proof (prove)
goal (1 subgoal):
 1. derivesp g =
    (\<lambda>lsl rsl.
        \<exists>s1 s2 lhs rhs.
           s1 @ [NTS lhs] @ s2 = lsl \<and>
           s1 @ rhs @ s2 = rsl \<and> fst g (rule lhs rhs))


proof (prove)
goal (3 subgoals):
 1. \<And>x y.
       \<lbrakk>x \<in> carrier P; y \<in> carrier P\<rbrakk>
       \<Longrightarrow> to_fun (x \<otimes>\<^bsub>P\<^esub> y) =
                         to_fun
                          x \<otimes>\<^bsub>function_ring (carrier R) R\<^esub>
                         to_fun y
 2. \<And>x y.
       \<lbrakk>x \<in> carrier P; y \<in> carrier P\<rbrakk>
       \<Longrightarrow> to_fun (x \<oplus>\<^bsub>P\<^esub> y) =
                         to_fun
                          x \<oplus>\<^bsub>function_ring (carrier R) R\<^esub>
                         to_fun y
 3. to_fun \<one>\<^bsub>P\<^esub> =
    \<one>\<^bsub>function_ring (carrier R) R\<^esub>


proof (prove)
using this:
  AE \<omega> in M. False

goal (1 subgoal):
 1. False


proof (prove)
goal (1 subgoal):
 1. mono_setup_loc (\<le>)


proof (prove)
goal (1 subgoal):
 1. correctCompositionDiffLevels sA9


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>b \<le> a; d \<le> c\<rbrakk>
    \<Longrightarrow> (a - b) * (c - d) =
                      a * c + b * d - (a * d + b * c) \<and>
                      a * d + b * c \<le> a * c + b * d


proof (prove)
using this:
  0 \<le> y
  y < x
  n \<in> {i. 0 < i \<and> real i \<le> x}

goal (1 subgoal):
 1. (f' has_integral f x - f (max (real n) y)) {max (real n) y..x}


proof (state)
this:
  LINT (x, y, z)
     |(count_space (X ` space M) \<Otimes>\<^sub>M
       count_space (Y ` space M) \<Otimes>\<^sub>M
       count_space (Z ` space M)).
     (if (x, y, z) \<in> (\<lambda>x. (X x, Y x, Z x)) ` space M
      then Pxyz (x, y, z) else 0) *
     log b
      ((if (x, y, z) \<in> (\<lambda>x. (X x, Y x, Z x)) ` space M
        then Pxyz (x, y, z) else 0) /
       ((if (x, z) \<in> (\<lambda>x. (X x, Z x)) ` space M then Pxz (x, z)
         else 0) *
        ((if (y, z) \<in> (\<lambda>x. (Y x, Z x)) ` space M then Pyz (y, z)
          else 0) /
         Pz z))) =
  (\<Sum>(x, y, z)\<in>(\<lambda>x. (X x, Y x, Z x)) ` space M.
     Pxyz (x, y, z) *
     log b (Pxyz (x, y, z) / (Pxz (x, z) * (Pyz (y, z) / Pz z))))

goal (5 subgoals):
 1. \<And>x.
       x \<in> space (count_space (X ` space M)) \<Longrightarrow>
       0 \<le> prob (X -` {x} \<inter> space M)
 2. \<And>z.
       z \<in> space (count_space (Z ` space M)) \<Longrightarrow>
       0 \<le> Pz z
 3. \<And>y z.
       \<lbrakk>y \<in> space (count_space (Y ` space M));
        z \<in> space (count_space (Z ` space M))\<rbrakk>
       \<Longrightarrow> 0 \<le> (if (y, z)
                                     \<in> (\<lambda>x. (Y x, Z x)) `
     space M
                                  then Pyz (y, z) else 0)
 4. \<And>x z.
       \<lbrakk>x \<in> space (count_space (X ` space M));
        z \<in> space (count_space (Z ` space M))\<rbrakk>
       \<Longrightarrow> 0 \<le> (if (x, z)
                                     \<in> (\<lambda>x. (X x, Z x)) `
     space M
                                  then Pxz (x, z) else 0)
 5. \<And>x y z.
       \<lbrakk>x \<in> space (count_space (X ` space M));
        y \<in> space (count_space (Y ` space M));
        z \<in> space (count_space (Z ` space M))\<rbrakk>
       \<Longrightarrow> 0 \<le> (if (x, y, z)
                                     \<in> (\<lambda>x. (X x, Y x, Z x)) `
     space M
                                  then Pxyz (x, y, z) else 0)


proof (prove)
goal (1 subgoal):
 1. x \<in> {Inf_aform' p X..Sup_aform' p X} \<and> xs \<in> Joints XS


proof (prove)
goal (1 subgoal):
 1. isCont f a \<Longrightarrow> isCont (\<lambda>x. Re (f x)) a


proof (prove)
goal (1 subgoal):
 1. matpow (A + mat 1) n ** A = A ** matpow (A + mat 1) n


proof (prove)
goal (1 subgoal):
 1. \<And>h \<sigma> r.
       \<lbrakk>\<sigma> = Some (snd (Ref.alloc x (the_state (Some h))));
        r = fst (Ref.alloc x (the_state (Some h)));
        Ref.get (the_state \<sigma>) r = x\<rbrakk>
       \<Longrightarrow> \<not> is_exn \<sigma> \<and>
                         Ref.get (the_state \<sigma>) r = x \<and>
                         new_addrs h {} (the_state \<sigma>) =
                         {addr_of_ref r} \<and>
                         addr_of_ref r < lim (the_state \<sigma>) \<and>
                         relH {a. a < lim h} h (the_state \<sigma>) \<and>
                         lim h \<le> lim (the_state \<sigma>)


proof (prove)
goal (1 subgoal):
 1. (\<Sum>x\<in>#A. if x = p then 1 else 0) =
    (if p \<in> S then f p else 0)


proof (prove)
goal (1 subgoal):
 1. hn_refine emp (return None) emp (option_assn P) (RETURN $ None)


proof (prove)
goal (1 subgoal):
 1. \<forall>x.
       (\<exists>xa.
           xa \<noteq> x \<and>
           (\<exists>va u.
               move ts ts' v=va\<parallel>u \<and>
               True \<and>
               (\<exists>v ua.
                   u=v\<parallel>ua \<and>
                   (\<exists>va u.
                       v=va--u \<and>
                       True \<and>
                       (\<exists>v ua.
                           u=v--ua \<and>
                           ((0 < \<parallel>ext v\<parallel> \<and>
                             len v ts' x = ext v \<and>
                             restrict v (clm ts') x = lan v \<and>
                             |lan v| = 1) \<and>
                            (0 < \<parallel>ext v\<parallel> \<and>
                             len v ts' xa = ext v \<and>
                             restrict v (res ts') xa = lan v \<and>
                             |lan v| = 1 \<or>
                             0 < \<parallel>ext v\<parallel> \<and>
                             len v ts' xa = ext v \<and>
                             restrict v (clm ts') xa = lan v \<and>
                             |lan v| = 1)) \<and>
                           True)) \<and>
                   True))) \<longrightarrow>
       (\<forall>ts'.
           ts' \<^bold>\<midarrow>r( x ) \<^bold>\<rightarrow> ts' \<longrightarrow>
           False)


proof (prove)
using this:
  (a1 \<inter>\<^sub>g b1) = Some d1
  \<Gamma>\<turnstile>Catch a1 a2 \<down> s
  s = Normal s'

goal (1 subgoal):
 1. \<Gamma>\<turnstile>d1 \<down> Normal s'


proof (prove)
using this:
  toList ?x \<in> rel_ext (\<lambda>x. sorted x \<and> distinct x)

goal (1 subgoal):
 1. sorted (toList xs)


proof (prove)
goal (1 subgoal):
 1. class.countable_complete_distrib_lattice Inf Sup inf (\<le>) (<) sup bot
     top


proof (prove)
using this:
  ?r2 \<in> g3ip \<Longrightarrow> ?r2 \<in> upRules

goal (1 subgoal):
 1. g3ip \<subseteq> upRules


proof (prove)
using this:
  x * (n - 1) mod n = 1
  \<lbrakk>x \<in> carrier G; n - 1 \<in> carrier G;
   x \<otimes>\<^bsub>G\<^esub> (n - 1) = \<one>\<^bsub>G\<^esub>;
   (n - 1) \<otimes>\<^bsub>G\<^esub> x = \<one>\<^bsub>G\<^esub>\<rbrakk>
  \<Longrightarrow> n - 1 = inv\<^bsub>G\<^esub> x
  \<lbrakk>x \<in> carrier G; y \<in> carrier G;
   x \<otimes>\<^bsub>G\<^esub> y = \<one>\<^bsub>G\<^esub>;
   y \<otimes>\<^bsub>G\<^esub> x = \<one>\<^bsub>G\<^esub>\<rbrakk>
  \<Longrightarrow> y = inv\<^bsub>G\<^esub> x
  2 \<le> n \<Longrightarrow> n - 1 \<in> totatives n
  1 < n
  x \<in> totatives n
  y \<in> totatives n
  [x * y = 1] (mod n)

goal (1 subgoal):
 1. y = n - 1


proof (state)
this:
  c' = csp + c
  ?s \<in># csp \<Longrightarrow>
  \<exists>p u v.
     ?s = [entry fg p] \<and>
     (u, Spawn p, v) \<in> edges fg \<and> initialproc fg p

goal (1 subgoal):
 1. \<And>csp.
       \<lbrakk>c' = csp + c;
        \<And>s.
           s \<in># csp \<Longrightarrow>
           \<exists>p u v.
              s = [entry fg p] \<and>
              (u, Spawn p, v) \<in> edges fg \<and>
              initialproc fg p\<rbrakk>
       \<Longrightarrow> P


proof (prove)
goal (1 subgoal):
 1. HInv4b s' q


proof (prove)
goal (1 subgoal):
 1. (\<And>s. s \<in> terminates_on g) \<Longrightarrow> terminates g


proof (prove)
goal (1 subgoal):
 1. (case bezout (A $ from_nat i $ from_nat i)
           (A $ from_nat j $ from_nat j) of
     (p, q, u, v, d) \<Rightarrow> p,
     case bezout (A $ from_nat i $ from_nat i)
           (A $ from_nat j $ from_nat j) of
     (p, q, u, v, d) \<Rightarrow> q,
     case bezout (A $ from_nat i $ from_nat i)
           (A $ from_nat j $ from_nat j) of
     (p, q, u, v, d) \<Rightarrow> u,
     case bezout (A $ from_nat i $ from_nat i)
           (A $ from_nat j $ from_nat j) of
     (p, q, u, v, d) \<Rightarrow> v,
     case bezout (A $ from_nat i $ from_nat i)
           (A $ from_nat j $ from_nat j) of
     (p, q, u, v, d) \<Rightarrow> d) =
    bezout (A $ from_nat i $ from_nat i) (A $ from_nat j $ from_nat j)


proof (prove)
goal (1 subgoal):
 1. Bot < x \<Longrightarrow> \<exists>z. x = Value z


proof (prove)
goal (1 subgoal):
 1. root n (real_of_rat (((l' + r') / 2) ^ n)) =
    root n (real_of_rat ((l' + r') / 2) ^ n)


proof (prove)
using this:
  Abs_fps (\<lambda>n. of_nat n ^ k) = 1 / (1 - fps_X)

goal (1 subgoal):
 1. Abs_fps (\<lambda>n. of_nat n ^ k) =
    fps_of_poly (fps_monom_poly (1::'a) k) / (1 - fps_X) ^ (k + 1)


proof (prove)
using this:
  A \<noteq> Q
  Bet a P b
  Bet A Q B
  P a Le Q A
  P b Le Q B
  \<lbrakk>Bet ?a ?P ?b; Bet ?A ?Q ?B; ?P ?a Le ?Q ?A; ?P ?b Le ?Q ?B;
   ?B = ?Q\<rbrakk>
  \<Longrightarrow> ?a ?b Le ?A ?B
  \<lbrakk>Bet ?a ?Po ?b; Bet ?A ?PO ?B; ?Po ?a Le ?PO ?A; ?Po ?b Le ?PO ?B;
   ?A \<noteq> ?PO; ?B \<noteq> ?PO\<rbrakk>
  \<Longrightarrow> ?a ?b Le ?A ?B

goal (1 subgoal):
 1. a b Le A B


proof (prove)
goal (1 subgoal):
 1. map_poly_comm_monoid_add_hom (\<lambda>x. monom x i)


proof (prove)
goal (1 subgoal):
 1. OFCLASS('a \<times> 'b, card_UNIV_class)


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>equivalence_map f;
     \<guillemotleft>g : trg f \<rightarrow> src f\<guillemotright>; ide g;
     \<guillemotleft>\<eta> : src f \<Rightarrow> g \<star>
            f\<guillemotright>;
     local.iso \<eta>; ide f;
     \<guillemotleft>f : src f \<rightarrow> trg f\<guillemotright>;
     obj (src f) \<Longrightarrow>
     \<guillemotleft>UP.unit
                      (src f) : UP.map\<^sub>0
                                 (src f) \<Rightarrow>\<^sub>S S.UP
                          (src f)\<guillemotright>;
     obj (src f) \<Longrightarrow> S.iso (UP.unit (src f));
     obj (src f) \<Longrightarrow>
     UP.unit (src f) \<cdot>\<^sub>S S.\<i> (UP.map\<^sub>0 (src f)) =
     (S.UP \<i>[src f] \<cdot>\<^sub>S
      S.cmp\<^sub>U\<^sub>P (src f, src f)) \<cdot>\<^sub>S
     (UP.unit (src f) \<star>\<^sub>S UP.unit (src f));
     obj (src f) \<Longrightarrow>
     \<exists>!\<psi>.
        \<guillemotleft>\<psi> : UP.map\<^sub>0
                                  (src f) \<Rightarrow>\<^sub>S S.UP
                           (src f)\<guillemotright> \<and>
        S.iso \<psi> \<and>
        \<psi> \<cdot>\<^sub>S S.\<i> (UP.map\<^sub>0 (src f)) =
        (S.UP \<i>[src f] \<cdot>\<^sub>S
         S.cmp\<^sub>U\<^sub>P (src f, src f)) \<cdot>\<^sub>S
        (\<psi> \<star>\<^sub>S \<psi>);
     \<And>f a b.
        \<lbrakk>S.iso f;
         \<guillemotleft>f : a \<Rightarrow>\<^sub>S b\<guillemotright>\<rbrakk>
        \<Longrightarrow> \<guillemotleft>S.inv
     f : b \<Rightarrow>\<^sub>S a\<guillemotright>\<rbrakk>
    \<Longrightarrow> S.src (S.UP f) = S.trg (S.UP (src f))


proof (chain)
picking this:
  homeomorphism (C \<inter> g -` S) S g f


proof (prove)
goal (1 subgoal):
 1. (Var x
      \<alpha> \<leftrightarrow> Var y
                                  \<alpha>) \<bullet> (Var x \<alpha>,
                 Var x \<beta>) =
    (Var y \<alpha>, Var x \<beta>)


proof (prove)
using this:
  guessed_runs Rb = \<lparr>role = Resp, owner = B, partner = A\<rparr>
  guessed_frame Rb xpkE = Some KE
  KE = epubKF (Ra $ kE)
  guessed_runs Ra = \<lparr>role = Init, owner = A, partner = B\<rparr>

goal (1 subgoal):
 1. Aenc (NonceF (Rb $ sk)) KE \<in> synth (analz generators)


proof (prove)
goal (1 subgoal):
 1. q = p


proof (prove)
goal (1 subgoal):
 1. gurun A w r x


proof (prove)
goal (1 subgoal):
 1. (\<Sum>k\<in>d. norm (integral k f)) =
    (\<Sum>k\<in>d. norm (set_lebesgue_integral lebesgue k f))


proof (prove)
goal (1 subgoal):
 1. a \<in> lists A \<and> b \<in> lists A


proof (prove)
goal (1 subgoal):
 1. (\<And>a b.
        \<lbrakk>a \<in> set (x # xs); b \<in> set (x # xs)\<rbrakk>
        \<Longrightarrow> (f a \<circ>\<circ> f) b =
                          (f b \<circ>\<circ> f) a) \<Longrightarrow>
    fold f (x # xs) = (f x \<circ>\<circ>\<circ> fold) f xs


proof (prove)
using this:
  a = a' * gcd a b
  a' dvd c

goal (1 subgoal):
 1. a = gcd a b * a' \<and> gcd a b dvd b \<and> a' dvd c


proof (prove)
using this:
  (\<lambda>x.
      \<Sum>k\<le>n2. a2 k * sin (real k * x) + b2 k * cos (real k * x)) =
  (\<lambda>x.
      \<Sum>k\<le>n2. a2 k * sin (real k * x) + b2 k * cos (real k * x))

goal (1 subgoal):
 1. trigpoly
     (\<lambda>x.
         (\<Sum>k\<le>n1.
             a1 k * sin (real k * x) + b1 k * cos (real k * x)) *
         (\<Sum>k\<le>n2.
             a2 k * sin (real k * x) + b2 k * cos (real k * x)))


proof (prove)
using this:
  supp \<alpha> - {atom i} \<subseteq> atom ` Vs

goal (1 subgoal):
 1. subst i' (Var sn')
     (ssubst \<lfloor>\<alpha>\<rfloor>(insert i Vs) (insert i Vs) Fi) =
    ssubst \<lfloor>\<alpha>(i::=Var sn)\<rfloor>V' V' F'


proof (prove)
goal (1 subgoal):
 1. mpt M Tinv \<and> finite_measure M


proof (prove)
goal (1 subgoal):
 1. (\<lambda>s.
        \<exists>p q.
           p \<oplus> q = Some s \<and> sep_true p \<and> sep_true q) =
    sep_true


proof (prove)
using this:
  finite (A \<times> {xs. set xs \<subseteq> A \<and> length xs = n})

goal (1 subgoal):
 1. finite A


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>as = as' @ [a']; valid_node m'; valid_call_list cs' m';
     \<forall>i<length rs'. rs' ! i \<in> get_return_edges (cs' ! i);
     valid_return_list rs' m'; length rs' = length cs';
     ms' = targetnodes rs'; upd_cs cs (as' @ [a']) = cs'\<rbrakk>
    \<Longrightarrow> valid_node m' \<and>
                      valid_call_list cs' m' \<and>
                      (\<forall>i<length rs'.
                          rs' ! i \<in> get_return_edges (cs' ! i)) \<and>
                      valid_return_list rs' m' \<and>
                      length rs' = length cs' \<and>
                      ms' = targetnodes rs' \<and> upd_cs cs as = cs'


proof (prove)
using this:
  ?x \<in># image_mset fst
             (SkewBinomialHeapStruc.queue_to_multiset
               (map bsmapt qy)) \<Longrightarrow>
  ay \<le> eprio ?x
  ?x \<in># image_mset fst
             (SkewBinomialHeapStruc.queue_to_multiset
               (map bsmapt qy)) \<Longrightarrow>
  elem_invar ?x
  ?y \<in># image_mset fst
             (SkewBinomialHeapStruc.queue_to_multiset
               (map bsmapt q)) \<Longrightarrow>
  eprio (findMin q) \<le> eprio ?y
  ?y \<in># image_mset fst
             (SkewBinomialHeapStruc.queue_to_multiset
               (map bsmapt q)) \<Longrightarrow>
  elem_invar ?y

goal (1 subgoal):
 1. elem_invar (deleteMin' (Element e a q))


proof (prove)
using this:
  ((S.UP g \<star>\<^sub>S
    S.UP \<epsilon> \<cdot>\<^sub>S
    S.cmp\<^sub>U\<^sub>P (f, g)) \<cdot>\<^sub>S
   (S.inv (S.cmp\<^sub>U\<^sub>P (g, f)) \<cdot>\<^sub>S
    S.UP \<eta> \<star>\<^sub>S
    S.UP g)) \<cdot>\<^sub>S
  S.inv (S.cmp\<^sub>U\<^sub>P (trg g, g)) =
  ((S.UP g \<star>\<^sub>S UP.unit (src g)) \<cdot>\<^sub>S
   (S.inv (UP.unit (trg g)) \<star>\<^sub>S S.UP g)) \<cdot>\<^sub>S
  S.inv (S.cmp\<^sub>U\<^sub>P (trg g, g))
  S.epi (S.inv (S.cmp\<^sub>U\<^sub>P (trg g, g)))
  S.seq
   ((S.UP g \<star>\<^sub>S
     S.UP \<epsilon> \<cdot>\<^sub>S
     S.cmp\<^sub>U\<^sub>P (f, g)) \<cdot>\<^sub>S
    (S.inv (S.cmp\<^sub>U\<^sub>P (g, f)) \<cdot>\<^sub>S
     S.UP \<eta> \<star>\<^sub>S
     S.UP g))
   (S.inv (S.cmp\<^sub>U\<^sub>P (trg g, g)))
  S.seq
   ((S.UP g \<star>\<^sub>S UP.unit (src g)) \<cdot>\<^sub>S
    (S.inv (UP.unit (trg g)) \<star>\<^sub>S S.UP g))
   (S.inv (S.cmp\<^sub>U\<^sub>P (trg g, g)))

goal (1 subgoal):
 1. (S.UP g \<star>\<^sub>S
     S.UP \<epsilon> \<cdot>\<^sub>S
     S.cmp\<^sub>U\<^sub>P (f, g)) \<cdot>\<^sub>S
    (S.inv (S.cmp\<^sub>U\<^sub>P (g, f)) \<cdot>\<^sub>S
     S.UP \<eta> \<star>\<^sub>S
     S.UP g) =
    (S.UP g \<star>\<^sub>S UP.unit (src g)) \<cdot>\<^sub>S
    (S.inv (UP.unit (trg g)) \<star>\<^sub>S S.UP g)


proof (state)
this:
  U <#> V <#> inv\<^bsub>G Mod N\<^esub> U =
  N #> g <#> (N #> h) <#> (N #> inv g)

goal (1 subgoal):
 1. U <#> V <#> inv\<^bsub>G Mod N\<^esub> U =
    N #> g \<otimes> h \<otimes> inv g


proof (prove)
goal (2 subgoals):
 1. \<And>n g v v'.
       \<lbrakk>CFG_SSA_Transformed \<alpha>e \<alpha>n invar inEdges Entry
                 oldDefs oldUses defs (\<lambda>g. lookup_multimap (uses g))
                 (\<lambda>g. Mapping.lookup (phis g)) var;
        \<And>g. Mapping.keys (uses g) \<subseteq> set (\<alpha>n g);
        n \<in> set (\<alpha>n g); v \<in> allDefs g n;
        v' \<in> allDefs g n; v \<noteq> v'\<rbrakk>
       \<Longrightarrow> var g v' \<noteq> var g v
 2. \<And>g.
       \<lbrakk>CFG_SSA_Transformed \<alpha>e \<alpha>n invar inEdges Entry
                 oldDefs oldUses defs (\<lambda>g. lookup_multimap (uses g))
                 (\<lambda>g. Mapping.lookup (phis g)) var;
        \<And>g.
           Mapping.keys (uses g) \<subseteq> set (\<alpha>n g)\<rbrakk>
       \<Longrightarrow> Mapping.keys (uses g) \<subseteq> set (\<alpha>n g)


proof (prove)
using this:
  s \<notin> directed_towards S2 (SIGMA x:S\<^sub>r. set_pmf (ct x))
  s \<in> S\<^sub>r
  \<lbrakk>simple ct t \<in> valid_cfg; v (simple ct t) \<noteq> 0\<rbrakk>
  \<Longrightarrow> state (simple ct t) \<in> S\<^sub>r \<union> S2
  \<lbrakk>s \<in> S; t \<in> set_pmf (ct s)\<rbrakk>
  \<Longrightarrow> t \<in> S
  cfg = simple ct t
  t \<in> set_pmf (ct s)
  s \<in> S

goal (1 subgoal):
 1. (\<exists>s.
        cfg = simple ct s \<and>
        s \<notin> directed_towards S2
                    (SIGMA x:S\<^sub>r. set_pmf (ct x)) \<and>
        s \<in> S\<^sub>r) \<or>
    v cfg = 0


proof (prove)
goal (1 subgoal):
 1. infinite (range \<nu>)


proof (prove)
using this:
  t1 = N0
  t \<in> U (Suc h)
  split_min t = Some (a, t')
  split_min t1 = None

goal (1 subgoal):
 1. t' \<in> Um (Suc h)


proof (prove)
using this:
  invar s_

goal (1 subgoal):
 1. Tree2.set_tree (Interval_Tree.insert x_ s_) =
    Tree2.set_tree s_ \<union> {x_}


proof (prove)
goal (1 subgoal):
 1. \<forall>\<^sub>F x in at_top. f x ^ n \<le> g x ^ n


proof (prove)
using this:
  II1 \<inter> II2 \<noteq> {}

goal (1 subgoal):
 1. False


proof (state)
this:
  Polynomial.smult a (\<Prod>a\<leftarrow>as. [:- a, 1::'a:]) =
  Polynomial.smult a (\<Prod>a\<leftarrow>bs. [:- a, 1::'a:])

goal (1 subgoal):
 1. mset as = mset bs


proof (prove)
using this:
  \<lbrakk>0 < s; s \<noteq> 1\<rbrakk>
  \<Longrightarrow> \<exists>c>0.
                       \<forall>x\<ge>1.
                          \<bar>sum_upto (\<lambda>x. real x powr - s) x -
                                (x powr (1 - s) / (1 - s) +
                                 Re (zeta (complex_of_real s)))\<bar>
                          \<le> c * x powr - s
  1 < s
  \<zeta> \<equiv> Re (zeta (complex_of_real s))

goal (1 subgoal):
 1. (\<And>c.
        \<lbrakk>0 < c;
         \<forall>x\<ge>1.
            \<bar>sum_upto (\<lambda>x. real x powr - s) x -
                  (x powr (1 - s) / (1 - s) + \<zeta>)\<bar>
            \<le> c * x powr - s\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. (lookup t k = Some v) = ((k, v) \<in> set (entries t))


proof (prove)
goal (1 subgoal):
 1. (RETURN \<circ>\<circ>\<circ> f,
     \<lambda>x y z.
        ASSERT (P x y z) \<bind> (\<lambda>_. RETURN (f x y z)))
    \<in> Id \<rightarrow>
          Id \<rightarrow> Id \<rightarrow> \<langle>Id\<rangle>nres_rel


proof (prove)
using this:
  trg\<^sub>C g = src\<^sub>C f
  src\<^sub>C g = trg\<^sub>C f
  \<lbrakk>D.arr ?f; D.dom ?f = ?a\<rbrakk>
  \<Longrightarrow> ?f \<cdot>\<^sub>D ?a = ?f
  \<lbrakk>D.arr ?f; D.cod ?f = ?b\<rbrakk>
  \<Longrightarrow> ?b \<cdot>\<^sub>D ?f = ?f

goal (1 subgoal):
 1. F ((f \<star>\<^sub>C g) \<star>\<^sub>C f) \<cdot>\<^sub>D
    F \<a>\<^sub>C\<^sup>-\<^sup>1[f, g, f] \<cdot>\<^sub>D
    F (f \<star>\<^sub>C g \<star>\<^sub>C f) =
    F \<a>\<^sub>C\<^sup>-\<^sup>1[f, g, f]


proof (prove)
goal (1 subgoal):
 1. \<And>x.
       x \<in> topspace X \<Longrightarrow>
       \<exists>j.
          j \<in> I \<and>
          x \<in> T j \<and>
          f (SOME i. i \<in> I \<and> x \<in> T i) x = f j x


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>atom
              l \<sharp> ((s, k, x, y, x', y', v, i), sl, sl', m, n, sm,
                          sm', sn, sn');
     atom
      sl \<sharp> ((s, k, x, y, x', y', v, i), sl', m, n, sm, sm', sn, sn');
     atom sl' \<sharp> ((s, k, x, y, x', y', v, i), m, n, sm, sm', sn, sn');
     atom m \<sharp> ((s, k, x, y, x', y', v, i), n, sm, sm', sn, sn');
     atom n \<sharp> ((s, k, x, y, x', y', v, i), sm, sm', sn, sn');
     atom sm \<sharp> ((s, k, x, y, x', y', v, i), sm', sn, sn');
     atom sm' \<sharp> ((s, k, x, y, x', y', v, i), sn, sn');
     atom sn \<sharp> ((s, k, x, y, x', y', v, i), sn');
     atom sn' \<sharp> (s, k, x, y, x', y', v, i);
     atom s \<sharp> (k, x, y, x', y', v, i);
     atom k \<sharp> (x, y, x', y', v, i)\<rbrakk>
    \<Longrightarrow> {Var l EQ Zero, SubstTermP v i x x',
                       SubstTermP v i y y'} \<turnstile>
                      SubstAtomicP v i (Q_Eq x y) (Q_Eq x' y') OR
                      SyntaxN.Ex m
                       (SyntaxN.Ex n
                         (SyntaxN.Ex sm
                           (SyntaxN.Ex sm'
                             (SyntaxN.Ex sn
                               (SyntaxN.Ex sn'
                                 (Var m IN Var l AND
                                  Var n IN Var l AND
                                  HPair (Var m)
                                   (HPair (Var sm) (Var sm')) IN
                                  Eats Zero
                                   (HPair Zero
                                     (HPair (Q_Eq x y) (Q_Eq x' y'))) AND
                                  HPair (Var n)
                                   (HPair (Var sn) (Var sn')) IN
                                  Eats Zero
                                   (HPair Zero
                                     (HPair (Q_Eq x y) (Q_Eq x' y'))) AND
                                  (Q_Eq x y EQ Q_Disj (Var sm) (Var sn) AND
                                   Q_Eq x' y' EQ
                                   Q_Disj (Var sm') (Var sn') OR
                                   Q_Eq x y EQ Q_Neg (Var sm) AND
                                   Q_Eq x' y' EQ Q_Neg (Var sm') OR
                                   Q_Eq x y EQ Q_Ex (Var sm) AND
                                   Q_Eq x' y' EQ Q_Ex (Var sm'))))))))


proof (prove)
goal (1 subgoal):
 1. mset_neg (abs_zmultiset (Mp, Mn)) = Mn - Mp


proof (prove)
using this:
  \<lbrakk>measure_pmf.random_variable M (count_space UNIV) g;
   f \<in> borel_measurable (count_space UNIV)\<rbrakk>
  \<Longrightarrow> integral\<^sup>L
                     (distr (measure_pmf M) (count_space UNIV) g) f =
                    measure_pmf.expectation M (\<lambda>x. f (g x))

goal (1 subgoal):
 1. integral\<^sup>L (distr (measure_pmf M) (count_space UNIV) g) f =
    measure_pmf.expectation M (\<lambda>x. f (g x))


proof (prove)
goal (6 subgoals):
 1. \<And>\<Gamma> exp c.
       \<lbrakk>atom ` domA \<Gamma> \<sharp>* c;
        \<And>c. \<forall>(x, e)\<in>set \<Gamma>. P c e;
        \<And>c. P c exp\<rbrakk>
       \<Longrightarrow> P c (Let \<Gamma> exp)
 2. \<And>var exp c.
       \<lbrakk>{atom var} \<sharp>* c; \<And>c. P c exp\<rbrakk>
       \<Longrightarrow> P c (Lam [var]. exp)
 3. \<And>b c. P c (Bool b)
 4. \<And>scrut e1 e2 c.
       \<lbrakk>\<And>c. P c scrut; \<And>c. P c e1;
        \<And>c. P c e2\<rbrakk>
       \<Longrightarrow> P c (scrut ? e1 : e2)
 5. \<And>c. \<forall>(x, e)\<in>set []. P c e
 6. \<And>var exp \<Gamma> c.
       \<lbrakk>\<And>c. P c exp;
        \<And>c. \<forall>(x, e)\<in>set \<Gamma>. P c e\<rbrakk>
       \<Longrightarrow> \<forall>(x, e)\<in>set ((var, exp) # \<Gamma>).
                            P c e


proof (prove)
using this:
  g = 0

goal (1 subgoal):
 1. f = 0 &&& c = 0 &&& fs = []


proof (prove)
using this:
  x \<noteq> y
  card x = 1
  card y = 1

goal (1 subgoal):
 1. x \<inter> y = {}


proof (prove)
goal (1 subgoal):
 1. distributed M S (\<lambda>x. (X x, Y x)) (\<lambda>x. ennreal (P x))


proof (prove)
using this:
  0 < p * q
  2 ^ (length (nat_to_bv (p * q)) - Suc 0) \<noteq> p * q

goal (1 subgoal):
 1. 2 ^ (length (nat_to_bv (p * q)) - Suc 0) < p * q


proof (prove)
goal (1 subgoal):
 1. (\<And>p.
        \<lbrakk>p \<in> cball a r;
         \<And>y.
            y \<in> cball a r \<Longrightarrow>
            cmod (g y) \<le> cmod (g p)\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. f x \<le> (\<lambda>s. emeasure (M s) {x \<in> space N. F top x})


proof (prove)
goal (1 subgoal):
 1. lower (arctan_float_interval p x) = lb_arctan p (lower x)


proof (prove)
using this:
  split_vals_e xs = (as, bs)

goal (1 subgoal):
 1. xs = ($$* as) @ bs


proof (prove)
using this:
  U.Problem TE_wtFsym wtPsym (length \<circ> TE_arOf) (length \<circ> parOf)
   TE_\<Phi> \<and>
  U.Struct TE_wtFsym wtPsym (length \<circ> TE_arOf) (length \<circ> parOf)
   D eintF eintP \<and>
  U.Model_axioms TE_\<Phi> D eintF eintP

goal (1 subgoal):
 1. M_Problem TE_wtFsym wtPsym TE_arOf TE_resOf parOf TE_\<Phi> \<and>
    (M_Signature TYPE('tp) TE_wtFsym wtPsym \<and>
     U.Struct TE_wtFsym wtPsym (length \<circ> TE_arOf)
      (length \<circ> parOf) D eintF eintP) \<and>
    U.Problem TE_wtFsym wtPsym (length \<circ> TE_arOf)
     (length \<circ> parOf) TE_\<Phi> \<and>
    U.Struct TE_wtFsym wtPsym (length \<circ> TE_arOf)
     (length \<circ> parOf) D eintF eintP \<and>
    U.Model_axioms TE_\<Phi> D eintF eintP


proof (prove)
using this:
  k < n
  ?x < ?y \<Longrightarrow>
  max_stutter_sampler ?\<sigma>1 ?x < max_stutter_sampler ?\<sigma>1 ?y

goal (1 subgoal):
 1. max_stutter_sampler \<sigma> k < max_stutter_sampler \<sigma> n


proof (prove)
goal (2 subgoals):
 1. reflp (\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h')
 2. transp (\<lambda>h h'. object_ptr_kinds h = object_ptr_kinds h')


proof (prove)
goal (1 subgoal):
 1. map f xs \<bind> g = xs \<bind> g \<circ> f


proof (prove)
goal (1 subgoal):
 1. P\<^sup>\<star> \<sqsubseteq> II \<sqinter> (P ;; P\<^sup>\<star>)


proof (prove)
goal (1 subgoal):
 1. concat
     (map (\<lambda>n. if P (l ! n) then [n] else [])
       [0..<length l]) \<noteq>
    []


proof (prove)
goal (1 subgoal):
 1. \<exists>cs.
       (\<forall>c\<in>set cs.
           c \<in> carrier G \<and> irreducible G c) \<and>
       fmset G cs = Cs


proof (prove)
goal (1 subgoal):
 1. map f (take n xs) \<preceq> map f xs


proof (prove)
using this:
  p = q
  prime ?p \<Longrightarrow> 1 < ?p
  fst (p, m) ^ snd (p, m) = fst (q, n) ^ snd (q, n)
  0 < m
  prime p
  0 < n
  prime q

goal (1 subgoal):
 1. m = n


proof (prove)
using this:
  Obtuse A' B C

goal (1 subgoal):
 1. A B C LtA A' B C


proof (prove)
using this:
  sets x = sets y

goal (1 subgoal):
 1. y \<le> sup_measure' x y


proof (prove)
goal (1 subgoal):
 1. \<Sqinter> range f \<le> (\<Sqinter>n. f (Suc n))


proof (prove)
goal (1 subgoal):
 1. locally_trans R (A - B) (C - D) (E - F)


proof (prove)
goal (1 subgoal):
 1. bij (rsuml \<circ> map_sum swap_sum id \<circ> lsumr)


proof (prove)
goal (1 subgoal):
 1. \<And>z za.
       \<lbrakk>\<forall>v.
                   (v \<^bold>\<in> RPb) =
                   (\<exists>u\<le>b. v = u \<triangleleft> a);
        \<forall>u. (u \<^bold>\<in> Pb) = (u \<le> b);
        \<forall>v.
           (v \<^bold>\<in> RPb) =
           (\<exists>u. u \<^bold>\<in> Pb \<and> v = u \<triangleleft> a);
        \<forall>u. (u \<^bold>\<in> Pb) = (u \<le> b);
        \<forall>u.
           (u \<^bold>\<in> z) =
           (u \<le> b \<or> (\<exists>ua\<le>b. u = ua \<triangleleft> a));
        \<forall>u.
           (u \<^bold>\<in> za) =
           (u \<^bold>\<in> Pb \<or> u \<^bold>\<in> RPb)\<rbrakk>
       \<Longrightarrow> \<forall>u.
                            (u \<^bold>\<in> z) =
                            (u \<le> b \<or>
                             (\<exists>ua.
                                 ua \<triangleleft> a = u \<and>
                                 a \<^bold>\<notin> ua \<and> ua \<le> b))


proof (chain)
picking this:
  inv\<^bsub>K\<^esub> a \<otimes>\<^bsub>K\<^esub> a =
  \<one>\<^bsub>K\<^esub>


proof (prove)
goal (1 subgoal):
 1. len m k j bs < len m k j ys


proof (prove)
using this:
  (\<Sum>s\<in>set (map (consistent_sign_vec qs)
                     (characterize_root_list_p p)) \<inter>
               {s. z_R I s = 1}.
     z_R I s *
     rat_of_int
      (int (card {x. poly p x = 0 \<and> consistent_sign_vec qs x = s}))) =
  rat_of_int
   (int (card
          {x. poly p x = 0 \<and>
              (\<forall>p\<in>set (retrieve_polys qs (fst I)).
                  poly p x = 0) \<and>
              0 < poly (prod_list (retrieve_polys qs (snd I))) x}))
  (\<Sum>s\<in>set (map (consistent_sign_vec qs)
                     (characterize_root_list_p p)) \<inter>
               {s. z_R I s = - 1}.
     z_R I s *
     rat_of_int
      (int (card {x. poly p x = 0 \<and> consistent_sign_vec qs x = s}))) =
  - rat_of_int
     (int (card
            {x. poly p x = 0 \<and>
                (\<forall>p\<in>set (retrieve_polys qs (fst I)).
                    poly p x = 0) \<and>
                poly (prod_list (retrieve_polys qs (snd I))) x < 0}))
  (\<Sum>s\<in>set (map (consistent_sign_vec qs)
                     (characterize_root_list_p p)) \<inter>
               {s. z_R I s = 0}.
     z_R I s *
     rat_of_int
      (int (card {x. poly p x = 0 \<and> consistent_sign_vec qs x = s}))) =
  0
  (\<Sum>s\<in>set (map (consistent_sign_vec qs)
                     (characterize_root_list_p p)) \<inter>
               {s. z_R I s = 1} \<union>
               set (map (consistent_sign_vec qs)
                     (characterize_root_list_p p)) \<inter>
               {s. z_R I s = - 1}.
     z_R I s *
     rat_of_int
      (int (card {x. poly p x = 0 \<and> consistent_sign_vec qs x = s}))) +
  (\<Sum>s\<in>set (map (consistent_sign_vec qs)
                     (characterize_root_list_p p)) \<inter>
               {s. z_R I s = 0}.
     z_R I s *
     rat_of_int
      (int (card {x. poly p x = 0 \<and> consistent_sign_vec qs x = s}))) =
  (\<Sum>s\<in>set (map (consistent_sign_vec qs)
                     (characterize_root_list_p p)) \<inter>
               {s. z_R I s = 1}.
     z_R I s *
     rat_of_int
      (int (card {x. poly p x = 0 \<and> consistent_sign_vec qs x = s}))) +
  (\<Sum>s\<in>set (map (consistent_sign_vec qs)
                     (characterize_root_list_p p)) \<inter>
               {s. z_R I s = - 1}.
     z_R I s *
     rat_of_int
      (int (card {x. poly p x = 0 \<and> consistent_sign_vec qs x = s}))) +
  (\<Sum>s\<in>set (map (consistent_sign_vec qs)
                     (characterize_root_list_p p)) \<inter>
               {s. z_R I s = 0}.
     z_R I s *
     rat_of_int
      (int (card {x. poly p x = 0 \<and> consistent_sign_vec qs x = s})))

goal (1 subgoal):
 1. vec_of_list (mtx_row_R signs I) \<bullet>
    construct_lhs_vector_R p qs signs =
    rat_of_int
     (int (card
            {x. poly p x = 0 \<and>
                (\<forall>p\<in>set (retrieve_polys qs (fst I)).
                    poly p x = 0) \<and>
                0 < poly (prod_list (retrieve_polys qs (snd I))) x})) -
    rat_of_int
     (int (card
            {x. poly p x = 0 \<and>
                (\<forall>p\<in>set (retrieve_polys qs (fst I)).
                    poly p x = 0) \<and>
                poly (prod_list (retrieve_polys qs (snd I))) x < 0}))


proof (prove)
goal (1 subgoal):
 1. (\<And>t s.
        L = Pos (Eq t s) \<or> L = Neg (Eq t s) \<Longrightarrow>
        thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. (m, n) \<in> Le_enat \<Longrightarrow> m \<le> n


proof (prove)
goal (1 subgoal):
 1. B C D' CongA C B E


proof (prove)
using this:
  atom x \<sharp> u'
  atom x \<sharp> e\<^sub>1
  atom x \<sharp> e\<^sub>1'
  \<lless>[], Syntax.Let e\<^sub>1 x
               e\<^sub>2\<ggreater> I\<rightarrow> \<lless>[], u'\<ggreater>
  value e\<^sub>1 \<Longrightarrow> False

goal (1 subgoal):
 1. Syntax.Let e\<^sub>1' x e\<^sub>2 = u'


proof (prove)
using this:
  map_pmf (snd \<circ> snd)
   (config'_rand BIT
     (fst BIT ?s0.0 \<bind> (\<lambda>is. return_pmf (?s0.0, is))) ?qs) =
  return_pmf ?s0.0 \<and>
  map_pmf (fst \<circ> snd)
   (config'_rand BIT
     (fst BIT ?s0.0 \<bind> (\<lambda>is. return_pmf (?s0.0, is))) ?qs) =
  bv (length ?s0.0)

goal (1 subgoal):
 1. map_pmf (fst \<circ> snd)
     (config'_rand BIT
       (fst BIT s0 \<bind> (\<lambda>is. return_pmf (s0, is))) qs) =
    bv (length s0)


proof (prove)
using this:
  \<lbrakk>?G1.0 \<in> \<G>; ?G2.0 \<in> \<G>; ?G1.0 \<noteq> ?G2.0;
   ?x \<in> ?G1.0; ?y \<in> ?G2.0\<rbrakk>
  \<Longrightarrow> int (\<B> index {?x, ?y}) = \<Lambda>

goal (1 subgoal):
 1. \<lbrakk>ps \<subseteq> \<V>; card ps = 2;
     \<And>G.
        G \<in> \<G> \<Longrightarrow> \<not> ps \<subseteq> G\<rbrakk>
    \<Longrightarrow> int (\<B> index ps) = \<Lambda>


proof (prove)
using this:
  At i xs \<in># \<Gamma> + \<Gamma>' \<and>
  At i xs \<in># \<Delta> + \<Delta>'

goal (1 subgoal):
 1. ( \<Gamma> + \<Gamma>' \<Rightarrow>* \<Delta> + \<Delta>', 0)
    \<in> derivable  R*


proof (prove)
using this:
  \<Psi> \<rhd> M\<lparr>\<lambda>*p \<bullet>
                                   xvec p \<bullet>
  N\<rparr>.p \<bullet>
            P \<longmapsto> K\<lparr>(p \<bullet>
N)[(p \<bullet>
    xvec)::=Tvec]\<rparr> \<prec> (p \<bullet> P)[(p \<bullet> xvec)::=Tvec]

goal (1 subgoal):
 1. \<Psi> \<rhd> M\<lparr>\<lambda>*xvec N\<rparr>.P \<longmapsto> K\<lparr>N[xvec::=Tvec]\<rparr> \<prec> P[xvec::=Tvec]


proof (prove)
using this:
  yun_rel ?F ?c ?f \<Longrightarrow> yun_rel (?F ^ ?n) (?c ^ ?n) (?f ^ ?n)

goal (1 subgoal):
 1. \<exists>c. yun_rel F c f \<Longrightarrow>
    \<exists>c. yun_rel (F ^ n) c (f ^ n)


proof (prove)
using this:
  ?e \<in> E \<Longrightarrow>
  fst (trace_core' core1 p tr) ?e = fst (trace_core' core2 q tr) ?e
  ?ia \<in> IA \<Longrightarrow>
  fst (snd (trace_core' core1 p tr)) ?ia =
  fst (snd (trace_core' core2 q tr)) ?ia
  ?iu \<in> IU \<Longrightarrow>
  snd (snd (trace_core' core1 p tr)) ?iu =
  snd (snd (trace_core' core2 q tr)) ?iu
  p' = trace_core_aux core1 p tr
  q' = trace_core_aux core2 q tr

goal (1 subgoal):
 1. (e \<in> E \<Longrightarrow>
     weight_spmf (p' \<bind> (\<lambda>s. cpoke core1 s e)) =
     weight_spmf (q' \<bind> (\<lambda>s. cpoke core2 s e))) &&&
    (ia \<in> IA \<Longrightarrow>
     p' \<bind> (\<lambda>s1. map_spmf fst (cfunc_adv core1 s1 ia)) =
     q' \<bind> (\<lambda>s2. map_spmf fst (cfunc_adv core2 s2 ia))) &&&
    (iu \<in> IU \<Longrightarrow>
     p' \<bind> (\<lambda>s1. map_spmf fst (cfunc_usr core1 s1 iu)) =
     q' \<bind> (\<lambda>s2. map_spmf fst (cfunc_usr core2 s2 iu)))


proof (prove)
goal (1 subgoal):
 1. P Q OS A C


proof (prove)
using this:
  steps0 (Suc 0, l, r) (tp @ shift (mopup n) off) stp =
  (Suc off, Bk # Bk # ires, <am> @ Bk \<up> k)
  steps0 (Suc 0 + off, Bk # Bk # ires, <am> @ Bk \<up> k)
   (tp @ shift (mopup n) off) stpb =
  (0, Bk \<up> i @ Bk # Bk # ires, Oc # Oc \<up> rs @ Bk \<up> j)

goal (1 subgoal):
 1. \<exists>stp i j.
       steps0 (Suc 0, l, r) (tp @ shift (mopup n) off) stp =
       (0, Bk \<up> i @ Bk # Bk # ires, Oc \<up> Suc rs @ Bk \<up> j)


proof (state)
this:
  length x = DIM('h)

goal (1 subgoal):
 1. \<And>aa a'a x y z.
       \<lbrakk>(aa, a'a) \<in> \<langle>lv_rel\<rangle>sctn_rel;
        (x, y) \<in> appr_rell;
        (y, z) \<in> \<langle>lv_rel\<rangle>set_rel\<rbrakk>
       \<Longrightarrow> ((nres_of o2 inter_appr_plane ops optns) x aa,
                          inter_sctn_spec z a'a)
                         \<in> \<langle>appr_rell O
  \<langle>lv_rel\<rangle>set_rel\<rangle>nres_rel


proof (prove)
using this:
  u < Suc u
  sgn1 (sf (u + 1) - u) \<noteq> 0

goal (1 subgoal):
 1. b_least2 (\<lambda>u z. sgn1 (sf (z + 1) - u)) u (Suc u) =
    (LEAST z. sgn1 (sf (z + 1) - u) \<noteq> 0)


proof (prove)
using this:
  eventually ((<) 0) sequentially
  \<lbrakk>0 < ?n; ?z \<notin> \<int>\<^sub>\<le>\<^sub>0\<rbrakk>
  \<Longrightarrow> exp (ln_Gamma_series ?z ?n) = Gamma_series ?z ?n
  z \<notin> \<int>\<^sub>\<le>\<^sub>0

goal (1 subgoal):
 1. \<forall>\<^sub>F n in sequentially.
       exp (- ln_Gamma_series z n) = rGamma_series z n


proof (prove)
using this:
  y \<in> \<Inter> I

goal (1 subgoal):
 1. \<forall>S\<in>I. y \<in> S


proof (prove)
goal (1 subgoal):
 1. row A i \<bullet> col C j \<succ> row B i \<bullet> col C j


proof (prove)
using this:
  M (rinit rest1) (rinit rest2)
  (S ===> IA ===> rel_spmf (rel_prod (rel_prod OA (list_all2 E)) S))
   (rfunc_adv rest1) (rfunc_adv rest2)
  (S ===> IU ===> rel_spmf (rel_prod (rel_prod OU (list_all2 E)) S))
   (rfunc_usr rest1) (rfunc_usr rest2)

goal (1 subgoal):
 1. rel_rest' S E IA IU OA OU M rest1 rest2


proof (prove)
using this:
  finite A
  ?i \<in> A \<Longrightarrow> convex (B ?i)

goal (1 subgoal):
 1. convex (sum B A)


proof (prove)
goal (7 subgoals):
 1. \<And>\<Gamma>.
       is_nnf_mset \<Gamma> \<Longrightarrow> is_disj (disj_of_clause R')
 2. \<And>\<Gamma>.
       is_nnf_mset \<Gamma> \<Longrightarrow>
       is_nnf \<^bold>\<And>map disj_of_clause S'
 3. \<And>\<Gamma> x xa.
       \<lbrakk>is_nnf_mset \<Gamma>; x \<in> cnf (disj_of_clause R');
        x \<notin> {}; xa \<in> x\<rbrakk>
       \<Longrightarrow> xa \<in> R
 4. \<And>\<Gamma> x xa.
       \<lbrakk>is_nnf_mset \<Gamma>; x \<in> cnf (disj_of_clause R');
        x \<notin> {}; xa \<in> R\<rbrakk>
       \<Longrightarrow> xa \<in> x
 5. \<And>\<Gamma> x.
       is_nnf_mset \<Gamma> \<Longrightarrow>
       R \<in> cnf (disj_of_clause R')
 6. \<And>\<Gamma> x.
       \<lbrakk>is_nnf_mset \<Gamma>;
        x \<in> cnf \<^bold>\<And>map disj_of_clause S'\<rbrakk>
       \<Longrightarrow> x \<in> S
 7. \<And>\<Gamma>.
       \<lbrakk>is_nnf_mset \<Gamma>;
        disj_of_clause
         R', \<^bold>\<And>map disj_of_clause
                            S', \<Gamma> \<Rightarrow>\<^sub>n\<rbrakk>
       \<Longrightarrow> \<^bold>\<And>map disj_of_clause
  S', \<Gamma> \<Rightarrow>\<^sub>n


proof (prove)
using this:
  Tree2.set_tree (inter_rbt (list_to_rbt ?xs2) (list_to_rbt ?xs1)) =
  Tree2.set_tree (list_to_rbt ?xs2) \<inter>
  Tree2.set_tree (list_to_rbt ?xs1)

goal (1 subgoal):
 1. dimacs_model ls cs =
    (let tls = list_to_rbt ls
     in (\<forall>c\<in>set cs.
            size (inter_rbt tls (list_to_rbt c)) \<noteq> 0) \<and>
        distinct (map dimacs_lit_to_var ls))


proof (prove)
goal (1 subgoal):
 1. \<And>x xa xb xc xd.
       \<lbrakk>heap_is_wellformed h; type_wf h; known_ptrs h;
        h \<turnstile> get_owner_document ptr \<rightarrow>\<^sub>r x;
        h \<turnstile> get_disconnected_nodes x \<rightarrow>\<^sub>r xa;
        h \<turnstile> to_tree_order
                        (cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r
                          x)
        \<rightarrow>\<^sub>r xb;
        h \<turnstile> map_M
                        (to_tree_order \<circ>
                         cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r)
                        xa
        \<rightarrow>\<^sub>r xc;
        sc = xb @ concat xc; xd \<in> set xc; ptr' \<in> set xd\<rbrakk>
       \<Longrightarrow> ptr' |\<in>| object_ptr_kinds h


proof (prove)
goal (2 subgoals):
 1. \<And>x.
       \<lbrakk>finite A; card A = Suc 0; A \<noteq> {}; x \<in> A\<rbrakk>
       \<Longrightarrow> \<exists>f.
                            f \<in> {0} \<rightarrow> A \<and>
                            surj_to f {0} A
 2. \<lbrakk>finite A; card A = Suc 0; A \<noteq> {}\<rbrakk>
    \<Longrightarrow> A \<noteq> {}


proof (prove)
goal (1 subgoal):
 1. (((f \<star> g \<star> h) \<star>
      arrow_of_spans_of_maps.the_\<theta> (\<cdot>) (\<star>)
       (tab\<^sub>0 h \<star> fg\<^sub>0h\<^sub>1.p\<^sub>0)
       ((tab\<^sub>0 h \<star> g\<^sub>0h\<^sub>1.p\<^sub>0) \<star>
        f\<^sub>0gh\<^sub>1.p\<^sub>0)
       (arrow_of_tabulations_in_maps.chine (\<cdot>) (\<star>) \<a> \<i> src
         trg
         (\<a>\<^sup>-\<^sup>1[f \<star>
                               g, h, tab\<^sub>0 h \<star>
                                     fg\<^sub>0h\<^sub>1.p\<^sub>0] \<cdot>
          ((f \<star> g) \<star>
           \<a>[h, tab\<^sub>0 h, fg\<^sub>0h\<^sub>1.p\<^sub>0]) \<cdot>
          ((f \<star> g) \<star>
           h.tab \<star> fg\<^sub>0h\<^sub>1.p\<^sub>0) \<cdot>
          ((f \<star> g) \<star> fg\<^sub>0h\<^sub>1.\<phi>) \<cdot>
          \<a>[f \<star>
               g, tab\<^sub>0 g \<star>
                  f\<^sub>0g\<^sub>1.p\<^sub>0, fg\<^sub>0h\<^sub>1.p\<^sub>1] \<cdot>
          (Tfg.\<rho>\<sigma>.tab \<star> fg\<^sub>0h\<^sub>1.p\<^sub>1))
         (tab\<^sub>0 h \<star> fg\<^sub>0h\<^sub>1.p\<^sub>0)
         (f \<star> g \<star> h) TfTgh.tab
         ((tab\<^sub>0 h \<star> g\<^sub>0h\<^sub>1.p\<^sub>0) \<star>
          f\<^sub>0gh\<^sub>1.p\<^sub>0)
         (tab\<^sub>1 f \<star> f\<^sub>0gh\<^sub>1.p\<^sub>1)
         \<a>[f, g, h])) \<cdot>
     \<a>[f \<star>
          g \<star>
          h, (tab\<^sub>0 h \<star> g\<^sub>0h\<^sub>1.p\<^sub>0) \<star>
             f\<^sub>0gh\<^sub>1.p\<^sub>0, arrow_of_tabulations_in_maps.chine
       (\<cdot>) (\<star>) \<a> \<i> src trg
       (\<a>\<^sup>-\<^sup>1[f \<star>
                             g, h, tab\<^sub>0 h \<star>
                                   fg\<^sub>0h\<^sub>1.p\<^sub>0] \<cdot>
        ((f \<star> g) \<star>
         \<a>[h, tab\<^sub>0 h, fg\<^sub>0h\<^sub>1.p\<^sub>0]) \<cdot>
        ((f \<star> g) \<star>
         h.tab \<star> fg\<^sub>0h\<^sub>1.p\<^sub>0) \<cdot>
        ((f \<star> g) \<star> fg\<^sub>0h\<^sub>1.\<phi>) \<cdot>
        \<a>[f \<star>
             g, tab\<^sub>0 g \<star>
                f\<^sub>0g\<^sub>1.p\<^sub>0, fg\<^sub>0h\<^sub>1.p\<^sub>1] \<cdot>
        (Tfg.\<rho>\<sigma>.tab \<star> fg\<^sub>0h\<^sub>1.p\<^sub>1))
       (tab\<^sub>0 h \<star> fg\<^sub>0h\<^sub>1.p\<^sub>0)
       (f \<star> g \<star> h) TfTgh.tab
       ((tab\<^sub>0 h \<star> g\<^sub>0h\<^sub>1.p\<^sub>0) \<star>
        f\<^sub>0gh\<^sub>1.p\<^sub>0)
       (tab\<^sub>1 f \<star> f\<^sub>0gh\<^sub>1.p\<^sub>1)
       \<a>[f, g, h]] \<cdot>
     (TfTgh.tab \<star>
      arrow_of_tabulations_in_maps.chine (\<cdot>) (\<star>) \<a> \<i> src
       trg
       (\<a>\<^sup>-\<^sup>1[f \<star>
                             g, h, tab\<^sub>0 h \<star>
                                   fg\<^sub>0h\<^sub>1.p\<^sub>0] \<cdot>
        ((f \<star> g) \<star>
         \<a>[h, tab\<^sub>0 h, fg\<^sub>0h\<^sub>1.p\<^sub>0]) \<cdot>
        ((f \<star> g) \<star>
         h.tab \<star> fg\<^sub>0h\<^sub>1.p\<^sub>0) \<cdot>
        ((f \<star> g) \<star> fg\<^sub>0h\<^sub>1.\<phi>) \<cdot>
        \<a>[f \<star>
             g, tab\<^sub>0 g \<star>
                f\<^sub>0g\<^sub>1.p\<^sub>0, fg\<^sub>0h\<^sub>1.p\<^sub>1] \<cdot>
        (Tfg.\<rho>\<sigma>.tab \<star> fg\<^sub>0h\<^sub>1.p\<^sub>1))
       (tab\<^sub>0 h \<star> fg\<^sub>0h\<^sub>1.p\<^sub>0)
       (f \<star> g \<star> h) TfTgh.tab
       ((tab\<^sub>0 h \<star> g\<^sub>0h\<^sub>1.p\<^sub>0) \<star>
        f\<^sub>0gh\<^sub>1.p\<^sub>0)
       (tab\<^sub>1 f \<star> f\<^sub>0gh\<^sub>1.p\<^sub>1)
       \<a>[f, g, h])) \<cdot>
    arrow_of_spans_of_maps.the_\<nu> (\<cdot>) (\<star>)
     ((tab\<^sub>1 f \<star> f\<^sub>0g\<^sub>1.p\<^sub>1) \<star>
      fg\<^sub>0h\<^sub>1.p\<^sub>1)
     (tab\<^sub>1 f \<star> f\<^sub>0gh\<^sub>1.p\<^sub>1)
     (arrow_of_tabulations_in_maps.chine (\<cdot>) (\<star>) \<a> \<i> src
       trg
       (\<a>\<^sup>-\<^sup>1[f \<star>
                             g, h, tab\<^sub>0 h \<star>
                                   fg\<^sub>0h\<^sub>1.p\<^sub>0] \<cdot>
        ((f \<star> g) \<star>
         \<a>[h, tab\<^sub>0 h, fg\<^sub>0h\<^sub>1.p\<^sub>0]) \<cdot>
        ((f \<star> g) \<star>
         h.tab \<star> fg\<^sub>0h\<^sub>1.p\<^sub>0) \<cdot>
        ((f \<star> g) \<star> fg\<^sub>0h\<^sub>1.\<phi>) \<cdot>
        \<a>[f \<star>
             g, tab\<^sub>0 g \<star>
                f\<^sub>0g\<^sub>1.p\<^sub>0, fg\<^sub>0h\<^sub>1.p\<^sub>1] \<cdot>
        (Tfg.\<rho>\<sigma>.tab \<star> fg\<^sub>0h\<^sub>1.p\<^sub>1))
       (tab\<^sub>0 h \<star> fg\<^sub>0h\<^sub>1.p\<^sub>0)
       (f \<star> g \<star> h) TfTgh.tab
       ((tab\<^sub>0 h \<star> g\<^sub>0h\<^sub>1.p\<^sub>0) \<star>
        f\<^sub>0gh\<^sub>1.p\<^sub>0)
       (tab\<^sub>1 f \<star> f\<^sub>0gh\<^sub>1.p\<^sub>1)
       \<a>[f, g, h]) =
    (\<a>[f, g, h] \<star>
     tab\<^sub>0 h \<star> fg\<^sub>0h\<^sub>1.p\<^sub>0) \<cdot>
    \<a>\<^sup>-\<^sup>1[f \<star>
                         g, h, tab\<^sub>0 h \<star>
                               fg\<^sub>0h\<^sub>1.p\<^sub>0] \<cdot>
    ((f \<star> g) \<star>
     \<a>[h, tab\<^sub>0 h, fg\<^sub>0h\<^sub>1.p\<^sub>0]) \<cdot>
    ((f \<star> g) \<star>
     h.tab \<star> fg\<^sub>0h\<^sub>1.p\<^sub>0) \<cdot>
    ((f \<star> g) \<star> fg\<^sub>0h\<^sub>1.\<phi>) \<cdot>
    \<a>[f \<star>
         g, tab\<^sub>0 g \<star>
            f\<^sub>0g\<^sub>1.p\<^sub>0, fg\<^sub>0h\<^sub>1.p\<^sub>1] \<cdot>
    (Tfg.\<rho>\<sigma>.tab \<star> fg\<^sub>0h\<^sub>1.p\<^sub>1)


proof (prove)
goal (1 subgoal):
 1. \<langle>i : opaodv
                  i \<langle>\<langle>\<^bsub>i\<^esub> qmsg : R\<rangle>\<^sub>o \<Turnstile>\<^sub>A (\<lambda>\<sigma>
                               _. oarrivemsg
                                   (\<lambda>\<sigma> m.
 msg_fresh \<sigma> m \<and> msg_zhops m)
                                   \<sigma>,
                            other quality_increases {i} \<rightarrow>)
                            globala
                             (\<lambda>(\<sigma>, a, \<sigma>').
                                 a \<noteq> \<tau> \<and>
                                 (\<forall>d.
                                     a \<noteq>
                                     i:deliver(d)) \<longrightarrow>
                                 \<sigma> i = \<sigma>' i)


proof (prove)
using this:
  \<Gamma> \<turnstile> App t1 t2 : T

goal (1 subgoal):
 1. \<exists>T'.
       \<Gamma> \<turnstile> t1 : T' \<rightarrow> T \<and>
       \<Gamma> \<turnstile> t2 : T'


proof (prove)
goal (1 subgoal):
 1. coreflexive
     ((f \<sqinter> - q) * (f \<sqinter> - q)\<^sup>T \<squnion>
      (f \<sqinter> - q) * (f \<sqinter> q) \<squnion>
      (f \<sqinter> - q) * e\<^sup>T \<squnion>
      (f \<sqinter> q)\<^sup>T * (f \<sqinter> - q)\<^sup>T \<squnion>
      (f \<sqinter> q)\<^sup>T * (f \<sqinter> q) \<squnion>
      (f \<sqinter> q)\<^sup>T * e\<^sup>T \<squnion>
      e * (f \<sqinter> - q)\<^sup>T \<squnion>
      e * (f \<sqinter> q) \<squnion>
      e * e\<^sup>T)


proof (state)
this:
  poss AA \<subseteq># map_clause f ?C \<Longrightarrow>
  \<exists>AA0. poss AA0 \<subseteq># ?C \<and> AA = image_mset f AA0
  poss (add_mset A AA) \<subseteq># map_clause f C

goal (2 subgoals):
 1. \<And>C.
       poss {#} \<subseteq># map_clause f C \<Longrightarrow>
       \<exists>AA0. poss AA0 \<subseteq># C \<and> {#} = image_mset f AA0
 2. \<And>x AA C.
       \<lbrakk>\<And>C.
                   poss AA \<subseteq># map_clause f C \<Longrightarrow>
                   \<exists>AA0.
                      poss AA0 \<subseteq># C \<and> AA = image_mset f AA0;
        poss (add_mset x AA) \<subseteq># map_clause f C\<rbrakk>
       \<Longrightarrow> \<exists>AA0.
                            poss AA0 \<subseteq># C \<and>
                            add_mset x AA = image_mset f AA0


proof (prove)
goal (2 subgoals):
 1. \<And>x y.
       x - y = Abs_bit1 ((Rep_bit1 x - Rep_bit1 y) mod int CARD('a bit1))
 2. \<And>x. - x = Abs_bit1 (- Rep_bit1 x mod int CARD('a bit1))


proof (prove)
goal (1 subgoal):
 1. partial_state.encode1 a.dims0 a.vars1'
     (partial_state.encode1 b.dims0 b.vars1' i) =
    partial_state.encode1 d.dims0 d.vars1' i


proof (prove)
goal (1 subgoal):
 1. (SUP F\<in>{F. finite F \<and> F \<subseteq> A}. ereal (sum f F)) =
    ereal (Sup (sum f ` {F. finite F \<and> F \<subseteq> A}))


proof (prove)
goal (1 subgoal):
 1. (\<lbrakk>r = get h a ! i; h' = update a i x h;
      i < Array.length h a\<rbrakk>
     \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (state)
this:
  ?u \<in> N2 \<Longrightarrow> (y, ?u) \<in> (edges T2)\<^sup>*

goal (1 subgoal):
 1. (\<And>T1 T2.
        \<lbrakk>tree T1; tree T2; nodes T1 \<inter> nodes T2 = {};
         nodes T = nodes T1 \<union> nodes T2;
         edges T1 \<union> edges T2 = E';
         nodes T1 = {u. (x, u) \<in> E'\<^sup>*};
         nodes T2 = {u. (y, u) \<in> E'\<^sup>*}; x \<in> nodes T1;
         y \<in> nodes T2\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. maintained
     (transl_rule (A_Cmp (A_Lbl idt) (A_Lbl idt) \<sqsubseteq> A_Lbl idt))
     G &&&
    maintained (transl_rule (A_Cnv (A_Lbl idt) \<sqsubseteq> A_Lbl idt))
     G &&&
    maintained
     (transl_rule
       (A_Cmp (A_Cmp (A_Lbl idt) (A_Lbl l)) (A_Lbl idt) \<sqsubseteq>
        A_Lbl l))
     G


proof (prove)
goal (1 subgoal):
 1. \<exists>n.
       is_final
        (steps0 (Suc 0, [], <m # args>) (t_wcode_prepare |+| t_wcode_main)
          n) \<and>
       (\<lambda>(l, r).
           l = Bk # Oc # Oc \<up> m \<and>
           (\<exists>ln rn.
               r =
               Bk #
               Oc #
               Bk \<up> ln @
               Bk #
               Bk #
               Oc \<up> bl_bin (<args>) @
               Bk \<up> rn)) holds_for steps0 (Suc 0, [], <m # args>)
  (t_wcode_prepare |+| t_wcode_main) n


proof (prove)
goal (1 subgoal):
 1. (\<And>l.
        \<lbrakk>\<forall>n. (\<Sum>i<2 * n. (- 1) ^ i * a i) \<le> l;
         (\<lambda>n. \<Sum>i<2 * n. (- 1) ^ i * a i)
         \<longlonglongrightarrow> l;
         \<forall>n. l \<le> (\<Sum>i<2 * n + 1. (- 1) ^ i * a i);
         (\<lambda>n. \<Sum>i<2 * n + 1. (- 1) ^ i * a i)
         \<longlonglongrightarrow> l\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. rho &[y1 // y]_ys &[z1 // z]_zs =
    rho &[z1 // z]_zs &[y1 @ys[z1 / z]_zs // y]_ys


proof (prove)
goal (1 subgoal):
 1. cmod (to_complex (moebius_pt (moebius_rotation \<phi>) u)) =
    cmod (to_complex u)


proof (prove)
using this:
  Unit \<rightarrow>\<beta> M'

goal (1 subgoal):
 1. False


proof (prove)
goal (1 subgoal):
 1. normalization_euclidean_semiring_class.Gcd = Gcd


proof (prove)
goal (1 subgoal):
 1. \<integral>\<^sup>+ generat.
                         (case generat of Pure x \<Rightarrow> f x
                          | IO out c \<Rightarrow>
                              \<Sqinter>r\<in>responses_\<I> \<I> out.
                                 expectation_gpv' (c r))
                       \<partial>measure_spmf (the_gpv gpv) +
    fail * ennreal (pmf (the_gpv gpv) None)
    \<le> expectation_gpv fail \<I>' f gpv


proof (prove)
goal (1 subgoal):
 1. (\<Sum>i\<le>degree (map_poly hom p).
        monom (monom (coeff (map_poly hom p) i) i) i) =
    map_poly (map_poly hom)
     (\<Sum>i\<le>degree p. monom (monom (coeff p i) i) i)


proof (prove)
goal (1 subgoal):
 1. (\<lambda>n. inf (F n x) (G n x))
    \<longlonglongrightarrow> (if x \<in> S then inf (f x) (g x)
                               else (0::'b))


proof (prove)
using this:
  u \<in> timpl_closure s TI
  u \<in> timpl_closure t TI
  set TI' = {(a, b). (a, b) \<in> TI\<^sup>+ \<and> a \<noteq> b}

goal (1 subgoal):
 1. equal_mod_timpls TI' s t


proof (prove)
goal (1 subgoal):
 1. prv (imp (eql t1 t2) (eql (suc t1) (suc t2)))


proof (prove)
using this:
  arr f
  X \<^bold>\<in> ide_to_hf (local.dom f)
  \<langle>X, Y\<rangle> \<^bold>\<in> arr_to_hfun f
  arr_to_hfun ?f =
  \<lbrace>XY \<^bold>\<in> ide_to_hf (local.dom ?f) * ide_to_hf (cod ?f).
   hsnd XY = DOWN (Fun ?f (UP (hfst XY)))\<rbrace>

goal (1 subgoal):
 1. Y = DOWN (Fun f (UP X))


proof (prove)
goal (1 subgoal):
 1. (\<Prod>i = 0..<k. A $$ (i, i)) dvd (\<Prod>i = 0..<k. A $$ (f i, f i))


proof (prove)
using this:
  set xs = {x. finfun_dom f(a $:= b) $ x}
  finfun_dom f $ a
  finfun_to_list f = insort_insert a xs

goal (1 subgoal):
 1. xs =
    (if b = finfun_default f then remove1 a (finfun_to_list f)
     else insort_insert a (finfun_to_list f))


proof (chain)
picking this:
  partial_density_operator (DS (M1 * \<rho> * adjoint M1))


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<exists>D. (f has_derivative D) (at x within s);
     \<exists>D. (g has_derivative D) (at x within s)\<rbrakk>
    \<Longrightarrow> \<exists>D.
                         ((\<lambda>x. cinner (f x) (g x)) has_derivative D)
                          (at x within s)


proof (prove)
using this:
  (0::'c) =
  (\<Sum>v\<in>f ` {v. r v \<noteq> (0::'a)}. r (the_inv_into B f v) *b v)

goal (1 subgoal):
 1. r v \<noteq> (0::'a) \<Longrightarrow>
    r (the_inv_into B f (f v)) = (0::'a)


proof (prove)
using this:
  (\<lambda>(x, y). x \<otimes> y)
  \<in> hom (subgroup_generated G A \<times>\<times> subgroup_generated G B)
         G

goal (1 subgoal):
 1. \<forall>x\<in>A. \<forall>y\<in>B. x \<otimes> y = y \<otimes> x


proof (prove)
using this:
  \<Gamma> \<turnstile> e1 : t1
  case_nat t1 \<Gamma> \<turnstile> e2 : t2
  \<lbrakk>randomfree e1; free_vars e1 \<subseteq> ?V\<rbrakk>
  \<Longrightarrow> (\<lambda>\<sigma>. expr_sem_rf \<sigma> e1)
                    \<in> state_measure ?V \<Gamma> \<rightarrow>\<^sub>M
                          stock_measure t1
  \<lbrakk>randomfree e2; free_vars e2 \<subseteq> ?V\<rbrakk>
  \<Longrightarrow> (\<lambda>\<sigma>. expr_sem_rf \<sigma> e2)
                    \<in> state_measure ?V
                           (\<lambda>a.
                               case a of 0 \<Rightarrow> t1
                               | Suc x \<Rightarrow>
                                   \<Gamma> x) \<rightarrow>\<^sub>M
                          stock_measure t2
  randomfree (LET e1 IN e2)
  free_vars (LET e1 IN e2) \<subseteq> V
  Suc -` ?A \<subseteq> ?V \<Longrightarrow> ?A \<subseteq> shift_var_set ?V

goal (1 subgoal):
 1. (\<lambda>\<sigma>. expr_sem_rf \<sigma> e1)
    \<in> state_measure V \<Gamma> \<rightarrow>\<^sub>M
          stock_measure t1 &&&
    (\<lambda>\<sigma>. expr_sem_rf \<sigma> e2)
    \<in> state_measure (shift_var_set V)
           (case_nat t1 \<Gamma>) \<rightarrow>\<^sub>M
          stock_measure t2


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>finite V; n = 0 \<or> (\<forall>v\<in>V. v < n)\<rbrakk>
    \<Longrightarrow> local.wf n
                       (INTERSECT (sorted_list_of_set (valid_ENC n ` V)))


proof (prove)
using this:
  (c::'a::refinement_lattice)\<^sup>\<omega> \<sqinter>
  c ; c\<^sup>\<omega> ; c\<^sup>\<omega> =
  (nil \<sqinter> c ; c\<^sup>\<omega>) ; c\<^sup>\<omega>
  nil \<sqinter>
  (c::'a::refinement_lattice) ; c\<^sup>\<omega> ;
  c\<^sup>\<omega> \<sqsubseteq>
  nil \<sqinter> c ; c\<^sup>\<omega> \<sqinter>
  c ; c\<^sup>\<omega> ; c\<^sup>\<omega>
  nil \<sqinter>
  (?c::'a::refinement_lattice) ; (?x::'a::refinement_lattice) \<sqsubseteq>
  ?x \<Longrightarrow>
  ?c\<^sup>\<omega> \<sqsubseteq> ?x
  (?c::'a::refinement_lattice)\<^sup>\<omega> =
  nil \<sqinter> ?c ; ?c\<^sup>\<omega>
  (?a::'a::refinement_lattice) ; (?b::'a::refinement_lattice) ;
  (?c::'a::refinement_lattice) =
  ?a ; (?b ; ?c)

goal (1 subgoal):
 1. c\<^sup>\<omega> \<sqsubseteq> c\<^sup>\<omega> ; c\<^sup>\<omega>
variables:
  c, nil :: 'a
  (;) :: 'a \<Rightarrow> 'a \<Rightarrow> 'a
type variables:
  'a :: refinement_lattice


proof (prove)
goal (3 subgoals):
 1. \<And>F.
       \<lbrakk>bij h; F \<in> increasing (func \<circ> inv h);
        \<exists>G. F = rename h G\<rbrakk>
       \<Longrightarrow> F \<in> rename h ` increasing func
 2. \<And>F.
       \<lbrakk>bij h; F \<in> increasing (func \<circ> inv h)\<rbrakk>
       \<Longrightarrow> \<exists>G. F = rename h G
 3. \<And>xa.
       \<lbrakk>bij h; xa \<in> increasing func\<rbrakk>
       \<Longrightarrow> rename h xa \<in> increasing (func \<circ> inv h)


proof (prove)
using this:
  0 < x

goal (1 subgoal):
 1. deriv (stirling_sum' (Suc j) m) x = stirling_sum' (Suc (Suc j)) m x


proof (prove)
using this:
  nat \<lfloor>x\<rfloor> < m
  0 < x

goal (1 subgoal):
 1. cmod (\<Sum>k\<in>real -` {x<..real m}. \<chi> k * of_nat k powr - s)
    \<le> real (totient n) * (2 + cmod s / \<sigma>) / x powr \<sigma>


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(set xs, X)
             \<in> \<langle>\<langle>A\<rangle>default_rel
          d\<rangle>set_rel;
     those xs = Some z_\<rbrakk>
    \<Longrightarrow> (concat z_, op_Union_default $ X) \<in> A


proof (prove)
goal (1 subgoal):
 1. \<And>x y z.
       (x \<squnion> - - (y \<sqinter> z) \<sqinter> y) \<sqinter> z =
       (x \<squnion> y) \<sqinter> z


proof (state)
this:
  f p \<sqsubseteq> p

goal (2 subgoals):
 1. p \<sqsubseteq> f p
 2. f p = p


proof (prove)
using this:
  p \<in># prime_factorization j

goal (1 subgoal):
 1. multiplicity p j \<noteq> 0


proof (prove)
goal (1 subgoal):
 1. xa_
    \<in> snd `
          (SIGMA xa:{\<alpha> \<in> A. \<phi> \<alpha> x \<noteq> 0}.
              {i \<in> N. a i = xa \<and> x \<in> W i}) \<Longrightarrow>
    (case (a xa_, xa_) of (\<alpha>, i) \<Rightarrow> g i x) = g xa_ x


proof (prove)
goal (1 subgoal):
 1. blinfun_apply (comp12 f g) b =
    blinfun_apply f (fst b) + blinfun_apply g (snd b)


proof (state)
this:
  {cf e |e. e \<in> set p} \<noteq> {}

goal (1 subgoal):
 1. (\<And>e.
        \<lbrakk>e \<in> set p; cf e = resCap p\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
using this:
  rlex_fun s t \<Longrightarrow> rlex_fun (s + u) (t + u)
  finite (supp_fun s)
  finite (supp_fun t)
  finite (supp_fun u)
  dord_fun rlex_fun s t

goal (1 subgoal):
 1. dord_fun rlex_fun (s + u) (t + u)


proof (prove)
using this:
  LB M2 M1 vs' xs' (TS M2 M1 \<Omega> V m j \<union> V) S1 \<Omega> V''
  \<le> m
  m < LB M2 M1 vs' xs' (TS M2 M1 \<Omega> V m j \<union> V) S1 \<Omega> V''

goal (1 subgoal):
 1. False


proof (prove)
using this:
  map (fst \<circ> meval n (\<tau> \<sigma> j) db) \<phi>s = xss
  list_all2 (\<lambda>i t. t = \<tau> \<sigma> i)
   [progress_regex \<sigma> P r j..<Suc j] (nts @ [\<tau> \<sigma> j])
  list_all2 (\<lambda>i t. t = \<tau> \<sigma> i)
   [progress_regex \<sigma> P r j..<Suc j] (nts @ [\<tau> \<sigma> j])
  Monitor.progress \<sigma> P (formula.MatchF I r) j + length aux =
  progress_regex \<sigma> P r j
  wf_matchF_aux \<sigma> V n R I r aux
   (Monitor.progress \<sigma> P (formula.MatchF I r) j) 0
  list_all2 (wf_mformula \<sigma> j P V n R) \<phi>s \<psi>s

goal (1 subgoal):
 1. wf_matchF_aux \<sigma> V n R I r aux'
     (Monitor.progress \<sigma> P (formula.MatchF I r) j) 0 \<and>
    Monitor.progress \<sigma> P (formula.MatchF I r) j + length aux' =
    progress_regex \<sigma> P' r (Suc j)


proof (prove)
using this:
  \<lbrakk>approx_form prec f ?vs ss; bounded_by xs ?vs\<rbrakk>
  \<Longrightarrow> interpret_form f xs
  approx_form prec (Assign x a f) vs ss
  bounded_by xs vs

goal (1 subgoal):
 1. (\<And>n. x = Var n \<Longrightarrow> thesis) \<Longrightarrow> thesis


proof (prove)
goal (1 subgoal):
 1. rel_gpv'' A C R gpv
     (map_gpv (relcompp_witness A A') (relcompp_witness C C')
       (rel_witness_gpv (A OO A') (C OO C') R R' (gpv, gpv'')))


proof (prove)
using this:
  wf_until_aux \<sigma> n R pos \<phi>'' I \<psi>'' ((t, a1, a2) # aux') i

goal (1 subgoal):
 1. qtable n (fv \<psi>'') (mem_restr R)
     (\<lambda>v.
         \<exists>j\<ge>i.
            j < Suc (i + length aux') \<and>
            mem (\<tau> \<sigma> j - \<tau> \<sigma> i) I \<and>
            MFOTL.sat \<sigma> (map the v) j \<psi>'' \<and>
            (\<forall>k\<in>{i..<j}.
                if pos then MFOTL.sat \<sigma> (map the v) k \<phi>''
                else \<not> MFOTL.sat \<sigma> (map the v) k \<phi>''))
     a2


proof (prove)
goal (1 subgoal):
 1. (msum_appr ops, (+))
    \<in> appr_rel \<rightarrow> appr_rel \<rightarrow> appr_rel


proof (prove)
goal (1 subgoal):
 1. Generalizations2.matrix inner_rows inner_cols


proof (prove)
using this:
  3 * C / \<epsilon> \<le> R
  1 \<le> R
  0 < \<delta>
  \<delta> \<le> 1 / 2
  \<delta> < l

goal (1 subgoal):
 1. (((path A &&& path B1) &&& path B3 &&& path B2 &&& valid_path A) &&&
     (valid_path B1 &&& valid_path B3) &&&
     valid_path B2 &&& arc A &&& arc B1) &&&
    ((arc B3 &&& arc B2) &&&
     pathstart A = - \<i> * complex_of_real R &&&
     pathfinish A = \<i> * complex_of_real R &&&
     pathstart B1 = \<i> * complex_of_real R) &&&
    (pathfinish B1 = complex_of_real R * \<i> - complex_of_real \<delta> &&&
     pathstart B3 =
     complex_of_real (- R) * \<i> - complex_of_real \<delta>) &&&
    pathfinish B3 = - \<i> * complex_of_real R &&&
    pathstart B2 = complex_of_real R * \<i> - complex_of_real \<delta> &&&
    pathfinish B2 = complex_of_real (- R) * \<i> - complex_of_real \<delta>


proof (prove)
using this:
  normal \<phi>_ \<Longrightarrow>
  I (lift_nnf_qe qe \<phi>_) ?xs = I \<phi>_ ?xs
  normal (ExQ \<phi>_)

goal (1 subgoal):
 1. I (lift_nnf_qe qe (ExQ \<phi>_)) xs = I (ExQ \<phi>_) xs


proof (prove)
goal (10 subgoals):
 1. \<And>n g.
       \<lbrakk>CFG_SSA_Transformed \<alpha>e \<alpha>n invar inEdges Entry
                 oldDefs oldUses defs (\<lambda>g. lookup_multimap (uses g))
                 (\<lambda>g. Mapping.lookup (phis g)) var;
        \<And>g. Mapping.keys (uses g) \<subseteq> set (\<alpha>n g);
        n \<in> set (\<alpha>n g)\<rbrakk>
       \<Longrightarrow> defs g n \<inter> phiDefs g n = {}
 2. \<And>n g m.
       \<lbrakk>CFG_SSA_Transformed \<alpha>e \<alpha>n invar inEdges Entry
                 oldDefs oldUses defs (\<lambda>g. lookup_multimap (uses g))
                 (\<lambda>g. Mapping.lookup (phis g)) var;
        \<And>g. Mapping.keys (uses g) \<subseteq> set (\<alpha>n g);
        n \<in> set (\<alpha>n g); m \<in> set (\<alpha>n g);
        n \<noteq> m\<rbrakk>
       \<Longrightarrow> allDefs g n \<inter> allDefs g m = {}
 3. \<And>v g n.
       \<lbrakk>CFG_SSA_Transformed \<alpha>e \<alpha>n invar inEdges Entry
                 oldDefs oldUses defs (\<lambda>g. lookup_multimap (uses g))
                 (\<lambda>g. Mapping.lookup (phis g)) var;
        \<And>g. Mapping.keys (uses g) \<subseteq> set (\<alpha>n g);
        v \<in> CFG_SSA_base.allUses \<alpha>n inEdges (usesOf \<circ> uses)
                 (\<lambda>g. Mapping.lookup (phis g)) g n;
        n \<in> set (\<alpha>n g)\<rbrakk>
       \<Longrightarrow> defAss g n v
 4. \<And>g v.
       \<lbrakk>CFG_SSA_Transformed \<alpha>e \<alpha>n invar inEdges Entry
                 oldDefs oldUses defs (\<lambda>g. lookup_multimap (uses g))
                 (\<lambda>g. Mapping.lookup (phis g)) var;
        \<And>g.
           Mapping.keys (uses g) \<subseteq> set (\<alpha>n g)\<rbrakk>
       \<Longrightarrow> Mapping.lookup (phis g) (Entry g, v) = None
 5. \<And>g n.
       \<lbrakk>CFG_SSA_Transformed \<alpha>e \<alpha>n invar inEdges Entry
                 oldDefs oldUses defs (\<lambda>g. lookup_multimap (uses g))
                 (\<lambda>g. Mapping.lookup (phis g)) var;
        \<And>g.
           Mapping.keys (uses g) \<subseteq> set (\<alpha>n g)\<rbrakk>
       \<Longrightarrow> oldDefs g n = var g ` defs g n
 6. \<And>n g.
       \<lbrakk>CFG_SSA_Transformed \<alpha>e \<alpha>n invar inEdges Entry
                 oldDefs oldUses defs (\<lambda>g. lookup_multimap (uses g))
                 (\<lambda>g. Mapping.lookup (phis g)) var;
        \<And>g. Mapping.keys (uses g) \<subseteq> set (\<alpha>n g);
        n \<in> set (\<alpha>n g)\<rbrakk>
       \<Longrightarrow> oldUses g n = var g ` (usesOf \<circ> uses) g n
 7. \<And>g n ns m v x v'.
       \<lbrakk>CFG_SSA_Transformed \<alpha>e \<alpha>n invar inEdges Entry
                 oldDefs oldUses defs (\<lambda>g. lookup_multimap (uses g))
                 (\<lambda>g. Mapping.lookup (phis g)) var;
        \<And>g. Mapping.keys (uses g) \<subseteq> set (\<alpha>n g);
        old.path2 g n ns m; n \<notin> set (tl ns); v \<in> allDefs g n;
        v \<in> CFG_SSA_base.allUses \<alpha>n inEdges (usesOf \<circ> uses)
                 (\<lambda>g. Mapping.lookup (phis g)) g m;
        x \<in> set (tl ns); v' \<in> allDefs g x\<rbrakk>
       \<Longrightarrow> var g v' \<noteq> var g v
 8. \<And>g n v vs v'.
       \<lbrakk>CFG_SSA_Transformed \<alpha>e \<alpha>n invar inEdges Entry
                 oldDefs oldUses defs (\<lambda>g. lookup_multimap (uses g))
                 (\<lambda>g. Mapping.lookup (phis g)) var;
        \<And>g. Mapping.keys (uses g) \<subseteq> set (\<alpha>n g);
        Mapping.lookup (phis g) (n, v) = Some vs; v' \<in> set vs\<rbrakk>
       \<Longrightarrow> var g v' = var g v
 9. \<And>n g v v'.
       \<lbrakk>CFG_SSA_Transformed \<alpha>e \<alpha>n invar inEdges Entry
                 oldDefs oldUses defs (\<lambda>g. lookup_multimap (uses g))
                 (\<lambda>g. Mapping.lookup (phis g)) var;
        \<And>g. Mapping.keys (uses g) \<subseteq> set (\<alpha>n g);
        n \<in> set (\<alpha>n g); v \<in> allDefs g n;
        v' \<in> allDefs g n; v \<noteq> v'\<rbrakk>
       \<Longrightarrow> var g v' \<noteq> var g v
 10. \<And>g.
        \<lbrakk>CFG_SSA_Transformed \<alpha>e \<alpha>n invar inEdges Entry
                  oldDefs oldUses defs
                  (\<lambda>g. lookup_multimap (uses g))
                  (\<lambda>g. Mapping.lookup (phis g)) var;
         \<And>g.
            Mapping.keys (uses g) \<subseteq> set (\<alpha>n g)\<rbrakk>
        \<Longrightarrow> Mapping.keys (uses g)
                          \<subseteq> set (\<alpha>n g)


proof (prove)
using this:
  igWlsDisj MOD \<and> igWlsAbsDisj MOD
  igWlsDisj MOD
  igWlsAbsIsInBar MOD
  igVarIPresIGWls MOD \<and> igAbsIPresIGWls MOD \<and> igOpIPresIGWls MOD
  igSwapIPresIGWls MOD \<and> igSwapAbsIPresIGWlsAbs MOD
  igSwapIGVar MOD \<and> igSwapIGAbs MOD \<and> igSwapIGOp MOD
  \<lbrakk>igVarIPresIGWls MOD; igSwapIGVar MOD\<rbrakk>
  \<Longrightarrow> igSwapIGVar (errMOD MOD)
  \<lbrakk>igAbsIPresIGWls MOD; igWlsDisj MOD; igSwapIPresIGWls MOD;
   igSwapIGAbs MOD\<rbrakk>
  \<Longrightarrow> igSwapIGAbsSTR (errMOD MOD)
  \<lbrakk>igWlsAbsIsInBar MOD; igOpIPresIGWls MOD; igSwapIPresIGWls MOD;
   igSwapAbsIPresIGWlsAbs MOD; igWlsDisj MOD; igWlsAbsDisj MOD;
   igSwapIGOp MOD\<rbrakk>
  \<Longrightarrow> igSwapIGOpSTR (errMOD MOD)

goal (1 subgoal):
 1. igSwapIGVar (errMOD MOD) \<and>
    igSwapIGAbsSTR (errMOD MOD) \<and> igSwapIGOpSTR (errMOD MOD)


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>string_binop_type op \<tau> \<sigma> \<rho>\<^sub>1;
     string_binop_type op \<tau> \<sigma> \<rho>\<^sub>2\<rbrakk>
    \<Longrightarrow> \<rho>\<^sub>1 = \<rho>\<^sub>2


proof (prove)
using this:
  a \<in> snd ` set (Atoms (preprocess' t start))

goal (1 subgoal):
 1. atom_var a < FirstFreshVariable (preprocess' (hh # t) start)


proof (state)
this:
  f \<circ> g C1_differentiable_on {0..1} - S

goal (1 subgoal):
 1. valid_path (f \<circ> g)


proof (prove)
using this:
  \<forall>X\<langle>\<or>\<noteq>: F \<or>\<notin>: G\<rangle>
  \<in> set (a # A)
  \<forall>X\<langle>\<or>\<noteq>: F \<or>\<notin>: G\<rangle>
  \<in> set A \<Longrightarrow>
  \<forall>X\<langle>\<or>\<noteq>: (F \<cdot>\<^sub>p\<^sub>a\<^sub>i\<^sub>r\<^sub>s
                                     rm_vars (set X)
\<theta>) \<or>\<notin>: G \<cdot>\<^sub>p\<^sub>a\<^sub>i\<^sub>r\<^sub>s
                         rm_vars (set X) \<theta>\<rangle>
  \<in> set (A \<cdot>\<^sub>s\<^sub>s\<^sub>t \<theta>)
  a # A \<cdot>\<^sub>s\<^sub>s\<^sub>t \<theta> =
  (a \<cdot>\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<theta>) #
  (A \<cdot>\<^sub>s\<^sub>s\<^sub>t \<theta>)

goal (1 subgoal):
 1. \<forall>X\<langle>\<or>\<noteq>: (F \<cdot>\<^sub>p\<^sub>a\<^sub>i\<^sub>r\<^sub>s
 rm_vars (set X)
  \<theta>) \<or>\<notin>: G \<cdot>\<^sub>p\<^sub>a\<^sub>i\<^sub>r\<^sub>s
                           rm_vars (set X) \<theta>\<rangle>
    \<in> set (a # A \<cdot>\<^sub>s\<^sub>s\<^sub>t \<theta>)


proof (prove)
goal (1 subgoal):
 1. finfun_curry (K$ c) = (K$ K$ c)


proof (prove)
goal (1 subgoal):
 1. path (x\<^sup>T\<^sup>\<star> ; p \<cdot> x)


proof (prove)
goal (1 subgoal):
 1. map norm_instr ys = xs


proof (prove)
goal (1 subgoal):
 1. (\<And>s x y es s'.
        \<lbrakk>((y, es), s') \<in> set_spmf (rfunc_adv rest s x);
         x \<in> outs_\<I> \<I>_adv; I s\<rbrakk>
        \<Longrightarrow> y \<in> responses_\<I> \<I>_adv x \<and> I s') &&&
    (\<And>s x y es s'.
        \<lbrakk>((y, es), s') \<in> set_spmf (rfunc_usr rest s x);
         x \<in> outs_\<I> \<I>_usr; I s\<rbrakk>
        \<Longrightarrow> y \<in> responses_\<I> \<I>_usr x \<and> I s') &&&
    I (rinit rest)


proof (prove)
using this:
  (X', ?Y90) \<in> rel \<Longrightarrow> phi ?Y90

goal (1 subgoal):
 1. phiAbs (Abs xs x X)


proof (prove)
goal (1 subgoal):
 1. (\<And>w.
        \<lbrakk>cmod w = r;
         \<And>z.
            cmod z < r \<Longrightarrow>
            cmod (h z) \<le> cmod (h w)\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. is_bij ((\<Phi> w x y z)\<^sup>\<smile>)


proof (state)
this:
  k' \<in> subterms\<^sub>s\<^sub>e\<^sub>t M \<union>
           \<Union> ((set \<circ> fst \<circ> Ana) ` M) -
           M

goal (1 subgoal):
 1. k' \<notin> M \<Longrightarrow>
    (\<exists>\<delta>.
        wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \<delta> \<and>
        wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \<delta>) \<and>
        k \<in> M \<cdot>\<^sub>s\<^sub>e\<^sub>t \<delta>) \<or>
    k \<in> SMP (subterms\<^sub>s\<^sub>e\<^sub>t M \<union>
                 \<Union> ((set \<circ> fst \<circ> Ana) ` M) -
                 M)


proof (prove)
using this:
  \<Sum>\<^sub># (mset Cs) \<noteq> negs (mset As)
  \<forall>B\<in>atms_of (\<Sum>\<^sub># (mset Cs)). B < A_max
  Neg A_max \<notin># \<Sum>\<^sub># (mset Cs)
  Neg A_max \<in># negs (mset As)

goal (1 subgoal):
 1. \<Sum>\<^sub># (mset Cs) \<noteq> negs (mset As) \<and>
    (\<forall>y.
        count (negs (mset As)) y
        < count (\<Sum>\<^sub># (mset Cs)) y \<longrightarrow>
        (\<exists>x>y.
            count (\<Sum>\<^sub># (mset Cs)) x < count (negs (mset As)) x))


proof (prove)
using this:
  x \<in> carrier R
  y \<in> carrier R

goal (1 subgoal):
 1. (\<Union>a\<in>I +> x. \<Union>b\<in>I +> y. I +> a \<otimes> b) =
    I +> x \<otimes> y


proof (prove)
using this:
  store_typing s \<S>
  i < length (s_inst \<S>)
  store_typing ?s ?\<S> \<Longrightarrow>
  length (inst ?s) = length (s_inst ?\<S>)
  \<lbrakk>store_typing ?s ?\<S>; ?i < length (inst ?s)\<rbrakk>
  \<Longrightarrow> inst_typing ?\<S> (inst ?s ! ?i) (s_inst ?\<S> ! ?i)

goal (1 subgoal):
 1. list_all2 (globi_agree (s_globs \<S>)) (inst.globs (inst s ! i))
     (global (s_inst \<S> ! i))


proof (prove)
goal (5 subgoals):
 1. \<And>s.
       \<lbrakk>alw (holds
                      (\<lambda>c. cri.InvMsgInGlob (exchange_config c)))
                 s;
        alw Next s; InvGlobPointstampsEq (shd s);
        inv_init_imp_prop_safe (shd s);
        \<forall>p. prop_invs (prop_config (shd s) p);
        \<not> alw (holds all_invs) (stl s)\<rbrakk>
       \<Longrightarrow> inv_init_imp_prop_safe (shd (stl s))
 2. \<And>s p.
       \<lbrakk>alw (holds
                      (\<lambda>c. cri.InvMsgInGlob (exchange_config c)))
                 s;
        alw Next s; InvGlobPointstampsEq (shd s);
        inv_init_imp_prop_safe (shd s);
        \<forall>p. prop_invs (prop_config (shd s) p);
        \<not> alw (holds all_invs) (stl s)\<rbrakk>
       \<Longrightarrow> inv_implications_nonneg
                          (prop_config (shd (stl s)) p)
 3. \<And>s p.
       \<lbrakk>alw (holds
                      (\<lambda>c. cri.InvMsgInGlob (exchange_config c)))
                 s;
        alw Next s; InvGlobPointstampsEq (shd s);
        inv_init_imp_prop_safe (shd s);
        \<forall>p. prop_invs (prop_config (shd s) p);
        \<not> alw (holds all_invs) (stl s)\<rbrakk>
       \<Longrightarrow> inv_imps_work_sum (prop_config (shd (stl s)) p)
 4. \<And>s.
       \<lbrakk>alw (holds
                      (\<lambda>c. cri.InvMsgInGlob (exchange_config c)))
                 s;
        alw Next s; InvGlobPointstampsEq (shd s);
        inv_init_imp_prop_safe (shd s);
        \<forall>p. prop_invs (prop_config (shd s) p);
        \<not> alw (holds all_invs) (stl s)\<rbrakk>
       \<Longrightarrow> alw (holds
                               (\<lambda>c.
                                   cri.InvMsgInGlob (exchange_config c)))
                          (stl s)
 5. \<And>s.
       \<lbrakk>alw (holds
                      (\<lambda>c. cri.InvMsgInGlob (exchange_config c)))
                 s;
        alw Next s; InvGlobPointstampsEq (shd s);
        inv_init_imp_prop_safe (shd s);
        \<forall>p. prop_invs (prop_config (shd s) p);
        \<not> alw (holds all_invs) (stl s)\<rbrakk>
       \<Longrightarrow> alw Next (stl s)


proof (prove)
goal (1 subgoal):
 1. Sigma_Algebra.measure lebesgue ((+) a ` S) =
    Sigma_Algebra.measure lebesgue S


proof (prove)
using this:
  A \<in> sets Invariants

goal (1 subgoal):
 1. A \<in> local.P.events


proof (prove)
using this:
  \<forall>\<^sub>F n in sequentially. \<mu>.C n x < \<omega>

goal (1 subgoal):
 1. \<forall>\<^sub>F n in sequentially. x < \<mu>.I n \<omega>


proof (prove)
goal (1 subgoal):
 1. lim (h\<lparr>lim := l\<rparr>) = l


proof (state)
this:
  (cmod
    (complex_of_real r1 * exp (\<i> * complex_of_real \<theta>1) -
     complex_of_real r2 * exp (\<i> * complex_of_real \<theta>2)))\<^sup>2 =
  (cmod
    (complex_of_real r1 * exp (\<i> * complex_of_real \<theta>1) +
     complex_of_real r2 *
     exp (\<i> * complex_of_real (\<theta>2 + pi))))\<^sup>2

goal (1 subgoal):
 1. (cmod
      (complex_of_real r1 * exp (\<i> * complex_of_real \<theta>1) -
       complex_of_real r2 *
       exp (\<i> * complex_of_real \<theta>2)))\<^sup>2 =
    r1\<^sup>2 + r2\<^sup>2 - 2 * r1 * r2 * cos (\<theta>1 - \<theta>2)


proof (prove)
goal (1 subgoal):
 1. spec s \<Longrightarrow>
    alw (holds (\<lambda>c. \<forall>t. 0 \<le> zcount (c_records c) t)) s


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>B \<in> f \<turnstile> folding.\<C>;
     C \<in> folding.\<C> - f \<turnstile> folding.\<C>;
     D \<in> f \<turnstile> folding.\<C>;
     folding.gallery (B # C # Cs @ [D])\<rbrakk>
    \<Longrightarrow> \<not> min_gallery (B # C # Cs @ [D])


proof (state)
this:
  L1 = ta_lang TA1
  ranked_tree_automaton TA1 A
  L2 = ta_lang TA2
  ranked_tree_automaton TA2 A

goal (1 subgoal):
 1. \<And>TA TAa.
       \<lbrakk>L1 = ta_lang TA; ranked_tree_automaton TA A;
        L2 = ta_lang TAa; ranked_tree_automaton TAa A\<rbrakk>
       \<Longrightarrow> L1 \<inter> L2 \<in> regular_languages A


proof (prove)
goal (1 subgoal):
 1. t \<cdot>\<^sub>t \<sigma>\<^sub>1 = t \<cdot>\<^sub>t \<sigma>\<^sub>2


proof (prove)
goal (1 subgoal):
 1. coprime a' b'


proof (prove)
goal (1 subgoal):
 1. bottom r (OK None)


proof (prove)
goal (1 subgoal):
 1. numeral n \<noteq> \<omega>\<^sub>z


proof (prove)
goal (1 subgoal):
 1. x \<notin> set (stake (LEAST n. xs !! n = x) xs)


proof (prove)
using this:
  \<not> separating \<Gamma> (TER h)

goal (1 subgoal):
 1. (\<And>x y p.
        \<lbrakk>x \<in> A \<Gamma>; y \<in> B \<Gamma>;
         path \<Gamma> x p y; x \<notin> TER h;
         \<And>z. z \<in> set p \<Longrightarrow> z \<notin> TER h\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. \<exists>V.
       V \<in> set (build_ip_partition c rs) \<and>
       s \<in> wordinterval_to_set V


proof (state)
this:
  Domain a \<inter> X \<noteq> {}

goal (1 subgoal):
 1. sum b (Outside' X a) \<le> Max (sum b ` allAllocations (N - X) G)


proof (prove)
goal (1 subgoal):
 1. while\<^sub>T
     (\<lambda>(f, PRED, C, N, d). f = False \<and> C \<noteq> {})
     (\<lambda>(f, PRED, C, N, d).
         assert (C \<noteq> {}) \<bind>
         (\<lambda>_.
             IICF_Set.op_set_pick C \<bind>
             (\<lambda>v.
                 let C = C - {v}
                 in assert (v \<in> V) \<bind>
                    (\<lambda>_.
                        succ v \<bind>
                        (\<lambda>sl.
                            inner_loop2 dst sl v PRED N \<bind>
                            (\<lambda>(f, PRED, N).
                                if f then return (f, PRED, C, N, d + 1)
                                else assert
(assn1 src dst (f, PRED, C, N, d)) \<bind>
                                     (\<lambda>_.
   if C = {} then let C = N; N = {}; d = d + 1 in return (f, PRED, C, N, d)
   else return (f, PRED, C, N, d))))))))
     (False, [src \<mapsto> src], {src}, {}, 0) \<bind>
    (\<lambda>(f, PRED, uu_, uu_, d).
        if f then return (Some (d, PRED)) else return None)
    \<le> \<Down> Id
           (while\<^sub>T\<^bsup>outer_loop_invar src dst\<^esup>
             (\<lambda>(f, PRED, C, N, d). f = False \<and> C \<noteq> {})
             (\<lambda>(f, PRED, C, N, d).
                 (spec v. v \<in> C) \<bind>
                 (\<lambda>v.
                     let C = C - {v}
                     in assert (v \<in> V) \<bind>
                        (\<lambda>_.
                            let succ = E `` {v}
                            in assert (finite succ) \<bind>
                               (\<lambda>_.
                                   add_succ_spec dst succ v PRED N \<bind>
                                   (\<lambda>(f, PRED, N).
 if f then return (f, PRED, C, N, d + 1)
 else assert (assn1 src dst (f, PRED, C, N, d)) \<bind>
      (\<lambda>_.
          if C = {}
          then let C = N; N = {}; d = d + 1 in return (f, PRED, C, N, d)
          else return (f, PRED, C, N, d)))))))
             (False, [src \<mapsto> src], {src}, {}, 0) \<bind>
            (\<lambda>(f, PRED, uu_, uu_, d).
                if f then return (Some (d, PRED)) else return None))


proof (prove)
using this:
  (?i::nat) < (j::nat) \<Longrightarrow>
  (b::'a::refinement_lattice) \<^sup>;^ j =
  (b \<^sup>;^ ?i) ; (b \<^sup>;^ (j - ?i))
  (i::nat) < Suc (j::nat)
  ((?m::nat) < Suc (?n::nat)) = (?m < ?n \<or> ?m = ?n)
  (?a::'a::refinement_lattice) ; (?b::'a::refinement_lattice) ;
  (?c::'a::refinement_lattice) =
  ?a ; (?b ; ?c)

goal (1 subgoal):
 1. b \<^sup>;^ Suc j = b ; (b \<^sup>;^ i) ; (b \<^sup>;^ (j - i))
variables:
  i, j :: nat
  b, nil :: 'a
  (;) :: 'a \<Rightarrow> 'a \<Rightarrow> 'a
type variables:
  'a :: refinement_lattice


proof (prove)
using this:
  \<forall>v. closed (\<Gamma> v) \<and> closed (\<Gamma>' v)
  \<forall>v.
     evalDdb (\<Gamma> v)\<cdot>env_empty_db =
     evalDdb (\<Gamma>' v)\<cdot>env_empty_db

goal (1 subgoal):
 1. evalDdb (closing_subst (DBVar x_) \<Gamma> k)\<cdot>\<rho> =
    evalDdb (closing_subst (DBVar x_) \<Gamma>' k)\<cdot>\<rho>


proof (prove)
goal (1 subgoal):
 1. \<And>x.
       x \<in> set xs \<Longrightarrow> propos x \<subseteq> propos (Or xs)


proof (prove)
goal (1 subgoal):
 1. (((R ===> M) ===> X) ===> local.rel_envT R M ===> X) case_envT case_envT


proof (prove)
using this:
  ((\<sigma>, k), \<sigma>', k') \<in> cop

goal (1 subgoal):
 1. (path \<sigma>, k) \<in> scop \<and> (path \<sigma>', k') \<in> scp


proof (prove)
using this:
  s \<in> correct_jvm_state \<Phi>
  P \<turnstile> s -t'\<triangleright>ta'\<rightarrow>\<^bsub>jvmd\<^esub> s'
  thr s t = \<lfloor>((xcp, frs), no_wait_locks)\<rfloor>
  execd_mthr.can_sync P t (xcp, frs) (shr s') L

goal (1 subgoal):
 1. \<exists>L'\<subseteq>L. execd_mthr.can_sync P t (xcp, frs) (shr s) L'


proof (prove)
goal (1 subgoal):
 1. l_get_host_wf Shadow_DOM.heap_is_wellformed ShadowRootClass.known_ptr
     ShadowRootClass.known_ptrs ShadowRootClass.type_wf get_host


proof (prove)
using this:
  module R M1
  module R M2
  module R M1
  module R M2

goal (1 subgoal):
 1. module_axioms R (direct_sum M1 M2)


proof (prove)
using this:
  \<lbrakk>\<And>x. x \<in> set xs \<Longrightarrow> g (f (fst x)) = fst x;
   f (g x) = x\<rbrakk>
  \<Longrightarrow> map_of
                     (map (\<lambda>a.
                              case a of (k, a) \<Rightarrow> (f k, a))
                       xs)
                     x =
                    map_of xs (g x)
  ?x \<in> set (a # xs) \<Longrightarrow> g (f (fst ?x)) = fst ?x
  f (g x) = x

goal (1 subgoal):
 1. map_of
     (map (\<lambda>a. case a of (k, a) \<Rightarrow> (f k, a)) (a # xs))
     x =
    map_of (a # xs) (g x)


proof (prove)
goal (1 subgoal):
 1. (\<nu> \<in> fml_sem I (FsubstFO (Exists x \<phi>) \<sigma>)) =
    (\<exists>r. repv \<nu> x r \<in> fml_sem I (FsubstFO \<phi> \<sigma>))


proof (prove)
goal (1 subgoal):
 1. sorted_wrt (\<succ>\<^sub>t)
     (fold (\<lambda>p. merge_wrt (\<succ>\<^sub>t) (keys_to_list p)) ps [])


proof (prove)
goal (1 subgoal):
 1. wf_mbufn k js Ps buf' &&& list_all2 R [k..<j] nts'


proof (prove)
goal (1 subgoal):
 1. TernaryOrdering.ordering
     (\<lambda>n.
         if n = 0 then a else if n = 1 then b else if n = 2 then c else d)
     ord {a, b, c, d}


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>f `# P = {#y#};
     \<And>x.
        \<lbrakk>P = {#x#}; f x = y\<rbrakk> \<Longrightarrow> Q\<rbrakk>
    \<Longrightarrow> Q


proof (prove)
goal (1 subgoal):
 1. iexp x =
    (\<Sum>k\<le>0. (\<i> * complex_of_real x) ^ k / fact k) +
    \<i> ^ Suc 0 / fact 0 * (CLBINT s=0..ereal x. f s 0 * iexp s)


proof (prove)
goal (4 subgoals):
 1. \<lbrakk>\<forall>v\<in>fset V. wf_ass (\<Lambda> v);
     \<forall>e\<in>set E. wf_com (snd3 e);
     acyclic (\<Union>e\<in>set E. fset (fst3 e) \<times> fset (thd3 e));
     distinct E \<and>
     (\<forall>e\<in>set E.
         \<forall>f\<in>set E.
            e \<noteq> f \<longrightarrow>
            fset (fst3 e |\<inter>| fst3 f) = fset {||} \<and>
            fset (thd3 e |\<inter>| thd3 f) = fset {||});
     \<forall>e\<in>set E.
        fset (fst3 e |\<union>| thd3 e) \<subseteq> fset V;
     e \<in> set E; fset (fst3 e) \<subseteq> fset S;
     fset S
     \<subseteq> fset
                  (ffilter
                    (\<lambda>v.
                        \<forall>e\<in>set (Graph V \<Lambda> E)^E.
                           v \<notin> fset (thd3 e))
                    (Graph V \<Lambda> E)^V)\<rbrakk>
    \<Longrightarrow> acyclic ?s14
 2. \<lbrakk>\<forall>v\<in>fset V. wf_ass (\<Lambda> v);
     \<forall>e\<in>set E. wf_com (snd3 e);
     acyclic (\<Union>e\<in>set E. fset (fst3 e) \<times> fset (thd3 e));
     distinct E \<and>
     (\<forall>e\<in>set E.
         \<forall>f\<in>set E.
            e \<noteq> f \<longrightarrow>
            fset (fst3 e |\<inter>| fst3 f) = fset {||} \<and>
            fset (thd3 e |\<inter>| thd3 f) = fset {||});
     \<forall>e\<in>set E.
        fset (fst3 e |\<union>| thd3 e) \<subseteq> fset V;
     e \<in> set E; fset (fst3 e) \<subseteq> fset S;
     fset S
     \<subseteq> fset
                  (ffilter
                    (\<lambda>v.
                        \<forall>e\<in>set (Graph V \<Lambda> E)^E.
                           v \<notin> fset (thd3 e))
                    (Graph V \<Lambda> E)^V)\<rbrakk>
    \<Longrightarrow> (\<Union>e\<in>set (removeAll e E).
                          fset (fst3 e) \<times> fset (thd3 e))
                      \<subseteq> ?s14
 3. \<lbrakk>\<forall>v\<in>fset V. wf_ass (\<Lambda> v);
     \<forall>e\<in>set E. wf_com (snd3 e);
     acyclic (\<Union>e\<in>set E. fset (fst3 e) \<times> fset (thd3 e));
     distinct E \<and>
     (\<forall>e\<in>set E.
         \<forall>f\<in>set E.
            e \<noteq> f \<longrightarrow>
            fset (fst3 e |\<inter>| fst3 f) = fset {||} \<and>
            fset (thd3 e |\<inter>| thd3 f) = fset {||});
     \<forall>e\<in>set E.
        fset (fst3 e |\<union>| thd3 e) \<subseteq> fset V;
     e \<in> set E; fset (fst3 e) \<subseteq> fset S;
     fset S
     \<subseteq> fset
                  (ffilter
                    (\<lambda>v.
                        \<forall>e\<in>set (Graph V \<Lambda> E)^E.
                           v \<notin> fset (thd3 e))
                    (Graph V \<Lambda> E)^V)\<rbrakk>
    \<Longrightarrow> distinct (removeAll e E) \<and>
                      (\<forall>ea\<in>set (removeAll e E).
                          \<forall>f\<in>set (removeAll e E).
                             ea \<noteq> f \<longrightarrow>
                             fset (fst3 ea |\<inter>| fst3 f) =
                             fset {||} \<and>
                             fset (thd3 ea |\<inter>| thd3 f) = fset {||})
 4. \<lbrakk>\<forall>v\<in>fset V. wf_ass (\<Lambda> v);
     \<forall>e\<in>set E. wf_com (snd3 e);
     acyclic (\<Union>e\<in>set E. fset (fst3 e) \<times> fset (thd3 e));
     distinct E \<and>
     (\<forall>e\<in>set E.
         \<forall>f\<in>set E.
            e \<noteq> f \<longrightarrow>
            fset (fst3 e |\<inter>| fst3 f) = fset {||} \<and>
            fset (thd3 e |\<inter>| thd3 f) = fset {||});
     \<forall>e\<in>set E.
        fset (fst3 e |\<union>| thd3 e) \<subseteq> fset V;
     e \<in> set E; fset (fst3 e) \<subseteq> fset S;
     fset S
     \<subseteq> fset
                  (ffilter
                    (\<lambda>v.
                        \<forall>e\<in>set (Graph V \<Lambda> E)^E.
                           v \<notin> fset (thd3 e))
                    (Graph V \<Lambda> E)^V)\<rbrakk>
    \<Longrightarrow> \<forall>ea\<in>set (removeAll e E).
                         fset (fst3 ea |\<union>| thd3 ea)
                         \<subseteq> fset (V |-| fst3 e)


proof (prove)
goal (1 subgoal):
 1. f \<in> o[F](g) \<Longrightarrow> L F (\<lambda>x. f x - g x) = L F g


proof (prove)
goal (1 subgoal):
 1. 0 < k \<Longrightarrow>
    f \<odot> k \<Join>\<^sub> [ 0, mod k, n ] = f \<Join>\<^sub> [\<dots>n]


proof (prove)
using this:
  z = of_nat p
  prime p
  [p = 3] (mod 4)
  prime z
  gauss_int_norm z = p\<^sup>2

goal (1 subgoal):
 1. prime p \<and> z = of_nat p


proof (prove)
using this:
  \<bar>spmf (DDH0 ?\<A>) True - spmf (DDH1 ?\<A>) True\<bar>
  \<le> advantage ?\<A> +
        \<bar>spmf (ddh_1 ?\<A>) True - spmf (DDH1 ?\<A>) True\<bar>
  advantage (DDH_\<A>' ?\<A>) =
  \<bar>spmf (ddh_1 ?\<A>) True - spmf (DDH1 ?\<A>) True\<bar>
  DDH_advantage ?\<A> =
  \<bar>spmf (DDH0 ?\<A>) True - spmf (DDH1 ?\<A>) True\<bar>

goal (1 subgoal):
 1. DDH_advantage \<A> \<le> advantage \<A> + advantage (DDH_\<A>' \<A>)


proof (prove)
goal (1 subgoal):
 1. (ffUnion \<circ> fset_of_list \<circ> map frees) (x # xs) =
    frees x |\<union>| (ffUnion \<circ> fset_of_list \<circ> map frees) xs


proof (prove)
goal (1 subgoal):
 1. n < length cms''


proof (prove)
goal (1 subgoal):
 1. conv_mirror \<sigma> \<in> conv ars \<and>
    set (labels_conv (conv_mirror \<sigma>)) =
    set (labels_conv \<sigma>) \<and>
    fst \<sigma> = lst_conv (conv_mirror \<sigma>) \<and>
    lst_conv \<sigma> = fst (conv_mirror \<sigma>)


proof (prove)
goal (1 subgoal):
 1. min_set
     (\<Otimes>\<^sub>m
       {min_dnf (subst \<phi> m) |\<phi>. \<phi> \<in> fset \<Phi>}) =
    \<Otimes>\<^sub>m
     {min_dnf (subst \<phi> m) |\<phi>. \<phi> \<in> fset \<Phi>}


proof (prove)
goal (1 subgoal):
 1. Rel_match B (f x) (g y)


proof (prove)
using this:
  Ord \<alpha>
  ?y \<in> elts \<alpha> \<Longrightarrow> P ?y

goal (1 subgoal):
 1. P \<alpha>


proof (prove)
using this:
  AX10 \<union> ?y1 \<turnstile>\<^sub>H
  (?F3 \<^bold>\<rightarrow> ?H3) \<^bold>\<rightarrow>
  (?G3 \<^bold>\<rightarrow> ?H3) \<^bold>\<rightarrow>
  (?F3 \<^bold>\<or> ?G3) \<^bold>\<rightarrow> ?H3
  \<lbrakk>?\<Gamma> \<turnstile>\<^sub>H ?F;
   ?\<Gamma> \<turnstile>\<^sub>H ?F \<^bold>\<rightarrow> ?G\<rbrakk>
  \<Longrightarrow> ?\<Gamma> \<turnstile>\<^sub>H ?G
  AX10 \<union> \<Gamma> \<turnstile>\<^sub>H F \<^bold>\<rightarrow> H
  AX10 \<union> \<Gamma> \<turnstile>\<^sub>H G \<^bold>\<rightarrow> H

goal (1 subgoal):
 1. AX10 \<union> \<Gamma> \<turnstile>\<^sub>H
    (F \<^bold>\<or> G) \<^bold>\<rightarrow> H


proof (state)
this:
  c * a < c * b

goal (2 subgoals):
 1. \<And>a. \<bar>a\<bar> = (if a < 0 then - a else a)
 2. \<And>x. sgn x = (if x = 0 then 0 else if 0 < x then 1 else - 1)


proof (prove)
goal (1 subgoal):
 1. \<And>f g h.
       \<lbrakk>B.ide f; B.ide g; B.ide h; src\<^sub>B f = trg\<^sub>B g;
        src\<^sub>B g = trg\<^sub>B h\<rbrakk>
       \<Longrightarrow> local.map \<a>\<^sub>B[f, g, h] \<cdot>\<^sub>B
                         cmp (f \<star>\<^sub>B g, h) \<cdot>\<^sub>B
                         (cmp (f, g) \<star>\<^sub>B local.map h) =
                         cmp (f, g \<star>\<^sub>B h) \<cdot>\<^sub>B
                         (local.map f \<star>\<^sub>B
                          cmp (g, h)) \<cdot>\<^sub>B
                         \<a>\<^sub>B[local.map f, local.map g, local.map h]


proof (prove)
using this:
  A \<in> list.set as

goal (1 subgoal):
 1. sorted A


proof (prove)
goal (1 subgoal):
 1. \<rho> \<one> = \<one>


proof (prove)
goal (1 subgoal):
 1. transformation_by_components A B F G \<tau>


proof (prove)
goal (1 subgoal):
 1. monom_mult (1::'b) (0::'a) p = p


proof (prove)
using this:
  local_ring stk1.carrier_stalk stk1.add_stalk stk1.mult_stalk
   (stk1.zero_stalk (f \<^sup>\<inverse> X U))
   (stk1.one_stalk (f \<^sup>\<inverse> X U))
  ring_isomorphism (identity stk1.carrier_stalk) stk1.carrier_stalk
   stk1.add_stalk stk1.mult_stalk
   (stk1.zero_stalk (f \<^sup>\<inverse> X U))
   (stk1.one_stalk (f \<^sup>\<inverse> X U)) stk2.carrier_stalk
   stk2.add_stalk stk2.mult_stalk
   (stk2.zero_stalk (f \<^sup>\<inverse> X U))
   (stk2.one_stalk (f \<^sup>\<inverse> X U))

goal (1 subgoal):
 1. local_ring_morphism (identity stk1.carrier_stalk) stk1.carrier_stalk
     stk1.add_stalk stk1.mult_stalk
     (stk1.zero_stalk (f \<^sup>\<inverse> X U))
     (stk1.one_stalk (f \<^sup>\<inverse> X U)) stk2.carrier_stalk
     stk2.add_stalk stk2.mult_stalk
     (stk2.zero_stalk (f \<^sup>\<inverse> X U))
     (stk2.one_stalk (f \<^sup>\<inverse> X U))


proof (prove)
using this:
  bounded_hashcode_nat (length l) x \<noteq>
  bounded_hashcode_nat (length l) k

goal (1 subgoal):
 1. map_of (abs_update k v l ! bounded_hashcode_nat (length l) x) x =
    map_of (l ! bounded_hashcode_nat (length l) x) x


proof (prove)
goal (1 subgoal):
 1. ((\<box> t {t}. Q t) \<or>
     (\<diamond> ta {t}.
         P ta \<and> (\<box> t' {t} \<down>\<le> ta. Q t'))) =
    Q t


proof (prove)
using this:
  has_channel\<^sup>+\<^sup>+ p q

goal (1 subgoal):
 1. (\<And>r s. has_channel r s \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
using this:
  V < length xs

goal (1 subgoal):
 1. True,P,t \<turnstile>1 \<langle>sync\<^bsub>V\<^esub> (null) e2,
                            (h, xs)\<rangle> -\<lbrace>\<rbrace>\<rightarrow>
                           \<langle>Throw (addr_of_sys_xcpt NullPointer),
                            (h, xs[V := Null])\<rangle>


proof (prove)
using this:
  fold_graph f z (insert x B) v
  x \<notin> B
  insert x B \<subseteq> A
  z \<in> A

goal (1 subgoal):
 1. (\<And>y.
        \<lbrakk>v = f x y; fold_graph f z B y\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
using this:
  2 \<le> card X

goal (1 subgoal):
 1. (\<And>Y.
        \<lbrakk>Y \<subseteq> X; card Y = 2\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (state)
this:
  (g ?x = Some ?y) = (P ?x \<and> ?y = fst ?x)

goal (1 subgoal):
 1. set_iterator_genord (map_iterator_dom_filter P it)
     {k. \<exists>v. m k = Some v \<and> P (k, v)} R'


proof (prove)
using this:
  (D::'a::refinement_lattice set) =
  {d \<parallel> (i::'a::refinement_lattice) |d::'a::refinement_lattice.
   (c::'a::refinement_lattice) \<sqsubseteq> d \<parallel> i}
  (C::'a::refinement_lattice set) = {c::'a::refinement_lattice}
  (?a::?'a::type)
  \<in> {x::?'a::type.
         (?P::?'a::type \<Rightarrow> bool) x} \<Longrightarrow>
  ?P ?a
  (?a::?'a::type) \<in> {?a}

goal (1 subgoal):
 1. \<forall>d::'a\<in>D. \<exists>c::'a\<in>C. c \<sqsubseteq> d
variables:
  C, D :: 'a set
type variables:
  'a :: refinement_lattice


proof (prove)
using this:
  approx_tm prec ord I a (Max l r) env = Some t

goal (1 subgoal):
 1. (\<And>t1 t2.
        \<lbrakk>t = tm_max prec I a t1 t2;
         Some t1 = approx_tm prec ord I a l env;
         approx_tm prec ord I a r env = Some t2\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. src.saturated_upto
     (Liminf_llist
       (lmap
         (\<lambda>St.
             grounding_of_clss
              (N_of_wstate St \<union> P_of_wstate St \<union>
               Q_of_wstate St))
         Sts))


proof (prove)
using this:
  d_IN j ?x1 \<le> \<epsilon>

goal (1 subgoal):
 1. weight \<Gamma> a + d_IN j \<langle>a\<rangle> - \<epsilon>
    \<le> weight \<Gamma> a


proof (prove)
goal (1 subgoal):
 1. (\<U> s' \<longrightarrow>
     (set (the (\<U>\<^sub>c s')) \<subseteq> indices_state s' \<and>
      (\<nexists>v.
          v \<Turnstile>\<^sub>t \<T> s' \<and>
          (\<forall>x c.
              \<B>\<^sub>l s' x = Some c \<longrightarrow>
              \<I>\<^sub>l s' x
              \<in> set (the (\<U>\<^sub>c s')) \<longrightarrow>
              c \<le> v x) \<and>
          (\<forall>x c.
              \<B>\<^sub>u s' x = Some c \<longrightarrow>
              \<I>\<^sub>u s' x
              \<in> set (the (\<U>\<^sub>c s')) \<longrightarrow>
              v x \<le> c))) \<and>
     (distinct_indices_state s' \<longrightarrow>
      (\<forall>I\<subset>set (the (\<U>\<^sub>c s')).
          \<exists>v.
             v \<Turnstile>\<^sub>t \<T> s' \<and>
             (\<forall>x c.
                 \<B>\<^sub>l s' x = Some c \<longrightarrow>
                 \<I>\<^sub>l s' x \<in> I \<longrightarrow> v x = c) \<and>
             (\<forall>x c.
                 \<B>\<^sub>u s' x = Some c \<longrightarrow>
                 \<I>\<^sub>u s' x \<in> I \<longrightarrow> v x = c)))) =
    (\<U> s' \<longrightarrow>
     (set (the (\<U>\<^sub>c s')) \<subseteq> indices_state s' \<and>
      (\<nexists>v.
          v \<Turnstile>\<^sub>t \<T> s' \<and>
          (\<forall>x c i.
              \<B>\<^sub>l s' x = Some c \<longrightarrow>
              \<I>\<^sub>l s' x = i \<longrightarrow>
              i \<in> set (the (\<U>\<^sub>c s')) \<longrightarrow>
              c \<le> v x) \<and>
          (\<forall>x c i.
              \<B>\<^sub>u s' x = Some c \<longrightarrow>
              \<I>\<^sub>u s' x = i \<longrightarrow>
              i \<in> set (the (\<U>\<^sub>c s')) \<longrightarrow>
              v x \<le> c))) \<and>
     (distinct_indices_state s' \<longrightarrow>
      (\<forall>I\<subset>set (the (\<U>\<^sub>c s')).
          \<exists>v.
             v \<Turnstile>\<^sub>t \<T> s' \<and>
             (\<forall>x c i.
                 \<B>\<^sub>l s' x = Some c \<longrightarrow>
                 \<I>\<^sub>l s' x = i \<longrightarrow>
                 i \<in> I \<longrightarrow> v x = c) \<and>
             (\<forall>x c i.
                 \<B>\<^sub>u s' x = Some c \<longrightarrow>
                 \<I>\<^sub>u s' x = i \<longrightarrow>
                 i \<in> I \<longrightarrow> v x = c))))


proof (prove)
using this:
  incseq (\<lambda>n x. F n x * indicator (\<Union>n. (T ^^ n) --` A) x)

goal (1 subgoal):
 1. (\<Squnion>n. set_nn_integral M (\<Union>n. (T ^^ n) --` A) (F n)) =
    \<integral>\<^sup>+ x. (\<Squnion>n.
                               F n x *
                               indicator (\<Union>n. (T ^^ n) --` A) x)
                       \<partial>M


proof (prove)
goal (1 subgoal):
 1. \<forall>c\<in>{[Pos (Eq (lOfWax \<sigma>) (rOfWax \<sigma>))] |
                    \<sigma>. \<not> isRes \<sigma> \<and> protFw \<sigma>}.
       list_all TE.wtL c


proof (prove)
using this:
  ?xc \<in> set lc \<Longrightarrow> invar ?xc
  \<lbrakk>invar ?xc; \<alpha> ?xc \<in> set (map \<alpha> lc)\<rbrakk>
  \<Longrightarrow> fc ?xc = fa (\<alpha> ?xc)

goal (1 subgoal):
 1. foldli (map \<alpha> lc) c fa \<sigma>0 = foldli lc c fc \<sigma>0


proof (prove)
using this:
  prefs_from_table_wf agents alts xs
  prefs_from_table_wf agents alts ys
  h permutes {..<length ys}

goal (1 subgoal):
 1. prefs_from_table ys = prefs_from_table (permute_list h ys)


proof (prove)
goal (1 subgoal):
 1. vec.independent (set (Gram_Schmidt2 V)) \<and>
    set V \<subseteq> vec.span (set (Gram_Schmidt2 V)) \<and>
    card (set (Gram_Schmidt2 V)) = vec.dim (set V) \<and>
    pairwise orthogonal (set (Gram_Schmidt2 V))


proof (prove)
using this:
  ide f
  src ?\<mu> \<equiv>
  if arr ?\<mu> then mkObj (C.cod (Leg0 (Dom ?\<mu>))) else null

goal (1 subgoal):
 1. f.dsrc = src_f.dom.leg1


proof (prove)
using this:
  vangle u v = 0
  \<bar>u \<bullet> v / (norm u * norm v)\<bar> \<le> 1 \<and>
  \<bar>1\<bar> \<le> 1 \<Longrightarrow>
  (arccos (u \<bullet> v / (norm u * norm v)) = arccos 1) =
  (u \<bullet> v / (norm u * norm v) = 1)
  \<bar>u \<bullet> v\<bar> \<le> norm u * norm v

goal (1 subgoal):
 1. u \<bullet> v = norm u * norm v


proof (prove)
goal (1 subgoal):
 1. L \<le> K


proof (prove)
using this:
  T_slow_median ys \<le> 5\<^sup>2 + 3 * 5 + 4

goal (1 subgoal):
 1. T_slow_median ys \<le> 44


proof (prove)
using this:
  finite C

goal (1 subgoal):
 1. sum c V \<le> (\<Sum>i\<in>C. sum c (S i))


proof (prove)
using this:
  a dvdm prod_list xs

goal (1 subgoal):
 1. of_int_poly a dvd of_int_poly (prod_list xs)


proof (prove)
goal (1 subgoal):
 1. ltl (llist_of_tllist xs) = llist_of_tllist (ttl xs)


proof (prove)
using this:
  Nml (t \<^bold>\<star> u)

goal (1 subgoal):
 1. t = \<^bold>\<langle>un_Prim t\<^bold>\<rangle> \<and>
    arr (un_Prim t) \<and>
    Nml t \<and>
    Nml u \<and>
    \<not> is_Prim\<^sub>0 u \<and>
    \<^bold>\<langle>src (un_Prim t)\<^bold>\<rangle>\<^sub>0 = Trg u


proof (prove)
goal (1 subgoal):
 1. inorder (n2 l a r) = inorder l @ a # inorder r


proof (prove)
goal (1 subgoal):
 1. valid_mmsaux args cur
     (join_mmsaux_abs args X
       (nt, gc, maskL, maskR, data_prev, data_in, tuple_in, tuple_since))
     (map (\<lambda>(t, rel). (t, join rel (args_pos args) X)) auxlist)