[STATEMENT]
lemma height_balR2:
  "\<lbrakk> avl l;  avl r;  height r \<noteq> height l + 2 \<rbrakk> \<Longrightarrow>
   height (balR l a r) = 1 + max (height l) (height r)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>avl l; avl r; height r \<noteq> height l + 2\<rbrakk> \<Longrightarrow> height (balR l a r) = 1 + max (height l) (height r)
[PROOF STEP]
by (simp_all add: balR_def)


[STATEMENT]
lemma "max (3::int) 8 > 5"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 5 < max 3 8
[PROOF STEP]
by (smt (verit))


[STATEMENT]
lemma Im_power2: "Im (x ^ 2) = 2 * Re x * Im x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Im (x\<^sup>2) = 2 * Re x * Im x
[PROOF STEP]
by (simp add: power2_eq_square)


[STATEMENT]
theorem dijkstra_list_correct:
  "case dijkstra_list l s of
    None \<Rightarrow> \<not>valid_graph_rep l
  | Some D \<Rightarrow>
        valid_graph_rep l
      \<and> M.invar D
      \<and> (\<forall>u d. lookup D u = Some d \<longleftrightarrow> WGraph.\<delta> (wgraph_of_list l) s u = enat d)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. case dijkstra_list l s of None \<Rightarrow> \<not> valid_graph_rep l | Some D \<Rightarrow> valid_graph_rep l \<and> M.invar D \<and> (\<forall>u d. (lookup D u = Some d) = (WGraph.\<delta> (wgraph_of_list l) s u = enat d))
[PROOF STEP]
unfolding dijkstra_list_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. case if valid_graph_rep l then Some (dijkstra (from_list l) s) else None of None \<Rightarrow> \<not> valid_graph_rep l | Some D \<Rightarrow> valid_graph_rep l \<and> M.invar D \<and> (\<forall>u d. (lookup D u = Some d) = (WGraph.\<delta> (wgraph_of_list l) s u = enat d))
[PROOF STEP]
by (auto simp: dijkstra_correct G.from_list_correct)


[STATEMENT]
lemma (in CRR_market_viable) disc_put_option_lgeom:
  shows "(discounted_value r (\<lambda>m. (put_option T K)) T w) =
    (det_discount r T) * (max (K - (lgeom_proc u d init (stake T w))) 0)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. discounted_value r (\<lambda>m. put_option T K) T w = det_discount r T * max (K - lgeom_proc u d init (stake T w)) 0
[PROOF STEP]
using det_discounted[of r "\<lambda>m. put_option T K" T w] put_option_lgeom[of T K w]
[PROOF STATE]
proof (prove)
using this:
discounted_value r (\<lambda>m. put_option T K) T w = det_discount r T * put_option T K w
put_option T K w = max (K - lgeom_proc u d init (stake T w)) 0

goal (1 subgoal):
 1. discounted_value r (\<lambda>m. put_option T K) T w = det_discount r T * max (K - lgeom_proc u d init (stake T w)) 0
[PROOF STEP]
by simp


[STATEMENT]
lemma lipschitz_on_cmult_upper [lipschitz_intros]:
  fixes f::"'a::metric_space \<Rightarrow> 'b::real_normed_vector"
  assumes "C-lipschitz_on U f"
    "abs(a) \<le> D"
  shows "(D * C)-lipschitz_on U (\<lambda>x. a *\<^sub>R f x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (D * C)-lipschitz_on U (\<lambda>x. a *\<^sub>R f x)
[PROOF STEP]
apply (rule lipschitz_on_mono[OF lipschitz_on_cmult[OF assms(1), of a], of _ "D * C"])
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. U \<subseteq> U
 2. \<bar>a\<bar> * C \<le> D * C
[PROOF STEP]
using assms(2) lipschitz_on_nonneg[OF assms(1)] mult_right_mono
[PROOF STATE]
proof (prove)
using this:
\<bar>a\<bar> \<le> D
0 \<le> C
\<lbrakk>?a \<le> ?b; (0::?'a) \<le> ?c\<rbrakk> \<Longrightarrow> ?a * ?c \<le> ?b * ?c

goal (2 subgoals):
 1. U \<subseteq> U
 2. \<bar>a\<bar> * C \<le> D * C
[PROOF STEP]
by auto


[STATEMENT]
lemma "0x0A + 0x10 = (0x1A :: nat)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 10 + 16 = 26
[PROOF STEP]
by simp


[STATEMENT]
lemma inf_par_distrib: "(c\<^sub>0 \<sqinter> c\<^sub>1) \<parallel> d = (c\<^sub>0 \<parallel> d) \<sqinter> (c\<^sub>1 \<parallel> d)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (c\<^sub>0 \<sqinter> c\<^sub>1) \<parallel> d = c\<^sub>0 \<parallel> d \<sqinter> c\<^sub>1 \<parallel> d
variables:
c\<^sub>0, c\<^sub>1, d :: 'a
(\<parallel>) :: 'a \<Rightarrow> 'a \<Rightarrow> 'a
type variables:
'a :: refinement_lattice
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (c\<^sub>0 \<sqinter> c\<^sub>1) \<parallel> d = c\<^sub>0 \<parallel> d \<sqinter> c\<^sub>1 \<parallel> d
variables:
c\<^sub>0, c\<^sub>1, d :: 'a
(\<parallel>) :: 'a \<Rightarrow> 'a \<Rightarrow> 'a
type variables:
'a :: refinement_lattice
[PROOF STEP]
have "(c\<^sub>0 \<sqinter> c\<^sub>1) \<parallel> d = (\<Sqinter> {c\<^sub>0, c\<^sub>1}) \<parallel> d"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (c\<^sub>0 \<sqinter> c\<^sub>1) \<parallel> d = \<Sqinter> {c\<^sub>0, c\<^sub>1} \<parallel> d
variables:
c\<^sub>0, c\<^sub>1, d :: 'a
(\<parallel>) :: 'a \<Rightarrow> 'a \<Rightarrow> 'a
type variables:
'a :: refinement_lattice
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
((c\<^sub>0::'a::refinement_lattice) \<sqinter> (c\<^sub>1::'a::refinement_lattice)) \<parallel> (d::'a::refinement_lattice) = \<Sqinter> {c\<^sub>0, c\<^sub>1} \<parallel> d

goal (1 subgoal):
 1. (c\<^sub>0 \<sqinter> c\<^sub>1) \<parallel> d = c\<^sub>0 \<parallel> d \<sqinter> c\<^sub>1 \<parallel> d
variables:
c\<^sub>0, c\<^sub>1, d :: 'a
(\<parallel>) :: 'a \<Rightarrow> 'a \<Rightarrow> 'a
type variables:
'a :: refinement_lattice
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
((c\<^sub>0::'a::refinement_lattice) \<sqinter> (c\<^sub>1::'a::refinement_lattice)) \<parallel> (d::'a::refinement_lattice) = \<Sqinter> {c\<^sub>0, c\<^sub>1} \<parallel> d

goal (1 subgoal):
 1. (c\<^sub>0 \<sqinter> c\<^sub>1) \<parallel> d = c\<^sub>0 \<parallel> d \<sqinter> c\<^sub>1 \<parallel> d
variables:
c\<^sub>0, c\<^sub>1, d :: 'a
(\<parallel>) :: 'a \<Rightarrow> 'a \<Rightarrow> 'a
type variables:
'a :: refinement_lattice
[PROOF STEP]
have "... = (\<Sqinter>c \<in> {c\<^sub>0, c\<^sub>1}. c \<parallel> d)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<Sqinter> {c\<^sub>0, c\<^sub>1} \<parallel> d = (\<Sqinter>c::'a\<in>{c\<^sub>0, c\<^sub>1}. c \<parallel> d)
variables:
c\<^sub>0, c\<^sub>1, d :: 'a
(\<parallel>) :: 'a \<Rightarrow> 'a \<Rightarrow> 'a
type variables:
'a :: refinement_lattice
[PROOF STEP]
using Inf_par_distrib
[PROOF STATE]
proof (prove)
using this:
(?D::'a::refinement_lattice set) \<noteq> {} \<Longrightarrow> \<Sqinter> ?D \<parallel> (?c::'a::refinement_lattice) = (\<Sqinter>d::'a::refinement_lattice\<in>?D. d \<parallel> ?c)

goal (1 subgoal):
 1. \<Sqinter> {c\<^sub>0, c\<^sub>1} \<parallel> d = (\<Sqinter>c::'a\<in>{c\<^sub>0, c\<^sub>1}. c \<parallel> d)
variables:
c\<^sub>0, c\<^sub>1, d :: 'a
(\<parallel>) :: 'a \<Rightarrow> 'a \<Rightarrow> 'a
type variables:
'a :: refinement_lattice
[PROOF STEP]
by (meson insert_not_empty)
[PROOF STATE]
proof (state)
this:
\<Sqinter> {c\<^sub>0::'a::refinement_lattice, c\<^sub>1::'a::refinement_lattice} \<parallel> (d::'a::refinement_lattice) = (\<Sqinter>c::'a::refinement_lattice\<in>{c\<^sub>0, c\<^sub>1}. c \<parallel> d)

goal (1 subgoal):
 1. (c\<^sub>0 \<sqinter> c\<^sub>1) \<parallel> d = c\<^sub>0 \<parallel> d \<sqinter> c\<^sub>1 \<parallel> d
variables:
c\<^sub>0, c\<^sub>1, d :: 'a
(\<parallel>) :: 'a \<Rightarrow> 'a \<Rightarrow> 'a
type variables:
'a :: refinement_lattice
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
\<Sqinter> {c\<^sub>0::'a::refinement_lattice, c\<^sub>1::'a::refinement_lattice} \<parallel> (d::'a::refinement_lattice) = (\<Sqinter>c::'a::refinement_lattice\<in>{c\<^sub>0, c\<^sub>1}. c \<parallel> d)

goal (1 subgoal):
 1. (c\<^sub>0 \<sqinter> c\<^sub>1) \<parallel> d = c\<^sub>0 \<parallel> d \<sqinter> c\<^sub>1 \<parallel> d
variables:
c\<^sub>0, c\<^sub>1, d :: 'a
(\<parallel>) :: 'a \<Rightarrow> 'a \<Rightarrow> 'a
type variables:
'a :: refinement_lattice
[PROOF STEP]
have "... = c\<^sub>0 \<parallel> d \<sqinter> c\<^sub>1 \<parallel> d"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Sqinter>c::'a\<in>{c\<^sub>0, c\<^sub>1}. c \<parallel> d) = c\<^sub>0 \<parallel> d \<sqinter> c\<^sub>1 \<parallel> d
variables:
c\<^sub>0, c\<^sub>1, d :: 'a
(\<parallel>) :: 'a \<Rightarrow> 'a \<Rightarrow> 'a
type variables:
'a :: refinement_lattice
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
(\<Sqinter>c::'a::refinement_lattice\<in>{c\<^sub>0::'a::refinement_lattice, c\<^sub>1::'a::refinement_lattice}. c \<parallel> (d::'a::refinement_lattice)) = c\<^sub>0 \<parallel> d \<sqinter> c\<^sub>1 \<parallel> d

goal (1 subgoal):
 1. (c\<^sub>0 \<sqinter> c\<^sub>1) \<parallel> d = c\<^sub>0 \<parallel> d \<sqinter> c\<^sub>1 \<parallel> d
variables:
c\<^sub>0, c\<^sub>1, d :: 'a
(\<parallel>) :: 'a \<Rightarrow> 'a \<Rightarrow> 'a
type variables:
'a :: refinement_lattice
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
((c\<^sub>0::'a::refinement_lattice) \<sqinter> (c\<^sub>1::'a::refinement_lattice)) \<parallel> (d::'a::refinement_lattice) = c\<^sub>0 \<parallel> d \<sqinter> c\<^sub>1 \<parallel> d
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
((c\<^sub>0::'a::refinement_lattice) \<sqinter> (c\<^sub>1::'a::refinement_lattice)) \<parallel> (d::'a::refinement_lattice) = c\<^sub>0 \<parallel> d \<sqinter> c\<^sub>1 \<parallel> d

goal (1 subgoal):
 1. (c\<^sub>0 \<sqinter> c\<^sub>1) \<parallel> d = c\<^sub>0 \<parallel> d \<sqinter> c\<^sub>1 \<parallel> d
variables:
c\<^sub>0, c\<^sub>1, d :: 'a
(\<parallel>) :: 'a \<Rightarrow> 'a \<Rightarrow> 'a
type variables:
'a :: refinement_lattice
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
((c\<^sub>0::'a::refinement_lattice) \<sqinter> (c\<^sub>1::'a::refinement_lattice)) \<parallel> (d::'a::refinement_lattice) = c\<^sub>0 \<parallel> d \<sqinter> c\<^sub>1 \<parallel> d

goal:
No subgoals!
variables:
c\<^sub>0, c\<^sub>1, d :: 'a
(\<parallel>) :: 'a \<Rightarrow> 'a \<Rightarrow> 'a
type variables:
'a :: refinement_lattice
[PROOF STEP]
qed


[STATEMENT]
lemma fetch_aft_erase_c_b:
  "fetch (mopup_a n @ shift mopup_b (2 * n)) (2 * n + 4) Bk
 = (R, Suc (2 * n + 1))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fetch (mopup_a n @ shift mopup_b (2 * n)) (2 * n + 4) Bk = (R, Suc (2 * n + 1))
[PROOF STEP]
apply(subgoal_tac "length (mopup_a n) = 4 * n")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. length (mopup_a n) = 4 * n \<Longrightarrow> fetch (mopup_a n @ shift mopup_b (2 * n)) (2 * n + 4) Bk = (R, Suc (2 * n + 1))
 2. length (mopup_a n) = 4 * n
[PROOF STEP]
apply(subgoal_tac "2*n + 4 = Suc (2*n + 3)", simp only: fetch.simps)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<lbrakk>length (mopup_a n) = 4 * n; 2 * n + 4 = Suc (2 * n + 3)\<rbrakk> \<Longrightarrow> (case nth_of (mopup_a n @ shift mopup_b (2 * n)) (2 * (2 * n + 3)) of None \<Rightarrow> (Nop, 0) | Some i \<Rightarrow> i) = (R, Suc (2 * n + 1))
 2. length (mopup_a n) = 4 * n \<Longrightarrow> 2 * n + 4 = Suc (2 * n + 3)
 3. length (mopup_a n) = 4 * n
[PROOF STEP]
apply(auto simp: mopup_b_def nth_append shift.simps)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma "(\<lambda>x::real. ((x+4) powr (3/2) + exp x - 9) / x) \<midarrow>0\<rightarrow> 4"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lambda>x. ((x + 4) powr (3 / 2) + exp x - 9) / x) \<midarrow>0\<rightarrow> 4
[PROOF STEP]
by real_asymp


[STATEMENT]
lemma degeneralize_simps[simp]:
      "alphabet\<^sub>2 (degeneralize A) = alphabet\<^sub>1 A"
      "initial\<^sub>2 (degeneralize A) = initial\<^sub>1 A \<times> {0}"
      "transition\<^sub>2 (degeneralize A) a (p, k) =
        {(q, count (condition\<^sub>1 A) (item (p, a, q)) k) |q. q \<in> transition\<^sub>1 A a p}"
      "condition\<^sub>2 (degeneralize A) = degen (condition\<^sub>1 A) \<circ> translate"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (alphabet\<^sub>2 (degeneralize A) = alphabet\<^sub>1 A &&& initial\<^sub>2 (degeneralize A) = initial\<^sub>1 A \<times> {0}) &&& transition\<^sub>2 (degeneralize A) a (p, k) = {(q, count (condition\<^sub>1 A) (item (p, a, q)) k) |q. q \<in> transition\<^sub>1 A a p} &&& condition\<^sub>2 (degeneralize A) = degen (condition\<^sub>1 A) \<circ> translate
[PROOF STEP]
unfolding degeneralize_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (alphabet\<^sub>2 (automaton\<^sub>2 (alphabet\<^sub>1 A) (initial\<^sub>1 A \<times> {0}) (\<lambda>a (p, k). {(q, count (condition\<^sub>1 A) (item (p, a, q)) k) |q. q \<in> transition\<^sub>1 A a p}) (degen (condition\<^sub>1 A) \<circ> translate)) = alphabet\<^sub>1 A &&& initial\<^sub>2 (automaton\<^sub>2 (alphabet\<^sub>1 A) (initial\<^sub>1 A \<times> {0}) (\<lambda>a (p, k). {(q, count (condition\<^sub>1 A) (item (p, a, q)) k) |q. q \<in> transition\<^sub>1 A a p}) (degen (condition\<^sub>1 A) \<circ> translate)) = initial\<^sub>1 A \<times> {0}) &&& transition\<^sub>2 (automaton\<^sub>2 (alphabet\<^sub>1 A) (initial\<^sub>1 A \<times> {0}) (\<lambda>a (p, k). {(q, count (condition\<^sub>1 A) (item (p, a, q)) k) |q. q \<in> transition\<^sub>1 A a p}) (degen (condition\<^sub>1 A) \<circ> translate)) a (p, k) = {(q, count (condition\<^sub>1 A) (item (p, a, q)) k) |q. q \<in> transition\<^sub>1 A a p} &&& condition\<^sub>2 (automaton\<^sub>2 (alphabet\<^sub>1 A) (initial\<^sub>1 A \<times> {0}) (\<lambda>a (p, k). {(q, count (condition\<^sub>1 A) (item (p, a, q)) k) |q. q \<in> transition\<^sub>1 A a p}) (degen (condition\<^sub>1 A) \<circ> translate)) = degen (condition\<^sub>1 A) \<circ> translate
[PROOF STEP]
by auto


[STATEMENT]
lemma INFM_nat_le: "(\<exists>\<^sub>\<infinity>n. P n) \<longleftrightarrow> (\<forall>m. \<exists>n\<ge>m. P n)"
  for P :: "nat \<Rightarrow> bool"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<exists>\<^sub>\<infinity>n. P n) = (\<forall>m. \<exists>n\<ge>m. P n)
[PROOF STEP]
by (simp add: frequently_cofinite infinite_nat_iff_unbounded_le)


[STATEMENT]
lemma "list_of_array (the (Gale_Shapley
  [[4,6,0,1,5,7,3,2], [1,2,6,4,3,0,7,5], [7,4,0,3,5,1,2,6], [2,1,6,3,0,5,7,4],
   [6,1,4,0,2,5,7,3], [0,5,6,4,7,3,1,2], [1,4,6,5,2,3,7,0], [2,7,3,4,6,1,5,0]]
  [[4,2,6,5,0,1,7,3], [7,5,2,4,6,1,0,3], [0,4,5,1,3,7,6,2], [7,6,2,1,3,0,4,5],
   [5,3,6,2,7,0,1,4], [1,7,4,2,3,5,6,0], [6,4,1,0,7,5,3,2], [6,3,0,4,1,2,5,7]]))
  = [0, 1, 0, 5, 0, 0, 0, 2]"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. list (the (Gale_Shapley2.Gale_Shapley [[4, 6, 0, 1, 5, 7, 3, 2], [1, 2, 6, 4, 3, 0, 7, 5], [7, 4, 0, 3, 5, 1, 2, 6], [2, 1, 6, 3, 0, 5, 7, 4], [6, 1, 4, 0, 2, 5, 7, 3], [0, 5, 6, 4, 7, 3, 1, 2], [1, 4, 6, 5, 2, 3, 7, 0], [2, 7, 3, 4, 6, 1, 5, 0]] [[4, 2, 6, 5, 0, 1, 7, 3], [7, 5, 2, 4, 6, 1, 0, 3], [0, 4, 5, 1, 3, 7, 6, 2], [7, 6, 2, 1, 3, 0, 4, 5], [5, 3, 6, 2, 7, 0, 1, 4], [1, 7, 4, 2, 3, 5, 6, 0], [6, 4, 1, 0, 7, 5, 3, 2], [6, 3, 0, 4, 1, 2, 5, 7]])) = [0, 1, 0, 5, 0, 0, 0, 2]
[PROOF STEP]
by eval


[STATEMENT]
lemma eval_mod_exp_nat_aux [simp]:
  "mod_exp_nat_aux m y x 0 = y"
  "mod_exp_nat_aux m y x (Suc 0) = (x * y) mod m"
  "mod_exp_nat_aux m y x (numeral (num.Bit0 n)) =
     mod_exp_nat_aux m y (x\<^sup>2 mod m) (numeral n)"
  "mod_exp_nat_aux m y x (numeral (num.Bit1 n)) =
     mod_exp_nat_aux m ((x * y) mod m) (x\<^sup>2 mod m) (numeral n)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (mod_exp_nat_aux m y x 0 = y &&& mod_exp_nat_aux m y x (Suc 0) = x * y mod m) &&& mod_exp_nat_aux m y x (numeral (num.Bit0 n)) = mod_exp_nat_aux m y (x\<^sup>2 mod m) (numeral n) &&& mod_exp_nat_aux m y x (numeral (num.Bit1 n)) = mod_exp_nat_aux m (x * y mod m) (x\<^sup>2 mod m) (numeral n)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. mod_exp_nat_aux m y x 0 = y
 2. mod_exp_nat_aux m y x (Suc 0) = x * y mod m
 3. mod_exp_nat_aux m y x (numeral (num.Bit0 n)) = mod_exp_nat_aux m y (x\<^sup>2 mod m) (numeral n)
 4. mod_exp_nat_aux m y x (numeral (num.Bit1 n)) = mod_exp_nat_aux m (x * y mod m) (x\<^sup>2 mod m) (numeral n)
[PROOF STEP]
define n' where "n' = (numeral n :: nat)"
[PROOF STATE]
proof (state)
this:
n' = numeral n

goal (4 subgoals):
 1. mod_exp_nat_aux m y x 0 = y
 2. mod_exp_nat_aux m y x (Suc 0) = x * y mod m
 3. mod_exp_nat_aux m y x (numeral (num.Bit0 n)) = mod_exp_nat_aux m y (x\<^sup>2 mod m) (numeral n)
 4. mod_exp_nat_aux m y x (numeral (num.Bit1 n)) = mod_exp_nat_aux m (x * y mod m) (x\<^sup>2 mod m) (numeral n)
[PROOF STEP]
have [simp]: "n' \<noteq> 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. n' \<noteq> 0
[PROOF STEP]
by (auto simp: n'_def)
[PROOF STATE]
proof (state)
this:
n' \<noteq> 0

goal (4 subgoals):
 1. mod_exp_nat_aux m y x 0 = y
 2. mod_exp_nat_aux m y x (Suc 0) = x * y mod m
 3. mod_exp_nat_aux m y x (numeral (num.Bit0 n)) = mod_exp_nat_aux m y (x\<^sup>2 mod m) (numeral n)
 4. mod_exp_nat_aux m y x (numeral (num.Bit1 n)) = mod_exp_nat_aux m (x * y mod m) (x\<^sup>2 mod m) (numeral n)
[PROOF STEP]
show "mod_exp_nat_aux m y x 0 = y" and "mod_exp_nat_aux m y x (Suc 0) = (x * y) mod m"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mod_exp_nat_aux m y x 0 = y &&& mod_exp_nat_aux m y x (Suc 0) = x * y mod m
[PROOF STEP]
by (simp_all add: mod_exp_nat_aux_def)
[PROOF STATE]
proof (state)
this:
mod_exp_nat_aux m y x 0 = y
mod_exp_nat_aux m y x (Suc 0) = x * y mod m

goal (2 subgoals):
 1. mod_exp_nat_aux m y x (numeral (num.Bit0 n)) = mod_exp_nat_aux m y (x\<^sup>2 mod m) (numeral n)
 2. mod_exp_nat_aux m y x (numeral (num.Bit1 n)) = mod_exp_nat_aux m (x * y mod m) (x\<^sup>2 mod m) (numeral n)
[PROOF STEP]
have "numeral (num.Bit0 n) = (2 * n')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. numeral (num.Bit0 n) = 2 * n'
[PROOF STEP]
by (subst numeral.numeral_Bit0) (simp del: arith_simps add: n'_def)
[PROOF STATE]
proof (state)
this:
numeral (num.Bit0 n) = 2 * n'

goal (2 subgoals):
 1. mod_exp_nat_aux m y x (numeral (num.Bit0 n)) = mod_exp_nat_aux m y (x\<^sup>2 mod m) (numeral n)
 2. mod_exp_nat_aux m y x (numeral (num.Bit1 n)) = mod_exp_nat_aux m (x * y mod m) (x\<^sup>2 mod m) (numeral n)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
numeral (num.Bit0 n) = 2 * n'

goal (2 subgoals):
 1. mod_exp_nat_aux m y x (numeral (num.Bit0 n)) = mod_exp_nat_aux m y (x\<^sup>2 mod m) (numeral n)
 2. mod_exp_nat_aux m y x (numeral (num.Bit1 n)) = mod_exp_nat_aux m (x * y mod m) (x\<^sup>2 mod m) (numeral n)
[PROOF STEP]
have "mod_exp_nat_aux m y x \<dots> = mod_exp_nat_aux m y (x^2 mod m) n'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mod_exp_nat_aux m y x (2 * n') = mod_exp_nat_aux m y (x\<^sup>2 mod m) n'
[PROOF STEP]
by (subst mod_exp_nat_aux_code) (simp_all add: power2_eq_square)
[PROOF STATE]
proof (state)
this:
mod_exp_nat_aux m y x (2 * n') = mod_exp_nat_aux m y (x\<^sup>2 mod m) n'

goal (2 subgoals):
 1. mod_exp_nat_aux m y x (numeral (num.Bit0 n)) = mod_exp_nat_aux m y (x\<^sup>2 mod m) (numeral n)
 2. mod_exp_nat_aux m y x (numeral (num.Bit1 n)) = mod_exp_nat_aux m (x * y mod m) (x\<^sup>2 mod m) (numeral n)
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
mod_exp_nat_aux m y x (numeral (num.Bit0 n)) = mod_exp_nat_aux m y (x\<^sup>2 mod m) n'
[PROOF STEP]
show "mod_exp_nat_aux m y x (numeral (num.Bit0 n)) =
                  mod_exp_nat_aux m y (x\<^sup>2 mod m) (numeral n)"
[PROOF STATE]
proof (prove)
using this:
mod_exp_nat_aux m y x (numeral (num.Bit0 n)) = mod_exp_nat_aux m y (x\<^sup>2 mod m) n'

goal (1 subgoal):
 1. mod_exp_nat_aux m y x (numeral (num.Bit0 n)) = mod_exp_nat_aux m y (x\<^sup>2 mod m) (numeral n)
[PROOF STEP]
by (simp add: n'_def)
[PROOF STATE]
proof (state)
this:
mod_exp_nat_aux m y x (numeral (num.Bit0 n)) = mod_exp_nat_aux m y (x\<^sup>2 mod m) (numeral n)

goal (1 subgoal):
 1. mod_exp_nat_aux m y x (numeral (num.Bit1 n)) = mod_exp_nat_aux m (x * y mod m) (x\<^sup>2 mod m) (numeral n)
[PROOF STEP]
have "numeral (num.Bit1 n) = Suc (2 * n')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. numeral (num.Bit1 n) = Suc (2 * n')
[PROOF STEP]
by (subst numeral.numeral_Bit1) (simp del: arith_simps add: n'_def)
[PROOF STATE]
proof (state)
this:
numeral (num.Bit1 n) = Suc (2 * n')

goal (1 subgoal):
 1. mod_exp_nat_aux m y x (numeral (num.Bit1 n)) = mod_exp_nat_aux m (x * y mod m) (x\<^sup>2 mod m) (numeral n)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
numeral (num.Bit1 n) = Suc (2 * n')

goal (1 subgoal):
 1. mod_exp_nat_aux m y x (numeral (num.Bit1 n)) = mod_exp_nat_aux m (x * y mod m) (x\<^sup>2 mod m) (numeral n)
[PROOF STEP]
have "mod_exp_nat_aux m y x \<dots> = mod_exp_nat_aux m ((x * y) mod m) (x^2 mod m) n'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mod_exp_nat_aux m y x (Suc (2 * n')) = mod_exp_nat_aux m (x * y mod m) (x\<^sup>2 mod m) n'
[PROOF STEP]
by (subst mod_exp_nat_aux_code) (simp_all add: power2_eq_square)
[PROOF STATE]
proof (state)
this:
mod_exp_nat_aux m y x (Suc (2 * n')) = mod_exp_nat_aux m (x * y mod m) (x\<^sup>2 mod m) n'

goal (1 subgoal):
 1. mod_exp_nat_aux m y x (numeral (num.Bit1 n)) = mod_exp_nat_aux m (x * y mod m) (x\<^sup>2 mod m) (numeral n)
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
mod_exp_nat_aux m y x (numeral (num.Bit1 n)) = mod_exp_nat_aux m (x * y mod m) (x\<^sup>2 mod m) n'
[PROOF STEP]
show "mod_exp_nat_aux m y x (numeral (num.Bit1 n)) =
                  mod_exp_nat_aux m ((x * y) mod m) (x\<^sup>2 mod m) (numeral n)"
[PROOF STATE]
proof (prove)
using this:
mod_exp_nat_aux m y x (numeral (num.Bit1 n)) = mod_exp_nat_aux m (x * y mod m) (x\<^sup>2 mod m) n'

goal (1 subgoal):
 1. mod_exp_nat_aux m y x (numeral (num.Bit1 n)) = mod_exp_nat_aux m (x * y mod m) (x\<^sup>2 mod m) (numeral n)
[PROOF STEP]
by (simp add: n'_def)
[PROOF STATE]
proof (state)
this:
mod_exp_nat_aux m y x (numeral (num.Bit1 n)) = mod_exp_nat_aux m (x * y mod m) (x\<^sup>2 mod m) (numeral n)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma word_power_less_1 [simp]:
  "sz < LENGTH('a::len) \<Longrightarrow> (2::'a word) ^ sz - 1 < 2 ^ sz"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. sz < LENGTH('a) \<Longrightarrow> 2 ^ sz - 1 < 2 ^ sz
[PROOF STEP]
apply (simp add: word_less_nat_alt)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. sz < LENGTH('a) \<Longrightarrow> unat (2 ^ sz - 1) < 2 ^ sz
[PROOF STEP]
apply (subst unat_minus_one)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. sz < LENGTH('a) \<Longrightarrow> 2 ^ sz \<noteq> 0
 2. sz < LENGTH('a) \<Longrightarrow> unat (2 ^ sz) - 1 < 2 ^ sz
[PROOF STEP]
apply simp_all
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma SPEC_rule_weak:
  assumes "f x \<le> SPEC (Q x)" and "f x \<le> SPEC (P x)"
      and "\<And>r1 r2. \<lbrakk>(Q x) (r1, r2); (P x) (r1, r2)\<rbrakk> \<Longrightarrow> (P x') (r1, r2)"
    shows "f x \<le> SPEC (P x')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. f x \<le> SPEC (P x')
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
f x \<le> SPEC (Q x)
f x \<le> SPEC (P x)
\<lbrakk>Q x (?r1.0, ?r2.0); P x (?r1.0, ?r2.0)\<rbrakk> \<Longrightarrow> P x' (?r1.0, ?r2.0)

goal (1 subgoal):
 1. f x \<le> SPEC (P x')
[PROOF STEP]
by (simp add: pw_le_iff)


[STATEMENT]
lemma (in equivalence) closure_idem_strong:
  assumes "A \<subseteq> carrier S"
  shows "closure_of (closure_of A) = closure_of A"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. closure_of (closure_of A) = closure_of A
[PROOF STEP]
using assms closure_of_eq complete_classes is_closedI
[PROOF STATE]
proof (prove)
using this:
A \<subseteq> carrier S
\<lbrakk>?A \<subseteq> carrier S; ?x \<in> closure_of ?A; ?x' \<in> carrier S; ?x .= ?x'\<rbrakk> \<Longrightarrow> ?x' \<in> closure_of ?A
is_closed ?A \<Longrightarrow> ?A = closure_of ?A
\<lbrakk>\<And>x y. \<lbrakk>x .= y; x \<in> ?A; y \<in> carrier S\<rbrakk> \<Longrightarrow> y \<in> ?A; ?A \<subseteq> carrier S\<rbrakk> \<Longrightarrow> is_closed ?A

goal (1 subgoal):
 1. closure_of (closure_of A) = closure_of A
[PROOF STEP]
by auto


[STATEMENT]
lemma "!!a::int. [| a <= b; c <= d; x+y<z |] ==> a+c <= b+d"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a. \<lbrakk>a \<le> b; c \<le> d; x + y < z\<rbrakk> \<Longrightarrow> a + c \<le> b + d
[PROOF STEP]
by arith