proof (prove)
goal (1 subgoal):
 1. x \<le> top


proof (prove)
using this:
  c N = round (real_of_int (B * b N) / real_of_int (a N))
  real_of_int (c (N + 1)) / real_of_int (a N) =
  real_of_int (c N) - real_of_int (B * b N) / real_of_int (a N)
  \<bar>of_int (round ?x) - ?x\<bar> \<le> (1::?'a) / (2::?'a)

goal (1 subgoal):
 1. \<bar>real_of_int (c (N + 1)) / real_of_int (a N)\<bar> \<le> 1 / 2


proof (prove)
goal (1 subgoal):
 1. C1 = C2


proof (prove)
using this:
  t \<le> t'
  {t..t'} \<subseteq> existence_ivl0 x
  (?A \<subseteq> {}) = (?A = {})

goal (1 subgoal):
 1. x \<in> X


proof (state)
this:
  reduc_saturated N

goal (2 subgoals):
 1. reduc_saturated N \<Longrightarrow> reduc_calc.saturated N
 2. reduc_calc.saturated N \<Longrightarrow> reduc_saturated N


proof (prove)
goal (1 subgoal):
 1. P p (q + r)


proof (prove)
using this:
  P \<turnstile> \<langle>e_,s\<^sub>0_\<rangle> \<Rightarrow>
                 \<langle>addr a_,(h_, l_, sh_)\<rangle>
  \<lbrakk>iconf (shp s\<^sub>0_) e_;
   P,shp s\<^sub>0_ \<turnstile>\<^sub>b (e_,?b) \<surd>\<rbrakk>
  \<Longrightarrow> P \<turnstile> \<langle>e_,s\<^sub>0_,
                                    ?b\<rangle> \<rightarrow>*
                                   \<langle>addr a_,(h_, l_, sh_),
                                    False\<rangle>
  h_ a_ = \<lfloor>(D_, fs_)\<rfloor>
  (D_, C_) \<notin> (subcls1 P)\<^sup>*
  iconf (shp s\<^sub>0_) (Cast C_ e_)
  P,shp s\<^sub>0_ \<turnstile>\<^sub>b (Cast C_ e_,b) \<surd>

goal (1 subgoal):
 1. P \<turnstile> \<langle>Cast C_ e_,s\<^sub>0_,b\<rangle> \<rightarrow>*
                   \<langle>THROW ClassCast,(h_, l_, sh_),False\<rangle>


proof (prove)
using this:
  finite A
  a \<notin> A
  f \<in> A \<rightarrow> carrier_vec n \<Longrightarrow>
  dim_vec (finsum V f A) = n
  f \<in> insert a A \<rightarrow> carrier_vec n

goal (1 subgoal):
 1. dim_vec (f a + finsum V f A) = n


proof (prove)
using this:
  user_reg_val curr_win (rd OR 1) y = user_reg_val curr_win (rd OR 1) ya

goal (1 subgoal):
 1. low_equal yb yc


proof (prove)
goal (1 subgoal):
 1. (Variable (Suc (Suc 0)) \<in> var &&&
     out \<noteq> Variable (Suc (Suc 0)) \<and>
     Variable (Suc (Suc 0)) \<noteq> out) &&&
    inp \<noteq> Variable (Suc (Suc 0)) \<and>
    Variable (Suc (Suc 0)) \<noteq> inp &&&
    Variable (Suc (Suc 0)) \<notin> Fvars \<tau> &&&
    Variable (Suc (Suc 0)) \<notin> Fvars \<phi>


proof (prove)
using this:
  p \<in> span (insert r B)
  r \<in> span B

goal (1 subgoal):
 1. p \<in> span B


proof (prove)
using this:
  has_unique_favorites R

goal (1 subgoal):
 1. pref_profile_unique_favorites agents alts R


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>simple_match_valid ac; \<not> simple_matches ac p;
     match_iface (oiface ac) (p_oiface p);
     OF_match_linear OF_match_fields_safe
      (map (\<lambda>x.
               split3 OFEntry
                (x1, x,
                 case ba of Accept \<Rightarrow> [Forward ad]
                 | Drop \<Rightarrow> []))
        (simple_match_to_of_match ac ifs))
      p \<noteq>
     NoAction\<rbrakk>
    \<Longrightarrow> False


proof (chain)
picking this:
  weak_conv_m (\<mu> \<circ> s \<circ> r) (interval_measure F)


proof (prove)
using this:
  map_of subs = map_of ?subs \<Longrightarrow>
  raw_match_term f f' (map_of ?subs) =
  map_option map_of (assoc_match_term f f' ?subs)
  raw_match_term f f' (map_of subs) = Some (map_of ?subs) \<Longrightarrow>
  raw_match_term u u' (map_of ?subs) =
  map_option map_of (assoc_match_term u u' ?subs)

goal (1 subgoal):
 1. Option.bind (map_option map_of (assoc_match_term f f' subs))
     (raw_match_term u u') =
    map_option map_of
     (Option.bind (assoc_match_term f f' subs) (assoc_match_term u u'))


proof (prove)
goal (1 subgoal):
 1. sa.is_run (snd \<circ> r) \<and>
    local.sa.L \<circ> snd \<circ> r \<in> local.igba.lang


proof (prove)
goal (1 subgoal):
 1. (n \<le> length kvs \<Longrightarrow>
     inv2 (fst (rbtreeify_f n kvs))) &&&
    (n \<le> Suc (length kvs) \<Longrightarrow>
     inv2 (fst (rbtreeify_g n kvs)))


proof (prove)
goal (1 subgoal):
 1. TOTAL_wrt \<phi> = TOTAL


proof (prove)
goal (1 subgoal):
 1. \<And>Y xs.
       \<lbrakk>chain Y; chain (\<lambda>i. ccTTree (Y i) G);
        xs \<in> valid_lists (\<Union> (range Y)) G\<rbrakk>
       \<Longrightarrow> xs = [] \<or>
                         (\<exists>x. xs \<in> valid_lists (Y x) G)


proof (state)
this:
  \<phi> \<cdot> f \<cdot> local.inv \<phi> = f'

goal (1 subgoal):
 1. \<theta>' \<cdot>
    (\<phi> \<cdot> f \<cdot> local.inv \<phi> \<star>
     w' \<cdot> \<gamma> \<cdot> w) =
    \<theta>' \<cdot> (f' \<star> \<gamma>)


proof (prove)
goal (1 subgoal):
 1. derives1 a (drop (length w) b)


proof (prove)
goal (1 subgoal):
 1. vars_term (scf_term scf (Fun f ss)) =
    (\<Union>x\<in>set (scf_list (scf (f, length ss)) ss).
        vars_term (scf_term scf x))


proof (prove)
goal (2 subgoals):
 1. wb_lens X \<Longrightarrow>
    X ;\<^sub>L fst\<^sub>L \<bowtie> Y ;\<^sub>L snd\<^sub>L
 2. wb_lens X \<Longrightarrow>
    x ;\<^sub>L (Y ;\<^sub>L snd\<^sub>L) =
    x ;\<^sub>L (Y ;\<^sub>L snd\<^sub>L)


proof (prove)
goal (1 subgoal):
 1. Sigma_Algebra.measure M (\<Union> (range c)) \<le> 0


proof (prove)
goal (1 subgoal):
 1. snd (snd (foldl echelon_form_of_column_k_iarrays
               (matrix_to_iarray A, 0, bezout) [0..<Suc k])) =
    bezout


proof (prove)
using this:
  0 < x
  0 \<le> log 2 x - real_of_int \<lfloor>log 2 x\<rfloor>

goal (1 subgoal):
 1. 0 < truncate_down p x


proof (prove)
using this:
  u \<noteq> inversion u
  v \<noteq> inversion u
  {u, v} \<subseteq> circline_set l1 \<inter> circline_set l2
  \<lbrakk>u \<noteq> inversion u; u \<noteq> v;
   inversion u \<noteq> v\<rbrakk>
  \<Longrightarrow> \<exists>!H.
                       u \<in> circline_set H \<and>
                       inversion u \<in> circline_set H \<and>
                       v \<in> circline_set H
  u \<noteq> v
  \<lbrakk>is_poincare_line l1; u \<in> circline_set l1\<rbrakk>
  \<Longrightarrow> inversion u \<in> circline_set l1
  \<lbrakk>is_poincare_line l2; u \<in> circline_set l2\<rbrakk>
  \<Longrightarrow> inversion u \<in> circline_set l2
  is_poincare_line l1
  is_poincare_line l2

goal (1 subgoal):
 1. l1 = l2


proof (prove)
goal (1 subgoal):
 1. nfa.init (Reverse_nfa MS) = dfa.final MS


proof (prove)
using this:
  pointermap_p_valid n (dpm bdd) \<and>
  (case pm_pth (dpm bdd) n of
   (nv, nt, ne) \<Rightarrow>
     nv = v \<and> Rmi_g nt t bdd \<and> Rmi_g ne e bdd)
  pointermap_p_valid ?p (dpm bdd) \<Longrightarrow>
  pointermap_p_valid ?p (dpm s')
  Rmi_g x1a t bdd \<Longrightarrow> Rmi_g x1a t s'
  Rmi_g x2a e bdd \<Longrightarrow> Rmi_g x2a e s'

goal (1 subgoal):
 1. pointermap_p_valid n (dpm s') \<and>
    (case pm_pth (dpm s') n of
     (nv, nt, ne) \<Rightarrow>
       nv = v \<and> Rmi_g nt t s' \<and> Rmi_g ne e s')


proof (prove)
goal (1 subgoal):
 1. \<And>ptr' disc_nodes.
       h \<turnstile> get_tag_name ptr' \<rightarrow>\<^sub>r disc_nodes =
       h' \<turnstile> get_tag_name ptr' \<rightarrow>\<^sub>r disc_nodes


proof (prove)
goal (1 subgoal):
 1. (p \<sqinter> - (1::'a) \<squnion> (1::'a))\<^sup>T *
    (p \<sqinter> - (1::'a) \<squnion> (1::'a)) =
    (p \<sqinter> - (1::'a) \<squnion>
     (p \<sqinter> - (1::'a))\<^sup>T)\<^sup>\<star>


proof (prove)
using this:
  Can t
  Nml t
  \<lbrakk>Can ?t; Nml ?t\<rbrakk> \<Longrightarrow> Ide ?t
  Ide ?t \<Longrightarrow> ?t \<in> HHom (Src ?t) (Trg ?t)
  Ide ?t \<Longrightarrow> ?t \<in> VHom ?t ?t

goal (1 subgoal):
 1. t \<^bold>\<lfloor>\<^bold>\<cdot>\<^bold>\<rfloor> Inv t = Cod t


proof (prove)
goal (1 subgoal):
 1. exec_gpv callee (pauses xs) s =
    map_spmf (Pair ())
     (foldl_spmf (map_fun id (map_fun id (map_spmf snd)) callee)
       (return_spmf s) xs)


proof (prove)
goal (2 subgoals):
 1. 16 \<le> 128 - n \<Longrightarrow>
    length (dropWhile Not (to_bl (w && (mask 16 << n) >> n))) \<le> 16
 2. 16 \<le> 128 - n \<Longrightarrow>
    w && (mask 16 << n) >> n << n = w && (mask 16 << n)


proof (prove)
goal (1 subgoal):
 1. (\<And>n\<^sub>1.
        (\<And>m q.
            n\<^sub>1 \<le> m \<Longrightarrow>
            (Bex (configuration q m) token_succeeds \<longrightarrow>
             q \<in> \<S>\<^sub>R m) \<and>
            (q \<in> \<S>\<^sub>R m \<longrightarrow>
             Ball (configuration q m) token_succeeds)) \<Longrightarrow>
        thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. map (case_rule (\<lambda>m'. Rule (MatchAnd m m'))) (Rule m' a' # rs) =
    Rule (MatchAnd m m') a' #
    map (case_rule (\<lambda>m'. Rule (MatchAnd m m'))) rs


proof (prove)
using this:
  Norm s0\<Colon>\<preceq>(G, L)
  \<lparr>prg = G, cls = accC,
     lcl = L\<rparr>\<turnstile>In1r (Expr e)\<Colon>T
  \<lparr>prg = G, cls = accC,
     lcl =
       L\<rparr>\<turnstile> dom (locals
                                   (snd (Norm
    s0))) \<guillemotright>In1r (Expr e)\<guillemotright> A

goal (1 subgoal):
 1. (\<And>E.
        \<lparr>prg = G, cls = accC,
           lcl =
             L\<rparr>\<turnstile> dom (locals
   (snd (Norm
          s0))) \<guillemotright>In1l e\<guillemotright> E \<Longrightarrow>
        thesis) \<Longrightarrow>
    thesis


proof (prove)
using this:
  x \<in> Extend (set ((\<^bold>\<not> p) # G))
           (mk_finite_char
             (close
               {set G |G. \<not> \<turnstile> imply G \<^bold>\<bottom>}))
           from_nat

goal (1 subgoal):
 1. Kripke pi
     (reach
       (mk_finite_char
         (close
           {set G |G.
            \<not> \<turnstile> imply G
                                 \<^bold>\<bottom>}))), Extend
                   (set ((\<^bold>\<not> p) # G))
                   (mk_finite_char
                     (close
                       {set G |G.
                        \<not> \<turnstile> imply G \<^bold>\<bottom>}))
                   from_nat \<Turnstile> x


proof (prove)
goal (1 subgoal):
 1. x dvd prod_mset A


proof (prove)
goal (1 subgoal):
 1. akra_bazzi_lower x\<^sub>0 x\<^sub>1 k as bs ts f integrable integral g
     g'


proof (prove)
using this:
  unstream (maps_trans f g) (s', None) =
  List.maps
   ((\<lambda>a. case a of (a, b) \<Rightarrow> unstream a b) \<circ> f)
   (unstream g s')
  generator g s = Yield x s'

goal (1 subgoal):
 1. unstream (maps_trans f g) (s, None) =
    List.maps
     ((\<lambda>a. case a of (a, b) \<Rightarrow> unstream a b) \<circ> f)
     (unstream g s)


proof (prove)
goal (1 subgoal):
 1. two_chain_vertical_boundary {rot_circle_cube} -
    {rot_circle_top_edge, rot_circle_bot_edge} =
    {rot_circle_left_edge, rot_circle_right_edge}


proof (prove)
using this:
  \<lparr>prg = G, cls = accC,
     lcl = L\<rparr>\<turnstile>In1l (Cast castT e)\<Colon>T

goal (1 subgoal):
 1. (\<And>eT.
        \<lbrakk>\<lparr>prg = G, cls = accC,
                    lcl = L\<rparr>\<turnstile>e\<Colon>-eT;
         G\<turnstile>eT\<preceq>? castT; T = Inl castT\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (3 subgoals):
 1. \<And>x.
       \<lbrakk>R module N; f \<in> mHom R M N; bijec\<^bsub>M,N\<^esub> f;
        invmfun R M N f \<in> aHom N M; x \<in> carrier N;
        f (invmfun R M N f x) = f \<zero>\<rbrakk>
       \<Longrightarrow> x = \<zero>\<^bsub>N\<^esub>
 2. \<lbrakk>R module N; f \<in> mHom R M N; bijec\<^bsub>M,N\<^esub> f;
     invmfun R M N f \<in> aHom N M\<rbrakk>
    \<Longrightarrow> {\<zero>\<^bsub>N\<^esub>}
                      \<subseteq> ker\<^bsub>N,M\<^esub> invmfun R M N f
 3. \<lbrakk>R module N; f \<in> mHom R M N; bijec\<^bsub>M,N\<^esub> f;
     invmfun R M N f \<in> mHom R N M\<rbrakk>
    \<Longrightarrow> surjec\<^bsub>N,M\<^esub> invmfun R M N f


proof (prove)
goal (1 subgoal):
 1. span_in_category (\<odot>)
     \<lparr>Leg0 =
               \<lbrakk>\<lbrakk>tab\<^sub>0
                                  (local.dom \<mu>)\<rbrakk>\<rbrakk>,
        Leg1 =
          \<lbrakk>\<lbrakk>tab\<^sub>1
                             (local.dom \<mu>)\<rbrakk>\<rbrakk>\<rparr>


proof (prove)
using this:
  \<lbrakk>?A \<subseteq> carrier V; ?v \<in> span ?A\<rbrakk>
  \<Longrightarrow> span ?A = span (?A \<union> {?v})
  gen_set {\<zero>\<^bsub>V\<^esub>}
  \<lbrakk>finite ?A; ?A \<subseteq> carrier V;
   \<And>a.
      \<lbrakk>a \<in> ?A \<rightarrow> carrier K;
       lincomb a ?A = \<zero>\<^bsub>V\<^esub>\<rbrakk>
      \<Longrightarrow> \<forall>v\<in>?A.
                           a v = \<zero>\<^bsub>K\<^esub>\<rbrakk>
  \<Longrightarrow> lin_indpt ?A
  \<zero>\<^bsub>V\<^esub> \<in> span ?U

goal (1 subgoal):
 1. lin_indpt {} \<and> gen_set {} \<and> {} \<subseteq> carrier V


proof (prove)
goal (1 subgoal):
 1. w =
    (\<Sum>x\<in>T. c x *\<^sub>R x) + (\<Sum>x\<in>S - T. c x *\<^sub>R x)


proof (prove)
using this:
  finite A
  \<forall>i\<in>A. finite (B i)

goal (1 subgoal):
 1. finite (sum B A)


proof (prove)
goal (6 subgoals):
 1. \<And>w parent owner_document document_ptr h h' x.
       \<lbrakk>w \<in> Shadow_DOM.adopt_node_locs parent owner_document
                         document_ptr;
        h \<turnstile> w \<rightarrow>\<^sub>h h';
        x |\<in>| object_ptr_kinds h\<rbrakk>
       \<Longrightarrow> x |\<in>| object_ptr_kinds h'
 2. \<And>w parent owner_document document_ptr h h' x.
       \<lbrakk>w \<in> Shadow_DOM.adopt_node_locs parent owner_document
                         document_ptr;
        h \<turnstile> w \<rightarrow>\<^sub>h h';
        x |\<in>| object_ptr_kinds h'\<rbrakk>
       \<Longrightarrow> x |\<in>| object_ptr_kinds h
 3. \<And>w parent owner_document document_ptr h h'.
       \<lbrakk>w \<in> Shadow_DOM.adopt_node_locs parent owner_document
                         document_ptr;
        h \<turnstile> w \<rightarrow>\<^sub>h h';
        ShadowRootClass.type_wf h\<rbrakk>
       \<Longrightarrow> ShadowRootClass.type_wf h'
 4. \<And>w parent owner_document document_ptr h h'.
       \<lbrakk>w \<in> Shadow_DOM.adopt_node_locs parent owner_document
                         document_ptr;
        h \<turnstile> w \<rightarrow>\<^sub>h h';
        ShadowRootClass.type_wf h'\<rbrakk>
       \<Longrightarrow> ShadowRootClass.type_wf h
 5. \<And>h document_ptr child.
       h \<turnstile> ok Shadow_DOM.adopt_node document_ptr
                          child \<Longrightarrow>
       child |\<in>| node_ptr_kinds h
 6. \<And>h owner_document node h' ptr children children' x.
       \<lbrakk>h \<turnstile> Shadow_DOM.adopt_node owner_document node
                \<rightarrow>\<^sub>h h';
        h \<turnstile> Shadow_DOM.get_child_nodes ptr
        \<rightarrow>\<^sub>r children;
        h' \<turnstile> Shadow_DOM.get_child_nodes ptr
        \<rightarrow>\<^sub>r children';
        ShadowRootClass.known_ptrs h; ShadowRootClass.type_wf h;
        x \<in> set children'\<rbrakk>
       \<Longrightarrow> x \<in> set children


proof (prove)
goal (1 subgoal):
 1. loc (map ENV w) = []


proof (prove)
goal (1 subgoal):
 1. hindered \<Gamma> \<Longrightarrow>
    \<exists>\<epsilon>>0. hindered_by \<Gamma> \<epsilon>


proof (prove)
goal (1 subgoal):
 1. \<And>x xa.
       (\<And>x xa. is_cc_lub x xa = (xa = coCallsLub x)) \<Longrightarrow>
       is_cc_lub x xa = x <<| xa


proof (prove)
goal (1 subgoal):
 1. (\<lambda>ai sctni. RETURN (above_sctn_impl ai sctni), above_sctn)
    \<in> appr_rel \<rightarrow>
          \<langle>lv_rel\<rangle>sctn_rel \<rightarrow>
          \<langle>bool_rel\<rangle>nres_rel


proof (prove)
using this:
  llength x = llength a

goal (1 subgoal):
 1. llist_all2 S x a = llist_all2 T y b


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>sorted1 (xs @ (a, a') # ys @ (b, b') # zs @ (c, c') # us);
     x < c\<rbrakk>
    \<Longrightarrow> del_list x
                       (xs @ (a, a') # ys @ (b, b') # zs @ (c, c') # us) =
                      del_list x (xs @ (a, a') # ys @ (b, b') # zs) @
                      (c, c') # us


proof (prove)
goal (1 subgoal):
 1. (\<lambda>x y.
        rel_prod R S (BNF_Def.convol f1 g1 x) (BNF_Def.convol f2 g2 y)) =
    inf (BNF_Def.vimage2p f1 f2 R) (BNF_Def.vimage2p g1 g2 S)


proof (state)
goal (4 subgoals):
 1. list.set (hd \<alpha>s # tl \<alpha>s) \<subseteq> ON
 2. list.set ms \<subseteq> {0<..}
 3. length (tl \<alpha>s) = length ms
 4. sorted_wrt (\<lambda>x y. y < x) (hd \<alpha>s # tl \<alpha>s)


proof (prove)
goal (1 subgoal):
 1. Dynkin_system \<Omega> {A \<in> sigma_sets \<Omega> G. P A}


proof (prove)
goal (1 subgoal):
 1. safe_distance_normal.safe_distance_1r a\<^sub>e v\<^sub>e \<delta> =
    safe_distance_1r a\<^sub>e v\<^sub>e \<delta>


proof (prove)
using this:
  \<forall>t\<in>fst ` set (linearize data_prev').
     t \<le> nt \<and> nt - t < left I
  {tas \<in> ts_tuple_rel (set (linearize data_in)).
   valid_tuple tuple_since tas \<and> ?as = snd tas} =
  {tas \<in> ts_tuple_rel (set (linearize data_in)).
   valid_tuple tuple_since' tas \<and> ?as = snd tas}

goal (1 subgoal):
 1. valid_mmsaux args cur
     (add_new_table_mmsaux args X
       (nt, gc, maskL, maskR, data_prev, data_in, tuple_in, tuple_since))
     (case auxlist of [] \<Rightarrow> [(cur, X)]
      | (t, y) # ts \<Rightarrow>
          if t = cur then (t, y \<union> X) # ts else (cur, X) # auxlist)


proof (state)
this:
  P,t \<turnstile> (xcp, h', frs) -ta-jvm\<rightarrow> \<sigma>'

goal (1 subgoal):
 1. \<exists>ta x' m' s.
       execd_mthr.r_syntax P t (xcp, frs) h' ta x' m' \<and>
       exec_mthr.actions_ok s t ta


proof (prove)
goal (1 subgoal):
 1. rel (s + u) (t + u) = rel s t


proof (prove)
using this:
  inverse_arrows \<mu> (MkArr (Cod \<mu>) (Dom \<mu>) (B.inv (Map \<mu>)))

goal (1 subgoal):
 1. local.iso \<mu>


proof (prove)
goal (11 subgoals):
 1. \<And>x y. dist x y = \<parallel>x - y\<parallel>
 2. \<And>a x y. a *\<^sub>R (x + y) = a *\<^sub>R x + a *\<^sub>R y
 3. \<And>a b x. (a + b) *\<^sub>R x = a *\<^sub>R x + b *\<^sub>R x
 4. \<And>a b x. a *\<^sub>R b *\<^sub>R x = (a * b) *\<^sub>R x
 5. \<And>x. 1 *\<^sub>R x = x
 6. \<And>x. sgn x = inverse (\<parallel>x\<parallel>) *\<^sub>R x
 7. uniformity = (INF e\<in>{0<..}. principal {(x, y). dist x y < e})
 8. \<And>U.
       open U =
       (\<forall>x\<in>U.
           \<forall>\<^sub>F (x', y) in uniformity.
              x' = x \<longrightarrow> y \<in> U)
 9. \<And>x. (\<parallel>x\<parallel> = 0) = (x = 0)
 10. \<And>x y.
        \<parallel>x + y\<parallel>
        \<le> (\<parallel>x\<parallel>) + (\<parallel>y\<parallel>)
A total of 11 subgoals...


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invc t; invh t; invpst t; color t = Black\<rbrakk>
    \<Longrightarrow> invc (paint Black (del k t)) \<and>
                      invh (paint Black (del k t)) \<and>
                      invpst (del k t) \<and>
                      color (paint Black (del k t)) = Black


proof (state)
this:
  [\<theta>]\<nu>' \<down> r

goal (4 subgoals):
 1. \<And>\<alpha> \<nu> \<mu> \<beta> \<omega> \<nu>'.
       \<lbrakk>[[\<alpha>]]\<nu> \<down> \<mu>;
        \<And>\<nu>'.
           \<nu> REP \<nu>' \<Longrightarrow>
           \<exists>\<omega>'.
              (\<mu> REP \<omega>') \<and>
              ([\<alpha>]\<nu>' \<downharpoonleft> \<omega>');
        [[\<beta>]]\<mu> \<down> \<omega>;
        \<And>\<nu>'.
           \<mu> REP \<nu>' \<Longrightarrow>
           \<exists>\<omega>'.
              (\<omega> REP \<omega>') \<and>
              ([\<beta>]\<nu>' \<downharpoonleft> \<omega>');
        \<nu> REP \<nu>'\<rbrakk>
       \<Longrightarrow> \<exists>\<omega>'.
                            (\<omega> REP \<omega>') \<and>
                            ([\<alpha> ;;
                              \<beta>]\<nu>' \<downharpoonleft> \<omega>')
 2. \<And>\<omega> \<nu> x \<theta> \<nu>'.
       \<lbrakk>\<omega> = \<nu>
                (Inr x := snd ([\<theta>]<>\<nu>),
                 Inl x := fst ([\<theta>]<>\<nu>));
        \<nu> REP \<nu>'\<rbrakk>
       \<Longrightarrow> \<exists>\<omega>'.
                            (\<omega> REP \<omega>') \<and>
                            ([x :=
                              \<theta>]\<nu>' \<downharpoonleft> \<omega>')
 3. \<And>\<alpha> \<nu> \<omega> \<beta> \<nu>'.
       \<lbrakk>[[\<alpha>]]\<nu> \<down> \<omega>;
        \<And>\<nu>'.
           \<nu> REP \<nu>' \<Longrightarrow>
           \<exists>\<omega>'.
              (\<omega> REP \<omega>') \<and>
              ([\<alpha>]\<nu>' \<downharpoonleft> \<omega>');
        \<nu> REP \<nu>'\<rbrakk>
       \<Longrightarrow> \<exists>\<omega>'.
                            (\<omega> REP \<omega>') \<and>
                            ([\<alpha> \<union>\<union>
                              \<beta>]\<nu>' \<downharpoonleft> \<omega>')
 4. \<And>\<beta> \<nu> \<omega> \<alpha> \<nu>'.
       \<lbrakk>[[\<beta>]]\<nu> \<down> \<omega>;
        \<And>\<nu>'.
           \<nu> REP \<nu>' \<Longrightarrow>
           \<exists>\<omega>'.
              (\<omega> REP \<omega>') \<and>
              ([\<beta>]\<nu>' \<downharpoonleft> \<omega>');
        \<nu> REP \<nu>'\<rbrakk>
       \<Longrightarrow> \<exists>\<omega>'.
                            (\<omega> REP \<omega>') \<and>
                            ([\<alpha> \<union>\<union>
                              \<beta>]\<nu>' \<downharpoonleft> \<omega>')


proof (prove)
goal (1 subgoal):
 1. map_minsky f g (map_minsky f' g' M) =
    map_minsky (f \<circ> f') (g \<circ> g') M


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>monotone ord (ord_spmf (=)) f;
     cont lub ord lub_spmf (ord_spmf (=)) f\<rbrakk>
    \<Longrightarrow> monotone ord (\<le>) (\<lambda>p. spmf (f p) x)


proof (prove)
goal (1 subgoal):
 1. H\<^sub>L g (L.comp \<nu> \<mu>) = g \<star> \<nu> \<cdot> \<mu>


proof (prove)
goal (1 subgoal):
 1. xs \<noteq> [] \<Longrightarrow>
    braun_list t xs =
    (\<exists>l x r.
        t = \<langle>l, x, r\<rangle> \<and>
        x = hd xs \<and>
        braun_list l (take_nths 1 1 xs) \<and>
        braun_list r (take_nths 2 1 xs))


proof (prove)
using this:
  (P'', Q') \<in> Rel\<inverse>

goal (1 subgoal):
 1. (Q', P'') \<in> Rel


proof (prove)
goal (1 subgoal):
 1. (F g \<star>\<^sub>D \<r>\<^sub>D[F f]) \<cdot>\<^sub>D
    \<a>\<^sub>D[F g, F f, F.map\<^sub>0 (src\<^sub>C f)] =
    \<r>\<^sub>D[F g \<star>\<^sub>D F f]


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(n_, dom_) \<in> {(n, dom). dom = set [0..<n]};
     dom_
     \<in> {dom.
            set_mset (dom_m A) \<subseteq> dom \<and> finite dom}\<rbrakk>
    \<Longrightarrow> RETURN (2 ^ 64 \<le> n_) \<le> SPEC (\<lambda>_. True)


proof (prove)
goal (1 subgoal):
 1. V \<noteq> {} \<Longrightarrow>
    (if V\<^bsub>T\<^esub> = {} then 0 else max_bag_card - 1) < card V


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Ball (set ws) Lyndon \<and>
             linorder.sorted lexordp_eq (rev ws);
     i \<le> j; j < \<^bold>|ws\<^bold>|\<rbrakk>
    \<Longrightarrow> ws ! j \<le>lex ws ! i


proof (prove)
goal (1 subgoal):
 1. rec_inseparable
     {p. 0 \<in> nat_to_ce_set p \<and> 1 \<notin> nat_to_ce_set p}
     {p. 0 \<notin> nat_to_ce_set p \<and> 1 \<in> nat_to_ce_set p}


proof (prove)
using this:
  L.in_hom \<nu> (L.cod \<mu>) (L.cod \<nu>)
  L.hom ?a ?b = hom ?a ?b \<inter> Collect (left a)

goal (1 subgoal):
 1. \<guillemotleft>\<nu> : L.cod
                             \<mu> \<rightarrow> L.cod
            \<nu>\<guillemotright> \<and>
    arr \<nu> \<and> \<nu> \<in> Collect (left a)


proof (prove)
goal (1 subgoal):
 1. total_quasi_ordered_set A r = total_quasi_ordered_set A r'


proof (prove)
goal (1 subgoal):
 1. pprefix_closed P


proof (prove)
goal (1 subgoal):
 1. Policy.sp_spec_subj_obj (Step.partition tid) (PAGE page) READ


proof (prove)
goal (1 subgoal):
 1. w =
    restrict0 diff_fun_space
     (\<lambda>g. restrict0 sub.diff_fun_space v (restrict0 sub.carrier g))


proof (prove)
using this:
  P \<turnstile> C sees M, b :  Ts\<rightarrow>T = m in D
  P \<turnstile> C' \<preceq>\<^sup>* C
  wf_prog wf_md P
  \<exists>D' Ts' T' m'.
     P \<turnstile> C' sees M, b :  Ts'\<rightarrow>T' = m' in D' \<and>
     P \<turnstile> Ts [\<le>] Ts' \<and> P \<turnstile> T' \<le> T

goal (1 subgoal):
 1. \<exists>D' Ts' T' m'.
       P \<turnstile> C' sees M, b :  Ts'\<rightarrow>T' = m' in D' \<and>
       P \<turnstile> Ts [\<le>] Ts' \<and>
       P \<turnstile> T' \<le> T \<and>
       P \<turnstile> C' \<preceq>\<^sup>* D' \<and>
       is_type P T' \<and>
       (\<forall>T\<in>set Ts'. is_type P T) \<and>
       wf_md P D' (M, b, Ts', T', m')


proof (prove)
using this:
  compP\<^sub>1
   P \<turnstile>\<^sub>1 \<langle>compE\<^sub>1 Vs e\<^sub>1,
                           (h, ls, sh)\<rangle> \<Rightarrow>
                          \<langle>fin\<^sub>1 null,
                           (h\<^sub>1, ls\<^sub>1,
                            sh\<^sub>1)\<rangle> \<and>
  l\<^sub>1 \<subseteq>\<^sub>m [Vs [\<mapsto>] ls\<^sub>1]
  length ls = length ls\<^sub>1
  compP\<^sub>1
   P \<turnstile>\<^sub>1 \<langle>compE\<^sub>1 Vs e\<^sub>2,
                           (h\<^sub>1, ls\<^sub>1,
                            sh\<^sub>1)\<rangle> \<Rightarrow>
                          \<langle>fin\<^sub>1 (Val v),
                           (h\<^sub>2, ls\<^sub>2,
                            sh\<^sub>2)\<rangle> \<and>
  l\<^sub>2 \<subseteq>\<^sub>m [Vs [\<mapsto>] ls\<^sub>2]
  P \<turnstile> \<langle>e\<^sub>1,(h, l, sh)\<rangle> \<Rightarrow>
                 \<langle>null,(h\<^sub>1, l\<^sub>1, sh\<^sub>1)\<rangle>
  \<lbrakk>fv e\<^sub>1 \<subseteq> set ?Vs;
   l \<subseteq>\<^sub>m [?Vs [\<mapsto>] ?ls];
   length ?Vs + max_vars e\<^sub>1 \<le> length ?ls\<rbrakk>
  \<Longrightarrow> \<exists>ls'.
                       compP\<^sub>1
                        P \<turnstile>\<^sub>1 \<langle>compE\<^sub>1 ?Vs
                   e\<^sub>1,
          (h, ?ls, sh)\<rangle> \<Rightarrow>
         \<langle>fin\<^sub>1 null,
          (h\<^sub>1, ls', sh\<^sub>1)\<rangle> \<and>
                       l\<^sub>1 \<subseteq>\<^sub>m [?Vs [\<mapsto>] ls']
  P \<turnstile> \<langle>e\<^sub>2,
                  (h\<^sub>1, l\<^sub>1, sh\<^sub>1)\<rangle> \<Rightarrow>
                 \<langle>Val v,(h\<^sub>2, l\<^sub>2, sh\<^sub>2)\<rangle>
  \<lbrakk>fv e\<^sub>2 \<subseteq> set ?Vs;
   l\<^sub>1 \<subseteq>\<^sub>m [?Vs [\<mapsto>] ?ls];
   length ?Vs + max_vars e\<^sub>2 \<le> length ?ls\<rbrakk>
  \<Longrightarrow> \<exists>ls'.
                       compP\<^sub>1
                        P \<turnstile>\<^sub>1 \<langle>compE\<^sub>1 ?Vs
                   e\<^sub>2,
          (h\<^sub>1, ?ls, sh\<^sub>1)\<rangle> \<Rightarrow>
         \<langle>fin\<^sub>1 (Val v),
          (h\<^sub>2, ls', sh\<^sub>2)\<rangle> \<and>
                       l\<^sub>2 \<subseteq>\<^sub>m [?Vs [\<mapsto>] ls']
  fv (e\<^sub>1\<bullet>F{D} := e\<^sub>2) \<subseteq> set Vs
  l \<subseteq>\<^sub>m [Vs [\<mapsto>] ls]
  length Vs + max_vars (e\<^sub>1\<bullet>F{D} := e\<^sub>2) \<le> length ls

goal (1 subgoal):
 1. \<exists>ls'.
       compP\<^sub>1
        P \<turnstile>\<^sub>1 \<langle>compE\<^sub>1 Vs
   (e\<^sub>1\<bullet>F{D} := e\<^sub>2),
                                (h, ls, sh)\<rangle> \<Rightarrow>
                               \<langle>fin\<^sub>1 (THROW NullPointer),
                                (h\<^sub>2, ls', sh\<^sub>2)\<rangle> \<and>
       l\<^sub>2 \<subseteq>\<^sub>m [Vs [\<mapsto>] ls']


proof (prove)
using this:
  \<forall>i.
     dterm_sem I (if i = vid1 then \<theta>' else Const 0) (a, b) =
     dterm_sem I (if i = vid1 then \<theta> else Const 0) (a, b)

goal (1 subgoal):
 1. Functions I var
     (\<chi>i.
         dterm_sem I (if i = vid1 then \<theta> else Const 0) (a, b)) =
    Functions I var
     (\<chi>i. dterm_sem I (if i = vid1 then \<theta>' else Const 0) (a, b))


proof (prove)
goal (1 subgoal):
 1. \<turnstile>\<^bsub>\<C>\<^esub> c \<Longrightarrow> Strongly_Secure [c]


proof (prove)
using this:
  Cop_S.inverse_arrows
   (Cop_S.MkArr (\<Phi>'.Y a) (\<Phi>'.Y a') \<Phi>\<Psi>'.map)
   (Cop_S.MkArr (\<Phi>'.Y a') (\<Phi>'.Y a) \<Phi>'\<Psi>.map)

goal (1 subgoal):
 1. Cop_S.iso (Cop_S.MkArr (\<Phi>'.Y a) (\<Phi>'.Y a') \<Phi>\<Psi>'.map)


proof (prove)
goal (1 subgoal):
 1. \<And>s.
       s \<in> UNIV1 \<Longrightarrow>
       Timess (pderivs s r1) r2 \<union> pderivs_lang (PSuf s) r2
       \<subseteq> Timess (pderivs_lang UNIV1 r1) r2 \<union>
                   pderivs_lang UNIV1 r2


proof (prove)
goal (1 subgoal):
 1. (|vars xs| <o |UNIV| \<or> finite (vars xs)) \<and>
    (|\<Union> (range terms)| <o |UNIV| \<or>
     finite (\<Union> (range terms))) \<and>
    Ball (\<Union> (range terms)) good \<and>
    (|\<Union>xs s. abs (xs, s)| <o |UNIV| \<or>
     finite (\<Union>xs s. abs (xs, s))) \<and>
    Ball (\<Union>xs s. abs (xs, s)) goodAbs \<and>
    (|envs| <o |UNIV| \<or> finite envs) \<and> Ball envs goodEnv


proof (prove)
goal (1 subgoal):
 1. op_dghm \<FF> :
    op_dg
     \<AA> \<mapsto>\<mapsto>\<^sub>D\<^sub>G\<^sub>.\<^sub>t\<^sub>m\<^bsub>\<alpha>\<^esub> op_dg
                   \<BB>


proof (prove)
using this:
  system_step q sh' sh
  atCs (cPGM (GST sh p)) \<in> {{}}

goal (1 subgoal):
 1. atCs (cPGM (GST sh' p)) \<in> {{}}


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>group_hom (relative_homology_group p X S)
              (homology_group (p - 1) (subtopology X S))
              (hom_boundary p X S) \<and>
             hom_induced (p - 1) (subtopology X S) {} X {} id
             \<in> hom (homology_group (p - 1) (subtopology X S))
                    (homology_group (p - 1) X) \<and>
             (\<forall>x.
                 (x \<in> carrier
                           (homology_group (p - 1) (subtopology X S)) \<and>
                  (\<forall>xa.
                      (xa \<in> hom_induced (p - 1) (subtopology X S) {} X
                                 {} id x) =
                      (xa \<in> \<one>\<^bsub>homology_group (p - 1) X\<^esub>))) =
                 (x \<in> hom_boundary p X S `
                          carrier (relative_homology_group p X S)));
     hom_boundary p X S C
     \<in> carrier (homology_group (p - 1) (subtopology X S))\<rbrakk>
    \<Longrightarrow> hom_boundary p X S C
                      \<in> hom_boundary p X S `
                            carrier (relative_homology_group p X S)


proof (prove)
using this:
  ?\<theta> closes (a, \<sigma>) # \<Gamma> \<Longrightarrow>
  ?\<theta><t> \<in> RED \<tau>
  a \<sharp> \<Gamma>
  a \<sharp> \<theta>
  \<theta> closes \<Gamma>
  ?a \<sharp> ?\<Gamma> \<Longrightarrow>
  \<nexists>\<tau>. (?a, \<tau>) \<in> set ?\<Gamma>

goal (1 subgoal):
 1. \<forall>s\<in>RED \<sigma>. ((a, s) # \<theta>)<t> \<in> RED \<tau>


proof (prove)
goal (1 subgoal):
 1. natural_transformation (\<cdot>\<^sub>C) (\<cdot>\<^sub>B) F'
     (FG.GF.map \<circ> F') (FG.\<eta> \<circ> F')


proof (prove)
goal (1 subgoal):
 1. dist (center + radius *\<^sub>R of_radiant \<alpha>)
     (center + radius *\<^sub>R of_radiant \<beta>) =
    sqrt
     (radius\<^sup>2 *
      ((cos \<alpha> - cos \<beta>)\<^sup>2 +
       (sin \<alpha> - sin \<beta>)\<^sup>2))


proof (state)
this:
  prefix as_1 as
  exec_plan s as_1 = last slist_1
  length slist_1 = Suc (length as_1)

goal (1 subgoal):
 1. \<exists>as1 as2 as3.
       as1 @ as2 @ as3 = as \<and>
       exec_plan s (as1 @ as2) = exec_plan s as1 \<and> as2 \<noteq> []


proof (prove)
goal (4 subgoals):
 1. \<And>x1 x2 x y.
       atom y \<sharp> x1 EQ x2 \<Longrightarrow>
       (x \<leftrightarrow> y) \<bullet> x1 EQ x2 = (x1 EQ x2)(x::=Var y)
 2. \<And>x1 x2 x y.
       \<lbrakk>\<And>b ba.
                   atom ba \<sharp> x1 \<Longrightarrow>
                   (b \<leftrightarrow> ba) \<bullet> x1 = x1(b::=Var ba);
        \<And>b ba.
           atom ba \<sharp> x2 \<Longrightarrow>
           (b \<leftrightarrow> ba) \<bullet> x2 = x2(b::=Var ba);
        atom y \<sharp> x1 OR x2\<rbrakk>
       \<Longrightarrow> (x \<leftrightarrow> y) \<bullet> x1 OR x2 =
                         (x1 OR x2)(x::=Var y)
 3. \<And>x xa y.
       \<lbrakk>\<And>b ba.
                   atom ba \<sharp> x \<Longrightarrow>
                   (b \<leftrightarrow> ba) \<bullet> x = x(b::=Var ba);
        atom y \<sharp> neg x\<rbrakk>
       \<Longrightarrow> (xa \<leftrightarrow> y) \<bullet> neg x =
                         (neg x)(xa::=Var y)
 4. \<And>x1 x2 x y.
       \<lbrakk>atom x1 \<sharp> x; atom x1 \<sharp> y;
        \<And>b ba.
           atom ba \<sharp> x2 \<Longrightarrow>
           (b \<leftrightarrow> ba) \<bullet> x2 = x2(b::=Var ba);
        atom y \<sharp> exi x1 x2\<rbrakk>
       \<Longrightarrow> (x \<leftrightarrow> y) \<bullet> exi x1 x2 =
                         (exi x1 x2)(x::=Var y)


proof (prove)
goal (1 subgoal):
 1. class.dioid_one_zero (\<oplus>) (\<otimes>) \<epsilon> \<delta>
     mat_less_eq mat_less


proof (prove)
goal (1 subgoal):
 1. (as, x) \<approx>lst (=) supp p (as', x')


proof (prove)
goal (1 subgoal):
 1. ord_option ord (lub_option lub Y) y


proof (prove)
using this:
  lookup (MP_oalist ys) v = (0::'b)
  lookup (MP_oalist xs) v \<noteq> (0::'b)
  lt_of_nat_term_order cmp_term v ?u \<Longrightarrow>
  lookup (MP_oalist ys) ?u = lookup (MP_oalist xs) ?u

goal (1 subgoal):
 1. ord_strict_p (MP_oalist ys) (MP_oalist xs)


proof (prove)
goal (1 subgoal):
 1. run_gpv hash.oracle game0 Map.empty =
    map_spmf fst
     (sample_uniform (order \<G>) \<bind>
      (\<lambda>x. sample_uniform (order \<G>) \<bind> game1 x))


proof (prove)
goal (1 subgoal):
 1. (\<And>f'.
        \<lbrakk>continuous_on U f'; f' ` U \<subseteq> C;
         \<And>x.
            x \<in> T \<Longrightarrow> f' x = (g \<circ> f) x\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (state)
this:
  aS\<^bsub>T\<^esub> = iS\<^bsub>CI T\<^esub>

goal (1 subgoal):
 1. \<phi> \<in> Axioms.Theory T


proof (prove)
goal (2 subgoals):
 1. \<And>i c\<^sub>C mds\<^sub>C mem\<^sub>C mem\<^sub>C'.
       \<lbrakk>i < length cms; cms\<^sub>C ! i = (c\<^sub>C, mds\<^sub>C);
        conc.low_mds_eq mds\<^sub>C mem\<^sub>C mem\<^sub>C'\<rbrakk>
       \<Longrightarrow> (\<langle>fst (cms\<^sub>A !
  i), snd (cms\<^sub>A ! i), mem\<^sub>A_of mem\<^sub>C\<rangle>\<^sub>A,
                          \<langle>fst (cms\<^sub>A !
  i), snd (cms\<^sub>A ! i), mem\<^sub>A_of mem\<^sub>C'\<rangle>\<^sub>A)
                         \<in> \<R>\<^sub>A_rel (cms ! i) \<and>
                         (\<langle>c\<^sub>C, mds\<^sub>C, mem\<^sub>C\<rangle>\<^sub>C,
                          \<langle>c\<^sub>C, mds\<^sub>C, mem\<^sub>C'\<rangle>\<^sub>C)
                         \<in> P_rel (cms ! i)
 2. \<forall>mem.
       True \<longrightarrow> conc.sound_mode_use (cms\<^sub>C, mem)


proof (prove)
goal (1 subgoal):
 1. term_variants_pred P (Fun f (S @ t # T)) (Fun g (S @ s # T))


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>H \<turnstile> t EQ t'; H \<turnstile> u EQ u'\<rbrakk>
    \<Longrightarrow> H \<turnstile> pls t u EQ pls t' u'


proof (prove)
goal (1 subgoal):
 1. A' \<inter># remove1_mset a (remdups_mset Aa) = A' \<inter># Aa


proof (state)
this:
  space (K x) \<noteq> {}

goal (3 subgoals):
 1. sets
     (K x \<bind>
      (\<lambda>y.
          distr (lim_sequence y) (Pi\<^sub>M UNIV (\<lambda>j. M))
           (case_nat y))) =
    sets (Pi\<^sub>M UNIV (\<lambda>j. M))
 2. \<And>A J.
       \<lbrakk>finite J; J \<subseteq> UNIV;
        \<And>i. i \<in> J \<Longrightarrow> A i \<in> sets M\<rbrakk>
       \<Longrightarrow> emeasure (lim_sequence x)
                          (prod_emb UNIV (\<lambda>j. M) J
                            (Pi\<^sub>E J A)) =
                         emeasure
                          (K x \<bind>
                           (\<lambda>y.
                               distr (lim_sequence y)
                                (Pi\<^sub>M UNIV (\<lambda>j. M))
                                (case_nat y)))
                          (prod_emb UNIV (\<lambda>j. M) J (Pi\<^sub>E J A))
 3. finite_measure (lim_sequence x)


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>single_valued R; x \<in> Domain R\<rbrakk>
    \<Longrightarrow> (x, construct_fun_from_rel R x) \<in> R


proof (prove)
goal (1 subgoal):
 1. B \<otimes>\<^bsub>relative_homology_group p X S\<^esub>
    inv\<^bsub>relative_homology_group p X S\<^esub> hom_induced p X T X S
                id D =
    hom_induced p X T X S id (hom_induced p X {} X T id W) \<Longrightarrow>
    B =
    hom_induced p X T X S id
     D \<otimes>\<^bsub>relative_homology_group p X S\<^esub>
    hom_induced p X T X S id (hom_induced p X {} X T id W)


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<forall>x\<in>cnf. sat_clause \<sigma> x; x \<in> cnf;
     (l\<^sub>1, l\<^sub>2) \<in> edges_of_clause x;
     sat_lit \<sigma> l\<^sub>1\<rbrakk>
    \<Longrightarrow> sat_lit \<sigma> l\<^sub>2


proof (prove)
using this:
  ldistinct (lmap f xs)

goal (1 subgoal):
 1. ldistinct xs


proof (prove)
goal (1 subgoal):
 1. (mat_rel R ===> mat_rel R ===> (=)) (=) (=)


proof (prove)
goal (1 subgoal):
 1. \<And>s t ss tt n na.
       \<lbrakk>secure c;
        \<forall>s ss.
            s \<approx> ss  \<longrightarrow> evalB b s = evalB b ss;
         s \<approx> t ;  s , While b c \<rightarrow>\<^sub>n  ss ;
         t , While b c \<rightarrow>\<^sub>na  tt \<rbrakk>
       \<Longrightarrow>  ss \<approx> tt


proof (prove)
using this:
  ?m \<le> ?n \<Longrightarrow> f ?n \<le> f ?m

goal (1 subgoal):
 1. f \<longlonglongrightarrow> Inf (range f)


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>left_inverse_matrix A Y; right_inverse_matrix A X\<rbrakk>
    \<Longrightarrow> Y * A * X = X


proof (state)
this:
  even n

goal (2 subgoals):
 1. real_of_float x = 0 \<Longrightarrow>
    cos (real_of_float x)
    \<in> {real_of_float
            (lb_sin_cos_aux prec (get_even n) 1 1
              (x *
               x))..real_of_float
                     (ub_sin_cos_aux prec (get_odd n) 1 1 (x * x))}
 2. real_of_float x \<noteq> 0 \<Longrightarrow>
    cos (real_of_float x)
    \<in> {real_of_float
            (lb_sin_cos_aux prec (get_even n) 1 1
              (x *
               x))..real_of_float
                     (ub_sin_cos_aux prec (get_odd n) 1 1 (x * x))}


proof (prove)
using this:
  winning_path p (ldropn n P)
  ltl (ldropn n P) = ldropn (Suc n) P
  \<not> lnull (ldropn n P)
  \<lbrakk>winning_path p (ldropn n P); \<not> lnull (ldropn n P);
   \<not> lnull (ltl (ldropn n P))\<rbrakk>
  \<Longrightarrow> winning_path p (ltl (ldropn n P))
  enat (Suc n) < llength P

goal (1 subgoal):
 1. winning_path p (ldropn (Suc n) P)


proof (prove)
goal (1 subgoal):
 1. poly_mult (local.monom a n) p =
    local.normalize (map ((\<otimes>) a) p @ replicate n \<zero>)


proof (prove)
using this:
  arr f
  x \<in> Dom f
  arr ?f \<Longrightarrow> ide (cod ?f)
  arr f \<Longrightarrow>
  Fun f \<in> extensional (Dom f) \<inter> (Dom f \<rightarrow> Cod f)
  ide ?a \<Longrightarrow> local.set ?a \<subseteq> Univ

goal (1 subgoal):
 1. Fun f x \<in> Univ


proof (prove)
goal (1 subgoal):
 1. \<And>B.
       \<lbrakk>x \<in> roofed_gen G B S; path G x p y; y \<in> B\<rbrakk>
       \<Longrightarrow> (\<exists>z\<in>set p. z \<in> S) \<or> x \<in> S


proof (chain)
picking this:
  2 ^ (k + 1) = 2 *n 2 ^ k


proof (prove)
using this:
  0 + int (card X) - int j - 1 gchoose (card X - j - 1) =
  0 - int (poly_deg f) + int (card X) - int j - 1 gchoose (card X - j - 1) +
  (0 - int (poly_deg f) + int (card X) - int j gchoose (card X - j)) +
  (0 + int (card X) - int j gchoose (card X - j)) -
  2 -
  (\<Sum>i = Suc j..card X.
      0 - int (aa i) + int i - int j - 1 gchoose (i - j) +
      (0 - int (bb i) + int i - int j - 1 gchoose (i - j)))

goal (1 subgoal):
 1. 1 =
    (- 1) ^ (card X - Suc j) *
    (int (poly_deg f) - 1 gchoose (card X - Suc j)) +
    (- 1) ^ (card X - j) * (int (poly_deg f) - 1 gchoose (card X - j)) -
    1 -
    (\<Sum>i = Suc j..card X.
        (- 1) ^ (i - j) *
        (int (aa i) gchoose (i - j) + (int (bb i) gchoose (i - j))))


proof (prove)
goal (2 subgoals):
 1. uint asi = 15 \<Longrightarrow>
    fst (case read_data_cache s addr of None \<Rightarrow> (None, s)
         | Some w \<Rightarrow> (Some w, s)) =
    fst (case read_data_cache
               (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
                    dwrite := new_dwrite, state_var := new_state_var,
                    traps := new_traps, undef := new_undef\<rparr>)
               addr of
         None \<Rightarrow>
           (None, s
            \<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
               dwrite := new_dwrite, state_var := new_state_var,
               traps := new_traps, undef := new_undef\<rparr>)
         | Some w \<Rightarrow>
             (Some w, s
              \<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
                 dwrite := new_dwrite, state_var := new_state_var,
                 traps := new_traps, undef := new_undef\<rparr>))
 2. \<lbrakk>uint asi \<noteq> 1; uint asi \<noteq> 2;
     uint asi \<notin> {8, 9}; uint asi \<notin> {10, 11};
     uint asi \<noteq> 13; uint asi \<noteq> 15\<rbrakk>
    \<Longrightarrow> (uint addr = 12 \<longrightarrow>
                       fst (let asi_int = uint asi
                            in if asi_int = 1
                               then let r1 =
    load_word_mem s addr (word_of_int 8)
                                    in if r1 = None
 then let r2 = load_word_mem s addr (word_of_int 10)
      in if r2 = None then (None, s) else (r2, s)
 else (r1, s)
                               else if asi_int = 2
                                    then (Some (sys_reg_val DCCR s), s)
                                    else if asi_int \<in> {8, 9}
   then let ccr_val = sys_reg s CCR
        in if ccr_val AND 1 \<noteq> 0
           then Let (load_word_mem s addr asi)
                 (case_option (None, s)
                   (\<lambda>w. (Some w, add_instr_cache s addr w 15)))
           else (load_word_mem s addr asi, s)
   else if asi_int \<in> {10, 11}
        then let ccr_val = sys_reg s CCR
             in if ccr_val AND 1 \<noteq> 0
                then Let (load_word_mem s addr asi)
                      (case_option (None, s)
                        (\<lambda>w. (Some w, add_data_cache s addr w 15)))
                else (load_word_mem s addr asi, s)
        else if asi_int = 13
             then Let (read_instr_cache s addr)
                   (case_option (None, s) (\<lambda>w. (Some w, s)))
             else if asi_int = 15
                  then Let (read_data_cache s addr)
                        (case_option (None, s) (\<lambda>w. (Some w, s)))
                  else if asi_int \<in> {16, 17} then (None, s)
                       else if asi_int \<in> {20, 21} then (None, s)
                            else if asi_int = 24 then (None, s)
                                 else if asi_int = 25
then (mmu_reg_val (mmu s) addr, s)
else if asi_int = 28 then (mem_val_w32 asi (ucast addr) s, s)
     else if asi_int = 29 then (None, s) else (None, s)) =
                       fst (let asi_int = uint asi
                            in if asi_int = 1
                               then let r1 =
    load_word_mem
     (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
          dwrite := new_dwrite, state_var := new_state_var,
          traps := new_traps, undef := new_undef\<rparr>)
     addr (word_of_int 8)
                                    in if r1 = None
 then let r2 = load_word_mem
                (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
                     dwrite := new_dwrite, state_var := new_state_var,
                     traps := new_traps, undef := new_undef\<rparr>)
                addr (word_of_int 10)
      in if r2 = None
         then (None, s
               \<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
                  dwrite := new_dwrite, state_var := new_state_var,
                  traps := new_traps, undef := new_undef\<rparr>)
         else (r2, s
               \<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
                  dwrite := new_dwrite, state_var := new_state_var,
                  traps := new_traps, undef := new_undef\<rparr>)
 else (r1, s
       \<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
          dwrite := new_dwrite, state_var := new_state_var,
          traps := new_traps, undef := new_undef\<rparr>)
                               else if asi_int = 2
                                    then (Some
     (sys_reg_val DCCR
       (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
            dwrite := new_dwrite, state_var := new_state_var,
            traps := new_traps, undef := new_undef\<rparr>)),
    s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
        dwrite := new_dwrite, state_var := new_state_var,
        traps := new_traps, undef := new_undef\<rparr>)
                                    else if asi_int \<in> {8, 9}
   then let ccr_val =
              sys_reg
               (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
                    dwrite := new_dwrite, state_var := new_state_var,
                    traps := new_traps, undef := new_undef\<rparr>)
               CCR
        in if ccr_val AND 1 \<noteq> 0
           then Let (load_word_mem
                      (s\<lparr>cpu_reg := new_cpu_reg,
                           user_reg := new_user_reg, dwrite := new_dwrite,
                           state_var := new_state_var, traps := new_traps,
                           undef := new_undef\<rparr>)
                      addr asi)
                 (case_option
                   (None, s
                    \<lparr>cpu_reg := new_cpu_reg,
                       user_reg := new_user_reg, dwrite := new_dwrite,
                       state_var := new_state_var, traps := new_traps,
                       undef := new_undef\<rparr>)
                   (\<lambda>w.
                       (Some w,
                        add_instr_cache
                         (s\<lparr>cpu_reg := new_cpu_reg,
                              user_reg := new_user_reg,
                              dwrite := new_dwrite,
                              state_var := new_state_var,
                              traps := new_traps,
                              undef := new_undef\<rparr>)
                         addr w 15)))
           else (load_word_mem
                  (s\<lparr>cpu_reg := new_cpu_reg,
                       user_reg := new_user_reg, dwrite := new_dwrite,
                       state_var := new_state_var, traps := new_traps,
                       undef := new_undef\<rparr>)
                  addr asi,
                 s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
                     dwrite := new_dwrite, state_var := new_state_var,
                     traps := new_traps, undef := new_undef\<rparr>)
   else if asi_int \<in> {10, 11}
        then let ccr_val =
                   sys_reg
                    (s\<lparr>cpu_reg := new_cpu_reg,
                         user_reg := new_user_reg, dwrite := new_dwrite,
                         state_var := new_state_var, traps := new_traps,
                         undef := new_undef\<rparr>)
                    CCR
             in if ccr_val AND 1 \<noteq> 0
                then Let (load_word_mem
                           (s\<lparr>cpu_reg := new_cpu_reg,
                                user_reg := new_user_reg,
                                dwrite := new_dwrite,
                                state_var := new_state_var,
                                traps := new_traps,
                                undef := new_undef\<rparr>)
                           addr asi)
                      (case_option
                        (None, s
                         \<lparr>cpu_reg := new_cpu_reg,
                            user_reg := new_user_reg, dwrite := new_dwrite,
                            state_var := new_state_var, traps := new_traps,
                            undef := new_undef\<rparr>)
                        (\<lambda>w.
                            (Some w,
                             add_data_cache
                              (s\<lparr>cpu_reg := new_cpu_reg,
                                   user_reg := new_user_reg,
                                   dwrite := new_dwrite,
                                   state_var := new_state_var,
                                   traps := new_traps,
                                   undef := new_undef\<rparr>)
                              addr w 15)))
                else (load_word_mem
                       (s\<lparr>cpu_reg := new_cpu_reg,
                            user_reg := new_user_reg, dwrite := new_dwrite,
                            state_var := new_state_var, traps := new_traps,
                            undef := new_undef\<rparr>)
                       addr asi,
                      s\<lparr>cpu_reg := new_cpu_reg,
                          user_reg := new_user_reg, dwrite := new_dwrite,
                          state_var := new_state_var, traps := new_traps,
                          undef := new_undef\<rparr>)
        else if asi_int = 13
             then Let (read_instr_cache
                        (s\<lparr>cpu_reg := new_cpu_reg,
                             user_reg := new_user_reg, dwrite := new_dwrite,
                             state_var := new_state_var, traps := new_traps,
                             undef := new_undef\<rparr>)
                        addr)
                   (case_option
                     (None, s
                      \<lparr>cpu_reg := new_cpu_reg,
                         user_reg := new_user_reg, dwrite := new_dwrite,
                         state_var := new_state_var, traps := new_traps,
                         undef := new_undef\<rparr>)
                     (\<lambda>w.
                         (Some w, s
                          \<lparr>cpu_reg := new_cpu_reg,
                             user_reg := new_user_reg, dwrite := new_dwrite,
                             state_var := new_state_var, traps := new_traps,
                             undef := new_undef\<rparr>)))
             else if asi_int = 15
                  then Let (read_data_cache
                             (s\<lparr>cpu_reg := new_cpu_reg,
                                  user_reg := new_user_reg,
                                  dwrite := new_dwrite,
                                  state_var := new_state_var,
                                  traps := new_traps,
                                  undef := new_undef\<rparr>)
                             addr)
                        (case_option
                          (None, s
                           \<lparr>cpu_reg := new_cpu_reg,
                              user_reg := new_user_reg,
                              dwrite := new_dwrite,
                              state_var := new_state_var,
                              traps := new_traps,
                              undef := new_undef\<rparr>)
                          (\<lambda>w.
                              (Some w, s
                               \<lparr>cpu_reg := new_cpu_reg,
                                  user_reg := new_user_reg,
                                  dwrite := new_dwrite,
                                  state_var := new_state_var,
                                  traps := new_traps,
                                  undef := new_undef\<rparr>)))
                  else if asi_int \<in> {16, 17}
                       then (None, s
                             \<lparr>cpu_reg := new_cpu_reg,
                                user_reg := new_user_reg,
                                dwrite := new_dwrite,
                                state_var := new_state_var,
                                traps := new_traps,
                                undef := new_undef\<rparr>)
                       else if asi_int \<in> {20, 21}
                            then (None, s
                                  \<lparr>cpu_reg := new_cpu_reg,
                                     user_reg := new_user_reg,
                                     dwrite := new_dwrite,
                                     state_var := new_state_var,
                                     traps := new_traps,
                                     undef := new_undef\<rparr>)
                            else if asi_int = 24
                                 then (None, s
 \<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
    dwrite := new_dwrite, state_var := new_state_var, traps := new_traps,
    undef := new_undef\<rparr>)
                                 else if asi_int = 25
then (mmu_reg_val
       (mmu (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
                 dwrite := new_dwrite, state_var := new_state_var,
                 traps := new_traps, undef := new_undef\<rparr>))
       addr,
      s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
          dwrite := new_dwrite, state_var := new_state_var,
          traps := new_traps, undef := new_undef\<rparr>)
else if asi_int = 28
     then (mem_val_w32 asi (ucast addr)
            (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
                 dwrite := new_dwrite, state_var := new_state_var,
                 traps := new_traps, undef := new_undef\<rparr>),
           s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
               dwrite := new_dwrite, state_var := new_state_var,
               traps := new_traps, undef := new_undef\<rparr>)
     else if asi_int = 29
          then (None, s
                \<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
                   dwrite := new_dwrite, state_var := new_state_var,
                   traps := new_traps, undef := new_undef\<rparr>)
          else (None, s
                \<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
                   dwrite := new_dwrite, state_var := new_state_var,
                   traps := new_traps, undef := new_undef\<rparr>))) \<and>
                      (uint addr \<noteq> 12 \<longrightarrow>
                       (uint addr = 8 \<longrightarrow>
                        fst (let asi_int = uint asi
                             in if asi_int = 1
                                then let r1 =
     load_word_mem s addr (word_of_int 8)
                                     in if r1 = None
  then let r2 = load_word_mem s addr (word_of_int 10)
       in if r2 = None then (None, s) else (r2, s)
  else (r1, s)
                                else if asi_int = 2
                                     then (Some (sys_reg_val ICCR s), s)
                                     else if asi_int \<in> {8, 9}
    then let ccr_val = sys_reg s CCR
         in if ccr_val AND 1 \<noteq> 0
            then Let (load_word_mem s addr asi)
                  (case_option (None, s)
                    (\<lambda>w. (Some w, add_instr_cache s addr w 15)))
            else (load_word_mem s addr asi, s)
    else if asi_int \<in> {10, 11}
         then let ccr_val = sys_reg s CCR
              in if ccr_val AND 1 \<noteq> 0
                 then Let (load_word_mem s addr asi)
                       (case_option (None, s)
                         (\<lambda>w. (Some w, add_data_cache s addr w 15)))
                 else (load_word_mem s addr asi, s)
         else if asi_int = 13
              then Let (read_instr_cache s addr)
                    (case_option (None, s) (\<lambda>w. (Some w, s)))
              else if asi_int = 15
                   then Let (read_data_cache s addr)
                         (case_option (None, s) (\<lambda>w. (Some w, s)))
                   else if asi_int \<in> {16, 17} then (None, s)
                        else if asi_int \<in> {20, 21} then (None, s)
                             else if asi_int = 24 then (None, s)
                                  else if asi_int = 25
 then (mmu_reg_val (mmu s) addr, s)
 else if asi_int = 28 then (mem_val_w32 asi (ucast addr) s, s)
      else if asi_int = 29 then (None, s) else (None, s)) =
                        fst (let asi_int = uint asi
                             in if asi_int = 1
                                then let r1 =
     load_word_mem
      (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
           dwrite := new_dwrite, state_var := new_state_var,
           traps := new_traps, undef := new_undef\<rparr>)
      addr (word_of_int 8)
                                     in if r1 = None
  then let r2 = load_word_mem
                 (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
                      dwrite := new_dwrite, state_var := new_state_var,
                      traps := new_traps, undef := new_undef\<rparr>)
                 addr (word_of_int 10)
       in if r2 = None
          then (None, s
                \<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
                   dwrite := new_dwrite, state_var := new_state_var,
                   traps := new_traps, undef := new_undef\<rparr>)
          else (r2, s
                \<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
                   dwrite := new_dwrite, state_var := new_state_var,
                   traps := new_traps, undef := new_undef\<rparr>)
  else (r1, s
        \<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
           dwrite := new_dwrite, state_var := new_state_var,
           traps := new_traps, undef := new_undef\<rparr>)
                                else if asi_int = 2
                                     then (Some
      (sys_reg_val ICCR
        (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
             dwrite := new_dwrite, state_var := new_state_var,
             traps := new_traps, undef := new_undef\<rparr>)),
     s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
         dwrite := new_dwrite, state_var := new_state_var,
         traps := new_traps, undef := new_undef\<rparr>)
                                     else if asi_int \<in> {8, 9}
    then let ccr_val =
               sys_reg
                (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
                     dwrite := new_dwrite, state_var := new_state_var,
                     traps := new_traps, undef := new_undef\<rparr>)
                CCR
         in if ccr_val AND 1 \<noteq> 0
            then Let (load_word_mem
                       (s\<lparr>cpu_reg := new_cpu_reg,
                            user_reg := new_user_reg, dwrite := new_dwrite,
                            state_var := new_state_var, traps := new_traps,
                            undef := new_undef\<rparr>)
                       addr asi)
                  (case_option
                    (None, s
                     \<lparr>cpu_reg := new_cpu_reg,
                        user_reg := new_user_reg, dwrite := new_dwrite,
                        state_var := new_state_var, traps := new_traps,
                        undef := new_undef\<rparr>)
                    (\<lambda>w.
                        (Some w,
                         add_instr_cache
                          (s\<lparr>cpu_reg := new_cpu_reg,
                               user_reg := new_user_reg,
                               dwrite := new_dwrite,
                               state_var := new_state_var,
                               traps := new_traps,
                               undef := new_undef\<rparr>)
                          addr w 15)))
            else (load_word_mem
                   (s\<lparr>cpu_reg := new_cpu_reg,
                        user_reg := new_user_reg, dwrite := new_dwrite,
                        state_var := new_state_var, traps := new_traps,
                        undef := new_undef\<rparr>)
                   addr asi,
                  s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
                      dwrite := new_dwrite, state_var := new_state_var,
                      traps := new_traps, undef := new_undef\<rparr>)
    else if asi_int \<in> {10, 11}
         then let ccr_val =
                    sys_reg
                     (s\<lparr>cpu_reg := new_cpu_reg,
                          user_reg := new_user_reg, dwrite := new_dwrite,
                          state_var := new_state_var, traps := new_traps,
                          undef := new_undef\<rparr>)
                     CCR
              in if ccr_val AND 1 \<noteq> 0
                 then Let (load_word_mem
                            (s\<lparr>cpu_reg := new_cpu_reg,
                                 user_reg := new_user_reg,
                                 dwrite := new_dwrite,
                                 state_var := new_state_var,
                                 traps := new_traps,
                                 undef := new_undef\<rparr>)
                            addr asi)
                       (case_option
                         (None, s
                          \<lparr>cpu_reg := new_cpu_reg,
                             user_reg := new_user_reg, dwrite := new_dwrite,
                             state_var := new_state_var, traps := new_traps,
                             undef := new_undef\<rparr>)
                         (\<lambda>w.
                             (Some w,
                              add_data_cache
                               (s\<lparr>cpu_reg := new_cpu_reg,
                                    user_reg := new_user_reg,
                                    dwrite := new_dwrite,
                                    state_var := new_state_var,
                                    traps := new_traps,
                                    undef := new_undef\<rparr>)
                               addr w 15)))
                 else (load_word_mem
                        (s\<lparr>cpu_reg := new_cpu_reg,
                             user_reg := new_user_reg, dwrite := new_dwrite,
                             state_var := new_state_var, traps := new_traps,
                             undef := new_undef\<rparr>)
                        addr asi,
                       s\<lparr>cpu_reg := new_cpu_reg,
                           user_reg := new_user_reg, dwrite := new_dwrite,
                           state_var := new_state_var, traps := new_traps,
                           undef := new_undef\<rparr>)
         else if asi_int = 13
              then Let (read_instr_cache
                         (s\<lparr>cpu_reg := new_cpu_reg,
                              user_reg := new_user_reg,
                              dwrite := new_dwrite,
                              state_var := new_state_var,
                              traps := new_traps,
                              undef := new_undef\<rparr>)
                         addr)
                    (case_option
                      (None, s
                       \<lparr>cpu_reg := new_cpu_reg,
                          user_reg := new_user_reg, dwrite := new_dwrite,
                          state_var := new_state_var, traps := new_traps,
                          undef := new_undef\<rparr>)
                      (\<lambda>w.
                          (Some w, s
                           \<lparr>cpu_reg := new_cpu_reg,
                              user_reg := new_user_reg,
                              dwrite := new_dwrite,
                              state_var := new_state_var,
                              traps := new_traps,
                              undef := new_undef\<rparr>)))
              else if asi_int = 15
                   then Let (read_data_cache
                              (s\<lparr>cpu_reg := new_cpu_reg,
                                   user_reg := new_user_reg,
                                   dwrite := new_dwrite,
                                   state_var := new_state_var,
                                   traps := new_traps,
                                   undef := new_undef\<rparr>)
                              addr)
                         (case_option
                           (None, s
                            \<lparr>cpu_reg := new_cpu_reg,
                               user_reg := new_user_reg,
                               dwrite := new_dwrite,
                               state_var := new_state_var,
                               traps := new_traps,
                               undef := new_undef\<rparr>)
                           (\<lambda>w.
                               (Some w, s
                                \<lparr>cpu_reg := new_cpu_reg,
                                   user_reg := new_user_reg,
                                   dwrite := new_dwrite,
                                   state_var := new_state_var,
                                   traps := new_traps,
                                   undef := new_undef\<rparr>)))
                   else if asi_int \<in> {16, 17}
                        then (None, s
                              \<lparr>cpu_reg := new_cpu_reg,
                                 user_reg := new_user_reg,
                                 dwrite := new_dwrite,
                                 state_var := new_state_var,
                                 traps := new_traps,
                                 undef := new_undef\<rparr>)
                        else if asi_int \<in> {20, 21}
                             then (None, s
                                   \<lparr>cpu_reg := new_cpu_reg,
user_reg := new_user_reg, dwrite := new_dwrite, state_var := new_state_var,
traps := new_traps, undef := new_undef\<rparr>)
                             else if asi_int = 24
                                  then (None, s
  \<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
     dwrite := new_dwrite, state_var := new_state_var, traps := new_traps,
     undef := new_undef\<rparr>)
                                  else if asi_int = 25
 then (mmu_reg_val
        (mmu (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
                  dwrite := new_dwrite, state_var := new_state_var,
                  traps := new_traps, undef := new_undef\<rparr>))
        addr,
       s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
           dwrite := new_dwrite, state_var := new_state_var,
           traps := new_traps, undef := new_undef\<rparr>)
 else if asi_int = 28
      then (mem_val_w32 asi (ucast addr)
             (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
                  dwrite := new_dwrite, state_var := new_state_var,
                  traps := new_traps, undef := new_undef\<rparr>),
            s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
                dwrite := new_dwrite, state_var := new_state_var,
                traps := new_traps, undef := new_undef\<rparr>)
      else if asi_int = 29
           then (None, s
                 \<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
                    dwrite := new_dwrite, state_var := new_state_var,
                    traps := new_traps, undef := new_undef\<rparr>)
           else (None, s
                 \<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
                    dwrite := new_dwrite, state_var := new_state_var,
                    traps := new_traps, undef := new_undef\<rparr>))) \<and>
                       (uint addr \<noteq> 8 \<longrightarrow>
                        (uint addr = 0 \<longrightarrow>
                         fst (let asi_int = uint asi
                              in if asi_int = 1
                                 then let r1 =
      load_word_mem s addr (word_of_int 8)
in if r1 = None
   then let r2 = load_word_mem s addr (word_of_int 10)
        in if r2 = None then (None, s) else (r2, s)
   else (r1, s)
                                 else if asi_int = 2
then (Some (sys_reg_val CCR s), s)
else if asi_int \<in> {8, 9}
     then let ccr_val = sys_reg s CCR
          in if ccr_val AND 1 \<noteq> 0
             then Let (load_word_mem s addr asi)
                   (case_option (None, s)
                     (\<lambda>w. (Some w, add_instr_cache s addr w 15)))
             else (load_word_mem s addr asi, s)
     else if asi_int \<in> {10, 11}
          then let ccr_val = sys_reg s CCR
               in if ccr_val AND 1 \<noteq> 0
                  then Let (load_word_mem s addr asi)
                        (case_option (None, s)
                          (\<lambda>w.
                              (Some w, add_data_cache s addr w 15)))
                  else (load_word_mem s addr asi, s)
          else if asi_int = 13
               then Let (read_instr_cache s addr)
                     (case_option (None, s) (\<lambda>w. (Some w, s)))
               else if asi_int = 15
                    then Let (read_data_cache s addr)
                          (case_option (None, s) (\<lambda>w. (Some w, s)))
                    else if asi_int \<in> {16, 17} then (None, s)
                         else if asi_int \<in> {20, 21} then (None, s)
                              else if asi_int = 24 then (None, s)
                                   else if asi_int = 25
  then (mmu_reg_val (mmu s) addr, s)
  else if asi_int = 28 then (mem_val_w32 asi (ucast addr) s, s)
       else if asi_int = 29 then (None, s) else (None, s)) =
                         fst (let asi_int = uint asi
                              in if asi_int = 1
                                 then let r1 =
      load_word_mem
       (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
            dwrite := new_dwrite, state_var := new_state_var,
            traps := new_traps, undef := new_undef\<rparr>)
       addr (word_of_int 8)
in if r1 = None
   then let r2 = load_word_mem
                  (s\<lparr>cpu_reg := new_cpu_reg,
                       user_reg := new_user_reg, dwrite := new_dwrite,
                       state_var := new_state_var, traps := new_traps,
                       undef := new_undef\<rparr>)
                  addr (word_of_int 10)
        in if r2 = None
           then (None, s
                 \<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
                    dwrite := new_dwrite, state_var := new_state_var,
                    traps := new_traps, undef := new_undef\<rparr>)
           else (r2, s
                 \<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
                    dwrite := new_dwrite, state_var := new_state_var,
                    traps := new_traps, undef := new_undef\<rparr>)
   else (r1, s
         \<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
            dwrite := new_dwrite, state_var := new_state_var,
            traps := new_traps, undef := new_undef\<rparr>)
                                 else if asi_int = 2
then (Some
       (sys_reg_val CCR
         (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
              dwrite := new_dwrite, state_var := new_state_var,
              traps := new_traps, undef := new_undef\<rparr>)),
      s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
          dwrite := new_dwrite, state_var := new_state_var,
          traps := new_traps, undef := new_undef\<rparr>)
else if asi_int \<in> {8, 9}
     then let ccr_val =
                sys_reg
                 (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
                      dwrite := new_dwrite, state_var := new_state_var,
                      traps := new_traps, undef := new_undef\<rparr>)
                 CCR
          in if ccr_val AND 1 \<noteq> 0
             then Let (load_word_mem
                        (s\<lparr>cpu_reg := new_cpu_reg,
                             user_reg := new_user_reg, dwrite := new_dwrite,
                             state_var := new_state_var, traps := new_traps,
                             undef := new_undef\<rparr>)
                        addr asi)
                   (case_option
                     (None, s
                      \<lparr>cpu_reg := new_cpu_reg,
                         user_reg := new_user_reg, dwrite := new_dwrite,
                         state_var := new_state_var, traps := new_traps,
                         undef := new_undef\<rparr>)
                     (\<lambda>w.
                         (Some w,
                          add_instr_cache
                           (s\<lparr>cpu_reg := new_cpu_reg,
                                user_reg := new_user_reg,
                                dwrite := new_dwrite,
                                state_var := new_state_var,
                                traps := new_traps,
                                undef := new_undef\<rparr>)
                           addr w 15)))
             else (load_word_mem
                    (s\<lparr>cpu_reg := new_cpu_reg,
                         user_reg := new_user_reg, dwrite := new_dwrite,
                         state_var := new_state_var, traps := new_traps,
                         undef := new_undef\<rparr>)
                    addr asi,
                   s\<lparr>cpu_reg := new_cpu_reg,
                       user_reg := new_user_reg, dwrite := new_dwrite,
                       state_var := new_state_var, traps := new_traps,
                       undef := new_undef\<rparr>)
     else if asi_int \<in> {10, 11}
          then let ccr_val =
                     sys_reg
                      (s\<lparr>cpu_reg := new_cpu_reg,
                           user_reg := new_user_reg, dwrite := new_dwrite,
                           state_var := new_state_var, traps := new_traps,
                           undef := new_undef\<rparr>)
                      CCR
               in if ccr_val AND 1 \<noteq> 0
                  then Let (load_word_mem
                             (s\<lparr>cpu_reg := new_cpu_reg,
                                  user_reg := new_user_reg,
                                  dwrite := new_dwrite,
                                  state_var := new_state_var,
                                  traps := new_traps,
                                  undef := new_undef\<rparr>)
                             addr asi)
                        (case_option
                          (None, s
                           \<lparr>cpu_reg := new_cpu_reg,
                              user_reg := new_user_reg,
                              dwrite := new_dwrite,
                              state_var := new_state_var,
                              traps := new_traps,
                              undef := new_undef\<rparr>)
                          (\<lambda>w.
                              (Some w,
                               add_data_cache
                                (s\<lparr>cpu_reg := new_cpu_reg,
                                     user_reg := new_user_reg,
                                     dwrite := new_dwrite,
                                     state_var := new_state_var,
                                     traps := new_traps,
                                     undef := new_undef\<rparr>)
                                addr w 15)))
                  else (load_word_mem
                         (s\<lparr>cpu_reg := new_cpu_reg,
                              user_reg := new_user_reg,
                              dwrite := new_dwrite,
                              state_var := new_state_var,
                              traps := new_traps,
                              undef := new_undef\<rparr>)
                         addr asi,
                        s\<lparr>cpu_reg := new_cpu_reg,
                            user_reg := new_user_reg, dwrite := new_dwrite,
                            state_var := new_state_var, traps := new_traps,
                            undef := new_undef\<rparr>)
          else if asi_int = 13
               then Let (read_instr_cache
                          (s\<lparr>cpu_reg := new_cpu_reg,
                               user_reg := new_user_reg,
                               dwrite := new_dwrite,
                               state_var := new_state_var,
                               traps := new_traps,
                               undef := new_undef\<rparr>)
                          addr)
                     (case_option
                       (None, s
                        \<lparr>cpu_reg := new_cpu_reg,
                           user_reg := new_user_reg, dwrite := new_dwrite,
                           state_var := new_state_var, traps := new_traps,
                           undef := new_undef\<rparr>)
                       (\<lambda>w.
                           (Some w, s
                            \<lparr>cpu_reg := new_cpu_reg,
                               user_reg := new_user_reg,
                               dwrite := new_dwrite,
                               state_var := new_state_var,
                               traps := new_traps,
                               undef := new_undef\<rparr>)))
               else if asi_int = 15
                    then Let (read_data_cache
                               (s\<lparr>cpu_reg := new_cpu_reg,
                                    user_reg := new_user_reg,
                                    dwrite := new_dwrite,
                                    state_var := new_state_var,
                                    traps := new_traps,
                                    undef := new_undef\<rparr>)
                               addr)
                          (case_option
                            (None, s
                             \<lparr>cpu_reg := new_cpu_reg,
                                user_reg := new_user_reg,
                                dwrite := new_dwrite,
                                state_var := new_state_var,
                                traps := new_traps,
                                undef := new_undef\<rparr>)
                            (\<lambda>w.
                                (Some w, s
                                 \<lparr>cpu_reg := new_cpu_reg,
                                    user_reg := new_user_reg,
                                    dwrite := new_dwrite,
                                    state_var := new_state_var,
                                    traps := new_traps,
                                    undef := new_undef\<rparr>)))
                    else if asi_int \<in> {16, 17}
                         then (None, s
                               \<lparr>cpu_reg := new_cpu_reg,
                                  user_reg := new_user_reg,
                                  dwrite := new_dwrite,
                                  state_var := new_state_var,
                                  traps := new_traps,
                                  undef := new_undef\<rparr>)
                         else if asi_int \<in> {20, 21}
                              then (None, s
                                    \<lparr>cpu_reg := new_cpu_reg,
 user_reg := new_user_reg, dwrite := new_dwrite, state_var := new_state_var,
 traps := new_traps, undef := new_undef\<rparr>)
                              else if asi_int = 24
                                   then (None, s
   \<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
      dwrite := new_dwrite, state_var := new_state_var, traps := new_traps,
      undef := new_undef\<rparr>)
                                   else if asi_int = 25
  then (mmu_reg_val
         (mmu (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
                   dwrite := new_dwrite, state_var := new_state_var,
                   traps := new_traps, undef := new_undef\<rparr>))
         addr,
        s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
            dwrite := new_dwrite, state_var := new_state_var,
            traps := new_traps, undef := new_undef\<rparr>)
  else if asi_int = 28
       then (mem_val_w32 asi (ucast addr)
              (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
                   dwrite := new_dwrite, state_var := new_state_var,
                   traps := new_traps, undef := new_undef\<rparr>),
             s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
                 dwrite := new_dwrite, state_var := new_state_var,
                 traps := new_traps, undef := new_undef\<rparr>)
       else if asi_int = 29
            then (None, s
                  \<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
                     dwrite := new_dwrite, state_var := new_state_var,
                     traps := new_traps, undef := new_undef\<rparr>)
            else (None, s
                  \<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
                     dwrite := new_dwrite, state_var := new_state_var,
                     traps := new_traps,
                     undef := new_undef\<rparr>))) \<and>
                        (uint addr \<noteq> 0 \<longrightarrow>
                         fst (let asi_int = uint asi
                              in if asi_int = 1
                                 then let r1 =
      load_word_mem s addr (word_of_int 8)
in if r1 = None
   then let r2 = load_word_mem s addr (word_of_int 10)
        in if r2 = None then (None, s) else (r2, s)
   else (r1, s)
                                 else if asi_int = 2 then (None, s)
else if asi_int \<in> {8, 9}
     then let ccr_val = sys_reg s CCR
          in if ccr_val AND 1 \<noteq> 0
             then Let (load_word_mem s addr asi)
                   (case_option (None, s)
                     (\<lambda>w. (Some w, add_instr_cache s addr w 15)))
             else (load_word_mem s addr asi, s)
     else if asi_int \<in> {10, 11}
          then let ccr_val = sys_reg s CCR
               in if ccr_val AND 1 \<noteq> 0
                  then Let (load_word_mem s addr asi)
                        (case_option (None, s)
                          (\<lambda>w.
                              (Some w, add_data_cache s addr w 15)))
                  else (load_word_mem s addr asi, s)
          else if asi_int = 13
               then Let (read_instr_cache s addr)
                     (case_option (None, s) (\<lambda>w. (Some w, s)))
               else if asi_int = 15
                    then Let (read_data_cache s addr)
                          (case_option (None, s) (\<lambda>w. (Some w, s)))
                    else if asi_int \<in> {16, 17} then (None, s)
                         else if asi_int \<in> {20, 21} then (None, s)
                              else if asi_int = 24 then (None, s)
                                   else if asi_int = 25
  then (mmu_reg_val (mmu s) addr, s)
  else if asi_int = 28 then (mem_val_w32 asi (ucast addr) s, s)
       else if asi_int = 29 then (None, s) else (None, s)) =
                         fst (let asi_int = uint asi
                              in if asi_int = 1
                                 then let r1 =
      load_word_mem
       (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
            dwrite := new_dwrite, state_var := new_state_var,
            traps := new_traps, undef := new_undef\<rparr>)
       addr (word_of_int 8)
in if r1 = None
   then let r2 = load_word_mem
                  (s\<lparr>cpu_reg := new_cpu_reg,
                       user_reg := new_user_reg, dwrite := new_dwrite,
                       state_var := new_state_var, traps := new_traps,
                       undef := new_undef\<rparr>)
                  addr (word_of_int 10)
        in if r2 = None
           then (None, s
                 \<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
                    dwrite := new_dwrite, state_var := new_state_var,
                    traps := new_traps, undef := new_undef\<rparr>)
           else (r2, s
                 \<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
                    dwrite := new_dwrite, state_var := new_state_var,
                    traps := new_traps, undef := new_undef\<rparr>)
   else (r1, s
         \<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
            dwrite := new_dwrite, state_var := new_state_var,
            traps := new_traps, undef := new_undef\<rparr>)
                                 else if asi_int = 2
then (None, s
      \<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
         dwrite := new_dwrite, state_var := new_state_var,
         traps := new_traps, undef := new_undef\<rparr>)
else if asi_int \<in> {8, 9}
     then let ccr_val =
                sys_reg
                 (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
                      dwrite := new_dwrite, state_var := new_state_var,
                      traps := new_traps, undef := new_undef\<rparr>)
                 CCR
          in if ccr_val AND 1 \<noteq> 0
             then Let (load_word_mem
                        (s\<lparr>cpu_reg := new_cpu_reg,
                             user_reg := new_user_reg, dwrite := new_dwrite,
                             state_var := new_state_var, traps := new_traps,
                             undef := new_undef\<rparr>)
                        addr asi)
                   (case_option
                     (None, s
                      \<lparr>cpu_reg := new_cpu_reg,
                         user_reg := new_user_reg, dwrite := new_dwrite,
                         state_var := new_state_var, traps := new_traps,
                         undef := new_undef\<rparr>)
                     (\<lambda>w.
                         (Some w,
                          add_instr_cache
                           (s\<lparr>cpu_reg := new_cpu_reg,
                                user_reg := new_user_reg,
                                dwrite := new_dwrite,
                                state_var := new_state_var,
                                traps := new_traps,
                                undef := new_undef\<rparr>)
                           addr w 15)))
             else (load_word_mem
                    (s\<lparr>cpu_reg := new_cpu_reg,
                         user_reg := new_user_reg, dwrite := new_dwrite,
                         state_var := new_state_var, traps := new_traps,
                         undef := new_undef\<rparr>)
                    addr asi,
                   s\<lparr>cpu_reg := new_cpu_reg,
                       user_reg := new_user_reg, dwrite := new_dwrite,
                       state_var := new_state_var, traps := new_traps,
                       undef := new_undef\<rparr>)
     else if asi_int \<in> {10, 11}
          then let ccr_val =
                     sys_reg
                      (s\<lparr>cpu_reg := new_cpu_reg,
                           user_reg := new_user_reg, dwrite := new_dwrite,
                           state_var := new_state_var, traps := new_traps,
                           undef := new_undef\<rparr>)
                      CCR
               in if ccr_val AND 1 \<noteq> 0
                  then Let (load_word_mem
                             (s\<lparr>cpu_reg := new_cpu_reg,
                                  user_reg := new_user_reg,
                                  dwrite := new_dwrite,
                                  state_var := new_state_var,
                                  traps := new_traps,
                                  undef := new_undef\<rparr>)
                             addr asi)
                        (case_option
                          (None, s
                           \<lparr>cpu_reg := new_cpu_reg,
                              user_reg := new_user_reg,
                              dwrite := new_dwrite,
                              state_var := new_state_var,
                              traps := new_traps,
                              undef := new_undef\<rparr>)
                          (\<lambda>w.
                              (Some w,
                               add_data_cache
                                (s\<lparr>cpu_reg := new_cpu_reg,
                                     user_reg := new_user_reg,
                                     dwrite := new_dwrite,
                                     state_var := new_state_var,
                                     traps := new_traps,
                                     undef := new_undef\<rparr>)
                                addr w 15)))
                  else (load_word_mem
                         (s\<lparr>cpu_reg := new_cpu_reg,
                              user_reg := new_user_reg,
                              dwrite := new_dwrite,
                              state_var := new_state_var,
                              traps := new_traps,
                              undef := new_undef\<rparr>)
                         addr asi,
                        s\<lparr>cpu_reg := new_cpu_reg,
                            user_reg := new_user_reg, dwrite := new_dwrite,
                            state_var := new_state_var, traps := new_traps,
                            undef := new_undef\<rparr>)
          else if asi_int = 13
               then Let (read_instr_cache
                          (s\<lparr>cpu_reg := new_cpu_reg,
                               user_reg := new_user_reg,
                               dwrite := new_dwrite,
                               state_var := new_state_var,
                               traps := new_traps,
                               undef := new_undef\<rparr>)
                          addr)
                     (case_option
                       (None, s
                        \<lparr>cpu_reg := new_cpu_reg,
                           user_reg := new_user_reg, dwrite := new_dwrite,
                           state_var := new_state_var, traps := new_traps,
                           undef := new_undef\<rparr>)
                       (\<lambda>w.
                           (Some w, s
                            \<lparr>cpu_reg := new_cpu_reg,
                               user_reg := new_user_reg,
                               dwrite := new_dwrite,
                               state_var := new_state_var,
                               traps := new_traps,
                               undef := new_undef\<rparr>)))
               else if asi_int = 15
                    then Let (read_data_cache
                               (s\<lparr>cpu_reg := new_cpu_reg,
                                    user_reg := new_user_reg,
                                    dwrite := new_dwrite,
                                    state_var := new_state_var,
                                    traps := new_traps,
                                    undef := new_undef\<rparr>)
                               addr)
                          (case_option
                            (None, s
                             \<lparr>cpu_reg := new_cpu_reg,
                                user_reg := new_user_reg,
                                dwrite := new_dwrite,
                                state_var := new_state_var,
                                traps := new_traps,
                                undef := new_undef\<rparr>)
                            (\<lambda>w.
                                (Some w, s
                                 \<lparr>cpu_reg := new_cpu_reg,
                                    user_reg := new_user_reg,
                                    dwrite := new_dwrite,
                                    state_var := new_state_var,
                                    traps := new_traps,
                                    undef := new_undef\<rparr>)))
                    else if asi_int \<in> {16, 17}
                         then (None, s
                               \<lparr>cpu_reg := new_cpu_reg,
                                  user_reg := new_user_reg,
                                  dwrite := new_dwrite,
                                  state_var := new_state_var,
                                  traps := new_traps,
                                  undef := new_undef\<rparr>)
                         else if asi_int \<in> {20, 21}
                              then (None, s
                                    \<lparr>cpu_reg := new_cpu_reg,
 user_reg := new_user_reg, dwrite := new_dwrite, state_var := new_state_var,
 traps := new_traps, undef := new_undef\<rparr>)
                              else if asi_int = 24
                                   then (None, s
   \<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
      dwrite := new_dwrite, state_var := new_state_var, traps := new_traps,
      undef := new_undef\<rparr>)
                                   else if asi_int = 25
  then (mmu_reg_val
         (mmu (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
                   dwrite := new_dwrite, state_var := new_state_var,
                   traps := new_traps, undef := new_undef\<rparr>))
         addr,
        s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
            dwrite := new_dwrite, state_var := new_state_var,
            traps := new_traps, undef := new_undef\<rparr>)
  else if asi_int = 28
       then (mem_val_w32 asi (ucast addr)
              (s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
                   dwrite := new_dwrite, state_var := new_state_var,
                   traps := new_traps, undef := new_undef\<rparr>),
             s\<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
                 dwrite := new_dwrite, state_var := new_state_var,
                 traps := new_traps, undef := new_undef\<rparr>)
       else if asi_int = 29
            then (None, s
                  \<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
                     dwrite := new_dwrite, state_var := new_state_var,
                     traps := new_traps, undef := new_undef\<rparr>)
            else (None, s
                  \<lparr>cpu_reg := new_cpu_reg, user_reg := new_user_reg,
                     dwrite := new_dwrite, state_var := new_state_var,
                     traps := new_traps, undef := new_undef\<rparr>)))))


proof (prove)
goal (1 subgoal):
 1. set ancestor_ancestors \<subseteq> set ancestors


proof (prove)
goal (1 subgoal):
 1. (gbai_L, gba_L)
    \<in> \<langle>Rv, Re,
          Rv0\<rangle>gen_gba_impl_rel_ext Rm Rl Racc \<rightarrow> Rl &&&
    (gen_gba_impl_ext, gba_rec_ext)
    \<in> Rl \<rightarrow>
          Rm \<rightarrow> \<langle>Rm, Rl\<rangle>gen_gba_impl_rel_eext


proof (prove)
goal (1 subgoal):
 1. finite {len m i j xs |xs. set xs \<subseteq> {0..k} \<and> distinct xs}


proof (prove)
goal (2 subgoals):
 1. \<lbrakk>atom i \<sharp> (j, A); atom j \<sharp> A\<rbrakk>
    \<Longrightarrow> {A} \<turnstile> (Zero IN Var j)(j::=Eats Zero Zero)
 2. \<lbrakk>atom i \<sharp> (j, A); atom j \<sharp> A\<rbrakk>
    \<Longrightarrow> {Var i IN Var j} \<turnstile> A


proof (prove)
using this:
  x \<in> E

goal (1 subgoal):
 1. 0 \<le> \<parallel>x\<parallel>


proof (prove)
using this:
  order.greater n 0
  order.greater (add_order (s + t)) n \<or> add_order (s + t) = 0
  \<lbrakk>order.greater ?k 0; order.greater (add_order ?a) ?k\<rbrakk>
  \<Longrightarrow> ?a +^ ?k \<noteq> (0::?'a)
  \<lbrakk>add_order ?a = 0; order.greater ?n 0\<rbrakk>
  \<Longrightarrow> ?a +^ ?n \<noteq> (0::?'a)
  sum_list (alternating_list (2 * n) s t) = (0::'w)

goal (1 subgoal):
 1. False


proof (prove)
using this:
  bar []

goal (1 subgoal):
 1. \<exists>vs. is_prefix vs f \<and> good vs


proof (prove)
using this:
  x' = Some x''
  r \<in> range c
  z \<in> results r
  Resumption.resumption.Pause out c = x \<bind> f
  x = Resumption.resumption.Done x'

goal (1 subgoal):
 1. z \<in> (\<Union>a\<in>results x. results (f a))


proof (prove)
goal (1 subgoal):
 1. abs_conv_abscissa (f - g)
    \<le> max (abs_conv_abscissa f) (abs_conv_abscissa g)


proof (prove)
goal (1 subgoal):
 1. {} \<turnstile>
    {(=) Z} Impl M {\<lambda>t. \<exists>n. Z -Impl M-n\<rightarrow> t}


proof (prove)
goal (1 subgoal):
 1. set_integrable lborel ({0..1 / 2} \<union> {1 / 2..1})
     (\<lambda>t. t powr (a - 1) * (1 - t) powr (b - 1))


proof (prove)
using this:
  a \<in> open_segment (a - complex_of_real d) (a + complex_of_real e)

goal (1 subgoal):
 1. open_segment (a - complex_of_real d) (a + complex_of_real e)
    \<subseteq> inside (path_image p)


proof (prove)
goal (1 subgoal):
 1. unit_counit_adjunction (\<cdot>\<^sub>C) (\<cdot>\<^sub>D) F G \<eta>
     \<epsilon>


proof (prove)
goal (1 subgoal):
 1. D InAngle A B C


proof (prove)
using this:
  ?h \<in> Maps.Comp ?G ?F \<Longrightarrow>
  Maps.Comp ?G ?F = \<lbrakk>?h\<rbrakk>
  \<lbrakk>ide ?f; ide ?g; src ?f = trg ?g\<rbrakk>
  \<Longrightarrow> \<lbrakk>\<lbrakk>?f \<star> ?g\<rbrakk>\<rbrakk> =
                    Maps.MkArr (src ?g) (trg ?f)
                     (Maps.Comp \<lbrakk>?f\<rbrakk> \<lbrakk>?g\<rbrakk>)
  is_left_adjoint cmp.chine
  rs.cmp = cmp.chine

goal (1 subgoal):
 1. Maps.Comp \<lbrakk>tab\<^sub>0 (r \<star> s)\<rbrakk>
     \<lbrakk>rs.cmp\<rbrakk> =
    \<lbrakk>tab\<^sub>0 (r \<star> s) \<star> rs.cmp\<rbrakk>


proof (prove)
using this:
  [[a x c]]
  [[?a ?b ?c]] \<Longrightarrow> \<not> [[?b ?a ?c]]
  [[?a ?b ?c]] \<Longrightarrow> \<not> [[?a ?c ?b]]
  [[?a ?b ?c]] \<Longrightarrow> \<not> [[?b ?c ?a]]
  [[?a ?b ?c]] \<Longrightarrow> \<not> [[?c ?a ?b]]

goal (1 subgoal):
 1. \<not> ([[b a x]] \<or> [[b c x]] \<or> x = a \<or> x = c)


proof (prove)
using this:
  length w < n
  \<forall>x\<in>set I.
     case x of Inl p \<Rightarrow> p \<le> n
     | Inr P \<Rightarrow> \<forall>p\<in>P. p \<le> n

goal (1 subgoal):
 1. sdrop (Suc n) (stream_enc (w, I)) =
    sconst (any, replicate (length I) False)


proof (state)
goal (1 subgoal):
 1. isCont (\<lambda>x. if x \<le> a then g x else f x) a


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>card A \<noteq> 0;
     \<And>a b.
        \<lbrakk>a \<in> A; b \<in> A; a \<noteq> b\<rbrakk>
        \<Longrightarrow> coprime a b\<rbrakk>
    \<Longrightarrow> Lcm A = normalize (\<Prod>A)


proof (prove)
goal (1 subgoal):
 1. \<And>x y z.
       - - (x \<sqinter> y) \<squnion> - (- x \<sqinter> z) =
       - (- x \<sqinter> z)


proof (prove)
goal (1 subgoal):
 1. \<exists>a.
       a \<noteq> (0::'a) \<and> span S \<subseteq> {x. a \<bullet> x = 0}


proof (prove)
using this:
  awalk u (p @ q) w
  v \<in> set (awalk_verts u (p @ q))
  awalk u p v
  awalk v q w

goal (1 subgoal):
 1. set (awalk_verts u (p @ q)) =
    set (awalk_verts u p) \<union> set (awalk_verts v q)