[STATEMENT]
lemma temp_dyn_up_real_arith:
  assumes "a > 0" and Thyps: "Tmin \<le> T" "T \<le> Tmax" "Tmax < (L::real)"
    and thyps: "0 \<le> t" "\<forall>\<tau>\<in>{0..t}. \<tau> \<le> - (ln ((L - Tmax) / (L - T)) / a) "
  shows "L - Tmax \<le> exp (-(a * t)) * (L - T)"
    and "L - exp (-(a * t)) * (L - T) \<le> Tmax"
    and "Tmin \<le> L - exp (-(a * t)) * (L - T)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L - Tmax \<le> exp (- (a * t)) * (L - T) &&& L - exp (- (a * t)) * (L - T) \<le> Tmax &&& Tmin \<le> L - exp (- (a * t)) * (L - T)
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. L - Tmax \<le> exp (- (a * t)) * (L - T)
 2. L - exp (- (a * t)) * (L - T) \<le> Tmax
 3. Tmin \<le> L - exp (- (a * t)) * (L - T)
[PROOF STEP]
have "0 \<le> t \<and> t \<le> - (ln ((L - Tmax) / (L - T)) / a)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 \<le> t \<and> t \<le> - (ln ((L - Tmax) / (L - T)) / a)
[PROOF STEP]
using thyps
[PROOF STATE]
proof (prove)
using this:
0 \<le> t
\<forall>\<tau>\<in>{0..t}. \<tau> \<le> - (ln ((L - Tmax) / (L - T)) / a)

goal (1 subgoal):
 1. 0 \<le> t \<and> t \<le> - (ln ((L - Tmax) / (L - T)) / a)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
0 \<le> t \<and> t \<le> - (ln ((L - Tmax) / (L - T)) / a)

goal (3 subgoals):
 1. L - Tmax \<le> exp (- (a * t)) * (L - T)
 2. L - exp (- (a * t)) * (L - T) \<le> Tmax
 3. Tmin \<le> L - exp (- (a * t)) * (L - T)
[PROOF STEP]
hence "ln ((L - Tmax) / (L - T)) \<le> - a * t \<and> - a * t \<le> 0"
[PROOF STATE]
proof (prove)
using this:
0 \<le> t \<and> t \<le> - (ln ((L - Tmax) / (L - T)) / a)

goal (1 subgoal):
 1. ln ((L - Tmax) / (L - T)) \<le> - a * t \<and> - a * t \<le> 0
[PROOF STEP]
using assms(1) divide_le_cancel
[PROOF STATE]
proof (prove)
using this:
0 \<le> t \<and> t \<le> - (ln ((L - Tmax) / (L - T)) / a)
0 < a
(?a / ?c \<le> ?b / ?c) = (((0::?'a) < ?c \<longrightarrow> ?a \<le> ?b) \<and> (?c < (0::?'a) \<longrightarrow> ?b \<le> ?a))

goal (1 subgoal):
 1. ln ((L - Tmax) / (L - T)) \<le> - a * t \<and> - a * t \<le> 0
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
ln ((L - Tmax) / (L - T)) \<le> - a * t \<and> - a * t \<le> 0

goal (3 subgoals):
 1. L - Tmax \<le> exp (- (a * t)) * (L - T)
 2. L - exp (- (a * t)) * (L - T) \<le> Tmax
 3. Tmin \<le> L - exp (- (a * t)) * (L - T)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
ln ((L - Tmax) / (L - T)) \<le> - a * t \<and> - a * t \<le> 0

goal (3 subgoals):
 1. L - Tmax \<le> exp (- (a * t)) * (L - T)
 2. L - exp (- (a * t)) * (L - T) \<le> Tmax
 3. Tmin \<le> L - exp (- (a * t)) * (L - T)
[PROOF STEP]
have "(L - Tmax) / (L - T) > 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 < (L - Tmax) / (L - T)
[PROOF STEP]
using Thyps
[PROOF STATE]
proof (prove)
using this:
Tmin \<le> T
T \<le> Tmax
Tmax < L

goal (1 subgoal):
 1. 0 < (L - Tmax) / (L - T)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
0 < (L - Tmax) / (L - T)

goal (3 subgoals):
 1. L - Tmax \<le> exp (- (a * t)) * (L - T)
 2. L - exp (- (a * t)) * (L - T) \<le> Tmax
 3. Tmin \<le> L - exp (- (a * t)) * (L - T)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
ln ((L - Tmax) / (L - T)) \<le> - a * t \<and> - a * t \<le> 0
0 < (L - Tmax) / (L - T)
[PROOF STEP]
have "(L - Tmax) / (L - T) \<le> exp (-a * t) \<and> exp (-a * t) \<le> 1"
[PROOF STATE]
proof (prove)
using this:
ln ((L - Tmax) / (L - T)) \<le> - a * t \<and> - a * t \<le> 0
0 < (L - Tmax) / (L - T)

goal (1 subgoal):
 1. (L - Tmax) / (L - T) \<le> exp (- a * t) \<and> exp (- a * t) \<le> 1
[PROOF STEP]
using exp_ln exp_le_one_iff
[PROOF STATE]
proof (prove)
using this:
ln ((L - Tmax) / (L - T)) \<le> - a * t \<and> - a * t \<le> 0
0 < (L - Tmax) / (L - T)
0 < ?x \<Longrightarrow> exp (ln ?x) = ?x
(exp ?x \<le> 1) = (?x \<le> 0)

goal (1 subgoal):
 1. (L - Tmax) / (L - T) \<le> exp (- a * t) \<and> exp (- a * t) \<le> 1
[PROOF STEP]
by (metis exp_less_cancel_iff not_less)
[PROOF STATE]
proof (state)
this:
(L - Tmax) / (L - T) \<le> exp (- a * t) \<and> exp (- a * t) \<le> 1

goal (3 subgoals):
 1. L - Tmax \<le> exp (- (a * t)) * (L - T)
 2. L - exp (- (a * t)) * (L - T) \<le> Tmax
 3. Tmin \<le> L - exp (- (a * t)) * (L - T)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(L - Tmax) / (L - T) \<le> exp (- a * t) \<and> exp (- a * t) \<le> 1

goal (3 subgoals):
 1. L - Tmax \<le> exp (- (a * t)) * (L - T)
 2. L - exp (- (a * t)) * (L - T) \<le> Tmax
 3. Tmin \<le> L - exp (- (a * t)) * (L - T)
[PROOF STEP]
have "L - T > 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 < L - T
[PROOF STEP]
using Thyps
[PROOF STATE]
proof (prove)
using this:
Tmin \<le> T
T \<le> Tmax
Tmax < L

goal (1 subgoal):
 1. 0 < L - T
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
0 < L - T

goal (3 subgoals):
 1. L - Tmax \<le> exp (- (a * t)) * (L - T)
 2. L - exp (- (a * t)) * (L - T) \<le> Tmax
 3. Tmin \<le> L - exp (- (a * t)) * (L - T)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
(L - Tmax) / (L - T) \<le> exp (- a * t) \<and> exp (- a * t) \<le> 1
0 < L - T
[PROOF STEP]
have obs: "(L - Tmax) \<le> exp (-a * t) * (L - T) \<and> exp (-a * t) * (L - T) \<le> (L - T)"
[PROOF STATE]
proof (prove)
using this:
(L - Tmax) / (L - T) \<le> exp (- a * t) \<and> exp (- a * t) \<le> 1
0 < L - T

goal (1 subgoal):
 1. L - Tmax \<le> exp (- a * t) * (L - T) \<and> exp (- a * t) * (L - T) \<le> L - T
[PROOF STEP]
by (simp add: pos_divide_le_eq)
[PROOF STATE]
proof (state)
this:
L - Tmax \<le> exp (- a * t) * (L - T) \<and> exp (- a * t) * (L - T) \<le> L - T

goal (3 subgoals):
 1. L - Tmax \<le> exp (- (a * t)) * (L - T)
 2. L - exp (- (a * t)) * (L - T) \<le> Tmax
 3. Tmin \<le> L - exp (- (a * t)) * (L - T)
[PROOF STEP]
thus "(L - Tmax) \<le> exp (-(a * t)) * (L - T)"
[PROOF STATE]
proof (prove)
using this:
L - Tmax \<le> exp (- a * t) * (L - T) \<and> exp (- a * t) * (L - T) \<le> L - T

goal (1 subgoal):
 1. L - Tmax \<le> exp (- (a * t)) * (L - T)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
L - Tmax \<le> exp (- (a * t)) * (L - T)

goal (2 subgoals):
 1. L - exp (- (a * t)) * (L - T) \<le> Tmax
 2. Tmin \<le> L - exp (- (a * t)) * (L - T)
[PROOF STEP]
thus "L - exp (-(a * t)) * (L - T) \<le> Tmax"
[PROOF STATE]
proof (prove)
using this:
L - Tmax \<le> exp (- (a * t)) * (L - T)

goal (1 subgoal):
 1. L - exp (- (a * t)) * (L - T) \<le> Tmax
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
L - exp (- (a * t)) * (L - T) \<le> Tmax

goal (1 subgoal):
 1. Tmin \<le> L - exp (- (a * t)) * (L - T)
[PROOF STEP]
show "Tmin \<le> L - exp (-(a * t)) * (L - T)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Tmin \<le> L - exp (- (a * t)) * (L - T)
[PROOF STEP]
using Thyps and obs
[PROOF STATE]
proof (prove)
using this:
Tmin \<le> T
T \<le> Tmax
Tmax < L
L - Tmax \<le> exp (- a * t) * (L - T) \<and> exp (- a * t) * (L - T) \<le> L - T

goal (1 subgoal):
 1. Tmin \<le> L - exp (- (a * t)) * (L - T)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Tmin \<le> L - exp (- (a * t)) * (L - T)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma divide_eq2:
  assumes "eventually (\<lambda>x. h x \<noteq> 0) F"
  shows   "(\<lambda>x. f x / h x) \<in> L F (\<lambda>x. g x) \<longleftrightarrow> f \<in> L F (\<lambda>x. g x * h x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<lambda>x. f x / h x) \<in> L F g) = (f \<in> L F (\<lambda>x. g x * h x))
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. ((\<lambda>x. f x / h x) \<in> L F g) = (f \<in> L F (\<lambda>x. g x * h x))
[PROOF STEP]
have "L F (\<lambda>x. g x) = L F (\<lambda>x. g x * h x / h x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L F g = L F (\<lambda>x. g x * h x / h x)
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
\<forall>\<^sub>F x in F. h x \<noteq> (0::'b)

goal (1 subgoal):
 1. L F g = L F (\<lambda>x. g x * h x / h x)
[PROOF STEP]
by (intro cong) (auto elim: eventually_mono)
[PROOF STATE]
proof (state)
this:
L F g = L F (\<lambda>x. g x * h x / h x)

goal (1 subgoal):
 1. ((\<lambda>x. f x / h x) \<in> L F g) = (f \<in> L F (\<lambda>x. g x * h x))
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
L F g = L F (\<lambda>x. g x * h x / h x)

goal (1 subgoal):
 1. ((\<lambda>x. f x / h x) \<in> L F g) = (f \<in> L F (\<lambda>x. g x * h x))
[PROOF STEP]
by (simp only: divide_right_iff assms)
[PROOF STATE]
proof (state)
this:
((\<lambda>x. f x / h x) \<in> L F g) = (f \<in> L F (\<lambda>x. g x * h x))

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma has_sum_superconst_infinite_ereal:
  fixes f :: \<open>'a \<Rightarrow> ereal\<close>
  assumes \<open>\<And>x. x \<in> S \<Longrightarrow> f x \<ge> b\<close>
  assumes \<open>b > 0\<close>
  assumes \<open>infinite S\<close>
  shows "has_sum f S \<infinity>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. has_sum f S \<infinity>
[PROOF STEP]
by (metis Infty_neq_0(1) assms infsum_def has_sum_infsum infsum_superconst_infinite_ereal)


[STATEMENT]
theorem (in graph)  reach_next: "b \<in> reach a \<Longrightarrow> (b, c) \<in> next \<Longrightarrow> c \<in> reach a"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>b \<in> reach a; (b, c) \<in> next\<rbrakk> \<Longrightarrow> c \<in> reach a
[PROOF STEP]
apply (simp add: reach_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(a, b) \<in> next\<^sup>* \<and> b \<noteq> nil; (b, c) \<in> next\<rbrakk> \<Longrightarrow> (a, c) \<in> next\<^sup>* \<and> c \<noteq> nil
[PROOF STEP]
by auto


[STATEMENT]
lemma fds_converges_shift [simp]:
  fixes z :: "'a :: {banach, nat_power_field, real_normed_field}"
  shows "fds_converges (fds_shift c f) z \<longleftrightarrow> fds_converges f (z - c)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fds_converges (fds_shift c f) z = fds_converges f (z - c)
[PROOF STEP]
unfolding fds_converges_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. summable (\<lambda>n. fds_nth (fds_shift c f) n / nat_power n z) = summable (\<lambda>n. fds_nth f n / nat_power n (z - c))
[PROOF STEP]
by (intro summable_cong)
     (auto intro: eventually_mono [OF eventually_gt_at_top[of "0::nat"]] simp: nat_power_diff)


[STATEMENT]
lemma fls_mult_subdegree_ge_0:
  fixes   f g :: "'a::{comm_monoid_add,mult_zero} fls"
  assumes "fls_subdegree f \<ge> 0" "fls_subdegree g \<ge> 0"
  shows   "fls_subdegree (f*g) \<ge> 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 \<le> fls_subdegree (f * g)
[PROOF STEP]
using   assms fls_mult_subdegree_ge[of f g]
[PROOF STATE]
proof (prove)
using this:
0 \<le> fls_subdegree f
0 \<le> fls_subdegree g
f * g \<noteq> 0 \<Longrightarrow> fls_subdegree f + fls_subdegree g \<le> fls_subdegree (f * g)

goal (1 subgoal):
 1. 0 \<le> fls_subdegree (f * g)
[PROOF STEP]
by      fastforce


[STATEMENT]
lemma L\<^sub>a_int:
  fixes d :: "'a pmf" and v :: "'s \<Rightarrow>\<^sub>b real"
  shows "(\<integral>a. L\<^sub>a a v s \<partial>d) = (\<integral>a. r (s, a) \<partial>d) + l * \<integral>a. \<integral>s'. v s' \<partial>K (s, a) \<partial>d"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. measure_pmf.expectation d (\<lambda>a. L\<^sub>a a (apply_bfun v) s) = measure_pmf.expectation d (\<lambda>a. r (s, a)) + l * measure_pmf.expectation d (\<lambda>a. measure_pmf.expectation (K (s, a)) (apply_bfun v))
[PROOF STEP]
proof (subst Bochner_Integration.integral_add)
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. integrable (measure_pmf d) (\<lambda>a. r (s, a))
 2. integrable (measure_pmf d) (\<lambda>a. l * measure_pmf.expectation (K (s, a)) (apply_bfun v))
 3. measure_pmf.expectation d (\<lambda>a. r (s, a)) + measure_pmf.expectation d (\<lambda>a. l * measure_pmf.expectation (K (s, a)) (apply_bfun v)) = measure_pmf.expectation d (\<lambda>a. r (s, a)) + l * measure_pmf.expectation d (\<lambda>a. measure_pmf.expectation (K (s, a)) (apply_bfun v))
[PROOF STEP]
show "integrable d (\<lambda>a. r (s, a))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. integrable (measure_pmf d) (\<lambda>a. r (s, a))
[PROOF STEP]
using abs_r_le_r\<^sub>M
[PROOF STATE]
proof (prove)
using this:
\<bar>r ?sa\<bar> \<le> r\<^sub>M

goal (1 subgoal):
 1. integrable (measure_pmf d) (\<lambda>a. r (s, a))
[PROOF STEP]
by (fastforce intro!: bounded_integrable simp: bounded_iff)
[PROOF STATE]
proof (state)
this:
integrable (measure_pmf d) (\<lambda>a. r (s, a))

goal (2 subgoals):
 1. integrable (measure_pmf d) (\<lambda>a. l * measure_pmf.expectation (K (s, a)) (apply_bfun v))
 2. measure_pmf.expectation d (\<lambda>a. r (s, a)) + measure_pmf.expectation d (\<lambda>a. l * measure_pmf.expectation (K (s, a)) (apply_bfun v)) = measure_pmf.expectation d (\<lambda>a. r (s, a)) + l * measure_pmf.expectation d (\<lambda>a. measure_pmf.expectation (K (s, a)) (apply_bfun v))
[PROOF STEP]
show "integrable d (\<lambda>a. l * \<integral>s'. v s' \<partial>K (s, a))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. integrable (measure_pmf d) (\<lambda>a. l * measure_pmf.expectation (K (s, a)) (apply_bfun v))
[PROOF STEP]
by (intro bounded_integrable)
      (auto intro!: mult_mono order_trans[OF integral_abs_bound] boundedI[of _ "l * norm v"]
        measure_pmf.integral_le_const simp: abs_le_norm_bfun abs_mult)
[PROOF STATE]
proof (state)
this:
integrable (measure_pmf d) (\<lambda>a. l * measure_pmf.expectation (K (s, a)) (apply_bfun v))

goal (1 subgoal):
 1. measure_pmf.expectation d (\<lambda>a. r (s, a)) + measure_pmf.expectation d (\<lambda>a. l * measure_pmf.expectation (K (s, a)) (apply_bfun v)) = measure_pmf.expectation d (\<lambda>a. r (s, a)) + l * measure_pmf.expectation d (\<lambda>a. measure_pmf.expectation (K (s, a)) (apply_bfun v))
[PROOF STEP]
qed auto


[STATEMENT]
lemma LCL215_1:
 "(\<forall>A. axiom(or(not(or(A,A)),A))) &
  (\<forall>B A. axiom(or(not(A),or(B,A)))) &
  (\<forall>B A. axiom(or(not(or(A,B)),or(B,A)))) &
  (\<forall>B A C. axiom(or(not(or(A,or(B,C))),or(B,or(A,C))))) &
  (\<forall>A C B. axiom(or(not(or(not(A),B)),or(not(or(C,A)),or(C,B))))) &
  (\<forall>X. axiom(X) --> theorem(X)) &
  (\<forall>X Y. axiom(or(not(Y),X)) & theorem(Y) --> theorem(X)) &
  (\<forall>X Y Z. axiom(or(not(X),Y)) & theorem(or(not(Y),Z)) --> theorem(or(not(X),Z))) &
  (~theorem(or(not(or(not(p),q)),or(not(or(p,q)),q)))) --> False"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<forall>A. axiom (or (not (or (A, A)), A))) \<and> (\<forall>B A. axiom (or (not A, or (B, A)))) \<and> (\<forall>B A. axiom (or (not (or (A, B)), or (B, A)))) \<and> (\<forall>B A C. axiom (or (not (or (A, or (B, C))), or (B, or (A, C))))) \<and> (\<forall>A C B. axiom (or (not (or (not A, B)), or (not (or (C, A)), or (C, B))))) \<and> (\<forall>X. axiom X \<longrightarrow> theorem X) \<and> (\<forall>X Y. axiom (or (not Y, X)) \<and> theorem Y \<longrightarrow> theorem X) \<and> (\<forall>X Y Z. axiom (or (not X, Y)) \<and> theorem (or (not Y, Z)) \<longrightarrow> theorem (or (not X, Z))) \<and> \<not> theorem (or (not (or (not p, q)), or (not (or (p, q)), q))) \<longrightarrow> False
[PROOF STEP]
by meson


[STATEMENT]
theorem union: "Elem x (union A B) = (Elem x A | Elem x B)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Elem x (HOLZF.union A B) = (Elem x A \<or> Elem x B)
[PROOF STEP]
by (auto simp add: union_def Sum Upair)


[STATEMENT]
lemma DERIV_chain:
  "DERIV f (g x) :> Da \<Longrightarrow> (g has_field_derivative Db) (at x within s) \<Longrightarrow>
    (f \<circ> g has_field_derivative Da * Db) (at x within s)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(f has_field_derivative Da) (at (g x)); (g has_field_derivative Db) (at x within s)\<rbrakk> \<Longrightarrow> (f \<circ> g has_field_derivative Da * Db) (at x within s)
[PROOF STEP]
by (drule (1) DERIV_chain', simp add: o_def mult.commute)


[STATEMENT]
lemma count_roots_rat_code[code]:
  "count_roots_rat p = (let rp = map_poly rat_of_int p in if p = 0 then 0 else let ps = sturm_rat rp
    in sign_changes_neg_number_rootat ps - sign_changes_number_rootat ps)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. count_roots_rat p = (let rp = of_int_poly p in if p = 0 then 0 else let ps = sturm_rat rp in sign_changes_neg_number_rootat ps - sign_changes_number_rootat ps)
[PROOF STEP]
unfolding count_roots_rat_def Let_def sturm_rat count_roots_code of_rat_of_int_poly[symmetric, where 'a = real]
    sign_changes_neg_number_rootat sign_changes_number_rootat
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (if real_of_rat_poly (of_int_poly p) = 0 then 0 else sign_changes_neg_number_rootat (sturm_rat (of_int_poly p)) - sign_changes_number_rootat (sturm_rat (of_int_poly p))) = (if p = 0 then 0 else sign_changes_neg_number_rootat (sturm_rat (of_int_poly p)) - sign_changes_number_rootat (sturm_rat (of_int_poly p)))
[PROOF STEP]
by simp


[STATEMENT]
lemma minus_fset [simp]:
  shows "fset (xs - ys) = fset xs - fset ys"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fset (xs - ys) = fset xs - fset ys
[PROOF STEP]
by (descending) (auto)


[STATEMENT]
lemma vimage_VLambda_vrange_rep: "(\<lambda>a\<in>\<^sub>\<circ>A. f a) `\<^sub>\<circ> A = \<R>\<^sub>\<circ> (\<lambda>a\<in>\<^sub>\<circ>A. f a)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. VLambda A f `\<^sub>\<circ> A = \<R>\<^sub>\<circ> (VLambda A f)
[PROOF STEP]
by (simp add: vimage_VLambda_vrange)


[STATEMENT]
lemma eval_map_all : "(\<forall>l\<in>set(map f L). evalUni l x) = (\<forall>l\<in>set(L). evalUni (f l) x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<forall>l\<in>set (map f L). evalUni l x) = (\<forall>l\<in>set L. evalUni (f l) x)
[PROOF STEP]
by auto


[STATEMENT]
lemma abs_plus:
  fixes x y :: "'a::linordered_idom"
  assumes "sgn x = sgn y"
  shows "\<bar>x + y\<bar> = \<bar>x\<bar> + \<bar>y\<bar>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<bar>x + y\<bar> = \<bar>x\<bar> + \<bar>y\<bar>
[PROOF STEP]
by (simp add: assms same_sgn_abs_add)


[STATEMENT]
lemma trace_test_suite_from_tree_language_equivalence :
  assumes "observable M" and "finite_tree T"
  shows "(L M \<inter> set T = L M' \<inter> set T) = (list.set (fst (trace_test_suite_from_tree M T)) \<subseteq> L M' \<and> L M' \<inter> list.set (snd (trace_test_suite_from_tree M T)) = {})"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (L M \<inter> Prefix_Tree.set T = L M' \<inter> Prefix_Tree.set T) = (list.set (fst (trace_test_suite_from_tree M T)) \<subseteq> L M' \<and> L M' \<inter> list.set (snd (trace_test_suite_from_tree M T)) = {})
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (L M \<inter> Prefix_Tree.set T = L M' \<inter> Prefix_Tree.set T) = (list.set (fst (trace_test_suite_from_tree M T)) \<subseteq> L M' \<and> L M' \<inter> list.set (snd (trace_test_suite_from_tree M T)) = {})
[PROOF STEP]
obtain passes' fails where *: "(passes',fails) = separate_by (is_in_language M (initial M)) (sorted_list_of_sequences_in_tree T)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>passes' fails. (passes', fails) = separate_by (is_in_language M (FSM.initial M)) (sorted_list_of_sequences_in_tree T) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(passes', fails) = separate_by (is_in_language M (FSM.initial M)) (sorted_list_of_sequences_in_tree T)

goal (1 subgoal):
 1. (L M \<inter> Prefix_Tree.set T = L M' \<inter> Prefix_Tree.set T) = (list.set (fst (trace_test_suite_from_tree M T)) \<subseteq> L M' \<and> L M' \<inter> list.set (snd (trace_test_suite_from_tree M T)) = {})
[PROOF STEP]
define passes where "passes = sorted_list_of_maximal_sequences_in_tree (from_list passes')"
[PROOF STATE]
proof (state)
this:
passes = sorted_list_of_maximal_sequences_in_tree (from_list passes')

goal (1 subgoal):
 1. (L M \<inter> Prefix_Tree.set T = L M' \<inter> Prefix_Tree.set T) = (list.set (fst (trace_test_suite_from_tree M T)) \<subseteq> L M' \<and> L M' \<inter> list.set (snd (trace_test_suite_from_tree M T)) = {})
[PROOF STEP]
have "fst (trace_test_suite_from_tree M T) = passes"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fst (trace_test_suite_from_tree M T) = passes
[PROOF STEP]
using "*" passes_def
[PROOF STATE]
proof (prove)
using this:
(passes', fails) = separate_by (is_in_language M (FSM.initial M)) (sorted_list_of_sequences_in_tree T)
passes = sorted_list_of_maximal_sequences_in_tree (from_list passes')

goal (1 subgoal):
 1. fst (trace_test_suite_from_tree M T) = passes
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fst (trace_test_suite_from_tree M T) = passes

goal (1 subgoal):
 1. (L M \<inter> Prefix_Tree.set T = L M' \<inter> Prefix_Tree.set T) = (list.set (fst (trace_test_suite_from_tree M T)) \<subseteq> L M' \<and> L M' \<inter> list.set (snd (trace_test_suite_from_tree M T)) = {})
[PROOF STEP]
have "snd (trace_test_suite_from_tree M T) = fails"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. snd (trace_test_suite_from_tree M T) = fails
[PROOF STEP]
using "*" passes_def
[PROOF STATE]
proof (prove)
using this:
(passes', fails) = separate_by (is_in_language M (FSM.initial M)) (sorted_list_of_sequences_in_tree T)
passes = sorted_list_of_maximal_sequences_in_tree (from_list passes')

goal (1 subgoal):
 1. snd (trace_test_suite_from_tree M T) = fails
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
snd (trace_test_suite_from_tree M T) = fails

goal (1 subgoal):
 1. (L M \<inter> Prefix_Tree.set T = L M' \<inter> Prefix_Tree.set T) = (list.set (fst (trace_test_suite_from_tree M T)) \<subseteq> L M' \<and> L M' \<inter> list.set (snd (trace_test_suite_from_tree M T)) = {})
[PROOF STEP]
have "list.set passes' = L M \<inter> set T"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. list.set passes' = L M \<inter> Prefix_Tree.set T
[PROOF STEP]
using * sorted_list_of_sequences_in_tree_set[OF assms(2)]
[PROOF STATE]
proof (prove)
using this:
(passes', fails) = separate_by (is_in_language M (FSM.initial M)) (sorted_list_of_sequences_in_tree T)
list.set (sorted_list_of_sequences_in_tree T) = Prefix_Tree.set T

goal (1 subgoal):
 1. list.set passes' = L M \<inter> Prefix_Tree.set T
[PROOF STEP]
unfolding separate_by.simps
[PROOF STATE]
proof (prove)
using this:
(passes', fails) = (filter (is_in_language M (FSM.initial M)) (sorted_list_of_sequences_in_tree T), filter (\<lambda>x. \<not> is_in_language M (FSM.initial M) x) (sorted_list_of_sequences_in_tree T))
list.set (sorted_list_of_sequences_in_tree T) = Prefix_Tree.set T

goal (1 subgoal):
 1. list.set passes' = L M \<inter> Prefix_Tree.set T
[PROOF STEP]
unfolding is_in_language_iff[OF assms(1) fsm_initial]
[PROOF STATE]
proof (prove)
using this:
(passes', fails) = (filter (\<lambda>io. io \<in> L M) (sorted_list_of_sequences_in_tree T), filter (\<lambda>x. x \<notin> L M) (sorted_list_of_sequences_in_tree T))
list.set (sorted_list_of_sequences_in_tree T) = Prefix_Tree.set T

goal (1 subgoal):
 1. list.set passes' = L M \<inter> Prefix_Tree.set T
[PROOF STEP]
by (metis inter_set_filter old.prod.inject)
[PROOF STATE]
proof (state)
this:
list.set passes' = L M \<inter> Prefix_Tree.set T

goal (1 subgoal):
 1. (L M \<inter> Prefix_Tree.set T = L M' \<inter> Prefix_Tree.set T) = (list.set (fst (trace_test_suite_from_tree M T)) \<subseteq> L M' \<and> L M' \<inter> list.set (snd (trace_test_suite_from_tree M T)) = {})
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
list.set passes' = L M \<inter> Prefix_Tree.set T

goal (1 subgoal):
 1. (L M \<inter> Prefix_Tree.set T = L M' \<inter> Prefix_Tree.set T) = (list.set (fst (trace_test_suite_from_tree M T)) \<subseteq> L M' \<and> L M' \<inter> list.set (snd (trace_test_suite_from_tree M T)) = {})
[PROOF STEP]
have "list.set passes' \<subseteq> L M' = (list.set passes \<subseteq> L M')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (list.set passes' \<subseteq> L M') = (list.set passes \<subseteq> L M')
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (list.set passes' \<subseteq> L M') = (list.set passes \<subseteq> L M')
[PROOF STEP]
have "\<And> io . io \<in> list.set passes - {[]} \<Longrightarrow> \<exists> io' . io@io' \<in> list.set passes'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>io. io \<in> list.set passes - {[]} \<Longrightarrow> \<exists>io'. io @ io' \<in> list.set passes'
[PROOF STEP]
unfolding passes_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>io. io \<in> list.set (sorted_list_of_maximal_sequences_in_tree (from_list passes')) - {[]} \<Longrightarrow> \<exists>io'. io @ io' \<in> list.set passes'
[PROOF STEP]
unfolding sorted_list_of_maximal_sequences_in_tree_set[OF from_list_finite_tree]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>io. io \<in> {y \<in> Prefix_Tree.set (from_list passes'). \<nexists>y'. y' \<noteq> [] \<and> y @ y' \<in> Prefix_Tree.set (from_list passes')} - {[]} \<Longrightarrow> \<exists>io'. io @ io' \<in> list.set passes'
[PROOF STEP]
unfolding from_list_set
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>io. io \<in> {y \<in> Set.insert [] {xs''. \<exists>xs' xs'''. xs' \<in> list.set passes' \<and> xs' = xs'' @ xs'''}. \<nexists>y'. y' \<noteq> [] \<and> y @ y' \<in> Set.insert [] {xs''. \<exists>xs' xs'''. xs' \<in> list.set passes' \<and> xs' = xs'' @ xs'''}} - {[]} \<Longrightarrow> \<exists>io'. io @ io' \<in> list.set passes'
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
?io \<in> list.set passes - {[]} \<Longrightarrow> \<exists>io'. ?io @ io' \<in> list.set passes'

goal (1 subgoal):
 1. (list.set passes' \<subseteq> L M') = (list.set passes \<subseteq> L M')
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
?io \<in> list.set passes - {[]} \<Longrightarrow> \<exists>io'. ?io @ io' \<in> list.set passes'

goal (1 subgoal):
 1. (list.set passes' \<subseteq> L M') = (list.set passes \<subseteq> L M')
[PROOF STEP]
have "[] \<in> list.set passes'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. [] \<in> list.set passes'
[PROOF STEP]
unfolding \<open>list.set passes' = L M \<inter> set T\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. [] \<in> L M \<inter> Prefix_Tree.set T
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
[] \<in> list.set passes'

goal (1 subgoal):
 1. (list.set passes' \<subseteq> L M') = (list.set passes \<subseteq> L M')
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
?io \<in> list.set passes - {[]} \<Longrightarrow> \<exists>io'. ?io @ io' \<in> list.set passes'
[] \<in> list.set passes'
[PROOF STEP]
have "\<And> io . io \<in> list.set passes \<Longrightarrow> \<exists> io' . io@io' \<in> list.set passes'"
[PROOF STATE]
proof (prove)
using this:
?io \<in> list.set passes - {[]} \<Longrightarrow> \<exists>io'. ?io @ io' \<in> list.set passes'
[] \<in> list.set passes'

goal (1 subgoal):
 1. \<And>io. io \<in> list.set passes \<Longrightarrow> \<exists>io'. io @ io' \<in> list.set passes'
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
?io \<in> list.set passes \<Longrightarrow> \<exists>io'. ?io @ io' \<in> list.set passes'

goal (1 subgoal):
 1. (list.set passes' \<subseteq> L M') = (list.set passes \<subseteq> L M')
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
?io \<in> list.set passes \<Longrightarrow> \<exists>io'. ?io @ io' \<in> list.set passes'

goal (1 subgoal):
 1. (list.set passes' \<subseteq> L M') = (list.set passes \<subseteq> L M')
[PROOF STEP]
have "\<And> io . io \<in> list.set passes' \<Longrightarrow> \<exists> io' . io@io' \<in> list.set passes"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>io. io \<in> list.set passes' \<Longrightarrow> \<exists>io'. io @ io' \<in> list.set passes
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>io. io \<in> list.set passes' \<Longrightarrow> \<exists>io'. io @ io' \<in> list.set passes
[PROOF STEP]
have "\<And> io . io \<in> list.set passes' \<Longrightarrow> io \<in> set (from_list passes')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>io. io \<in> list.set passes' \<Longrightarrow> io \<in> Prefix_Tree.set (from_list passes')
[PROOF STEP]
unfolding from_list_set
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>io. io \<in> list.set passes' \<Longrightarrow> io \<in> Set.insert [] {xs''. \<exists>xs' xs'''. xs' \<in> list.set passes' \<and> xs' = xs'' @ xs'''}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
?io \<in> list.set passes' \<Longrightarrow> ?io \<in> Prefix_Tree.set (from_list passes')

goal (1 subgoal):
 1. \<And>io. io \<in> list.set passes' \<Longrightarrow> \<exists>io'. io @ io' \<in> list.set passes
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
?io \<in> list.set passes' \<Longrightarrow> ?io \<in> Prefix_Tree.set (from_list passes')

goal (1 subgoal):
 1. \<And>io. io \<in> list.set passes' \<Longrightarrow> \<exists>io'. io @ io' \<in> list.set passes
[PROOF STEP]
have "\<And> io. io \<in> set (from_list passes') \<Longrightarrow> \<exists> io' . io@io' \<in> list.set passes"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>io. io \<in> Prefix_Tree.set (from_list passes') \<Longrightarrow> \<exists>io'. io @ io' \<in> list.set passes
[PROOF STEP]
unfolding passes_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>io. io \<in> Prefix_Tree.set (from_list passes') \<Longrightarrow> \<exists>io'. io @ io' \<in> list.set (sorted_list_of_maximal_sequences_in_tree (from_list passes'))
[PROOF STEP]
unfolding sorted_list_of_maximal_sequences_in_tree_set[OF from_list_finite_tree]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>io. io \<in> Prefix_Tree.set (from_list passes') \<Longrightarrow> \<exists>io'. io @ io' \<in> {y \<in> Prefix_Tree.set (from_list passes'). \<nexists>y'. y' \<noteq> [] \<and> y @ y' \<in> Prefix_Tree.set (from_list passes')}
[PROOF STEP]
using from_list_finite_tree sorted_list_of_maximal_sequences_in_tree_ob sorted_list_of_maximal_sequences_in_tree_set
[PROOF STATE]
proof (prove)
using this:
finite_tree (from_list ?xs)
\<lbrakk>finite_tree ?T; ?xs \<in> Prefix_Tree.set ?T; \<And>xs'. ?xs @ xs' \<in> list.set (sorted_list_of_maximal_sequences_in_tree ?T) \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis
finite_tree ?t \<Longrightarrow> list.set (sorted_list_of_maximal_sequences_in_tree ?t) = {y \<in> Prefix_Tree.set ?t. \<nexists>y'. y' \<noteq> [] \<and> y @ y' \<in> Prefix_Tree.set ?t}

goal (1 subgoal):
 1. \<And>io. io \<in> Prefix_Tree.set (from_list passes') \<Longrightarrow> \<exists>io'. io @ io' \<in> {y \<in> Prefix_Tree.set (from_list passes'). \<nexists>y'. y' \<noteq> [] \<and> y @ y' \<in> Prefix_Tree.set (from_list passes')}
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
?io \<in> Prefix_Tree.set (from_list passes') \<Longrightarrow> \<exists>io'. ?io @ io' \<in> list.set passes

goal (1 subgoal):
 1. \<And>io. io \<in> list.set passes' \<Longrightarrow> \<exists>io'. io @ io' \<in> list.set passes
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
?io \<in> list.set passes' \<Longrightarrow> ?io \<in> Prefix_Tree.set (from_list passes')
?io \<in> Prefix_Tree.set (from_list passes') \<Longrightarrow> \<exists>io'. ?io @ io' \<in> list.set passes
[PROOF STEP]
show "\<And> io . io \<in> list.set passes' \<Longrightarrow> \<exists> io' . io@io' \<in> list.set passes"
[PROOF STATE]
proof (prove)
using this:
?io \<in> list.set passes' \<Longrightarrow> ?io \<in> Prefix_Tree.set (from_list passes')
?io \<in> Prefix_Tree.set (from_list passes') \<Longrightarrow> \<exists>io'. ?io @ io' \<in> list.set passes

goal (1 subgoal):
 1. \<And>io. io \<in> list.set passes' \<Longrightarrow> \<exists>io'. io @ io' \<in> list.set passes
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
?io \<in> list.set passes' \<Longrightarrow> \<exists>io'. ?io @ io' \<in> list.set passes

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
?io \<in> list.set passes' \<Longrightarrow> \<exists>io'. ?io @ io' \<in> list.set passes

goal (1 subgoal):
 1. (list.set passes' \<subseteq> L M') = (list.set passes \<subseteq> L M')
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
?io \<in> list.set passes \<Longrightarrow> \<exists>io'. ?io @ io' \<in> list.set passes'
?io \<in> list.set passes' \<Longrightarrow> \<exists>io'. ?io @ io' \<in> list.set passes
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
?io \<in> list.set passes \<Longrightarrow> \<exists>io'. ?io @ io' \<in> list.set passes'
?io \<in> list.set passes' \<Longrightarrow> \<exists>io'. ?io @ io' \<in> list.set passes

goal (1 subgoal):
 1. (list.set passes' \<subseteq> L M') = (list.set passes \<subseteq> L M')
[PROOF STEP]
using language_prefix[of _ _ M' "initial M'"]
[PROOF STATE]
proof (prove)
using this:
?io \<in> list.set passes \<Longrightarrow> \<exists>io'. ?io @ io' \<in> list.set passes'
?io \<in> list.set passes' \<Longrightarrow> \<exists>io'. ?io @ io' \<in> list.set passes
?io1.0 @ ?io2.0 \<in> L M' \<Longrightarrow> ?io1.0 \<in> L M'

goal (1 subgoal):
 1. (list.set passes' \<subseteq> L M') = (list.set passes \<subseteq> L M')
[PROOF STEP]
by (meson subset_iff)
[PROOF STATE]
proof (state)
this:
(list.set passes' \<subseteq> L M') = (list.set passes \<subseteq> L M')

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
(list.set passes' \<subseteq> L M') = (list.set passes \<subseteq> L M')

goal (1 subgoal):
 1. (L M \<inter> Prefix_Tree.set T = L M' \<inter> Prefix_Tree.set T) = (list.set (fst (trace_test_suite_from_tree M T)) \<subseteq> L M' \<and> L M' \<inter> list.set (snd (trace_test_suite_from_tree M T)) = {})
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(list.set passes' \<subseteq> L M') = (list.set passes \<subseteq> L M')

goal (1 subgoal):
 1. (L M \<inter> Prefix_Tree.set T = L M' \<inter> Prefix_Tree.set T) = (list.set (fst (trace_test_suite_from_tree M T)) \<subseteq> L M' \<and> L M' \<inter> list.set (snd (trace_test_suite_from_tree M T)) = {})
[PROOF STEP]
have "list.set fails = set T - L M"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. list.set fails = Prefix_Tree.set T - L M
[PROOF STEP]
using * sorted_list_of_sequences_in_tree_set[OF assms(2)]
[PROOF STATE]
proof (prove)
using this:
(passes', fails) = separate_by (is_in_language M (FSM.initial M)) (sorted_list_of_sequences_in_tree T)
list.set (sorted_list_of_sequences_in_tree T) = Prefix_Tree.set T

goal (1 subgoal):
 1. list.set fails = Prefix_Tree.set T - L M
[PROOF STEP]
unfolding separate_by.simps
[PROOF STATE]
proof (prove)
using this:
(passes', fails) = (filter (is_in_language M (FSM.initial M)) (sorted_list_of_sequences_in_tree T), filter (\<lambda>x. \<not> is_in_language M (FSM.initial M) x) (sorted_list_of_sequences_in_tree T))
list.set (sorted_list_of_sequences_in_tree T) = Prefix_Tree.set T

goal (1 subgoal):
 1. list.set fails = Prefix_Tree.set T - L M
[PROOF STEP]
unfolding is_in_language_iff[OF assms(1) fsm_initial]
[PROOF STATE]
proof (prove)
using this:
(passes', fails) = (filter (\<lambda>io. io \<in> L M) (sorted_list_of_sequences_in_tree T), filter (\<lambda>x. x \<notin> L M) (sorted_list_of_sequences_in_tree T))
list.set (sorted_list_of_sequences_in_tree T) = Prefix_Tree.set T

goal (1 subgoal):
 1. list.set fails = Prefix_Tree.set T - L M
[PROOF STEP]
by (simp add: set_diff_eq)
[PROOF STATE]
proof (state)
this:
list.set fails = Prefix_Tree.set T - L M

goal (1 subgoal):
 1. (L M \<inter> Prefix_Tree.set T = L M' \<inter> Prefix_Tree.set T) = (list.set (fst (trace_test_suite_from_tree M T)) \<subseteq> L M' \<and> L M' \<inter> list.set (snd (trace_test_suite_from_tree M T)) = {})
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
list.set passes' = L M \<inter> Prefix_Tree.set T
(list.set passes' \<subseteq> L M') = (list.set passes \<subseteq> L M')
list.set fails = Prefix_Tree.set T - L M
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
list.set passes' = L M \<inter> Prefix_Tree.set T
(list.set passes' \<subseteq> L M') = (list.set passes \<subseteq> L M')
list.set fails = Prefix_Tree.set T - L M

goal (1 subgoal):
 1. (L M \<inter> Prefix_Tree.set T = L M' \<inter> Prefix_Tree.set T) = (list.set (fst (trace_test_suite_from_tree M T)) \<subseteq> L M' \<and> L M' \<inter> list.set (snd (trace_test_suite_from_tree M T)) = {})
[PROOF STEP]
unfolding \<open>fst (trace_test_suite_from_tree M T) = passes\<close>
[PROOF STATE]
proof (prove)
using this:
list.set passes' = L M \<inter> Prefix_Tree.set T
(list.set passes' \<subseteq> L M') = (list.set passes \<subseteq> L M')
list.set fails = Prefix_Tree.set T - L M

goal (1 subgoal):
 1. (L M \<inter> Prefix_Tree.set T = L M' \<inter> Prefix_Tree.set T) = (list.set passes \<subseteq> L M' \<and> L M' \<inter> list.set (snd (trace_test_suite_from_tree M T)) = {})
[PROOF STEP]
unfolding \<open>snd (trace_test_suite_from_tree M T) = fails\<close>
[PROOF STATE]
proof (prove)
using this:
list.set passes' = L M \<inter> Prefix_Tree.set T
(list.set passes' \<subseteq> L M') = (list.set passes \<subseteq> L M')
list.set fails = Prefix_Tree.set T - L M

goal (1 subgoal):
 1. (L M \<inter> Prefix_Tree.set T = L M' \<inter> Prefix_Tree.set T) = (list.set passes \<subseteq> L M' \<and> L M' \<inter> list.set fails = {})
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(L M \<inter> Prefix_Tree.set T = L M' \<inter> Prefix_Tree.set T) = (list.set (fst (trace_test_suite_from_tree M T)) \<subseteq> L M' \<and> L M' \<inter> list.set (snd (trace_test_suite_from_tree M T)) = {})

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma integral_restrict_UNIV:
  fixes f :: "'n::euclidean_space \<Rightarrow> 'a::banach"
  shows "integral UNIV (\<lambda>x. if x \<in> S then f x else 0) = integral S f"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. integral UNIV (\<lambda>x. if x \<in> S then f x else (0::'a)) = integral S f
[PROOF STEP]
by (simp add: integral_restrict_Int)


[STATEMENT]
lemma isosceles_triangle_converse:
  assumes "angle a b c = angle b a c" "\<not>collinear {a,b,c}"
  shows   "dist a c = dist b c"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. dist a c = dist b c
[PROOF STEP]
by (rule congruent_triangle_asa[OF assms(1) _ _ assms(2)])
     (simp_all add: dist_commute angle_commute assms)


[STATEMENT]
lemma disc_compl_inter_ocircline_set [simp]:
  shows "disc_compl H \<inter> ocircline_set H = {}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. disc_compl H \<inter> ocircline_set H = {}
[PROOF STEP]
unfolding disc_compl_def ocircline_set_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Collect (out_ocircline H) \<inter> Collect (on_ocircline H) = {}
[PROOF STEP]
by auto (transfer, transfer, simp)


[STATEMENT]
lemma omax_ordLess_elim:
assumes "finite R" and "\<forall> r \<in> R. Well_order r"
and "omax R <o p" and "r \<in> R"
shows "r <o p"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. r <o p
[PROOF STEP]
using assms omax_maxim[of R r]
[PROOF STATE]
proof (prove)
using this:
finite R
\<forall>r\<in>R. Well_order r
omax R <o p
r \<in> R
\<lbrakk>finite R; \<forall>r\<in>R. Well_order r; r \<in> R\<rbrakk> \<Longrightarrow> r \<le>o omax R

goal (1 subgoal):
 1. r <o p
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>finite R; \<forall>r\<in>R. Well_order r; omax R <o p; r \<in> R; r \<le>o omax R\<rbrakk> \<Longrightarrow> r <o p
[PROOF STEP]
using ordLeq_ordLess_trans
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?r \<le>o ?r'; ?r' <o ?r''\<rbrakk> \<Longrightarrow> ?r <o ?r''

goal (1 subgoal):
 1. \<lbrakk>finite R; \<forall>r\<in>R. Well_order r; omax R <o p; r \<in> R; r \<le>o omax R\<rbrakk> \<Longrightarrow> r <o p
[PROOF STEP]
by blast


[STATEMENT]
lemma star_n_add: "star_n X + star_n Y = star_n (\<lambda>n. X n + Y n)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. star_n X + star_n Y = star_n (\<lambda>n. X n + Y n)
[PROOF STEP]
by (simp only: star_add_def starfun2_star_n)


[STATEMENT]
lemma div_Tr3:"\<lbrakk>(0::nat) < r; 0 < s; l < s * r\<rbrakk> \<Longrightarrow> Suc (l div s) \<le> r"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 < r; 0 < s; l < s * r\<rbrakk> \<Longrightarrow> Suc (l div s) \<le> r
[PROOF STEP]
apply (frule_tac div_Tr2[of "r" "s"], assumption+,
       cut_tac n1 = "l div s" and m1 = "r - Suc 0" in  Suc_le_mono[THEN sym])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 < r; 0 < s; l < s * r; l div s \<le> r - Suc 0; (l div s \<le> r - Suc 0) = (Suc (l div s) \<le> Suc (r - Suc 0))\<rbrakk> \<Longrightarrow> Suc (l div s) \<le> r
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma intersect_nodes_card:
    assumes "finite (DBTA.nodes A)" "finite (DBTA.nodes B)"
    shows "card (DBTA.nodes (intersect A B)) \<le> 2 * card (DBTA.nodes A) * card (DBTA.nodes B)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. card (DBTA.nodes (intersect A B)) \<le> 2 * card (DBTA.nodes A) * card (DBTA.nodes B)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. card (DBTA.nodes (intersect A B)) \<le> 2 * card (DBTA.nodes A) * card (DBTA.nodes B)
[PROOF STEP]
have "card (DBTA.nodes (intersect A B)) \<le>
      max 1 (length (dgbta.accepting (intersect' A B))) * card (DGBTA.nodes (intersect' A B))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. card (DBTA.nodes (intersect A B)) \<le> max 1 (length (dgbta.accepting (intersect' A B))) * card (DGBTA.nodes (intersect' A B))
[PROOF STEP]
using degeneralize_nodes_card
[PROOF STATE]
proof (prove)
using this:
card (DBTA.nodes (degeneralize ?A)) \<le> max 1 (length (dgbta.accepting ?A)) * card (DGBTA.nodes ?A)

goal (1 subgoal):
 1. card (DBTA.nodes (intersect A B)) \<le> max 1 (length (dgbta.accepting (intersect' A B))) * card (DGBTA.nodes (intersect' A B))
[PROOF STEP]
by this
[PROOF STATE]
proof (state)
this:
card (DBTA.nodes (intersect A B)) \<le> max 1 (length (dgbta.accepting (intersect' A B))) * card (DGBTA.nodes (intersect' A B))

goal (1 subgoal):
 1. card (DBTA.nodes (intersect A B)) \<le> 2 * card (DBTA.nodes A) * card (DBTA.nodes B)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
card (DBTA.nodes (intersect A B)) \<le> max 1 (length (dgbta.accepting (intersect' A B))) * card (DGBTA.nodes (intersect' A B))

goal (1 subgoal):
 1. card (DBTA.nodes (intersect A B)) \<le> 2 * card (DBTA.nodes A) * card (DBTA.nodes B)
[PROOF STEP]
have "length (dgbta.accepting (intersect' A B)) = 2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. length (dgbta.accepting (intersect' A B)) = 2
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
length (dgbta.accepting (intersect' A B)) = 2

goal (1 subgoal):
 1. card (DBTA.nodes (intersect A B)) \<le> 2 * card (DBTA.nodes A) * card (DBTA.nodes B)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
length (dgbta.accepting (intersect' A B)) = 2

goal (1 subgoal):
 1. card (DBTA.nodes (intersect A B)) \<le> 2 * card (DBTA.nodes A) * card (DBTA.nodes B)
[PROOF STEP]
have "card (DGBTA.nodes (intersect' A B)) \<le> card (DBTA.nodes A) * card (DBTA.nodes B)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. card (DGBTA.nodes (intersect' A B)) \<le> card (DBTA.nodes A) * card (DBTA.nodes B)
[PROOF STEP]
using intersect'_nodes_card assms
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>finite (DBTA.nodes ?A); finite (DBTA.nodes ?B)\<rbrakk> \<Longrightarrow> card (DGBTA.nodes (intersect' ?A ?B)) \<le> card (DBTA.nodes ?A) * card (DBTA.nodes ?B)
finite (DBTA.nodes A)
finite (DBTA.nodes B)

goal (1 subgoal):
 1. card (DGBTA.nodes (intersect' A B)) \<le> card (DBTA.nodes A) * card (DBTA.nodes B)
[PROOF STEP]
by this
[PROOF STATE]
proof (state)
this:
card (DGBTA.nodes (intersect' A B)) \<le> card (DBTA.nodes A) * card (DBTA.nodes B)

goal (1 subgoal):
 1. card (DBTA.nodes (intersect A B)) \<le> 2 * card (DBTA.nodes A) * card (DBTA.nodes B)
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
(\<And>x y. x \<le> y \<Longrightarrow> max 1 2 * x \<le> max 1 2 * y) \<Longrightarrow> card (DBTA.nodes (intersect A B)) \<le> max 1 2 * (card (DBTA.nodes A) * card (DBTA.nodes B))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
(\<And>x y. x \<le> y \<Longrightarrow> max 1 2 * x \<le> max 1 2 * y) \<Longrightarrow> card (DBTA.nodes (intersect A B)) \<le> max 1 2 * (card (DBTA.nodes A) * card (DBTA.nodes B))

goal (1 subgoal):
 1. card (DBTA.nodes (intersect A B)) \<le> 2 * card (DBTA.nodes A) * card (DBTA.nodes B)
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
card (DBTA.nodes (intersect A B)) \<le> 2 * card (DBTA.nodes A) * card (DBTA.nodes B)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma powrat_le_1_cancel_iff [simp]:
   "\<lbrakk>0 < x; x < 1\<rbrakk> \<Longrightarrow> (x pow\<^sub>\<rat> r \<le> x pow\<^sub>\<rat> s) = (s \<le> r)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 < x; x < 1\<rbrakk> \<Longrightarrow> (x pow\<^sub>\<rat> r \<le> x pow\<^sub>\<rat> s) = (s \<le> r)
[PROOF STEP]
by (auto simp add: le_less)


[STATEMENT]
lemma if_smult: "(if P then x else (y::real)) *\<^sub>R v = (if P then x *\<^sub>R v else y *\<^sub>R v)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (if P then x else y) *\<^sub>R v = (if P then x *\<^sub>R v else y *\<^sub>R v)
[PROOF STEP]
by (fact if_distrib)


[STATEMENT]
lemma less_TC_succ: " x \<sqsubset> succ \<beta> \<longleftrightarrow> x \<sqsubset> \<beta> \<or> x = \<beta>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (x \<sqsubset> ZFC_in_HOL.succ \<beta>) = (x \<sqsubset> \<beta> \<or> x = \<beta>)
[PROOF STEP]
by (metis elts_succ insert_iff le_TC_def less_TC_iff)


[STATEMENT]
lemma Prod_any_not_zero:
  fixes f :: "'b \<Rightarrow> 'a :: comm_semiring_1"
  assumes "finite {a. f a \<noteq> 1}"
  assumes "(\<Prod>a. f a) \<noteq> 0"
  shows "f a \<noteq> 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. f a \<noteq> (0::'a)
[PROOF STEP]
using assms Prod_any_zero [of f]
[PROOF STATE]
proof (prove)
using this:
finite {a. f a \<noteq> (1::'a)}
Prod_any f \<noteq> (0::'a)
\<lbrakk>finite {a. f a \<noteq> (1::'a)}; f ?a = (0::'a)\<rbrakk> \<Longrightarrow> Prod_any f = (0::'a)

goal (1 subgoal):
 1. f a \<noteq> (0::'a)
[PROOF STEP]
by blast