<Longrightarrow> wf_graph (generate_valid_topology_some M Es G)
[PROOF STEP]
apply(cases G)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>nodes edges. \<lbrakk>wf_graph G; G = \<lparr>nodes = nodes, edges = edges\<rparr>\<rbrakk> \<Longrightarrow> wf_graph (generate_valid_topology_some M Es G)
[PROOF STEP]
apply(simp add: wf_graph_def generate_valid_topology_some_nodes)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>nodes edgesa. \<lbrakk>fst ` edgesa \<subseteq> nodes \<and> snd ` edgesa \<subseteq> nodes \<and> finite edgesa \<and> finite nodes; G = \<lparr>nodes = nodes, edges = edgesa\<rparr>\<rbrakk> \<Longrightarrow> fst ` edges (generate_valid_topology_some M Es \<lparr>nodes = nodes, edges = edgesa\<rparr>) \<subseteq> nodes \<and> snd ` edges (generate_valid_topology_some M Es \<lparr>nodes = nodes, edges = edgesa\<rparr>) \<subseteq> nodes \<and> finite (edges (generate_valid_topology_some M Es \<lparr>nodes = nodes, edges = edgesa\<rparr>))
[PROOF STEP]
using generate_valid_topology_some_edges
[PROOF STATE]
proof (prove)
using this:
edges (generate_valid_topology_some ?M Es \<lparr>nodes = ?V, edges = ?E\<rparr>) \<subseteq> ?E

goal (1 subgoal):
 1. \<And>nodes edgesa. \<lbrakk>fst ` edgesa \<subseteq> nodes \<and> snd ` edgesa \<subseteq> nodes \<and> finite edgesa \<and> finite nodes; G = \<lparr>nodes = nodes, edges = edgesa\<rparr>\<rbrakk> \<Longrightarrow> fst ` edges (generate_valid_topology_some M Es \<lparr>nodes = nodes, edges = edgesa\<rparr>) \<subseteq> nodes \<and> snd ` edges (generate_valid_topology_some M Es \<lparr>nodes = nodes, edges = edgesa\<rparr>) \<subseteq> nodes \<and> finite (edges (generate_valid_topology_some M Es \<lparr>nodes = nodes, edges = edgesa\<rparr>))
[PROOF STEP]
by (meson dual_order.trans image_mono rev_finite_subset)
[PROOF STATE]
proof (state)
this:
wf_graph ?G \<Longrightarrow> wf_graph (generate_valid_topology_some M Es ?G)

goal (1 subgoal):
 1. \<And>a M. \<lbrakk>\<lbrakk>valid_reqs M; wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>); valid_reqs (a # M); wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled (a # M) (generate_valid_topology_some (a # M) Es \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
wf_graph ?G \<Longrightarrow> wf_graph (generate_valid_topology_some M Es ?G)

goal (1 subgoal):
 1. \<And>a M. \<lbrakk>\<lbrakk>valid_reqs M; wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>); valid_reqs (a # M); wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled (a # M) (generate_valid_topology_some (a # M) Es \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
assume notempty: "c_offending_flows m \<lparr>nodes = V, edges = E\<rparr> \<noteq> {}"
[PROOF STATE]
proof (state)
this:
c_offending_flows m \<lparr>nodes = V, edges = E\<rparr> \<noteq> {}

goal (1 subgoal):
 1. \<And>a M. \<lbrakk>\<lbrakk>valid_reqs M; wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>); valid_reqs (a # M); wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled (a # M) (generate_valid_topology_some (a # M) Es \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
hence "\<exists> hypE. (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>) = \<lparr>nodes = V, edges = hypE\<rparr>"
[PROOF STATE]
proof (prove)
using this:
c_offending_flows m \<lparr>nodes = V, edges = E\<rparr> \<noteq> {}

goal (1 subgoal):
 1. \<exists>hypE. generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr> = \<lparr>nodes = V, edges = hypE\<rparr>
[PROOF STEP]
proof(induction M arbitrary: V E)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>V E. c_offending_flows m \<lparr>nodes = V, edges = E\<rparr> \<noteq> {} \<Longrightarrow> \<exists>hypE. generate_valid_topology_some [] Es \<lparr>nodes = V, edges = E\<rparr> = \<lparr>nodes = V, edges = hypE\<rparr>
 2. \<And>a M V E. \<lbrakk>\<And>V E. c_offending_flows m \<lparr>nodes = V, edges = E\<rparr> \<noteq> {} \<Longrightarrow> \<exists>hypE. generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr> = \<lparr>nodes = V, edges = hypE\<rparr>; c_offending_flows m \<lparr>nodes = V, edges = E\<rparr> \<noteq> {}\<rbrakk> \<Longrightarrow> \<exists>hypE. generate_valid_topology_some (a # M) Es \<lparr>nodes = V, edges = E\<rparr> = \<lparr>nodes = V, edges = hypE\<rparr>
[PROOF STEP]
qed(simp_all add: delete_edges_simp2 generate_valid_topology_some_nodes)
[PROOF STATE]
proof (state)
this:
\<exists>hypE. generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr> = \<lparr>nodes = V, edges = hypE\<rparr>

goal (1 subgoal):
 1. \<And>a M. \<lbrakk>\<lbrakk>valid_reqs M; wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>); valid_reqs (a # M); wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled (a # M) (generate_valid_topology_some (a # M) Es \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
from this
[PROOF STATE]
proof (chain)
picking this:
\<exists>hypE. generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr> = \<lparr>nodes = V, edges = hypE\<rparr>
[PROOF STEP]
obtain E_IH where E_IH_prop:
            "(generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>) = \<lparr>nodes = V, edges = E_IH\<rparr>"
[PROOF STATE]
proof (prove)
using this:
\<exists>hypE. generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr> = \<lparr>nodes = V, edges = hypE\<rparr>

goal (1 subgoal):
 1. (\<And>E_IH. generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr> = \<lparr>nodes = V, edges = E_IH\<rparr> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr> = \<lparr>nodes = V, edges = E_IH\<rparr>

goal (1 subgoal):
 1. \<And>a M. \<lbrakk>\<lbrakk>valid_reqs M; wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>); valid_reqs (a # M); wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled (a # M) (generate_valid_topology_some (a # M) Es \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
from wf_graph_generate_valid_topology_some[OF Cons(3)] E_IH_prop
[PROOF STATE]
proof (chain)
picking this:
wf_graph (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>)
generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr> = \<lparr>nodes = V, edges = E_IH\<rparr>
[PROOF STEP]
have valid_G_E_IH: "wf_graph \<lparr>nodes = V, edges = E_IH\<rparr>"
[PROOF STATE]
proof (prove)
using this:
wf_graph (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>)
generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr> = \<lparr>nodes = V, edges = E_IH\<rparr>

goal (1 subgoal):
 1. wf_graph \<lparr>nodes = V, edges = E_IH\<rparr>
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
wf_graph \<lparr>nodes = V, edges = E_IH\<rparr>

goal (1 subgoal):
 1. \<And>a M. \<lbrakk>\<lbrakk>valid_reqs M; wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>); valid_reqs (a # M); wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled (a # M) (generate_valid_topology_some (a # M) Es \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
from all_security_requirements_fulfilled_mono[OF \<open>valid_reqs M\<close> _ valid_G_E_IH ] IH E_IH_prop
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>?E' \<subseteq> E_IH; all_security_requirements_fulfilled M \<lparr>nodes = V, edges = E_IH\<rparr>\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M \<lparr>nodes = V, edges = ?E'\<rparr>
all_security_requirements_fulfilled M (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>)
generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr> = \<lparr>nodes = V, edges = E_IH\<rparr>
[PROOF STEP]
have mono_rule: "E' \<subseteq> E_IH \<Longrightarrow> all_security_requirements_fulfilled M \<lparr>nodes = V, edges = E'\<rparr>" for E'
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?E' \<subseteq> E_IH; all_security_requirements_fulfilled M \<lparr>nodes = V, edges = E_IH\<rparr>\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M \<lparr>nodes = V, edges = ?E'\<rparr>
all_security_requirements_fulfilled M (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>)
generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr> = \<lparr>nodes = V, edges = E_IH\<rparr>

goal (1 subgoal):
 1. E' \<subseteq> E_IH \<Longrightarrow> all_security_requirements_fulfilled M \<lparr>nodes = V, edges = E'\<rparr>
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
?E' \<subseteq> E_IH \<Longrightarrow> all_security_requirements_fulfilled M \<lparr>nodes = V, edges = ?E'\<rparr>

goal (1 subgoal):
 1. \<And>a M. \<lbrakk>\<lbrakk>valid_reqs M; wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>); valid_reqs (a # M); wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled (a # M) (generate_valid_topology_some (a # M) Es \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
have "all_security_requirements_fulfilled M
            (delete_edges (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>)
                          (set (minimalize_offending_overapprox (c_sinvar m) Es [] \<lparr>nodes = V, edges = E\<rparr>)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. all_security_requirements_fulfilled M (delete_edges (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>) (set (minimalize_offending_overapprox (c_sinvar m) Es [] \<lparr>nodes = V, edges = E\<rparr>)))
[PROOF STEP]
unfolding E_IH_prop
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. all_security_requirements_fulfilled M (delete_edges \<lparr>nodes = V, edges = E_IH\<rparr> (set (minimalize_offending_overapprox (c_sinvar m) Es [] \<lparr>nodes = V, edges = E\<rparr>)))
[PROOF STEP]
by(auto simp add: delete_edges_simp2 intro:mono_rule)
[PROOF STATE]
proof (state)
this:
all_security_requirements_fulfilled M (delete_edges (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>) (set (minimalize_offending_overapprox (c_sinvar m) Es [] \<lparr>nodes = V, edges = E\<rparr>)))

goal (1 subgoal):
 1. \<And>a M. \<lbrakk>\<lbrakk>valid_reqs M; wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>); valid_reqs (a # M); wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled (a # M) (generate_valid_topology_some (a # M) Es \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
c_offending_flows m \<lparr>nodes = V, edges = E\<rparr> \<noteq> {} \<Longrightarrow> all_security_requirements_fulfilled M (delete_edges (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>) (set (minimalize_offending_overapprox (c_sinvar m) Es [] \<lparr>nodes = V, edges = E\<rparr>)))

goal (1 subgoal):
 1. \<And>a M. \<lbrakk>\<lbrakk>valid_reqs M; wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>); valid_reqs (a # M); wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled (a # M) (generate_valid_topology_some (a # M) Es \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
note goal_fulfilled_M=this
[PROOF STATE]
proof (state)
this:
c_offending_flows m \<lparr>nodes = V, edges = E\<rparr> \<noteq> {} \<Longrightarrow> all_security_requirements_fulfilled M (delete_edges (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>) (set (minimalize_offending_overapprox (c_sinvar m) Es [] \<lparr>nodes = V, edges = E\<rparr>)))

goal (1 subgoal):
 1. \<And>a M. \<lbrakk>\<lbrakk>valid_reqs M; wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>); valid_reqs (a # M); wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled (a # M) (generate_valid_topology_some (a # M) Es \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
have no_offending: "c_sinvar m \<lparr>nodes = V, edges = E\<rparr> \<Longrightarrow> c_offending_flows m \<lparr>nodes = V, edges = E\<rparr> = {}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. c_sinvar m \<lparr>nodes = V, edges = E\<rparr> \<Longrightarrow> c_offending_flows m \<lparr>nodes = V, edges = E\<rparr> = {}
[PROOF STEP]
by (simp add: configured_SecurityInvariant.c_sinvar_valid_imp_no_offending_flows validReq)
[PROOF STATE]
proof (state)
this:
c_sinvar m \<lparr>nodes = V, edges = E\<rparr> \<Longrightarrow> c_offending_flows m \<lparr>nodes = V, edges = E\<rparr> = {}

goal (1 subgoal):
 1. \<And>a M. \<lbrakk>\<lbrakk>valid_reqs M; wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled M (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>); valid_reqs (a # M); wf_graph \<lparr>nodes = V, edges = E\<rparr>; set Es = E; distinct Es\<rbrakk> \<Longrightarrow> all_security_requirements_fulfilled (a # M) (generate_valid_topology_some (a # M) Es \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
show "all_security_requirements_fulfilled (m # M) (generate_valid_topology_some (m # M) Es \<lparr>nodes = V, edges = E\<rparr>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. all_security_requirements_fulfilled (m # M) (generate_valid_topology_some (m # M) Es \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
apply(simp add: all_security_requirements_fulfilled_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (c_sinvar m \<lparr>nodes = V, edges = E\<rparr> \<longrightarrow> c_sinvar m (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>) \<and> (\<forall>m\<in>set M. c_sinvar m (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>))) \<and> (\<not> c_sinvar m \<lparr>nodes = V, edges = E\<rparr> \<longrightarrow> c_sinvar m (delete_edges (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>) (set (minimalize_offending_overapprox (c_sinvar m) Es [] \<lparr>nodes = V, edges = E\<rparr>))) \<and> (\<forall>ma\<in>set M. c_sinvar ma (delete_edges (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>) (set (minimalize_offending_overapprox (c_sinvar m) Es [] \<lparr>nodes = V, edges = E\<rparr>)))))
[PROOF STEP]
apply(intro conjI impI)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. c_sinvar m \<lparr>nodes = V, edges = E\<rparr> \<Longrightarrow> c_sinvar m (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>)
 2. c_sinvar m \<lparr>nodes = V, edges = E\<rparr> \<Longrightarrow> \<forall>m\<in>set M. c_sinvar m (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>)
 3. \<not> c_sinvar m \<lparr>nodes = V, edges = E\<rparr> \<Longrightarrow> c_sinvar m (delete_edges (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>) (set (minimalize_offending_overapprox (c_sinvar m) Es [] \<lparr>nodes = V, edges = E\<rparr>)))
 4. \<not> c_sinvar m \<lparr>nodes = V, edges = E\<rparr> \<Longrightarrow> \<forall>ma\<in>set M. c_sinvar ma (delete_edges (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>) (set (minimalize_offending_overapprox (c_sinvar m) Es [] \<lparr>nodes = V, edges = E\<rparr>)))
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. c_sinvar m \<lparr>nodes = V, edges = E\<rparr> \<Longrightarrow> c_sinvar m (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
using goal_sinvar_m no_offending
[PROOF STATE]
proof (prove)
using this:
c_offending_flows m \<lparr>nodes = V, edges = E\<rparr> = {} \<Longrightarrow> c_sinvar m (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>)
c_sinvar m \<lparr>nodes = V, edges = E\<rparr> \<Longrightarrow> c_offending_flows m \<lparr>nodes = V, edges = E\<rparr> = {}

goal (1 subgoal):
 1. c_sinvar m \<lparr>nodes = V, edges = E\<rparr> \<Longrightarrow> c_sinvar m (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
by blast
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. c_sinvar m \<lparr>nodes = V, edges = E\<rparr> \<Longrightarrow> \<forall>m\<in>set M. c_sinvar m (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>)
 2. \<not> c_sinvar m \<lparr>nodes = V, edges = E\<rparr> \<Longrightarrow> c_sinvar m (delete_edges (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>) (set (minimalize_offending_overapprox (c_sinvar m) Es [] \<lparr>nodes = V, edges = E\<rparr>)))
 3. \<not> c_sinvar m \<lparr>nodes = V, edges = E\<rparr> \<Longrightarrow> \<forall>ma\<in>set M. c_sinvar ma (delete_edges (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>) (set (minimalize_offending_overapprox (c_sinvar m) Es [] \<lparr>nodes = V, edges = E\<rparr>)))
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. c_sinvar m \<lparr>nodes = V, edges = E\<rparr> \<Longrightarrow> \<forall>m\<in>set M. c_sinvar m (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
using IH
[PROOF STATE]
proof (prove)
using this:
all_security_requirements_fulfilled M (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>)

goal (1 subgoal):
 1. c_sinvar m \<lparr>nodes = V, edges = E\<rparr> \<Longrightarrow> \<forall>m\<in>set M. c_sinvar m (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>)
[PROOF STEP]
by(simp add: all_security_requirements_fulfilled_def; fail)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<not> c_sinvar m \<lparr>nodes = V, edges = E\<rparr> \<Longrightarrow> c_sinvar m (delete_edges (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>) (set (minimalize_offending_overapprox (c_sinvar m) Es [] \<lparr>nodes = V, edges = E\<rparr>)))
 2. \<not> c_sinvar m \<lparr>nodes = V, edges = E\<rparr> \<Longrightarrow> \<forall>ma\<in>set M. c_sinvar ma (delete_edges (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>) (set (minimalize_offending_overapprox (c_sinvar m) Es [] \<lparr>nodes = V, edges = E\<rparr>)))
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> c_sinvar m \<lparr>nodes = V, edges = E\<rparr> \<Longrightarrow> c_sinvar m (delete_edges (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>) (set (minimalize_offending_overapprox (c_sinvar m) Es [] \<lparr>nodes = V, edges = E\<rparr>)))
[PROOF STEP]
using rm_off_valid
[PROOF STATE]
proof (prove)
using this:
\<not> c_sinvar m \<lparr>nodes = V, edges = E\<rparr> \<Longrightarrow> c_sinvar m \<lparr>nodes = V, edges = E - set (minimalize_offending_overapprox (c_sinvar m) Es [] \<lparr>nodes = V, edges = E\<rparr>)\<rparr>

goal (1 subgoal):
 1. \<not> c_sinvar m \<lparr>nodes = V, edges = E\<rparr> \<Longrightarrow> c_sinvar m (delete_edges (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>) (set (minimalize_offending_overapprox (c_sinvar m) Es [] \<lparr>nodes = V, edges = E\<rparr>)))
[PROOF STEP]
by (metis (no_types, lifting) Cons.prems(2) Diff_mono
            configured_SecurityInvariant.mono_sinvar delete_edges_simp2 generate_valid_topology_some_edges
            generate_valid_topology_some_nodes order_refl validReq wf_graph_remove_edges)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> c_sinvar m \<lparr>nodes = V, edges = E\<rparr> \<Longrightarrow> \<forall>ma\<in>set M. c_sinvar ma (delete_edges (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>) (set (minimalize_offending_overapprox (c_sinvar m) Es [] \<lparr>nodes = V, edges = E\<rparr>)))
[PROOF STEP]
(*TODO!*)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> c_sinvar m \<lparr>nodes = V, edges = E\<rparr> \<Longrightarrow> \<forall>ma\<in>set M. c_sinvar ma (delete_edges (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>) (set (minimalize_offending_overapprox (c_sinvar m) Es [] \<lparr>nodes = V, edges = E\<rparr>)))
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> c_sinvar m \<lparr>nodes = V, edges = E\<rparr> \<Longrightarrow> \<forall>ma\<in>set M. c_sinvar ma (delete_edges (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>) (set (minimalize_offending_overapprox (c_sinvar m) Es [] \<lparr>nodes = V, edges = E\<rparr>)))
[PROOF STEP]
using goal_fulfilled_M not_sinvar_off
[PROOF STATE]
proof (prove)
using this:
c_offending_flows m \<lparr>nodes = V, edges = E\<rparr> \<noteq> {} \<Longrightarrow> all_security_requirements_fulfilled M (delete_edges (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>) (set (minimalize_offending_overapprox (c_sinvar m) Es [] \<lparr>nodes = V, edges = E\<rparr>)))
\<not> c_sinvar m \<lparr>nodes = V, edges = E\<rparr> \<Longrightarrow> c_offending_flows m \<lparr>nodes = V, edges = E\<rparr> \<noteq> {}

goal (1 subgoal):
 1. \<not> c_sinvar m \<lparr>nodes = V, edges = E\<rparr> \<Longrightarrow> \<forall>ma\<in>set M. c_sinvar ma (delete_edges (generate_valid_topology_some M Es \<lparr>nodes = V, edges = E\<rparr>) (set (minimalize_offending_overapprox (c_sinvar m) Es [] \<lparr>nodes = V, edges = E\<rparr>)))
[PROOF STEP]
by(simp add: all_security_requirements_fulfilled_def)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
all_security_requirements_fulfilled (m # M) (generate_valid_topology_some (m # M) Es \<lparr>nodes = V, edges = E\<rparr>)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma starfun_ln_less_zero: "\<And>x. \<lbrakk>0 < x; x < 1\<rbrakk> \<Longrightarrow> ( *f* real_ln) x < 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>0 < x; x < 1\<rbrakk> \<Longrightarrow> (*f* real_ln) x < 0
[PROOF STEP]
by transfer (rule ln_less_zero)


[STATEMENT]
lemma hermitean_mult_real:
  assumes "hermitean H"
  shows "hermitean ((cor k) *\<^sub>s\<^sub>m H)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. hermitean (cor k *\<^sub>s\<^sub>m H)
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
hermitean H

goal (1 subgoal):
 1. hermitean (cor k *\<^sub>s\<^sub>m H)
[PROOF STEP]
unfolding hermitean_def
[PROOF STATE]
proof (prove)
using this:
mat_adj H = H

goal (1 subgoal):
 1. mat_adj (cor k *\<^sub>s\<^sub>m H) = cor k *\<^sub>s\<^sub>m H
[PROOF STEP]
by simp


[STATEMENT]
lemma plus_adds_pp_0:
  assumes "(s + t) adds\<^sub>p v"
  shows "s adds\<^sub>p (v \<ominus> t)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. s adds\<^sub>p v \<ominus> t
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
s + t adds\<^sub>p v

goal (1 subgoal):
 1. s adds\<^sub>p v \<ominus> t
[PROOF STEP]
by (simp add: adds_pp_def term_simps) (rule plus_adds_0)


[STATEMENT]
lemma real_root_gt_1_iff [simp]: "0 < n \<Longrightarrow> 1 < root n y \<longleftrightarrow> 1 < y"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 < n \<Longrightarrow> (1 < root n y) = (1 < y)
[PROOF STEP]
using real_root_less_iff [where x=1]
[PROOF STATE]
proof (prove)
using this:
0 < ?n \<Longrightarrow> (root ?n 1 < root ?n ?y) = (1 < ?y)

goal (1 subgoal):
 1. 0 < n \<Longrightarrow> (1 < root n y) = (1 < y)
[PROOF STEP]
by simp


[STATEMENT]
lemma ordertype_singleton [simp]:
  assumes "wf r"
  shows "ordertype {x} r = 1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ordertype {x} r = 1
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. ordertype {x} r = 1
[PROOF STEP]
have \<dagger>: "{y. y = x \<and> (y, x) \<in> r} = {}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {y. y = x \<and> (y, x) \<in> r} = {}
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
wf r

goal (1 subgoal):
 1. {y. y = x \<and> (y, x) \<in> r} = {}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
{y. y = x \<and> (y, x) \<in> r} = {}

goal (1 subgoal):
 1. ordertype {x} r = 1
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ordertype {x} r = 1
[PROOF STEP]
by (auto simp add: ordertype_def assms \<dagger> ordermap [where a=x])
[PROOF STATE]
proof (state)
this:
ordertype {x} r = 1

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma gbinomial_asymptotic':
  assumes "z \<notin> \<nat>"
  shows   "(\<lambda>n. z gchoose (n + k)) \<sim>[at_top]
             (\<lambda>n. (-1)^(n+k) / (Gamma (-z) * of_nat n powr (z + 1)) :: real)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lambda>n. z gchoose (n + k)) \<sim>[sequentially] (\<lambda>n. (- 1) ^ (n + k) / (Gamma (- z) * real n powr (z + 1)))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (\<lambda>n. z gchoose (n + k)) \<sim>[sequentially] (\<lambda>n. (- 1) ^ (n + k) / (Gamma (- z) * real n powr (z + 1)))
[PROOF STEP]
from assms
[PROOF STATE]
proof (chain)
picking this:
z \<notin> \<nat>
[PROOF STEP]
have [simp]: "Gamma (-z) \<noteq> 0"
[PROOF STATE]
proof (prove)
using this:
z \<notin> \<nat>

goal (1 subgoal):
 1. Gamma (- z) \<noteq> 0
[PROOF STEP]
by (simp_all add: Gamma_eq_zero_iff uminus_in_nonpos_Ints_iff)
[PROOF STATE]
proof (state)
this:
Gamma (- z) \<noteq> 0

goal (1 subgoal):
 1. (\<lambda>n. z gchoose (n + k)) \<sim>[sequentially] (\<lambda>n. (- 1) ^ (n + k) / (Gamma (- z) * real n powr (z + 1)))
[PROOF STEP]
have "filterlim (\<lambda>n. n + k) at_top at_top"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. LIM n sequentially. n + k :> sequentially
[PROOF STEP]
by (intro filterlim_subseq strict_mono_add)
[PROOF STATE]
proof (state)
this:
LIM n sequentially. n + k :> sequentially

goal (1 subgoal):
 1. (\<lambda>n. z gchoose (n + k)) \<sim>[sequentially] (\<lambda>n. (- 1) ^ (n + k) / (Gamma (- z) * real n powr (z + 1)))
[PROOF STEP]
from asymp_equivI'_const[OF gbinomial_asymptotic[of z]] assms
[PROOF STATE]
proof (chain)
picking this:
inverse (Gamma (- z)) \<noteq> 0 \<Longrightarrow> (gchoose) z \<sim>[sequentially] (\<lambda>x. inverse (Gamma (- z)) * ((- 1) ^ x / exp ((z + 1) * of_real (ln (real x)))))
z \<notin> \<nat>
[PROOF STEP]
have "(\<lambda>n. z gchoose n) \<sim>[at_top] (\<lambda>n. (-1)^n / (Gamma (-z) * exp ((z+1) * ln (real n))))"
[PROOF STATE]
proof (prove)
using this:
inverse (Gamma (- z)) \<noteq> 0 \<Longrightarrow> (gchoose) z \<sim>[sequentially] (\<lambda>x. inverse (Gamma (- z)) * ((- 1) ^ x / exp ((z + 1) * of_real (ln (real x)))))
z \<notin> \<nat>

goal (1 subgoal):
 1. (gchoose) z \<sim>[sequentially] (\<lambda>n. (- 1) ^ n / (Gamma (- z) * exp ((z + 1) * ln (real n))))
[PROOF STEP]
by (simp add: Gamma_eq_zero_iff uminus_in_nonpos_Ints_iff field_simps)
[PROOF STATE]
proof (state)
this:
(gchoose) z \<sim>[sequentially] (\<lambda>n. (- 1) ^ n / (Gamma (- z) * exp ((z + 1) * ln (real n))))

goal (1 subgoal):
 1. (\<lambda>n. z gchoose (n + k)) \<sim>[sequentially] (\<lambda>n. (- 1) ^ (n + k) / (Gamma (- z) * real n powr (z + 1)))
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(gchoose) z \<sim>[sequentially] (\<lambda>n. (- 1) ^ n / (Gamma (- z) * exp ((z + 1) * ln (real n))))

goal (1 subgoal):
 1. (\<lambda>n. z gchoose (n + k)) \<sim>[sequentially] (\<lambda>n. (- 1) ^ (n + k) / (Gamma (- z) * real n powr (z + 1)))
[PROOF STEP]
have "eventually (\<lambda>n. exp ((z+1) * ln (real n)) = real n powr (z+1)) at_top"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>\<^sub>F n in sequentially. exp ((z + 1) * ln (real n)) = real n powr (z + 1)
[PROOF STEP]
using eventually_gt_at_top[of 0]
[PROOF STATE]
proof (prove)
using this:
eventually ((<) (0::?'a1)) at_top

goal (1 subgoal):
 1. \<forall>\<^sub>F n in sequentially. exp ((z + 1) * ln (real n)) = real n powr (z + 1)
[PROOF STEP]
by eventually_elim (simp add: powr_def)
[PROOF STATE]
proof (state)
this:
\<forall>\<^sub>F n in sequentially. exp ((z + 1) * ln (real n)) = real n powr (z + 1)

goal (1 subgoal):
 1. (\<lambda>n. z gchoose (n + k)) \<sim>[sequentially] (\<lambda>n. (- 1) ^ (n + k) / (Gamma (- z) * real n powr (z + 1)))
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
(gchoose) z \<sim>[sequentially] (\<lambda>x. (- 1) ^ x / (Gamma (- z) * real x powr (z + 1)))
[PROOF STEP]
have "(\<lambda>x. z gchoose (x + k)) \<sim>[at_top]
                  (\<lambda>x. (- 1) ^ (x + k) / (Gamma (- z) * real (x + k) powr (z + 1)))"
[PROOF STATE]
proof (prove)
using this:
(gchoose) z \<sim>[sequentially] (\<lambda>x. (- 1) ^ x / (Gamma (- z) * real x powr (z + 1)))

goal (1 subgoal):
 1. (\<lambda>x. z gchoose (x + k)) \<sim>[sequentially] (\<lambda>x. (- 1) ^ (x + k) / (Gamma (- z) * real (x + k) powr (z + 1)))
[PROOF STEP]
by (rule asymp_equiv_compose') (simp add: filterlim_subseq strict_mono_add)
[PROOF STATE]
proof (state)
this:
(\<lambda>x. z gchoose (x + k)) \<sim>[sequentially] (\<lambda>x. (- 1) ^ (x + k) / (Gamma (- z) * real (x + k) powr (z + 1)))

goal (1 subgoal):
 1. (\<lambda>n. z gchoose (n + k)) \<sim>[sequentially] (\<lambda>n. (- 1) ^ (n + k) / (Gamma (- z) * real n powr (z + 1)))
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(\<lambda>x. z gchoose (x + k)) \<sim>[sequentially] (\<lambda>x. (- 1) ^ (x + k) / (Gamma (- z) * real (x + k) powr (z + 1)))

goal (1 subgoal):
 1. (\<lambda>n. z gchoose (n + k)) \<sim>[sequentially] (\<lambda>n. (- 1) ^ (n + k) / (Gamma (- z) * real n powr (z + 1)))
[PROOF STEP]
have "(\<lambda>x. real x + real k) \<sim>[at_top] real"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lambda>x. real x + real k) \<sim>[sequentially] real
[PROOF STEP]
by (subst asymp_equiv_add_right) auto
[PROOF STATE]
proof (state)
this:
(\<lambda>x. real x + real k) \<sim>[sequentially] real

goal (1 subgoal):
 1. (\<lambda>n. z gchoose (n + k)) \<sim>[sequentially] (\<lambda>n. (- 1) ^ (n + k) / (Gamma (- z) * real n powr (z + 1)))
[PROOF STEP]
hence "(\<lambda>x. real (x + k) powr (z + 1)) \<sim>[at_top] (\<lambda>x. real x powr (z + 1))"
[PROOF STATE]
proof (prove)
using this:
(\<lambda>x. real x + real k) \<sim>[sequentially] real

goal (1 subgoal):
 1. (\<lambda>x. real (x + k) powr (z + 1)) \<sim>[sequentially] (\<lambda>x. real x powr (z + 1))
[PROOF STEP]
by (intro asymp_equiv_powr_real) auto
[PROOF STATE]
proof (state)
this:
(\<lambda>x. real (x + k) powr (z + 1)) \<sim>[sequentially] (\<lambda>x. real x powr (z + 1))

goal (1 subgoal):
 1. (\<lambda>n. z gchoose (n + k)) \<sim>[sequentially] (\<lambda>n. (- 1) ^ (n + k) / (Gamma (- z) * real n powr (z + 1)))
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
(\<And>c d. c \<sim>[sequentially] d \<Longrightarrow> (\<lambda>a. (- 1) ^ (a + k) / (Gamma (- z) * c a)) \<sim>[sequentially] (\<lambda>a. (- 1) ^ (a + k) / (Gamma (- z) * d a))) \<Longrightarrow> (\<lambda>x. z gchoose (x + k)) \<sim>[sequentially] (\<lambda>a. (- 1) ^ (a + k) / (Gamma (- z) * real a powr (z + 1)))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
(\<And>c d. c \<sim>[sequentially] d \<Longrightarrow> (\<lambda>a. (- 1) ^ (a + k) / (Gamma (- z) * c a)) \<sim>[sequentially] (\<lambda>a. (- 1) ^ (a + k) / (Gamma (- z) * d a))) \<Longrightarrow> (\<lambda>x. z gchoose (x + k)) \<sim>[sequentially] (\<lambda>a. (- 1) ^ (a + k) / (Gamma (- z) * real a powr (z + 1)))

goal (1 subgoal):
 1. (\<lambda>n. z gchoose (n + k)) \<sim>[sequentially] (\<lambda>n. (- 1) ^ (n + k) / (Gamma (- z) * real n powr (z + 1)))
[PROOF STEP]
by - (simp_all add: asymp_equiv_intros)
[PROOF STATE]
proof (state)
this:
(\<lambda>n. z gchoose (n + k)) \<sim>[sequentially] (\<lambda>n. (- 1) ^ (n + k) / (Gamma (- z) * real n powr (z + 1)))

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma unitary_mult:
  assumes uA: "unitary A" and uB: "unitary B"
  shows "unitary (\<lambda>s. A s * B s)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. unitary (\<lambda>s. A s * B s)
[PROOF STEP]
proof(intro unitaryI2 nnegI bounded_byI)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>x. 0 \<le> A x * B x
 2. \<And>x. A x * B x \<le> 1
[PROOF STEP]
fix s
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>x. 0 \<le> A x * B x
 2. \<And>x. A x * B x \<le> 1
[PROOF STEP]
from assms
[PROOF STATE]
proof (chain)
picking this:
unitary A
unitary B
[PROOF STEP]
have nnA: "0 \<le> A s" and nnB: "0 \<le> B s"
[PROOF STATE]
proof (prove)
using this:
unitary A
unitary B

goal (1 subgoal):
 1. 0 \<le> A s &&& 0 \<le> B s
[PROOF STEP]
by(auto)
[PROOF STATE]
proof (state)
this:
0 \<le> A s
0 \<le> B s

goal (2 subgoals):
 1. \<And>x. 0 \<le> A x * B x
 2. \<And>x. A x * B x \<le> 1
[PROOF STEP]
thus "0 \<le> A s * B s"
[PROOF STATE]
proof (prove)
using this:
0 \<le> A s
0 \<le> B s

goal (1 subgoal):
 1. 0 \<le> A s * B s
[PROOF STEP]
by(rule mult_nonneg_nonneg)
[PROOF STATE]
proof (state)
this:
0 \<le> A s * B s

goal (1 subgoal):
 1. \<And>x. A x * B x \<le> 1
[PROOF STEP]
from assms
[PROOF STATE]
proof (chain)
picking this:
unitary A
unitary B
[PROOF STEP]
have "A s \<le> 1" and "B s \<le> 1"
[PROOF STATE]
proof (prove)
using this:
unitary A
unitary B

goal (1 subgoal):
 1. A s \<le> 1 &&& B s \<le> 1
[PROOF STEP]
by(auto)
[PROOF STATE]
proof (state)
this:
A s \<le> 1
B s \<le> 1

goal (1 subgoal):
 1. \<And>x. A x * B x \<le> 1
[PROOF STEP]
with nnB
[PROOF STATE]
proof (chain)
picking this:
0 \<le> B s
A s \<le> 1
B s \<le> 1
[PROOF STEP]
have "A s * B s \<le> 1 * 1"
[PROOF STATE]
proof (prove)
using this:
0 \<le> B s
A s \<le> 1
B s \<le> 1

goal (1 subgoal):
 1. A s * B s \<le> 1 * 1
[PROOF STEP]
by(intro mult_mono, auto)
[PROOF STATE]
proof (state)
this:
A s * B s \<le> 1 * 1

goal (1 subgoal):
 1. \<And>x. A x * B x \<le> 1
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
A s * B s \<le> 1 * 1

goal (1 subgoal):
 1. \<And>x. A x * B x \<le> 1
[PROOF STEP]
have "... = 1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 1 * 1 = 1
[PROOF STEP]
by(simp)
[PROOF STATE]
proof (state)
this:
1 * 1 = 1

goal (1 subgoal):
 1. \<And>x. A x * B x \<le> 1
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
A s * B s \<le> 1
[PROOF STEP]
show "A s * B s \<le> 1"
[PROOF STATE]
proof (prove)
using this:
A s * B s \<le> 1

goal (1 subgoal):
 1. A s * B s \<le> 1
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
A s * B s \<le> 1

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma fmrel_on_fset_unionI:
  "fmrel_on_fset A R m n \<Longrightarrow> fmrel_on_fset B R m n \<Longrightarrow> fmrel_on_fset (A |\<union>| B) R m n"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>fmrel_on_fset A R m n; fmrel_on_fset B R m n\<rbrakk> \<Longrightarrow> fmrel_on_fset (A |\<union>| B) R m n
[PROOF STEP]
unfolding fmrel_on_fset_alt_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>fBall A (\<lambda>x. rel_option R (fmlookup m x) (fmlookup n x)); fBall B (\<lambda>x. rel_option R (fmlookup m x) (fmlookup n x))\<rbrakk> \<Longrightarrow> fBall (A |\<union>| B) (\<lambda>x. rel_option R (fmlookup m x) (fmlookup n x))
[PROOF STEP]
by auto


[STATEMENT]
lemma card_enum_upto:
  fixes s::"'a::len word"
  shows "card (set [s .e. e]) = Suc (unat e) - unat s"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. card (set [s .e. e]) = Suc (unat e) - unat s
[PROOF STEP]
by (subst List.card_set) (simp add: remdups_enum_upto)


[STATEMENT]
lemma ideal_explicit: "ideal_generated S
      = {y. \<exists>f U. finite U \<and> U \<subseteq> S \<and> (\<Sum>i\<in>U. f i * i) = y}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ideal_generated S = {y. \<exists>f U. finite U \<and> U \<subseteq> S \<and> (\<Sum>i\<in>U. f i * i) = y}
[PROOF STEP]
by (simp add: ideal_generated_eq_left_ideal left_ideal_explicit)


[STATEMENT]
lemma less_add_order_eq_0:
  assumes "a+^k = 0" "k < add_order a"
  shows   "k = 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. k = 0
[PROOF STEP]
proof (cases "k=0")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. k = 0 \<Longrightarrow> k = 0
 2. k \<noteq> 0 \<Longrightarrow> k = 0
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
k \<noteq> 0

goal (2 subgoals):
 1. k = 0 \<Longrightarrow> k = 0
 2. k \<noteq> 0 \<Longrightarrow> k = 0
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
k \<noteq> 0

goal (2 subgoals):
 1. k = 0 \<Longrightarrow> k = 0
 2. k \<noteq> 0 \<Longrightarrow> k = 0
[PROOF STEP]
with assms(1)
[PROOF STATE]
proof (chain)
picking this:
a +^ k = (0::'a)
k \<noteq> 0
[PROOF STEP]
have "\<exists>n>0. a+^n = 0"
[PROOF STATE]
proof (prove)
using this:
a +^ k = (0::'a)
k \<noteq> 0

goal (1 subgoal):
 1. \<exists>n>0. a +^ n = (0::'a)
[PROOF STEP]
by fast
[PROOF STATE]
proof (state)
this:
\<exists>n>0. a +^ n = (0::'a)

goal (2 subgoals):
 1. k = 0 \<Longrightarrow> k = 0
 2. k \<noteq> 0 \<Longrightarrow> k = 0
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
k \<noteq> 0
\<exists>n>0. a +^ n = (0::'a)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
k \<noteq> 0
\<exists>n>0. a +^ n = (0::'a)

goal (1 subgoal):
 1. k = 0
[PROOF STEP]
using assms add_order_def not_less_Least[of k "\<lambda>n. n>0 \<and> a+^n = 0"]
[PROOF STATE]
proof (prove)
using this:
k \<noteq> 0
\<exists>n>0. a +^ n = (0::'a)
a +^ k = (0::'a)
k < add_order a
add_order ?a \<equiv> if \<exists>n>0. ?a +^ n = (0::'a) then LEAST n. 0 < n \<and> ?a +^ n = (0::'a) else 0
k < (LEAST x. 0 < x \<and> a +^ x = (0::'a)) \<Longrightarrow> \<not> (0 < k \<and> a +^ k = (0::'a))

goal (1 subgoal):
 1. k = 0
[PROOF STEP]
by    auto
[PROOF STATE]
proof (state)
this:
k = 0

goal (1 subgoal):
 1. k = 0 \<Longrightarrow> k = 0
[PROOF STEP]
qed simp


[STATEMENT]
lemma rotate_drop_take:
  "rotate n xs = drop (n mod length xs) xs @ take (n mod length xs) xs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. rotate n xs = drop (n mod length xs) xs @ take (n mod length xs) xs
[PROOF STEP]
proof (induct n)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. rotate 0 xs = drop (0 mod length xs) xs @ take (0 mod length xs) xs
 2. \<And>n. rotate n xs = drop (n mod length xs) xs @ take (n mod length xs) xs \<Longrightarrow> rotate (Suc n) xs = drop (Suc n mod length xs) xs @ take (Suc n mod length xs) xs
[PROOF STEP]
case (Suc n)
[PROOF STATE]
proof (state)
this:
rotate n xs = drop (n mod length xs) xs @ take (n mod length xs) xs

goal (2 subgoals):
 1. rotate 0 xs = drop (0 mod length xs) xs @ take (0 mod length xs) xs
 2. \<And>n. rotate n xs = drop (n mod length xs) xs @ take (n mod length xs) xs \<Longrightarrow> rotate (Suc n) xs = drop (Suc n mod length xs) xs @ take (Suc n mod length xs) xs
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. rotate (Suc n) xs = drop (Suc n mod length xs) xs @ take (Suc n mod length xs) xs
[PROOF STEP]
proof (cases "xs = []")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. xs = [] \<Longrightarrow> rotate (Suc n) xs = drop (Suc n mod length xs) xs @ take (Suc n mod length xs) xs
 2. xs \<noteq> [] \<Longrightarrow> rotate (Suc n) xs = drop (Suc n mod length xs) xs @ take (Suc n mod length xs) xs
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
xs \<noteq> []

goal (2 subgoals):
 1. xs = [] \<Longrightarrow> rotate (Suc n) xs = drop (Suc n mod length xs) xs @ take (Suc n mod length xs) xs
 2. xs \<noteq> [] \<Longrightarrow> rotate (Suc n) xs = drop (Suc n mod length xs) xs @ take (Suc n mod length xs) xs
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
xs \<noteq> []
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
xs \<noteq> []

goal (1 subgoal):
 1. rotate (Suc n) xs = drop (Suc n mod length xs) xs @ take (Suc n mod length xs) xs
[PROOF STEP]
proof (cases "n mod length xs = 0")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<lbrakk>xs \<noteq> []; n mod length xs = 0\<rbrakk> \<Longrightarrow> rotate (Suc n) xs = drop (Suc n mod length xs) xs @ take (Suc n mod length xs) xs
 2. \<lbrakk>xs \<noteq> []; n mod length xs \<noteq> 0\<rbrakk> \<Longrightarrow> rotate (Suc n) xs = drop (Suc n mod length xs) xs @ take (Suc n mod length xs) xs
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
n mod length xs = 0

goal (2 subgoals):
 1. \<lbrakk>xs \<noteq> []; n mod length xs = 0\<rbrakk> \<Longrightarrow> rotate (Suc n) xs = drop (Suc n mod length xs) xs @ take (Suc n mod length xs) xs
 2. \<lbrakk>xs \<noteq> []; n mod length xs \<noteq> 0\<rbrakk> \<Longrightarrow> rotate (Suc n) xs = drop (Suc n mod length xs) xs @ take (Suc n mod length xs) xs
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
n mod length xs = 0
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
n mod length xs = 0

goal (1 subgoal):
 1. rotate (Suc n) xs = drop (Suc n mod length xs) xs @ take (Suc n mod length xs) xs
[PROOF STEP]
by (auto simp add: mod_Suc False Suc.hyps drop_Suc rotate1_hd_tl take_Suc Suc_length_conv)
[PROOF STATE]
proof (state)
this:
rotate (Suc n) xs = drop (Suc n mod length xs) xs @ take (Suc n mod length xs) xs

goal (1 subgoal):
 1. \<lbrakk>xs \<noteq> []; n mod length xs \<noteq> 0\<rbrakk> \<Longrightarrow> rotate (Suc n) xs = drop (Suc n mod length xs) xs @ take (Suc n mod length xs) xs
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>xs \<noteq> []; n mod length xs \<noteq> 0\<rbrakk> \<Longrightarrow> rotate (Suc n) xs = drop (Suc n mod length xs) xs @ take (Suc n mod length xs) xs
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
n mod length xs \<noteq> 0

goal (1 subgoal):
 1. \<lbrakk>xs \<noteq> []; n mod length xs \<noteq> 0\<rbrakk> \<Longrightarrow> rotate (Suc n) xs = drop (Suc n mod length xs) xs @ take (Suc n mod length xs) xs
[PROOF STEP]
with \<open>xs \<noteq> []\<close> Suc
[PROOF STATE]
proof (chain)
picking this:
xs \<noteq> []
rotate n xs = drop (n mod length xs) xs @ take (n mod length xs) xs
n mod length xs \<noteq> 0
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
xs \<noteq> []
rotate n xs = drop (n mod length xs) xs @ take (n mod length xs) xs
n mod length xs \<noteq> 0

goal (1 subgoal):
 1. rotate (Suc n) xs = drop (Suc n mod length xs) xs @ take (Suc n mod length xs) xs
[PROOF STEP]
by (simp add: rotate_def mod_Suc rotate1_hd_tl drop_Suc[symmetric] drop_tl[symmetric]
            take_hd_drop linorder_not_le)
[PROOF STATE]
proof (state)
this:
rotate (Suc n) xs = drop (Suc n mod length xs) xs @ take (Suc n mod length xs) xs

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
rotate (Suc n) xs = drop (Suc n mod length xs) xs @ take (Suc n mod length xs) xs

goal (1 subgoal):
 1. xs = [] \<Longrightarrow> rotate (Suc n) xs = drop (Suc n mod length xs) xs @ take (Suc n mod length xs) xs
[PROOF STEP]
qed simp
[PROOF STATE]
proof (state)
this:
rotate (Suc n) xs = drop (Suc n mod length xs) xs @ take (Suc n mod length xs) xs

goal (1 subgoal):
 1. rotate 0 xs = drop (0 mod length xs) xs @ take (0 mod length xs) xs
[PROOF STEP]
qed simp


[STATEMENT]
lemma word_trichotomy[case_names Less Equal Greater]:
  fixes w1 w2 :: word
  shows
  "(w1 <s w2 \<Longrightarrow> P w1 w2) \<Longrightarrow>
   (w1 = w2  \<Longrightarrow> P w1 w2) \<Longrightarrow>
   (w2 <s w1 \<Longrightarrow> P w1 w2) \<Longrightarrow> P w1 w2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>w1 <s w2 \<Longrightarrow> P w1 w2; w1 = w2 \<Longrightarrow> P w1 w2; w2 <s w1 \<Longrightarrow> P w1 w2\<rbrakk> \<Longrightarrow> P w1 w2
[PROOF STEP]
using signed.linorder_cases
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?x <s ?y \<Longrightarrow> ?P; ?x = ?y \<Longrightarrow> ?P; ?y <s ?x \<Longrightarrow> ?P\<rbrakk> \<Longrightarrow> ?P

goal (1 subgoal):
 1. \<lbrakk>w1 <s w2 \<Longrightarrow> P w1 w2; w1 = w2 \<Longrightarrow> P w1 w2; w2 <s w1 \<Longrightarrow> P w1 w2\<rbrakk> \<Longrightarrow> P w1 w2
[PROOF STEP]
by auto


[STATEMENT]
lemma norm1_scaleR[simp]: "norm1 (r *\<^sub>R v) = abs r * norm1 v"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. norm1 (r *\<^sub>R v) = \<bar>r\<bar> * norm1 v
[PROOF STEP]
unfolding norm1_def sum_distrib_left
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Sum>i\<in>UNIV. norm ((r *\<^sub>R v) $h i)) = (\<Sum>n\<in>UNIV. \<bar>r\<bar> * norm (v $h n))
[PROOF STEP]
by (rule sum.cong, auto)


[STATEMENT]
lemma Legendre_zmult: "\<lbrakk> p > 2; prime p \<rbrakk>
  \<Longrightarrow> (Legendre (a*b) p) = (Legendre a p)*(Legendre b p)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>2 < p; prime p\<rbrakk> \<Longrightarrow> Legendre (a * b) p = Legendre a p * Legendre b p
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>2 < p; prime p\<rbrakk> \<Longrightarrow> Legendre (a * b) p = Legendre a p * Legendre b p
[PROOF STEP]
assume p2: "p > 2" and prp: "prime p"
[PROOF STATE]
proof (state)
this:
2 < p
prime p

goal (1 subgoal):
 1. \<lbrakk>2 < p; prime p\<rbrakk> \<Longrightarrow> Legendre (a * b) p = Legendre a p * Legendre b p
[PROOF STEP]
from prp
[PROOF STATE]
proof (chain)
picking this:
prime p
[PROOF STEP]
have prp': "prime (nat p)"
[PROOF STATE]
proof (prove)
using this:
prime p

goal (1 subgoal):
 1. prime (nat p)
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
prime (nat p)

goal (1 subgoal):
 1. \<lbrakk>2 < p; prime p\<rbrakk> \<Longrightarrow> Legendre (a * b) p = Legendre a p * Legendre b p
[PROOF STEP]
let ?p12 = "nat(((p) - 1) div 2)"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>2 < p; prime p\<rbrakk> \<Longrightarrow> Legendre (a * b) p = Legendre a p * Legendre b p
[PROOF STEP]
let ?Labp = "Legendre (a*b) p"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>2 < p; prime p\<rbrakk> \<Longrightarrow> Legendre (a * b) p = Legendre a p * Legendre b p
[PROOF STEP]
let ?Lap = "Legendre a p"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>2 < p; prime p\<rbrakk> \<Longrightarrow> Legendre (a * b) p = Legendre a p * Legendre b p
[PROOF STEP]
let ?Lbp = "Legendre b p"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>2 < p; prime p\<rbrakk> \<Longrightarrow> Legendre (a * b) p = Legendre a p * Legendre b p
[PROOF STEP]
have h1: "((nat p - 1) div 2) = nat ((p - 1) div 2)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (nat p - 1) div 2 = nat ((p - 1) div 2)
[PROOF STEP]
using p2
[PROOF STATE]
proof (prove)
using this:
2 < p

goal (1 subgoal):
 1. (nat p - 1) div 2 = nat ((p - 1) div 2)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(nat p - 1) div 2 = nat ((p - 1) div 2)

goal (1 subgoal):
 1. \<lbrakk>2 < p; prime p\<rbrakk> \<Longrightarrow> Legendre (a * b) p = Legendre a p * Legendre b p
[PROOF STEP]
hence "[?Labp = (a*b)^?p12] (mod p)"
[PROOF STATE]
proof (prove)
using this:
(nat p - 1) div 2 = nat ((p - 1) div 2)

goal (1 subgoal):
 1. [Legendre (a * b) p = (a * b) ^ nat ((p - 1) div 2)] (mod p)
[PROOF STEP]
using prp p2 euler_criterion[of "nat p" "a*b"]
[PROOF STATE]
proof (prove)
using this:
(nat p - 1) div 2 = nat ((p - 1) div 2)
prime p
2 < p
\<lbrakk>prime (nat p); 2 < nat p\<rbrakk> \<Longrightarrow> [Legendre (a * b) (int (nat p)) = (a * b) ^ ((nat p - 1) div 2)] (mod int (nat p))

goal (1 subgoal):
 1. [Legendre (a * b) p = (a * b) ^ nat ((p - 1) div 2)] (mod p)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
[Legendre (a * b) p = (a * b) ^ nat ((p - 1) div 2)] (mod p)

goal (1 subgoal):
 1. \<lbrakk>2 < p; prime p\<rbrakk> \<Longrightarrow> Legendre (a * b) p = Legendre a p * Legendre b p
[PROOF STEP]
hence "[a^?p12 * b^?p12 = ?Labp] (mod p)"
[PROOF STATE]
proof (prove)
using this:
[Legendre (a * b) p = (a * b) ^ nat ((p - 1) div 2)] (mod p)

goal (1 subgoal):
 1. [a ^ nat ((p - 1) div 2) * b ^ nat ((p - 1) div 2) = Legendre (a * b) p] (mod p)
[PROOF STEP]
by (simp only: power_mult_distrib cong_sym)
[PROOF STATE]
proof (state)
this:
[a ^ nat ((p - 1) div 2) * b ^ nat ((p - 1) div 2) = Legendre (a * b) p] (mod p)

goal (1 subgoal):
 1. \<lbrakk>2 < p; prime p\<rbrakk> \<Longrightarrow> Legendre (a * b) p = Legendre a p * Legendre b p
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
[a ^ nat ((p - 1) div 2) * b ^ nat ((p - 1) div 2) = Legendre (a * b) p] (mod p)

goal (1 subgoal):
 1. \<lbrakk>2 < p; prime p\<rbrakk> \<Longrightarrow> Legendre (a * b) p = Legendre a p * Legendre b p
[PROOF STEP]
have "[?Lap * ?Lbp = a^?p12*b^?p12] (mod p)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. [Legendre a p * Legendre b p = a ^ nat ((p - 1) div 2) * b ^ nat ((p - 1) div 2)] (mod p)
[PROOF STEP]
using euler_criterion[of "nat p"] p2 prp' h1
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>prime (nat p); 2 < nat p\<rbrakk> \<Longrightarrow> [Legendre ?a (int (nat p)) = ?a ^ ((nat p - 1) div 2)] (mod int (nat p))
2 < p
prime (nat p)
(nat p - 1) div 2 = nat ((p - 1) div 2)

goal (1 subgoal):
 1. [Legendre a p * Legendre b p = a ^ nat ((p - 1) div 2) * b ^ nat ((p - 1) div 2)] (mod p)
[PROOF STEP]
by (simp add: cong_mult)
[PROOF STATE]
proof (state)
this:
[Legendre a p * Legendre b p = a ^ nat ((p - 1) div 2) * b ^ nat ((p - 1) div 2)] (mod p)

goal (1 subgoal):
 1. \<lbrakk>2 < p; prime p\<rbrakk> \<Longrightarrow> Legendre (a * b) p = Legendre a p * Legendre b p
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
[a ^ nat ((p - 1) div 2) * b ^ nat ((p - 1) div 2) = Legendre (a * b) p] (mod p)
[Legendre a p * Legendre b p = a ^ nat ((p - 1) div 2) * b ^ nat ((p - 1) div 2)] (mod p)
[PROOF STEP]
have "[?Lap * ?Lbp = ?Labp] (mod p)"
[PROOF STATE]
proof (prove)
using this:
[a ^ nat ((p - 1) div 2) * b ^ nat ((p - 1) div 2) = Legendre (a * b) p] (mod p)
[Legendre a p * Legendre b p = a ^ nat ((p - 1) div 2) * b ^ nat ((p - 1) div 2)] (mod p)

goal (1 subgoal):
 1. [Legendre a p * Legendre b p = Legendre (a * b) p] (mod p)
[PROOF STEP]
using cong_trans
[PROOF STATE]
proof (prove)
using this:
[a ^ nat ((p - 1) div 2) * b ^ nat ((p - 1) div 2) = Legendre (a * b) p] (mod p)
[Legendre a p * Legendre b p = a ^ nat ((p - 1) div 2) * b ^ nat ((p - 1) div 2)] (mod p)
\<lbrakk>[?b = ?c] (mod ?a); [?c = ?d] (mod ?a)\<rbrakk> \<Longrightarrow> [?b = ?d] (mod ?a)

goal (1 subgoal):
 1. [Legendre a p * Legendre b p = Legendre (a * b) p] (mod p)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
[Legendre a p * Legendre b p = Legendre (a * b) p] (mod p)

goal (1 subgoal):
 1. \<lbrakk>2 < p; prime p\<rbrakk> \<Longrightarrow> Legendre (a * b) p = Legendre a p * Legendre b p
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
[Legendre a p * Legendre b p = Legendre (a * b) p] (mod p)
[PROOF STEP]
obtain k where k: "?Labp = (?Lap*?Lbp) + p * k"
[PROOF STATE]
proof (prove)
using this:
[Legendre a p * Legendre b p = Legendre (a * b) p] (mod p)

goal (1 subgoal):
 1. (\<And>k. Legendre (a * b) p = Legendre a p * Legendre b p + p * k \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (auto simp add: cong_iff_lin)
[PROOF STATE]
proof (state)
this:
Legendre (a * b) p = Legendre a p * Legendre b p + p * k

goal (1 subgoal):
 1. \<lbrakk>2 < p; prime p\<rbrakk> \<Longrightarrow> Legendre (a * b) p = Legendre a p * Legendre b p
[PROOF STEP]
have "k=0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. k = 0
[PROOF STEP]
proof (rule ccontr)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. k \<noteq> 0 \<Longrightarrow> False
[PROOF STEP]
assume "k \<noteq> 0"
[PROOF STATE]
proof (state)
this:
k \<noteq> 0

goal (1 subgoal):
 1. k \<noteq> 0 \<Longrightarrow> False
[PROOF STEP]
hence "\<bar>k\<bar> = 1 \<or> \<bar>k\<bar> > 1"
[PROOF STATE]
proof (prove)
using this:
k \<noteq> 0

goal (1 subgoal):
 1. \<bar>k\<bar> = 1 \<or> 1 < \<bar>k\<bar>
[PROOF STEP]
by arith
[PROOF STATE]
proof (state)
this:
\<bar>k\<bar> = 1 \<or> 1 < \<bar>k\<bar>

goal (1 subgoal):
 1. k \<noteq> 0 \<Longrightarrow> False
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<bar>k\<bar> = 1 \<or> 1 < \<bar>k\<bar>

goal (1 subgoal):
 1. k \<noteq> 0 \<Longrightarrow> False
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
\<bar>k\<bar> = 1 \<or> 1 < \<bar>k\<bar>

goal (1 subgoal):
 1. k \<noteq> 0 \<Longrightarrow> False
[PROOF STEP]
assume "\<bar>k\<bar>= 1"
[PROOF STATE]
proof (state)
this:
\<bar>k\<bar> = 1

goal (1 subgoal):
 1. k \<noteq> 0 \<Longrightarrow> False
[PROOF STEP]
with p2
[PROOF STATE]
proof (chain)
picking this:
2 < p
\<bar>k\<bar> = 1
[PROOF STEP]
have "\<bar>k\<bar>*p > 2"
[PROOF STATE]
proof (prove)
using this:
2 < p
\<bar>k\<bar> = 1

goal (1 subgoal):
 1. 2 < \<bar>k\<bar> * p
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
2 < \<bar>k\<bar> * p

goal (1 subgoal):
 1. k \<noteq> 0 \<Longrightarrow> False
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
\<bar>k\<bar> = 1 \<Longrightarrow> 2 < \<bar>k\<bar> * p

goal (1 subgoal):
 1. k \<noteq> 0 \<Longrightarrow> False
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<bar>k\<bar> = 1 \<Longrightarrow> 2 < \<bar>k\<bar> * p

goal (1 subgoal):
 1. k \<noteq> 0 \<Longrightarrow> False
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
\<bar>k\<bar> = 1 \<Longrightarrow> 2 < \<bar>k\<bar> * p

goal (1 subgoal):
 1. k \<noteq> 0 \<Longrightarrow> False
[PROOF STEP]
assume k1: "\<bar>k\<bar> > 1"
[PROOF STATE]
proof (state)
this:
1 < \<bar>k\<bar>

goal (1 subgoal):
 1. k \<noteq> 0 \<Longrightarrow> False
[PROOF STEP]
with p2
[PROOF STATE]
proof (chain)
picking this:
2 < p
1 < \<bar>k\<bar>
[PROOF STEP]
have "\<bar>k\<bar>*2 < \<bar>k\<bar>*p"
[PROOF STATE]
proof (prove)
using this:
2 < p
1 < \<bar>k\<bar>

goal (1 subgoal):
 1. \<bar>k\<bar> * 2 < \<bar>k\<bar> * p
[PROOF STEP]
by (simp only: zmult_zless_mono2)
[PROOF STATE]
proof (state)
this:
\<bar>k\<bar> * 2 < \<bar>k\<bar> * p

goal (1 subgoal):
 1. k \<noteq> 0 \<Longrightarrow> False
[PROOF STEP]
with k1
[PROOF STATE]
proof (chain)
picking this:
1 < \<bar>k\<bar>
\<bar>k\<bar> * 2 < \<bar>k\<bar> * p
[PROOF STEP]
have "\<bar>k\<bar>*p > 2"
[PROOF STATE]
proof (prove)
using this:
1 < \<bar>k\<bar>
\<bar>k\<bar> * 2 < \<bar>k\<bar> * p

goal (1 subgoal):
 1. 2 < \<bar>k\<bar> * p
[PROOF STEP]
by arith
[PROOF STATE]
proof (state)
this:
2 < \<bar>k\<bar> * p

goal (1 subgoal):
 1. k \<noteq> 0 \<Longrightarrow> False
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
1 < \<bar>k\<bar> \<Longrightarrow> 2 < \<bar>k\<bar> * p

goal (1 subgoal):
 1. k \<noteq> 0 \<Longrightarrow> False
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<bar>k\<bar> = 1 \<or> 1 < \<bar>k\<bar>
\<bar>k\<bar> = 1 \<Longrightarrow> 2 < \<bar>k\<bar> * p
1 < \<bar>k\<bar> \<Longrightarrow> 2 < \<bar>k\<bar> * p
[PROOF STEP]
have "\<bar>k\<bar>*p > 2"
[PROOF STATE]
proof (prove)
using this:
\<bar>k\<bar> = 1 \<or> 1 < \<bar>k\<bar>
\<bar>k\<bar> = 1 \<Longrightarrow> 2 < \<bar>k\<bar> * p
1 < \<bar>k\<bar> \<Longrightarrow> 2 < \<bar>k\<bar> * p

goal (1 subgoal):
 1. 2 < \<bar>k\<bar> * p
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
2 < \<bar>k\<bar> * p

goal (1 subgoal):
 1. k \<noteq> 0 \<Longrightarrow> False
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
2 < \<bar>k\<bar> * p

goal (1 subgoal):
 1. k \<noteq> 0 \<Longrightarrow> False
[PROOF STEP]
from p2
[PROOF STATE]
proof (chain)
picking this:
2 < p
[PROOF STEP]
have "\<bar>p\<bar> = p"
[PROOF STATE]
proof (prove)
using this:
2 < p

goal (1 subgoal):
 1. \<bar>p\<bar> = p
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<bar>p\<bar> = p

goal (1 subgoal):
 1. k \<noteq> 0 \<Longrightarrow> False
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
2 < \<bar>k\<bar> * p
\<bar>p\<bar> = p
[PROOF STEP]
have "\<bar>k*p\<bar> > 2"
[PROOF STATE]
proof (prove)
using this:
2 < \<bar>k\<bar> * p
\<bar>p\<bar> = p

goal (1 subgoal):
 1. 2 < \<bar>k * p\<bar>
[PROOF STEP]
by (auto simp only: abs_mult)
[PROOF STATE]
proof (state)
this:
2 < \<bar>k * p\<bar>

goal (1 subgoal):
 1. k \<noteq> 0 \<Longrightarrow> False
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
2 < \<bar>k * p\<bar>

goal (1 subgoal):
 1. k \<noteq> 0 \<Longrightarrow> False
[PROOF STEP]
from k
[PROOF STATE]
proof (chain)
picking this:
Legendre (a * b) p = Legendre a p * Legendre b p + p * k
[PROOF STEP]
have "?Labp - ?Lap*?Lbp = k*p"
[PROOF STATE]
proof (prove)
using this:
Legendre (a * b) p = Legendre a p * Legendre b p + p * k

goal (1 subgoal):
 1. Legendre (a * b) p - Legendre a p * Legendre b p = k * p
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Legendre (a * b) p - Legendre a p * Legendre b p = k * p

goal (1 subgoal):
 1. k \<noteq> 0 \<Longrightarrow> False
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
2 < \<bar>k * p\<bar>
Legendre (a * b) p - Legendre a p * Legendre b p = k * p
[PROOF STEP]
have "\<bar>?Labp - ?Lap*?Lbp\<bar> > 2"
[PROOF STATE]
proof (prove)
using this:
2 < \<bar>k * p\<bar>
Legendre (a * b) p - Legendre a p * Legendre b p = k * p

goal (1 subgoal):
 1. 2 < \<bar>Legendre (a * b) p - Legendre a p * Legendre b p\<bar>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
2 < \<bar>Legendre (a * b) p - Legendre a p * Legendre b p\<bar>

goal (1 subgoal):
 1. k \<noteq> 0 \<Longrightarrow> False
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
2 < \<bar>Legendre (a * b) p - Legendre a p * Legendre b p\<bar>

goal (1 subgoal):
 1. k \<noteq> 0 \<Longrightarrow> False
[PROOF STEP]
have "?Labp = 1 \<or> ?Labp = 0 \<or> ?Labp = -1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Legendre (a * b) p = 1 \<or> Legendre (a * b) p = 0 \<or> Legendre (a * b) p = - 1
[PROOF STEP]
by (simp add: Legendre_def)
[PROOF STATE]
proof (state)
this:
Legendre (a * b) p = 1 \<or> Legendre (a * b) p = 0 \<or> Legendre (a * b) p = - 1

goal (1 subgoal):
 1. k \<noteq> 0 \<Longrightarrow> False
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
Legendre (a * b) p = 1 \<or> Legendre (a * b) p = 0 \<or> Legendre (a * b) p = - 1

goal (1 subgoal):
 1. k \<noteq> 0 \<Longrightarrow> False
[PROOF STEP]
have "?Lap*?Lbp = 1 \<or> ?Lap*?Lbp = 0 \<or> ?Lap*?Lbp = -1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Legendre a p * Legendre b p = 1 \<or> Legendre a p * Legendre b p = 0 \<or> Legendre a p * Legendre b p = - 1
[PROOF STEP]
by (auto simp add: Legendre_def)
[PROOF STATE]
proof (state)
this:
Legendre a p * Legendre b p = 1 \<or> Legendre a p * Legendre b p = 0 \<or> Legendre a p * Legendre b p = - 1

goal (1 subgoal):
 1. k \<noteq> 0 \<Longrightarrow> False
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
2 < \<bar>Legendre (a * b) p - Legendre a p * Legendre b p\<bar>
Legendre (a * b) p = 1 \<or> Legendre (a * b) p = 0 \<or> Legendre (a * b) p = - 1
Legendre a p * Legendre b p = 1 \<or> Legendre a p * Legendre b p = 0 \<or> Legendre a p * Legendre b p = - 1
[PROOF STEP]
show False
[PROOF STATE]
proof (prove)
using this:
2 < \<bar>Legendre (a * b) p - Legendre a p * Legendre b p\<bar>
Legendre (a * b) p = 1 \<or> Legendre (a * b) p = 0 \<or> Legendre (a * b) p = - 1
Legendre a p * Legendre b p = 1 \<or> Legendre a p * Legendre b p = 0 \<or> Legendre a p * Legendre b p = - 1

goal (1 subgoal):
 1. False
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
False

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
k = 0

goal (1 subgoal):
 1. \<lbrakk>2 < p; prime p\<rbrakk> \<Longrightarrow> Legendre (a * b) p = Legendre a p * Legendre b p
[PROOF STEP]
with k
[PROOF STATE]
proof (chain)
picking this:
Legendre (a * b) p = Legendre a p * Legendre b p + p * k
k = 0
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
Legendre (a * b) p = Legendre a p * Legendre b p + p * k
k = 0

goal (1 subgoal):
 1. Legendre (a * b) p = Legendre a p * Legendre b p
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Legendre (a * b) p = Legendre a p * Legendre b p

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma weight_ins_edge[simp]: "\<lbrakk>u\<noteq>v; (u,v)\<notin>edges g\<rbrakk>
  \<Longrightarrow> weight w (ins_edge (u,v) g) = w {u,v} + weight w g"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>u \<noteq> v; (u, v) \<notin> edges g\<rbrakk> \<Longrightarrow> weight w (ins_edge (u, v) g) = w {u, v} + weight w g
[PROOF STEP]
unfolding weight_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>u \<noteq> v; (u, v) \<notin> edges g\<rbrakk> \<Longrightarrow> (\<Sum>e\<in>edges (ins_edge (u, v) g). w (uedge e)) div 2 = w {u, v} + (\<Sum>e\<in>edges g. w (uedge e)) div 2
[PROOF STEP]
apply clarsimp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>u \<noteq> v; (u, v) \<notin> edges g\<rbrakk> \<Longrightarrow> (w (uedge (u, v)) + (\<Sum>e\<in>insert (v, u) (edges g). w (uedge e))) div 2 = w {u, v} + (\<Sum>e\<in>edges g. w (uedge e)) div 2
[PROOF STEP]
apply (subst sum.insert)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<lbrakk>u \<noteq> v; (u, v) \<notin> edges g\<rbrakk> \<Longrightarrow> finite (edges g)
 2. \<lbrakk>u \<noteq> v; (u, v) \<notin> edges g\<rbrakk> \<Longrightarrow> (v, u) \<notin> edges g
 3. \<lbrakk>u \<noteq> v; (u, v) \<notin> edges g\<rbrakk> \<Longrightarrow> (w (uedge (u, v)) + (w (uedge (v, u)) + (\<Sum>e\<in>edges g. w (uedge e)))) div 2 = w {u, v} + (\<Sum>e\<in>edges g. w (uedge e)) div 2
[PROOF STEP]
by (auto dest: edges_sym' simp: uedge_def insert_commute)


[STATEMENT]
lemma n_mult_degree_bound:
  assumes "f \<in> carrier P"
  shows "degree (n_mult f) \<le> degree f"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. deg R (n_mult f) \<le> deg R f
[PROOF STEP]
apply(rule deg_leqI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. n_mult f \<in> carrier P
 2. \<And>n. deg R f < n \<Longrightarrow> n_mult f n = \<zero>
[PROOF STEP]
apply (simp add: assms n_mult_closed)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>n. deg R f < n \<Longrightarrow> n_mult f n = \<zero>
[PROOF STEP]
by (simp add: assms deg_leE n_mult_def)


[STATEMENT]
lemma expectation_pair_pmf_fst [simp]:
  fixes f :: "'a \<Rightarrow> 'b::{banach, second_countable_topology}"
  shows "measure_pmf.expectation (pair_pmf p q) (\<lambda>x. f (fst x)) = measure_pmf.expectation p f"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. measure_pmf.expectation (pair_pmf p q) (\<lambda>x. f (fst x)) = measure_pmf.expectation p f
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. measure_pmf.expectation (pair_pmf p q) (\<lambda>x. f (fst x)) = measure_pmf.expectation p f
[PROOF STEP]
have "measure_pmf.expectation (pair_pmf p q) (\<lambda>x. f (fst x)) =
          measure_pmf.expectation (map_pmf fst (pair_pmf p q)) f"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. measure_pmf.expectation (pair_pmf p q) (\<lambda>x. f (fst x)) = measure_pmf.expectation (map_pmf fst (pair_pmf p q)) f
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
measure_pmf.expectation (pair_pmf p q) (\<lambda>x. f (fst x)) = measure_pmf.expectation (map_pmf fst (pair_pmf p q)) f

goal (1 subgoal):
 1. measure_pmf.expectation (pair_pmf p q) (\<lambda>x. f (fst x)) = measure_pmf.expectation p f
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
measure_pmf.expectation (pair_pmf p q) (\<lambda>x. f (fst x)) = measure_pmf.expectation (map_pmf fst (pair_pmf p q)) f

goal (1 subgoal):
 1. measure_pmf.expectation (pair_pmf p q) (\<lambda>x. f (fst x)) = measure_pmf.expectation p f
[PROOF STEP]
have "map_pmf fst (pair_pmf p q) = p"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. map_pmf fst (pair_pmf p q) = p
[PROOF STEP]
by (simp add: map_fst_pair_pmf)
[PROOF STATE]
proof (state)
this:
map_pmf fst (pair_pmf p q) = p

goal (1 subgoal):
 1. measure_pmf.expectation (pair_pmf p q) (\<lambda>x. f (fst x)) = measure_pmf.expectation p f
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
measure_pmf.expectation (pair_pmf p q) (\<lambda>x. f (fst x)) = measure_pmf.expectation p f
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
measure_pmf.expectation (pair_pmf p q) (\<lambda>x. f (fst x)) = measure_pmf.expectation p f

goal (1 subgoal):
 1. measure_pmf.expectation (pair_pmf p q) (\<lambda>x. f (fst x)) = measure_pmf.expectation p f
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
measure_pmf.expectation (pair_pmf p q) (\<lambda>x. f (fst x)) = measure_pmf.expectation p f

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma param_rec_nat[param]:
  "(rec_nat,rec_nat) \<in> R \<rightarrow> (Id \<rightarrow> R \<rightarrow> R) \<rightarrow> Id \<rightarrow> R"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (rec_nat, rec_nat) \<in> R \<rightarrow> (nat_rel \<rightarrow> R \<rightarrow> R) \<rightarrow> nat_rel \<rightarrow> R
[PROOF STEP]
proof (intro fun_relI, goal_cases)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a a' aa a'a ab a'b. \<lbrakk>(a, a') \<in> R; (aa, a'a) \<in> nat_rel \<rightarrow> R \<rightarrow> R; (ab, a'b) \<in> nat_rel\<rbrakk> \<Longrightarrow> (rec_nat a aa ab, rec_nat a' a'a a'b) \<in> R
[PROOF STEP]
case (1 s s' f f' n n')
[PROOF STATE]
proof (state)
this:
(s, s') \<in> R
(f, f') \<in> nat_rel \<rightarrow> R \<rightarrow> R
(n, n') \<in> nat_rel

goal (1 subgoal):
 1. \<And>a a' aa a'a ab a'b. \<lbrakk>(a, a') \<in> R; (aa, a'a) \<in> nat_rel \<rightarrow> R \<rightarrow> R; (ab, a'b) \<in> nat_rel\<rbrakk> \<Longrightarrow> (rec_nat a aa ab, rec_nat a' a'a a'b) \<in> R
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
(s, s') \<in> R
(f, f') \<in> nat_rel \<rightarrow> R \<rightarrow> R
(n, n') \<in> nat_rel

goal (1 subgoal):
 1. (rec_nat s f n, rec_nat s' f' n') \<in> R
[PROOF STEP]
apply (induct n' arbitrary: n s s')
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>n s s'. \<lbrakk>(s, s') \<in> R; (f, f') \<in> nat_rel \<rightarrow> R \<rightarrow> R; (n, 0) \<in> nat_rel\<rbrakk> \<Longrightarrow> (rec_nat s f n, rec_nat s' f' 0) \<in> R
 2. \<And>n' n s s'. \<lbrakk>\<And>n s s'. \<lbrakk>(s, s') \<in> R; (f, f') \<in> nat_rel \<rightarrow> R \<rightarrow> R; (n, n') \<in> nat_rel\<rbrakk> \<Longrightarrow> (rec_nat s f n, rec_nat s' f' n') \<in> R; (s, s') \<in> R; (f, f') \<in> nat_rel \<rightarrow> R \<rightarrow> R; (n, Suc n') \<in> nat_rel\<rbrakk> \<Longrightarrow> (rec_nat s f n, rec_nat s' f' (Suc n')) \<in> R
[PROOF STEP]
apply (fastforce simp: fun_rel_def)+
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
(rec_nat s f n, rec_nat s' f' n') \<in> R

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma finite_polyhedron_facets:
  fixes S :: "'a :: euclidean_space set"
  shows "polyhedron S \<Longrightarrow> finite {F. F facet_of S}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. polyhedron S \<Longrightarrow> finite {F. F facet_of S}
[PROOF STEP]
unfolding facet_of_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. polyhedron S \<Longrightarrow> finite {F. F face_of S \<and> F \<noteq> {} \<and> aff_dim F = aff_dim S - 1}
[PROOF STEP]
by (blast intro: finite_subset [OF _ finite_polyhedron_faces])


[STATEMENT]
lemma (in domain) finprod_non_zero:
  assumes "finite A"
  assumes "f \<in> A \<rightarrow> carrier R - {\<zero>}"
  shows "(\<Otimes>i \<in> A. f i) \<in> carrier R - {\<zero>}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. finprod R f A \<in> carrier R - {\<zero>}
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
finite A
f \<in> A \<rightarrow> carrier R - {\<zero>}

goal (1 subgoal):
 1. finprod R f A \<in> carrier R - {\<zero>}
[PROOF STEP]
proof (induction A rule:finite_induct)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. f \<in> {} \<rightarrow> carrier R - {\<zero>} \<Longrightarrow> finprod R f {} \<in> carrier R - {\<zero>}
 2. \<And>x F. \<lbrakk>finite F; x \<notin> F; f \<in> F \<rightarrow> carrier R - {\<zero>} \<Longrightarrow> finprod R f F \<in> carrier R - {\<zero>}; f \<in> insert x F \<rightarrow> carrier R - {\<zero>}\<rbrakk> \<Longrightarrow> finprod R f (insert x F) \<in> carrier R - {\<zero>}
[PROOF STEP]
case empty
[PROOF STATE]
proof (state)
this:
f \<in> {} \<rightarrow> carrier R - {\<zero>}

goal (2 subgoals):
 1. f \<in> {} \<rightarrow> carrier R - {\<zero>} \<Longrightarrow> finprod R f {} \<in> carrier R - {\<zero>}
 2. \<And>x F. \<lbrakk>finite F; x \<notin> F; f \<in> F \<rightarrow> carrier R - {\<zero>} \<Longrightarrow> finprod R f F \<in> carrier R - {\<zero>}; f \<in> insert x F \<rightarrow> carrier R - {\<zero>}\<rbrakk> \<Longrightarrow> finprod R f (insert x F) \<in> carrier R - {\<zero>}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
f \<in> {} \<rightarrow> carrier R - {\<zero>}
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
f \<in> {} \<rightarrow> carrier R - {\<zero>}

goal (1 subgoal):
 1. finprod R f {} \<in> carrier R - {\<zero>}
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
finprod R f {} \<in> carrier R - {\<zero>}

goal (1 subgoal):
 1. \<And>x F. \<lbrakk>finite F; x \<notin> F; f \<in> F \<rightarrow> carrier R - {\<zero>} \<Longrightarrow> finprod R f F \<in> carrier R - {\<zero>}; f \<in> insert x F \<rightarrow> carrier R - {\<zero>}\<rbrakk> \<Longrightarrow> finprod R f (insert x F) \<in> carrier R - {\<zero>}
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x F. \<lbrakk>finite F; x \<notin> F; f \<in> F \<rightarrow> carrier R - {\<zero>} \<Longrightarrow> finprod R f F \<in> carrier R - {\<zero>}; f \<in> insert x F \<rightarrow> carrier R - {\<zero>}\<rbrakk> \<Longrightarrow> finprod R f (insert x F) \<in> carrier R - {\<zero>}
[PROOF STEP]
case (insert x F)
[PROOF STATE]
proof (state)
this:
finite F
x \<notin> F
f \<in> F \<rightarrow> carrier R - {\<zero>} \<Longrightarrow> finprod R f F \<in> carrier R - {\<zero>}
f \<in> insert x F \<rightarrow> carrier R - {\<zero>}

goal (1 subgoal):
 1. \<And>x F. \<lbrakk>finite F; x \<notin> F; f \<in> F \<rightarrow> carrier R - {\<zero>} \<Longrightarrow> finprod R f F \<in> carrier R - {\<zero>}; f \<in> insert x F \<rightarrow> carrier R - {\<zero>}\<rbrakk> \<Longrightarrow> finprod R f (insert x F) \<in> carrier R - {\<zero>}
[PROOF STEP]
have "finprod R f (insert x F) = f x \<otimes> finprod R f F"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. finprod R f (insert x F) = f x \<otimes> finprod R f F
[PROOF STEP]
using insert
[PROOF STATE]
proof (prove)
using this:
finite F
x \<notin> F
f \<in> F \<rightarrow> carrier R - {\<zero>} \<Longrightarrow> finprod R f F \<in> carrier R - {\<zero>}
f \<in> insert x F \<rightarrow> carrier R - {\<zero>}

goal (1 subgoal):
 1. finprod R f (insert x F) = f x \<otimes> finprod R f F
[PROOF STEP]
by (subst finprod_insert, simp_all add:Pi_def)
[PROOF STATE]
proof (state)
this:
finprod R f (insert x F) = f x \<otimes> finprod R f F

goal (1 subgoal):
 1. \<And>x F. \<lbrakk>finite F; x \<notin> F; f \<in> F \<rightarrow> carrier R - {\<zero>} \<Longrightarrow> finprod R f F \<in> carrier R - {\<zero>}; f \<in> insert x F \<rightarrow> carrier R - {\<zero>}\<rbrakk> \<Longrightarrow> finprod R f (insert x F) \<in> carrier R - {\<zero>}
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
finprod R f (insert x F) = f x \<otimes> finprod R f F

goal (1 subgoal):
 1. \<And>x F. \<lbrakk>finite F; x \<notin> F; f \<in> F \<rightarrow> carrier R - {\<zero>} \<Longrightarrow> finprod R f F \<in> carrier R - {\<zero>}; f \<in> insert x F \<rightarrow> carrier R - {\<zero>}\<rbrakk> \<Longrightarrow> finprod R f (insert x F) \<in> carrier R - {\<zero>}
[PROOF STEP]
have "... \<in> carrier R-{\<zero>}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. f x \<otimes> finprod R f F \<in> carrier R - {\<zero>}
[PROOF STEP]
using integral insert
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?a \<otimes> ?b = \<zero>; ?a \<in> carrier R; ?b \<in> carrier R\<rbrakk> \<Longrightarrow> ?a = \<zero> \<or> ?b = \<zero>
finite F
x \<notin> F
f \<in> F \<rightarrow> carrier R - {\<zero>} \<Longrightarrow> finprod R f F \<in> carrier R - {\<zero>}
f \<in> insert x F \<rightarrow> carrier R - {\<zero>}

goal (1 subgoal):
 1. f x \<otimes> finprod R f F \<in> carrier R - {\<zero>}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
f x \<otimes> finprod R f F \<in> carrier R - {\<zero>}

goal (1 subgoal):
 1. \<And>x F. \<lbrakk>finite F; x \<notin> F; f \<in> F \<rightarrow> carrier R - {\<zero>} \<Longrightarrow> finprod R f F \<in> carrier R - {\<zero>}; f \<in> insert x F \<rightarrow> carrier R - {\<zero>}\<rbrakk> \<Longrightarrow> finprod R f (insert x F) \<in> carrier R - {\<zero>}
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
finprod R f (insert x F) \<in> carrier R - {\<zero>}
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
finprod R f (insert x F) \<in> carrier R - {\<zero>}

goal (1 subgoal):
 1. finprod R f (insert x F) \<in> carrier R - {\<zero>}
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
finprod R f (insert x F) \<in> carrier R - {\<zero>}

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma uniform_limit_on_Union:
  assumes "finite I"
  assumes "\<And>J. J \<in> I \<Longrightarrow> uniform_limit J f g F"
  shows "uniform_limit (Union I) f g F"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. uniform_limit (\<Union> I) f g F
[PROOF STEP]
by (metis SUP_identity_eq assms uniform_limit_on_UNION)


[STATEMENT]
lemma zero_minus_vec[simp]: "(v :: 'a :: group_add vec) \<in> carrier_vec n \<Longrightarrow> 0\<^sub>v n - v = - v"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. v \<in> carrier_vec n \<Longrightarrow> 0\<^sub>v n - v = - v
[PROOF STEP]
by (intro eq_vecI, auto)


[STATEMENT]
theorem wls_freshAbs_psubstAbs_E2:
assumes "wlsAbs (us,s) A" and "wlsEnv rho"
and "rho ys y = Some Y" and "freshAbs zs z (A $[rho])"
shows "freshAbs ys y A \<or> fresh zs z Y"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. freshAbs ys y A \<or> fresh zs z Y
[PROOF STEP]
using assms freshAbs_psubstAbs_E2[of A rho ys y Y zs z]
[PROOF STATE]
proof (prove)
using this:
wlsAbs (us, s) A
wlsEnv rho
rho ys y = Some Y
freshAbs zs z A $[rho]
\<lbrakk>goodAbs A; goodEnv rho; rho ys y = Some Y; freshAbs zs z A $[rho]\<rbrakk> \<Longrightarrow> freshAbs ys y A \<or> fresh zs z Y

goal (1 subgoal):
 1. freshAbs ys y A \<or> fresh zs z Y
[PROOF STEP]
by simp


[STATEMENT]
lemma (in Group) Nfunc_LeastTr2_2:"\<lbrakk>i \<le> n; \<forall>l \<le> n. G \<guillemotright> f l; \<forall>l \<le> n. G \<guillemotright> g l;
        NfuncPair_neq_at f g i\<rbrakk> \<Longrightarrow>
                          (LEAST k. (NfuncPair_neq_at f g k)) \<le> i"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>i \<le> n; \<forall>l\<le>n. G \<guillemotright> f l ; \<forall>l\<le>n. G \<guillemotright> g l ; NfuncPair_neq_at f g i\<rbrakk> \<Longrightarrow> (LEAST k. NfuncPair_neq_at f g k) \<le> i
[PROOF STEP]
apply (simp add: Least_le [of "NfuncPair_neq_at f g" "i"])
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma NCol_cases:
  assumes "\<not> Col A B C \<or> \<not> Col A C B \<or> \<not> Col B A C \<or> \<not> Col B C A \<or> \<not> Col C A B \<or> \<not> Col C B A"
  shows  "\<not> Col A B C"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> Col A B C
[PROOF STEP]
using assms not_col_permutation_2 not_col_permutation_3
[PROOF STATE]
proof (prove)
using this:
\<not> Col A B C \<or> \<not> Col A C B \<or> \<not> Col B A C \<or> \<not> Col B C A \<or> \<not> Col C A B \<or> \<not> Col C B A
\<not> Col ?A ?B ?C \<Longrightarrow> \<not> Col ?C ?A ?B
\<not> Col ?A ?B ?C \<Longrightarrow> \<not> Col ?C ?B ?A

goal (1 subgoal):
 1. \<not> Col A B C
[PROOF STEP]
by blast