# TheoryBodies

body:
  bv_arith_caret: THEORY

  BEGIN

    IMPORTING bv_arith_nat, bv_caret, div,
              bv_sum, bv_arith_concat % For proofs only

    N: VAR posnat
    i: VAR int
    


    bv_shift    : THEOREM (FORALL (bv:bvec[N], ss: below(N)):
                         bv2nat(bv^(N-1,ss)) = div(bv2nat(bv), exp2(ss)))
  	      
    bv_bottom   : THEOREM (FORALL (bv:bvec[N], ss: below(N)):
                            bv2nat(bv^(ss,0)) = mod(bv2nat(bv),exp2(ss+1)) )
  	      
    bv_top      : THEOREM (FORALL (bv:bvec[N], ss: below(N)):
                           bv^(N-1,ss) = nat2bv[N-ss](div(bv2nat(bv), exp2(ss))))

    bv_bot      : THEOREM (FORALL (bv:bvec[N], nn: below(N)):
                            bv^(nn,0) = nat2bv[nn+1](mod(bv2nat(bv),exp2(nn+1))))

    bv_add_subrange : THEOREM (FORALL (bv1,bv2:bvec[N], nn: below(N)):
                                 (bv1 + bv2)^(nn,0) = bv1^(nn,0) + bv2^(nn,0))

    bv_plus_caret: LEMMA (FORALL (bv1: bvec[N], nn: below(N)):
                                 (bv1 + i)^(nn,0) = bv1^(nn,0) + i)

    bv_middle      : THEOREM (FORALL (n: posnat, i,j: below(n), bv: bvec[n]): 
                        i >= j IMPLIES
                      bv2nat(bv^(i,j)) = mod(div(bv2nat(bv), exp2(j)),exp2(i-j+1)))


    bv2nat_caret_00: THEOREM FORALL (n: posnat, bv: bvec[n]):
                                bv2nat(bv^(0,0)) = b2n(bv^0)

    bv2nat_lem     : THEOREM FORALL (n: above(1), bv: bvec[n]):
                                bv2nat(bv)  = 2 * bv2nat(bv ^ (n - 1, 1)) + bv ^ 0

  END bv_arith_caret

addendum:
  %%% ================ Addendum: generated declarations ================

  % Subtype TCC generated (at line 14, column 34) for  N - 1
      % expected type  below(N)
  bv_shift_TCC1: OBLIGATION
    FORALL (N: posnat, ss: below(N)): N - 1 >= 0 AND N - 1 < N;

  % Subtype TCC generated (at line 14, column 38) for  ss
      % expected type  upto(N - 1)
  bv_shift_TCC2: OBLIGATION FORALL (N: posnat, ss: below(N)): ss <= N - 1;

  % Subtype TCC generated (at line 14, column 34) for  N - ss
      % expected type  nat
  bv_shift_TCC3: OBLIGATION FORALL (N: posnat, ss: below(N)): N - ss >= 0;

  % Subtype TCC generated (at line 17, column 40) for  0
      % expected type  upto(ss)
  bv_bottom_TCC1: OBLIGATION FORALL (N: posnat, ss: below(N)): 0 <= ss;

  % Subtype TCC generated (at line 20, column 52) for
      % div(bv2nat(bv), exp2(ss))
      % expected type  val: below(exp2(N - ss))
  bv_top_TCC1: OBLIGATION
    FORALL (N: posnat, bv: bvec[N], ss: below(N)):
      div(bv2nat[N](bv), exp2(ss)) < exp2(N - ss);

  % Subtype TCC generated (at line 33, column 33) for  j
      % expected type  upto(i)
  bv_middle_TCC1: OBLIGATION
    FORALL (n: posnat, i, j: below(n)): i >= j IMPLIES j <= i;

  % Subtype TCC generated (at line 89, column 18) for  1 + i - j
      % expected type  nat
  bv_middle_TCC2: OBLIGATION
    FORALL (n: posnat, i, j: below(n)): i >= j IMPLIES 1 + i - j >= 0;

  % Subtype TCC generated (at line 33, column 73) for  i - j + 1
      % expected type  nat
  bv_middle_TCC3: OBLIGATION
    FORALL (n: posnat, i, j: below(n)): i >= j IMPLIES i - j + 1 >= 0;

  % Subtype TCC generated (at line 37, column 41) for  0
      % expected type  below(n)
  bv2nat_caret_00_TCC1: OBLIGATION FORALL (n: posnat): 0 < n;

  % Subtype TCC generated (at line 40, column 61) for  n - 1
      % expected type  below(n)
  bv2nat_lem_TCC1: OBLIGATION FORALL (n: above(1)): n - 1 >= 0 AND n - 1 < n;

  % Subtype TCC generated (at line 40, column 68) for  1
      % expected type  upto(n - 1)
  bv2nat_lem_TCC2: OBLIGATION FORALL (n: above(1)): 1 <= n - 1;

  % Subtype TCC generated (at line 40, column 61) for  n - 1
      % expected type  nat
  bv2nat_lem_TCC3: OBLIGATION FORALL (n: above(1)): n - 1 >= 0;

  % Subtype TCC generated (at line 40, column 79) for  0
      % expected type  below[n]
  bv2nat_lem_TCC4: OBLIGATION FORALL (n: above(1)): 0 < n;


body:
  bv_arith_caret_concat_rules: THEORY
  BEGIN

    IMPORTING bv_arith_caret


    N,m: VAR posnat
    i1,i: VAR int
    n1: VAR nat

  %  bv_caret_concat_over_addition_1: THEOREM FORALL (bvn:bvec[N], bvm:bvec[m]):
  %                                  n1 >= m AND  n1 < m+N =>
  %        ((bvn o bvm + i1)^(n1,m) o (bvm + i1)) = (bvn^(n1-m,0) o bvm + i1)
  %
  %  superrange_addition: THEOREM FORALL (bv: bvec[N], n2,n3,n4 : nat):
  %      (N > n4 & n4 >= n3 & n3 = n2 + 1 & n2 >= 0) => 
  %        ((bv + i)^(n4,n3) o (bv^(n2,0) + i)) = (bv^(n4,0) + i)

  END bv_arith_caret_concat_rules 


body:
  bv_arith_nat_caret_rules: THEORY
  BEGIN

    IMPORTING bv_arith_caret

    N: VAR posnat

    bv_shift_rule  : THEOREM FORALL (bv:bvec[N], ss: below(N)):
                         bv2nat(bv^(N-1,ss)) = div(bv2nat(bv), exp2(ss))
  	      
    bv_bottom_rule : THEOREM FORALL (bv:bvec[N], ss: below(N)):
                         bv2nat(bv^(ss,0)) = mod(bv2nat(bv),exp2(ss+1))
  	      

    bv_middle_rule : THEOREM (FORALL (i,j: below(N), bv: bvec[N]): i >= j IMPLIES
                         bv2nat(bv^(i,j)) = 
                             mod(div(bv2nat(bv), exp2(j)),exp2(i-j+1)))


    bv_caret_00_rule : THEOREM FORALL (n: posnat, bv: bvec[n]):
                                bv2nat(bv^(0,0)) = b2n(bv^0)

    bv2nat_lem_rule  : THEOREM FORALL (n: above(1), bv: bvec[n]):
                                2 * bv2nat(bv ^ (n - 1, 1)) + b2n(bv ^ 0) 
                                   = bv2nat(bv)

  END bv_arith_nat_caret_rules

addendum:
  %%% ================ Addendum: generated declarations ================

  % Subtype TCC generated (at line 9, column 34) for  N - 1
      % expected type  below(N)
  bv_shift_rule_TCC1: OBLIGATION
    FORALL (N: posnat, ss: below(N)): N - 1 >= 0 AND N - 1 < N;

  % Subtype TCC generated (at line 9, column 38) for  ss
      % expected type  upto(N - 1)
  bv_shift_rule_TCC2: OBLIGATION
    FORALL (N: posnat, ss: below(N)): ss <= N - 1;

  % Subtype TCC generated (at line 9, column 34) for  N - ss
      % expected type  nat
  bv_shift_rule_TCC3: OBLIGATION
    FORALL (N: posnat, ss: below(N)): N - ss >= 0;

  % Subtype TCC generated (at line 12, column 37) for  0
      % expected type  upto(ss)
  bv_bottom_rule_TCC1: OBLIGATION FORALL (N: posnat, ss: below(N)): 0 <= ss;

  % Subtype TCC generated (at line 16, column 36) for  j
      % expected type  upto(i)
  bv_middle_rule_TCC1: OBLIGATION
    FORALL (N: posnat, i, j: below(N)): i >= j IMPLIES j <= i;

  % Subtype TCC generated (at line 89, column 18) for  1 + i - j
      % expected type  nat
  bv_middle_rule_TCC2: OBLIGATION
    FORALL (N: posnat, i, j: below(N)): i >= j IMPLIES 1 + i - j >= 0;

  % Subtype TCC generated (at line 17, column 61) for  i - j + 1
      % expected type  nat
  bv_middle_rule_TCC3: OBLIGATION
    FORALL (N: posnat, i, j: below(N)): i >= j IMPLIES i - j + 1 >= 0;

  % Subtype TCC generated (at line 21, column 41) for  0
      % expected type  below(n)
  bv_caret_00_rule_TCC1: OBLIGATION FORALL (n: posnat): 0 < n;

  % Subtype TCC generated (at line 24, column 47) for  n - 1
      % expected type  below(n)
  bv2nat_lem_rule_TCC1: OBLIGATION
    FORALL (n: above(1)): n - 1 >= 0 AND n - 1 < n;

  % Subtype TCC generated (at line 24, column 54) for  1
      % expected type  upto(n - 1)
  bv2nat_lem_rule_TCC2: OBLIGATION FORALL (n: above(1)): 1 <= n - 1;

  % Subtype TCC generated (at line 24, column 47) for  n - 1
      % expected type  nat
  bv2nat_lem_rule_TCC3: OBLIGATION FORALL (n: above(1)): n - 1 >= 0;

  % Subtype TCC generated (at line 24, column 69) for  0
      % expected type  below[n]
  bv2nat_lem_rule_TCC4: OBLIGATION FORALL (n: above(1)): 0 < n;


body:
  bv_arith_caret_rules: THEORY
  BEGIN

    IMPORTING bv_arith_caret

    n,N: VAR posnat
    i: VAR int
    m,nn: VAR nat

    bv_add_caret       : THEOREM FORALL (bv1, bv2:bvec[N]): nn < N => 
                                      (bv1 + bv2)^(nn,0) = bv1^(nn,0) + bv2^(nn,0)


    bv_caret_over_plus : THEOREM FORALL (bvn:bvec[N]): nn < N => 
                                      (bvn + i)^(nn,0) = bvn^(nn,0) + i

    bv_odd_even_pc     : THEOREM FORALL (bv: bvec[N]):
                                      (bv + nn)^0 = NOT (bv + (nn-1))^0

    bv_even_odd_pc     : THEOREM FORALL (bv: bvec[N]):
                                      (bv + (-n))^0 = NOT ((bv + (-n+1))^0)


  %  PCp1              : LEMMA FORALL (bv: bvec[N]): N > 1 IMPLIES
  %                                   (NOT bv^0) => (bv + 1)^(N-1, 1) = bv^(N-1, 1)


    bv_plus_caret_rule : LEMMA FORALL (bv1, bv2 : bvec[N]):
                               m <= nn AND nn + 1 < N => 
                           (bv1 + bv2) ^ (nn, m) = (bv1^(nn,0) + bv2^(nn,0))^(nn,m)


  END bv_arith_caret_rules

addendum:
  %%% ================ Addendum: generated declarations ================

  % Subtype TCC generated (at line 11, column 52) for  0
      % expected type  upto(nn)
  bv_add_caret_TCC1: OBLIGATION
    FORALL (N: posnat, nn: nat): nn < N IMPLIES 0 <= nn;

  % Subtype TCC generated (at line 18, column 46) for  0
      % expected type  below[N]
  bv_odd_even_pc_TCC1: OBLIGATION FORALL (N: posnat): 0 < N;

  % Subtype TCC generated (at line 30, column 40) for  nn
      % expected type  below(N)
  bv_plus_caret_rule_TCC1: OBLIGATION
    FORALL (N: posnat, m, nn: nat): m <= nn AND nn + 1 < N IMPLIES nn < N;

  % Subtype TCC generated (at line 30, column 58) for  0
      % expected type  upto(nn)
  bv_plus_caret_rule_TCC2: OBLIGATION
    FORALL (N: posnat, m, nn: nat): m <= nn AND nn + 1 < N IMPLIES 0 <= nn;

  % Subtype TCC generated (at line 30, column 76) for  nn
      % expected type  below(1 + nn)
  bv_plus_caret_rule_TCC3: OBLIGATION
    FORALL (N: posnat, m, nn: nat):
      m <= nn AND nn + 1 < N IMPLIES nn < 1 + nn;


body:
  bv_caret_concat: THEORY

  BEGIN

    IMPORTING bv_arith_concat, bv_caret

    n,m: VAR posnat
    b  : VAR bit

    caret_fill	   : THEOREM FORALL (i: below(n), j: upto(i)): 
  			        fill[n](b)^(i,j) = fill[i-j+1](b)
   
    caret_concat_bot : THEOREM FORALL (i: below(n+m), j: upto(i),
                                       bvn: bvec[n], bvm: bvec[m]):
  			         i < m IMPLIES (bvn o bvm)^(i,j) = bvm^(i,j)
   
    caret_concat_top : THEOREM FORALL (i: below(n+m), j: upto(i),
                                       bvn: bvec[n], bvm: bvec[m]):
  			        j >= m 
  				  IMPLIES (bvn o bvm)^(i,j) = bvn^(i-m, j-m)
   
    caret_concat_all : THEOREM FORALL (i: below(n+m), j: upto(i), 
                                       bvn: bvec[n], bvm: bvec[m]):
  			        i >= m AND j < m 
  				   IMPLIES (bvn o bvm)^(i,j) = 
                                        bvn^(i-m,0) o bvm^(m-1,j) 

    bv_decomposition : THEOREM FORALL (N: above(1), k: below(N-1), bvn: bvec[N]):
                                  bvn^(N-1,k+1) o bvn^(k,0) = bvn
   
    caret_concat_join: THEOREM FORALL (bvn: bvec[n], i1,i2: below[n],
                                           j1: upto[i1], j2: upto[i2]):
                                 (j1=i2+1) =>
                                     (bvn^(i1,j1) o bvn^(i2,j2) =  bvn^(i1,j2));

    concat_bottom	   : THEOREM FORALL (bvn: bvec[n], bvm: bvec[m]):
                                  (bvn o bvm)^(m-1,0) = bvm
   
    concat_top	   : THEOREM FORALL (bvn: bvec[n], bvm: bvec[m]):
                                   (bvn o bvm)^((n+m-1),m) = bvn

  END bv_caret_concat

addendum:
  %%% ================ Addendum: generated declarations ================

  % Subtype TCC generated (at line 11, column 39) for  1 + i - j
      % expected type  nat
  caret_fill_TCC1: OBLIGATION
    FORALL (n: posnat, i: below(n), j: upto(i)): 1 + i - j >= 0;

  % Subtype TCC generated (at line 20, column 39) for  i - m
      % expected type  below(n)
  caret_concat_top_TCC1: OBLIGATION
    FORALL (m, n: posnat, i: below(m + n), j: upto(i)):
      j >= m IMPLIES i - m >= 0 AND i - m < n;

  % Subtype TCC generated (at line 20, column 44) for  j - m
      % expected type  upto(i - m)
  caret_concat_top_TCC2: OBLIGATION
    FORALL (m, n: posnat, i: below(m + n), j: upto(i)):
      j >= m IMPLIES j - m >= 0 AND j - m <= i - m;

  % Subtype TCC generated (at line 26, column 43) for  i - m
      % expected type  below(n)
  caret_concat_all_TCC1: OBLIGATION
    FORALL (m, n: posnat, i: below(m + n), j: upto(i)):
      i >= m AND j < m IMPLIES i - m >= 0 AND i - m < n;

  % Subtype TCC generated (at line 26, column 47) for  0
      % expected type  upto(i - m)
  caret_concat_all_TCC2: OBLIGATION
    FORALL (m, n: posnat, i: below(m + n), j: upto(i)):
      i >= m AND j < m IMPLIES 0 <= i - m;

  % Subtype TCC generated (at line 26, column 57) for  m - 1
      % expected type  below(m)
  caret_concat_all_TCC3: OBLIGATION
    FORALL (m, n: posnat, i: below(m + n), j: upto(i)):
      i >= m AND j < m IMPLIES m - 1 >= 0 AND m - 1 < m;

  % Subtype TCC generated (at line 26, column 61) for  j
      % expected type  upto(m - 1)
  caret_concat_all_TCC4: OBLIGATION
    FORALL (m, n: posnat, i: below(m + n), j: upto(i)):
      i >= m AND j < m IMPLIES j <= m - 1;

  % Subtype TCC generated (at line 89, column 18) for  1 + i - m
      % expected type  nat
  caret_concat_all_TCC5: OBLIGATION
    FORALL (m, n: posnat, i: below(m + n), j: upto(i)):
      i >= m AND j < m IMPLIES 1 + i - m >= 0;

  % Subtype TCC generated (at line 26, column 57) for  m - j
      % expected type  nat
  caret_concat_all_TCC6: OBLIGATION
    FORALL (m, n: posnat, i: below(m + n), j: upto(i)):
      i >= m AND j < m IMPLIES m - j >= 0;

  % Subtype TCC generated (at line 29, column 37) for  N - 1
      % expected type  below(N)
  bv_decomposition_TCC1: OBLIGATION
    FORALL (N: above(1), k: below(N - 1)): N - 1 >= 0 AND N - 1 < N;

  % Subtype TCC generated (at line 29, column 41) for  k + 1
      % expected type  upto(N - 1)
  bv_decomposition_TCC2: OBLIGATION
    FORALL (N: above(1), k: below(N - 1)): k + 1 <= N - 1;

  % Subtype TCC generated (at line 29, column 53) for  k
      % expected type  below(N)
  bv_decomposition_TCC3: OBLIGATION
    FORALL (N: above(1), k: below(N - 1)): k < N;

  % Subtype TCC generated (at line 29, column 55) for  0
      % expected type  upto(k)
  bv_decomposition_TCC4: OBLIGATION
    FORALL (N: above(1), k: below(N - 1)): 0 <= k;

  % Subtype TCC generated (at line 29, column 37) for  N - 1 - k
      % expected type  nat
  bv_decomposition_TCC5: OBLIGATION
    FORALL (N: above(1), k: below(N - 1)): N - 1 - k >= 0;

  % Subtype TCC generated (at line 89, column 18) for  1 + i2 - j2
      % expected type  nat
  caret_concat_join_TCC1: OBLIGATION
    FORALL (n: posnat, i1, i2: below[n], j1: upto[i1], j2: upto[i2]):
      (j1 = i2 + 1) IMPLIES 1 + i2 - j2 >= 0;

  % Subtype TCC generated (at line 34, column 73) for  j2
      % expected type  upto(i1)
  caret_concat_join_TCC2: OBLIGATION
    FORALL (n: posnat, i1, i2: below[n], j1: upto[i1], j2: upto[i2]):
      (j1 = i2 + 1) IMPLIES j2 <= i1;

  % Subtype TCC generated (at line 34, column 65) for  bvn ^ (i1, j2)
      % expected type  bvec[2 + i1 + i2 - j1 - j2]
  caret_concat_join_TCC3: OBLIGATION
    FORALL (n: posnat, bvn: bvec[n], i1, i2: below[n], j1: upto[i1],
            j2: upto[i2]):
      (j1 = i2 + 1) IMPLIES
       (FORALL (x: nat):
          (^[n](bvn, (i1, j2)))(x) IMPLIES
           (x < 1 + i1 - j2 IFF x < 2 + i1 + i2 - j1 - j2));

  % Subtype TCC generated (at line 37, column 45) for  m - 1
      % expected type  below(m + n)
  concat_bottom_TCC1: OBLIGATION
    FORALL (m, n: posnat): m - 1 >= 0 AND m - 1 < m + n;

  % Subtype TCC generated (at line 37, column 49) for  0
      % expected type  upto(m - 1)
  concat_bottom_TCC2: OBLIGATION FORALL (m: posnat): 0 <= m - 1;

  % Subtype TCC generated (at line 40, column 47) for  (n + m - 1)
      % expected type  below(m + n)
  concat_top_TCC1: OBLIGATION
    FORALL (m, n: posnat): (n + m - 1) >= 0 AND (n + m - 1) < m + n;

  % Subtype TCC generated (at line 40, column 54) for  m
      % expected type  upto((m + n - 1))
  concat_top_TCC2: OBLIGATION FORALL (m, n: posnat): m <= (m + n - 1);


body:
  bv_caret_concat_rules: THEORY

  BEGIN

    IMPORTING bv_caret_concat
    n,m: VAR posnat
    i,j: VAR nat
    b: VAR bit

    bv_concat_bottom     : LEMMA FORALL (bvn: bvec[n], bvm: bvec[m]):
                                  (bvn o bvm)^((m-1), 0) = bvm
   
    bv_concat_top	       : LEMMA FORALL (bvn: bvec[n], bvm: bvec[m]):
                                   (bvn o bvm)^((n+m-1), m) = bvn

    bv_caret_concat_low  : LEMMA FORALL (bvn: bvec[n], bvm: bvec[m]):
                                   (i < m) AND (j <= i) =>  
                                     (bvn o bvm)^(i, j) = bvm^(i, j) 

    bv_caret_concat_high : LEMMA FORALL (bvn: bvec[n], bvm: bvec[m]):
  			          i < n+m AND m <= j AND j <= i 
  				    IMPLIES (bvn o bvm)^(i,j) = bvn^(i-m, j-m)


    bv_caret_concat_split: LEMMA FORALL (bvn: bvec[n], bvm: bvec[m]):
                                   (i < n+m) AND (i >= m) AND
                                    (j < m) AND (j <= i) =>
                               (bvn o bvm)^(i,j) = bvn^(i-m, 0) o bvm^(m-1,j)


    bv_caret_recomp      : LEMMA FORALL (n: posnat, bvn: bvec[n], 
                                        i1,j1,i2,j2: below[n]):
                               (i1 >= j1) AND (i2 >= j2) AND (j1=i2+1) =>
                                  (bvn^(i1,j1) o bvn^(i2,j2) =  bvn^(i1,j2));

    bv_ucaret_concat_1   : LEMMA FORALL (bvn: bvec[n], bvm: bvec[m]):
                                    i < m => (bvn o bvm)^i = bvm^i

    bv_ucaret_concat_2   : LEMMA FORALL (bvn: bvec[n], bvm: bvec[m]): 
                                   (i < n+m) AND (i >= m) => 
                                      (bvn o bvm)^i = bvn^(i-m)  

    bv_caret_fill        : LEMMA FORALL (i: below(n), j: upto(i)): 
  			      fill[n](b)^(i,j) = fill[i-j+1](b)
   

  END bv_caret_concat_rules

addendum:
  %%% ================ Addendum: generated declarations ================

  % Subtype TCC generated (at line 11, column 46) for  (m - 1)
      % expected type  below(m + n)
  bv_concat_bottom_TCC1: OBLIGATION
    FORALL (m, n: posnat): (m - 1) >= 0 AND (m - 1) < m + n;

  % Subtype TCC generated (at line 11, column 52) for  0
      % expected type  upto((m - 1))
  bv_concat_bottom_TCC2: OBLIGATION FORALL (m: posnat): 0 <= (m - 1);

  % Subtype TCC generated (at line 14, column 47) for  (n + m - 1)
      % expected type  below(m + n)
  bv_concat_top_TCC1: OBLIGATION
    FORALL (m, n: posnat): (n + m - 1) >= 0 AND (n + m - 1) < m + n;

  % Subtype TCC generated (at line 14, column 55) for  m
      % expected type  upto((m + n - 1))
  bv_concat_top_TCC2: OBLIGATION FORALL (m, n: posnat): m <= (m + n - 1);

  % Subtype TCC generated (at line 18, column 48) for  i
      % expected type  below(m + n)
  bv_caret_concat_low_TCC1: OBLIGATION
    FORALL (i, j: nat, m, n: posnat): (i < m) AND (j <= i) IMPLIES i < m + n;

  % Subtype TCC generated (at line 22, column 29) for  i
      % expected type  below(m + n)
  bv_caret_concat_high_TCC1: OBLIGATION
    FORALL (i, j: nat, m, n: posnat):
      i < n + m AND m <= j AND j <= i IMPLIES i < m + n;

  % Subtype TCC generated (at line 22, column 41) for  i - m
      % expected type  below(n)
  bv_caret_concat_high_TCC2: OBLIGATION
    FORALL (i, j: nat, m, n: posnat):
      i < n + m AND m <= j AND j <= i IMPLIES i - m >= 0 AND i - m < n;

  % Subtype TCC generated (at line 22, column 46) for  j - m
      % expected type  upto(i - m)
  bv_caret_concat_high_TCC3: OBLIGATION
    FORALL (i, j: nat, m, n: posnat):
      i < n + m AND m <= j AND j <= i IMPLIES j - m >= 0 AND j - m <= i - m;

  % Subtype TCC generated (at line 28, column 42) for  i
      % expected type  below(m + n)
  bv_caret_concat_split_TCC1: OBLIGATION
    FORALL (i, j: nat, m, n: posnat):
      (i < n + m) AND (i >= m) AND (j < m) AND (j <= i) IMPLIES i < m + n;

  % Subtype TCC generated (at line 28, column 54) for  i - m
      % expected type  below(n)
  bv_caret_concat_split_TCC2: OBLIGATION
    FORALL (i, j: nat, m, n: posnat):
      (i < n + m) AND (i >= m) AND (j < m) AND (j <= i) IMPLIES
       i - m >= 0 AND i - m < n;

  % Subtype TCC generated (at line 28, column 59) for  0
      % expected type  upto(i - m)
  bv_caret_concat_split_TCC3: OBLIGATION
    FORALL (i, j: nat, m, n: posnat):
      (i < n + m) AND (i >= m) AND (j < m) AND (j <= i) IMPLIES 0 <= i - m;

  % Subtype TCC generated (at line 28, column 69) for  m - 1
      % expected type  below(m)
  bv_caret_concat_split_TCC4: OBLIGATION
    FORALL (i, j: nat, m, n: posnat):
      (i < n + m) AND (i >= m) AND (j < m) AND (j <= i) IMPLIES
       m - 1 >= 0 AND m - 1 < m;

  % Subtype TCC generated (at line 28, column 73) for  j
      % expected type  upto(m - 1)
  bv_caret_concat_split_TCC5: OBLIGATION
    FORALL (i, j: nat, m, n: posnat):
      (i < n + m) AND (i >= m) AND (j < m) AND (j <= i) IMPLIES j <= m - 1;

  % Subtype TCC generated (at line 89, column 18) for  1 + i - m
      % expected type  nat
  bv_caret_concat_split_TCC6: OBLIGATION
    FORALL (i, j: nat, m, n: posnat):
      (i < n + m) AND (i >= m) AND (j < m) AND (j <= i) IMPLIES
       1 + i - m >= 0;

  % Subtype TCC generated (at line 28, column 69) for  m - j
      % expected type  nat
  bv_caret_concat_split_TCC7: OBLIGATION
    FORALL (i, j: nat, m, n: posnat):
      (i < n + m) AND (i >= m) AND (j < m) AND (j <= i) IMPLIES m - j >= 0;

  % Subtype TCC generated (at line 34, column 41) for  j1
      % expected type  upto(i1)
  bv_caret_recomp_TCC1: OBLIGATION
    FORALL (n: posnat, i1, j1, i2, j2: below[n]):
      (i1 >= j1) AND (i2 >= j2) AND (j1 = i2 + 1) IMPLIES j1 <= i1;

  % Subtype TCC generated (at line 34, column 55) for  j2
      % expected type  upto(i2)
  bv_caret_recomp_TCC2: OBLIGATION
    FORALL (n: posnat, i1, j1, i2, j2: below[n]):
      (i1 >= j1) AND (i2 >= j2) AND (j1 = i2 + 1) IMPLIES j2 <= i2;

  % Subtype TCC generated (at line 89, column 18) for  1 + i1 - j1
      % expected type  nat
  bv_caret_recomp_TCC3: OBLIGATION
    FORALL (n: posnat, i1, j1, i2, j2: below[n]):
      (i1 >= j1) AND (i2 >= j2) AND (j1 = i2 + 1) IMPLIES 1 + i1 - j1 >= 0;

  % Subtype TCC generated (at line 89, column 18) for  1 + i2 - j2
      % expected type  nat
  bv_caret_recomp_TCC4: OBLIGATION
    FORALL (n: posnat, i1, j1, i2, j2: below[n]):
      (i1 >= j1) AND (i2 >= j2) AND (j1 = i2 + 1) IMPLIES 1 + i2 - j2 >= 0;

  % Subtype TCC generated (at line 34, column 70) for  j2
      % expected type  upto(i1)
  bv_caret_recomp_TCC5: OBLIGATION
    FORALL (n: posnat, i1, j1, i2, j2: below[n]):
      (i1 >= j1) AND (i2 >= j2) AND (j1 = i2 + 1) IMPLIES j2 <= i1;

  % Subtype TCC generated (at line 34, column 62) for  bvn ^ (i1, j2)
      % expected type  bvec[2 + i1 + i2 - j1 - j2]
  bv_caret_recomp_TCC6: OBLIGATION
    FORALL (n: posnat, bvn: bvec[n], i1, j1, i2, j2: below[n]):
      (i1 >= j1) AND (i2 >= j2) AND (j1 = i2 + 1) IMPLIES
       (FORALL (x: nat):
          (^[n](bvn, (i1, j2)))(x) IMPLIES
           (x < 1 + i1 - j2 IFF x < 2 + i1 + i2 - j1 - j2));

  % Subtype TCC generated (at line 37, column 55) for  i
      % expected type  below[m + n]
  bv_ucaret_concat_1_TCC1: OBLIGATION
    FORALL (i: nat, m, n: posnat): i < m IMPLIES i < m + n;

  % Subtype TCC generated (at line 41, column 48) for  i
      % expected type  below[m + n]
  bv_ucaret_concat_2_TCC1: OBLIGATION
    FORALL (i: nat, m, n: posnat): (i < n + m) AND (i >= m) IMPLIES i < m + n;

  % Subtype TCC generated (at line 41, column 57) for  (i - m)
      % expected type  below[n]
  bv_ucaret_concat_2_TCC2: OBLIGATION
    FORALL (i: nat, m, n: posnat):
      (i < n + m) AND (i >= m) IMPLIES (i - m) >= 0 AND (i - m) < n;

  % Subtype TCC generated (at line 44, column 37) for  1 + i - j
      % expected type  nat
  bv_caret_fill_TCC1: OBLIGATION
    FORALL (n: posnat, i: below(n), j: upto(i)): 1 + i - j >= 0;


body:
  %------------------------------------------------------------------------
  %
  % Integer interpretation of a bitvector (twos-complement interpretation)
  % ----------------------------------------------------------------------
  %
  %   Defines:
  %
  %      minint: int = -exp2(N-1)
  %      maxint: int =  exp2(N-1) - 1
  %      rng_2s_comp: TYPE = {i: int | minint <= i AND i <= maxint}
  %      bv2int : [bvec[N] -> rng_2s_comp] 
  %      int2bv : [rng_2s_comp  -> bvec[N]]
  %  
  %   Establishes:
  %  
  %      bv2int_bij : THEOREM bijective?(bv2int)
  %      bv2int_inv : THEOREM bv2int(int2bv(iv))=iv
  %
  %   Note.  The int2bv should be avoided in practice.  It is necessary
  %          for the development of the library.
  %
  %------------------------------------------------------------------------
  bv_int[N: posnat]: THEORY
  BEGIN

    IMPORTING bv_nat[N], bv_int_defs[N]

  % Definitions have been moved to the prelude theory bv_int_defs
  % to support Yices

  %   minint: int = -exp2(N-1)
  %   maxint: int =  exp2(N-1) - 1

  %   bv_maxint_to_minint:    LEMMA maxint = -minint - 1
  %   bv_minint_to_maxint:    LEMMA minint = -maxint - 1

  %   in_rng_2s_comp(i: int): bool = (minint <= i AND i <= maxint)
  %   rng_2s_comp: TYPE = {i: int | minint <= i AND i <= maxint}

  %   bv2int(bv: bvec[N]): rng_2s_comp = IF bv2nat(bv) < exp2(N-1) THEN bv2nat(bv)
  %                                      ELSE bv2nat(bv) - exp2(N) ENDIF

    i           : VAR below(N)
    iv,ii       : VAR rng_2s_comp
    bv, bv1, bv2: VAR bvec[N]

      
    bv2int_inj    : THEOREM % injective?(bv2int)
                                 bv2int(bv1) = bv2int(bv2) IMPLIES (bv1 = bv2)

    bv2int_surj   : THEOREM % surjective?(bv2int)
                                (EXISTS (bv: bvec[N]): bv2int(bv) = iv)

    bv2int_bij    : THEOREM bijective?(bv2int)

    bv2int_lem    : THEOREM bv2int(bv) = bv2nat(bv) - exp2(N) * bv^(N - 1)

    bv2int_fill_F : THEOREM bv2int(fill[N](FALSE)) = 0

    bv2int_fill_T : THEOREM bv2int(fill[N](TRUE)) = -1

    bv2int_top_bit: THEOREM IF bv2int(bv) >= 0 THEN bv^(N-1) = FALSE 
                            ELSE bv^(N-1) = TRUE ENDIF

    bv2int_topbit : THEOREM bv^(N-1) IFF (bv2int(bv) < 0)

  % ---------- Properties of int2bv ----------------------------


  %  int2bv(iv: rng_2s_comp): {bv | bv2int(bv) = iv}

    int2bv_def : THEOREM int2bv = inverse(bv2int) 

    int2bv_bij : THEOREM bijective?[rng_2s_comp,bvec[N]](int2bv)

    bv2int_inv : THEOREM bv2int(int2bv(iv))=iv

    int2bv_inv : THEOREM int2bv(bv2int(bv)) = bv

    int2bv_2nat: THEOREM  int2bv(ii) = IF ii >= 0 THEN nat2bv[N](ii)
                                     ELSE nat2bv[N](ii+exp2(N)) ENDIF


  END bv_int

addendum:
  %%% ================ Addendum: generated declarations ================

  % Subtype TCC generated (at line 56, column 66) for  (N - 1)
      % expected type  below[N]
  bv2int_lem_TCC1: OBLIGATION (N - 1) >= 0 AND (N - 1) < N;

  % Subtype TCC generated (at line 80, column 63) for  ii
      % expected type  val: below(exp2(N))
  int2bv_2nat_TCC1: OBLIGATION
    FORALL (ii: rng_2s_comp[N]): ii >= 0 IMPLIES ii < exp2(N);

  % Subtype TCC generated (at line 81, column 50) for  ii + exp2(N)
      % expected type  val: below(exp2(N))
  int2bv_2nat_TCC2: OBLIGATION
    FORALL (ii: rng_2s_comp[N]):
      NOT ii >= 0 IMPLIES ii + exp2(N) >= 0 AND ii + exp2(N) < exp2(N);


body:
  bv_arith_int_concat: THEORY

  BEGIN

    IMPORTING bv_arith_nat, bv_int,
              bv_arith_concat % For proofs only



    bv2int_concat      : LEMMA FORALL (n, m: posnat, bvn: bvec[n], bvm: bvec[m]):
                                  bv2int(bvn o bvm) = bv2int(bvn) * exp2(m) 
                                                      + bv2int(bvm) 
                                                      + b2n(bvm^(m-1)) * exp2(m)

  END bv_arith_int_concat

addendum:
  %%% ================ Addendum: generated declarations ================

  % Subtype TCC generated (at line 10, column 75) for  m + n
      % expected type  posnat
  bv2int_concat_TCC1: OBLIGATION FORALL (n, m: posnat): m + n > 0;

  % Subtype TCC generated (at line 13, column 63) for  (m - 1)
      % expected type  below[m]
  bv2int_concat_TCC2: OBLIGATION
    FORALL (n, m: posnat): (m - 1) >= 0 AND (m - 1) < m;


body:
  %------------------------------------------------------------------------
  %
  % Defines functions over bit vectors interpreted as natural numbers.
  %
  %    Introduces:
  %
  %         - :  bv1 - bv2
  %         - : [bvec -> bvec] 
  %         - : [bvec, bvec -> bvec]
  %         overflow    : [bvec, bvec -> bool]  
  %         underflow   : [bvec, bvec -> bool]  
  %   
  %------------------------------------------------------------------------
  bv_arithmetic[N: posnat]: THEORY
  BEGIN

    IMPORTING bv_int[N], bv_arith_caret, bv_arithmetic_defs[N]

    bv, bv1, bv2 : VAR bvec[N]

  % The following three definitions are now in the prelude theory
  %   bv_arithmetic_defs - they were moved there to support Yices

  % ---------- 2's complement negation of a bit vector ----------
      
  %   -(bv: bvec[N]): { bvn: bvec[N] | bv2int(bvn) = 
  %                               IF bv2int(bv) = minint THEN bv2int(bv)
  %                               ELSE -(bv2int(bv)) ENDIF}

  % ---------- 2's complement subtraction of two bit vectors ----------
      
  %   -(bv1, bv2): bvec[N] = (bv1 + (-bv2))

  % ---------- Define conditions for 2's complement overflow  ----------

      
  %   overflow(bv1,bv2): bool = (bv2int(bv1) + bv2int(bv2)) > maxint
  %                              OR (bv2int(bv1) + bv2int(bv2)) < minint 

  % === Properties of these additional functions ================================

    % ----------------------------------------------------------------------
    % If the result is in the range of 2s complement integers, addition of
    % two bit vectors is the same as for a natural number interpretation
    % ----------------------------------------------------------------------
     
    bv_top_bit_0: LEMMA  bv^(N-1) = FALSE IFF bv2nat(bv) < exp2(N-1)

    bv2int_add  : THEOREM in_rng_2s_comp(bv2int(bv1) + bv2int(bv2))
                           IMPLIES bv2int(bv1 + bv2) = bv2int(bv1) + bv2int(bv2)  
      
    bv2int_neg : LEMMA bv2int(-bv) = IF bv2int(bv) = minint THEN bv2int(bv)
                                     ELSE -(bv2int(bv)) ENDIF 

    bv2int_minus_1  : LEMMA bv2int(bv1) > minint AND bv2int(bv) = 1 
                         IMPLIES bv2int(bv1 - bv) = bv2int(bv1) - 1

    bv2int_plus_1: LEMMA bv2int(bv + 1) = IF bv2int(bv) = maxint[N] THEN minint[N]
                                         ELSE bv2int(bv) + 1 ENDIF 

    bv2int_elim    : LEMMA bv1 + bv2int(bv2) = bv1 + bv2

    i: VAR int
    bv2int_plus_i: LEMMA bv2int(bv+i) =
                         mod(bv2int(bv) + exp2(N) * b2n(bv^(N - 1)) + i, exp2(N))
                           - exp2(N) * b2n((bv + i)^(N - 1))

    bv2int_maxint : LEMMA bv2int(bv) = maxint IFF bv = b0 o fill[N-1](TRUE)
      
    bv2int_minint : LEMMA bv2int(bv) = minint IFF bv = b1 o fill[N-1](FALSE)

    IMPORTING bv_bitwise[N]
   
    n          : VAR upto(N)
     
    bv2nat_compl_max  : THEOREM bv2nat_rec(n, bv) + bv2nat_rec(n, NOT bv) 
                            = exp2(n) - 1

    % ----------------------------------------------------------------------
    % The 2s complement of a number is its 1s complement + 1
    % ----------------------------------------------------------------------

    bv_twos_compl     : THEOREM -bv2int(bv) = bv2int(NOT bv) + 1;

    bv_unary_minus    : THEOREM (-bv) = (NOT bv) + 1

    bv2nat_NOT     : COROLLARY bv2nat(NOT bv) = exp2(N) - bv2nat(bv) - 1  
   

    bv2int_NOT     : COROLLARY bv2int(NOT bv) = -bv2int(bv) - 1

    bv2nat_minus_bv: COROLLARY bv2nat(-bv) = IF bv2nat(bv) = 0 THEN 0
                                             ELSE exp2(N) - bv2nat(bv) ENDIF

    bv_is_minint   : COROLLARY bv2int(-bv) = bv2int(bv) 
                                 IMPLIES bv2int(bv) = minint OR bv2int(bv) = 0
   
    bv_neg_distrib : THEOREM -(bv1 + bv2) = -bv1 + -bv2

    bv_double_neg  : THEOREM -(-(bv1)) = bv1


  END bv_arithmetic

addendum:
  %%% ================ Addendum: generated declarations ================

  % Subtype TCC generated (at line 47, column 27) for  (N - 1)
      % expected type  below[N]
  bv_top_bit_0_TCC1: OBLIGATION (N - 1) >= 0 AND (N - 1) < N;

  % Subtype TCC generated (at line 47, column 62) for  N - 1
      % expected type  nat
  bv_top_bit_0_TCC2: OBLIGATION N - 1 >= 0;


body:
  bv_extend [N: posnat] : THEORY
  % -----------------------------------------------------------------------  
  %    Introduces:
  %	zero_extend: [k: above(N) -> [bvec[N] -> bvec[l]]] =
  %	sign_extend: [k: above(N) -> [bvec[N] -> bvec[l]]] =
  %	zero_extend_lsend: [k: above(N) -> [bvec[N] -> bvec[l]]]
  %	lsb_extend: [k: above(N) -> [bvec[N] -> bvec[l]]] =
  %   
  % -----------------------------------------------------------------------  

  BEGIN

    IMPORTING bv_caret, bv_concat, bv_extend_defs[N]
      
    bv: VAR bvec[N]
    k: VAR above(N)

  % Definitions have been moved to the prelude theory bv_extend_defs
  % to support Yices
    %------------------------------------------------------------------------
    % zero_extend returns a function that extends a bit vector to length k 
    % such that its interpretation as a natural number remains unchanged.
    % That is, it fills 0's at the most significant positions.
    %------------------------------------------------------------------------

  %   zero_extend(k: above(N)): [bvec[N] -> bvec[k]] =
  %        (LAMBDA bv: fill[k-N](FALSE) o bv )

    %------------------------------------------------------------------------
    % sign_extend returns a function that extends a bit vector to length k
    % by repeating the most significant bit of the given bit vector.
    % The set above(N) contains nat numbers greater than n.
    %------------------------------------------------------------------------

  %   sign_extend(k: above(N)): [bvec[N] -> bvec[k]] =
  %        (LAMBDA bv:  fill[k-N](bv^(N-1)) o bv )
    %------------------------------------------------------------------------
    % zero_extend_lsend returns a function that extends a bit vector to
    % length k by padding 0's at the least significant end of bvec.
    % That is, the bv2nat interpretation of the argument increases by 2**(k-N)
    %------------------------------------------------------------------------
      
  %   zero_extend_lsend(k: above(N)): [bvec[N] -> bvec[k]] =
  %         (LAMBDA bv:  bv o fill[k-N](FALSE))
    
    %------------------------------------------------------------------------
    % lsb_extend returns a function that extends a bit vector to
    % length k by repeating the lsb of the bit vector at its
    % least significant end.
    %------------------------------------------------------------------------
      
  %   lsb_extend(k: above(N)): [bvec[N] -> bvec[k]] =
  %        (LAMBDA bv: bv o fill[k-N](bv^0)) 

    zero_extend_def       : LEMMA zero_extend(k)(bv)  = fill[k-N](FALSE) o bv
    
    sign_extend_def       : LEMMA sign_extend(k)(bv)  = fill[k-N](bv^(N-1)) o bv 
    
    zero_extend_lsend_def : LEMMA zero_extend_lsend(k)(bv) = bv o fill[k-N](FALSE)
    
    lsb_extend__def       : LEMMA lsb_extend(k)(bv)        = bv o fill[k-N](bv^0)

  END bv_extend

addendum:
  %%% ================ Addendum: generated declarations ================

  % Subtype TCC generated (at line 55, column 59) for  k - N
      % expected type  nat
  zero_extend_def_TCC1: OBLIGATION FORALL (k: above(N)): k - N >= 0;

  % Subtype TCC generated (at line 57, column 68) for  (N - 1)
      % expected type  below[N]
  sign_extend_def_TCC1: OBLIGATION (N - 1) >= 0 AND (N - 1) < N;

  % Subtype TCC generated (at line 61, column 77) for  0
      % expected type  below[N]
  lsb_extend__def_TCC1: OBLIGATION 0 < N;


body:
  bv_arith_extend: THEORY

  BEGIN

    IMPORTING bv_extend, bv_arithmetic, bv_arith_int_concat, bv_bitwise

    n: VAR posnat    

    zero_extend_lem  : THEOREM (FORALL (bv: bvec[n], k: above(n)):
                          bv2nat[k](zero_extend[n](k)(bv)) = bv2nat(bv))

    sign_to_zero     : THEOREM (FORALL (bv: bvec[n], k: above(n)):
                                sign_extend[n](k)(bv) =
  			         IF bv(n-1) THEN 
                                      NOT(zero_extend[n](k)(NOT(bv)))
  			         ELSE zero_extend[n](k)(bv)
  			         ENDIF)

    sign_extend_lem  : THEOREM (FORALL (bv: bvec[n], k: above(n)):
                                 bv2int[k](sign_extend[n](k)(bv)) = bv2int(bv))

    zero_extend_lsend: THEOREM (FORALL (bv: bvec[n], k: above(n)):
                                  bv2nat(zero_extend_lsend[n](k)(bv)) 
                                     = bv2nat(bv) * exp2(k-n))

    pos_nat_below(n) : TYPE = {nn: nat | nn > 0 AND nn < n} 
    bv2int_elim_gen  : LEMMA (FORALL (m: pos_nat_below(n),
                                      bv1: bvec[n],bv2: bvec[m]):
                          bv1 + sign_extend[m](n)(bv2) = bv1 + bv2int[m](bv2))



  END bv_arith_extend

addendum:
  %%% ================ Addendum: generated declarations ================

  % Subtype TCC generated (at line 14, column 18) for  n - 1
      % expected type  below(n)
  sign_to_zero_TCC1: OBLIGATION FORALL (n: posnat): n - 1 >= 0 AND n - 1 < n;

  % Subtype TCC generated (at line 24, column 55) for  k - n
      % expected type  nat
  zero_extend_lsend_TCC1: OBLIGATION
    FORALL (n: posnat, k: above(n)): k - n >= 0;

  % Subtype TCC generated (at line 29, column 45) for  n
      % expected type  k: above(m)
  bv2int_elim_gen_TCC1: OBLIGATION
    FORALL (n: posnat, m: pos_nat_below(n)): n > m;


body:
  bv_overflow[N:posnat]: THEORY

  BEGIN

    IMPORTING bv_arithmetic[N]

    bv,bv1,bv2: var bvec[N]

    overflow(bv1,bv2): bool = NOT in_rng_2s_comp(bv2int(bv1) + bv2int(bv2))

    overflow_then_eq: LEMMA overflow(bv1,bv2) IMPLIES 
                                bv1 ^ (N - 1) = bv2 ^ (N - 1)
    
    i: VAR int  

    bv2int_overflow_nat : LEMMA NOT in_rng_2s_comp(bv2int(bv1) + bv2int(bv2))
                                      IMPLIES bv2int(bv1 + bv2) = 
                                        bv2nat(bv1) + bv2nat(bv2) - exp2(N)

    bv_not_in_rng_int   : LEMMA NOT in_rng_2s_comp(bv2int(bv1) + bv2int(bv2))
                                      IMPLIES bv2int(bv1 + bv2) =
                                          bv2int(bv1) + bv2int(bv2) 
                                                + exp2(N) * b2n(bv1(N - 1))
                                                + exp2(N) * b2n(bv2(N - 1))
                                                - exp2(N)

    bv2int_add_overflow : THEOREM NOT in_rng_2s_comp(bv2int(bv1) + bv2int(bv2))
                             IMPLIES bv2int(bv1 + bv2) =
              		       IF bv2int(bv1) >= 0 AND bv2int(bv2) >= 0
              			  THEN bv2int(bv1) + bv2int(bv2) - exp2(N)
              		       ELSE bv2int(bv1) + bv2int(bv2) + exp2(N) 
                                 ENDIF


    bv_sum_limits       : LEMMA bv2int(bv1) + bv2int(bv2) <= 2 * maxint AND
                                bv2int(bv1) + bv2int(bv2) >= 2 * minint  

    bv_bits_for_overflow: LEMMA (bv1 ^ (N - 1) = bv2 ^ (N - 1)
                                AND bv1 ^ (N - 1) /= (bv1 + bv2) ^ (N - 1))
                                    IMPLIES overflow(bv1, bv2)

    bv_overflow_bits_ne : LEMMA overflow(bv1,bv2) IMPLIES 
                                        (bv1 ^ (N - 1) /= (bv1 + bv2) ^ (N - 1))

    bv_overflow_def     : THEOREM overflow(bv1, bv2) =
                                     ((bv1 ^ (N - 1) = bv2 ^ (N - 1))
                                     AND (bv1 ^ (N - 1) /= (bv1 + bv2) ^ (N - 1)))

  END bv_overflow

addendum:
  %%% ================ Addendum: generated declarations ================

  % Subtype TCC generated (at line 12, column 37) for  (N - 1)
      % expected type  below[N]
  overflow_then_eq_TCC1: OBLIGATION
    FORALL (bv1, bv2: bvec[N]):
      overflow(bv1, bv2) IMPLIES (N - 1) >= 0 AND (N - 1) < N;

  % Subtype TCC generated (at line 23, column 66) for  N - 1
      % expected type  below(N)
  bv_not_in_rng_int_TCC1: OBLIGATION
    FORALL (bv1, bv2: bvec[N]):
      NOT in_rng_2s_comp(bv2int(bv1) + bv2int(bv2)) IMPLIES
       N - 1 >= 0 AND N - 1 < N;

  % Subtype TCC generated (at line 38, column 38) for  (N - 1)
      % expected type  below[N]
  bv_bits_for_overflow_TCC1: OBLIGATION (N - 1) >= 0 AND (N - 1) < N;


body:
  bv_arith_int_rules: THEORY
  BEGIN

    IMPORTING bv_arithmetic, bv_overflow, bv_arith_extend, bv_arith_caret

    n,N: VAR posnat

    singleton_int: LEMMA FORALL (bv: bvec[n], i: below[n]):
                              bv2int[1](bv^(i,i)) = - b2n(bv^i)

    bv2int_add_combined_rule: LEMMA FORALL (bv1, bv2: bvec[n]):
         bv2int(bv1 + bv2) =
           IF in_rng_2s_comp[n](bv2int(bv1) + bv2int(bv2)) THEN 
                bv2int(bv1) + bv2int(bv2)
           ELSIF bv2int(bv1) >= 0 AND bv2int(bv2) >= 0 THEN 
                bv2int(bv1) + bv2int(bv2) - exp2(n)
           ELSE 
               bv2int(bv1) + bv2int(bv2) + exp2(n) 
           ENDIF

     bv2int_add_no_overflow: LEMMA FORALL (bv1, bv2: bvec[n]):
                        in_rng_2s_comp[n](bv2int(bv1) + bv2int(bv2)) =>
                           bv2int(bv1 + bv2) = bv2int(bv1) + bv2int(bv2)

     bv2int_add_overflow: LEMMA FORALL (bv1, bv2: bvec[n]):
                       (NOT in_rng_2s_comp[n](bv2int(bv1) + bv2int(bv2))) =>
            		   bv2int(bv1 + bv2) =
            		     IF bv2int(bv1) >= 0 & bv2int(bv2) >= 0
            			THEN bv2int(bv1) + bv2int(bv2) - exp2(n)
            		     ELSE bv2int(bv1) + bv2int(bv2) + exp2(n) ENDIF


     sign_bit_of_unary_minus: LEMMA FORALL (bv: bvec[n]):
               (-bv)^(n-1) = IF bv2int(bv) = minint[n] THEN TRUE
                             ELSIF NOT bv^(n-1) THEN 
                                 IF bv2int(bv) = 0 THEN FALSE 
                                 ELSE TRUE ENDIF
                             ELSE FALSE ENDIF

  END bv_arith_int_rules

addendum:
  %%% ================ Addendum: generated declarations ================

  % Subtype TCC generated (at line 9, column 44) for  i
      % expected type  upto(i)
  singleton_int_TCC1: OBLIGATION FORALL (n: posnat, i: below[n]): i <= i;

  % Subtype TCC generated (at line 34, column 20) for  (n - 1)
      % expected type  below[n]
  sign_bit_of_unary_minus_TCC1: OBLIGATION
    FORALL (n: posnat): (n - 1) >= 0 AND (n - 1) < n;


body:
  %------------------------------------------------------------------------
  %
  % Rules derived from bv_arith_nat
  % -------------------------------
  %
  %
  %   o The association rules move bitvectors to the left and integers to the
  %     right.
  %
  %   o Rules collapse bv2nat(expressions) into expressions involving
  %     bv2nat of individual bitvectors 
  %
  %------------------------------------------------------------------------
  bv_arith_nat_rules: THEORY
  BEGIN

    IMPORTING bv_arith_nat

    N: VAR posnat
    n: VAR nat
    i,i1,i2: VAR int
    b: VAR bit

  % ---------- rules involving addition of two bitvectors ----------

    bv_add_rule              : LEMMA FORALL (bv1,bv2: bvec[N]):
                                 bv2nat(bv1) + bv2nat(bv2) < exp2(N) IMPLIES
                                    bv2nat(bv1 + bv2) = bv2nat(bv1) + bv2nat(bv2)

    bv_add_overflow     : LEMMA FORALL (bv1,bv2: bvec[N]):
                                 bv2nat(bv1) + bv2nat(bv2) >= exp2(N) IMPLIES
                          bv2nat(bv1 + bv2) = bv2nat(bv1) + bv2nat(bv2) - exp2(N)


  % ------- rules involving bitvector plus a constant

    bv_fill_F_plus_i : LEMMA bv2nat(fill[N](FALSE) + i) = mod(i,exp2(N))

    bv_plus_fill_T   : LEMMA FORALL (bv: bvec[N]): bv2nat(bv) /= 0 IMPLIES
                                       bv2nat(bv + fill[N](TRUE)) = bv2nat(bv) - 1

    bv2nat_elim_rule : LEMMA FORALL (bv1,bv2: bvec[N]): 
                                         bv1 + bv2nat(bv2) = bv1 + bv2

    bv2nat_plus: LEMMA FORALL (bv: bvec[N]): n < (exp2(N) - bv2nat(bv)) =>
                                               bv2nat(bv + n) = bv2nat(bv) + n

    bv2nat_plus2: LEMMA FORALL (bv: bvec[N]): n < exp2(N) AND 
                                              bv2nat(bv) + n >= exp2(N) =>
                           bv2nat(bv +  n) = bv2nat(bv) - (exp2(N) - n)


    bv2nat_minus : LEMMA FORALL (bv: bvec[N]):  n <= bv2nat(bv) =>
                                                 bv2nat(bv - n) = bv2nat(bv) - n

    bv2nat_minus2 : LEMMA FORALL (bv: bvec[N]):  n > bv2nat(bv) AND n < exp2(N) =>
                                   bv2nat(bv - n) = bv2nat(bv) - n + exp2(N)


    bv2nat_neg : LEMMA FORALL (bv: bvec[N]):  i < 0 AND (-i) <= bv2nat(bv) =>
                                                 bv2nat(bv + i) = bv2nat(bv) + i

    bv2nat_neg2: LEMMA FORALL (bv: bvec[N]): i < 0 AND (-i) > bv2nat(bv) AND
                                               (-i) < exp2(N) =>
                                  bv2nat(bv + i) = bv2nat(bv) + i + exp2(N)

  % if the above rewrites fail, reduce magnitude via mod:

    bv2nat_neg_modulo: LEMMA FORALL (bv: bvec[N]): i <= -exp2(N) =>
                              bv2nat(bv + i) = bv2nat(bv + (-mod(-i, exp2(N))))


  % ----------- miscellaneous rules ----------

    singleton_nat_alt   : LEMMA FORALL (bv: bvec[N]):
                                  N = 1 => bv2nat[N](bv) = b2n(bv^0)

  END bv_arith_nat_rules

addendum:
  %%% ================ Addendum: generated declarations ================

  % Subtype TCC generated (at line 76, column 64) for  0
      % expected type  below[N]
  singleton_nat_alt_TCC1: OBLIGATION FORALL (N: posnat): N = 1 IMPLIES 0 < N;


body:
  bv_arith_minus_rules: THEORY
  BEGIN

    IMPORTING bv_arithmetic

    N: VAR posnat

    bv_assoc_obliviation : LEMMA FORALL (bv1,bv2: bvec[N]):
                                  bv1 + (-(bv1) + bv2) = bv2

    bv_neg_identity      : LEMMA FORALL (bv1: bvec[N]): -(-(bv1)) = bv1
    
    bv_sub_normalization : LEMMA FORALL (bv1,bv2: bvec[N]):
                                   (bv1 - bv2) = bv1 + (-bv2)
    
    bv_neg_distribution  : LEMMA FORALL (bv1,bv2: bvec[N]):
                                   -(bv1 + bv2) = -bv1 + -bv2
    
    
    bv_plus_neg_distrib  : LEMMA FORALL (i: int, bv: bvec[N]):
                                      -(bv + i) = -bv + (-i)

    bv_sub_identity_R    : LEMMA FORALL (bv1: bvec[N]):
                                  bv1 + -(fill[N](FALSE)) = bv1
    
    bv_sub_identity_L    : LEMMA FORALL (bv1: bvec[N]):
                                  -(fill[N](FALSE)) + bv1 = bv1
    
    bv_fill_increment_R  : LEMMA FORALL (bv1: bvec[N]):
                                  (bv1 + -(fill[N](TRUE))) = bv1 + 1
    
    bv_fill_increment_L  : LEMMA FORALL (bv1: bvec[N]):
                                  (-(fill[N](TRUE)) + bv1) = bv1 + 1
    
    bv_not_normalization : LEMMA FORALL (bv1,bv2: bvec[N]):
                                  (NOT (bv1)) = -(bv1) + (-1)


  END bv_arith_minus_rules


body:
  bv_arith_rules: THEORY
  BEGIN

    IMPORTING bv_arith_nat

    N: VAR posnat
    n: VAR nat
    i,i1,i2: VAR int
    b: VAR bit

  % ---------- rules involving addition of two bitvectors ----------

    bv_add_normalization     : LEMMA FORALL (bv1,bv2,bv3: bvec[N]): 
                                           bv1 + (bv2 + bv3) = (bv1 + bv2) + bv3

    bv_add_both_sides        : LEMMA FORALL (bv1,bv2,bv3: bvec[N]):
                                       (bv1 + bv3 = bv2 + bv3) IFF bv1 = bv2

    bv_add_associative       : LEMMA FORALL (bv1,bv2,bv3: bvec[N]):
                                        bv1 + (bv2 + bv3) = (bv1 + bv2) + bv3 

    bv_add_identity_R        : LEMMA FORALL (bv1: bvec[N]): 
                                           bv1 + fill[N](FALSE) = bv1

    bv_add_identity_L        : LEMMA FORALL (bv1: bvec[N]): 
                                           fill[N](FALSE) + bv1 = bv1

  % ------- rules involving bitvector plus a constant

    bv_plus_wrap_rule : LEMMA FORALL (bv: bvec[N]): bv + i*exp2(N) = bv

    bv_fill_T_plus1   : LEMMA fill[N](TRUE) + 1 = fill[N](FALSE)


    bv_plus_0         : LEMMA FORALL (bv: bvec[N]): i = 0 IMPLIES bv + i = bv

    bv_plus_inj_rule  : LEMMA FORALL (bv: bvec[N]),(n1,n2: below(exp2(N))):
                                        (bv + n1 = bv + n2) = (n1 = n2)

  % ----- rules involving addition of two bitvectors and integers -----

  %  bv_bit_add_normalization : LEMMA FORALL (bv1,bv2: bvec[N]):
  %                                         bv1 + (bv2 + b) = (bv1 + b) + bv2 

    bv_plus_assoc1           : LEMMA FORALL (bv1,bv2: bvec[N]):
                                   bv1 + (bv2 + i) = (bv1 + bv2) + i

    bv_plus_assoc2           : LEMMA FORALL (bv1,bv2: bvec[N]):
                                  (bv1 + i) + bv2  = (bv1 + bv2) + i

    bv_plus_2int_assoc       : LEMMA FORALL (bv1: bvec[N]):
                                  (bv1 + i1) + i2  = bv1 + (i1 + i2) 


    bv_add_2_consts_1   : LEMMA FORALL (bv: bvec[N]),(k1,k2: int):
                                        (bv + k1) + k2 = bv + (k1+k2)

    bv_add_2_consts_2   : LEMMA FORALL (bv1,bv2: bvec[N]),(k1,k2: int):
                                 (bv1 + k1) + (bv2 + k2) = (bv1 + bv2) + (k1 + k2) 

  % ---- The following converts +(bv1,bv2) INTO bv plus constant

    fill_T_plus_bv   : LEMMA (FORALL (bv: bvec[N]): fill[N](TRUE) + bv = (bv - 1))
    bv_plus_fill_T   : LEMMA (FORALL (bv: bvec[N]): bv + fill[N](TRUE) = (bv - 1))


  END bv_arith_rules


body:
  bv_concat_rules: THEORY

  BEGIN

    IMPORTING bv_arith_concat, bv_bitwise

    m,n,p: VAR nat
    b: VAR bit


  %  -------- concatenation normalization -------- 


     bv_concat_null_r      : LEMMA FORALL (bvn:bvec[n], bv0: bvec[0]):
                                     (bvn o bv0 = bvn)
   
     bv_concat_null_l      : LEMMA FORALL (bvn:bvec[n], bv0: bvec[0]):
                                     (bv0 o bvn = bvn)

     bv_concat_associative : LEMMA FORALL (bvm:bvec[m], bvn:bvec[n], bvp:bvec[p]):
                                     (bvm o (bvn o bvp)) = ((bvm o bvn) o bvp) 

  %  -------- fill concatenation -------- 

     n1, n2, n3: VAR nat
    
     bv_concat_fill_fill : LEMMA fill[n1](b) o fill[n2](b) = fill[n1+n2](b)

     bv_concat_2fill     : LEMMA FORALL (bv: bvec[n]): 
                                       (fill[n1](b) o (fill[n2](b)) o bv) 
                                           = (fill[n1+n2](b) o bv);

  % ---------- miscellaneous --------

    bv_concat_top_rule  : LEMMA FORALL (N: posnat, bvn: bvec[N], bvm: bvec[m]):
                                           (bvn o bvm)^(N+m-1) = bvn^(N-1)

    bv_not_over_concat  : LEMMA FORALL (bvm: bvec[m], bvn: bvec[n]):
                                        (NOT (bvm o bvn)) = (NOT bvm) o (NOT bvn)

  END bv_concat_rules

addendum:
  %%% ================ Addendum: generated declarations ================

  % Subtype TCC generated (at line 36, column 54) for  (N + m - 1)
      % expected type  below[N + m]
  bv_concat_top_rule_TCC1: OBLIGATION
    FORALL (m: nat, N: posnat): (N + m - 1) >= 0 AND (N + m - 1) < N + m;

  % Subtype TCC generated (at line 36, column 68) for  (N - 1)
      % expected type  below[N]
  bv_concat_top_rule_TCC2: OBLIGATION
    FORALL (N: posnat): (N - 1) >= 0 AND (N - 1) < N;


body:
  bv_caret_bitwise: THEORY
  BEGIN

    IMPORTING bv_caret, bv_bitwise

    n: VAR nat

    bv_OR_caret : LEMMA (FORALL (bv1,bv2: bvec[n], i: below(n), j: upto(i)):
                         (bv1 OR bv2)^(i,j) = (bv1^(i,j) OR bv2^(i,j)))

    bv_AND_caret: LEMMA (FORALL (bv1,bv2: bvec[n], i: below(n), j: upto(i)):
                         (bv1 AND bv2)^(i,j) = (bv1^(i,j) AND bv2^(i,j)))

    bv_IFF_caret: LEMMA (FORALL (bv1,bv2: bvec[n], i: below(n), j: upto(i)):
                         (bv1 IFF bv2)^(i,j) = (bv1^(i,j) IFF bv2^(i,j)))

    bv_XOR_caret: LEMMA (FORALL (bv1,bv2: bvec[n], i: below(n), j: upto(i)):
                         XOR(bv1,bv2)^(i,j) = (bv1^(i,j) XOR bv2^(i,j)) )

    bv_NOT_caret: LEMMA (FORALL (bv: bvec[n], i: below(n), j: upto(i)):
                         (NOT bv)^(i,j) = NOT bv^(i,j) )

  END bv_caret_bitwise

addendum:
  %%% ================ Addendum: generated declarations ================

  % Subtype TCC generated (at line 89, column 18) for  1 + i - j
      % expected type  nat
  bv_OR_caret_TCC1: OBLIGATION
    FORALL (n: nat, i: below(n), j: upto(i)): 1 + i - j >= 0;


body:
  bv_caret_bitwise_rules: THEORY
  % -----------------------------------------------------------------------
  % Rules derived from bv_bitwise and bv_caret
  %
  % -----------------------------------------------------------------------  
  BEGIN

    IMPORTING bv_caret_bitwise


    N : VAR nat

    bv_caret_OR       : LEMMA (FORALL (bv1,bv2: bvec[N], i: below[N], j: upto(i)):
                          (bv1 OR bv2)^(i,j) = (bv1^(i,j) OR bv2^(i,j)))

    bv_caret_AND      : LEMMA (FORALL (bv1,bv2: bvec[N], i: below[N], j: upto(i)):
                          (bv1 AND bv2)^(i,j) = (bv1^(i,j) AND bv2^(i,j)))

    bv_caret_XOR      : LEMMA (FORALL (bv1,bv2: bvec[N], i: below[N], j: upto(i)):
                          XOR(bv1,bv2)^(i,j) = (bv1^(i,j) XOR bv2^(i,j)) )

    bv_caret_IFF      : LEMMA (FORALL (bv1,bv2: bvec[N], i: below(N), j: upto(i)):
                          (bv1 IFF bv2)^(i,j) = (bv1^(i,j) IFF bv2^(i,j)))
    
    bv_caret_NOT      : LEMMA (FORALL (bv: bvec[N], i: below(N), j: upto(i)):
                          (NOT bv)^(i,j) = NOT bv^(i,j) )



    bv_caret_OR_unary : LEMMA (FORALL (bv1, bv2: bvec[N], i: below[N]):
                          (bv1 OR bv2)^i = (bv1^i OR bv2^i))

    bv_caret_AND_unary: LEMMA (FORALL (bv1,bv2: bvec[N], i: below[N]):
                          (bv1 AND bv2)^i = (bv1^i AND bv2^i))

    bv_caret_XOR_unary: LEMMA (FORALL (bv1,bv2: bvec[N], i: below[N]):
                          XOR(bv1,bv2)^i = (bv1^i XOR bv2^i) )

    bv_caret_IFF_unary: LEMMA (FORALL (bv1,bv2: bvec[N], i: below[N]):
                            IFF(bv1,bv2)^i = (bv1^i IFF bv2^i) )

    bv_caret_NOT_unary: LEMMA (FORALL (bv: bvec[N], i: below[N]):
                          (NOT bv)^i = NOT bv^i )


  END bv_caret_bitwise_rules

addendum:
  %%% ================ Addendum: generated declarations ================

  % Subtype TCC generated (at line 89, column 18) for  1 + i - j
      % expected type  nat
  bv_caret_OR_TCC1: OBLIGATION
    FORALL (N: nat, i: below[N], j: upto(i)): 1 + i - j >= 0;


body:
  bv_caret_rules: THEORY
  %-----------------------------------------------------------------------
  %  
  %-----------------------------------------------------------------------  
  BEGIN

    IMPORTING bv_caret

    N, n, m : VAR nat
    i, j, i1, j1, i2, j2, k : VAR nat
    b: VAR bit

    bv_caret_remove     : LEMMA FORALL (bv: bvec[N]): 
                                  i=N-1 AND j=0 => bv^(i,j) = bv

    bv_caret_ii_0_rule  : LEMMA FORALL (bv: bvec[N]): 
                                  i < N => bv^(i,i)^0 = bv^i

    bv_caret_elim_rule  : LEMMA FORALL (bv: bvec[N]): 
                                  i < N AND j <= i AND k < i-j+1 => 
                                      bv ^ (i, j) ^ k = bv^(j+k)

    bv_caret_denormalize: LEMMA FORALL (n: posnat, bvn: bvec[n]):
                                  i1 < n         AND   j1 <= i1 AND 
                                  i2 < i1-j1+1   AND   j2 <= i2 AND 
                                  i2-j2+1 <= i1-j1+1 =>
                                     (bvn^(i1, j1))^(i2, j2) = bvn^(i2+j1, j2+j1)


    bv_fill_caret       : LEMMA n < m AND k < m AND k <= n =>
                                     (fill[m](b))^(n, k) = fill[n-k+1](b)

    bv_fill_caret_unary : LEMMA n < m => (fill[m](b))^n = b

  END bv_caret_rules 

addendum:
  %%% ================ Addendum: generated declarations ================

  % Subtype TCC generated (at line 14, column 53) for  i
      % expected type  below(N)
  bv_caret_remove_TCC1: OBLIGATION
    FORALL (N, i, j: nat): i = N - 1 AND j = 0 IMPLIES i < N;

  % Subtype TCC generated (at line 14, column 55) for  j
      % expected type  upto(i)
  bv_caret_remove_TCC2: OBLIGATION
    FORALL (N, i, j: nat): i = N - 1 AND j = 0 IMPLIES j <= i;

  % Subtype TCC generated (at line 14, column 60) for  bv
      % expected type  bvec[1 + i - j]
  bv_caret_remove_TCC3: OBLIGATION
    FORALL (N, i, j: nat, bv: bvec[N]):
      i = N - 1 AND j = 0 IMPLIES
       (FORALL (x: nat): bv(x) IMPLIES (x < N IFF x < 1 + i - j));

  % Subtype TCC generated (at line 17, column 47) for  i
      % expected type  upto(i)
  bv_caret_ii_0_rule_TCC1: OBLIGATION
    FORALL (N, i: nat): i < N IMPLIES i <= i;

  % Subtype TCC generated (at line 21, column 50) for  k
      % expected type  below[1 + i - j]
  bv_caret_elim_rule_TCC1: OBLIGATION
    FORALL (N, i, j, k: nat):
      i < N AND j <= i AND k < i - j + 1 IMPLIES k < 1 + i - j;

  % Subtype TCC generated (at line 89, column 18) for  1 + i - j
      % expected type  nat
  bv_caret_elim_rule_TCC2: OBLIGATION
    FORALL (N, i, j, k: nat):
      i < N AND j <= i AND k < i - j + 1 IMPLIES 1 + i - j >= 0;

  % Subtype TCC generated (at line 21, column 58) for  (j + k)
      % expected type  below[N]
  bv_caret_elim_rule_TCC3: OBLIGATION
    FORALL (N, i, j, k: nat):
      i < N AND j <= i AND k < i - j + 1 IMPLIES (j + k) < N;

  % Subtype TCC generated (at line 27, column 51) for  i2
      % expected type  below(1 + i1 - j1)
  bv_caret_denormalize_TCC1: OBLIGATION
    FORALL (i1, i2, j1, j2: nat, n: posnat):
           i1 < n AND j1 <= i1 AND i2 < i1 - j1 + 1 AND j2 <= i2
       AND i2 - j2 + 1 <= i1 - j1 + 1
       IMPLIES i2 < 1 + i1 - j1;

  % Subtype TCC generated (at line 89, column 18) for  1 + i1 - j1
      % expected type  nat
  bv_caret_denormalize_TCC2: OBLIGATION
    FORALL (i1, i2, j1, j2: nat, n: posnat):
           i1 < n AND j1 <= i1 AND i2 < i1 - j1 + 1 AND j2 <= i2
       AND i2 - j2 + 1 <= i1 - j1 + 1
       IMPLIES 1 + i1 - j1 >= 0;

  % Subtype TCC generated (at line 27, column 66) for  i2 + j1
      % expected type  below(n)
  bv_caret_denormalize_TCC3: OBLIGATION
    FORALL (i1, i2, j1, j2: nat, n: posnat):
           i1 < n AND j1 <= i1 AND i2 < i1 - j1 + 1 AND j2 <= i2
       AND i2 - j2 + 1 <= i1 - j1 + 1
       IMPLIES i2 + j1 < n;

  % Subtype TCC generated (at line 27, column 73) for  j2 + j1
      % expected type  upto(i2 + j1)
  bv_caret_denormalize_TCC4: OBLIGATION
    FORALL (i1, i2, j1, j2: nat, n: posnat):
           i1 < n AND j1 <= i1 AND i2 < i1 - j1 + 1 AND j2 <= i2
       AND i2 - j2 + 1 <= i1 - j1 + 1
       IMPLIES j2 + j1 <= i2 + j1;

  % Subtype TCC generated (at line 31, column 66) for  1 + n - k
      % expected type  nat
  bv_fill_caret_TCC1: OBLIGATION
    FORALL (k, m, n: nat): k <= n AND k < m AND n < m IMPLIES 1 + n - k >= 0;


body:
  bv_bitwise_rules: THEORY
  % -----------------------------------------------------------------------
  % Rules derived from bv_bitwise
  %
  %   o move fill[N]() to the right
  %
  %   o association to the left
  %
  % -----------------------------------------------------------------------  
  BEGIN

    IMPORTING bv_bitwise

    N : VAR nat
    b : VAR bit
    nb: VAR nbit

    bv_NOT_NOT           : LEMMA FORALL (bv:bvec[N]): (NOT (NOT bv)) = bv

    bv_NOT_caret         : LEMMA FORALL (bv:bvec[N]) (i: below(N)): 
                                        (NOT(bv))^i = NOT (bv^i)

    bv_fill_NOT          : LEMMA (NOT (fill[N](b))) = fill[N](NOT b)   

    bv_AND_fill_normalize: LEMMA FORALL (bv1 : bvec[N]):
                                   (fill[N](b) AND bv1) = (bv1 AND fill[N](b))

    bv_AND_fill_F        : LEMMA FORALL (bv1: bvec[N]): 
                                  (bv1 AND fill[N](FALSE)) = fill[N](FALSE)

    bv_AND_fill_T        : LEMMA FORALL 
                                  (bv1: bvec[N]): (bv1 AND fill[N](TRUE)) = bv1

    bv_AND_same          : LEMMA FORALL (bv1, bv2: bvec[N]):
                                    (bv1 = bv2) => (bv1 AND bv2) = bv1

    bv_AND_associative   : LEMMA FORALL (bv1, bv2, bv3: bvec[N]):
                                 (bv1 AND (bv2 AND bv3)) = ((bv1 AND bv2) AND bv3)

    bv_AND_bv_2eq        : LEMMA FORALL (bv1, bv2, bv3: bvec[N]):
                              bv1 = bv2 => (bv1 AND (bv2 AND bv3)) = (bv2 AND bv3)

    bv_OR_fill_normalize : LEMMA FORALL (bv1: bvec[N]): 
                                    (fill[N](b) OR bv1) = (bv1 OR fill[N](b))

    bv_OR_fill_F          : LEMMA FORALL (bv1: bvec[N]): 
                                   (bv1 OR fill[N](FALSE)) = bv1

    bv_OR_fill_T          : LEMMA FORALL (bv1: bvec[N]): 
                                    (bv1 OR fill[N](TRUE)) = fill[N](TRUE)
   
    bv_OR_bv_eq          : LEMMA FORALL (bv1, bv2: bvec[N]):
                                    (bv1 = bv2) => (bv1 OR bv2) = bv1

    bv_OR_associative    : LEMMA FORALL (bv1, bv2, bv3: bvec[N]):
                                    (bv1 OR (bv2 OR bv3)) = ((bv1 OR bv2) OR bv3)

    bv_OR_bv_bv_2eq      : LEMMA FORALL (bv1, bv2, bv3: bvec[N]):
                             (bv1 = bv2) => (bv1 OR (bv2 OR bv3)) = (bv2 OR bv3)

    bv_XOR_fill_normalize: LEMMA FORALL (bv1 : bvec[N]):
                             (fill[N](b) XOR bv1) = (bv1 XOR fill[N](b))

    bv_XOR_fill_F        : LEMMA FORALL (bv1: bvec[N]): 
                             (bv1 XOR fill[N](FALSE)) = bv1

    bv_XOR_fill_T        : LEMMA FORALL (bv1: bvec[N]): 
                             (bv1 XOR fill[N](TRUE)) = (NOT bv1)

    bv_XOR_bv_2eq        : LEMMA FORALL (bv1, bv2: bvec[N]):
                             (bv1 = bv2) => (bv1 XOR bv2) = fill[N](FALSE)

    bv_XOR_associative   : LEMMA FORALL (bv1, bv2, bv3: bvec[N]):
                             (bv1 XOR (bv2 XOR bv3)) = ((bv1 XOR bv2) XOR bv3)

    bv_XOR_bv_bv_2eq     : LEMMA FORALL (bv1, bv2, bv3: bvec[N]):
                              bv1 = bv2 => (bv1 XOR (bv2 XOR bv3)) = bv3



  END bv_bitwise_rules


body:
  bv_nat_rules: THEORY

  BEGIN

    IMPORTING bv_nat

    n: VAR nat

    bv2nat_fill_F   : LEMMA bv2nat(fill[n](FALSE)) = 0
    bv2nat_fill_T   : LEMMA bv2nat(fill[n](TRUE)) = exp2(n)-1

    bv2nat_top_bit_F: LEMMA FORALL (bvn: bvec[n]):
                               n > 0 AND bv2nat(bvn) < exp2(n-1) 
                                    IMPLIES bvn^(n-1) = FALSE

    bv2nat_top_bit_T: LEMMA FORALL (bvn: bvec[n]): 
                               n > 0 AND bv2nat(bvn) >= exp2(n-1) 
                                    IMPLIES bvn^(n-1) = TRUE 

    bv2nat_inj_rule : LEMMA FORALL (bv1, bv2: bvec[n]): bv2nat(bv1) = bv2nat(bv2) 
                                                          IMPLIES bv1 = bv2

    b: VAR bit
    bv_fill_unit_nat: LEMMA n = 1 => bv2nat[n](fill[n](b)) = b2n(b)

  END bv_nat_rules

addendum:
  %%% ================ Addendum: generated declarations ================

  % Subtype TCC generated (at line 13, column 58) for  n - 1
      % expected type  nat
  bv2nat_top_bit_F_TCC1: OBLIGATION FORALL (n: nat): n > 0 IMPLIES n - 1 >= 0;

  % Subtype TCC generated (at line 14, column 47) for  (n - 1)
      % expected type  below[n]
  bv2nat_top_bit_F_TCC2: OBLIGATION
    FORALL (n: nat, bvn: bvec[n]):
      n > 0 AND bv2nat(bvn) < exp2(n - 1) IMPLIES
       (n - 1) >= 0 AND (n - 1) < n;

  % Subtype TCC generated (at line 18, column 47) for  (n - 1)
      % expected type  below[n]
  bv2nat_top_bit_T_TCC1: OBLIGATION
    FORALL (n: nat, bvn: bvec[n]):
      n > 0 AND bv2nat(bvn) >= exp2(n - 1) IMPLIES
       (n - 1) >= 0 AND (n - 1) < n;


body:
  mod_rules: THEORY
  BEGIN

     IMPORTING mod

    i, i1, i2: VAR int
    n, k: VAR nat
    m, m1, m2: VAR posnat

    
  % ---------- Some basic rules about mod ---------- 
    
    mod_rule1     : LEMMA n >= m => mod(n, m) = mod(n-m, m)
    mod_rule2     : LEMMA n < m => mod(n, m) = n
    mod_rule3     : LEMMA i < 0 => mod(i, m) = mod(i+m, m)


    mod_mod_rule  : LEMMA mod(mod(i, m), m) = mod(i, m)
    mod_eq_rule1  : LEMMA m1 = m2 => mod(n + m1, m2) = mod(n, m2)
    mod_eq_rule2  : LEMMA m1 = m2 => mod(m1, m2) = 0

    mod_wrap_rule1: LEMMA n < m AND k <= m AND k >= m-n
                            IMPLIES mod(n+k, m) = n - (m-k)

    mod_wrap_rule2: LEMMA k < n AND n = m IMPLIES mod(n+k, m) = n - (m-k)


    mod_flatten1  : LEMMA mod(mod(i1, m) + i2, m) = mod(i1 + i2, m)
    mod_flatten2  : LEMMA mod(i1 + mod(i2, m), m) = mod(i1 + i2, m)


    mod_gt_rule   : LEMMA (i<2*m) AND (i >= m) IMPLIES mod(i,m) = i-m

    mod_lt        : LEMMA (i > -2*m) AND (i < 0) IMPLIES mod(i,m) = mod(i+m,m)

    mod_identity  : LEMMA (i >= 0) AND (i < m) IMPLIES mod(i,m) = i
    
    mod_gt_log2   : LEMMA i >= 2*m IMPLIES mod(i,m) = mod(mod(i,2*m),m);
    
    mod_gt_log16  : LEMMA i >= 16*m IMPLIES mod(i,m) = mod(mod(i,16*m),m)
    
    mod_gt_log256 : LEMMA i >= 256*m IMPLIES (mod(i,m) = mod(mod(i,256*m),m));
    
    mod_lt_log256 : LEMMA i <= -256*m IMPLIES mod(i,m) = mod(mod(i,256*m),m)
    
    mod_lt_log16  : LEMMA i <= -16*m IMPLIES mod(i,m) = mod(mod(i,16*m),m)
    
    mod_lt_log2   : LEMMA i <= -2*m IMPLIES mod(i,m) = mod(mod(i,2*m),m)
    

  END mod_rules


body:
  %------------------------------------------------------------------------
  %  bit-vectors rules
  %  --------------------------------
  %       
  %      Index:
  %      ------
  %
  %                                    syntactic objects/mneumonic
  %
  %        theory             |   +   | bv2nat | bv2int |       |   o    | AND
  %                           | arith |  nat   |   int  | caret | concat | bitwise
  %  -------------------------|-------|--------|--------|-------------------------
  %  mod_rules                |       |        |        |       |	       |
  %  bv_nat_rules             |       |   x    |        |       |	       |
  %  bv_bitwise_rules         |       |        |        |       |	       |  x    
  %  bv_caret_rules           |       |        |        |  x    |	       |    
  %  bv_caret_bitwise_rules   |       |        |        |  x    |	       |  x    
  %  bv_concat_rules          |       |        |        |       |	  x    |     
  %  bv_arith_nat_rules       |   x   |   x    |        |       |	       |      
  %  bv_arith_caret_rules     |       |   x    |        |  x    |	       |      
  %  bv_caret_concat_rules    |       |        |        |  x    |	  x    |      
  %  bv_arith_rules           |   x   |        |        |       |	       |      
  %  bv_arith_minus_rules     |   x   |        |        |       |	       |      
  %  bv_arith_nat_rules       |   x   |   x    |        |       |	       |      
  %  bv_arith_int_rules       |   x   |        |   x    |       |        |      
  %  bv_arith_caret_rules     |   x   |        |        |  x    |	       |       
  %  bv_arith_nat_caret_rules |   x   |        |        |  x    |	       | 
  %  bv_arith_int_caret_rules |   x   |        |   x    |  x    |        |      
  %
  %
  % NOTE: the presence of bv1 - bv2 or -bv indicates the need for bv2int
  %
  %------------------------------------------------------------------------
  bv_rules: THEORY
  BEGIN

    IMPORTING
       mod_rules,               % -- rules about mod function
       bv_nat_rules,            % -- rules involving only bv2nat
       bv_bitwise_rules,        % -- rules involving bitwise ops
       bv_caret_rules,          % -- rules involving ^
       bv_caret_bitwise_rules,  % -- rules involving ^ and bitwise ops
       bv_concat_rules,         % -- rules involving o
       bv_arith_rules,          % -- rules involving + 
       bv_arith_minus_rules,     % -- rules involving + and -
       bv_arith_nat_rules,      % -- rules involving bv2nat and +
       bv_arith_int_rules,      % -- rules involving bv2int and +
       bv_caret_concat_rules,   % -- rules involving ^ and o
       bv_arith_caret_rules,    % -- rules involving ^ and +          
       bv_arith_nat_caret_rules, % -- rules involving ^ and + and bv2nat         
       bv_arith_caret_concat_rules

  END bv_rules


body:
  bv_arith_int_caret: THEORY
  BEGIN


    IMPORTING bv_arithmetic, bv_arith_caret

  %  IMPORTING bv_int, bv_arith_caret, bv_caret_concat

    N: VAR posnat

    bv_sign_of_frag_neg: LEMMA FORALL (bvn: bvec[N], i: below[N]):
                                  bv2int(bvn) < 0 => bv2int(bvn^(N-1, i)) < 0
    
    bv_sign_of_frag_pos: LEMMA FORALL (bvn: bvec[N], i: below[N]):
                                  bv2int(bvn) >= 0 => bv2int(bvn^(N-1, i)) >= 0


    bv2int_top   : THEOREM FORALL (bv: bvec[N], i: below[N]):
                                 bv2int(bv^(N-1,i)) = floor(bv2int(bv)/ exp2(i))


    bv2int_concat : LEMMA FORALL (n, m: posnat, bvn: bvec[n], bvm: bvec[m]):
                           bv2int(bvn o bvm) = 
                               bv2int(bvn) * exp2(m) + bv2int(bvm) 
                                  + (b2n(bvm^(m-1)) * exp2(m))

    bv2int_bottom : THEOREM FORALL (bv: bvec[N], i: below[N]):
                              bv2int(bv^(i,0)) 
                               = mod(bv2int(bv),exp2(i+1)) - exp2(i+1)*b2n(bv^(i)) 

    in_small_rng   : LEMMA (FORALL (bv: bvec[N], i: below[N]):
                             i > 0 AND in_rng_2s_comp[i](bv2int(bv)) IMPLIES
  	                             (bv = fill[N-i](bv^(N-1)) o bv^(i-1,0)))


    in_rng_i_bv2int: LEMMA FORALL (bv: bvec[N], i: below[N]): i > 0 
                               AND in_rng_2s_comp[i](bv2int(bv)) IMPLIES
                                   bv2int[N](bv) = bv2int[i](bv^(i-1,0))

    bv_caret_negate: LEMMA FORALL (bv1: bvec[N], m: below[N]): 
                                      (-bv1)^(m,0) = -(bv1^(m,0))


    bv2int_in_rng_i    : LEMMA FORALL (bv: bvec[N], n: {np: posnat | np < N}):
                             in_rng_2s_comp[n](bv2int(bv)) => 
                                (bv = fill[N-n](bv^(n-1)) o bv^(n-1, 0))
    
    bv2int_in_rng_i_top: LEMMA FORALL (bv: bvec[N], n: {np: posnat | np < N}):
                              in_rng_2s_comp[n](bv2int(bv)) => 
                                 (bv^(N-1, n) = fill[N-n](bv^(n-1)))


    IMPORTING bv_arith_extend
    
    bv2int_of_sign_extension: LEMMA FORALL (bv: bvec[N], n: {np: posnat | np < N}):
                          in_rng_2s_comp[n](bv2int(bv)) =>
                             bv2int(bv^(n-1, 0)) = bv2int(bv)


  END bv_arith_int_caret

addendum:
  %%% ================ Addendum: generated declarations ================

  % Subtype TCC generated (at line 12, column 63) for  N - 1
      % expected type  below(N)
  bv_sign_of_frag_neg_TCC1: OBLIGATION
    FORALL (N: posnat, bvn: bvec[N], i: below[N]):
      bv2int(bvn) < 0 IMPLIES N - 1 >= 0 AND N - 1 < N;

  % Subtype TCC generated (at line 12, column 68) for  i
      % expected type  upto(N - 1)
  bv_sign_of_frag_neg_TCC2: OBLIGATION
    FORALL (N: posnat, bvn: bvec[N], i: below[N]):
      bv2int(bvn) < 0 IMPLIES i <= N - 1;

  % Subtype TCC generated (at line 12, column 63) for  N - i
      % expected type  posnat
  bv_sign_of_frag_neg_TCC3: OBLIGATION
    FORALL (N: posnat, bvn: bvec[N], i: below[N]):
      bv2int(bvn) < 0 IMPLIES N - i >= 0 AND N - i > 0;

  % Subtype TCC generated (at line 15, column 64) for  N - 1
      % expected type  below(N)
  bv_sign_of_frag_pos_TCC1: OBLIGATION
    FORALL (N: posnat, bvn: bvec[N], i: below[N]):
      bv2int(bvn) >= 0 IMPLIES N - 1 >= 0 AND N - 1 < N;

  % Subtype TCC generated (at line 15, column 69) for  i
      % expected type  upto(N - 1)
  bv_sign_of_frag_pos_TCC2: OBLIGATION
    FORALL (N: posnat, bvn: bvec[N], i: below[N]):
      bv2int(bvn) >= 0 IMPLIES i <= N - 1;

  % Subtype TCC generated (at line 15, column 64) for  N - i
      % expected type  posnat
  bv_sign_of_frag_pos_TCC3: OBLIGATION
    FORALL (N: posnat, bvn: bvec[N], i: below[N]):
      bv2int(bvn) >= 0 IMPLIES N - i >= 0 AND N - i > 0;

  % Subtype TCC generated (at line 19, column 42) for  N - 1
      % expected type  below(N)
  bv2int_top_TCC1: OBLIGATION
    FORALL (N: posnat, i: below[N]): N - 1 >= 0 AND N - 1 < N;

  % Subtype TCC generated (at line 19, column 46) for  i
      % expected type  upto(N - 1)
  bv2int_top_TCC2: OBLIGATION FORALL (N: posnat, i: below[N]): i <= N - 1;

  % Subtype TCC generated (at line 19, column 42) for  N - i
      % expected type  posnat
  bv2int_top_TCC3: OBLIGATION
    FORALL (N: posnat, i: below[N]): N - i >= 0 AND N - i > 0;

  % Subtype TCC generated (at line 22, column 70) for  m + n
      % expected type  posnat
  bv2int_concat_TCC1: OBLIGATION FORALL (n, m: posnat): m + n > 0;

  % Subtype TCC generated (at line 25, column 44) for  (m - 1)
      % expected type  below[m]
  bv2int_concat_TCC2: OBLIGATION
    FORALL (n, m: posnat): (m - 1) >= 0 AND (m - 1) < m;

  % Subtype TCC generated (at line 28, column 41) for  0
      % expected type  upto(i)
  bv2int_bottom_TCC1: OBLIGATION FORALL (N: posnat, i: below[N]): 0 <= i;

  % Subtype TCC generated (at line 33, column 41) for  N - i
      % expected type  nat
  in_small_rng_TCC1: OBLIGATION
    FORALL (N: posnat, bv: bvec[N], i: below[N]):
      i > 0 AND in_rng_2s_comp[i](bv2int(bv)) IMPLIES N - i >= 0;

  % Subtype TCC generated (at line 33, column 62) for  i - 1
      % expected type  below(N)
  in_small_rng_TCC2: OBLIGATION
    FORALL (N: posnat, bv: bvec[N], i: below[N]):
      i > 0 AND in_rng_2s_comp[i](bv2int(bv)) IMPLIES
       i - 1 >= 0 AND i - 1 < N;

  % Subtype TCC generated (at line 33, column 66) for  0
      % expected type  upto(i - 1)
  in_small_rng_TCC3: OBLIGATION
    FORALL (N: posnat, bv: bvec[N], i: below[N]):
      i > 0 AND in_rng_2s_comp[i](bv2int(bv)) IMPLIES 0 <= i - 1;

  % Subtype TCC generated (at line 46, column 50) for  (n - 1)
      % expected type  below[N]
  bv2int_in_rng_i_TCC1: OBLIGATION
    FORALL (N: posnat, bv: bvec[N], n: {np: posnat | np < N}):
      in_rng_2s_comp[n](bv2int(bv)) IMPLIES (n - 1) >= 0 AND (n - 1) < N;

  % Subtype TCC generated (at line 46, column 41) for  N - n
      % expected type  nat
  bv2int_in_rng_i_TCC2: OBLIGATION
    FORALL (N: posnat, bv: bvec[N], n: {np: posnat | np < N}):
      in_rng_2s_comp[n](bv2int(bv)) IMPLIES N - n >= 0;

  % Subtype TCC generated (at line 46, column 67) for  0
      % expected type  upto(n - 1)
  bv2int_in_rng_i_TCC3: OBLIGATION
    FORALL (N: posnat, bv: bvec[N], n: {np: posnat | np < N}):
      in_rng_2s_comp[n](bv2int(bv)) IMPLIES 0 <= n - 1;

  % Subtype TCC generated (at line 50, column 41) for  n
      % expected type  upto(N - 1)
  bv2int_in_rng_i_top_TCC1: OBLIGATION
    FORALL (N: posnat, bv: bvec[N], n: {np: posnat | np < N}):
      in_rng_2s_comp[n](bv2int(bv)) IMPLIES n <= N - 1;


body:
  bv_constants: THEORY
  %------------------------------------------------------------------------
  %
  %  Bitvector constants
  %  -------------------
  %
  %    This theory enables one to build bitvector constants using
  %    the hexadecimal constants h0 through HF and the o concatentation
  %    operator.  The user is urged to avoid using nat2bv or int2bv to
  %    construct bitvector constants.  If this is impossible and bitvector
  %    constants such as nat2bv[16](1) are present in a specification, it is
  %    often prudent to quickly rewrite them to the corresponding LAMBDA
  %    expressions easily defined using the hexadecimal constants and 
  %    concatentation.
  %
  %------------------------------------------------------------------------   

  BEGIN

     IMPORTING bv[4], bv_concat

     h0: bvec[4] = (LAMBDA (i: below[4]): FALSE)
     h1: bvec[4] = (LAMBDA (i: below[4]): i = 0 )
     h2: bvec[4] = (LAMBDA (i: below[4]): i = 1 )
     h3: bvec[4] = (LAMBDA (i: below[4]): i = 0 OR i = 1)
     h4: bvec[4] = (LAMBDA (i: below[4]): i = 2)
     h5: bvec[4] = (LAMBDA (i: below[4]): i = 0 OR i = 2)
     h6: bvec[4] = (LAMBDA (i: below[4]): i = 1 OR i = 2)
     h7: bvec[4] = (LAMBDA (i: below[4]): NOT i = 3 )
     h8: bvec[4] = (LAMBDA (i: below[4]): i = 3 )
     h9: bvec[4] = (LAMBDA (i: below[4]): i = 0 OR i = 3 )
     hA: bvec[4] = (LAMBDA (i: below[4]): i = 1 OR i = 3 )
     hB: bvec[4] = (LAMBDA (i: below[4]): NOT i = 2)
     hC: bvec[4] = (LAMBDA (i: below[4]): i = 2 OR i = 3 )
     hD: bvec[4] = (LAMBDA (i: below[4]): NOT (i = 1))
     hE: bvec[4] = (LAMBDA (i: below[4]): NOT (i = 0))
     hF: bvec[4] = (LAMBDA (i: below[4]): TRUE)


     h0_lem: LEMMA h0  = b0 o b0 o b0 o b0
     h1_lem: LEMMA h1 = b0 o b0 o b0 o b1
     h2_lem: LEMMA h2 = b0 o b0 o b1 o b0
     h3_lem: LEMMA h3 = b0 o b0 o b1 o b1
     h4_lem: LEMMA h4 = b0 o b1 o b0 o b0
     h5_lem: LEMMA h5 = b0 o b1 o b0 o b1
     h6_lem: LEMMA h6 = b0 o b1 o b1 o b0
     h7_lem: LEMMA h7 = b0 o b1 o b1 o b1
     h8_lem: LEMMA h8 = b1 o b0 o b0 o b0
     h9_lem: LEMMA h9 = b1 o b0 o b0 o b1
     hA_lem: LEMMA hA = b1 o b0 o b1 o b0
     hB_lem: LEMMA hB = b1 o b0 o b1 o b1
     hC_lem: LEMMA hC = b1 o b1 o b0 o b0
     hD_lem: LEMMA hD = b1 o b1 o b0 o b1
     hE_lem: LEMMA hE = b1 o b1 o b1 o b0
     hF_lem: LEMMA hF = b1 o b1 o b1 o b1

  END bv_constants


body:
  %------------------------------------------------------------------------
  %
  % Operational definition of bitvector addition
  % -------------------------------------------------
  %
  %   Author
  %
  %         Victor Carreno
  %
  %   Defines:
  %
  %       oba_sum - "sum" output of one bit adder
  %       oba_cout - overflow bit of one bit adder
  %       bv_adder - n-bit adder
  %
  %   Establishes:
  %
  %       adder_is_add: THEOREM bv_adder(bv1,bv2,FALSE) = bv1 + bv2   
  %
  %------------------------------------------------------------------------

  bv_adder[N:posnat]: THEORY

  BEGIN


     IMPORTING bv_bitwise[N], bv_nat[N]
     
     a,b,cin : VAR bit
     
     % =======   oba is a One Bit Adder   ======================================
     %
     %                 |---------------|
     %         a   --->|               |
     %                 |               | ----> sum
     %         b   --->|     oba       |
     %                 |               | ----> cout
     %         cin --->|               |
     %                 |---------------|
     %
     % =========================================================================
     
     oba_sum (a,b,cin): bit = (a XOR b XOR cin)
     oba_cout (a,b,cin): bit = ((a AND b) OR (a AND cin) OR (b AND cin))
     
     oba_correct: LEMMA a + b + cin = 2 * oba_cout (a,b,cin) + oba_sum (a,b,cin)
     
     a_cin: VAR bit
     x,y: VAR bvec[N]
     n: VAR below[N]
     
     % =======  
     %
     %     x   y   cin      x   y   cin        x   y   cin       x    y   
     %      n   n   __n_     n-1 n-1 __n-1      1   1   __1_      0    0  __ a_cin
     %     |   |   |    |   |   |   |           |   |   |    |   |   |   |
     %    -----------   |  -----------         -----------   |  -----------
     %    |         |   |  |         |         |         |   |  |         |
     %    |_________|   |  |_________|         |_________|   |  |_________|
     %      |    |      |____|    |            __|    |      |____|    | 
     %      c    s           c    s              c    s           c    s
     %       n    n           n-1  n-1            1    1           0    0
     %
     % =========================================================================
     
     n_cout_rec (n,x,y,a_cin): RECURSIVE bit =
       IF n =0 THEN oba_cout(x^(0),y^(0),a_cin)
       ELSE oba_cout(x^(n),y^(n),n_cout_rec(n-1,x,y,a_cin))
       ENDIF
       MEASURE n
     
     bv_adder(x,y,a_cin): bvec[N] =
       (LAMBDA (i:below(N)): 
        IF i=0 THEN oba_sum(x^(0),y^(0),a_cin)
        ELSE oba_sum(x^(i),y^(i),n_cout_rec(i-1,x,y,a_cin))
        ENDIF)
     
     adder_correct_rec: LEMMA 
         exp2(n+1)*n_cout_rec(n,x,y,a_cin)+bv2nat_rec(n+1,bv_adder(x,y,a_cin)) =
         bv2nat_rec(n+1,x) + bv2nat_rec(n+1,y) + a_cin
     
     adder_correct: THEOREM 
         exp2(N)*n_cout_rec(N-1,x,y,a_cin) + bv2nat(bv_adder(x,y,a_cin)) =  
         bv2nat(x) + bv2nat(y) + a_cin

     IMPORTING bv_arith_nat

     bv1,bv2: VAR bvec[N]
     adder_is_add: THEOREM bv_adder(bv1,bv2,FALSE) = bv1 + bv2 
                               
  END bv_adder

addendum:
  %%% ================ Addendum: generated declarations ================

  % Subtype TCC generated (at line 67, column 30) for  (0)
      % expected type  below[N]
  n_cout_rec_TCC1: OBLIGATION FORALL (n: below[N]): n = 0 IMPLIES (0) < N;

  % Subtype TCC generated (at line 68, column 42) for  n - 1
      % expected type  below[N]
  n_cout_rec_TCC2: OBLIGATION
    FORALL (n: below[N]): NOT n = 0 IMPLIES n - 1 >= 0 AND n - 1 < N;

  % Termination TCC generated (at line 68, column 31) for
      % n_cout_rec(n - 1, x, y, a_cin)
  n_cout_rec_TCC3: OBLIGATION
    FORALL (n: below[N]): NOT n = 0 IMPLIES n - 1 < n;

  % Subtype TCC generated (at line 79, column 52) for  n + 1
      % expected type  upto(N)
  adder_correct_rec_TCC1: OBLIGATION FORALL (n: below[N]): n + 1 <= N;

  % Subtype TCC generated (at line 83, column 26) for  N - 1
      % expected type  below[N]
  adder_correct_TCC1: OBLIGATION N - 1 >= 0 AND N - 1 < N;


body:
  bv_rotate [N: posnat ] : THEORY
  %-----------------------------------------------------------------------  
  %  Defines rotate operations.
  %  Introduces:
  %      rotate_right(k: upto(N), bv: bvec[N]): bvec[N] 
  %      rotate_left(k: upto(N), bv: bvec[N]): bvec[N] 
  %      rot_r1(bv: bvec[N]): bvec[N] 
  %      rot_l1(bv: bvec[N]): bvec[N] 
  %-----------------------------------------------------------------------  

  BEGIN

    IMPORTING bv_concat, bv_caret

    rotate_right(k: upto(N), bv: bvec[N]): bvec[N] = 
       IF (k = 0) OR (k = N) THEN bv 
       ELSE bv^(k-1,0) o bv^(N-1, k) ENDIF

    rotate_left(k: upto(N), bv: bvec[N]): bvec[N] =
       IF (k=0) OR (k = N) THEN bv 
       ELSE bv^(N-k-1, 0) o bv^(N-1,N-k) ENDIF

    rot_r1(bv: bvec[N]): bvec[N] = rotate_right(1,bv)

    rot_l1(bv: bvec[N]): bvec[N] = rotate_left(1,bv)

    i:  VAR below(N)
    k:  VAR upto(N)
    bv: VAR bvec[N]

    rotate_right_0   : LEMMA rotate_right(0,bv)= bv

    rotate_right_lem : LEMMA rotate_right(k,bv)^i =
                               IF i+k < N THEN bv^(i+k) ELSE bv^(i+k-N) ENDIF

    rotate_left_0    : LEMMA rotate_left(0,bv)= bv

    rotate_left_lem  : LEMMA rotate_left(k,bv)^i = 
                               IF i-k >= 0 THEN bv^(i-k) ELSE bv^(N+i-k) ENDIF

    iterate_rot_r1   : LEMMA iterate(rot_r1,k)(bv) = rotate_right(k,bv)

    iterate_rot_l1   : LEMMA iterate(rot_l1,k)(bv) = rotate_left(k,bv)

  END bv_rotate

addendum:
  %%% ================ Addendum: generated declarations ================

  % Subtype TCC generated (at line 17, column 14) for  k - 1
      % expected type  below(N)
  rotate_right_TCC1: OBLIGATION
    FORALL (k: upto(N)):
      NOT (k = 0) AND NOT (k = N) IMPLIES k - 1 >= 0 AND k - 1 < N;

  % Subtype TCC generated (at line 17, column 18) for  0
      % expected type  upto(k - 1)
  rotate_right_TCC2: OBLIGATION
    FORALL (k: upto(N)): NOT (k = 0) AND NOT (k = N) IMPLIES 0 <= k - 1;

  % Subtype TCC generated (at line 17, column 27) for  N - 1
      % expected type  below(N)
  rotate_right_TCC3: OBLIGATION
    FORALL (k: upto(N)):
      NOT (k = 0) AND NOT (k = N) IMPLIES N - 1 >= 0 AND N - 1 < N;

  % Subtype TCC generated (at line 17, column 32) for  k
      % expected type  upto(N - 1)
  rotate_right_TCC4: OBLIGATION
    FORALL (k: upto(N)): NOT (k = 0) AND NOT (k = N) IMPLIES k <= N - 1;

  % Subtype TCC generated (at line 17, column 27) for  N - k
      % expected type  nat
  rotate_right_TCC5: OBLIGATION
    FORALL (k: upto(N)): NOT (k = 0) AND NOT (k = N) IMPLIES N - k >= 0;

  % Subtype TCC generated (at line 21, column 14) for  N - k - 1
      % expected type  below(N)
  rotate_left_TCC1: OBLIGATION
    FORALL (k: upto(N)):
      NOT (k = 0) AND NOT (k = N) IMPLIES N - k - 1 >= 0 AND N - k - 1 < N;

  % Subtype TCC generated (at line 21, column 21) for  0
      % expected type  upto(N - 1 - k)
  rotate_left_TCC2: OBLIGATION
    FORALL (k: upto(N)): NOT (k = 0) AND NOT (k = N) IMPLIES 0 <= N - 1 - k;

  % Subtype TCC generated (at line 21, column 34) for  N - k
      % expected type  upto(N - 1)
  rotate_left_TCC3: OBLIGATION
    FORALL (k: upto(N)):
      NOT (k = 0) AND NOT (k = N) IMPLIES N - k >= 0 AND N - k <= N - 1;

  % Subtype TCC generated (at line 23, column 46) for  1
      % expected type  upto(N)
  rot_r1_TCC1: OBLIGATION 1 <= N;

  % Subtype TCC generated (at line 31, column 40) for  0
      % expected type  upto(N)
  rotate_right_0_TCC1: OBLIGATION 0 <= N;

  % Subtype TCC generated (at line 34, column 63) for  (i + k - N)
      % expected type  below[N]
  rotate_right_lem_TCC1: OBLIGATION
    FORALL (i: below(N), k: upto(N)):
      NOT i + k < N IMPLIES (i + k - N) >= 0 AND (i + k - N) < N;

  % Subtype TCC generated (at line 39, column 50) for  (i - k)
      % expected type  below[N]
  rotate_left_lem_TCC1: OBLIGATION
    FORALL (i: below(N), k: upto(N)): i - k >= 0 IMPLIES (i - k) < N;

  % Subtype TCC generated (at line 39, column 64) for  (N + i - k)
      % expected type  below[N]
  rotate_left_lem_TCC2: OBLIGATION
    FORALL (i: below(N), k: upto(N)):
      NOT i - k >= 0 IMPLIES (N + i - k) >= 0 AND (N + i - k) < N;


body:
  bv_shift [N: nat ] : THEORY
  %-----------------------------------------------------------------------  
  %  Defines shift operations.
  %  Introduces:
  %     left_shift(i: nat, bv: bvec[N]): bvec[N]
  %     right_shift(i: nat, bv: bvec[N]): bvec[N] 
  %     left_shift_with(k: upto(N), bvk: bvec[k], bv: bvec[N]): bvec[N]
  %     right_shift_with(k: upto(N), bvk: bvec[k], bv: bvec[N]): bvec[N]
  %-----------------------------------------------------------------------  

  BEGIN

    IMPORTING bv_concat, bv_caret

    %------------------------------------------------------------------------
    % right_shift (left_shift) shifts a bit vector by a given number of
    % positions to the right (left) filling 0's to the shifted bits
    %------------------------------------------------------------------------

    right_shift(i: nat, bv: bvec[N]): bvec[N] =
      IF i = 0 THEN bv
      ELSIF i < N THEN fill[i](FALSE) o bv^(N-1, i) 
      ELSE fill[N](FALSE) ENDIF
   
      
    left_shift(i: nat, bv: bvec[N]): bvec[N] =
      IF i = 0 THEN bv
      ELSIF i < N THEN bv^(N-i-1, 0) o fill[i](FALSE) 
      ELSE fill[N](FALSE) ENDIF

    %------------------------------------------------------------------------    
    % left_shift_with (right_shift_with) shifts a bit vector by a given
    % number of positions to the left (right) replacing the shifted bits
    % by the bit vector given as the second argument.
    %------------------------------------------------------------------------

    left_shift_with(k: upto(N), bvk: bvec[k], bv: bvec[N]): bvec[N] =
       IF k = N THEN bvk
       ELSE bv^(N-k-1, 0) o bvk ENDIF

    right_shift_with(k: upto(N), bvk: bvec[k], bv: bvec[N]): bvec[N] =
       IF k = N THEN bvk
       ELSE bvk o bv^(N-1, k) ENDIF

  END bv_shift

addendum:
  %%% ================ Addendum: generated declarations ================

  % Subtype TCC generated (at line 22, column 42) for  N - 1
      % expected type  below(N)
  right_shift_TCC1: OBLIGATION
    FORALL (i: nat): i < N AND NOT i = 0 IMPLIES N - 1 >= 0 AND N - 1 < N;

  % Subtype TCC generated (at line 22, column 47) for  i
      % expected type  upto(N - 1)
  right_shift_TCC2: OBLIGATION
    FORALL (i: nat): i < N AND NOT i = 0 IMPLIES i <= N - 1;

  % Subtype TCC generated (at line 22, column 42) for  N - i
      % expected type  nat
  right_shift_TCC3: OBLIGATION
    FORALL (i: nat): i < N AND NOT i = 0 IMPLIES N - i >= 0;

  % Subtype TCC generated (at line 28, column 25) for  N - i - 1
      % expected type  below(N)
  left_shift_TCC1: OBLIGATION
    FORALL (i: nat):
      i < N AND NOT i = 0 IMPLIES N - i - 1 >= 0 AND N - i - 1 < N;

  % Subtype TCC generated (at line 28, column 32) for  0
      % expected type  upto(N - 1 - i)
  left_shift_TCC2: OBLIGATION
    FORALL (i: nat): i < N AND NOT i = 0 IMPLIES 0 <= N - 1 - i;

  % Subtype TCC generated (at line 38, column 19) for  bvk
      % expected type  bvec[N]
  left_shift_with_TCC1: OBLIGATION
    FORALL (k: upto(N), bvk: bvec[k]):
      k = N IMPLIES (FORALL (x: nat): bvk(x) IMPLIES (x < k IFF x < N));

  % Subtype TCC generated (at line 39, column 14) for  N - k - 1
      % expected type  below(N)
  left_shift_with_TCC2: OBLIGATION
    FORALL (k: upto(N)): NOT k = N IMPLIES N - k - 1 >= 0 AND N - k - 1 < N;

  % Subtype TCC generated (at line 39, column 21) for  0
      % expected type  upto(N - 1 - k)
  left_shift_with_TCC3: OBLIGATION
    FORALL (k: upto(N)): NOT k = N IMPLIES 0 <= N - 1 - k;

  % Subtype TCC generated (at line 39, column 14) for  N - k
      % expected type  nat
  left_shift_with_TCC4: OBLIGATION
    FORALL (k: upto(N)): NOT k = N IMPLIES N - k >= 0;

  % Subtype TCC generated (at line 43, column 20) for  N - 1
      % expected type  below(N)
  right_shift_with_TCC1: OBLIGATION
    FORALL (k: upto(N)): NOT k = N IMPLIES N - 1 >= 0 AND N - 1 < N;

  % Subtype TCC generated (at line 43, column 25) for  k
      % expected type  upto(N - 1)
  right_shift_with_TCC2: OBLIGATION
    FORALL (k: upto(N)): NOT k = N IMPLIES k <= N - 1;


body:
  bv_fract [N: above(1)]: THEORY
  %------------------------------------------------------------------------------
  % Defines an interpretation of bit vectors as 2's complement fractions.
  %
  %   Introduces:
  %        bv2fract: function [bvec[N] -> bv2fract_range]
  %------------------------------------------------------------------------------
  BEGIN

    IMPORTING bv, exp2
    
    %----------------------------------------------------------------------------
    % Using a 2's complement representation, a bit vector of size N can 
    % represent any fraction of the form i/exp2(N-1) as a rational number, 
    % where i ranges over all integers representable by a bit vector of size N.
    % The predicate bv2fract_range characterizes this set of rationals.
    %--------------------------------------------------------------------------- 

    fract_numerator_range: TYPE = {i: int| i >= -exp2(N-1) & i < exp2(N-1)}

    bv2fract_range(r: rational): bool =
       (EXISTS (i: fract_numerator_range): (r = i/exp2(N-1)) )

    bv2fract_range: TYPE = (bv2fract_range) CONTAINING 0

    bv2fract: [bvec[N] -> bv2fract_range]

    %---------------------------------------------------------------------------
    % The following min and max definitions ignore 0 and -1, instead
    % naming their nearest fractional representations.
    %---------------------------------------------------------------------------

    min_pos_fract: bv2fract_range = 1/exp2(N-1)
    max_pos_fract: bv2fract_range = 1 - 1/exp2(N-1)

    min_neg_fract: bv2fract_range = -1/exp2(N-1)
    max_neg_fract: bv2fract_range = -1 + 1/exp2(N-1)

  END bv_fract

addendum:
  %%% ================ Addendum: generated declarations ================

  % Subtype TCC generated (at line 19, column 52) for  N - 1
      % expected type  nat
  fract_numerator_range_TCC1: OBLIGATION N - 1 >= 0;

  % Subtype TCC generated (at line 24, column 53) for  0
      % expected type  bv2fract_range
  bv2fract_range_TCC1: OBLIGATION bv2fract_range(0);

  % Subtype TCC generated (at line 33, column 34) for  1 / exp2(N - 1)
      % expected type  bv2fract_range
  min_pos_fract_TCC1: OBLIGATION bv2fract_range(1 / exp2(N - 1));

  % Subtype TCC generated (at line 34, column 34) for  1 - 1 / exp2(N - 1)
      % expected type  bv2fract_range
  max_pos_fract_TCC1: OBLIGATION bv2fract_range(1 - 1 / exp2(N - 1));

  % Subtype TCC generated (at line 36, column 34) for  -1 / exp2(N - 1)
      % expected type  bv2fract_range
  min_neg_fract_TCC1: OBLIGATION bv2fract_range(-1 / exp2(N - 1));

  % Subtype TCC generated (at line 37, column 34) for  -1 + 1 / exp2(N - 1)
      % expected type  bv2fract_range
  max_neg_fract_TCC1: OBLIGATION bv2fract_range(-1 + 1 / exp2(N - 1));


body:
  %------------------------------------------------------------------------
  %  Foundation of bit-vectors theory.
  %  --------------------------------
  %    Authors:  Paul Miner
  %              Ricky W. Butler
  %              Mandayam Srivas
  %              Steve Miller
  %              Dave Greve
  %     
  %    Index:
  %    ------
  %      bv                  -- basic definition of bitvector type "bvec"
  %      bv_nat              -- interpretes bvec as a natural number
  %      bv_int              -- interpretes bvec as an integer
  %      bv_arithmetic       -- defines basic operators (i.e. + - >) over
  %                             bitvectors
  %      bv_arith_nat        -- defines bv + i, bv - i, etc
  %      bv_adder            -- operational defn of bitvector addition
  %      bv_arith_caret      -- arithmetic over caret 
  %      bv_caret            -- defines extractor operator ^ that
  %      bv_concat           -- defines concatenation operator o
  %      bv_arith_concat     -- calculates bv2nat(bv1 o bv2)
  %      bv_constants        -- defines some useful bitvector constants
  %      bv_caret_concat     -- lemmas concerning ^ and o
  %      bv_bitwise          -- defines bit-wise logical operations on bitvectors
  %      bv_caret_bitwise    -- lemmas about bit-wise logical operations and ^
  %      bv_shift            -- defines shift operations
  %      bv_extend           -- zero and sign extend operations
  %      bv_arith_extend     -- lemmas about extend operations
  %      bv_fract            -- defines fractional interpretation of a bitvector
  %      bv_overflow         -- relates overflow to top bits
  %      bv_arith_int_caret  -- lemmas with bv2int and ^
  %      bv_arith_int_concat -- lemmas with bv2int and o
  %
  %
  %                               bv
  %                               |
  %       ------------------------------------------------------------
  %       |        |                 |               |               |
  %  bv_bitwise  bv_nat          bv_concat       bv_fract        bv_caret
  %  |   |         |                 |                               |
  %  |   |    --------        ---------------------|                 |        
  %  |   |    |      |        |                    |                 |
  %  |   |  bv_int   |    bv_arith_concat          |                 |      
  %  |   |    |      |        |                    |                 |          
  %  |   |    |      |        | _______==========================================
  %  |   |    | bv_arith_nat  | |      ||        ||           ||               ||
  %  |   |    |      |        | | bv_shift  bv_extend bv_caret_concat    bv_rotate
  %  |   |    |      |        | |     |         |
  %  |   |    |      |        | |     |         |
  %  |   |    |      |        | |     |         |
  %  |   |    |      |        | |     |         |
  %  |   |    |    bv_arith_caret     |         |
  %  |   |    |      |        |       |         |
  %  |   bv_arithmetic       bv_arith_shift     |    
  %  |            |                             |
  %  |            ------------------------      |
  %  |                    |         |    |      |
  % bv_caret_bitwise  bv_overflow   |    bv_arith_extend
  %                                 |
  %                          bv_arith_int_caret
  %----------------------------------------------------------------------------
  bv_core: THEORY
    
   BEGIN

    IMPORTING bv, bv_bitwise, bv_nat, bv_concat, bv_fract, bv_caret, 
              bv_int,  bv_arith_concat, bv_shift, bv_rotate,
              bv_caret_concat,  bv_extend,  bv_arith_extend, 
              bv_arith_nat, bv_adder, bv_arith_caret,
              bv_arithmetic, bv_overflow, bv_caret_bitwise, bv_constants,
              bv_arith_concat,
              bv_arith_int_caret, bv_arith_int_concat

  END bv_core


body:
  %
  %  BitvectorUtil
  %  =============
  %
  %  for Translating Java Classes into the Higher Order Logic of PVS.
  %
  %  All integral types are interpreted as PVS integers, without 
  %  taking bounds into account
  %
  %  Author: Bart Jacobs
  %  Integrated with the bitvector library by Sam Owre <owre@csl.sri.com>

  BitvectorUtil[N : nat] : THEORY
  BEGIN

    ASSUMING
       N_size: ASSUMPTION N >= 2
    ENDASSUMING

    IMPORTING bv_core, bv_rules, bv_notes

    bv, bv1, bv2 : VAR bvec[N]
    BV, BV1, BV2 : VAR bvec[2*N]
    k : VAR int

  %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  %
  % auxiliary results
  %
  %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

    bvec_induction : LEMMA % :-)
      FORALL(p:PRED[bvec[N]]) :
        p(fill[N](FALSE))
          AND
        (FORALL(bv:bvec[N]) : p(bv) IMPLIES p(bv+1))
          IMPLIES
        FORALL(bv:bvec[N]) : p(bv)

    plus_min_zero : LEMMA % :-)
      bv + (-bv) = fill[N](FALSE)

    min_fill_F : LEMMA % :-)
      -fill[N](FALSE) = fill[N](FALSE)

    inc_zero : LEMMA % :-)
      (bv+1)(0) IFF NOT bv(0)

    sum_upper_n : LEMMA % :-)
      FORALL(F : [nat -> nat], high,low,n : nat) :
        low <= n AND n <= high
          IMPLIES
        sigma(low, high, F) >= F(n)

    bv2nat_upper_n : LEMMA % :-)
      FORALL(n:below(N)) :
        bv(n) IMPLIES bv2nat(bv) >= exp2(n)

    bv2nat_upperbound : LEMMA % :-)
      FORALL(n:below(N)) :
        bv2nat(bv) < exp2(n) 
          IFF
        FORALL(k:below(N)) : k >= n IMPLIES NOT bv(k)

    bv2nat_upperbound_caret : LEMMA % :-)
      FORALL(n:below(N)) :
        bv2nat[N](bv) < exp2(n) 
          IMPLIES
        bv2nat[N](bv) = IF n = 0
                        THEN 0
                        ELSE bv2nat[n](bv^(n-1,0))
                        ENDIF

  %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  %
  % Widen & Narrow
  %
  % These are typical Java Integral operations to move back and forth
  % between integral types. Widen doubles the length of the 
  % representation (e.g. from byte to short (8 to 16 bits), or
  % from short to int (16 to 32 bits). It does so by keeping the sign.
  % 
  % In the reverse direction, narrowing drops half of the bits (the
  % most significant ones) in going e.g. from int to short. This
  % may affect the sign.
  %
  % See, JLS (Java Language Specification, 2nd ed.), 5.1.2 and 5.1.3.
  %
  % Operations on integral types typically first ``promote'' the
  % arguments to int type.
  %
  %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

    widen(bv) : bvec[2*N] = 
      LAMBDA(k:below(2*N)) : IF k < N-1
                             THEN bv(k) 
                             ELSE bv(N-1) % negative byte
                             ENDIF

    bv2int_widen : LEMMA % :-)
      bv2int[2*N](widen(bv)) = bv2int[N](bv)

    widen_inj : LEMMA % :-)
      (widen(bv1) = widen(bv2)) = (bv1 = bv2)

    bv2int_plus_widens : LEMMA % :-)
      bv2int[2*N](widen(bv1) + widen(bv2)) = bv2int[N](bv1) + bv2int[N](bv2)

    bv2int_min_widen : LEMMA % :-)
      bv2int[2*N](-widen(bv)) = -bv2int[N](bv)

    bv2nat_widen : LEMMA % :-)
      bv2nat(widen(bv)) = IF bv2nat(bv) < exp2(N-1)
                          THEN bv2nat(bv)
                          ELSE bv2nat(bv) + exp2(2*N)-exp2(N)
                          ENDIF

    bv2nat_widen_null : LEMMA % :-)
      (bv2nat(widen(bv)) = 0) = (bv2nat(bv) = 0)

    narrow(BV) : bvec[N] = BV^(N-1,0)

    bv2int_narrow : LEMMA % :-)
      -exp2(N-1) <= bv2int(BV) AND bv2int(BV) < exp2(N-1)
        IMPLIES
      bv2int[N](narrow(BV)) = bv2int[2*N](BV)

    narrow_int2bv : LEMMA % :-)
      -exp2(N-1) <= k AND k < exp2(N-1)
        IMPLIES
      narrow(int2bv[2*N](k)) = int2bv[N](k)

    narrow_widen : LEMMA % :-)
      narrow(widen(bv)) = bv;

    narrow_plus : LEMMA % :-)
      narrow(BV1 + BV2) = narrow(BV1) + narrow(BV2)

    narrow_min : LEMMA % :-)
      narrow(-BV) = -narrow(BV)
      
    narrow_minus : LEMMA % :-)
      narrow(BV1 - BV2) = narrow(BV1) - narrow(BV2)

    % The next lemma will probably not often work because of the representation
    % of bitvectors, namely as:  (x o (x o (x o (x...))))

    narrow_concat : LEMMA %-)
      FORALL (bv1,bv2 : bvec[N]):
        narrow[2*N](bv1 o bv2) = bv2

  %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  %
  % More auxiliary results
  %
  %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

    leftshift_zero : LEMMA % :-)
      left_shift(0, bv) = bv

    leftshift_inc : LEMMA % :-)
      FORALL(n:below(N-1)) : 
        n > 0  % Condition needed to prevent circular rewriting
          IMPLIES
        left_shift(n+1, bv) = left_shift(1, left_shift(n, bv))

    bv2nat_leftshift : LEMMA % :-)
      FORALL(n:below(N)) :
        bv2nat(bv) < exp2(N-n) 
          IMPLIES 
        bv2nat(left_shift(n, bv)) = exp2(n) * bv2nat(bv)

    bv2nat_rightshift_upperbound : LEMMA % :-)
      FORALL(n:below(N)) :
        exp2(n) * bv2nat(right_shift(n, bv)) <= bv2nat(bv)

    bv2int_rightshift_upperbound : LEMMA % :-)
      FORALL(n:below(N)) : 
        bv2int(bv) >= 0
          IMPLIES
        exp2(n) * bv2int(right_shift(n, bv)) <= bv2int(bv)

    rightshift_zero : LEMMA % :-)
      right_shift(0, bv) = bv

    rightshift_inc : LEMMA % :-)
      FORALL(n:below(N-1)) :
        n > 0  % Condition needed to prevent circular rewriting
          IMPLIES
        right_shift(n+1, bv) = right_shift(1, right_shift(n, bv))

    bv2int_rightshift_pos : LEMMA % :-)
      FORALL(n:posnat) : 
        bv2int(right_shift(n, bv)) >= 0

    leftshift1_add_aux : LEMMA % :-)
      FORALL(n:below(N-1)) : 
        n_cout_rec[N](n+1, left_shift(1, bv1), left_shift(1, bv2), FALSE)
        =
        n_cout_rec[N](n, bv1, bv2, FALSE)

    leftshift1_add : LEMMA % :-)
     left_shift(1, bv1 + bv2) = 
       left_shift(1, bv1) + left_shift(1, bv2)

    narrow_rightshift : LEMMA % :-)
      FORALL(n:nat) :
      0 <= bv2int(BV) AND bv2int(BV) < exp2(N)
          IMPLIES
        narrow(right_shift(n, BV)) = right_shift(n, narrow(BV))

  END BitvectorUtil

addendum:
  %%% ================ Addendum: generated declarations ================

  % Subtype TCC generated (at line 22, column 26) for  N
      % expected type  posnat
  plus_min_zero_TCC1: OBLIGATION N > 0;

  % Subtype TCC generated (at line 47, column 11) for  0
      % expected type  below(N)
  inc_zero_TCC1: OBLIGATION 0 < N;

  % Subtype TCC generated (at line 71, column 41) for  n - 1
      % expected type  below(N)
  bv2nat_upperbound_caret_TCC1: OBLIGATION
    FORALL (bv: bvec[N], n: below(N)):
      NOT n = 0 AND bv2nat[N](bv) < exp2(n) IMPLIES n - 1 >= 0 AND n - 1 < N;

  % Subtype TCC generated (at line 71, column 45) for  0
      % expected type  upto(n - 1)
  bv2nat_upperbound_caret_TCC2: OBLIGATION
    FORALL (bv: bvec[N], n: below(N)):
      NOT n = 0 AND bv2nat[N](bv) < exp2(n) IMPLIES 0 <= n - 1;

  % Subtype TCC generated (at line 96, column 35) for  k
      % expected type  below(N)
  widen_TCC1: OBLIGATION FORALL (k: below(2 * N)): k < N - 1 IMPLIES k < N;

  % Subtype TCC generated (at line 97, column 35) for  N - 1
      % expected type  below(N)
  widen_TCC2: OBLIGATION
    FORALL (k: below(2 * N)): NOT k < N - 1 IMPLIES N - 1 >= 0 AND N - 1 < N;

  % Subtype TCC generated (at line 101, column 11) for  2 * N
      % expected type  posnat
  bv2int_widen_TCC1: OBLIGATION 2 * N > 0;

  % Subtype TCC generated (at line 113, column 45) for  N - 1
      % expected type  nat
  bv2nat_widen_TCC1: OBLIGATION N - 1 >= 0;

  % Subtype TCC generated (at line 121, column 29) for  N - 1
      % expected type  below(2 * N)
  narrow_TCC1: OBLIGATION N - 1 >= 0 AND N - 1 < 2 * N;

  % Subtype TCC generated (at line 121, column 33) for  0
      % expected type  upto(N - 1)
  narrow_TCC2: OBLIGATION 0 <= N - 1;

  % Subtype TCC generated (at line 131, column 23) for  k
      % expected type  iv: rng_2s_comp[2 * N]
  narrow_int2bv_TCC1: OBLIGATION
    FORALL (k: int):
      k < exp2(N - 1) AND -exp2(N - 1) <= k IMPLIES
       minint[2 * N] <= k AND k <= maxint[2 * N];

  % Subtype TCC generated (at line 131, column 39) for  k
      % expected type  iv: rng_2s_comp[N]
  narrow_int2bv_TCC2: OBLIGATION
    FORALL (k: int):
      k < exp2(N - 1) AND -exp2(N - 1) <= k IMPLIES
       minint[N] <= k AND k <= maxint[N];

  % Subtype TCC generated (at line 169, column 24) for  N - n
      % expected type  nat
  bv2nat_leftshift_TCC1: OBLIGATION FORALL (n: below(N)): N - n >= 0;

  % Subtype TCC generated (at line 198, column 20) for  n + 1
      % expected type  below[N]
  leftshift1_add_aux_TCC1: OBLIGATION FORALL (n: below(N - 1)): n + 1 < N;

  % Subtype TCC generated (at line 200, column 20) for  n
      % expected type  below[N]
  leftshift1_add_aux_TCC2: OBLIGATION FORALL (n: below(N - 1)): n < N;


body:
  %
  %  BitvectorMultiplication
  %  =======================
  %
  %  for Translating Java Classes into the Higher Order Logic of PVS.
  %
  %  All integral types are interpreted as PVS integers, without 
  %  taking bounds into account
  %
  %  Author: Bart Jacobs
  %  Integrated with the bitvector library by Sam Owre <owre@csl.sri.com>

  BitvectorMultiplication[N : posnat] : THEORY
  BEGIN

    ASSUMING
       N_size: ASSUMPTION N >= 2
    ENDASSUMING

    IMPORTING BitvectorUtil[N]

    bv, bv1, bv2, bv3 : VAR bvec[N]

    times_rec(bv1:bvec[N], bv2:bvec[N], n:nat) : RECURSIVE bvec[N] =
      IF n = 0
      THEN fill[N](FALSE)
      ELSIF bv1(0)
      THEN bv2 + left_shift(1, times_rec(right_shift(1, bv1), bv2, n-1))
      ELSE left_shift(1, times_rec(right_shift(1, bv1), bv2, n-1))
      ENDIF
      MEASURE n;

    *(bv1, bv2) : bvec[N] = times_rec(bv1, bv2, N)

  %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  %
  % auxiliary results
  %
  %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

    times_rec_zero_right : LEMMA % :-)
      FORALL(n:nat) : 
        times_rec(bv, fill[N](FALSE), n) = fill[N](FALSE)

    times_rec_zero_left : LEMMA % :-)
      FORALL(n:nat) : 
        times_rec(fill[N](FALSE), bv, n) = fill[N](FALSE)

    times_rec_repeat : LEMMA % :-)
      FORALL(n,m:nat) : 
        bv2nat(bv1) < exp2(n)
          IMPLIES
        times_rec(bv1, bv2, n+m) = times_rec(bv1, bv2, n)

  % Distributivity of zero

    times_zero_first : LEMMA % :-)
      fill[N](FALSE) * bv = fill[N](FALSE)

    times_zero_second : LEMMA % :-)
      bv * fill[N](FALSE) = fill[N](FALSE)

  % inc-right

    times_rec_inc_right : LEMMA % :-)
      FORALL(n:below(N+1)) : 
        times_rec(bv1, bv2+1, n) = 
          times_rec(bv1, bv2, n) + (IF n = 0
                                    THEN fill[N](FALSE)
                                    ELSE (fill[N-n](FALSE) o bv1 ^ (n-1, 0))
                                    ENDIF)

    times_rec_max_inc_right : LEMMA % :-)
      times_rec(bv1, bv2+1, N) = 
        times_rec(bv1, bv2, N) + bv1

    times_rec_max_inc_n_right : LEMMA % :-)
      FORALL(n:nat) : 
        times_rec(bv1, bv2+n, N) =
          iterate[bvec[N]](LAMBDA(b:bvec[N]) : b + bv1, n)
                          (times_rec(bv1, bv2, N))

    times_rec_iterate : LEMMA % :-)
      times_rec(bv1, bv2, N) =
        iterate[bvec[N]](LAMBDA(b:bvec[N]) : b + bv1, bv2nat(bv2))
                        (fill[N](FALSE))

  % two crucial auxiliary results, on which much of the subsequent reasoning
  % depends:

    bv2nat_iterate : LEMMA % :-)
      FORALL(n:nat) :
        n * bv2nat(bv1) < exp2(N) 
          IMPLIES
        bv2nat(iterate[bvec[N]](LAMBDA(b:bvec[N]) : b + bv1, n)(fill[N](FALSE)))
          = n * bv2nat(bv1)

    bv2int_iterate : LEMMA % :-)
      FORALL(n:nat) :
        -exp2(N-1) <= n * bv2int(bv1) AND n * bv2int(bv1) < exp2(N-1) 
          IMPLIES
        bv2int(iterate[bvec[N]](LAMBDA(b:bvec[N]) : b + bv1, n)(fill[N](FALSE)))
          = n * bv2int(bv1)

  % towards commutativity, proved by bitvector induction

    iterate_inc : LEMMA % :-)
      FORALL(n:nat) :
        iterate[bvec[N]](LAMBDA (b:bvec[N]): b + (bv1 + 1), n)
                        (fill[N](FALSE))
        =
        iterate[bvec[N]](LAMBDA (b:bvec[N]): b + bv1, n)
                      (fill[N](FALSE)) + n

    iterate_inc_m : LEMMA % :-)
      FORALL(n,m:nat) :
        iterate[bvec[N]](LAMBDA (b:bvec[N]): b + (bv1 + m), n)
                        (fill[N](FALSE))
        =
        iterate[bvec[N]](LAMBDA (b:bvec[N]): b + bv1, n)
                      (fill[N](FALSE)) + (n * m)

    iterate_modulo : LEMMA % :-)
      FORALL(i:nat) : 
        iterate[bvec[N]](LAMBDA(b:bvec[N]) : b + bv2, i * exp2(N))
                        (fill[N](FALSE))    
        = 
        fill[N](FALSE)

    iterate_comm : LEMMA % :-)
      iterate[bvec[N]](LAMBDA(b:bvec[N]) : b + bv1, bv2nat(bv2))
                      (fill[N](FALSE))    
      =
      iterate[bvec[N]](LAMBDA(b:bvec[N]) : b + bv2, bv2nat(bv1))
                      (fill[N](FALSE))    

    times_rec_comm : LEMMA % :-)
      times_rec(bv1, bv2, N) = times_rec(bv2, bv1, N)

    times_comm : LEMMA % :-)
      bv1 * bv2 = bv2 * bv1

  % commutation with min

    iterate_min_second : LEMMA % :-)
      FORALL(n:nat) : 
        iterate[bvec[N]](LAMBDA(b:bvec[N]) : b + (-bv), n)
                        (fill[N](FALSE))    
        =
        -iterate[bvec[N]](LAMBDA(b:bvec[N]) : b + bv, n)
                        (fill[N](FALSE))    

    times_rec_min_first : LEMMA % :-)
      times_rec(-bv1, bv2, N) = -times_rec(bv1, bv2, N)
        
    times_rec_min_second : LEMMA % :-)
      times_rec(bv1, -bv2, N) = -times_rec(bv1, bv2, N)

    times_min_first : LEMMA % :-)
      (-bv1) * bv2 = -(bv1 * bv2)

    times_min_second : LEMMA % :-)
      bv1 * (-bv2) = -(bv1 * bv2)

  % multiplicative unit

    one : bvec[N] = (LAMBDA(k:below(N)) : k=0)

    bv2nat_one : LEMMA % :-)
      bv2nat[N](one) = 1

    bv2int_one : LEMMA % :-)
      bv2int[N](one) = 1

    times_one_first : LEMMA % :-)
      one * bv = bv

    times_one_second : LEMMA % :-)
      bv * one = bv

  % distributivity over +

    iterate_zero_add : LEMMA % :-)
      FORALL(n:nat) : 
        iterate[bvec[N]](LAMBDA(b:bvec[N]) : b + bv1, n)
                        (bv2)    
        =
        iterate[bvec[N]](LAMBDA(b:bvec[N]) : b + bv1, n)
                        (fill[N](FALSE)) + bv2

    times_rec_distr : LEMMA % :-)
      times_rec(bv1, bv2 + bv3, N)
      =
      times_rec(bv1, bv2, N) + times_rec(bv1, bv3, N)

    times_distr_right : LEMMA % :-)
      bv1 * (bv2 + bv3) = (bv1 * bv2) + (bv1 * bv3)
      
    times_distr_left : LEMMA % :-)
      (bv1 + bv2) * bv3 = (bv1 * bv3) + (bv2 * bv3)
      
    times_distr_iterate : LEMMA % :-)
      FORALL(n:nat) :
        bv2 * iterate[bvec[N]](LAMBDA(b:bvec[N]) : b + bv1, n)(fill[N](FALSE))
        =
        iterate[bvec[N]](LAMBDA(b:bvec[N]) : b + (bv2 * bv1), n)(fill[N](FALSE))

  % associativity

    times_assoc : LEMMA % :-)
      (bv1 * bv2) * bv3 = bv1 * (bv2 * bv3)

  % Now we can say that bvec[N] carries a commutative group structure
  % (0, +, -) and a commutative monoid structure (*, one), and that
  % the latter preserves the group structure. More formally, (*, one)
  % is a commutative monoid in the category of commutative groups,
  % see MacLane, Categories for the Working Mathematician (1972), 
  % Chapter VII, section 3.

  END BitvectorMultiplication

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 20, column 12) for  BitvectorUtil[N]
      % generated from assumption BitvectorUtil.N_size
  IMP_BitvectorUtil_TCC1: OBLIGATION N >= 2;

  % Subtype TCC generated (at line 27, column 14) for  0
      % expected type  below(N)
  times_rec_TCC1: OBLIGATION FORALL (n: nat): NOT n = 0 IMPLIES 0 < N;

  % Subtype TCC generated (at line 28, column 65) for  n - 1
      % expected type  nat
  times_rec_TCC2: OBLIGATION
    FORALL (bv1: bvec[N], n: nat): bv1(0) AND NOT n = 0 IMPLIES n - 1 >= 0;

  % Termination TCC generated (at line 28, column 29) for
      % times_rec(right_shift(1, bv1), bv2, n - 1)
  times_rec_TCC3: OBLIGATION
    FORALL (bv1: bvec[N], n: nat): bv1(0) AND NOT n = 0 IMPLIES n - 1 < n;

  % Subtype TCC generated (at line 29, column 59) for  n - 1
      % expected type  nat
  times_rec_TCC4: OBLIGATION
    FORALL (bv1: bvec[N], n: nat):
      NOT bv1(0) AND NOT n = 0 IMPLIES n - 1 >= 0;

  % Termination TCC generated (at line 29, column 23) for
      % times_rec(right_shift(1, bv1), bv2, n - 1)
  times_rec_TCC5: OBLIGATION
    FORALL (bv1: bvec[N], n: nat): NOT bv1(0) AND NOT n = 0 IMPLIES n - 1 < n;

  % Subtype TCC generated (at line 70, column 45) for  N - n
      % expected type  nat
  times_rec_inc_right_TCC1: OBLIGATION
    FORALL (n: below(N + 1)): NOT n = 0 IMPLIES N - n >= 0;

  % Subtype TCC generated (at line 70, column 66) for  n - 1
      % expected type  below(N)
  times_rec_inc_right_TCC2: OBLIGATION
    FORALL (n: below(N + 1)): NOT n = 0 IMPLIES n - 1 >= 0 AND n - 1 < N;

  % Subtype TCC generated (at line 70, column 71) for  0
      % expected type  upto(n - 1)
  times_rec_inc_right_TCC3: OBLIGATION
    FORALL (n: below(N + 1)): NOT n = 0 IMPLIES 0 <= n - 1;

  % Subtype TCC generated (at line 100, column 12) for  N - 1
      % expected type  nat
  bv2int_iterate_TCC1: OBLIGATION N - 1 >= 0;


body:
  %
  %  BitvectorMultiplicationWidenNarrow
  %  ==================================
  %
  %  for Translating Java Classes into the Higher Order Logic of PVS.
  %
  %  All integral types are interpreted as PVS integers, without 
  %  taking bounds into account
  %
  %  Author: Bart Jacobs
  %  Integrated with the bitvector library by Sam Owre <owre@csl.sri.com>

  BitvectorMultiplicationWidenNarrow[N : posnat] : THEORY
  BEGIN
    ASSUMING
       N_size: ASSUMPTION N >= 2
    ENDASSUMING

    IMPORTING BitvectorMultiplication[N],
              BitvectorMultiplication[2*N]

    bv, bv1, bv2 : VAR bvec[N]
    BV, BV1, BV2 : VAR bvec[2*N]

    bv2nat_narrow : LEMMA % :-)
      bv2nat(BV) < exp2(N) IMPLIES bv2nat(narrow(BV)) = bv2nat(BV)

    bv2nat_times_rec : LEMMA % :-)
      bv2nat(BV1) < exp2(N) AND bv2nat(BV2) < exp2(N)
        IMPLIES
      bv2nat(times_rec[2*N](BV1, BV2, 2*N)) = bv2nat(BV1) * bv2nat(BV2)

    bv2nat_times : LEMMA % :-)
      bv2nat(BV1) * bv2nat(BV2) < exp2(2*N)
        IMPLIES
      bv2nat(BV1 * BV2) = bv2nat(BV1) * bv2nat(BV2)

    bv2int_times : LEMMA % :-)
     -exp2(2*N-1) < bv2int(BV1) * bv2int(BV2) 
       AND 
     bv2int(BV1) * bv2int(BV2) < exp2(2*N-1)
        IMPLIES
      bv2int(BV1 * BV2) = bv2int(BV1) * bv2int(BV2)

  % main results for computing outcomes of multiplications:

    bv2int_times_widens : LEMMA % :-)
      bv2int(widen(bv1) * widen(bv2)) = bv2int(bv1) * bv2int(bv2)

    bv2int_times_int2bv_first : LEMMA % :-)
      FORALL(k:int) :
       -exp2(2*N-1) < k * bv2int(BV) AND k * bv2int(BV) < exp2(2*N-1)      
         AND
       -exp2(2*N-1) <= k AND k < exp2(2*N-1)      
         IMPLIES
       bv2int[2*N](int2bv[2*N](k) * BV) = k * bv2int(BV)

    bv2int_times_int2bv_second : LEMMA % :-)
      FORALL(k:int) :
       -exp2(2*N-1) < k * bv2int(BV) AND k * bv2int(BV) < exp2(2*N-1)      
         AND
       -exp2(2*N-1) <= k AND k < exp2(2*N-1)      
         IMPLIES
       bv2int[2*N](BV * int2bv[2*N](k)) = k * bv2int(BV)

  % narrow and multiplication

    narrow_iterate : LEMMA % :-)
      FORALL(n:nat) :
        narrow(iterate[bvec[2*N]](LAMBDA(b:bvec[2*N]) : b + BV1, n)
                                 (fill[2*N](FALSE)))
        =
        iterate[bvec[N]](LAMBDA(b:bvec[N]) : b + narrow(BV1), n)(fill[N](FALSE))

    bv2nat_split : LEMMA % :-)
      bv2nat(BV) = exp2(N) * bv2nat(BV^(2*N-1,N)) + bv2nat(BV^(N-1,0))

    narrow_times : LEMMA % :-)
      narrow(BV1 * BV2) = narrow(BV1) * narrow(BV2)


  % JLS, 15.17.1:
  %
  % The binary * operator performs multiplication, producing the product
  % of its operands. Multiplication is a commutative operation if the
  % operand expressions have no side effects. While integer multiplication
  % is associative when the operands are all of the same type,
  % floating-point multiplication is not associative. If an integer
  % multiplication overflows, then the result is the low-order bits of the
  % mathematical product as represented in some sufficiently large
  % two's-complement format. As a result, if overflow occurs, then the sign
  % of the result may not be the same as the sign of the mathematical
  % product of the two operand values.
  %
  % This is formalised in the following way:

    times_is_java_times : LEMMA % :-)
      bv1 * bv2 = narrow(widen(bv1) * widen(bv2))

  END BitvectorMultiplicationWidenNarrow

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 19, column 12) for
      % BitvectorMultiplication[N]
      % generated from assumption BitvectorMultiplication.N_size
  IMP_BitvectorMultiplication_TCC1: OBLIGATION N >= 2;

  % Assuming TCC generated (at line 20, column 12) for
      % BitvectorMultiplication[2 * N]
      % generated from assumption BitvectorMultiplication.N_size
  IMP_BitvectorMultiplication_TCC2: OBLIGATION 2 * N >= 2;

  % Subtype TCC generated (at line 39, column 9) for  2 * N - 1
      % expected type  nat
  bv2int_times_TCC1: OBLIGATION 2 * N - 1 >= 0;

  % Subtype TCC generated (at line 56, column 29) for  k
      % expected type  iv: rng_2s_comp[2 * N]
  bv2int_times_int2bv_first_TCC1: OBLIGATION
    FORALL (BV: bvec[2 * N], k: int):
      -exp2(2 * N - 1) < k * bv2int(BV) AND
       k * bv2int(BV) < exp2(2 * N - 1) AND
        -exp2(2 * N - 1) <= k AND k < exp2(2 * N - 1)
       IMPLIES minint[2 * N] <= k AND k <= maxint[2 * N];

  % Subtype TCC generated (at line 76, column 38) for  2 * N - 1
      % expected type  below(2 * N)
  bv2nat_split_TCC1: OBLIGATION 2 * N - 1 >= 0 AND 2 * N - 1 < 2 * N;

  % Subtype TCC generated (at line 76, column 44) for  N
      % expected type  upto(2 * N - 1)
  bv2nat_split_TCC2: OBLIGATION N <= 2 * N - 1;

  % Subtype TCC generated (at line 76, column 61) for  N - 1
      % expected type  below(2 * N)
  bv2nat_split_TCC3: OBLIGATION N - 1 >= 0 AND N - 1 < 2 * N;

  % Subtype TCC generated (at line 76, column 65) for  0
      % expected type  upto(N - 1)
  bv2nat_split_TCC4: OBLIGATION 0 <= N - 1;


body:
  %
  %  DivisionUtil
  %  ============
  %
  %  for Translating Java Classes into the Higher Order Logic of PVS.
  %
  %  All integral types are interpreted as PVS integers, without 
  %  taking bounds into account
  %
  %  Author: Bart Jacobs
  %  Integrated with the bitvector library by Sam Owre <owre@csl.sri.com>

  DivisionUtil : THEORY
  BEGIN

    IMPORTING BitvectorUtil

    leftshift_with : LEMMA % :-)
      FORALL(n:nat, bv:bvec[n], b:bool) : 
        n > 1 AND bv2nat[n](bv) < exp2(n-1)
          IMPLIES
        bv2nat[n](left_shift(1, bv) WITH [(0) := b]) = 2 * bv2nat[n](bv) + b2n(b)

    bv2nat_minus3 : LEMMA % :-)
      FORALL(n:posnat, bv1, bv2:bvec[n]) :
        bv2nat[n](bv1) <= bv2nat[n](bv2)
          IMPLIES
        bv2nat[n](bv2 - bv1) = bv2nat[n](bv2) - bv2nat[n](bv1);

  END DivisionUtil

addendum:
  %%% ================ Addendum: generated declarations ================

  % Subtype TCC generated (at line 20, column 37) for  n - 1
      % expected type  nat
  leftshift_with_TCC1: OBLIGATION FORALL (n: nat): n > 1 IMPLIES n - 1 >= 0;

  % Subtype TCC generated (at line 22, column 41) for  0
      % expected type  below(n)
  leftshift_with_TCC2: OBLIGATION
    FORALL (n: nat, bv: bvec[n]):
      n > 1 AND bv2nat[n](bv) < exp2(n - 1) IMPLIES 0 < n;


body:
  %
  %  BitvectorOneComplementDivision
  %  ==============================
  %
  %  for Translating Java Classes into the Higher Order Logic of PVS.
  %
  %  All integral types are interpreted as PVS integers, without 
  %  taking bounds into account
  %
  %  Author: Bart Jacobs
  %  Integrated with the bitvector library by Sam Owre <owre@csl.sri.com>

  BitvectorOneComplementDivision[N : posnat] : THEORY
  BEGIN

    ASSUMING
       N_size: ASSUMPTION N >= 2
    ENDASSUMING

    IMPORTING DivisionUtil,
              BitvectorMultiplication[N]

    bv, bv1, bv2, bv3 : VAR bvec[N]
    dvs, dvd, rem, quot, aux : VAR bvec[N]

  %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  %
  % The next function implements 1-complement division-remainder
  % computation, following for instance: Stallings, Computer Organization
  % and Architecture (4th ed., 1996), Section 8.3: Integer arithmetic.
  %
  % Basically, it follows the standard paper-and-pencil approach.
  %
  % The function should be called with rem = fill[N](FALSE), n = N,
  % see the subsequent definitions of div and rem.
  %
  % Names: dvs = divisor, 
  %        dvd = dividend (as in dividend/divisor), 
  %        rem = remainder, 
  %        n   = counter
  % 
  % An output tuple should be interpreted as (dvd/dvs, dvd%dvs), see
  % the subsequent definitions of div and rem.
  %
  %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

    divrem(dvd, dvs, rem : bvec[N], n : nat) : RECURSIVE [bvec[N], bvec[N]] =
      IF n = 0
      THEN (dvd, rem)
      ELSE LET 
               rem1 = left_shift(1, rem) WITH [(0) := dvd(N-1)],
               dvd1 = left_shift(1, dvd)
           IN
               IF bv2nat[N](dvs) <= bv2nat[N](rem1)
               THEN divrem(dvd1 WITH [(0) := TRUE], dvs, rem1-dvs, n-1)
               ELSE divrem(dvd1, dvs, rem1, n-1)
               ENDIF
      ENDIF
      MEASURE n;

  % div

    div(dvd, dvs) : bvec[N] = divrem(dvd, dvs, fill[N](FALSE), N)`1;

  % rem

    rem(dvd, dvs) : bvec[N] = divrem(dvd, dvs, fill[N](FALSE), N)`2

  % Some easy results about div and rem

    divrem_dvd : LEMMA % :-)
      FORALL(n:below(N+1), k:below(N-n)) :
        divrem(dvd, dvs, rem, n)`1(k+n) = dvd(k)

    divrem_dvs0 : LEMMA % :-)
      FORALL(n:below(N+1)) :
        divrem(dvd, fill[N](FALSE), rem, n) = 
          ((LAMBDA(i:below(N)) : IF i < n
                                 THEN TRUE
                                 ELSE dvd(i-n)
                                 ENDIF),

           (LAMBDA(i:below(N)) : IF i < n
                                 THEN dvd(N-n+i)
                                 ELSE rem(i-n)
                                 ENDIF))

  % A couple of auxiliary results needed for the key invariant
  % property of divrem below.

    bv2nat_left_false_inc : LEMMA % :-)
      FORALL(n:below(N)) :
        bv2nat[N](LAMBDA(i:below(N)) :
                    IF i < n+1
                    THEN bv(i)
                    ELSE FALSE
                    ENDIF)
        =
        bv2nat[N](LAMBDA(i:below(N)) :
                    IF i < n
                    THEN bv(i)
                    ELSE FALSE
                    ENDIF) + exp2(n) * b2n(bv(n))

    bv2nat_right_false_inc : LEMMA % :-)
      FORALL(n:below(N)) :
        bv2nat[N](LAMBDA(i:below(N)) :
                    IF i < n
                    THEN FALSE
                    ELSE bv(i)
                    ENDIF) 
        =
        bv2nat[N](LAMBDA(i:below(N)) :
                    IF i < n+1
                    THEN FALSE
                    ELSE bv(i)
                    ENDIF) + exp2(n) * b2n(bv(n))

    bv2nat_left_false_dec : LEMMA % :-)
      FORALL(n:below(N)) :
        bv2nat[N](LAMBDA(i:below(N)) :
                    IF i < N-n
                    THEN bv(i+n)
                    ELSE FALSE
                    ENDIF)
        =
        bv2nat[N](LAMBDA(i:below(N)) :
                    IF i < N-n-1
                    THEN bv(i+n)
                    ELSE FALSE
                    ENDIF) + exp2(N-n-1) * b2n(bv(N-1))

    bv2nat_split : LEMMA % :-)
      FORALL(m:below(N+1)) :
        bv2nat[N](LAMBDA(i:below(N)) :
                    IF i < m
                    THEN bv1(i+N-m)
                    ELSE bv2(i-m)
                    ENDIF)
        =
        bv2nat[N](LAMBDA(i:below(N)) :
                    IF i < m
                    THEN bv1(i+N-m)
                    ELSE FALSE
                    ENDIF)
        + exp2(m) * bv2nat[N](LAMBDA(i:below(N)) :
                                IF i < N-m
                                THEN bv2(i)
                                ELSE FALSE
                                ENDIF)

    bv2nat_left_false_minus : LEMMA % :-)
      FORALL(n:below(N)) :
        bv2nat[N](LAMBDA (i: below(N)):
                    IF i < N - n
                    THEN bv(i + n)
                    ELSE FALSE
                    ENDIF)
        =
        2 * bv2nat[N](LAMBDA (i: below(N)):
                    IF i < N - n - 1
                    THEN bv(1 + i + n)
                    ELSE FALSE
                    ENDIF)
        + b2n(bv(n))

    bv2nat_leftshift_exp : LEMMA % :-)
      bv2nat(bv) = bv2nat(left_shift(1, bv))/2 + exp2(N-1) * b2n(bv(N-1))

  %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  %
  % The above divrem function is too compact. For instance, it overwrites
  % the argument dvd from the left, which becomes the intended quotient.
  % In this way we cannot formulate the intended invariant property.
  % Therefore we introduce a more explicit auxiliary variation `divrem_mem' 
  % with ``memory'', which keeps the dvd argument.
  % Also, in its cycles it considers only the appropriate part of the
  % remainder argument.
  %
  %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

    divrem_mem(aux, dvs, quot, rem : bvec[N], n : below(N+1)) : 
      RECURSIVE [bvec[N], bvec[N], bvec[N]] =
        IF n = 0
        THEN (aux, quot, rem)
        ELSE LET 
                 aux1  = left_shift(1, aux) WITH [(0) := quot(N-1)],
                 rem1  = left_shift(1, rem) WITH [(0) := quot(N-1)],
                 quot1 = left_shift(1, quot)
             IN
                 IF bv2nat[N](dvs) <= bv2nat[N](LAMBDA(i:below(N)) : IF i < N-n+1
                                                                     THEN rem1(i)
                                                                     ELSE FALSE
                                                                     ENDIF)
                 THEN divrem_mem(aux1, dvs, quot1 WITH [(0) := TRUE], 
                                 (LAMBDA(i:below(N)) : IF i < N-n+1
                                                       THEN rem1(i)
                                                       ELSE FALSE
                                                       ENDIF) - dvs, n-1)
                 ELSE divrem_mem(aux1, dvs, quot1, rem1, n-1)
                 ENDIF
        ENDIF
        MEASURE n;

  % The next three results relate divrem_mem with divrem, and with div and rem.

    divrem_mem_first_second_third : LEMMA % :-)
      FORALL(n:below(N+1)) :
        LET
            drm = divrem_mem(aux, dvs, quot, rem, n),
            dr  = divrem(quot, dvs, (LAMBDA(i:below(N)) : IF i < N-n
                                                          THEN rem(i)
                                                          ELSE FALSE
                                                          ENDIF), n)
        IN 
            drm`1 = (LAMBDA(i:below(N)) : IF i < n
                                          THEN quot(N-n+i)
                                          ELSE aux(i-n)
                                          ENDIF)
              AND
            drm`2 = dr`1
              AND
            drm`3 = dr`2

    divrem_mem_rem : LEMMA % :-)
      FORALL(n:below(N+1)) :
        (LAMBDA(i:below(N)) : IF i < N-n
                              THEN rem(i)
                              ELSE FALSE
                              ENDIF) < dvs 
          IMPLIES 
        divrem_mem(aux, dvs, dvd, rem, n)`3 < dvs

    div_divrem_mem : LEMMA % :-)
      div(dvd, dvs) = divrem_mem(fill[N](FALSE), dvs, dvd, fill[N](FALSE), N)`2

    rem_divrem_mem : LEMMA % :-)
      rem(dvd, dvs) = divrem_mem(fill[N](FALSE), dvs, dvd, fill[N](FALSE), N)`3

  %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  %
  % The key invariant property of divrem_mem. The parameter n should be
  % interpreted as the number of cycles that still need to be performed
  % to complete the computation.
  %
  %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

    divrem_mem_invariant : LEMMA % :-)
      FORALL(n:below(N+1)) : 
        LET 
            start_n = (LAMBDA(i:below(N)) : IF i < n
                                            THEN quot(N-n+i)
                                            ELSE aux(i-n)
                                            ENDIF),
            quot_n =  (LAMBDA(i:below(N)) : IF i < N-n
                                            THEN quot(i)
                                            ELSE FALSE
                                            ENDIF),
            rem_n =   (LAMBDA(i:below(N)) : IF i < n
                                            THEN quot(N-n+i)
                                            ELSE rem(i-n)
                                            ENDIF),
            drm = divrem_mem(aux, dvs, quot, rem, n)
        IN
            bv2nat[N](start_n) = 
              exp2(n) * bv2nat[N](dvs) * bv2nat[N](quot_n) + bv2nat[N](rem_n)
              IMPLIES
            bv2nat[N](drm`1) = 
              bv2nat[N](dvs) * bv2nat[N](drm`2) + bv2nat[N](drm`3)

  % Key properties of div and rem, including: 
  %     (a/b)*b+(a%b) = a and a%b < b
  % The `1' in the names of the lemmas refers to the 1-complement interpretation.

    divrem1_eq : LEMMA % :-)
      bv2nat(div(dvd, dvs)) * bv2nat(dvs) + bv2nat(rem(dvd, dvs)) = bv2nat(dvd)

    rem1_below_dvs : LEMMA % :-)
      bv2nat(dvs) /= 0 IMPLIES bv2nat(rem(dvd, dvs)) < bv2nat(dvs)

    rem1_dvs0 : LEMMA % :-)
      rem(dvd, fill[N](FALSE)) = dvd

    div1_dvs0 : LEMMA % :-)
      div(dvd, fill[N](FALSE)) = fill[N](TRUE)

    div1_below_dvd : LEMMA % :-)
      bv2nat(dvs) /= 0 IMPLIES bv2nat(div(dvd, dvs)) <= bv2nat(dvd)

    divrem1_uniqueness : LEMMA % :-)
      FORALL(q,r:nat) : 
        r < bv2nat(dvs) AND q * bv2nat(dvs) + r = bv2nat(dvd)
          IMPLIES
        q = bv2nat(div(dvd, dvs)) AND r = bv2nat(rem(dvd, dvs));

    divrem1_dvs1 : LEMMA % :-)
      div(dvd, one) = dvd AND rem(dvd, one) = fill[N](FALSE)

    div1_eq0 : LEMMA % :-)
      (bv2nat(div(dvd, dvs)) = 0) = (bv2nat(dvd) < bv2nat(dvs))

  END BitvectorOneComplementDivision

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 21, column 12) for
      % BitvectorMultiplication[N]
      % generated from assumption BitvectorMultiplication.N_size
  IMP_BitvectorMultiplication_TCC1: OBLIGATION N >= 2;

  % Subtype TCC generated (at line 55, column 37) for  0
      % expected type  below(N)
  divrem_TCC1: OBLIGATION
    FORALL (dvd, dvs, rem: bvec[N], n: nat):
      NOT n = 0 IMPLIES
       (FORALL (rem1: bvec[N]):
          rem1 = left_shift(1, rem) WITH [(0) := dvd(N - 1)] IMPLIES
           (FORALL (dvd1: bvec[N]):
              bv2nat[N](dvs) <= bv2nat[N](rem1) AND dvd1 = left_shift(1, dvd)
               IMPLIES 0 < N));

  % Subtype TCC generated (at line 55, column 65) for  n - 1
      % expected type  nat
  divrem_TCC2: OBLIGATION
    FORALL (dvd, dvs, rem: bvec[N], n: nat):
      NOT n = 0 IMPLIES
       (FORALL (rem1: bvec[N]):
          rem1 = left_shift(1, rem) WITH [(0) := dvd(N - 1)] IMPLIES
           (FORALL (dvd1: bvec[N]):
              bv2nat[N](dvs) <= bv2nat[N](rem1) AND dvd1 = left_shift(1, dvd)
               IMPLIES n - 1 >= 0));

  % Termination TCC generated (at line 55, column 18) for
      % divrem(dvd1 WITH [(0) := TRUE], dvs, rem1 - dvs, n - 1)
  divrem_TCC3: OBLIGATION
    FORALL (dvd, dvs, rem: bvec[N], n: nat):
      NOT n = 0 IMPLIES
       (FORALL (rem1: bvec[N]):
          rem1 = left_shift(1, rem) WITH [(0) := dvd(N - 1)] IMPLIES
           (FORALL (dvd1: bvec[N]):
              bv2nat[N](dvs) <= bv2nat[N](rem1) AND dvd1 = left_shift(1, dvd)
               IMPLIES n - 1 < n));

  % Subtype TCC generated (at line 56, column 42) for  n - 1
      % expected type  nat
  divrem_TCC4: OBLIGATION
    FORALL (dvd, dvs, rem: bvec[N], n: nat):
      NOT n = 0 IMPLIES
       (FORALL (rem1: bvec[N]):
          rem1 = left_shift(1, rem) WITH [(0) := dvd(N - 1)] IMPLIES
           (FORALL (dvd1: bvec[N]):
              NOT bv2nat[N](dvs) <= bv2nat[N](rem1) AND
               dvd1 = left_shift(1, dvd)
               IMPLIES n - 1 >= 0));

  % Termination TCC generated (at line 56, column 18) for
      % divrem(dvd1, dvs, rem1, n - 1)
  divrem_TCC5: OBLIGATION
    FORALL (dvd, dvs, rem: bvec[N], n: nat):
      NOT n = 0 IMPLIES
       (FORALL (rem1: bvec[N]):
          rem1 = left_shift(1, rem) WITH [(0) := dvd(N - 1)] IMPLIES
           (FORALL (dvd1: bvec[N]):
              NOT bv2nat[N](dvs) <= bv2nat[N](rem1) AND
               dvd1 = left_shift(1, dvd)
               IMPLIES n - 1 < n));

  % Subtype TCC generated (at line 51, column 46) for  0
      % expected type  below(N)
  divrem_TCC6: OBLIGATION FORALL (n: nat): NOT n = 0 IMPLIES 0 < N;

  % Subtype TCC generated (at line 51, column 56) for  N - 1
      % expected type  below(N)
  divrem_TCC7: OBLIGATION
    FORALL (n: nat): NOT n = 0 IMPLIES N - 1 >= 0 AND N - 1 < N;

  % Subtype TCC generated (at line 73, column 33) for  k + n
      % expected type  below(N)
  divrem_dvd_TCC1: OBLIGATION
    FORALL (n: below(N + 1), k: below(N - n)): k + n < N;

  % Subtype TCC generated (at line 73, column 44) for  k
      % expected type  below(N)
  divrem_dvd_TCC2: OBLIGATION
    FORALL (n: below(N + 1), k: below(N - n)): k < N;

  % Subtype TCC generated (at line 80, column 40) for  i - n
      % expected type  below(N)
  divrem_dvs0_TCC1: OBLIGATION
    FORALL (n: below(N + 1), i: below(N)):
      NOT i < n IMPLIES i - n >= 0 AND i - n < N;

  % Subtype TCC generated (at line 84, column 40) for  N - n + i
      % expected type  below(N)
  divrem_dvs0_TCC2: OBLIGATION
    FORALL (n: below(N + 1), i: below(N)):
      i < n IMPLIES N - n + i >= 0 AND N - n + i < N;

  % Subtype TCC generated (at line 123, column 26) for  i + n
      % expected type  below(N)
  bv2nat_left_false_dec_TCC1: OBLIGATION
    FORALL (n: below(N), i: below(N)): i < N - n IMPLIES i + n < N;

  % Subtype TCC generated (at line 129, column 26) for  i + n
      % expected type  below(N)
  bv2nat_left_false_dec_TCC2: OBLIGATION
    FORALL (n: below(N), i: below(N)): i < N - n - 1 IMPLIES i + n < N;

  % Subtype TCC generated (at line 131, column 32) for  N - n - 1
      % expected type  nat
  bv2nat_left_false_dec_TCC3: OBLIGATION FORALL (n: below(N)): N - n - 1 >= 0;

  % Subtype TCC generated (at line 131, column 48) for  N - 1
      % expected type  below(N)
  bv2nat_left_false_dec_TCC4: OBLIGATION
    FORALL (n: below(N)): N - 1 >= 0 AND N - 1 < N;

  % Subtype TCC generated (at line 137, column 27) for  i + N - m
      % expected type  below(N)
  bv2nat_split_TCC1: OBLIGATION
    FORALL (m: below(N + 1), i: below(N)):
      i < m IMPLIES i + N - m >= 0 AND i + N - m < N;

  % Subtype TCC generated (at line 162, column 26) for  1 + i + n
      % expected type  below(N)
  bv2nat_left_false_minus_TCC1: OBLIGATION
    FORALL (n: below(N), i: below(N)): i < N - n - 1 IMPLIES 1 + i + n < N;

  % Subtype TCC generated (at line 168, column 52) for  N - 1
      % expected type  nat
  bv2nat_leftshift_exp_TCC1: OBLIGATION N - 1 >= 0;

  % Subtype TCC generated (at line 199, column 67) for  n - 1
      % expected type  below(1 + N)
  divrem_mem_TCC1: OBLIGATION
    FORALL (aux, dvs, quot, rem: bvec[N], n: below(N + 1)):
      NOT n = 0 IMPLIES
       (FORALL (aux1: bvec[N]):
          aux1 = left_shift(1, aux) WITH [(0) := quot(N - 1)] IMPLIES
           (FORALL (rem1: bvec[N]):
              rem1 = left_shift(1, rem) WITH [(0) := quot(N - 1)] IMPLIES
               (FORALL (quot1: bvec[N]):
                  bv2nat[N](dvs) <=
                   bv2nat[N]
                       (LAMBDA (i: below(N)):
                          IF i < N - n + 1 THEN rem1(i) ELSE FALSE ENDIF)
                   AND quot1 = left_shift(1, quot)
                   IMPLIES n - 1 >= 0 AND n - 1 < 1 + N)));

  % Termination TCC generated (at line 195, column 20) for
      % divrem_mem(aux1, dvs, quot1 WITH [(0) := TRUE],
      %            (LAMBDA (i: below(N)):
      %               IF i < N - n + 1 THEN rem1(i) ELSE FALSE ENDIF)
      %             - dvs,
      %            n - 1)
  divrem_mem_TCC2: OBLIGATION
    FORALL (aux, dvs, quot, rem: bvec[N], n: below(N + 1)):
      NOT n = 0 IMPLIES
       (FORALL (aux1: bvec[N]):
          aux1 = left_shift(1, aux) WITH [(0) := quot(N - 1)] IMPLIES
           (FORALL (rem1: bvec[N]):
              rem1 = left_shift(1, rem) WITH [(0) := quot(N - 1)] IMPLIES
               (FORALL (quot1: bvec[N]):
                  bv2nat[N](dvs) <=
                   bv2nat[N]
                       (LAMBDA (i: below(N)):
                          IF i < N - n + 1 THEN rem1(i) ELSE FALSE ENDIF)
                   AND quot1 = left_shift(1, quot)
                   IMPLIES n - 1 < n)));

  % Subtype TCC generated (at line 200, column 55) for  n - 1
      % expected type  below(1 + N)
  divrem_mem_TCC3: OBLIGATION
    FORALL (aux, dvs, quot, rem: bvec[N], n: below(N + 1)):
      NOT n = 0 IMPLIES
       (FORALL (aux1: bvec[N]):
          aux1 = left_shift(1, aux) WITH [(0) := quot(N - 1)] IMPLIES
           (FORALL (rem1: bvec[N]):
              rem1 = left_shift(1, rem) WITH [(0) := quot(N - 1)] IMPLIES
               (FORALL (quot1: bvec[N]):
                  NOT bv2nat[N](dvs) <=
                       bv2nat[N]
                           (LAMBDA (i: below(N)):
                              IF i < N - n + 1 THEN rem1(i) ELSE FALSE ENDIF)
                   AND quot1 = left_shift(1, quot)
                   IMPLIES n - 1 >= 0 AND n - 1 < 1 + N)));

  % Termination TCC generated (at line 200, column 20) for
      % divrem_mem(aux1, dvs, quot1, rem1, n - 1)
  divrem_mem_TCC4: OBLIGATION
    FORALL (aux, dvs, quot, rem: bvec[N], n: below(N + 1)):
      NOT n = 0 IMPLIES
       (FORALL (aux1: bvec[N]):
          aux1 = left_shift(1, aux) WITH [(0) := quot(N - 1)] IMPLIES
           (FORALL (rem1: bvec[N]):
              rem1 = left_shift(1, rem) WITH [(0) := quot(N - 1)] IMPLIES
               (FORALL (quot1: bvec[N]):
                  NOT bv2nat[N](dvs) <=
                       bv2nat[N]
                           (LAMBDA (i: below(N)):
                              IF i < N - n + 1 THEN rem1(i) ELSE FALSE ENDIF)
                   AND quot1 = left_shift(1, quot)
                   IMPLIES n - 1 < n)));

  % Subtype TCC generated (at line 235, column 73) for  N
      % expected type  below(1 + N)
  div_divrem_mem_TCC1: OBLIGATION N < 1 + N;


body:
  %
  %  BitvectorTwoComplementDivision
  %  ==============================
  %
  %  for Translating Java Classes into the Higher Order Logic of PVS.
  %
  %  All integral types are interpreted as PVS integers, without 
  %  taking bounds into account
  %
  %  Author: Bart Jacobs
  %  Integrated with the bitvector library by Sam Owre <owre@csl.sri.com>

  BitvectorTwoComplementDivision[N:posnat] : THEORY
  BEGIN

    ASSUMING
       N_size: ASSUMPTION N >= 2
    ENDASSUMING

    IMPORTING BitvectorOneComplementDivision[N],
              BitvectorOneComplementDivision[2*N],
              BitvectorMultiplicationWidenNarrow[N]

    dvd, dvs, bv : VAR bvec[N]
    DVD, DVS, BV : VAR bvec[2*N]

  % First some additional results about one-complement division,
  % requiring parameter 2*N.

    DIVREM1_eq : LEMMA % :-)
      div(DVD, DVS) * DVS + rem(DVD, DVS) = DVD

    div1_cancel : LEMMA % :-)
      bv2nat(BV) * bv2nat(DVD) < exp2(2*N)
        AND
      bv2nat(BV) * bv2nat(DVS) < exp2(2*N)
        AND
      bv2nat(BV) /= 0
        IMPLIES
      div(BV * DVD, BV * DVS) = div(DVD, DVS)
        AND
      (bv2nat(DVS) /= 0 IMPLIES 
         rem(BV * DVD, BV * DVS) = BV * rem(DVD, DVS));

  %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  %
  % Definitions for 2-complement interpretation
  %
  %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

    /(dvd, dvs) : bvec[N] =
      IF bv2int[N](dvd) >= 0
      THEN IF bv2int[N](dvs) >= 0
           THEN div[N](dvd, dvs)
           ELSE -div[N](dvd, -dvs)
           ENDIF
      ELSE IF bv2int[N](dvs) >= 0
           THEN -div[N](-dvd, dvs)
           ELSE div[N](-dvd, -dvs)
           ENDIF
      ENDIF;

    //(dvd, dvs) : bvec[N] =
      IF bv2int[N](dvd) >= 0
      THEN IF bv2int[N](dvs) >= 0
           THEN rem[N](dvd, dvs)
           ELSE rem[N](dvd, -dvs)
           ENDIF
      ELSE IF bv2int[N](dvs) >= 0
           THEN -rem[N](-dvd, dvs)
           ELSE -rem[N](-dvd, -dvs)
           ENDIF
      ENDIF

  %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  %
  % Below the relevant texts from the Java Language Specification (2nd ed.)
  % are included. All the stated properties about divisition and remainder
  % are proven below (plus of few more, like divrem_widens).
  %
  %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%


  %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  %
  % JLS 15.17.2 Division Operator
  %
  % The binary / operator performs division, producing the quotient of its
  % operands. The left-hand operand is the dividend and the right-hand
  % operand is the divisor. Integer division rounds toward 0. That is, the
  % quotient produced for operands n and d that are integers after binary
  % numeric promotion (§5.6.2) is an integer value q whose magnitude is as
  % large as possible while satisfying |d * q| <= |n|; moreover, q is
  % positive when and n and d have the same sign, but q is negative when
  % and n and d have opposite signs. There is one special case that does
  % not satisfy this rule: if the dividend is the negative integer of
  % largest possible magnitude for its type, and the divisor is -1, then
  % integer overflow occurs and the result is equal to the
  % dividend. Despite the overflow, no exception is thrown in this
  % case. On the other hand, if the value of the divisor in an integer
  % division is 0, then an ArithmeticException is thrown. 
  %
  %
  % JLS 15.17.3 Remainder Operator 
  %
  % The binary % operator is said to yield the remainder of its operands
  % from an implied division; the left-hand operand is the dividend and
  % the right-hand operand is the divisor. In C and C++, the remainder
  % operator accepts only integral operands, but in the Java programming
  % language, it also accepts floating-point operands. The remainder
  % operation for operands that are integers after binary numeric
  % promotion (§5.6.2) produces a result value such that (a/b)*b+(a%b) is
  % equal to a. This identity holds even in the special case that the
  % dividend is the negative integer of largest possible magnitude for its
  % type and the divisor is -1 (the remainder is 0). It follows from this
  % rule that the result of the remainder operation can be negative only
  % if the dividend is negative, and can be positive only if the dividend
  % is positive; moreover, the magnitude of the result is always less than
  % the magnitude of the divisor. If the value of the divisor for an
  % integer remainder operator is 0, then an ArithmeticException is
  % thrown. 
  %
  % Examples: 
  %	5%3 produces 2 (note that 5/3 produces 1) 
  %	5%(-3) produces 2 (note that 5/(-3) produces -1) 
  %	(-5)%3 produces -2 (note that (-5)/3 produces -1) 
  %	(-5)%(-3) produces -2 (note that (-5)/(-3) produces 1) 
  %
  %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%


  %  div_minus_dvd : LEMMA
  %    (-dvd) / dvs = -(dvd / dvs)

    rem_dvs0 : LEMMA % :-)
      dvd // fill[N](FALSE) = dvd

    div_dvs0 : LEMMA % :-)
      dvd / fill[N](FALSE) = IF bv2int[N](dvd) >= 0
                             THEN fill[N](TRUE)  % -1
                             ELSE one[N]         % 1
                             ENDIF

    divrem_dvs1 : LEMMA % :-)
      dvd / one = dvd AND dvd // one = fill[N](FALSE)

    rem_below_dvs : LEMMA % :-)
      bv2int(dvs) /= 0
        IMPLIES
      abs(bv2int(dvd // dvs)) < abs(bv2int(dvs))

    divrem_eq : LEMMA % :-)
      NOT (bv2int(dvd) = -exp2(N-1) AND bv2int(dvs) = -1)
        IMPLIES
      bv2int[N](dvd / dvs) * bv2int[N](dvs) + bv2int[N](dvd // dvs) 
        = bv2int[N](dvd)

    divrem_overflow : LEMMA % :-)
      bv2int(dvd) = -exp2(N-1) AND bv2int(dvs) = -1
        IMPLIES
      bv2int[N](dvd / dvs) = -exp2(N-1) AND bv2int[N](dvd // dvs) = 0

    div_sgn : LEMMA % :-)
      NOT (bv2int(dvd) = -exp2(N-1) AND bv2int(dvs) = -1)
        AND
      bv2int(dvs) /= 0
        IMPLIES
      ((bv2int(dvd / dvs) > 0) = 
          ((bv2int(dvd) >= bv2int(dvs) AND bv2int(dvs) > 0)
           OR
           (bv2int(dvd) <= bv2int(dvs) AND bv2int(dvs) < 0)))
        AND
      ((bv2int(dvd / dvs) = 0) = 
          (abs(bv2int(dvd)) < abs(bv2int(dvs))))
        AND
      ((bv2int(dvd / dvs) < 0) = 
          ((bv2int(dvd) >= -bv2int(dvs) AND bv2int(dvs) < 0)
           OR
           (bv2int(dvd) <= -bv2int(dvs) AND bv2int(dvs) > 0)))

    rem_sgn : LEMMA % :-)
      ((bv2int(dvd) > 0) IMPLIES (bv2int(dvd // dvs) >= 0))
         AND
      ((bv2int(dvd) < 0) IMPLIES (bv2int(dvd // dvs) <= 0))

    divrem_uniqueness : LEMMA % :-)
      FORALL(q,r:int) : 
        (NOT (bv2int(dvd) = -exp2(N-1) AND bv2int(dvs) = -1))
          AND
        bv2int(dvs) /= 0
          AND
        ((q > 0) = 
          ((bv2int(dvd) >= bv2int(dvs) AND bv2int(dvs) > 0)
           OR
           (bv2int(dvd) <= bv2int(dvs) AND bv2int(dvs) < 0)))
          AND
        ((q = 0) = 
           (abs(bv2int(dvd)) < abs(bv2int(dvs))))
          AND
        ((q < 0) = 
           ((bv2int(dvd) >= -bv2int(dvs) AND bv2int(dvs) < 0)
            OR
            (bv2int(dvd) <= -bv2int(dvs) AND bv2int(dvs) > 0)))
          AND
        ((bv2int(dvd) > 0) IMPLIES (r >= 0))
          AND
        ((bv2int(dvd) < 0) IMPLIES (r <= 0))
          AND
        abs(r) < abs(bv2int(dvs)) 
          AND 
        q * bv2int(dvs) + r = bv2int(dvd)
          IMPLIES
        q = bv2int(dvd / dvs) AND r = bv2int(dvd // dvs)


  % from JLS: division ... is an integer value q whose magnitude is as
  % large as possible while satisfying |d * q| <= |n|

    div_largest : LEMMA % :-)
      FORALL(q:int) : 
        bv2int(dvs) /= 0
          AND
        abs(bv2int(dvs) * q) <= abs(bv2int(dvd)) 
          IMPLIES 
        abs(q) <= abs(bv2int(dvd/dvs))

  END BitvectorTwoComplementDivision

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 20, column 12) for
      % BitvectorOneComplementDivision[N]
      % generated from assumption BitvectorOneComplementDivision.N_size
  IMP_BitvectorOneComplementDivision_TCC1: OBLIGATION N >= 2;

  % Assuming TCC generated (at line 21, column 12) for
      % BitvectorOneComplementDivision[2 * N]
      % generated from assumption BitvectorOneComplementDivision.N_size
  IMP_BitvectorOneComplementDivision_TCC2: OBLIGATION 2 * N >= 2;

  % Subtype TCC generated (at line 155, column 29) for  N - 1
      % expected type  nat
  divrem_eq_TCC1: OBLIGATION N - 1 >= 0;


body:
  %
  %  BitvectorTwoComplementDivisionWidenNarrow
  %  =========================================
  %
  %  for Translating Java Classes into the Higher Order Logic of PVS.
  %
  %  All integral types are interpreted as PVS integers, without 
  %  taking bounds into account
  %
  %  Author: Bart Jacobs
  %  Integrated with the bitvector library by Sam Owre <owre@csl.sri.com>

  BitvectorTwoComplementDivisionWidenNarrow[N:posnat] : THEORY
  BEGIN

    ASSUMING
       N_size: ASSUMPTION N >= 2
    ENDASSUMING

    IMPORTING BitvectorTwoComplementDivision[N],
              BitvectorTwoComplementDivision[2*N]

    dvd, dvs, bv : VAR bvec[N]
    DVD, DVS, BV : VAR bvec[2*N]

    DIVREM_eq : LEMMA % :-)
      (DVD / DVS) * DVS + (DVD // DVS) = DVD

    divrem_widens : LEMMA % :-)
      NOT (bv2int(dvd) = -exp2(N-1) AND bv2int(dvs) = -1)
        IMPLIES
      widen(dvd) / widen(dvs) = widen(dvd / dvs)
        AND
      widen(dvd) // widen(dvs) = widen(dvd // dvs)

    div_cancel : LEMMA % :-)
     -exp2(2*N-1) < bv2int(BV) * bv2int(DVD) 
       AND 
      bv2int(BV) * bv2int(DVD) < exp2(2*N-1)
        AND
     -exp2(2*N-1) < bv2int(BV) * bv2int(DVS) 
       AND 
      bv2int(BV) * bv2int(DVS) < exp2(2*N-1)
        AND
      bv2int(BV) /= 0
        AND
      bv2int(DVS) /= 0
        AND
      NOT (bv2int(DVD) = -exp2(2 * N - 1) AND bv2int(DVS) = -1)
        IMPLIES
      (BV * DVD) / (BV * DVS) = DVD / DVS
        AND
      (BV * DVD) // (BV * DVS) = BV * (DVD // DVS)

  END BitvectorTwoComplementDivisionWidenNarrow

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 20, column 12) for
      % BitvectorTwoComplementDivision[N]
      % generated from assumption BitvectorTwoComplementDivision.N_size
  IMP_BitvectorTwoComplementDivision_TCC1: OBLIGATION N >= 2;

  % Assuming TCC generated (at line 21, column 12) for
      % BitvectorTwoComplementDivision[2 * N]
      % generated from assumption BitvectorTwoComplementDivision.N_size
  IMP_BitvectorTwoComplementDivision_TCC2: OBLIGATION 2 * N >= 2;

  % Subtype TCC generated (at line 30, column 29) for  N - 1
      % expected type  nat
  divrem_widens_TCC1: OBLIGATION N - 1 >= 0;

  % Subtype TCC generated (at line 37, column 9) for  2 * N - 1
      % expected type  nat
  div_cancel_TCC1: OBLIGATION 2 * N - 1 >= 0;


body:
  %
  %  JAVA BITVECTOR INTEGRALS
  %  ========================
  %
  %  for Translating Java Classes into the Higher Order Logic of PVS.
  %
  %  All integral types are interpreted as PVS integers, without 
  %  taking bounds into account
  %
  %  Author: Bart Jacobs
  %  Started: Wednesday 24 May 00 10:59:26 bart@frustratie
  %  Last-modified: $Date$
  %  Last-modified by: $Author$


  bv_mult_div_rem: THEORY
  BEGIN
    IMPORTING BitvectorUtil, BitvectorMultiplication,
              BitvectorMultiplicationWidenNarrow, DivisionUtil,
              BitvectorOneComplementDivision, BitvectorTwoComplementDivision,
              BitvectorTwoComplementDivisionWidenNarrow
   END bv_mult_div_rem


body:
  %------------------------------------------------------------------------
  %
  %  Top of finite sets theory   Version 2.2    5/22/97
  %  --------------------------------------------------------------
  %      Authors: Ricky W. Butler   NASA Langley Research Center
  %               Bruno Dutertre    Royal Holloway & Bedford New College
  %               Damir Jamsek      Odyssey Research Associates
  %               Sam Owre          SRI International
  %               David Griffioen   CWI and KUN (Catholic University 
  %                                 Nijmegen), the Netherlands.
  %   
  %      Index:
  %      ------
  %        finite_sets            -- main theory that is imported
  %                                  (provides basic type and cardinality)
  %        finite_sets_sum        -- summation over a set
  %        finite_sets_minmax     -- min and max over a set
  %        finite_sets_inductions -- induction schemes
  %        finite_sets_sum_real   -- additional properties for summations
  %                                  over real-valued functions
  %        finite_sets_int        -- special properties of integer sets
  %        finite_sets_nat        -- special properties of natural sets
  %        finite_sets_pred       -- lemmas involving predicate subtypes
  %        finite_sets_below      -- lemmas involving sets of below and upto
  %        finite_sets_eq         -- lemmas to show set is finite via mappings
  %        finite_sets_card_eq    -- equal cardinality of two dissimilar sets
  %        finite_sets_rules      -- experimental AUTO-REWRITE-THEORY rules
  %        finite_sets_minmax_props -- properties of min and max of finite sets
  %        finite_cross           -- cartesian product of finite sets is finite
  %        fs_constructors,       -- constructors for one, two, three element sets
  %        finite_sets_product,   -- product over finite sets
  %        finite_sets_product_real, -- product over finite sets of reals
  %        card_tricks,              -- more lemmas about card
  %        finite_sets_subtype_props

  %
  %  This theory was designed for making libraries and is not intended
  %  for importing.  One should directly import one of the above listed
  %  theories.
  %
  %------------------------------------------------------------------------
  top: THEORY
  BEGIN

    IMPORTING finite_sets, 
              finite_sets_sum, 
              finite_sets_minmax, 
              finite_sets_inductions,
              finite_sets_sum_real, 
              finite_sets_int, 
              finite_sets_nat, 
              finite_sets_pred,
              finite_sets_below, 
              finite_sets_card_eq, 
              finite_sets_eq,
              finite_sets_minmax_props, 
              finite_cross, 
              fs_constructors,
              finite_sets_product,
              finite_sets_product_real,
              card_tricks,
              finite_sets_subtype_props


  END top


body:
  card_tricks  [ T: TYPE, S: TYPE FROM T ] : THEORY
  %-------------------------------------------------------------------------------
  %
  %   AUTHOR: Ben Di Vito     NASA Langley
  %-------------------------------------------------------------------------------
  BEGIN

    U:   VAR set[S]
    V:   VAR set[T]
    A:   VAR finite_set[S]
    B:   VAR finite_set[T]
    m,n: VAR nat
    x,y: VAR T

    subtype_full?: LEMMA full?[(U)](U)

    subtype_fullset: LEMMA fullset[(U)] = U

    non_subtype_elements(V): set[T] =
        difference(V, extend[T, S, boolean, FALSE](fullset[S]))

    extend_restrict: LEMMA
        empty?(non_subtype_elements(V))
        IMPLIES extend[T, S, boolean, FALSE](restrict[T, S, boolean](V)) = V

    union_extend_restrict: LEMMA
        union(non_subtype_elements(V),
              extend[T, S, boolean, FALSE](restrict[T, S, boolean](V)))
        = V

    disjoint_extend_restrict: LEMMA
        disjoint?(non_subtype_elements(V),
                  extend[T, S, boolean, FALSE](restrict[T, S, boolean](V)))

    card_restrict_subtype: LEMMA
        empty?(non_subtype_elements(B))
        IMPLIES card(restrict[T, S, boolean](B)) = card(B)

    same_card_subset_extend: LEMMA
        subset?(extend[T, S, boolean, FALSE](A), B) AND card(A) = card(B) 
        IMPLIES extend[T, S, boolean, FALSE](A) = B

    card_restrict_plus: LEMMA
        card(non_subtype_elements(B)) + card(restrict[T, S, boolean](B))
        = card(B)

    card_restrict_less: LEMMA
        nonempty?(non_subtype_elements(B))
        IMPLIES card(restrict[T, S, boolean](B)) < card(B)


  END card_tricks

addendum:
  %%% ================ Addendum: generated declarations ================

  % Subtype TCC generated (at line 44, column 11) for  non_subtype_elements(B)
      % expected type  S: finite_set[T]
  card_restrict_plus_TCC1: OBLIGATION
    FORALL (B: finite_set[T]): is_finite[T](non_subtype_elements(B));


body:
  finite_sets_subtype_props  [ T1, T2: TYPE ] : THEORY
  %-------------------------------------------------------------------------------
  %
  %   AUTHOR: Ben Di Vito     NASA Langley
  %-------------------------------------------------------------------------------
  BEGIN

    IMPORTING card_tricks

    S: VAR set[T1]
    A: VAR finite_set[T1]
    B: VAR finite_set[T2]

    only_subtype_elements: LEMMA empty?(non_subtype_elements[T1, (A)](A)) AND
                                 empty?(non_subtype_elements[T2, (B)](B))

    same_card_inj_bij: LEMMA
        FORALL (f: [ (A) -> (B) ]):
     	  card(A) = card(B) AND injective?(f) IMPLIES bijective?(f)

  END finite_sets_subtype_props 


body:
  finite_sets_inductions[T: TYPE]: THEORY

  BEGIN

    IMPORTING finite_sets[T]

    S, S1, S2 : VAR finite_set
    SS,U : VAR non_empty_finite_set
    e : VAR T
    P : VAR pred[finite_set]
    Q : VAR pred[non_empty_finite_set]
    n : VAR nat

    cardinal_induction       : LEMMA (FORALL S : P(S)) IFF 
                                        (FORALL n, S : card(S) = n IMPLIES P(S)) 

    finite_set_induction     : THEOREM P(emptyset[T])
                                        AND (FORALL e,S: P(S) IMPLIES P(add(e,S)))
                                           IMPLIES (FORALL S: P(S))

    finite_set_ind_modified  : THEOREM  P(emptyset[T]) AND 
                               (FORALL e,S: NOT S(e) AND P(S) IMPLIES P(add(e,S)))
                                         IMPLIES (FORALL S: P(S))

    finite_set_induction_rest: THEOREM P(emptyset[T])
                                       AND (FORALL SS : P(rest(SS)) IMPLIES P(SS))
                                               IMPLIES (FORALL S : P(S))

    finite_set_induction_union: THEOREM P(emptyset[T])
                                        AND (FORALL e: P(singleton(e)))
                    AND (FORALL S1,S2: P(S1) AND P(S2) IMPLIES P(union(S1,S2)))
                                       IMPLIES (FORALL S: P(S))


    finite_set_induction_gen: THEOREM (FORALL S:
                                   (FORALL S2: card(S2) < card(S) IMPLIES P(S2))
                                                  IMPLIES P(S))
                                    IMPLIES (FORALL S: P(S))


  % -------- Induction rules for non empty sets ----------------


    nonempty_card_induction : LEMMA (FORALL U : Q(U)) IFF 
  	                      (FORALL S, n : n > 0 AND card(S) = n IMPLIES Q(S))

    nonempty_finite_set_induct : THEOREM (FORALL e : Q(singleton(e)))
         AND (FORALL e, U : Q(U) AND NOT U(e) IMPLIES Q(add(e, U)))
                                          IMPLIES (FORALL U : Q(U))

  END finite_sets_inductions

addendum:
  %%% ================ Addendum: generated declarations ================

  % Subtype TCC generated (at line 45, column 70) for  S
      % expected type  non_empty_finite_set[T]
  nonempty_card_induction_TCC1: OBLIGATION
    FORALL (S, n): n > 0 AND card(S) = n IMPLIES NOT empty?[T](S);


body:
  finite_sets_product[T, R: TYPE, one:R, *:[R,R -> R] ]: THEORY
  %----------------------------------------------------------------------
  %  
  %                                      ----
  %                                      |  |    
  %  sum(S: finite_set[T], f:[T->R]) =   |  |  f(i) 
  %                                      |  |
  %                                      member(i,S)
  %  
  %----------------------------------------------------------------------
  BEGIN

    ASSUMING
       r,r1,r2,r3 : VAR R
       one_identity: ASSUMPTION identity?(*)(one)
       mult_ac:       ASSUMPTION associative?(*) AND commutative?(*)
    ENDASSUMING

    mult_one_right: LEMMA r * one = r 
    mult_one_left : LEMMA one* r = r
    mult_assoc     : LEMMA (r1 * r2) * r3 = r1 * (r2 * r3) 
    mult_comm      : LEMMA r1 * r2 = r2 * r1

    IMPORTING finite_sets_inductions[T], sets_lemmas[T]

    f,g: VAR [T -> R]
    S, A, B: VAR finite_set
    x: VAR T

    product(S,f) : RECURSIVE R = 
      IF (empty?(S)) THEN one
      ELSE f(choose(S)) * product(rest(S),f)
      ENDIF MEASURE (LAMBDA S,f: card(S))

    product_emptyset  : THEOREM product(emptyset[T],f) = one

    product_singleton : THEOREM product(singleton(x),f) = f(x);

    product_x         : THEOREM (FORALL (x: (S)): 
                                product(S, f) = f(x) * product(remove(x, S), f))

    product_x1_x2     : LEMMA (FORALL (x1,x2: (S)): f(x1) * product(remove(x1,S),f) 
                                = f(x2) * product(remove(x2,S),f))

    product_add       : THEOREM product(add(x,S),f) 
                            = product(S,f) * IF member(x,S) THEN one ELSE f(x) ENDIF

    product_remove    : THEOREM product(remove(x,S),f) 
                            * IF member(x,S) THEN f(x) ELSE one ENDIF = product(S,f)

    product_rest      : THEOREM NOT empty?(S) IMPLIES
                              f(choose(S)) * product(rest(S),f) = product(S,f)
   
    product_disj_union: THEOREM disjoint?(A,B) IMPLIES 
                              product(union(A,B),f) = product(A,f) * product(B,f) 

    product_diff_subset: THEOREM subset?(A, B) IMPLIES 
  		            product(difference(B, A), f) * product(A, f) = product(B, f) 

    product_union      : THEOREM product(union(A,B),f) * product(intersection(A,B),f) 
                                   = product(A,f) * product(B,f) 

    product_diff_intersection: THEOREM product(A,f) = 
                              product(difference(A,B),f) * product(intersection(A,B),f) 

    product_f_g         : LEMMA (FORALL (x: (S)): f(x) = g(x)) 
                                 IMPLIES product(S, f) = product(S, g)

    product_particular  : THEOREM product(S,f) = product(S, f WITH [x := one])
  			       * IF S(x) THEN f(x) ELSE one ENDIF 

    product_distributive: THEOREM product(A,f) * product(A,g) = 
                                  product(A,(LAMBDA x: f(x) * g(x))) 

  END finite_sets_product

addendum:
  %%% ================ Addendum: generated declarations ================

  % Subtype TCC generated (at line 32, column 18) for  S
      % expected type  p: (nonempty?[T])
  product_TCC1: OBLIGATION
    FORALL (S: finite_set[T], f: [T -> R]):
      NOT (empty?(S)) IMPLIES nonempty?[T](S);

  % Termination TCC generated (at line 32, column 24) for  product(rest(S), f)
  product_TCC2: OBLIGATION
    FORALL (S: finite_set[T], f: [T -> R]):
      NOT (empty?(S)) IMPLIES card[T](rest[T](S)) < card[T](S);

  % Subtype TCC generated (at line 52, column 37) for  S
      % expected type  p: (nonempty?[T])
  product_rest_TCC1: OBLIGATION
    FORALL (S: finite_set[T]): NOT empty?(S) IMPLIES nonempty?[T](S);


body:
  finite_sets_product_real[T: TYPE]: THEORY
  %------------------------------------------------------------------------
  %
  % finite product over real-valued functions   
  %
  %   Authors: Ricky W. Butler
  %            David Griffioen
  %
  %   NOTES:
  %      -- there are several theorems which are virtually idential to
  %         theorems in finite_sets_product.  They are repeated here to prevent
  %         the need for commands such as (LEMMA product_emptyset[T,real,1,*])
  %      -- the theorems with names ending in "_rew" are especially useful
  %         for rewriting.  Some of these take advantage of the fact that
  %         since we have real-valued functions we have a "-" available.
  %------------------------------------------------------------------------
  BEGIN


    IMPORTING finite_sets_product[T,real,1,*]    %% prelude_aux

    S, A, B: VAR finite_set[T]
    t: VAR T
    c,N: VAR real
    cnz: VAR nzreal
    f,g: VAR function[T -> real]

    SS: VAR non_empty_finite_set[T]

    product_const        : THEOREM product(S, (LAMBDA t: c)) = c^card(S) 

    product_1_is_card    : COROLLARY product(S,(LAMBDA t: 1)) = 1

    product_mult         : THEOREM product(S,(LAMBDA t: c*f(t))) = c^card(S)*product(S,f) 


    product_eq_0        : THEOREM product(S,f) = 0 IMPLIES  
                                            (EXISTS (t:(S)): f(t) = 0)



  % ----------- Some rewrite rules using "-" ------------------

    product_empty?       : THEOREM empty?(S) IMPLIES product(S,f) = 1

    product_emptyset_rew : THEOREM S = emptyset[T] IMPLIES product(S,f) = 1

    product_singleton_rew: THEOREM card(S) = 1 AND S(t) IMPLIES product(S,f) = f(t)

    product_remove_rew   : THEOREM f(t) /= 0 IMPLIES 
                            product(remove(t,S),f) = product(S,f) /
                                  IF S(t) THEN f(t) ELSE 1 ENDIF 

    product_rest_rew     : THEOREM NOT empty?(S) AND f(choose(S)) /= 0 IMPLIES
                                  product(rest(S),f) = product(S,f) / f(choose(S))

    product_union_rew    : THEOREM product(union(A,B),f)*product(intersection(A,B),f) 
                                    = product(A,f) * product(B,f)

  % -------- products of slightly modified functions ----------

    product_eq_funs       : THEOREM (FORALL (t: (S)): f(t) = g(t)) 
                                 IMPLIES product(S, f) = product(S, g)

    product_particular_gen: THEOREM product(S,f) = product(S, f WITH [t := cnz])
  			       * IF S(t) THEN f(t)/cnz ELSE 1 ENDIF 


  % ----- some order relationships involving product -----

    product_nonneg   : LEMMA (FORALL (t: (S)): f(t) >= 0) IMPLIES product(S,f) >= 0

    product_pos      : LEMMA (FORALL (t: (S)): f(t) > 0) IMPLIES product(S,f) > 0 OR
                                                      S = emptyset[T]

    product_nz       : LEMMA (FORALL (t: (SS)): f(t) /= 0) IMPLIES product(SS,f) /= 0 

    product_posreal: JUDGEMENT product(A: non_empty_finite_set[T], f: [T -> posreal])
              HAS_TYPE posreal

    product_int: JUDGEMENT product(A: finite_set[T], f: [T -> int]) HAS_TYPE int

    product_nat: JUDGEMENT product(A: finite_set[T], f: [T -> nat]) HAS_TYPE nat

  % ----- Special properties non-negative valued functions -----

    fnr,gnr: VAR [T -> nonneg_real]

    Fnat:  VAR function[T -> nat]

    product_eq_1        : THEOREM product(S,Fnat) = 1 IMPLIES  
                                            (FORALL (t:(S)): Fnat(t) = 1)


  % ----- Special properties positive valued functions -----

  %  Fposnat: VAR [T -> posnat]
  %  product_subset   : THEOREM subset?(A,B) IMPLIES product(A,Fposnat) <= product(B,Fposnat)


    JUDGEMENT product(A: finite_set[T], f: [T -> nonneg_real])
              HAS_TYPE nonneg_real
    JUDGEMENT product(A: finite_set[T], f: [T -> nonneg_int]) HAS_TYPE nonneg_int
    JUDGEMENT product(A: non_empty_finite_set[T], f: [T->posnat]) HAS_TYPE posnat

  %  JUDGEMENT product(A: non_empty_finite_set[T], f: [T->negreal]) HAS_TYPE negreal
  %  JUDGEMENT product(A: finite_set[T], f: [T -> nonpos_real]) HAS_TYPE nonpos_real
  %  JUDGEMENT product(A: finite_set[T], f: [T -> negint]) HAS_TYPE negint

  END finite_sets_product_real

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 20, column 12) for
      % finite_sets_product
      %     [T, real, 1,
      %      restrict[[numfield, numfield], [real, real], numfield](*)]
      % generated from assumption finite_sets_product.one_identity
  IMP_finite_sets_product_TCC1: OBLIGATION
    identity?[real]
        (restrict[[numfield, numfield], [real, real], numfield](*))(1);

  % Assuming TCC generated (at line 20, column 12) for
      % finite_sets_product
      %     [T, real, 1,
      %      restrict[[numfield, numfield], [real, real], numfield](*)]
      % generated from assumption finite_sets_product.mult_ac
  IMP_finite_sets_product_TCC2: OBLIGATION
    associative?[real]
        (restrict[[numfield, numfield], [real, real], numfield](*))
     AND
     commutative?[real]
         (restrict[[numfield, numfield], [real, real], numfield](*));

  % Subtype TCC generated (at line 30, column 63) for  card(S)
      % expected type  {i: int | c /= 0 OR i >= 0}
  product_const_TCC1: OBLIGATION
    FORALL (S: finite_set[T], c: real): c /= 0 OR card[T](S) >= 0;

  % Subtype TCC generated (at line 54, column 60) for  S
      % expected type  p: (nonempty?[T])
  product_rest_rew_TCC1: OBLIGATION
    FORALL (S: finite_set[T]): NOT empty?(S) IMPLIES nonempty?[T](S);

  % Judgement subtype TCC generated (at line 78, column 29) for  product(A, f)
      % expected type  posreal
  product_posreal: OBLIGATION
    FORALL (A: non_empty_finite_set[T], f: [T -> posreal]):
      product
          [T, real, 1,
           restrict[[numfield, numfield], [real, real], numfield](*)]
          (A, f)
       >= 0
       AND
       product
           [T, real, 1,
            restrict[[numfield, numfield], [real, real], numfield](*)]
           (A, f)
        > 0;

  % Judgement subtype TCC generated (at line 81, column 25) for  product(A, f)
      % expected type  int
  product_int: OBLIGATION
    FORALL (A: finite_set[T], f: [T -> int]):
      rational_pred(product
                        [T, real, 1,
                         restrict
                             [[numfield, numfield], [real, real], numfield]
                             (*)]
                        (A, f))
       AND
       integer_pred(product
                        [T, real, 1,
                         restrict
                             [[numfield, numfield], [real, real], numfield]
                             (*)]
                        (A, f));

  % Judgement subtype TCC generated (at line 83, column 25) for  product(A, f)
      % expected type  nat
  product_nat: OBLIGATION
    FORALL (A: finite_set[T], f: [T -> nat]):
      product
          [T, real, 1,
           restrict[[numfield, numfield], [real, real], numfield](*)]
          (A, f)
       >= 0;

  % Judgement subtype TCC generated (at line 101, column 12) for  product(A, f)
      % expected type  nonneg_real
  product_TCC1: OBLIGATION
    FORALL (A: finite_set[T], f: [T -> nonneg_real]):
      product
          [T, real, 1,
           restrict[[numfield, numfield], [real, real], numfield](*)]
          (A, f)
       >= 0;

  % Judgement subtype TCC generated (at line 104, column 12) for  product(A, f)
      % expected type  posnat
  product_TCC2: OBLIGATION
    FORALL (A: non_empty_finite_set[T], f: [T -> posnat]):
      product
          [T, real, 1,
           restrict[[numfield, numfield], [real, real], numfield](*)]
          (A, f)
       > 0;


body:
  fs_constructors[T: TYPE]: THEORY
  BEGIN

    a1,a2,a3,a4,a5: VAR T

    fs(a1): non_empty_finite_set[T] = {t:T | t = a1}

    fs(a1,a2): non_empty_finite_set[T] = {t:T | t = a1 OR t = a2}

    fs(a1,a2,a3): non_empty_finite_set[T] = {t:T | t = a1 OR t = a2 OR t = a3}

    fs(a1,a2,a3,a4): non_empty_finite_set[T] = {t:T | t = a1 OR t = a2 OR t = a3 OR t = a4}

    fs(a1,a2,a3,a4,a5): non_empty_finite_set[T] 
       = {t:T | t = a1 OR t = a2 OR t = a3 OR t = a4 OR t = a5}


  END fs_constructors

addendum:
  %%% ================ Addendum: generated declarations ================

  % Subtype TCC generated (at line 6, column 36) for  {t: T | t = a1}
      % expected type  non_empty_finite_set[T]
  fs_TCC1: OBLIGATION
    FORALL (a1: T):
      is_finite[T]({t: T | t = a1}) AND NOT empty?[T]({t: T | t = a1});

  % Subtype TCC generated (at line 8, column 39) for
      % {t: T | t = a1 OR t = a2}
      % expected type  non_empty_finite_set[T]
  fs_TCC2: OBLIGATION
    FORALL (a1: T, a2: T):
      is_finite[T]({t: T | t = a1 OR t = a2}) AND
       NOT empty?[T]({t: T | t = a1 OR t = a2});

  % Subtype TCC generated (at line 10, column 42) for
      % {t: T | t = a1 OR t = a2 OR t = a3}
      % expected type  non_empty_finite_set[T]
  fs_TCC3: OBLIGATION
    FORALL (a1: T, a2: T, a3: T):
      is_finite[T]({t: T | t = a1 OR t = a2 OR t = a3}) AND
       NOT empty?[T]({t: T | t = a1 OR t = a2 OR t = a3});

  % Subtype TCC generated (at line 12, column 45) for
      % {t: T | t = a1 OR t = a2 OR t = a3 OR t = a4}
      % expected type  non_empty_finite_set[T]
  fs_TCC4: OBLIGATION
    FORALL (a1: T, a2: T, a3: T, a4: T):
      is_finite[T]({t: T | t = a1 OR t = a2 OR t = a3 OR t = a4}) AND
       NOT empty?[T]({t: T | t = a1 OR t = a2 OR t = a3 OR t = a4});

  % Subtype TCC generated (at line 15, column 7) for
      % {t: T |     t = a1 OR t = a2 OR t = a3 OR t = a4 OR t = a5}
      % expected type  non_empty_finite_set[T]
  fs_TCC5: OBLIGATION
    FORALL (a1: T, a2: T, a3: T, a4: T, a5: T):
      is_finite[T]
          ({t: T |     t = a1 OR t = a2 OR t = a3 OR t = a4 OR t = a5})
       AND
       NOT empty?[T]
               ({t: T |     t = a1 OR t = a2 OR t = a3 OR t = a4 OR t = a5});


body:
  % proof that the cartesian product of two finite sets is finite
  %
  % Author: Alfons Geser, National Institute of Aerospace

  finite_cross[T1, T2: TYPE]: THEORY

  BEGIN

    X: VAR set[T1]
    Y: VAR set[T2]

    is_finite_cross: LEMMA is_finite_type[T1] AND is_finite_type[T2] 
                              IMPLIES is_finite_type[[T1,T2]]

  END finite_cross


body:
  finite_sets_minmax[T: TYPE, <= : (total_order?[T])]: THEORY
  BEGIN

    IMPORTING  finite_sets_inductions[T]

    fsmin(x,y:T): T = IF x <= y THEN x ELSE y ENDIF
    fsmax(x,y:T): T = IF x <= y THEN y ELSE x ENDIF

    a,x,y: VAR T
    SS: VAR non_empty_finite_set

    minrec(SS): RECURSIVE T = 
                  IF empty?(rest(SS)) THEN choose(SS)
                  ELSE fsmin(choose(SS),minrec(rest(SS)))
                  ENDIF
                MEASURE (LAMBDA SS: card(SS))

    maxrec(SS): RECURSIVE T = 
                  IF empty?(rest(SS)) THEN choose(SS)
                  ELSE fsmax(choose(SS),maxrec(rest(SS)))
                  ENDIF
                MEASURE (LAMBDA SS: card(SS))

    lt_reflexive:     LEMMA FORALL (x: T): <=(x, x)
    lt_transitive:    LEMMA FORALL (x,y,z:T): <=(x, y) & <=(y, z) => <=(x, z)
    lt_total:         LEMMA FORALL (x,y:T) : x <= y OR y <= x
    lt_antisymmetric: LEMMA FORALL (x,y: T): <=(x, y) & <=(y, x) => x = y

    min(SS): {a: T | SS(a) AND (FORALL (x: T): SS(x) IMPLIES a <= x)}
    max(SS): {a: T | SS(a) AND (FORALL (x: T): SS(x) IMPLIES x <= a)}
   

    min_lem: LEMMA (min(SS) = a IFF
                    SS(a) AND (FORALL (x: (SS)): a <= x))

    max_lem: LEMMA (max(SS) = a IFF
                    SS(a) AND (FORALL (x: (SS)): x <= a))

    A,B:   VAR non_empty_finite_set

    min_union: LEMMA min(A) = x AND min(B) = y IMPLIES
                        min(union(A,B)) = fsmin(x,y)

    max_union: LEMMA max(A) = x AND max(B) = y IMPLIES
                        max(union(A,B)) = fsmax(x,y)


  END finite_sets_minmax

addendum:
  %%% ================ Addendum: generated declarations ================

  % Termination TCC generated (at line 14, column 38) for  minrec(rest(SS))
  minrec_TCC1: OBLIGATION
    FORALL (SS: non_empty_finite_set[T]):
      NOT empty?(rest(SS)) IMPLIES card[T](rest[T](SS)) < card[T](SS);

  % Existence TCC generated (at line 29, column 2) for
      % min(SS): {a: T | SS(a) AND (FORALL (x: T): SS(x) IMPLIES a <= x)}
  min_TCC1: OBLIGATION
    EXISTS (x1:
              [SS: non_empty_finite_set[T] ->
                 {a: T | SS(a) AND (FORALL (x: T): SS(x) IMPLIES a <= x)}]):
      TRUE;

  % Existence TCC generated (at line 30, column 2) for
      % max(SS): {a: T | SS(a) AND (FORALL (x: T): SS(x) IMPLIES x <= a)}
  max_TCC1: OBLIGATION
    EXISTS (x1:
              [SS: non_empty_finite_set[T] ->
                 {a: T | SS(a) AND (FORALL (x: T): SS(x) IMPLIES x <= a)}]):
      TRUE;


body:
  finite_sets_minmax_props[T: TYPE, <= : (total_order?[T])]: THEORY
  %----------------------------------------------------------------------------
  % Some useful properties about min and max of finite sets
  %
  % Author : Alfons Geser, National Institute of Aerospace
  % Date   : Aug 26, 2003
  %----------------------------------------------------------------------------
  BEGIN

    IMPORTING finite_sets_minmax[T,<=]

    a,x,y: VAR T
    SS: VAR non_empty_finite_set

    max_le: LEMMA max(SS) <= a IFF (FORALL (x: T): SS(x) => x <= a)

    le_max: LEMMA a <= max(SS) IFF (EXISTS (x: T): SS(x) & a <= x)

  END finite_sets_minmax_props


body:
  func_composition  [ T1, T2, T3 : TYPE ] : THEORY
  %------------------------------------------------------------------------
  %      Author:  Bruno Dutertre 
  %
  %      Composition of injective, surjective, bijective functions
  %------------------------------------------------------------------------

    BEGIN

    f1 : VAR [T1 -> T2]
    f2 : VAR [T2 -> T3]

    composition_injective : LEMMA injective?(f1) AND injective?(f2) 
                                     IMPLIES injective?(f2 o f1)

    composition_surjective: LEMMA surjective?(f1) AND surjective?(f2) 
                                     IMPLIES surjective?(f2 o f1)

    composition_bijective : LEMMA bijective?(f1) AND bijective?(f2) 
                                     IMPLIES bijective?(f2 o f1)

    %  ---------------- Cancellation laws ----------------

    f, g : VAR [T1 -> T2]
    h, k : VAR [T2 -> T3]

    composition_def          : LEMMA (FORALL (x : T1) : h(f(x)) = (h o f)(x))
    
    composition_left_cancel1 : LEMMA injective?(h)  
                                        IMPLIES  (h o f = h o g IFF f = g)
    
    composition_left_cancel2 : LEMMA bijective?(h)  
                                        IMPLIES  (h o f = h o g IFF f = g)

   
    composition_right_cancel1: LEMMA surjective?(f)  
                                        IMPLIES  (h o f = k o f IFF h = k)
    
    composition_right_cancel2: LEMMA bijective?(f) 
                                        IMPLIES  (h o f = k o f IFF h = k)

  END func_composition


body:
  finite_sets_eq[T1, T2 : TYPE] : THEORY
  %-------------------------------------------------------------------------
  %
  %      by Bruno Dutertre    Royal Holloway & Bedford New College
  % 
  %      Equipotence of finite sets  
  %
  %-------------------------------------------------------------------------

  BEGIN


    N: VAR nat

    IMPORTING finite_sets, func_composition

    E: VAR finite_set[T1]
    F: VAR finite_set[T2]

    S: VAR set[T1]
    U: VAR set[T2]

    injection_to_finite_set    : LEMMA
          (EXISTS (f: [(S)->(F)]): injective?(f)) IMPLIES is_finite(S)

    surjection_from_finite_set : LEMMA
          (EXISTS (f: [(E)->(U)]): surjective?(f)) IMPLIES is_finite(U)

    injection_to_finite_set2   : LEMMA
          (FORALL S, F, (f: [(S)->(F)]): injective?(f) IMPLIES is_finite(S))

    surjection_from_finite_set2: LEMMA
          (FORALL E, U, (f: [(E)->(U)]): surjective?(f) IMPLIES is_finite(U))

    bijection_finite_set1      : LEMMA
          (EXISTS (f: [(S)->(F)]): bijective?(f)) IMPLIES is_finite(S)

    bijection_finite_set2      : LEMMA
          (EXISTS (f: [(E)->(U)]): bijective?(f)) IMPLIES is_finite(U)

  END finite_sets_eq


body:
  finite_sets_card_eq[T1, T2 : TYPE] : THEORY
  %-------------------------------------------------------------------------
  %
  %      by Bruno Dutertre    Royal Holloway & Bedford New College
  % 
  % Establishes:
  %
  %       card_eq_bij : LEMMA card(E) = card(F) IFF 
  %                                  EXISTS (f: [(E)->(F)]): bijective?(f)
  %
  %-------------------------------------------------------------------------

  BEGIN

    IMPORTING finite_sets, func_composition

    E: VAR finite_set[T1]
    F: VAR finite_set[T2]

    N: VAR nat
    card_injection         : LEMMA (EXISTS (f : [(E)->below[N]]) : injective?(f)) 
                                       IMPLIES card(E) <= N
    
    card_surjection        : LEMMA (EXISTS (f : [(E)->below[N]]) : surjective?(f)) 
                                       IMPLIES N <= card(E) 
    

    injection_and_cardinal : LEMMA (EXISTS (f : [(E)->(F)]): injective?(f))
                                              IMPLIES card(E) <= card(F)

    surjection_and_cardinal: LEMMA (EXISTS (f: [(E)->(F)]): surjective?(f))
                                              IMPLIES card(F) <= card(E)

    card_eq_bij            : LEMMA card(E) = card(F) IFF 
                                            EXISTS (f: [(E)->(F)]): bijective?(f)

  END finite_sets_card_eq


body:
  finite_sets_below[N: nat]: THEORY
  BEGIN

    IMPORTING finite_sets

    A,B,BS: VAR set[below(N)]
    US: VAR set[upto(N)]

    finite_below      : LEMMA is_finite[below(N)](BS)

    card_below_fullset: LEMMA card[below(N)](fullset[below(N)]) = N

    card_below        : LEMMA card[below(N)](BS) <= N

    finite_upto       : LEMMA is_finite[upto(N)](US)

    card_upto_fullset : LEMMA card[upto(N)](fullset[upto(N)]) = N + 1

    card_upto         : LEMMA card[upto(N)](US) <= N + 1

    k: VAR nat
    pidgeon_hole      : LEMMA card(A) + card(B) >= N + k IMPLIES 
                                  card(intersection(A,B)) >= k


  END finite_sets_below

addendum:
  %%% ================ Addendum: generated declarations ================

  % Subtype TCC generated (at line 11, column 43) for  fullset[below(N)]
      % expected type  S: finite_set[below(N)]
  card_below_fullset_TCC1: OBLIGATION is_finite[below(N)](fullset[below(N)]);

  % Subtype TCC generated (at line 13, column 43) for  BS
      % expected type  S: finite_set[below(N)]
  card_below_TCC1: OBLIGATION
    FORALL (BS: set[below(N)]): is_finite[below(N)](BS);

  % Subtype TCC generated (at line 17, column 42) for  fullset[upto(N)]
      % expected type  S: finite_set[upto(N)]
  card_upto_fullset_TCC1: OBLIGATION is_finite[upto(N)](fullset[upto(N)]);

  % Subtype TCC generated (at line 19, column 42) for  US
      % expected type  S: finite_set[upto(N)]
  card_upto_TCC1: OBLIGATION
    FORALL (US: set[upto(N)]): is_finite[upto(N)](US);

  % Subtype TCC generated (at line 23, column 37) for  intersection(A, B)
      % expected type  S: finite_set[below(N)]
  pidgeon_hole_TCC1: OBLIGATION
    FORALL (A, B: set[below(N)], k: nat):
      card(A) + card(B) >= N + k IMPLIES
       is_finite[below(N)](intersection[below(N)](A, B));


body:
  finite_sets_pred[T: TYPE]: THEORY
  BEGIN

    IMPORTING finite_sets

    P, P1, P2: VAR pred[T]

    finite_pred: LEMMA is_finite(fullset[T]) IMPLIES
                          is_finite[T]({x: T | P(x)})


    card_implies: LEMMA is_finite(fullset[T]) AND
                        (FORALL (x: T): P1(x) IMPLIES P2(x)) 
               IMPLIES card({x: T | P1(x)}) <= card({x: T | P2(x)})

  END finite_sets_pred

addendum:
  %%% ================ Addendum: generated declarations ================

  % Subtype TCC generated (at line 14, column 26) for  {x: T | P1(x)}
      % expected type  S: finite_set[T]
  card_implies_TCC1: OBLIGATION
    FORALL (P1, P2: pred[T]):
      (FORALL (x: T): P1(x) IMPLIES P2(x)) AND is_finite(fullset[T]) IMPLIES
       is_finite[T]({x: T | P1(x)});

  % Subtype TCC generated (at line 14, column 50) for  {x: T | P2(x)}
      % expected type  S: finite_set[T]
  card_implies_TCC2: OBLIGATION
    FORALL (P1, P2: pred[T]):
      (FORALL (x: T): P1(x) IMPLIES P2(x)) AND is_finite(fullset[T]) IMPLIES
       is_finite[T]({x: T | P2(x)});


body:
  finite_sets_nat: THEORY
   BEGIN
    IMPORTING finite_sets[nat]

    n, N: VAR nat
    i, j: VAR nat
    p: VAR pred[nat]

    finite_bounded       : LEMMA is_finite({j: nat | j < N })

    card_bounded         : LEMMA card({j: nat | j < N}) = N    

    finite_bounded_subset: LEMMA is_finite({j: nat | j < N AND p(j)})

    card_bounded_subset  : LEMMA card({j: nat | j < N AND p(j)}) <= N

  % ------------------------------------------------------------------------
  % The following lemmas apply is_finite[nat] and card[nat] to subtype
  % sets.  This should be avoided if possible.  See finite_subint for
  % preferred lemmas.
  % ------------------------------------------------------------------------

    finite_nat_below   : LEMMA is_finite[nat]({x: below(n) | TRUE})

    card_nat_below     : LEMMA card[nat]({x: below(n) | TRUE}) = n

    finite_nat_upto    : LEMMA is_finite[nat]({x: upto(n) | TRUE})

    card_nat_upto      : LEMMA card[nat]({x: upto(n) | TRUE}) = n + 1

    finite_nat_subrange: LEMMA
        is_finite[nat](restrict[int, nat, bool]({x: subrange(i, j) | TRUE}))

    card_nat_subrange  : LEMMA
        card[nat](restrict[int, nat, bool]({x: subrange(i, j) | TRUE})) =
                                 IF i <= j THEN j - i + 1 ELSE 0 ENDIF


  END finite_sets_nat

addendum:
  %%% ================ Addendum: generated declarations ================

  % Subtype TCC generated (at line 11, column 36) for  {j: nat | j < N}
      % expected type  S: finite_set[nat]
  card_bounded_TCC1: OBLIGATION
    FORALL (N: nat): is_finite[nat]({j: nat | j < N});

  % Subtype TCC generated (at line 15, column 36) for
      % {j: nat | j < N AND p(j)}
      % expected type  S: finite_set[nat]
  card_bounded_subset_TCC1: OBLIGATION
    FORALL (N: nat, p: pred[nat]): is_finite[nat]({j: nat | j < N AND p(j)});

  % Subtype TCC generated (at line 25, column 39) for
      % extend[nat, below(n), bool, FALSE]({x: below(n) | TRUE})
      % expected type  S: finite_set[nat]
  card_nat_below_TCC1: OBLIGATION
    FORALL (n: nat):
      is_finite[nat]
          (extend[nat, below(n), bool, FALSE]({x: below(n) | TRUE}));

  % Subtype TCC generated (at line 29, column 39) for
      % extend[nat, upto(n), bool, FALSE]({x: upto(n) | TRUE})
      % expected type  S: finite_set[nat]
  card_nat_upto_TCC1: OBLIGATION
    FORALL (n: nat):
      is_finite[nat](extend[nat, upto(n), bool, FALSE]({x: upto(n) | TRUE}));

  % Subtype TCC generated (at line 35, column 16) for
      % restrict[int, nat, bool]
      %     (extend[int, subrange(i, j), bool, FALSE]
      %          ({x: subrange(i, j) | TRUE}))
      % expected type  S: finite_set[nat]
  card_nat_subrange_TCC1: OBLIGATION
    FORALL (i, j: nat):
      is_finite[nat]
          (restrict[int, nat, bool]
               (extend[int, subrange(i, j), bool, FALSE]
                    ({x: subrange(i, j) | TRUE})));


body:
  finite_sets_int: THEORY
   BEGIN
    IMPORTING finite_sets[int]

    i, j, x: VAR int

    p: VAR pred[int]

    in_subrng(x,i,j): bool = (i <= x) AND (x <= j)

    finite_subrng       : LEMMA is_finite({x | in_subrng(x,i,j)})

    finite_subrng_subset: LEMMA is_finite({x | in_subrng(x,i,j) AND p(x)})

    card_subrng         : LEMMA card({x | in_subrng(x,i,j)}) =
                                    IF i <= j THEN abs(j-i+1) ELSE 0 ENDIF


  % ------------------------------------------------------------------------
  % The following lemmas apply is_finite[nat] and card[nat] to subtype
  % sets.  This should be avoided if possible.  See finite_subint for
  % preferred lemmas.
  % ------------------------------------------------------------------------

    finite_int_subrange     : LEMMA is_finite[int]({x: subrange(i, j) | TRUE})

    finite_int_subrange_pred: LEMMA is_finite[int]({x: subrange(i, j) | p(x)})

    card_int_subrange       : LEMMA card[int]({x: subrange(i, j) | TRUE}) =
                                      IF i <= j THEN abs(j-i+1) ELSE 0 ENDIF

  END finite_sets_int

addendum:
  %%% ================ Addendum: generated declarations ================

  % Subtype TCC generated (at line 15, column 35) for
      % {x | in_subrng(x, i, j)}
      % expected type  S: finite_set[int]
  card_subrng_TCC1: OBLIGATION
    FORALL (i, j: int): is_finite[int]({x | in_subrng(x, i, j)});

  % Subtype TCC generated (at line 29, column 44) for
      % extend[int, subrange(i, j), bool, FALSE]({x: subrange(i, j) | TRUE})
      % expected type  S: finite_set[int]
  card_int_subrange_TCC1: OBLIGATION
    FORALL (i, j: int):
      is_finite[int]
          (extend[int, subrange(i, j), bool, FALSE]
               ({x: subrange(i, j) | TRUE}));


body:
  prelude_aux[T: TYPE]: THEORY

  BEGIN

    % these lemmas should go in prelude

    rest_emptyset: LEMMA (FORALL (S: set[T], t:T): rest(S) = emptyset[T]
                             AND S(t) IMPLIES choose(S) = t)


  END prelude_aux

addendum:
  %%% ================ Addendum: generated declarations ================

  % Subtype TCC generated (at line 8, column 51) for  S
      % expected type  p: (nonempty?[T])
  rest_emptyset_TCC1: OBLIGATION
    FORALL (S: set[T], t: T):
      rest(S) = emptyset[T] AND S(t) IMPLIES nonempty?[T](S);


body:
  finite_sets_sum[T, R: TYPE, zero:R, +:[R,R -> R] ]: THEORY
  %----------------------------------------------------------------------
  %  
  %                                              ----
  %                                              \     
  %  sum(S: finite_set[T], f:[T->R]) = zero +       f(i) 
  %                                              /
  %                                              ----
  %                                              member(i,S)
  %  
  %----------------------------------------------------------------------
  BEGIN

    ASSUMING
       r,r1,r2,r3 : VAR R
       zero_identity: ASSUMPTION identity?(+)(zero)
       plus_ac:       ASSUMPTION associative?(+) AND commutative?(+)
    ENDASSUMING

    plus_zero_right: LEMMA r + zero = r 
    plus_zero_left : LEMMA zero + r = r
    plus_assoc     : LEMMA (r1 + r2) + r3 = r1 + (r2 + r3) 
    plus_comm      : LEMMA r1 + r2 = r2 + r1

    IMPORTING finite_sets[T], finite_sets_inductions[T], sets_lemmas[T]

    f,g: VAR [T -> R]
    S, A, B: VAR finite_set
    x: VAR T

    sum(S,f) : RECURSIVE R = 
      IF (empty?(S)) THEN zero
      ELSE f(choose(S)) + sum(rest(S),f)
      ENDIF MEASURE (LAMBDA S,f: card(S))

    sum_emptyset  : THEOREM sum(emptyset[T],f) = zero

    sum_singleton : THEOREM sum(singleton(x),f) = f(x) + zero ;

    sum_x         : THEOREM (FORALL (x: (S)): 
                                sum(S, f) = f(x) + sum(remove(x, S), f))

    sum_x1_x2     : LEMMA (FORALL (x1,x2: (S)): f(x1) + sum(remove(x1,S),f) 
                                = f(x2) + sum(remove(x2,S),f))

    sum_add       : THEOREM sum(add(x,S),f) 
                            = sum(S,f) + IF member(x,S) THEN zero ELSE f(x) ENDIF

    sum_remove    : THEOREM sum(remove(x,S),f) 
                            + IF member(x,S) THEN f(x) ELSE zero ENDIF = sum(S,f)

    sum_rest      : THEOREM NOT empty?(S) IMPLIES
                              f(choose(S)) + sum(rest(S),f) = sum(S,f)
   
    sum_disj_union: THEOREM disjoint?(A,B) IMPLIES 
                              sum(union(A,B),f) = sum(A,f) + sum(B,f) 

    sum_diff_subset: THEOREM subset?(A, B) IMPLIES 
  		            sum(difference(B, A), f) + sum(A, f) = sum(B, f) 

    sum_union      : THEOREM sum(union(A,B),f) + sum(intersection(A,B),f) =
                                           sum(A,f) + sum(B,f) 

    sum_diff_intersection: THEOREM sum(A,f) = 
                              sum(difference(A,B),f) + sum(intersection(A,B),f) 

    sum_f_g         : LEMMA (FORALL (x: (S)): f(x) = g(x)) 
                                 IMPLIES sum(S, f) = sum(S, g)

    sum_particular  : THEOREM sum(S,f) = sum(S, f WITH [x := zero])
  			       + IF S(x) THEN f(x) ELSE zero ENDIF 

    sum_distributive: THEOREM sum(A,f) + sum(A,g) = 
                                  sum(A,(LAMBDA x: f(x) + g(x))) 

  END finite_sets_sum

addendum:
  %%% ================ Addendum: generated declarations ================

  % Subtype TCC generated (at line 33, column 18) for  S
      % expected type  p: (nonempty?[T])
  sum_TCC1: OBLIGATION
    FORALL (S: finite_set[T], f: [T -> R]):
      NOT (empty?(S)) IMPLIES nonempty?[T](S);

  % Termination TCC generated (at line 33, column 24) for  sum(rest(S), f)
  sum_TCC2: OBLIGATION
    FORALL (S: finite_set[T], f: [T -> R]):
      NOT (empty?(S)) IMPLIES card[T](rest[T](S)) < card[T](S);

  % Subtype TCC generated (at line 53, column 37) for  S
      % expected type  p: (nonempty?[T])
  sum_rest_TCC1: OBLIGATION
    FORALL (S: finite_set[T]): NOT empty?(S) IMPLIES nonempty?[T](S);


body:
  finite_sets_sum_real[T: TYPE]: THEORY
  %------------------------------------------------------------------------
  %
  % finite sum over real-valued functions   
  %
  %   Authors: Ricky W. Butler
  %            David Griffioen
  %
  %   NOTES:
  %      -- there are several theorems which are virtually idential to
  %         theorems in finite_sets_sum.  They are repeated here to prevent
  %         the need for commands such as (LEMMA sum_emptyset[T,real,0,+])
  %      -- the theorems with names ending in "_rew" are especially useful
  %         for rewriting.  Some of these take advantage of the fact that
  %         since we have real-valued functions we have a "-" available.
  %------------------------------------------------------------------------
  BEGIN


    IMPORTING finite_sets_sum[T,real,0,+], prelude_aux

    S, A, B: VAR finite_set[T]
    t: VAR T
    c,N: VAR real
    f,g: VAR function[T -> real]

    sum_const        : THEOREM sum(S, (LAMBDA t: c)) = c*card(S) 

    sum_1_is_card    : COROLLARY sum(S,(LAMBDA t: 1)) = card(S)

    sum_mult         : THEOREM sum(S,(LAMBDA t: c*f(t))) = c*sum(S,f) 

  % ----------- Some rewrite rules using "-" ------------------

    sum_empty?       : THEOREM empty?(S) IMPLIES sum(S,f) = 0

    sum_emptyset_rew : THEOREM S = emptyset[T] IMPLIES sum(S,f) = 0

    sum_singleton_rew: THEOREM card(S) = 1 AND S(t) IMPLIES sum(S,f) = f(t)

    sum_remove_rew   : THEOREM sum(remove(t,S),f) = sum(S,f) -
                                  IF member(t,S) THEN f(t) ELSE 0 ENDIF 


    sum_rest_rew     : THEOREM NOT empty?(S) IMPLIES
                                  sum(rest(S),f) = sum(S,f) - f(choose(S))

    sum_union_rew    : THEOREM sum(union(A,B),f) = sum(A,f) + sum(B,f)
                                   - sum(intersection(A,B),f) 


  % -------- sums of slightly modified functions ----------

    sum_eq_funs       : THEOREM (FORALL (t: (S)): f(t) = g(t)) 
                                 IMPLIES sum(S, f) = sum(S, g)

    sum_particular_gen: THEOREM sum(S,f) = sum(S, f WITH [t := c])
  			       + IF S(t) THEN f(t) - c ELSE 0 ENDIF 


  % ----- some order relationships involving sum -----

    sum_bound    : THEOREM (FORALL (t: (S)): f(t) <= N) 
                               IMPLIES sum(S,f) <= N*card(S)

    sum_order    : THEOREM (FORALL (t:T): f(t) <= g(t)) IMPLIES
                             sum(S,f) <= sum(S,g)

    sum_nonneg   : LEMMA (FORALL (t: (S)): f(t) >= 0) IMPLIES sum(S,f) >= 0

    sum_pos      : LEMMA (FORALL (t: (S)): f(t) > 0) IMPLIES sum(S,f) > 0 OR
                                                      S = emptyset[T]

    JUDGEMENT sum(A: non_empty_finite_set[T], f: [T -> posreal])
              HAS_TYPE posreal

    JUDGEMENT sum(A: finite_set[T], f: [T -> int]) HAS_TYPE int

    JUDGEMENT sum(A: finite_set[T], f: [T -> nat]) HAS_TYPE nat

  % ----- Special properties non-negative valued functions -----

    fnr,gnr: VAR [T -> nonneg_real]

    sum_subset   : THEOREM subset?(A,B) IMPLIES sum(A,fnr) <= sum(B,fnr)

    sum_order_sub: THEOREM subset?(A,B) AND (FORALL (t:T): fnr(t) <= gnr(t))
                             IMPLIES sum(A,fnr) <= sum(B,gnr)

    gn:  VAR function[T -> nat]
    gi:  VAR function[T -> nonneg_int]

    sum_0_nat       : THEOREM sum(S,gn) = 0 IMPLIES  S = emptyset[T] OR
                                            (FORALL (t:(S)): gn(t) = 0)

    sum_is_null     : COROLLARY sum(S,gn) = 0 => (S(t) => gn(t) = 0)

    sum_0_int       : THEOREM sum(S,gi) = 0 IMPLIES S = emptyset[T]
                                                 OR (FORALL (t:(S)): gi(t) = 0)

    sum_0_non_neg   : THEOREM sum(S,f) = 0 AND (FORALL (t: (S)): f(t) >= 0) 
                               IMPLIES S = emptyset[T] 
                                        OR (FORALL (t:(S)): f(t) = 0)

    JUDGEMENT sum(A: finite_set[T], f: [T -> nonneg_real])
              HAS_TYPE nonneg_real
    JUDGEMENT sum(A: finite_set[T], f: [T -> nonneg_int]) HAS_TYPE nonneg_int
    JUDGEMENT sum(A: non_empty_finite_set[T], f: [T->posnat]) HAS_TYPE posnat

  %  JUDGEMENT sum(A: non_empty_finite_set[T], f: [T->negreal]) HAS_TYPE negreal
  %  JUDGEMENT sum(A: finite_set[T], f: [T -> nonpos_real]) HAS_TYPE nonpos_real
  %  JUDGEMENT sum(A: finite_set[T], f: [T -> negint]) HAS_TYPE negint

  END finite_sets_sum_real

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 20, column 12) for
      % finite_sets_sum
      %     [T, real, 0,
      %      restrict[[numfield, numfield], [real, real], numfield](+)]
      % generated from assumption finite_sets_sum.zero_identity
  IMP_finite_sets_sum_TCC1: OBLIGATION
    identity?[real]
        (restrict[[numfield, numfield], [real, real], numfield](+))(0);

  % Assuming TCC generated (at line 20, column 12) for
      % finite_sets_sum
      %     [T, real, 0,
      %      restrict[[numfield, numfield], [real, real], numfield](+)]
      % generated from assumption finite_sets_sum.plus_ac
  IMP_finite_sets_sum_TCC2: OBLIGATION
    associative?[real]
        (restrict[[numfield, numfield], [real, real], numfield](+))
     AND
     commutative?[real]
         (restrict[[numfield, numfield], [real, real], numfield](+));

  % Subtype TCC generated (at line 46, column 69) for  S
      % expected type  p: (nonempty?[T])
  sum_rest_rew_TCC1: OBLIGATION
    FORALL (S: finite_set[T]): NOT empty?(S) IMPLIES nonempty?[T](S);

  % Judgement subtype TCC generated (at line 74, column 12) for  sum(A, f)
      % expected type  posreal
  sum_TCC1: OBLIGATION
    FORALL (A: non_empty_finite_set[T], f: [T -> posreal]):
      sum
          [T, real, 0,
           restrict[[numfield, numfield], [real, real], numfield](+)]
          (A, f)
       >= 0
       AND
       sum
           [T, real, 0,
            restrict[[numfield, numfield], [real, real], numfield](+)]
           (A, f)
        > 0;

  % Judgement subtype TCC generated (at line 77, column 12) for  sum(A, f)
      % expected type  int
  sum_TCC2: OBLIGATION
    FORALL (A: finite_set[T], f: [T -> int]):
      rational_pred(sum
                        [T, real, 0,
                         restrict
                             [[numfield, numfield], [real, real], numfield]
                             (+)]
                        (A, f))
       AND
       integer_pred(sum
                        [T, real, 0,
                         restrict
                             [[numfield, numfield], [real, real], numfield]
                             (+)]
                        (A, f));

  % Judgement subtype TCC generated (at line 79, column 12) for  sum(A, f)
      % expected type  nat
  sum_TCC3: OBLIGATION
    FORALL (A: finite_set[T], f: [T -> nat]):
      sum
          [T, real, 0,
           restrict[[numfield, numfield], [real, real], numfield](+)]
          (A, f)
       >= 0;

  % Judgement subtype TCC generated (at line 105, column 12) for  sum(A, f)
      % expected type  nonneg_real
  sum_TCC4: OBLIGATION
    FORALL (A: finite_set[T], f: [T -> nonneg_real]):
      sum
          [T, real, 0,
           restrict[[numfield, numfield], [real, real], numfield](+)]
          (A, f)
       >= 0;

  % Judgement subtype TCC generated (at line 108, column 12) for  sum(A, f)
      % expected type  posnat
  sum_TCC5: OBLIGATION
    FORALL (A: non_empty_finite_set[T], f: [T -> posnat]):
      sum
          [T, real, 0,
           restrict[[numfield, numfield], [real, real], numfield](+)]
          (A, f)
       > 0;


# Declarations

decl_type: tcc
theory: rationals
library: prelude
signature: nil
location: 91 0 93 999
body:
  % Judgement subtype TCC generated (at line 2077, column 34) for  x + y
      % expected type  rat
  rat_plus_rat_is_rat: OBLIGATION FORALL (x, y): rational_pred(x + y);


decl_type: tcc
theory: rationals
library: prelude
signature: nil
location: 95 0 97 999
body:
  % Judgement subtype TCC generated (at line 2078, column 34) for  x - y
      % expected type  rat
  rat_minus_rat_is_rat: OBLIGATION FORALL (x, y): rational_pred(x - y);


decl_type: tcc
theory: rationals
library: prelude
signature: nil
location: 99 0 101 999
body:
  % Judgement subtype TCC generated (at line 2079, column 34) for  x * y
      % expected type  rat
  rat_times_rat_is_rat: OBLIGATION FORALL (x, y): rational_pred(x * y);


decl_type: tcc
theory: rationals
library: prelude
signature: nil
location: 103 0 105 999
body:
  % Judgement subtype TCC generated (at line 2080, column 34) for  x / n0z
      % expected type  rat
  rat_div_nzrat_is_rat: OBLIGATION FORALL (n0z, x): rational_pred(x / n0z);


decl_type: tcc
theory: rationals
library: prelude
signature: nil
location: 107 0 109 999
body:
  % Judgement subtype TCC generated (at line 2082, column 30) for  -x
      % expected type  rat
  minus_rat_is_rat: OBLIGATION FORALL (x): rational_pred(-x);


decl_type: tcc
theory: rationals
library: prelude
signature: nil
location: 111 0 113 999
body:
  % Judgement subtype TCC generated (at line 2101, column 31) for  x
      % expected type  nzrat
  posrat_is_nzrat: OBLIGATION FORALL (x: posrat): x /= 0;


decl_type: tcc
theory: rationals
library: prelude
signature: nil
location: 115 0 117 999
body:
  % Judgement subtype TCC generated (at line 2102, column 31) for  x
      % expected type  nzrat
  negrat_is_nzrat: OBLIGATION FORALL (x: negrat): x /= 0;


decl_type: tcc
theory: rationals
library: prelude
signature: nil
location: 119 0 121 999
body:
  % Judgement subtype TCC generated (at line 2104, column 40) for  n0x * n0y
      % expected type  nzrat
  nzrat_times_nzrat_is_nzrat: OBLIGATION FORALL (n0x, n0y): n0x * n0y /= 0;


decl_type: tcc
theory: rationals
library: prelude
signature: nil
location: 123 0 125 999
body:
  % Judgement subtype TCC generated (at line 2105, column 40) for  n0x / n0y
      % expected type  nzrat
  nzrat_div_nzrat_is_nzrat: OBLIGATION FORALL (n0x, n0y): n0x / n0y /= 0;


decl_type: tcc
theory: rationals
library: prelude
signature: nil
location: 127 0 129 999
body:
  % Judgement subtype TCC generated (at line 2106, column 40) for  -n0x
      % expected type  nzrat
  minus_nzrat_is_nzrat: OBLIGATION FORALL (n0x): -n0x /= 0;


decl_type: tcc
theory: rationals
library: prelude
signature: nil
location: 131 0 133 999
body:
  % Judgement subtype TCC generated (at line 2108, column 40) for  nnx + nny
      % expected type  nonneg_rat
  nnrat_plus_nnrat_is_nnrat: OBLIGATION FORALL (nnx, nny): nnx + nny >= 0;


decl_type: tcc
theory: rationals
library: prelude
signature: nil
location: 135 0 137 999
body:
  % Judgement subtype TCC generated (at line 2109, column 40) for  nnx * nny
      % expected type  nonneg_rat
  nnrat_times_nnrat_is_nnrat: OBLIGATION FORALL (nnx, nny): nnx * nny >= 0;


decl_type: tcc
theory: rationals
library: prelude
signature: nil
location: 139 0 141 999
body:
  % Judgement subtype TCC generated (at line 2110, column 40) for  nnx / py
      % expected type  nonneg_rat
  nnrat_div_posrat_is_nnrat: OBLIGATION FORALL (nnx, py): nnx / py >= 0;


decl_type: tcc
theory: rationals
library: prelude
signature: nil
location: 143 0 145 999
body:
  % Judgement subtype TCC generated (at line 2111, column 40) for  nnx / ny
      % expected type  nprat
  nnrrat_div_negrat_is_nprat: OBLIGATION FORALL (nnx, ny): nnx / ny <= 0;


decl_type: tcc
theory: rationals
library: prelude
signature: nil
location: 147 0 149 999
body:
  % Judgement subtype TCC generated (at line 2113, column 40) for  npx + npy
      % expected type  nprat
  nprat_plus_nprat_is_nprat: OBLIGATION FORALL (npx, npy): npx + npy <= 0;


decl_type: tcc
theory: rationals
library: prelude
signature: nil
location: 151 0 153 999
body:
  % Judgement subtype TCC generated (at line 2114, column 40) for  npx * npy
      % expected type  nnrat
  nprat_times_nprat_is_nnrat: OBLIGATION FORALL (npx, npy): npx * npy >= 0;


decl_type: tcc
theory: rationals
library: prelude
signature: nil
location: 155 0 157 999
body:
  % Judgement subtype TCC generated (at line 2115, column 40) for  npx / py
      % expected type  nprat
  nprat_div_posrat_is_nprat: OBLIGATION FORALL (npx, py): npx / py <= 0;


decl_type: tcc
theory: rationals
library: prelude
signature: nil
location: 159 0 161 999
body:
  % Judgement subtype TCC generated (at line 2116, column 40) for  npx / ny
      % expected type  nnrat
  nprat_div_negrat_is_nnrat: OBLIGATION FORALL (npx, ny): npx / ny >= 0;


decl_type: tcc
theory: rationals
library: prelude
signature: nil
location: 163 0 165 999
body:
  % Judgement subtype TCC generated (at line 2118, column 43) for  px + nny
      % expected type  posrat
  posrat_plus_nnrat_is_posrat: OBLIGATION FORALL (nny, px): px + nny > 0;


decl_type: tcc
theory: rationals
library: prelude
signature: nil
location: 167 0 169 999
body:
  % Judgement subtype TCC generated (at line 2119, column 43) for  nnx + py
      % expected type  posrat
  nnrat_plus_posrat_is_posrat: OBLIGATION FORALL (nnx, py): nnx + py > 0;


decl_type: tcc
theory: rationals
library: prelude
signature: nil
location: 171 0 173 999
body:
  % Judgement subtype TCC generated (at line 2120, column 43) for  px * py
      % expected type  posrat
  posrat_times_posrat_is_posrat: OBLIGATION FORALL (px, py): px * py > 0;


decl_type: tcc
theory: rationals
library: prelude
signature: nil
location: 175 0 177 999
body:
  % Judgement subtype TCC generated (at line 2121, column 43) for  px / py
      % expected type  posrat
  posrat_div_posrat_is_posrat: OBLIGATION FORALL (px, py): px / py > 0;


decl_type: tcc
theory: rationals
library: prelude
signature: nil
location: 179 0 181 999
body:
  % Judgement subtype TCC generated (at line 2123, column 43) for  nx + ny
      % expected type  negrat
  negrat_plus_negrat_is_negrat: OBLIGATION FORALL (nx, ny): nx + ny < 0;


decl_type: tcc
theory: rationals
library: prelude
signature: nil
location: 183 0 185 999
body:
  % Judgement subtype TCC generated (at line 2124, column 43) for  nx * ny
      % expected type  posrat
  negrat_times_negrat_is_posrat: OBLIGATION FORALL (nx, ny): nx * ny > 0;


decl_type: tcc
theory: rationals
library: prelude
signature: nil
location: 187 0 189 999
body:
  % Judgement subtype TCC generated (at line 2125, column 43) for  nx / ny
      % expected type  posrat
  negrat_div_negrat_is_posrat: OBLIGATION FORALL (nx, ny): nx / ny > 0;


decl_type: formula
theory: finite_sets_of_sets
library: prelude
signature: nil
location: 17 2 22 46
body:
    powerset_natfun_rec_bound: LEMMA
     FORALL (A: finite_set[T],
             n: upto(card(A)),
             f: (bijective?[(A), below(card(A))]),
             B: (powerset(A))):
       powerset_natfun_rec(A, n, f, B) < exp2(n)


decl_type: formula
theory: finite_sets_of_sets
library: prelude
signature: nil
location: 28 2 36 73
body:
    powerset_natfun_inj_rec: LEMMA
     FORALL (A: finite_set[T],
             n: upto(card(A)),
             f: (bijective?[(A), below(card(A))]),
             B1, B2: (powerset(A))):
      powerset_natfun_rec(A, n, f, B1) = powerset_natfun_rec(A, n, f, B2)
        <=> (FORALL (m: upto(card(A))):
              (m < n) IMPLIES
                 (member(inverse(f)(m), B1) IFF member(inverse(f)(m), B2)))


decl_type: formula
theory: finite_sets_of_sets
library: prelude
signature: nil
location: 38 2 41 71
body:
    powerset_natfun_inj: LEMMA
      FORALL (A: finite_set[T]):
        FORALL (B1, B2: (powerset(A))):
          powerset_natfun(A)(B1) = powerset_natfun(A)(B2) IMPLIES B1 = B2


decl_type: formula
theory: finite_sets_of_sets
library: prelude
signature: nil
location: 48 2 49 78
body:
    Union_finite: THEOREM
      FORALL SS: is_finite(Union(SS)) IFF is_finite(SS) AND every(is_finite)(SS)


decl_type: formula
theory: finite_sets_of_sets
library: prelude
signature: nil
location: 51 2 52 49
body:
    finite_Union_finite: LEMMA is_finite(SS) AND every(is_finite[T])(SS) IMPLIES
                               is_finite(Union(SS))


decl_type: formula
theory: finite_sets_of_sets
library: prelude
signature: nil
location: 54 2 56 73
body:
    Union_infinite: COROLLARY
      FORALL SS:
        is_infinite(Union(SS)) IFF is_infinite(SS) OR some(is_infinite)(SS)


decl_type: formula
theory: finite_sets_of_sets
library: prelude
signature: nil
location: 58 2 60 75
body:
    Intersection_finite: THEOREM
      FORALL SS:
        nonempty?(SS) AND every(is_finite)(SS) => is_finite(Intersection(SS))


decl_type: formula
theory: finite_sets_of_sets
library: prelude
signature: nil
location: 62 2 63 70
body:
    Intersection_infinite: COROLLARY
      FORALL SS: is_infinite(Intersection(SS)) => every(is_infinite)(SS)


decl_type: judgement
theory: finite_sets_of_sets
library: prelude
signature: finite_set[set[T]]
location: 68 2 69 66
body:
    Complement_is_finite: JUDGEMENT
      Complement(SS: finite_set[set[T]]) HAS_TYPE finite_set[set[T]]


decl_type: judgement
theory: finite_sets_of_sets
library: prelude
signature: infinite_set[set[T]]
location: 74 2 75 70
body:
    Complement_is_infinite: JUDGEMENT
      Complement(SS: infinite_set[set[T]]) HAS_TYPE infinite_set[set[T]]


decl_type: function
theory: finite_sets_of_sets
library: prelude
location: 6 2 15 11
signature:
  [[A: finite_set[T], upto(card(A)),
         (bijective?[(A), below(card(A))]), (powerset(A))] ->
          nat]

body:
    powerset_natfun_rec(A: finite_set[T],
                        n: upto(card(A)),
                        f: (bijective?[(A), below(card(A))]),
                        B: (powerset(A))):
          RECURSIVE nat =
     IF n = 0 THEN 0
     ELSE LET nval = exp2(n-1) * IF member(inverse(f)(n-1), B) THEN 1 ELSE 0 ENDIF
           IN nval + powerset_natfun_rec(A, n-1, f, B)
     ENDIF
    MEASURE n


decl_type: function
theory: finite_sets_of_sets
library: prelude
signature: [A: finite_set[T] -> [(powerset(A)) -> below(exp2(card(A)))]]
location: 24 2 26 45
body:
    powerset_natfun(A: finite_set[T])(B: (powerset(A))): below(exp2(card(A))) =
      LET f = choose(bijective?[(A), below(card(A))])
       IN powerset_natfun_rec(A, card(A), f, B)


decl_type: tcc
theory: finite_sets_of_sets
library: prelude
signature: nil
location: 82 0 91 999
body:
  % Subtype TCC generated (at line 5955, column 42) for  n - 1
      % expected type  upto(card(A))
  powerset_natfun_rec_TCC1: OBLIGATION
    FORALL (A: finite_set[T], n: upto(card[T](A)),
            f: (bijective?[(A), below(card[T](A))]), B: (powerset[T](A))):
      NOT n = 0 IMPLIES
       (FORALL (nval: (divides(exp2(n - 1)))):
          nval =
           exp2(n - 1) * IF member(inverse(f)(n - 1), B) THEN 1 ELSE 0 ENDIF
           IMPLIES n - 1 >= 0 AND n - 1 <= card[T](A));


decl_type: tcc
theory: finite_sets_of_sets
library: prelude
signature: nil
location: 93 0 102 999
body:
  % Termination TCC generated (at line 5955, column 19) for
      % powerset_natfun_rec(A, n - 1, f, B)
  powerset_natfun_rec_TCC2: OBLIGATION
    FORALL (A: finite_set[T], n: upto(card[T](A)),
            f: (bijective?[(A), below(card[T](A))]), B: (powerset[T](A))):
      NOT n = 0 IMPLIES
       (FORALL (nval: (divides(exp2(n - 1)))):
          nval =
           exp2(n - 1) * IF member(inverse(f)(n - 1), B) THEN 1 ELSE 0 ENDIF
           IMPLIES n - 1 < n);


decl_type: tcc
theory: finite_sets_of_sets
library: prelude
signature: nil
location: 104 0 120 999
body:
  % Subtype TCC generated (at line 5955, column 12) for
      % nval + powerset_natfun_rec(A, n - 1, f, B)
      % expected type  nat
  powerset_natfun_rec_TCC3: OBLIGATION
    FORALL (A: finite_set[T], n: upto(card[T](A)),
            v:
              [{z:
                  [A: finite_set[T], upto(card(A)),
                   (bijective?[(A), below(card(A))]), (powerset(A))] |
                        z`2 < n} ->
                 nat],
            f: (bijective?[(A), below(card[T](A))]), B: (powerset[T](A))):
      NOT n = 0 IMPLIES
       (FORALL (nval: (divides(exp2(n - 1)))):
          nval =
           exp2(n - 1) * IF member(inverse(f)(n - 1), B) THEN 1 ELSE 0 ENDIF
           IMPLIES nval + v(A, n - 1, f, B) >= 0);


decl_type: tcc
theory: finite_sets_of_sets
library: prelude
signature: nil
location: 122 0 127 999
body:
  % Subtype TCC generated (at line 5954, column 24) for  n - 1
      % expected type  nat
  powerset_natfun_rec_TCC4: OBLIGATION
    FORALL (A: finite_set[T], n: upto(card[T](A)),
            f: (bijective?[(A), below(card[T](A))]), B: (powerset[T](A))):
      NOT n = 0 IMPLIES n - 1 >= 0;


decl_type: tcc
theory: finite_sets_of_sets
library: prelude
signature: nil
location: 129 0 134 999
body:
  % Subtype TCC generated (at line 5954, column 52) for  n - 1
      % expected type  below(card(A))
  powerset_natfun_rec_TCC5: OBLIGATION
    FORALL (A: finite_set[T], n: upto(card[T](A)),
            f: (bijective?[(A), below(card[T](A))]), B: (powerset[T](A))):
      NOT n = 0 IMPLIES n - 1 >= 0 AND n - 1 < card[T](A);


decl_type: tcc
theory: finite_sets_of_sets
library: prelude
signature: nil
location: 136 0 140 999
body:
  % Existence TCC generated (at line 5954, column 41) for  inverse
  powerset_natfun_rec_TCC6: OBLIGATION
    FORALL (A: finite_set[T], n: upto(card[T](A)),
            f: (bijective?[(A), below(card[T](A))]), B: (powerset[T](A))):
      NOT n = 0 IMPLIES (EXISTS (x: (A)): TRUE);


decl_type: tcc
theory: finite_sets_of_sets
library: prelude
signature: nil
location: 142 0 148 999
body:
  % Subtype TCC generated (at line 5967, column 19) for
      % bijective?[(A), below(card(A))]
      % expected type  p: (nonempty?[[(A) -> below(card(A))]])
  powerset_natfun_TCC1: OBLIGATION
    FORALL (A: finite_set[T], B: (powerset[T](A))):
      nonempty?[[(A) -> below(card[T](A))]]
          (bijective?[(A), below(card[T](A))]);


decl_type: tcc
theory: finite_sets_of_sets
library: prelude
signature: nil
location: 150 0 156 999
body:
  % Subtype TCC generated (at line 5968, column 31) for  card(A)
      % expected type  upto(card(A))
  powerset_natfun_TCC2: OBLIGATION
    FORALL (A: finite_set[T], B: (powerset[T](A)),
            f: (bijective?[(A), below(card[T](A))])):
      f = choose(bijective?[(A), below(card(A))]) IMPLIES
       card[T](A) <= card[T](A);


decl_type: tcc
theory: finite_sets_of_sets
library: prelude
signature: nil
location: 158 0 165 999
body:
  % Subtype TCC generated (at line 5968, column 8) for
      % powerset_natfun_rec(A, card(A), f, B)
      % expected type  below(exp2(card(A)))
  powerset_natfun_TCC3: OBLIGATION
    FORALL (A: finite_set[T], B: (powerset[T](A)),
            f: (bijective?[(A), below(card[T](A))])):
      f = choose(bijective?[(A), below(card(A))]) IMPLIES
       powerset_natfun_rec(A, card[T](A), f, B) < exp2(card[T](A));


decl_type: tcc
theory: finite_sets_of_sets
library: prelude
signature: nil
location: 167 0 173 999
body:
  % Subtype TCC generated (at line 5978, column 34) for  m
      % expected type  below(card(A))
  powerset_natfun_inj_rec_TCC1: OBLIGATION
    FORALL (A: finite_set[T], n: upto(card[T](A)),
            f: (bijective?[(A), below(card[T](A))]),
            B1, B2: (powerset[T](A)), m: upto(card[T](A))):
      (m < n) IMPLIES m < card[T](A);


decl_type: tcc
theory: finite_sets_of_sets
library: prelude
signature: nil
location: 175 0 180 999
body:
  % Existence TCC generated (at line 5978, column 23) for  inverse
  powerset_natfun_inj_rec_TCC2: OBLIGATION
    FORALL (A: finite_set[T], n: upto(card[T](A)),
            f: (bijective?[(A), below(card[T](A))]),
            B1, B2: (powerset[T](A)), m: upto(card[T](A))):
      (m < n) IMPLIES (EXISTS (x: (A)): TRUE);


decl_type: tcc
theory: finite_sets_of_sets
library: prelude
signature: nil
location: 182 0 185 999
body:
  % Judgement subtype TCC generated (at line 5986, column 4) for  powerset(A)
      % expected type  finite_set[set[T]]
  powerset_finite: OBLIGATION
    FORALL (A: finite_set[T]): is_finite[set[T]](powerset[T](A));


decl_type: tcc
theory: finite_sets_of_sets
library: prelude
signature: nil
location: 187 0 191 999
body:
  % Judgement subtype TCC generated (at line 6011, column 4) for
      % Complement(SS)
      % expected type  finite_set[set[T]]
  Complement_is_finite: OBLIGATION
    FORALL (SS: finite_set[set[T]]): is_finite[set[T]](Complement[T](SS));


decl_type: tcc
theory: finite_sets_of_sets
library: prelude
signature: nil
location: 193 0 198 999
body:
  % Judgement subtype TCC generated (at line 6017, column 4) for
      % Complement(SS)
      % expected type  infinite_set[set[T]]
  Complement_is_infinite: OBLIGATION
    FORALL (SS: infinite_set[set[T]]):
      NOT is_finite[set[T]](Complement[T](SS));


decl_type: formula
theory: bounded_nat_inductions
library: prelude
signature: nil
location: 9 2 11 33
body:
    upto_induction: LEMMA
      (pt(0) AND (FORALL jt: jt < m AND pt(jt) IMPLIES pt(jt + 1)))
        IMPLIES (FORALL jt: pt(jt))


decl_type: formula
theory: bounded_nat_inductions
library: prelude
signature: nil
location: 13 2 15 33
body:
    UPTO_induction: LEMMA
      (FORALL jt: (FORALL kt: kt < jt IMPLIES pt(kt)) IMPLIES pt(jt))
        IMPLIES (FORALL jt: pt(jt))


decl_type: formula
theory: bounded_nat_inductions
library: prelude
signature: nil
location: 20 2 23 33
body:
    below_induction: LEMMA
      ((m > 0 IMPLIES pb(0))
          AND (FORALL jb: jb < m - 1 AND pb(jb) IMPLIES pb(jb + 1)))
        IMPLIES (FORALL jb: pb(jb))


decl_type: formula
theory: bounded_nat_inductions
library: prelude
signature: nil
location: 25 2 27 33
body:
    BELOW_induction: LEMMA
      (FORALL jb: (FORALL kb: kb < jb IMPLIES pb(kb)) IMPLIES pb(jb))
        IMPLIES (FORALL jb: pb(jb))


decl_type: tcc
theory: bounded_nat_inductions
library: prelude
signature: nil
location: 34 0 36 999
body:
  % Subtype TCC generated (at line 3969, column 8) for  0
      % expected type  upto(m)
  upto_induction_TCC1: OBLIGATION 0 <= m;


decl_type: tcc
theory: bounded_nat_inductions
library: prelude
signature: nil
location: 38 0 42 999
body:
  % Subtype TCC generated (at line 3969, column 56) for  jt + 1
      % expected type  upto(m)
  upto_induction_TCC2: OBLIGATION
    FORALL (pt: pred[upto(m)]):
      pt(0) IMPLIES (FORALL (jt): jt < m AND pt(jt) IMPLIES jt + 1 <= m);


decl_type: tcc
theory: bounded_nat_inductions
library: prelude
signature: nil
location: 44 0 46 999
body:
  % Subtype TCC generated (at line 3980, column 23) for  0
      % expected type  below(m)
  below_induction_TCC1: OBLIGATION m > 0 IMPLIES 0 < m;


decl_type: tcc
theory: bounded_nat_inductions
library: prelude
signature: nil
location: 48 0 53 999
body:
  % Subtype TCC generated (at line 3981, column 57) for  jb + 1
      % expected type  below(m)
  below_induction_TCC2: OBLIGATION
    FORALL (pb: pred[below(m)]):
      (m > 0 IMPLIES pb(0)) IMPLIES
       (FORALL (jb): jb < m - 1 AND pb(jb) IMPLIES jb + 1 < m);


decl_type: function
theory: list2set
library: prelude
signature: [list[T] -> set[T]]
location: 8 2 13 17
body:
    list2set(l) : RECURSIVE set[T] =
      CASES l OF
        null: emptyset[T],
        cons(x, y): add(x, list2set(y))
      ENDCASES
     MEASURE length


decl_type: tcc
theory: list2set
library: prelude
signature: nil
location: 22 0 25 999
body:
  % Termination TCC generated (at line 4912, column 25) for  list2set(y)
  list2set_TCC1: OBLIGATION
    FORALL (l: list[T], x: T, y: list[T]):
      l = cons(x, y) IMPLIES length[T](y) < length[T](l);


decl_type: tcc
theory: function_image_aux
library: prelude
signature: nil
location: 31 0 33 999
body:
  % Judgement subtype TCC generated (at line 4413, column 26) for  image(f, S)
      % expected type  finite_set[R]
  finite_image: OBLIGATION FORALL (S, f): is_finite[R](image[D, R](f, S));


decl_type: tcc
theory: function_image_aux
library: prelude
signature: nil
location: 35 0 38 999
body:
  % Subtype TCC generated (at line 4420, column 56) for  inj
      % expected type  [D -> (image(inj, fullset[D]))]
  bijective_image_TCC1: OBLIGATION
    FORALL (inj): FORALL (x1: D): image[D, R](inj, fullset[D])(inj(x1));


decl_type: formula
theory: wf_induction
library: prelude
signature: nil
location: 7 2 13 27
body:
    wf_induction: LEMMA
      (FORALL (p: pred[T]):
        (FORALL (x: T):
          (FORALL (y: T): y<x IMPLIES p(y))
             IMPLIES p(x))
      IMPLIES
        (FORALL (x:T): p(x)))


decl_type: formula
theory: sets
library: prelude
signature: nil
location: 85 2 87 27
body:
    is_singleton: LEMMA
      FORALL a: (nonempty?(a) AND FORALL x, y: a(x) AND a(y) IMPLIES (x=y))
        IMPLIES singleton?(a)


decl_type: tcc
theory: sets
library: prelude
signature: nil
location: 120 0 122 999
body:
  % Subtype TCC generated (at line 803, column 31) for  {y | y = x}
      % expected type  (singleton?)
  singleton_TCC1: OBLIGATION FORALL (x: T): singleton?({y | y = x});


decl_type: tcc
theory: sets
library: prelude
signature: nil
location: 124 0 128 999
body:
  % Subtype TCC generated (at line 807, column 27) for
      % {y | x = y OR member(y, a)}
      % expected type  (nonempty?)
  add_TCC1: OBLIGATION
    FORALL (x: T, a: set): nonempty?({y | x = y OR member(y, a)});


decl_type: tcc
theory: sets
library: prelude
signature: nil
location: 130 0 132 999
body:
  % Existence TCC generated (at line 815, column 2) for
      % choose(p: (nonempty?)): (p)
  choose_TCC1: OBLIGATION EXISTS (x: [p: (nonempty?) -> (p)]): TRUE;


decl_type: tcc
theory: sets
library: prelude
signature: nil
location: 134 0 136 999
body:
  % Existence TCC generated (at line 817, column 64) for  epsilon
  choose_is_epsilon_TCC1: OBLIGATION
    FORALL (p: (nonempty?)): EXISTS (x: T): TRUE;


decl_type: tcc
theory: sets
library: prelude
signature: nil
location: 138 0 140 999
body:
  % Existence TCC generated (at line 819, column 2) for
      % the(p: (singleton?)): (p)
  the_TCC1: OBLIGATION EXISTS (x: [p: (singleton?) -> (p)]): TRUE;


decl_type: tcc
theory: sets
library: prelude
signature: nil
location: 142 0 145 999
body:
  % Subtype TCC generated for  LAMBDA x: member(x, a)
      % expected type  p: (singleton?)
  singleton_elt_TCC1: OBLIGATION
    FORALL (a: (singleton?)): singleton?(LAMBDA x: member(x, a));


decl_type: tcc
theory: sets
library: prelude
signature: nil
location: 147 0 150 999
body:
  % Subtype TCC generated (at line 835, column 75) for  a
      % expected type  p: (nonempty?)
  singleton_elt_def_TCC1: OBLIGATION
    FORALL (a: set): singleton?(a) IMPLIES nonempty?(a);


decl_type: tcc
theory: sets
library: prelude
signature: nil
location: 152 0 154 999
body:
  % Subtype TCC generated (at line 843, column 56) for  a
      % expected type  p: (nonempty?)
  rest_TCC1: OBLIGATION FORALL (a: set): NOT empty?(a) IMPLIES nonempty?(a);


decl_type: tcc
theory: sets
library: prelude
signature: nil
location: 156 0 158 999
body:
  % Judgement subtype TCC generated (at line 855, column 32) for  x
      % expected type  (nonempty?)
  nonempty_singleton: OBLIGATION FORALL (x: (singleton?)): nonempty?(x);


decl_type: tcc
theory: sets
library: prelude
signature: nil
location: 160 0 163 999
body:
  % Judgement subtype TCC generated (at line 856, column 29) for  union(a, b)
      % expected type  (nonempty?)
  nonempty_union1: OBLIGATION
    FORALL (a: (nonempty?), b: set): nonempty?(union(a, b));


decl_type: tcc
theory: sets
library: prelude
signature: nil
location: 165 0 168 999
body:
  % Judgement subtype TCC generated (at line 857, column 29) for  union(a, b)
      % expected type  (nonempty?)
  nonempty_union2: OBLIGATION
    FORALL (a: set, b: (nonempty?)): nonempty?(union(a, b));


decl_type: function
theory: exponentiation
library: prelude
signature: [[real, nat] -> real]
location: 24 2 28 13
body:
    expt(r, n): RECURSIVE real =
      IF n = 0 THEN 1
      ELSE r * expt(r, n-1)
      ENDIF
     MEASURE n;


decl_type: function
theory: exponentiation
library: prelude
signature: [[r: real, {i: int | r /= 0 OR i >= 0}] -> real]
location: 44 2 45 56
body:
    ^(r: real, i:{i:int | r /= 0 OR i >= 0}): real
      = IF i >= 0 THEN expt(r, i) ELSE 1/expt(r, -i) ENDIF


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 230 0 232 999
body:
  % Subtype TCC generated (at line 3421, column 21) for  n - 1
      % expected type  nat
  expt_TCC1: OBLIGATION FORALL (n: nat): NOT n = 0 IMPLIES n - 1 >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 234 0 235 999
body:
  % Termination TCC generated (at line 3421, column 13) for  expt(r, n - 1)
  expt_TCC2: OBLIGATION FORALL (n: nat): NOT n = 0 IMPLIES n - 1 < n;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 237 0 239 999
body:
  % Judgement subtype TCC generated (at line 3429, column 26) for  expt(x, n)
      % expected type  nnreal
  nnreal_expt: OBLIGATION FORALL (n: nat, x: nnreal): expt(x, n) >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 241 0 243 999
body:
  % Judgement subtype TCC generated (at line 3430, column 26) for  expt(x, n)
      % expected type  posreal
  posreal_expt: OBLIGATION FORALL (n: nat, x: posreal): expt(x, n) > 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 245 0 247 999
body:
  % Judgement subtype TCC generated (at line 3431, column 26) for  expt(x, n)
      % expected type  nzreal
  nzreal_expt: OBLIGATION FORALL (n: nat, x: nzreal): expt(x, n) /= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 249 0 251 999
body:
  % Judgement subtype TCC generated (at line 3432, column 26) for  expt(x, n)
      % expected type  rat
  rat_expt: OBLIGATION FORALL (n: nat, x: rat): rational_pred(expt(x, n));


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 253 0 255 999
body:
  % Judgement subtype TCC generated (at line 3433, column 26) for  expt(x, n)
      % expected type  nnrat
  nnrat_expt: OBLIGATION FORALL (n: nat, x: nnrat): expt(x, n) >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 257 0 259 999
body:
  % Judgement subtype TCC generated (at line 3434, column 26) for  expt(x, n)
      % expected type  posrat
  posrat_expt: OBLIGATION FORALL (n: nat, x: posrat): expt(x, n) > 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 261 0 263 999
body:
  % Judgement subtype TCC generated (at line 3435, column 26) for  expt(x, n)
      % expected type  int
  int_expt: OBLIGATION FORALL (n: nat, x: int): integer_pred(expt(x, n));


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 265 0 267 999
body:
  % Judgement subtype TCC generated (at line 3436, column 26) for  expt(x, n)
      % expected type  nat
  nat_expt: OBLIGATION FORALL (n, x: nat): expt(x, n) >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 269 0 271 999
body:
  % Judgement subtype TCC generated (at line 3437, column 26) for  expt(x, n)
      % expected type  posnat
  posnat_expt: OBLIGATION FORALL (n: nat, x: posnat): expt(x, n) > 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 273 0 277 999
body:
  % Subtype TCC generated (at line 3440, column 47) for  -i
      % expected type  nat
  caret_TCC1: OBLIGATION
    FORALL (r: real, i: {i: int | r /= 0 OR i >= 0}):
      NOT i >= 0 IMPLIES -i >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 279 0 283 999
body:
  % Subtype TCC generated (at line 3440, column 39) for  expt(r, -i)
      % expected type  nznum
  caret_TCC2: OBLIGATION
    FORALL (r: real, i: {i: int | r /= 0 OR i >= 0}):
      NOT i >= 0 IMPLIES expt(r, -i) /= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 285 0 287 999
body:
  % Subtype TCC generated (at line 3442, column 21) for  i
      % expected type  {i: int | px /= 0 OR i >= 0}
  expt_pos_TCC1: OBLIGATION FORALL (i: int, px: posreal): px /= 0 OR i >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 289 0 292 999
body:
  % Subtype TCC generated (at line 3444, column 26) for  i
      % expected type  {i: int | n0x /= 0 OR i >= 0}
  expt_nonzero_TCC1: OBLIGATION
    FORALL (i: int, n0x: nzreal): n0x /= 0 OR i >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 294 0 297 999
body:
  % Judgement subtype TCC generated (at line 3446, column 25) for  x ^ i
      % expected type  nnreal
  nnreal_exp: OBLIGATION
    FORALL (x: nnreal, i: int | x /= 0 OR i >= 0): x ^ i >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 299 0 301 999
body:
  % Judgement subtype TCC generated (at line 3447, column 25) for  x ^ i
      % expected type  posreal
  posreal_exp: OBLIGATION FORALL (i: int, x: posreal): x ^ i > 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 303 0 305 999
body:
  % Judgement subtype TCC generated (at line 3448, column 25) for  x ^ i
      % expected type  nzreal
  nzreal_exp: OBLIGATION FORALL (i: int, x: nzreal): x ^ i /= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 307 0 310 999
body:
  % Judgement subtype TCC generated (at line 3449, column 25) for  x ^ i
      % expected type  rat
  rat_exp: OBLIGATION
    FORALL (x: rat, i: int | x /= 0 OR i >= 0): rational_pred(x ^ i);


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 312 0 315 999
body:
  % Judgement subtype TCC generated (at line 3450, column 25) for  x ^ i
      % expected type  nnrat
  nnrat_exp: OBLIGATION
    FORALL (x: nnrat, i: int | x /= 0 OR i >= 0): x ^ i >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 317 0 319 999
body:
  % Subtype TCC generated (at line 3451, column 38) for  i
      % expected type  {i: int | x /= 0 OR i >= 0}
  posrat_exp_TCC1: OBLIGATION FORALL (i: int, x: posrat): x /= 0 OR i >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 321 0 323 999
body:
  % Judgement subtype TCC generated (at line 3451, column 25) for  x ^ i
      % expected type  posrat
  posrat_exp: OBLIGATION FORALL (i: int, x: posrat): x ^ i > 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 325 0 327 999
body:
  % Subtype TCC generated (at line 3452, column 34) for  n
      % expected type  {i: int | x /= 0 OR i >= 0}
  int_exp_TCC1: OBLIGATION FORALL (n: nat, x: int): x /= 0 OR n >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 329 0 331 999
body:
  % Judgement subtype TCC generated (at line 3452, column 25) for  x ^ n
      % expected type  int
  int_exp: OBLIGATION FORALL (n: nat, x: int): integer_pred(x ^ n);


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 333 0 335 999
body:
  % Judgement subtype TCC generated (at line 3453, column 25) for  x ^ n
      % expected type  nat
  nat_exp: OBLIGATION FORALL (n, x: nat): x ^ n >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 337 0 339 999
body:
  % Judgement subtype TCC generated (at line 3454, column 25) for  x ^ n
      % expected type  posint
  posint_exp: OBLIGATION FORALL (n: nat, x: posint): x ^ n > 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 341 0 344 999
body:
  % Subtype TCC generated (at line 3473, column 29) for  m - n
      % expected type  nat
  expt_minus_aux_TCC1: OBLIGATION
    FORALL (m, n: nat): m >= n IMPLIES m - n >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 346 0 348 999
body:
  % Subtype TCC generated (at line 3531, column 19) for  0
      % expected type  {i: int | x /= 0 OR i >= 0}
  expt_x0_TCC1: OBLIGATION FORALL (x: real): x /= 0 OR 0 >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 350 0 352 999
body:
  % Subtype TCC generated (at line 3533, column 19) for  1
      % expected type  {i: int | x /= 0 OR i >= 0}
  expt_x1_TCC1: OBLIGATION FORALL (x: real): x /= 0 OR 1 >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 354 0 356 999
body:
  % Subtype TCC generated (at line 3534, column 19) for  2
      % expected type  {i: int | x /= 0 OR i >= 0}
  expt_x2_TCC1: OBLIGATION FORALL (x: real): x /= 0 OR 2 >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 358 0 360 999
body:
  % Subtype TCC generated (at line 3535, column 19) for  3
      % expected type  {i: int | x /= 0 OR i >= 0}
  expt_x3_TCC1: OBLIGATION FORALL (x: real): x /= 0 OR 3 >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 362 0 364 999
body:
  % Subtype TCC generated (at line 3536, column 19) for  4
      % expected type  {i: int | x /= 0 OR i >= 0}
  expt_x4_TCC1: OBLIGATION FORALL (x: real): x /= 0 OR 4 >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 366 0 368 999
body:
  % Subtype TCC generated (at line 3540, column 21) for  pn
      % expected type  {i: int | x /= 0 OR i >= 0}
  expt_eq_0_TCC1: OBLIGATION FORALL (pn: posnat, x: real): x /= 0 OR pn >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 370 0 373 999
body:
  % Subtype TCC generated (at line 3542, column 24) for  (i + j)
      % expected type  {i: int | n0x /= 0 OR i >= 0}
  expt_plus_TCC1: OBLIGATION
    FORALL (i, j: int, n0x: nzreal): n0x /= 0 OR (i + j) >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 375 0 378 999
body:
  % Subtype TCC generated (at line 3544, column 25) for  (i * j)
      % expected type  {i: int | n0x /= 0 OR i >= 0}
  expt_times_TCC1: OBLIGATION
    FORALL (i, j: int, n0x: nzreal): n0x /= 0 OR (i * j) >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 380 0 383 999
body:
  % Subtype TCC generated (at line 3546, column 27) for  (-i)
      % expected type  {i: int | n0x /= 0 OR i >= 0}
  expt_inverse_TCC1: OBLIGATION
    FORALL (i: int, n0x: nzreal): n0x /= 0 OR (-i) >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 385 0 388 999
body:
  % Subtype TCC generated (at line 3548, column 37) for  (i - j)
      % expected type  {i: int | n0x /= 0 OR i >= 0}
  expt_div_TCC1: OBLIGATION
    FORALL (i, j: int, n0x: nzreal): n0x /= 0 OR (i - j) >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 390 0 393 999
body:
  % Subtype TCC generated (at line 3550, column 31) for  n0i
      % expected type  {i: int | px /= 0 OR i >= 0}
  both_sides_expt1_TCC1: OBLIGATION
    FORALL (n0i: nzint, px: posreal): px /= 0 OR n0i >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 395 0 397 999
body:
  % Subtype TCC generated (at line 3556, column 27) for  n
      % expected type  {i: int | b /= 0 OR i >= 0}
  pos_expt_gt_TCC1: OBLIGATION FORALL (b: above(1), n: nat): b /= 0 OR n >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 399 0 402 999
body:
  % Subtype TCC generated (at line 3560, column 37) for  pm
      % expected type  {i: int | px /= 0 OR i >= 0}
  both_sides_expt_pos_lt_TCC1: OBLIGATION
    FORALL (pm: posnat, px: posreal): px /= 0 OR pm >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 404 0 407 999
body:
  % Subtype TCC generated (at line 3562, column 39) for  i
      % expected type  {i: int | gt1x /= 0 OR i >= 0}
  both_sides_expt_gt1_lt_TCC1: OBLIGATION
    FORALL (gt1x: {r: posreal | r > 1}, i: int): gt1x /= 0 OR i >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 409 0 412 999
body:
  % Subtype TCC generated (at line 3564, column 39) for  i
      % expected type  {i: int | lt1x /= 0 OR i >= 0}
  both_sides_expt_lt1_lt_TCC1: OBLIGATION
    FORALL (i: int, lt1x: {r: posreal | r < 1}): lt1x /= 0 OR i >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 414 0 417 999
body:
  % Subtype TCC generated (at line 3584, column 27) for  pm
      % expected type  {i: int | gt1x /= 0 OR i >= 0}
  expt_gt1_pos_TCC1: OBLIGATION
    FORALL (gt1x: {r: posreal | r > 1}, pm: posnat): gt1x /= 0 OR pm >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 419 0 422 999
body:
  % Subtype TCC generated (at line 3586, column 28) for  (-pm)
      % expected type  {i: int | gt1x /= 0 OR i >= 0}
  expt_gt1_neg_TCC1: OBLIGATION
    FORALL (gt1x: {r: posreal | r > 1}, pm: posnat): gt1x /= 0 OR (-pm) >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 424 0 427 999
body:
  % Subtype TCC generated (at line 3588, column 31) for  (-m)
      % expected type  {i: int | gt1x /= 0 OR i >= 0}
  expt_gt1_nonpos_TCC1: OBLIGATION
    FORALL (gt1x: {r: posreal | r > 1}, m: nat): gt1x /= 0 OR (-m) >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 429 0 432 999
body:
  % Subtype TCC generated (at line 3590, column 32) for  i
      % expected type  {i: int | (n0x * n0y) /= 0 OR i >= 0}
  mult_expt_TCC1: OBLIGATION
    FORALL (i: int, n0x, n0y: nzreal): (n0x * n0y) /= 0 OR i >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 434 0 437 999
body:
  % Subtype TCC generated (at line 3592, column 31) for  i
      % expected type  {i: int | (n0x / n0y) /= 0 OR i >= 0}
  div_expt_TCC1: OBLIGATION
    FORALL (i: int, n0x, n0y: nzreal): (n0x / n0y) /= 0 OR i >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 439 0 442 999
body:
  % Subtype TCC generated (at line 3596, column 27) for  i
      % expected type  {i: int | abs(n0x) /= 0 OR i >= 0}
  abs_expt_TCC1: OBLIGATION
    FORALL (i: int, n0x: nzreal): abs(n0x) /= 0 OR i >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 444 0 447 999
body:
  % Subtype TCC generated (at line 3598, column 29) for  n
      % expected type  {i: int | abs(x) /= 0 OR i >= 0}
  abs_hat_nat_TCC1: OBLIGATION
    FORALL (n: nat, x: real): abs(x) /= 0 OR n >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 449 0 451 999
body:
  % Subtype TCC generated (at line 3598, column 39) for  n
      % expected type  {i: int | x /= 0 OR i >= 0}
  abs_hat_nat_TCC2: OBLIGATION FORALL (n: nat, x: real): x /= 0 OR n >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 453 0 456 999
body:
  % Subtype TCC generated (at line 3616, column 27) for  i
      % expected type  {i: int | b /= 0 OR i >= 0}
  exponent_adjust_TCC1: OBLIGATION
    FORALL (b: above(1), i: int): b /= 0 OR i >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 458 0 461 999
body:
  % Subtype TCC generated (at line 3616, column 32) for  (i - pm)
      % expected type  {i: int | b /= 0 OR i >= 0}
  exponent_adjust_TCC2: OBLIGATION
    FORALL (b: above(1), i: int, pm: posnat): b /= 0 OR (i - pm) >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 463 0 466 999
body:
  % Subtype TCC generated (at line 3616, column 43) for  (i + 1)
      % expected type  {i: int | b /= 0 OR i >= 0}
  exponent_adjust_TCC3: OBLIGATION
    FORALL (b: above(1), i: int): b /= 0 OR (i + 1) >= 0;


decl_type: formula
theory: sets_lemmas
library: prelude
signature: nil
location: 48 2 50 25
body:
    strict_subset_transitive: LEMMA
      strict_subset?(a, b) AND strict_subset?(b, c) IMPLIES
       strict_subset?(a, c)


decl_type: formula
theory: sets_lemmas
library: prelude
signature: nil
location: 84 2 85 77
body:
    intersection_associative: LEMMA
      intersection(intersection(a, b), c) = intersection(a, intersection(b, c))


decl_type: formula
theory: sets_lemmas
library: prelude
signature: nil
location: 95 2 96 74
body:
    intersection_lower_bound: LEMMA
      subset?(c, a) and subset?(c, b) IMPLIES subset?(c, intersection(a, b))


decl_type: formula
theory: sets_lemmas
library: prelude
signature: nil
location: 98 2 100 55
body:
    distribute_intersection_union: LEMMA
      intersection(a, union(b, c))
          = union(intersection(a, b), intersection(a, c))


decl_type: formula
theory: sets_lemmas
library: prelude
signature: nil
location: 102 2 103 73
body:
    distribute_union_intersection: LEMMA
      union(a, intersection(b, c)) = intersection(union(a, b), union(a, c))


decl_type: formula
theory: sets_lemmas
library: prelude
signature: nil
location: 136 2 138 51
body:
    difference_difference2: LEMMA
      difference(a, difference(b, c))
        = union(difference(a, b), intersection(a, c))


decl_type: formula
theory: sets_lemmas
library: prelude
signature: nil
location: 200 2 201 58
body:
    rest_empty_lem: LEMMA NOT empty?(a) AND empty?(rest(a))
                            IMPLIES a = singleton(choose(a))


decl_type: formula
theory: sets_lemmas
library: prelude
signature: nil
location: 211 2 213 53
body:
    union_disj_remove_left: LEMMA
      disjoint?(a, b) AND a(x) IMPLIES
        union(remove(x, a), b) = remove(x, union(a, b))


decl_type: formula
theory: sets_lemmas
library: prelude
signature: nil
location: 215 2 217 53
body:
    union_disj_remove_right: LEMMA
      disjoint?(a, b) AND b(x) IMPLIES
        union(a, remove(x, b)) = remove(x, union(a, b))


decl_type: formula
theory: sets_lemmas
library: prelude
signature: nil
location: 247 2 248 71
body:
    Union_union_rew: LEMMA nonempty?(A) IMPLIES
                              Union(A) = union(choose(A), Union(rest(A)))


decl_type: formula
theory: sets_lemmas
library: prelude
signature: nil
location: 250 2 252 50
body:
    Intersection_empty: LEMMA
      empty?(Intersection(A)) IFF
       (FORALL x: EXISTS (a: (A)): NOT member(x, a))


decl_type: formula
theory: sets_lemmas
library: prelude
signature: nil
location: 266 2 268 70
body:
    Intersection_intersection_rew: LEMMA
      nonempty?(A) IMPLIES
        Intersection(A) = intersection(choose(A), Intersection(rest(A)))


decl_type: tcc
theory: sets_lemmas
library: prelude
signature: nil
location: 292 0 294 999
body:
  % Judgement subtype TCC generated (at line 905, column 4) for  subset?[T]
      % expected type  (partial_order?[set[T]])
  subset_is_partial_order: OBLIGATION partial_order?[set[T]](subset?[T]);


decl_type: tcc
theory: sets_lemmas
library: prelude
signature: nil
location: 296 0 300 999
body:
  % Judgement subtype TCC generated (at line 916, column 4) for
      % strict_subset?[T]
      % expected type  (strict_order?[set[T]])
  strict_subset_is_strict_order: OBLIGATION
    strict_order?[set[T]](strict_subset?[T]);


decl_type: tcc
theory: sets_lemmas
library: prelude
signature: nil
location: 302 0 305 999
body:
  % Subtype TCC generated (at line 1037, column 54) for  a
      % expected type  p: (nonempty?)
  choose_rest_TCC1: OBLIGATION
    FORALL (a: set[T]): NOT empty?(a) IMPLIES nonempty?[T](a);


decl_type: tcc
theory: sets_lemmas
library: prelude
signature: nil
location: 307 0 311 999
body:
  % Subtype TCC generated (at line 1053, column 56) for  a
      % expected type  p: (nonempty?)
  choose_rest_or_TCC1: OBLIGATION
    FORALL (a: set[T], x: T):
      member(x, a) AND NOT member(x, rest(a)) IMPLIES nonempty?[T](a);


decl_type: tcc
theory: sets_lemmas
library: prelude
signature: nil
location: 313 0 315 999
body:
  % Judgement subtype TCC generated (at line 1086, column 31) for  powerset(a)
      % expected type  (nonempty?[set[T]])
  nonempty_powerset: OBLIGATION FORALL (a): nonempty?[set[T]](powerset[T](a));


decl_type: tcc
theory: sets_lemmas
library: prelude
signature: nil
location: 317 0 319 999
body:
  % Judgement subtype TCC generated (at line 1104, column 4) for  Union
      % expected type  (surjective?[setofsets[T], set[T]])
  Union_surjective: OBLIGATION surjective?[setofsets[T], set[T]](Union[T]);


decl_type: tcc
theory: sets_lemmas
library: prelude
signature: nil
location: 321 0 324 999
body:
  % Judgement subtype TCC generated (at line 1125, column 4) for  Intersection
      % expected type  (surjective?[setofsets[T], set[T]])
  Intersection_surjective: OBLIGATION
    surjective?[setofsets[T], set[T]](Intersection[T]);


decl_type: tcc
theory: sets_lemmas
library: prelude
signature: nil
location: 326 0 329 999
body:
  % Judgement subtype TCC generated (at line 1143, column 4) for  Complement
      % expected type  (bijective?[setofsets[T], setofsets[T]])
  Complement_bijective: OBLIGATION
    bijective?[setofsets[T], setofsets[T]](Complement);


decl_type: judgement
theory: function_props_alt
library: prelude
signature: (preserves[T1, T3, R1, R3])
location: 4 3 6 43
body:
     composition_preserves: JUDGEMENT
       o(f2: (preserves[T2, T3, R2, R3]), f1: (preserves[T1, T2, R1, R2]))
         HAS_TYPE (preserves[T1, T3, R1, R3])


decl_type: judgement
theory: function_props_alt
library: prelude
signature: (inverts[T1, T3, R1, R3])
location: 8 3 10 41
body:
     composition_inverts1: JUDGEMENT
       o(f2: (preserves[T2, T3, R2, R3]), f1: (inverts[T1, T2, R1, R2]))
         HAS_TYPE (inverts[T1, T3, R1, R3])


decl_type: judgement
theory: function_props_alt
library: prelude
signature: (inverts[T1, T3, R1, R3])
location: 12 3 14 41
body:
     composition_inverts2: JUDGEMENT
       o(f2: (inverts[T2, T3, R2, R3]), f1: (preserves[T1, T2, R1, R2]))
         HAS_TYPE (inverts[T1, T3, R1, R3])


decl_type: tcc
theory: function_props_alt
library: prelude
signature: nil
location: 20 0 25 999
body:
  % Judgement subtype TCC generated (at line 1509, column 5) for  f2 o f1
      % expected type  (preserves[T1, T3, R1, R3])
  composition_preserves: OBLIGATION
    FORALL (f1: (preserves[T1, T2, R1, R2]),
            f2: (preserves[T2, T3, R2, R3])):
      preserves[T1, T3, R1, R3](o[T1, T2, T3](f2, f1));


decl_type: tcc
theory: function_props_alt
library: prelude
signature: nil
location: 27 0 31 999
body:
  % Judgement subtype TCC generated (at line 1513, column 5) for  f2 o f1
      % expected type  (inverts[T1, T3, R1, R3])
  composition_inverts1: OBLIGATION
    FORALL (f1: (inverts[T1, T2, R1, R2]), f2: (preserves[T2, T3, R2, R3])):
      inverts[T1, T3, R1, R3](o[T1, T2, T3](f2, f1));


decl_type: tcc
theory: function_props_alt
library: prelude
signature: nil
location: 33 0 37 999
body:
  % Judgement subtype TCC generated (at line 1517, column 5) for  f2 o f1
      % expected type  (inverts[T1, T3, R1, R3])
  composition_inverts2: OBLIGATION
    FORALL (f1: (preserves[T1, T2, R1, R2]), f2: (inverts[T2, T3, R2, R3])):
      inverts[T1, T3, R1, R3](o[T1, T2, T3](f2, f1));


decl_type: judgement
theory: relation_converse_props
library: prelude
signature: (antisymmetric?[T])
location: 21 2 22 65
body:
    antisymmetric_converse: JUDGEMENT
      converse(R: (antisymmetric?[T])) HAS_TYPE (antisymmetric?[T])


decl_type: judgement
theory: relation_converse_props
library: prelude
signature: (partial_order?[T])
location: 36 2 37 65
body:
    partial_order_converse: JUDGEMENT
      converse(R: (partial_order?[T])) HAS_TYPE (partial_order?[T])


decl_type: judgement
theory: relation_converse_props
library: prelude
signature: (strict_total_order?[T])
location: 51 2 52 75
body:
    strict_total_order_converse: JUDGEMENT
      converse(R: (strict_total_order?[T])) HAS_TYPE (strict_total_order?[T])


decl_type: tcc
theory: relation_converse_props
library: prelude
signature: nil
location: 59 0 62 999
body:
  % Judgement subtype TCC generated (at line 1639, column 4) for  converse(R)
      % expected type  (reflexive?[T])
  reflexive_converse: OBLIGATION
    FORALL (R: (reflexive?[T])): reflexive?[T](converse[T, T](R));


decl_type: tcc
theory: relation_converse_props
library: prelude
signature: nil
location: 64 0 67 999
body:
  % Judgement subtype TCC generated (at line 1642, column 4) for  converse(R)
      % expected type  (irreflexive?[T])
  irreflexive_converse: OBLIGATION
    FORALL (R: (irreflexive?[T])): irreflexive?[T](converse[T, T](R));


decl_type: tcc
theory: relation_converse_props
library: prelude
signature: nil
location: 69 0 72 999
body:
  % Judgement subtype TCC generated (at line 1645, column 4) for  converse(R)
      % expected type  (symmetric?[T])
  symmetric_converse: OBLIGATION
    FORALL (R: (symmetric?[T])): symmetric?[T](converse[T, T](R));


decl_type: tcc
theory: relation_converse_props
library: prelude
signature: nil
location: 74 0 77 999
body:
  % Judgement subtype TCC generated (at line 1648, column 4) for  converse(R)
      % expected type  (antisymmetric?[T])
  antisymmetric_converse: OBLIGATION
    FORALL (R: (antisymmetric?[T])): antisymmetric?[T](converse[T, T](R));


decl_type: tcc
theory: relation_converse_props
library: prelude
signature: nil
location: 79 0 82 999
body:
  % Judgement subtype TCC generated (at line 1651, column 4) for  converse(R)
      % expected type  (connected?[T])
  connected_converse: OBLIGATION
    FORALL (R: (connected?[T])): connected?[T](converse[T, T](R));


decl_type: tcc
theory: relation_converse_props
library: prelude
signature: nil
location: 84 0 87 999
body:
  % Judgement subtype TCC generated (at line 1654, column 4) for  converse(R)
      % expected type  (transitive?[T])
  transitive_converse: OBLIGATION
    FORALL (R: (transitive?[T])): transitive?[T](converse[T, T](R));


decl_type: tcc
theory: relation_converse_props
library: prelude
signature: nil
location: 89 0 92 999
body:
  % Judgement subtype TCC generated (at line 1657, column 4) for  converse(R)
      % expected type  (equivalence?[T])
  equivalence_converse: OBLIGATION
    FORALL (R: (equivalence?[T])): equivalence?[T](converse[T, T](R));


decl_type: tcc
theory: relation_converse_props
library: prelude
signature: nil
location: 94 0 97 999
body:
  % Judgement subtype TCC generated (at line 1660, column 4) for  converse(R)
      % expected type  (preorder?[T])
  preorder_converse: OBLIGATION
    FORALL (R: (preorder?[T])): preorder?[T](converse[T, T](R));


decl_type: tcc
theory: relation_converse_props
library: prelude
signature: nil
location: 99 0 102 999
body:
  % Judgement subtype TCC generated (at line 1663, column 4) for  converse(R)
      % expected type  (partial_order?[T])
  partial_order_converse: OBLIGATION
    FORALL (R: (partial_order?[T])): partial_order?[T](converse[T, T](R));


decl_type: tcc
theory: relation_converse_props
library: prelude
signature: nil
location: 104 0 107 999
body:
  % Judgement subtype TCC generated (at line 1666, column 4) for  converse(R)
      % expected type  (strict_order?[T])
  strict_order_converse: OBLIGATION
    FORALL (R: (strict_order?[T])): strict_order?[T](converse[T, T](R));


decl_type: tcc
theory: relation_converse_props
library: prelude
signature: nil
location: 109 0 112 999
body:
  % Judgement subtype TCC generated (at line 1669, column 4) for  converse(R)
      % expected type  (dichotomous?[T])
  dichotomous_converse: OBLIGATION
    FORALL (R: (dichotomous?[T])): dichotomous?[T](converse[T, T](R));


decl_type: tcc
theory: relation_converse_props
library: prelude
signature: nil
location: 114 0 117 999
body:
  % Judgement subtype TCC generated (at line 1672, column 4) for  converse(R)
      % expected type  (total_order?[T])
  total_order_converse: OBLIGATION
    FORALL (R: (total_order?[T])): total_order?[T](converse[T, T](R));


decl_type: tcc
theory: relation_converse_props
library: prelude
signature: nil
location: 119 0 122 999
body:
  % Judgement subtype TCC generated (at line 1675, column 4) for  converse(R)
      % expected type  (trichotomous?[T])
  trichotomous_converse: OBLIGATION
    FORALL (R: (trichotomous?[T])): trichotomous?[T](converse[T, T](R));


decl_type: tcc
theory: relation_converse_props
library: prelude
signature: nil
location: 124 0 128 999
body:
  % Judgement subtype TCC generated (at line 1678, column 4) for  converse(R)
      % expected type  (strict_total_order?[T])
  strict_total_order_converse: OBLIGATION
    FORALL (R: (strict_total_order?[T])):
      strict_total_order?[T](converse[T, T](R));


decl_type: function
theory: stdfmap
library: prelude
signature:
  [[IStream, [IStream -> string], T, [[string, T] -> T], nat] ->
  T]

location: 8 2 19 13
body:
    fmap(f:IStream,fread:[IStream->string],t:T,st:[[string,T]->T],n:nat) : 
      RECURSIVE T =
      IF fopen?(f) THEN
        IF n=0 or eof?(f) THEN t
        ELSE
          LET s  = fread(f) IN
          LET nt = st(s,t) IN
            fmap(f,fread,nt,st,n-1)
        ENDIF
      ELSE throw(ClosedStream,fname(f))
      ENDIF
      MEASURE n


decl_type: function
theory: stdfmap
library: prelude
signature: [[IStream, [IStream -> string], T, [[string, T] -> T]] -> T]
location: 22 2 25 22
body:
    fmap(f:IStream,fread:[IStream->string],t:T,st:[[string,T]->T]) : T =
      let l  = flength(f) in
      let nt = fmap(f,fread,t,st,l) in  
      prog(fclose(f),nt)


decl_type: function
theory: stdfmap
library: prelude
signature: [[IStream, T, [[string, T] -> T]] -> T]
location: 28 2 31 22
body:
    fmap_line(f:IStream,t:T,st:[[string,T]->T]):T =
      let l  = flength(f) in
      let nt = fmap(f,fread_line,t,st,l) in  
      prog(fclose(f),nt)


decl_type: tcc
theory: stdfmap
library: prelude
signature: nil
location: 45 0 53 999
body:
  % Subtype TCC generated (at line 7004, column 29) for  n - 1
      % expected type  nat
  fmap_TCC1: OBLIGATION
    FORALL (f: IStream, fread: [IStream -> string], t: T,
            st: [[string, T] -> T], n: nat):
      NOT n = 0 AND NOT eof?(f) AND fopen?(f) IMPLIES
       (FORALL (s: string):
          s = fread(f) IMPLIES
           (FORALL (nt: T): nt = st(s, t) IMPLIES n - 1 >= 0));


decl_type: tcc
theory: stdfmap
library: prelude
signature: nil
location: 55 0 63 999
body:
  % Termination TCC generated (at line 7004, column 10) for
      % fmap(f, fread, nt, st, n - 1)
  fmap_TCC2: OBLIGATION
    FORALL (f: IStream, fread: [IStream -> string], t: T,
            st: [[string, T] -> T], n: nat):
      NOT n = 0 AND NOT eof?(f) AND fopen?(f) IMPLIES
       (FORALL (s: string):
          s = fread(f) IMPLIES
           (FORALL (nt: T): nt = st(s, t) IMPLIES n - 1 < n));


decl_type: type
theory: stdsys
library: prelude
signature: nil
location: 7 2 17 4
body:
    Time : TYPE = [# 
      second : below(60),
      minute : below(60),
      hour   : below(24),
      day    : subrange(1,31),
      month  : subrange(1,12),
      year   : nat,
      dow    : below(7), % Day of week: 0 Monday
      dst    : bool,     % Dayligth saving time?
      tz     : {x:rat| -24 <= x AND x <= 24} % Time zone 
    #]


decl_type: function
theory: stdsys
library: prelude
signature: [below(7) -> string]
location: 31 2 39 9
body:
    days_of_week(dow:below(7)):string =
      if    dow=0 then "Monday"
      elsif dow=1 then "Tuesday"
      elsif dow=2 then "Wednesday"
      elsif dow=3 then "Thursday" 
      elsif dow=4 then "Friday"
      elsif dow=5 then "Saturday"
      else  "Sunday"
      endif


decl_type: function
theory: stdsys
library: prelude
signature: [subrange(1, 12) -> string]
location: 41 2 54 9
body:
    months(month:subrange(1,12)):string =
      if    month=1  then "January"
      elsif month=2  then "February"
      elsif month=3  then "March"
      elsif month=4  then "April"
      elsif month=5  then "May"
      elsif month=6  then "June"
      elsif month=7  then "July"
      elsif month=8  then "August"
      elsif month=9  then "September"
      elsif month=10 then "October"
      elsif month=11 then "November"
      else "December"
      endif


decl_type: function
theory: stdsys
library: prelude
signature: [Time -> string]
location: 56 2 60 29
body:
    tostr(t:Time): string =
      days_of_week(dow(t))+" "+months(month(t))+
      format(" ~2,'0d ",day(t))+year(t)+
      format(", ~2,'0d:~2,'0d:~2,'0d ",(hour(t),minute(t),second(t)))+
      format("(GMT~@d)",-tz(t))


decl_type: constant
theory: stdsys
library: prelude
signature: Time
location: 19 2 29 4
body:
    tinybang : Time = (#
      day    := 1,
      dow    := 0,
      dst    := false,
      hour   := 0,
      minute := 0,
      month  := 1,
      second := 0,
      tz     := 0,
      year   := 0
    #)


decl_type: function
theory: bv_concat_def
library: prelude
signature: [[bvec[n], bvec[m]] -> bvec[n + m]]
location: 21 2 24 39
body:
    o(bvn: bvec[n], bvm: bvec[m]): bvec[n+m] =
         (LAMBDA (nm: below(n+m)): IF nm < m THEN bvm(nm)
                                   ELSE bvn(nm - m)
                                   ENDIF)


decl_type: tcc
theory: bv_concat_def
library: prelude
signature: nil
location: 31 0 34 999
body:
  % Subtype TCC generated (at line 5319, column 42) for  nm - m
      % expected type  below(n)
  oh_TCC1: OBLIGATION
    FORALL (nm: below(n + m)): NOT nm < m IMPLIES nm - m >= 0 AND nm - m < n;


decl_type: formula
theory: function_inverse_def
library: prelude
signature: nil
location: 59 2 60 76
body:
    injective_inverse_alt: LEMMA
      FORALL (f: (injective?[D, R])), (g: (inverse?(f))): r = f(d) => g(r) = d


decl_type: formula
theory: function_inverse_def
library: prelude
signature: nil
location: 62 2 63 67
body:
    comp_inverse_left_inj_alt: LEMMA
      FORALL (f: (injective?[D, R])), (g: (inverse?(f))): g(f(d)) = d


decl_type: formula
theory: function_inverse_def
library: prelude
signature: nil
location: 76 2 77 77
body:
    surj_right_alt: LEMMA
      FORALL (f: (surjective?[D, R])), (g: (inverse?(f))): right_inverse?(g, f)


decl_type: formula
theory: function_inverse_def
library: prelude
signature: nil
location: 82 2 83 77
body:
    surjective_inverse_alt: LEMMA
      FORALL (f: (surjective?[D, R])), (g: (inverse?(f))): g(r) = d => r = f(d)


decl_type: formula
theory: function_inverse_def
library: prelude
signature: nil
location: 85 2 86 68
body:
    comp_inverse_right_surj_alt: LEMMA
      FORALL (f: (surjective?[D, R])), (g: (inverse?(f))): f(g(r)) = r


decl_type: formula
theory: function_inverse_def
library: prelude
signature: nil
location: 93 2 96 38
body:
    left_right_bij: COROLLARY
      FORALL f, g:
        right_inverse?(g, f) AND left_inverse?(g, f) =>
         bijective?(f) AND bijective?(g)


decl_type: formula
theory: function_inverse_def
library: prelude
signature: nil
location: 98 2 100 50
body:
    bij_left_right: COROLLARY
      FORALL (f: (bijective?[D, R])), (g: (inverse?(f))):
        right_inverse?(g, f) AND left_inverse?(g, f)


decl_type: formula
theory: function_inverse_def
library: prelude
signature: nil
location: 102 2 103 69
body:
    bij_inv_is_bij_alt: COROLLARY
      FORALL (f: (bijective?[D, R])), (g: (inverse?(f))): bijective?(g)


decl_type: formula
theory: function_inverse_def
library: prelude
signature: nil
location: 105 2 106 77
body:
    bijective_inverse_alt: COROLLARY
      FORALL (f: (bijective?[D, R])), (g: (inverse?(f))): g(r) = d IFF r = f(d)


decl_type: formula
theory: function_inverse_def
library: prelude
signature: nil
location: 108 2 109 67
body:
    comp_inverse_right_alt: COROLLARY
      FORALL (f: (bijective?[D, R])), (g: (inverse?(f))): f(g(r)) = r


decl_type: formula
theory: function_inverse_def
library: prelude
signature: nil
location: 111 2 112 67
body:
    comp_inverse_left_alt: COROLLARY
      FORALL (f: (bijective?[D, R])), (g: (inverse?(f))): g(f(d)) = d


decl_type: formula
theory: function_inverse_def
library: prelude
signature: nil
location: 122 2 124 56
body:
    exists_inv2: LEMMA
      (EXISTS (f: (surjective?[D, R])): TRUE) =>
         ((EXISTS (d: D): TRUE) OR (FORALL (r: R): FALSE))


decl_type: formula
theory: function_inverse_def
library: prelude
signature: nil
location: 125 2 127 56
body:
    exists_inv3: LEMMA
      (EXISTS f: NOT injective?(f)) =>
         ((EXISTS (d: D): TRUE) OR (FORALL (r: R): FALSE))


decl_type: formula
theory: measure_induction
library: prelude
signature: nil
location: 7 1 12 34
body:
   measure_induction: LEMMA
    (FORALL (p: pred[T]):
       (FORALL (x: T): 
           (FORALL (y: T): m(y) < m(x) IMPLIES  p(y))
               IMPLIES p(x))
      IMPLIES (FORALL (x: T): p(x)))


decl_type: tcc
theory: functions
library: prelude
signature: nil
location: 59 0 61 999
body:
  % Judgement subtype TCC generated (at line 270, column 24) for  x
      % expected type  (injective?)
  bij_is_inj: OBLIGATION FORALL (x: (bijective?)): injective?(x);


decl_type: tcc
theory: functions
library: prelude
signature: nil
location: 63 0 65 999
body:
  % Judgement subtype TCC generated (at line 272, column 25) for  x
      % expected type  (surjective?)
  bij_is_surj: OBLIGATION FORALL (x: (bijective?)): surjective?(x);


decl_type: formula
theory: floor_ceil
library: prelude
signature: nil
location: 53 2 54 81
body:
    floor_plus: LEMMA 
          floor(x + y) = floor(x) + floor(y) + floor(fractional(x) + fractional(y))


decl_type: formula
theory: floor_ceil
library: prelude
signature: nil
location: 56 2 57 85
body:
    ceiling_plus: LEMMA
          ceiling(x + y) = floor(x) + floor(y) + ceiling(fractional(x) + fractional(y))


decl_type: formula
theory: floor_ceil
library: prelude
signature: nil
location: 67 2 68 70
body:
    floor_small: LEMMA  abs(i) < abs(j) IMPLIES
                           floor(i/j) = IF i/j >= 0 THEN 0 ELSE -1 ENDIF


decl_type: tcc
theory: floor_ceil
library: prelude
signature: nil
location: 83 0 86 999
body:
  % Existence TCC generated (at line 3334, column 2) for
      % floor(x): {i | i <= x & x < i + 1}
  floor_TCC1: OBLIGATION
    EXISTS (x1: [x: real -> {i | i <= x & x < 1 + i}]): TRUE;


decl_type: tcc
theory: floor_ceil
library: prelude
signature: nil
location: 88 0 91 999
body:
  % Subtype TCC generated (at line 3336, column 40) for  x - floor(x)
      % expected type  {x | 0 <= x & x < 1}
  fractional_TCC1: OBLIGATION
    FORALL (x: real): 0 <= x - floor(x) & x - floor(x) < 1;


decl_type: tcc
theory: floor_ceil
library: prelude
signature: nil
location: 93 0 96 999
body:
  % Existence TCC generated (at line 3338, column 2) for
      % ceiling(x): {i | x <= i & i < x + 1}
  ceiling_TCC1: OBLIGATION
    EXISTS (x1: [x: real -> {i | x <= i & i < 1 + x}]): TRUE;


decl_type: tcc
theory: floor_ceil
library: prelude
signature: nil
location: 98 0 100 999
body:
  % Judgement subtype TCC generated (at line 3348, column 33) for  floor(x)
      % expected type  nat
  nonneg_floor_is_nat: OBLIGATION FORALL (x: nonneg_real): floor(x) >= 0;


decl_type: tcc
theory: floor_ceil
library: prelude
signature: nil
location: 102 0 104 999
body:
  % Judgement subtype TCC generated (at line 3349, column 35) for  ceiling(x)
      % expected type  nat
  nonneg_ceiling_is_nat: OBLIGATION FORALL (x: nonneg_real): ceiling(x) >= 0;


decl_type: formula
theory: infinite_sets_def
library: prelude
signature: nil
location: 45 2 47 66
body:
    infinite_union: THEOREM
      FORALL S, R:
        is_infinite(union(S, R)) => is_infinite(S) OR is_infinite(R)


decl_type: formula
theory: infinite_sets_def
library: prelude
signature: nil
location: 49 2 51 74
body:
    infinite_intersection: THEOREM
      FORALL S, R:
        is_infinite(intersection(S, R)) => is_infinite(S) AND is_infinite(R)


decl_type: tcc
theory: infinite_sets_def
library: prelude
signature: nil
location: 65 0 67 999
body:
  % Judgement subtype TCC generated (at line 5914, column 31) for  x
      % expected type  (nonempty?[T])
  infinite_nonempty: OBLIGATION FORALL (x: infinite_set): nonempty?[T](x);


decl_type: tcc
theory: infinite_sets_def
library: prelude
signature: nil
location: 69 0 71 999
body:
  % Judgement subtype TCC generated (at line 5916, column 26) for  add(t, Inf)
      % expected type  infinite_set
  infinite_add: OBLIGATION FORALL (Inf, t): NOT is_finite[T](add[T](t, Inf));


decl_type: tcc
theory: infinite_sets_def
library: prelude
signature: nil
location: 73 0 77 999
body:
  % Judgement subtype TCC generated (at line 5918, column 29) for
      % remove(t, Inf)
      % expected type  infinite_set
  infinite_remove: OBLIGATION
    FORALL (Inf, t): NOT is_finite[T](remove[T](t, Inf));


decl_type: tcc
theory: infinite_sets_def
library: prelude
signature: nil
location: 79 0 83 999
body:
  % Judgement subtype TCC generated (at line 5922, column 33) for
      % union(Inf, S)
      % expected type  infinite_set
  infinite_union_left: OBLIGATION
    FORALL (Inf, S): NOT is_finite[T](union[T](Inf, S));


decl_type: tcc
theory: infinite_sets_def
library: prelude
signature: nil
location: 85 0 89 999
body:
  % Judgement subtype TCC generated (at line 5923, column 34) for
      % union(S, Inf)
      % expected type  infinite_set
  infinite_union_right: OBLIGATION
    FORALL (Inf, S): NOT is_finite[T](union[T](S, Inf));


decl_type: tcc
theory: infinite_sets_def
library: prelude
signature: nil
location: 91 0 95 999
body:
  % Judgement subtype TCC generated (at line 5933, column 33) for
      % difference(Inf, Fin)
      % expected type  infinite_set
  infinite_difference: OBLIGATION
    FORALL (Fin, Inf): NOT is_finite[T](difference[T](Inf, Fin));


decl_type: tcc
theory: infinite_sets_def
library: prelude
signature: nil
location: 97 0 99 999
body:
  % Judgement subtype TCC generated (at line 5935, column 27) for  rest(Inf)
      % expected type  infinite_set
  infinite_rest: OBLIGATION FORALL (Inf): NOT is_finite[T](rest[T](Inf));


decl_type: formula
theory: KernelDefinition
library: prelude
signature: nil
location: 20 2 21 73
body:
    PreservesEq_is_preserving: LEMMA
      PreservesEq(R) = preserves(restrict[[X, X], [X1, X1], bool](R), =[Y])


decl_type: tcc
theory: KernelDefinition
library: prelude
signature: nil
location: 28 0 32 999
body:
  % Subtype TCC generated (at line 6126, column 4) for
      % {x1, x2 | f(x1) = f(x2)}
      % expected type  equivalence[X1]
  EquivalenceKernel_TCC1: OBLIGATION
    FORALL (f: [X1 -> Y]): equivalence?[X1]({x1, x2 | f(x1) = f(x2)});


decl_type: formula
theory: stdtokenizer
library: prelude
signature: nil
location: 155 2 158 46
body:
    pos_go_next : LEMMA
      FORALL (t1:Tokenizer):
        LET t2= go_next(t1) IN
        NOT error?(t2) IMPLIES t2`pos = t1`pos+1


decl_type: formula
theory: stdtokenizer
library: prelude
signature: nil
location: 174 2 177 46
body:
    pos_accept_word : LEMMA
      FORALL (t1:Tokenizer,test:[string->bool]):
        LET t2= accept_word(t1,test) IN
        NOT error?(t2) IMPLIES t2`pos = t1`pos+1


decl_type: formula
theory: stdtokenizer
library: prelude
signature: nil
location: 210 2 213 46
body:
    pos_accept_int : LEMMA
      FORALL (t1:Tokenizer,test:[int->bool]):
        LET t2= accept_int(t1,test) IN
        NOT error?(t2) IMPLIES t2`pos = t1`pos+1


decl_type: formula
theory: stdtokenizer
library: prelude
signature: nil
location: 239 2 242 46
body:
    pos_accept_real : LEMMA
      FORALL (t1:Tokenizer,test:[real->bool]):
        LET t2= accept_real(t1,test) IN
        NOT error?(t2) IMPLIES t2`pos = t1`pos+1


decl_type: type
theory: stdtokenizer
library: prelude
signature: nil
location: 20 2 30 4
body:
    Tokenizer : TYPE = [#
      stream   : ARRAY[nat->string],
      lines    : ARRAY[nat->nat],
      casesen  : boolean,
      separ    : string,
      error    : int,
      val_int  : int,
      val_real : real,
      length   : nat,
      pos      : upto(length)
    #]


decl_type: function
theory: stdtokenizer
library: prelude
signature: [[bool, string] -> Tokenizer]
location: 32 2 42 4
body:
    init_tokenizer(casesen:bool,separ:string) : Tokenizer = (#
      stream   := LAMBDA(x:nat):emptystr,
      lines    := LAMBDA(x:nat):0,
      casesen  := casesen,
      separ    := separ,
      error    := NoError,
      val_int  := 0,
      val_real := 0, 
      length   := 0,
      pos      := 0
    #)


decl_type: function
theory: stdtokenizer
library: prelude
signature: [Tokenizer -> string]
location: 70 2 73 9
body:
    last_token(t:Tokenizer): string =
      IF t`pos = 0 THEN emptystr
      ELSE t`stream(t`pos-1)
      ENDIF


decl_type: function
theory: stdtokenizer
library: prelude
signature: [[t: Tokenizer, upto(t`length)] -> string]
location: 81 2 88 24
body:
    tostr(t:Tokenizer,i:upto(t`length)) : RECURSIVE string =
      IF i = t`length THEN emptystr
      ELSIF i=t`pos THEN
        "["+t`stream(i)+"] " + tostr(t,i+1)
      ELSE 
        t`stream(i)+space + tostr(t,i+1)
      ENDIF
      MEASURE t`length - i


decl_type: function
theory: stdtokenizer
library: prelude
signature: [[string, Tokenizer, nat] -> Tokenizer]
location: 90 2 94 32
body:
    add_token(s:string,t:Tokenizer,l:nat): MACRO Tokenizer =
      LET n = t`length IN
      t WITH [`stream(n) := s,
              `lines(n)  := l,
              `length    := n + 1]


decl_type: function
theory: stdtokenizer
library: prelude
signature: [[string, [Tokenizer, nat]] -> [Tokenizer, nat]]
location: 98 2 103 28
body:
    line_tokenizer(s:string,tl:[Tokenizer,nat]):[Tokenizer,nat] =
      LET (t,l) = tl IN
      LET g = fopenin(str,s) IN
      LET f = (LAMBDA(mys:string,myt:Tokenizer):add_token(mys,myt,l)) IN
      LET nt = fmap(g,read_token(t),t,f,length(s)) IN
      prog(fclose(g),(nt,l+1))


decl_type: function
theory: stdtokenizer
library: prelude
signature: [[string, Tokenizer] -> Tokenizer]
location: 106 2 118 9
body:
    file2tokenizer(s:string,t:Tokenizer):Tokenizer=
      IF fexists(s) THEN 
        LET (nt,l) = fmap_line(fopenin(s),
                               (t,1),
                               line_tokenizer) IN 
          nt
      ELSE        
        LET filename = s IN
        t WITH [
          `stream(0) := filename,
          `error     := FileNotFound
        ]
      ENDIF


decl_type: function
theory: stdtokenizer
library: prelude
signature: [[string, Tokenizer] -> Tokenizer]
location: 124 2 127 10
body:
    str2tokenizer(s:string,t:Tokenizer):Tokenizer= 
      LET f = fopenin(str,s) IN
      LET (nt,l) = fmap_line(f,(t,1),line_tokenizer) IN 
          nt


decl_type: function
theory: stdtokenizer
library: prelude
signature: [d: [Tokenizer, posnat] -> TokenizerOfLength(d`1`length)]
location: 138 2 144 9
body:
    consume(t:Tokenizer,n:posnat) : TokenizerOfLength(t`length) = 
      IF error?(t) THEN t
      ELSIF eot?(t) OR t`pos + n > t`length THEN 
        t WITH [`error := EndOfTokenizer]
      ELSE 
        t WITH [`pos := t`pos + n]
      ENDIF


decl_type: function
theory: stdtokenizer
library: prelude
signature: [t: Tokenizer -> TokenizerOfLength(t`length)]
location: 149 2 153 9
body:
    go_back(t:Tokenizer) : TokenizerOfLength(t`length) = 
      IF t`pos = 0 THEN t
      ELSE 
        t WITH [`pos := t`pos - 1]
      ENDIF


decl_type: function
theory: stdtokenizer
library: prelude
signature:
  [d: [Tokenizer, [string -> bool]] ->
  TokenizerOfLength(d`1`length)]

location: 161 2 172 9
body:
    accept_word(t:Tokenizer,test:[string->bool])
      : TokenizerOfLength(t`length) =
      IF error?(t) THEN t
      ELSIF eot?(t) THEN 
        t WITH [`error := EndOfTokenizer]
      ELSIF number?(t`stream(t`pos)) THEN
        t WITH [`error := ExpectingWord]
      ELSIF test(t`stream(t`pos)) THEN 
        t WITH [`pos := t`pos + 1]
      ELSE 
        t WITH [`error := ExpectingTestWord]
      ENDIF


decl_type: function
theory: stdtokenizer
library: prelude
signature: [d: [Tokenizer, string] -> TokenizerOfLength(d`1`length)]
location: 183 2 184 30
body:
    accept_word(t:Tokenizer,s:string) : MACRO TokenizerOfLength(t`length) =
      accept_word(t,the_word(s))


decl_type: function
theory: stdtokenizer
library: prelude
signature:
  [d: [Tokenizer, [int -> bool]] ->
  TokenizerOfLength(d`1`length)]

location: 193 2 208 9
body:
    accept_int(t:Tokenizer,test:[int->bool])
      : TokenizerOfLength(t`length) =
      IF error?(t) THEN t
      ELSIF eot?(t) THEN 
        t WITH [`error := EndOfTokenizer]
      ELSIF NOT int?(t`stream(t`pos)) THEN
        t WITH [`error := ExpectingInt]
      ELSE
        LET i = str2int(t`stream(t`pos)) IN
        IF test(i) THEN 
          t WITH [`pos := t`pos + 1, `val_int := i, `val_real := i]

        ELSE 
          t WITH [`error := ExpectingTestInt]
        ENDIF
      ENDIF


decl_type: function
theory: stdtokenizer
library: prelude
signature:
  [d: [Tokenizer, [real -> bool]] ->
  TokenizerOfLength(d`1`length)]

location: 222 2 237 9
body:
    accept_real(t:Tokenizer,test:[real->bool])
      : TokenizerOfLength(t`length) =
      IF error?(t) THEN t
      ELSIF eot?(t) THEN 
        t WITH [`error := EndOfTokenizer]
      ELSIF NOT number?(t`stream(t`pos)) THEN
        t WITH [`error := ExpectingReal]
      ELSE
        LET r = str2real(t`stream(t`pos)) IN
        IF test(r) THEN 
          t WITH [`pos := t`pos + 1, `val_real := r]

        ELSE 
          t WITH [`error := ExpectingTestReal]
        ENDIF
      ENDIF


decl_type: function
theory: stdtokenizer
library: prelude
signature: [Tokenizer -> [int -> string]]
location: 254 2 279 9
body:
    std_mssg(t:Tokenizer)(code:int):string =
      IF    code <= 0 THEN emptystr
      ELSIF code = FileNotFound THEN
        "File not found: "+doublequote+next_token(t)+doublequote+"."
      ELSIF code = EndOfTokenizer THEN
        "Found EOT."
      ELSIF code = InvalidToken THEN 
        "Invalid Token: "+doublequote+next_token(t)+doublequote+"."
      ELSIF code = ExpectingWord THEN 
        "Expecting a word. Found: "+doublequote+next_token(t)+doublequote+"."
      ELSIF code = ExpectingTestWord THEN 
        "Expecting word that satisfies test. Found: "+doublequote+next_token(t)+
        doublequote+"."
      ELSIF code = ExpectingInt THEN 
        "Expecting an integer. Found: "+doublequote+next_token(t)+doublequote+"."
      ELSIF code = ExpectingTestInt THEN 
        "Expecting integer that satisfies test. Found: "+
        doublequote+next_token(t)+doublequote+"."
      ELSIF code = ExpectingReal THEN 
        "Expecting a real. Found: "+doublequote+next_token(t)+doublequote+"."
      ELSIF code = ExpectingTestReal THEN 
        "Expecting real that satisfies test. Found: "+doublequote+next_token(t)+
        doublequote+"."
      ELSE
        emptystr
      ENDIF


decl_type: function
theory: stdtokenizer
library: prelude
signature: [[Tokenizer, Messenger] -> void]
location: 281 2 287 9
body:
    print_error(t:Tokenizer,m:Messenger): MACRO void = 
      IF error?(t) THEN  
        println("Syntax Error. "+"Line "+get_line(t)+": "+m(error(t))) &
        fail
      ELSE
        skip
      ENDIF


decl_type: function
theory: stdtokenizer
library: prelude
signature: [Tokenizer -> void]
location: 289 2 292 3
body:
    print_error(t:Tokenizer): MACRO void = 
      print_error(t,std_mssg(t))

    ;*(m:Messenger,cs:[int,string]) : Messenger =


decl_type: constant
theory: stdtokenizer
library: prelude
signature: Tokenizer
location: 44 2 54 4
body:
    empty_tokenizer : Tokenizer = (#
      stream   := LAMBDA(x:nat):emptystr,
      lines    := LAMBDA(x:nat):0,
      casesen  := true,
      separ    := emptystr,
      error    := NoError,
      val_int  := 0,
      val_real := 0, 
      length   := 0,
      pos      := 0
    #)


decl_type: tcc
theory: stdtokenizer
library: prelude
signature: nil
location: 307 0 310 999
body:
  % Subtype TCC generated (at line 7139, column 4) for
      % t WITH [`error := code]
      % expected type  TokenizerOfLength(t`length)
  set_error_TCC1: OBLIGATION FORALL (t: Tokenizer): t`length = t`length;


decl_type: tcc
theory: stdtokenizer
library: prelude
signature: nil
location: 312 0 315 999
body:
  % Subtype TCC generated (at line 7144, column 18) for  t`pos - 1
      % expected type  nat
  last_token_TCC1: OBLIGATION
    FORALL (t: Tokenizer): NOT t`pos = 0 IMPLIES t`pos - 1 >= 0;


decl_type: tcc
theory: stdtokenizer
library: prelude
signature: nil
location: 317 0 319 999
body:
  % Subtype TCC generated (at line 7148, column 54) for  t`pos + n - 1
      % expected type  nat
  peek_TCC1: OBLIGATION FORALL (t: Tokenizer, n: posnat): t`pos + n - 1 >= 0;


decl_type: tcc
theory: stdtokenizer
library: prelude
signature: nil
location: 321 0 324 999
body:
  % Subtype TCC generated (at line 7160, column 12) for  t`length - i
      % expected type  naturalnumber
  tostr_TCC1: OBLIGATION
    FORALL (t: Tokenizer, i: upto(t`length)): t`length - i >= 0;


decl_type: tcc
theory: stdtokenizer
library: prelude
signature: nil
location: 326 0 330 999
body:
  % Subtype TCC generated (at line 7156, column 37) for  i + 1
      % expected type  upto(t`length)
  tostr_TCC2: OBLIGATION
    FORALL (t: Tokenizer, i: upto(t`length)):
      i = t`pos AND NOT i = t`length IMPLIES i + 1 <= t`length;


decl_type: tcc
theory: stdtokenizer
library: prelude
signature: nil
location: 332 0 336 999
body:
  % Termination TCC generated (at line 7156, column 29) for  tostr(t, i + 1)
  tostr_TCC3: OBLIGATION
    FORALL (t: Tokenizer, i: upto(t`length)):
      i = t`pos AND NOT i = t`length IMPLIES
       t`length - (i + 1) < t`length - i;


decl_type: tcc
theory: stdtokenizer
library: prelude
signature: nil
location: 338 0 342 999
body:
  % Subtype TCC generated (at line 7158, column 34) for  i + 1
      % expected type  upto(t`length)
  tostr_TCC4: OBLIGATION
    FORALL (t: Tokenizer, i: upto(t`length)):
      NOT i = t`pos AND NOT i = t`length IMPLIES i + 1 <= t`length;


decl_type: tcc
theory: stdtokenizer
library: prelude
signature: nil
location: 344 0 348 999
body:
  % Termination TCC generated (at line 7158, column 26) for  tostr(t, i + 1)
  tostr_TCC5: OBLIGATION
    FORALL (t: Tokenizer, i: upto(t`length)):
      NOT i = t`pos AND NOT i = t`length IMPLIES
       t`length - (i + 1) < t`length - i;


decl_type: tcc
theory: stdtokenizer
library: prelude
signature: nil
location: 350 0 353 999
body:
  % Subtype TCC generated for  t`pos
      % expected type  upto(1 + n)
  add_token_TCC1: OBLIGATION
    FORALL (t: Tokenizer, n: nat): n = t`length IMPLIES t`pos <= 1 + n;


decl_type: tcc
theory: stdtokenizer
library: prelude
signature: nil
location: 355 0 362 999
body:
  % Subtype TCC generated for  myt`pos
      % expected type  upto(1 + myt`length)
  line_tokenizer_TCC1: OBLIGATION
    FORALL (s: string, tl: [Tokenizer, nat], t: Tokenizer, l: nat):
      l = tl`2 AND t = tl`1 IMPLIES
       (FORALL (g: IStream):
          g = fopenin(str, s) IMPLIES
           (FORALL (myt: Tokenizer): myt`pos <= 1 + myt`length));


decl_type: tcc
theory: stdtokenizer
library: prelude
signature: nil
location: 364 0 392 999
body:
  % Subtype TCC generated (at line 7175, column 4) for
      % prog(fclose(g), (nt, l + 1))
      % expected type  [Tokenizer, nat]
  line_tokenizer_TCC2: OBLIGATION
    FORALL (s: string, tl: [Tokenizer, nat], t: Tokenizer, l: nat):
      l = tl`2 AND t = tl`1 IMPLIES
       (FORALL (g: IStream):
          g = fopenin(str, s) IMPLIES
           (FORALL (f: [[string, Tokenizer] -> Tokenizer]):
              (f =
                (LAMBDA (mys: string, myt: Tokenizer):
                   myt
                     WITH [`stream(myt`length) := mys,
                           `lines(myt`length) := l,
                           `length := myt`length + 1]))
               IMPLIES
               (FORALL (nt: Tokenizer):
                  nt = fmap(g, read_token(t), t, f, length(s)) IMPLIES
                   real_pred(prog[[Tokenizer, numfield]]
                                 (fclose(g), (nt, l + 1))`2)
                    AND
                    rational_pred(prog[[Tokenizer, numfield]]
                                      (fclose(g), (nt, l + 1))`2)
                     AND
                     integer_pred(prog[[Tokenizer, numfield]]
                                      (fclose(g), (nt, l + 1))`2)
                      AND
                      prog[[Tokenizer, numfield]](fclose(g), (nt, l + 1))`2
                       >= 0)));


decl_type: tcc
theory: stdtokenizer
library: prelude
signature: nil
location: 394 0 399 999
body:
  % Subtype TCC generated (at line 7215, column 22) for  t`pos + n
      % expected type  upto(t`length)
  consume_TCC1: OBLIGATION
    FORALL (t: Tokenizer, n: posnat):
      NOT eot?(t) AND NOT t`pos + n > t`length AND NOT t`error /= NoError
       IMPLIES t`pos + n <= t`length;


decl_type: tcc
theory: stdtokenizer
library: prelude
signature: nil
location: 401 0 405 999
body:
  % Subtype TCC generated (at line 7224, column 22) for  t`pos - 1
      % expected type  upto(t`length)
  go_back_TCC1: OBLIGATION
    FORALL (t: Tokenizer):
      NOT t`pos = 0 IMPLIES t`pos - 1 >= 0 AND t`pos - 1 <= t`length;


decl_type: tcc
theory: stdtokenizer
library: prelude
signature: nil
location: 407 0 414 999
body:
  % Subtype TCC generated (at line 7241, column 22) for  t`pos + 1
      % expected type  upto(t`length)
  accept_word_TCC1: OBLIGATION
    FORALL (t: Tokenizer, test: [string -> bool]):
      test(t`stream(t`pos)) AND
       NOT number?(t`stream(t`pos)) AND
        NOT eot?(t) AND NOT t`error /= NoError
       IMPLIES t`pos + 1 <= t`length;


decl_type: tcc
theory: stdtokenizer
library: prelude
signature: nil
location: 416 0 424 999
body:
  % Subtype TCC generated (at line 7275, column 24) for  t`pos + 1
      % expected type  upto(t`length)
  accept_int_TCC1: OBLIGATION
    FORALL (t: Tokenizer, test: [int -> bool]):
      int?(t`stream(t`pos)) AND NOT eot?(t) AND NOT t`error /= NoError
       IMPLIES
       (FORALL (i: int):
          test(i) AND i = str2int(t`stream(t`pos)) IMPLIES
           t`pos + 1 <= t`length);


decl_type: tcc
theory: stdtokenizer
library: prelude
signature: nil
location: 426 0 434 999
body:
  % Subtype TCC generated (at line 7304, column 24) for  t`pos + 1
      % expected type  upto(t`length)
  accept_real_TCC1: OBLIGATION
    FORALL (t: Tokenizer, test: [real -> bool]):
      number?(t`stream(t`pos)) AND NOT eot?(t) AND NOT t`error /= NoError
       IMPLIES
       (FORALL (r: rat):
          test(r) AND r = str2real(t`stream(t`pos)) IMPLIES
           t`pos + 1 <= t`length);


decl_type: tcc
theory: stdtokenizer
library: prelude
signature: nil
location: 436 0 440 999
body:
  % Subtype TCC generated (at line 7148, column 54) for  t`pos + 1 - 1
      % expected type  nat
  std_mssg_TCC1: OBLIGATION
    FORALL (t: Tokenizer, code: int):
      code = FileNotFound AND NOT code <= 0 IMPLIES t`pos + 1 - 1 >= 0;


decl_type: tcc
theory: stdtokenizer
library: prelude
signature: nil
location: 442 0 449 999
body:
  % Subtype TCC generated (at line 7148, column 54) for  t`pos + 1 - 1
      % expected type  nat
  std_mssg_TCC2: OBLIGATION
    FORALL (t: Tokenizer, code: int):
      code = InvalidToken AND
       NOT code = EndOfTokenizer AND
        NOT code = FileNotFound AND NOT code <= 0
       IMPLIES t`pos + 1 - 1 >= 0;


decl_type: tcc
theory: stdtokenizer
library: prelude
signature: nil
location: 451 0 458 999
body:
  % Subtype TCC generated (at line 7148, column 54) for  t`pos + 1 - 1
      % expected type  nat
  std_mssg_TCC3: OBLIGATION
    FORALL (t: Tokenizer, code: int):
           code = ExpectingWord AND NOT code = InvalidToken
       AND NOT code = EndOfTokenizer AND NOT code = FileNotFound
       AND NOT code <= 0
       IMPLIES t`pos + 1 - 1 >= 0;


decl_type: tcc
theory: stdtokenizer
library: prelude
signature: nil
location: 460 0 467 999
body:
  % Subtype TCC generated (at line 7148, column 54) for  t`pos + 1 - 1
      % expected type  nat
  std_mssg_TCC4: OBLIGATION
    FORALL (t: Tokenizer, code: int):
           code = ExpectingTestWord AND NOT code = ExpectingWord
       AND NOT code = InvalidToken AND NOT code = EndOfTokenizer
       AND NOT code = FileNotFound AND NOT code <= 0
       IMPLIES t`pos + 1 - 1 >= 0;


decl_type: tcc
theory: stdtokenizer
library: prelude
signature: nil
location: 469 0 477 999
body:
  % Subtype TCC generated (at line 7148, column 54) for  t`pos + 1 - 1
      % expected type  nat
  std_mssg_TCC5: OBLIGATION
    FORALL (t: Tokenizer, code: int):
           code = ExpectingInt AND NOT code = ExpectingTestWord
       AND NOT code = ExpectingWord AND NOT code = InvalidToken
       AND NOT code = EndOfTokenizer AND NOT code = FileNotFound
       AND NOT code <= 0
       IMPLIES t`pos + 1 - 1 >= 0;


decl_type: tcc
theory: stdtokenizer
library: prelude
signature: nil
location: 479 0 487 999
body:
  % Subtype TCC generated (at line 7148, column 54) for  t`pos + 1 - 1
      % expected type  nat
  std_mssg_TCC6: OBLIGATION
    FORALL (t: Tokenizer, code: int):
           code = ExpectingTestInt AND NOT code = ExpectingInt
       AND NOT code = ExpectingTestWord AND NOT code = ExpectingWord
       AND NOT code = InvalidToken AND NOT code = EndOfTokenizer
       AND NOT code = FileNotFound AND NOT code <= 0
       IMPLIES t`pos + 1 - 1 >= 0;


decl_type: tcc
theory: stdtokenizer
library: prelude
signature: nil
location: 489 0 498 999
body:
  % Subtype TCC generated (at line 7148, column 54) for  t`pos + 1 - 1
      % expected type  nat
  std_mssg_TCC7: OBLIGATION
    FORALL (t: Tokenizer, code: int):
           code = ExpectingReal AND NOT code = ExpectingTestInt
       AND NOT code = ExpectingInt AND NOT code = ExpectingTestWord
       AND NOT code = ExpectingWord AND NOT code = InvalidToken
       AND NOT code = EndOfTokenizer AND NOT code = FileNotFound
       AND NOT code <= 0
       IMPLIES t`pos + 1 - 1 >= 0;


decl_type: tcc
theory: stdtokenizer
library: prelude
signature: nil
location: 500 0 509 999
body:
  % Subtype TCC generated (at line 7148, column 54) for  t`pos + 1 - 1
      % expected type  nat
  std_mssg_TCC8: OBLIGATION
    FORALL (t: Tokenizer, code: int):
           code = ExpectingTestReal AND NOT code = ExpectingReal
       AND NOT code = ExpectingTestInt AND NOT code = ExpectingInt
       AND NOT code = ExpectingTestWord AND NOT code = ExpectingWord
       AND NOT code = InvalidToken AND NOT code = EndOfTokenizer
       AND NOT code = FileNotFound AND NOT code <= 0
       IMPLIES t`pos + 1 - 1 >= 0;


decl_type: tcc
theory: stdtokenizer
library: prelude
signature: nil
location: 511 0 513 999
body:
  % Subtype TCC generated (at line 7368, column 12) for  0
      % expected type  upto(t`length)
  tokenizer2str_TCC1: OBLIGATION FORALL (t: Tokenizer): 0 <= t`length;


decl_type: formula
theory: PartialFunctionComposition
library: prelude
signature: nil
location: 26 2 28 57
body:
    SPartFun_to_LPartFun_CompositionPreservation : LEMMA
      SPartFun_to_LPartFun(k o h)
        = SPartFun_to_LPartFun(k) o SPartFun_to_LPartFun(h)


decl_type: formula
theory: PartialFunctionComposition
library: prelude
signature: nil
location: 30 2 32 57
body:
    LPartFun_to_SPartFun_CompositionPreservation : LEMMA
      LPartFun_to_SPartFun(g o f)
        = LPartFun_to_SPartFun(g) o LPartFun_to_SPartFun(f)


decl_type: function
theory: PartialFunctionComposition
library: prelude
signature:
  [[LiftPartialFunction[Y, Z], LiftPartialFunction[X, Y]] ->
  LiftPartialFunction[X, Z]]

location: 7 2 12 14
body:
    o(g, f) : LiftPartialFunction[X, Z] =
      LAMBDA(x : X) :
        CASES f(x) OF
          bottom : bottom,
          up(y) : g(y)
        ENDCASES


decl_type: function
theory: PartialFunctionComposition
library: prelude
signature:
  [[SubsetPartialFunction[Y, Z], SubsetPartialFunction[X, Y]] ->
  SubsetPartialFunction[X, Z]]

location: 20 2 24 6
body:
    o(k, h) : SubsetPartialFunction[X, Z] =
      (# 
        dom := CompDom(k, h),
        fun := LAMBDA(x : (CompDom(k, h))) : fun(k)(fun(h)(x))
      #)


decl_type: tcc
theory: PartialFunctionComposition
library: prelude
signature: nil
location: 39 0 44 999
body:
  % Subtype TCC generated (at line 6383, column 57) for  x
      % expected type  (h`dom)
  oh_TCC1: OBLIGATION
    FORALL (k: SubsetPartialFunction[Y, Z], h: SubsetPartialFunction[X, Y],
            x: (CompDom(k, h))):
      h`dom(x);


decl_type: tcc
theory: PartialFunctionComposition
library: prelude
signature: nil
location: 46 0 51 999
body:
  % Subtype TCC generated (at line 6383, column 50) for  fun(h)(x)
      % expected type  (k`dom)
  oh_TCC2: OBLIGATION
    FORALL (k: SubsetPartialFunction[Y, Z], h: SubsetPartialFunction[X, Y],
            x: (CompDom(k, h))):
      k`dom(fun(h)(x));


decl_type: tcc
theory: if_def
library: prelude
signature: nil
location: 15 0 17 999
body:
  % Existence TCC generated (at line 82, column 2) for
      % IF: [boolean, T, T -> T]
  IF_TCC1: OBLIGATION EXISTS (x: [[boolean, T, T] -> T]): TRUE;


decl_type: tcc
theory: identity
library: prelude
signature: nil
location: 16 0 18 999
body:
  % Subtype TCC generated (at line 429, column 27) for  (LAMBDA x: x)
      % expected type  (bijective?[T, T])
  I_TCC1: OBLIGATION bijective?[T, T]((LAMBDA x: x));


decl_type: formula
theory: indexed_sets
library: prelude
signature: nil
location: 21 2 23 58
body:
    IIntersection_intersection: LEMMA
      IIntersection(LAMBDA i: intersection(A(i), B(i)))
          = intersection(IIntersection(A), IIntersection(B))


decl_type: formula
theory: indexed_sets
library: prelude
signature: nil
location: 25 2 27 36
body:
    IUnion_intersection: LEMMA
      IUnion(LAMBDA i: intersection(A(i), S))
          = intersection(IUnion(A), S)


decl_type: formula
theory: indexed_sets
library: prelude
signature: nil
location: 29 2 31 36
body:
    IIntersection_union: LEMMA
      IIntersection(LAMBDA i: union(A(i), S))
          = union(IIntersection(A), S)


decl_type: formula
theory: stdio
library: prelude
signature: nil
location: 243 0 246 999
body:
  Mode_ord_defaxiom: AXIOM
         Mode_ord(input) = 0 AND Mode_ord(output) = 1 AND Mode_ord(create) = 2
     AND Mode_ord(append) = 3 AND Mode_ord(overwrite) = 4
     AND Mode_ord(rename) = 5 AND Mode_ord(str) = 6;


decl_type: formula
theory: stdio
library: prelude
signature: nil
location: 248 0 252 999
body:
  Mode_inclusive: AXIOM
    FORALL (Mode_var: Mode):
          input?(Mode_var) OR output?(Mode_var) OR create?(Mode_var)
       OR append?(Mode_var) OR overwrite?(Mode_var) OR rename?(Mode_var)
       OR str?(Mode_var);


decl_type: formula
theory: stdio
library: prelude
signature: nil
location: 254 0 258 999
body:
  Mode_induction: AXIOM
    FORALL (p: [Mode -> boolean]):
           p(input) AND p(output) AND p(create) AND p(append) AND p(overwrite)
       AND p(rename) AND p(str)
       IMPLIES (FORALL (Mode_var: Mode): p(Mode_var));


decl_type: function
theory: stdio
library: prelude
signature: [Mode -> upto(6)]
location: 284 0 293 999
body:
  ord(x: Mode): [Mode -> upto(6)] =
      CASES x
        OF input: 0,
           output: 1,
           create: 2,
           append: 3,
           overwrite: 4,
           rename: 5,
           str: 6
        ENDCASES


decl_type: function
theory: stdio
library: prelude
signature: [Mode -> string]
location: 86 2 94 10
body:
    mode2str(m:Mode) : string = CASES m OF
      input     : "input",
      output    : "output",
      create    : "create",
      append    : "append",
      overwrite : "overwrite",
      rename    : "rename",
      str       : "str"
    ENDCASES


decl_type: function
theory: stdio
library: prelude
signature: [[Mode, string] -> IStream]
location: 104 2 109 9
body:
    fopenin(m:Mode,s:string) : IStream = 
      IF    m = input AND length(s)=0 THEN stdin 
      ELSIF m = input THEN fopenin_lisp(s)
      ELSIF m = str   THEN sopenin(s)
      ELSE throw(WrongInputStreamMode,tostr(m))
      ENDIF


decl_type: function
theory: stdio
library: prelude
signature: [[Mode, string] -> OStream]
location: 115 2 124 9
body:
    fopenout(m:Mode,s:string): OStream =
      IF    m = output AND length(s)=0 THEN stdout
      ELSIF m = output    THEN fopenout_lisp(s,0) 
      ELSIF m = create    THEN fopenout_lisp(s,1)
      ELSIF m = append    THEN fopenout_lisp(s,2)
      ELSIF m = overwrite THEN fopenout_lisp(s,3)
      ELSIF m = rename    THEN fopenout_lisp(s,4)
      ELSIF m = str       THEN sopenout(s)
      ELSE throw(WrongOutputStreamMode,tostr(m))
      ENDIF


decl_type: function
theory: stdio
library: prelude
signature: [Stream -> string]
location: 138 2 143 9
body:
    fname(f:Stream):string =
      if filestream?(f) then 
        fname_lisp(f)
      else
        emptystr
      endif


decl_type: function
theory: stdio
library: prelude
signature: [OStream -> string]
location: 146 2 149 9
body:
    fgetstr(f:OStream):string =
      if fopen?(f) then fgetstr_lisp(f)
      else throw(ClosedStream,fname(f))
      endif


decl_type: function
theory: stdio
library: prelude
signature: [IStream -> bool]
location: 152 2 155 9
body:
    eof?(f:IStream):bool =
      if fopen?(f) then eof_lisp(f)
      else throw(ClosedStream,fname(f))
      endif


decl_type: function
theory: stdio
library: prelude
signature: [Stream -> nat]
location: 158 2 161 9
body:
    flength(f:Stream):nat =
      if fopen?(f) then flength_lisp(f)
      else throw(ClosedStream,fname(f))
      endif


decl_type: function
theory: stdio
library: prelude
signature: [Stream -> nat]
location: 164 2 167 9
body:
    fgetpos(f:Stream):nat = 
      if fopen?(f) then fgetpos_lisp(f)
      else throw(ClosedStream,fname(f))
      endif


decl_type: function
theory: stdio
library: prelude
signature: [[OStream, string] -> void]
location: 170 2 173 9
body:
    fprint(f:OStream,s:string):void = 
      if fopen?(f) then fprint_lisp(f,s)
      else throw(ClosedStream,fname(f))
      endif


decl_type: function
theory: stdio
library: prelude
signature: [[Stream, nat] -> void]
location: 178 2 181 9
body:
    fsetpos(f:Stream,n:nat):void =
      if fopen?(f) then fsetpos_lisp(f,n)
      else throw(ClosedStream,fname(f))
      endif


decl_type: function
theory: stdio
library: prelude
signature: [IStream -> bool]
location: 204 2 206 46
body:
    fcheck(f:IStream): bool = 
      (fopen?(f)   OR throw(ClosedStream,fname(f))) AND
      (NOT eof?(f) OR throw(EndOfFile,fname(f)))


decl_type: constant
theory: stdio
library: prelude
signature: list[ExceptionTag[string]]
location: 15 2 18 33
body:
    IOExceptionTags : list[ExceptionTag[string]] = 
      (: NotARealNumber, NotAnInteger, FileNotFound,
         FileAlreadyExists, WrongInputStreamMode, WrongOutputStreamMode,
         ClosedStream, EndOfFile :)


decl_type: function
theory: stdcatch
library: prelude
signature:
  [[ExceptionTag[T2], [Dummy -> T1], [Exception[T2] -> T1]] ->
  T1]

location: 7 2 9 41
body:
    catch_lift(tag:ExceptionTag[T2],
               t1:[Dummy->T1],
               t2:[Exception[T2]->T1]) : T1


decl_type: function
theory: stdcatch
library: prelude
signature: [[ExceptionTag[T2], T1, [Exception[T2] -> T1]] -> T1]
location: 11 2 14 41
body:
    catch(tag:ExceptionTag[T2],
          t1:T1,
          t2:[Exception[T2]->T1]) : MACRO T1 =
      catch_lift(tag,LAMBDA(d:Dummy):t1,t2)


decl_type: function
theory: stdcatch
library: prelude
signature:
  [[list[ExceptionTag[T2]], [Dummy -> T1], [Exception[T2] -> T1]] ->
  T1]

location: 16 2 25 19
body:
    catch_list_lift(l:list[ExceptionTag[T2]],
                    f1:[Dummy->T1],
                    f2:[Exception[T2]->T1]) : RECURSIVE T1 =
      CASES l OF
        null : f1(dummy),
        cons(e,r) : catch_lift(e,
                               LAMBDA(d:Dummy):catch_list_lift(r,f1,f2),
                               f2)
      ENDCASES
      MEASURE l BY <<  


decl_type: function
theory: stdcatch
library: prelude
signature: [[list[ExceptionTag[T2]], T1, [Exception[T2] -> T1]] -> T1]
location: 27 2 28 44
body:
    catch(l:list[ExceptionTag[T2]],t1:T1,t2:[Exception[T2]->T1]) : MACRO T1 =
      catch_list_lift(l,LAMBDA(d:Dummy):t1,t2)


decl_type: tcc
theory: stdcatch
library: prelude
signature: nil
location: 40 0 45 999
body:
  % Termination TCC generated (at line 6461, column 45) for
      % catch_list_lift(r, f1, f2)
  catch_list_lift_TCC1: OBLIGATION
    FORALL (l: list[ExceptionTag[T2]], e: ExceptionTag[T2],
            r: list[ExceptionTag[T2]]):
      l = cons(e, r) IMPLIES <<[ExceptionTag[T2]](r, l);


decl_type: tcc
theory: restrict
library: prelude
signature: nil
location: 27 0 30 999
body:
  % Judgement subtype TCC generated (at line 332, column 4) for  restrict(f)
      % expected type  (injective?[S, R])
  restrict_of_inj_is_inj: OBLIGATION
    FORALL (f: (injective?[T, R])): injective?[S, R](restrict(f));


decl_type: tcc
theory: reals
library: prelude
signature: nil
location: 62 0 64 999
body:
  % Judgement subtype TCC generated (at line 1854, column 37) for  x + y
      % expected type  real
  real_plus_real_is_real: OBLIGATION FORALL (x, y): real_pred(x + y);


decl_type: tcc
theory: reals
library: prelude
signature: nil
location: 66 0 68 999
body:
  % Judgement subtype TCC generated (at line 1855, column 37) for  x - y
      % expected type  real
  real_minus_real_is_real: OBLIGATION FORALL (x, y): real_pred(x - y);


decl_type: tcc
theory: reals
library: prelude
signature: nil
location: 70 0 72 999
body:
  % Judgement subtype TCC generated (at line 1856, column 37) for  x * y
      % expected type  real
  real_times_real_is_real: OBLIGATION FORALL (x, y): real_pred(x * y);


decl_type: tcc
theory: reals
library: prelude
signature: nil
location: 74 0 76 999
body:
  % Judgement subtype TCC generated (at line 1857, column 37) for  x / n0z
      % expected type  real
  real_div_nzreal_is_real: OBLIGATION FORALL (n0z, x): real_pred(x / n0z);


decl_type: tcc
theory: reals
library: prelude
signature: nil
location: 78 0 80 999
body:
  % Judgement subtype TCC generated (at line 1859, column 32) for  -x
      % expected type  real
  minus_real_is_real: OBLIGATION FORALL (x): real_pred(-x);


decl_type: function
theory: integers
library: prelude
signature: [number -> bool]
location: 11 2 13 46
body:
    integer?(n:number): bool =
      number_field_pred(n) AND real_pred(n)
        AND rational_pred(n) AND integer_pred(n)


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 121 0 123 999
body:
  % Subtype TCC generated (at line 2161, column 58) for  i
      % expected type  upfrom(i)
  upfrom_TCC1: OBLIGATION FORALL (i: int): i >= i;


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 125 0 127 999
body:
  % Subtype TCC generated (at line 2162, column 57) for  i + 1
      % expected type  above(i)
  above_TCC1: OBLIGATION FORALL (i: int): integer_pred(i + 1) AND i + 1 > i;


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 129 0 131 999
body:
  % Judgement subtype TCC generated (at line 2164, column 34) for  i + j
      % expected type  int
  int_plus_int_is_int: OBLIGATION FORALL (i, j): integer_pred(i + j);


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 133 0 135 999
body:
  % Judgement subtype TCC generated (at line 2165, column 34) for  i - j
      % expected type  int
  int_minus_int_is_int: OBLIGATION FORALL (i, j): integer_pred(i - j);


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 137 0 139 999
body:
  % Judgement subtype TCC generated (at line 2166, column 34) for  i * j
      % expected type  int
  int_times_int_is_int: OBLIGATION FORALL (i, j): integer_pred(i * j);


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 141 0 143 999
body:
  % Judgement subtype TCC generated (at line 2168, column 30) for  -i
      % expected type  int
  minus_int_is_int: OBLIGATION FORALL (i): integer_pred(-i);


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 145 0 147 999
body:
  % Judgement subtype TCC generated (at line 2169, column 34) for  -n0i
      % expected type  nzint
  minus_nzint_is_nzint: OBLIGATION FORALL (n0i): -n0i /= 0;


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 149 0 151 999
body:
  % Judgement subtype TCC generated (at line 2190, column 30) for  x
      % expected type  nzint
  posint_is_nzint: OBLIGATION FORALL (x: posint): x /= 0;


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 153 0 155 999
body:
  % Judgement subtype TCC generated (at line 2191, column 30) for  x
      % expected type  nzint
  negint_is_nzint: OBLIGATION FORALL (x: negint): x /= 0;


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 157 0 159 999
body:
  % Judgement subtype TCC generated (at line 2193, column 43) for  n0i * n0j
      % expected type  nzint
  nzint_times_nzint_is_nzint: OBLIGATION FORALL (n0i, n0j): n0i * n0j /= 0;


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 161 0 163 999
body:
  % Judgement subtype TCC generated (at line 2195, column 40) for  nni + nnj
      % expected type  nonneg_int
  nnint_plus_nnint_is_nnint: OBLIGATION FORALL (nni, nnj): nni + nnj >= 0;


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 165 0 167 999
body:
  % Judgement subtype TCC generated (at line 2196, column 43) for  nni * nnj
      % expected type  nonneg_int
  nnint_times_nnint_is_nnint: OBLIGATION FORALL (nni, nnj): nni * nnj >= 0;


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 169 0 171 999
body:
  % Judgement subtype TCC generated (at line 2198, column 40) for  npi + npj
      % expected type  nonpos_int
  npint_plus_npint_is_npint: OBLIGATION FORALL (npi, npj): npi + npj <= 0;


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 173 0 175 999
body:
  % Judgement subtype TCC generated (at line 2199, column 43) for  npi * npj
      % expected type  nonneg_int
  npint_times_npint_is_nnint: OBLIGATION FORALL (npi, npj): npi * npj >= 0;


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 177 0 179 999
body:
  % Judgement subtype TCC generated (at line 2201, column 43) for  pi + nnj
      % expected type  posint
  posint_plus_nnint_is_posint: OBLIGATION FORALL (nnj, pi): pi + nnj > 0;


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 181 0 183 999
body:
  % Judgement subtype TCC generated (at line 2202, column 43) for  nni + pj
      % expected type  posint
  nnint_plus_posint_is_posint: OBLIGATION FORALL (nni, pj): nni + pj > 0;


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 185 0 187 999
body:
  % Judgement subtype TCC generated (at line 2203, column 43) for  pi * pj
      % expected type  posint
  posint_times_posint_is_posint: OBLIGATION FORALL (pi, pj): pi * pj > 0;


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 189 0 191 999
body:
  % Judgement subtype TCC generated (at line 2205, column 43) for  ni + nj
      % expected type  negint
  negint_plus_negint_is_negint: OBLIGATION FORALL (ni, nj): ni + nj < 0;


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 193 0 195 999
body:
  % Judgement subtype TCC generated (at line 2206, column 43) for  ni * nj
      % expected type  posint
  negint_times_negint_is_posint: OBLIGATION FORALL (ni, nj): ni * nj > 0;


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 197 0 199 999
body:
  % Subtype TCC generated (at line 2214, column 47) for  0
      % expected type  even_int
  even_int_TCC1: OBLIGATION even?(0);


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 201 0 203 999
body:
  % Subtype TCC generated (at line 2215, column 47) for  1
      % expected type  odd_int
  odd_int_TCC1: OBLIGATION odd?(1);


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 205 0 207 999
body:
  % Judgement subtype TCC generated (at line 2225, column 26) for  x
      % expected type  nzint
  odd_is_nzint: OBLIGATION FORALL (x: odd_int): x /= 0;


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 209 0 211 999
body:
  % Judgement subtype TCC generated (at line 2227, column 37) for  e1 + e2
      % expected type  even_int
  even_plus_even_is_even: OBLIGATION FORALL (e1, e2): even?(e1 + e2);


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 213 0 215 999
body:
  % Judgement subtype TCC generated (at line 2228, column 37) for  e1 - e2
      % expected type  even_int
  even_minus_even_is_even: OBLIGATION FORALL (e1, e2): even?(e1 - e2);


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 217 0 219 999
body:
  % Judgement subtype TCC generated (at line 2229, column 37) for  o1 + o2
      % expected type  even_int
  odd_plus_odd_is_even: OBLIGATION FORALL (o1, o2): even?(o1 + o2);


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 221 0 223 999
body:
  % Judgement subtype TCC generated (at line 2230, column 37) for  o1 - o2
      % expected type  even_int
  odd_minus_odd_is_even: OBLIGATION FORALL (o1, o2): even?(o1 - o2);


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 225 0 227 999
body:
  % Judgement subtype TCC generated (at line 2231, column 37) for  o1 + e2
      % expected type  odd_int
  odd_plus_even_is_odd: OBLIGATION FORALL (e2, o1): odd?(o1 + e2);


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 229 0 231 999
body:
  % Judgement subtype TCC generated (at line 2232, column 37) for  o1 - e2
      % expected type  odd_int
  odd_minus_even_is_odd: OBLIGATION FORALL (e2, o1): odd?(o1 - e2);


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 233 0 235 999
body:
  % Judgement subtype TCC generated (at line 2233, column 37) for  e1 + o2
      % expected type  odd_int
  even_plus_odd_is_odd: OBLIGATION FORALL (e1, o2): odd?(e1 + o2);


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 237 0 239 999
body:
  % Judgement subtype TCC generated (at line 2234, column 37) for  e1 - o2
      % expected type  odd_int
  even_minus_odd_is_odd: OBLIGATION FORALL (e1, o2): odd?(e1 - o2);


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 241 0 243 999
body:
  % Judgement subtype TCC generated (at line 2235, column 37) for  e1 * i
      % expected type  even_int
  even_times_int_is_even: OBLIGATION FORALL (e1, i): even?(e1 * i);


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 245 0 247 999
body:
  % Judgement subtype TCC generated (at line 2236, column 37) for  i * e2
      % expected type  even_int
  int_times_even_is_even: OBLIGATION FORALL (e2, i): even?(i * e2);


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 249 0 251 999
body:
  % Judgement subtype TCC generated (at line 2237, column 37) for  o1 * o2
      % expected type  odd_int
  odd_times_odd_is_odd: OBLIGATION FORALL (o1, o2): odd?(o1 * o2);


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 253 0 255 999
body:
  % Judgement subtype TCC generated (at line 2238, column 35) for  -e1
      % expected type  even_int
  minus_even_is_even: OBLIGATION FORALL (e1): even?(-e1);


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 257 0 259 999
body:
  % Judgement subtype TCC generated (at line 2239, column 33) for  -o1
      % expected type  odd_int
  minus_odd_is_odd: OBLIGATION FORALL (o1): odd?(-o1);


decl_type: formula
theory: QuotientExtensionProperties
library: prelude
signature: nil
location: 12 2 15 49
body:
    lift_commutation : LEMMA
      FORALL (S),
             (g : (PreservesEq[X, X1, Y](S))) : 
        lift(S)(g) o quotient_sub_map[X, X1](S) = g


decl_type: formula
theory: QuotientExtensionProperties
library: prelude
signature: nil
location: 17 2 21 65
body:
    lift_unicity : LEMMA
      FORALL (S | PreservesEq[X, X, bool](S)(X1_pred)),
             (g : (PreservesEq[X, X1, Y](S))) :
        FORALL(h : [QuotientSub[X, X1](S) -> Y]) :
          h o quotient_sub_map[X, X1](S) = g IMPLIES h = lift(S)(g)


decl_type: function
theory: QuotientExtensionProperties
library: prelude
location: 6 2 10 18
signature:
  [S: {R: equivalence[X] | PreservesEq[X, X, bool](R)(X1_pred)} ->
          [(PreservesEq[X, X1, Y](S)) ->
             [QuotientSub[X, X1](S) -> Y]]]

body:
    lift(S)
        (g : (PreservesEq[X, X1, Y](S)))
        (P : QuotientSub[X, X1](S))
        : Y
      = g(rep(S)(P))


decl_type: tcc
theory: QuotientExtensionProperties
library: prelude
signature: nil
location: 28 0 33 999
body:
  % Subtype TCC generated (at line 6190, column 15) for  P
      % expected type  Quotient[X](S)
  lift_TCC1: OBLIGATION
    FORALL (S: {R: equivalence[X] | PreservesEq[X, X, bool](R)(X1_pred)},
            g: (PreservesEq[X, X1, Y](S)), P: QuotientSub[X, X1](S)):
      EXISTS (x: X): P = EquivClass[X](S)(x);


decl_type: tcc
theory: QuotientExtensionProperties
library: prelude
signature: nil
location: 35 0 40 999
body:
  % Subtype TCC generated (at line 6190, column 8) for  rep(S)(P)
      % expected type  X1
  lift_TCC2: OBLIGATION
    FORALL (S: {R: equivalence[X] | PreservesEq[X, X, bool](R)(X1_pred)},
            g: (PreservesEq[X, X1, Y](S)), P: QuotientSub[X, X1](S)):
      X1_pred(rep[X](S)(P));


decl_type: formula
theory: extend_set_props
library: prelude
signature: nil
location: 5 2 7 62
body:
    finite_extension: LEMMA
      FORALL (a: set[S]):
        is_finite(extend[T, S, bool, FALSE](a)) IFF is_finite(a)


decl_type: formula
theory: extend_set_props
library: prelude
signature: nil
location: 24 2 26 56
body:
    empty?_extend: LEMMA
      FORALL (a: set[S]): 
        empty?(extend[T, S, bool, FALSE](a)) IFF empty?(a)


decl_type: formula
theory: extend_set_props
library: prelude
signature: nil
location: 28 2 30 62
body:
    nonempty?_extend: LEMMA
      FORALL (a: set[S]): 
        nonempty?(extend[T, S, bool, FALSE](a)) IFF nonempty?(a)


decl_type: formula
theory: extend_set_props
library: prelude
signature: nil
location: 32 2 34 64
body:
    singleton?_extend: LEMMA
      FORALL (a: set[S]): 
        singleton?(extend[T, S, bool, FALSE](a)) IFF singleton?(a)


decl_type: formula
theory: extend_set_props
library: prelude
signature: nil
location: 36 2 39 22
body:
    subset_extend: LEMMA
      FORALL (a, b: set[S]): 
        subset?(extend[T, S, bool, FALSE](a), extend[T, S, bool, FALSE](b)) IFF
           subset?(a, b)


decl_type: formula
theory: extend_set_props
library: prelude
signature: nil
location: 41 2 44 48
body:
    union_extend: LEMMA
      FORALL (a, b: set[S]): 
        union(extend[T, S, bool, FALSE](a), extend[T, S, bool, FALSE](b))
          = extend[T, S, bool, FALSE](union(a, b))


decl_type: formula
theory: extend_set_props
library: prelude
signature: nil
location: 46 2 49 55
body:
    intersection_extend: LEMMA
      FORALL (a, b: set[S]): 
        intersection(extend[T, S, bool, FALSE](a), extend[T, S, bool, FALSE](b))
          = extend[T, S, bool, FALSE](intersection(a, b))


decl_type: formula
theory: extend_set_props
library: prelude
signature: nil
location: 51 2 54 53
body:
    difference_extend: LEMMA
      FORALL (a, b: set[S]): 
        difference(extend[T, S, bool, FALSE](a), extend[T, S, bool, FALSE](b))
          = extend[T, S, bool, FALSE](difference(a, b))


decl_type: formula
theory: extend_set_props
library: prelude
signature: nil
location: 56 2 59 46
body:
    add_extend: LEMMA
      FORALL (x: S, a: set[S]): 
        add(x, extend[T, S, bool, FALSE](a))
          = extend[T, S, bool, FALSE](add(x, a))


decl_type: formula
theory: extend_set_props
library: prelude
signature: nil
location: 61 2 64 49
body:
    remove_extend: LEMMA
      FORALL (x: S, a: set[S]): 
        remove(x, extend[T, S, bool, FALSE](a))
          = extend[T, S, bool, FALSE](remove(x, a))


decl_type: judgement
theory: extend_set_props
library: prelude
signature: (nonempty?[T])
location: 15 2 16 72
body:
    nonempty_extend: JUDGEMENT
      extend[T, S, bool, FALSE](a: (nonempty?[S])) HAS_TYPE (nonempty?[T])


decl_type: judgement
theory: extend_set_props
library: prelude
signature: (singleton?[T])
location: 18 2 19 74
body:
    singleton_extend: JUDGEMENT
      extend[T, S, bool, FALSE](a: (singleton?[S])) HAS_TYPE (singleton?[T])


decl_type: tcc
theory: extend_set_props
library: prelude
signature: nil
location: 71 0 75 999
body:
  % Judgement subtype TCC generated (at line 4338, column 4) for
      % extend[T, S, bool, FALSE](a)
      % expected type  finite_set[T]
  finite_extend: OBLIGATION
    FORALL (a: finite_set[S]): is_finite[T](extend[T, S, bool, FALSE](a));


decl_type: tcc
theory: extend_set_props
library: prelude
signature: nil
location: 77 0 81 999
body:
  % Judgement subtype TCC generated (at line 4341, column 4) for
      % extend[T, S, bool, FALSE](a)
      % expected type  (empty?[T])
  empty_extend: OBLIGATION
    FORALL (a: (empty?[S])): empty?[T](extend[T, S, bool, FALSE](a));


decl_type: tcc
theory: extend_set_props
library: prelude
signature: nil
location: 83 0 87 999
body:
  % Judgement subtype TCC generated (at line 4344, column 4) for
      % extend[T, S, bool, FALSE](a)
      % expected type  (nonempty?[T])
  nonempty_extend: OBLIGATION
    FORALL (a: (nonempty?[S])): nonempty?[T](extend[T, S, bool, FALSE](a));


decl_type: tcc
theory: extend_set_props
library: prelude
signature: nil
location: 89 0 93 999
body:
  % Judgement subtype TCC generated (at line 4347, column 4) for
      % extend[T, S, bool, FALSE](a)
      % expected type  (singleton?[T])
  singleton_extend: OBLIGATION
    FORALL (a: (singleton?[S])): singleton?[T](extend[T, S, bool, FALSE](a));


decl_type: function
theory: more_finseq
library: prelude
signature: [[seq, seq] -> bool]
location: 9 3 11 60
body:
     prefix?(rr, ss): bool =
       rr`length <= ss`length AND
         (FORALL (i: below(rr`length)): rr`seq(i) = ss`seq(i))


decl_type: function
theory: more_finseq
library: prelude
signature: [set[seq] -> bool]
location: 13 3 14 68
body:
     prefix_closed?(X : set[seq]): bool =
       FORALL ss: X(ss) IMPLIES (FORALL (rr | prefix?(rr, ss)): X(rr))


decl_type: function
theory: more_finseq
library: prelude
signature: [[T, seq] -> finseq[T]]
location: 16 3 18 35
body:
     add(x, rr): finseq[T] =
       rr WITH [`length := rr`length + 1,
                `seq(rr`length) := x]


decl_type: tcc
theory: more_finseq
library: prelude
signature: nil
location: 25 0 30 999
body:
  % Subtype TCC generated (at line 4603, column 57) for  i
      % expected type  below[ss`length]
  prefix?_TCC1: OBLIGATION
    FORALL (rr: seq, ss: seq):
      rr`length <= ss`length IMPLIES
       (FORALL (i: below(rr`length)): i < ss`length);


decl_type: tcc
theory: more_finseq
library: prelude
signature: nil
location: 32 0 34 999
body:
  % Subtype TCC generated (at line 4610, column 19) for  rr`length
      % expected type  below[1 + rr`length]
  add_TCC1: OBLIGATION FORALL (x: T, rr: seq): rr`length < 1 + rr`length;


decl_type: formula
theory: exp2
library: prelude
signature: nil
location: 27 2 28 66
body:
    exp_prop       : LEMMA x1 < exp2(n) AND  x2 < exp2(m) 
                             IMPLIES x1 * exp2(m) + x2 < exp2(n + m)


decl_type: tcc
theory: exp2
library: prelude
signature: nil
location: 35 0 37 999
body:
  % Subtype TCC generated (at line 5270, column 65) for  n - 1
      % expected type  nat
  exp2_TCC1: OBLIGATION FORALL (n: nat): NOT n = 0 IMPLIES n - 1 >= 0;


decl_type: tcc
theory: exp2
library: prelude
signature: nil
location: 39 0 40 999
body:
  % Termination TCC generated (at line 5270, column 60) for  exp2(n - 1)
  exp2_TCC2: OBLIGATION FORALL (n: nat): NOT n = 0 IMPLIES n - 1 < n;


decl_type: tcc
theory: exp2
library: prelude
signature: nil
location: 42 0 44 999
body:
  % Judgement subtype TCC generated (at line 5273, column 12) for  exp2(n)
      % expected type  above(n)
  exp2_TCC3: OBLIGATION FORALL (n: nat): exp2(n) > n;


decl_type: tcc
theory: exp2
library: prelude
signature: nil
location: 46 0 48 999
body:
  % Subtype TCC generated (at line 5285, column 50) for  n - k
      % expected type  nat
  exp2_minus_TCC1: OBLIGATION FORALL (n, k: upto(n)): n - k >= 0;


decl_type: function
theory: EquivalenceClosure
library: prelude
signature: [PRED[[T, T]] -> equivalence[T]]
location: 18 2 19 75
body:
    EquivClos(R) : equivalence[T] =
      { (x, y) | FORALL(S : equivalence[T]) : subset?(R, S) IMPLIES S(x, y) }


decl_type: tcc
theory: EquivalenceClosure
library: prelude
signature: nil
location: 41 0 49 999
body:
  % Subtype TCC generated (at line 6040, column 4) for
      % {x, y | FORALL (S: equivalence[T]): subset?(R, S) IMPLIES S(x, y)}
      % expected type  equivalence[T]
  EquivClos_TCC1: OBLIGATION
    FORALL (R: PRED[[T, T]]):
      equivalence?[T]
          ({x, y |
              FORALL (S: equivalence[T]):
                subset?[[T, T]](R, S) IMPLIES S(x, y)});


decl_type: formula
theory: sequences
library: prelude
signature: nil
location: 47 2 49 27
body:
    sequence_induction: LEMMA
      p(nth(seq, 0)) AND (FORALL n: p(nth(seq, n)) IMPLIES p(nth(seq, n + 1)))
        IMPLIES every(p)(seq)


decl_type: function
theory: sequences
library: prelude
signature: [[T, nat, sequence] -> sequence]
location: 28 2 31 39
body:
    insert(x, n, seq): sequence =
      (LAMBDA i: (IF i < n THEN seq(i)
                  ELSIF i = n THEN x
                  ELSE seq(i - 1) ENDIF))


decl_type: tcc
theory: sequences
library: prelude
signature: nil
location: 60 0 64 999
body:
  % Subtype TCC generated (at line 4488, column 25) for  i - 1
      % expected type  nat
  insert_TCC1: OBLIGATION
    FORALL (x: T, n: nat, seq: sequence, i):
      NOT i = n AND NOT i < n IMPLIES i - 1 >= 0;


decl_type: formula
theory: euclidean_division
library: prelude
signature: nil
location: 26 2 28 53
body:
    unique_quotient : PROPOSITION
          FORALL (q1, q2 : int), (r1, r2 : mod(b)) :
              b * q1 + r1 = b * q2 + r2 IMPLIES q1 = q2


decl_type: formula
theory: euclidean_division
library: prelude
signature: nil
location: 30 2 32 53
body:
    unique_remainder : COROLLARY
          FORALL (q1, q2 : int), (r1, r2 : mod(b)) :
              b * q1 + r1 = b * q2 + r2 IMPLIES r1 = r2


decl_type: formula
theory: euclidean_division
library: prelude
signature: nil
location: 34 2 36 65
body:
    unique_division : COROLLARY
          FORALL (q1, q2 : int), (r1, r2 : mod(b)) :
              b * q1 + r1 = b * q2 + r2 IMPLIES q1 = q2 AND r1 = r2


decl_type: tcc
theory: euclidean_division
library: prelude
signature: nil
location: 43 0 45 999
body:
  % Existence TCC generated (at line 3636, column 2) for
      % mod(b): TYPE+ = {i | i < b}
  mod_TCC1: OBLIGATION FORALL (b: posnat): EXISTS (x: {i | i < b}): TRUE;


decl_type: formula
theory: quantifier_props
library: prelude
signature: nil
location: 16 2 17 78
body:
    exists_implies: LEMMA
      (EXISTS x: p(x) IMPLIES q(x)) = ((EXISTS x: NOT p(x)) OR (EXISTS x: q(x)))


decl_type: formula
theory: function_props
library: prelude
signature: nil
location: 31 2 33 40
body:
    preserves_composition: LEMMA
      preserves(f1, R1, R2) AND preserves(f2, R2, R3)
        IMPLIES preserves(f2 o f1, R1, R3)


decl_type: formula
theory: function_props
library: prelude
signature: nil
location: 35 2 37 38
body:
    inverts_composition1: LEMMA
      preserves(f1, R1, R2) AND inverts(f2, R2, R3)
        IMPLIES inverts(f2 o f1, R1, R3)


decl_type: formula
theory: function_props
library: prelude
signature: nil
location: 39 2 41 38
body:
    inverts_composition2: LEMMA
      inverts(f1, R1, R2) AND preserves(f2, R2, R3)
        IMPLIES inverts(f2 o f1, R1, R3)


decl_type: judgement
theory: function_props
library: prelude
signature: (injective?[T1, T3])
location: 16 2 18 35
body:
    composition_injective: JUDGEMENT
      o(f2: (injective?[T2, T3]), f1: (injective?[T1, T2]))
        HAS_TYPE (injective?[T1, T3])


decl_type: judgement
theory: function_props
library: prelude
signature: (surjective?[T1, T3])
location: 20 2 22 36
body:
    composition_surjective: JUDGEMENT
      o(f2: (surjective?[T2, T3]), f1: (surjective?[T1, T2]))
        HAS_TYPE (surjective?[T1, T3])


decl_type: judgement
theory: function_props
library: prelude
signature: (bijective?[T1, T3])
location: 24 2 26 35
body:
    composition_bijective: JUDGEMENT
      o(f2: (bijective?[T2, T3]), f1: (bijective?[T1, T2]))
        HAS_TYPE (bijective?[T1, T3])


decl_type: tcc
theory: function_props
library: prelude
signature: nil
location: 48 0 52 999
body:
  % Judgement subtype TCC generated (at line 1476, column 4) for  f2 o f1
      % expected type  (injective?[T1, T3])
  composition_injective: OBLIGATION
    FORALL (f1: (injective?[T1, T2]), f2: (injective?[T2, T3])):
      injective?[T1, T3](f2 o f1);


decl_type: tcc
theory: function_props
library: prelude
signature: nil
location: 54 0 58 999
body:
  % Judgement subtype TCC generated (at line 1480, column 4) for  f2 o f1
      % expected type  (surjective?[T1, T3])
  composition_surjective: OBLIGATION
    FORALL (f1: (surjective?[T1, T2]), f2: (surjective?[T2, T3])):
      surjective?[T1, T3](f2 o f1);


decl_type: tcc
theory: function_props
library: prelude
signature: nil
location: 60 0 64 999
body:
  % Judgement subtype TCC generated (at line 1484, column 4) for  f2 o f1
      % expected type  (bijective?[T1, T3])
  composition_bijective: OBLIGATION
    FORALL (f1: (bijective?[T1, T2]), f2: (bijective?[T2, T3])):
      bijective?[T1, T3](f2 o f1);


decl_type: function
theory: stdstr
library: prelude
signature: [[string, string] -> string]
location: 57 2 58 3
body:
    concat(s1:string,s2:string):string = s1 o s2
    ;+(s1:string,s2:string): MACRO string = concat(s1,s2)


decl_type: function
theory: stdstr
library: prelude
signature: [[string, string] -> string]
location: 58 3 59 3
body:
    ;+(s1:string,s2:string): MACRO string = concat(s1,s2)
    ;+(r:real,s:string): MACRO string = concat(tostr(r),s)


decl_type: function
theory: stdstr
library: prelude
signature: [[real, string] -> string]
location: 59 3 60 3
body:
    ;+(r:real,s:string): MACRO string = concat(tostr(r),s)
    ;+(s:string,r:real): MACRO string = concat(s,tostr(r))


decl_type: function
theory: stdstr
library: prelude
signature: [[string, real] -> string]
location: 60 3 61 3
body:
    ;+(s:string,r:real): MACRO string = concat(s,tostr(r))
    ;+(b:bool,s:string): MACRO string = concat(tostr(b),s)


decl_type: function
theory: stdstr
library: prelude
signature: [[bool, string] -> string]
location: 61 3 62 3
body:
    ;+(b:bool,s:string): MACRO string = concat(tostr(b),s)
    ;+(s:string,b:bool): MACRO string = concat(s,tostr(b))


decl_type: function
theory: stdstr
library: prelude
signature: [[nat, string] -> string]
location: 65 2 69 13
body:
    pad(n:nat,s:string): RECURSIVE string = 
      IF n=0 THEN emptystr
      ELSE s+pad(n-1,s)
      ENDIF
      MEASURE n


decl_type: tcc
theory: stdstr
library: prelude
signature: nil
location: 116 0 118 999
body:
  % Subtype TCC generated (at line 6641, column 15) for  n - 1
      % expected type  nat
  pad_TCC1: OBLIGATION FORALL (n: nat): NOT n = 0 IMPLIES n - 1 >= 0;


decl_type: tcc
theory: stdstr
library: prelude
signature: nil
location: 120 0 121 999
body:
  % Termination TCC generated (at line 6641, column 11) for  pad(n - 1, s)
  pad_TCC2: OBLIGATION FORALL (n: nat): NOT n = 0 IMPLIES n - 1 < n;


decl_type: function
theory: lex2
library: prelude
signature: [[nat, nat] -> ordinal]
location: 9 2 17 11
body:
    lex2(m, n): ordinal = 
      (IF m=0
         THEN IF n = 0
                 THEN zero
                 ELSE add(n, zero, zero)
              ENDIF
         ELSIF n = 0 THEN add(m, add(1,zero,zero),zero)
         ELSE add(m, add(1,zero,zero), add(n,zero, zero))
       ENDIF)


decl_type: tcc
theory: lex2
library: prelude
signature: nil
location: 28 0 31 999
body:
  % Subtype TCC generated (at line 4703, column 20) for  zero
      % expected type  ordinal
  lex2_TCC1: OBLIGATION
    FORALL (m: nat, n: nat): n = 0 AND m = 0 IMPLIES ordinal?(zero);


decl_type: tcc
theory: lex2
library: prelude
signature: nil
location: 33 0 36 999
body:
  % Subtype TCC generated (at line 4704, column 24) for  n
      % expected type  posnat
  lex2_TCC2: OBLIGATION
    FORALL (m: nat, n: nat): NOT n = 0 AND m = 0 IMPLIES n > 0;


decl_type: tcc
theory: lex2
library: prelude
signature: nil
location: 38 0 42 999
body:
  % Subtype TCC generated (at line 4704, column 20) for  add(n, zero, zero)
      % expected type  ordinal
  lex2_TCC3: OBLIGATION
    FORALL (m: nat, n: nat):
      NOT n = 0 AND m = 0 IMPLIES ordinal?(add(n, zero, zero));


decl_type: tcc
theory: lex2
library: prelude
signature: nil
location: 44 0 47 999
body:
  % Subtype TCC generated (at line 4706, column 28) for  m
      % expected type  posnat
  lex2_TCC4: OBLIGATION
    FORALL (m: nat, n: nat): n = 0 AND NOT m = 0 IMPLIES m > 0;


decl_type: tcc
theory: lex2
library: prelude
signature: nil
location: 49 0 54 999
body:
  % Subtype TCC generated (at line 4706, column 24) for
      % add(m, add(1, zero, zero), zero)
      % expected type  ordinal
  lex2_TCC5: OBLIGATION
    FORALL (m: nat, n: nat):
      n = 0 AND NOT m = 0 IMPLIES ordinal?(add(m, add(1, zero, zero), zero));


decl_type: tcc
theory: lex2
library: prelude
signature: nil
location: 56 0 59 999
body:
  % Subtype TCC generated (at line 4707, column 16) for  m
      % expected type  posnat
  lex2_TCC6: OBLIGATION
    FORALL (m: nat, n: nat): NOT n = 0 AND NOT m = 0 IMPLIES m > 0;


decl_type: tcc
theory: lex2
library: prelude
signature: nil
location: 61 0 64 999
body:
  % Subtype TCC generated (at line 4707, column 41) for  n
      % expected type  posnat
  lex2_TCC7: OBLIGATION
    FORALL (m: nat, n: nat): NOT n = 0 AND NOT m = 0 IMPLIES n > 0;


decl_type: tcc
theory: lex2
library: prelude
signature: nil
location: 66 0 72 999
body:
  % Subtype TCC generated (at line 4707, column 12) for
      % add(m, add(1, zero, zero), add(n, zero, zero))
      % expected type  ordinal
  lex2_TCC8: OBLIGATION
    FORALL (m: nat, n: nat):
      NOT n = 0 AND NOT m = 0 IMPLIES
       ordinal?(add(m, add(1, zero, zero), add(n, zero, zero)));


decl_type: judgement
theory: QuotientKernelProperties
library: prelude
signature:
  (PreservesEq[X, X1, Quotient(S)]
  (extend[[X, X], [X1, X1], bool, FALSE](S)))

location: 13 2 14 65
body:
    quotient_map_is_Quotient_EqivalenceRespecting: JUDGEMENT
      quotient_map(S) HAS_TYPE (PreservesEq[X, X1, Quotient(S)](S))


decl_type: judgement
theory: QuotientKernelProperties
library: prelude
signature:
  (PreservesEq[X, X1, ECQuotient(S)]
  (extend[[X, X], [X1, X1], bool, FALSE](S)))

location: 22 2 23 67
body:
    quotient_map_is_ECQuotient_EqivalenceRespecting: JUDGEMENT
      quotient_map(S) HAS_TYPE (PreservesEq[X, X1, ECQuotient(S)](S))


decl_type: tcc
theory: QuotientKernelProperties
library: prelude
signature: nil
location: 30 0 37 999
body:
  % Judgement subtype TCC generated (at line 6152, column 4) for
      % quotient_map(S)
      % expected type  (PreservesEq[X, X1, Quotient(S)]
                     %      (extend[[X, X], [X1, X1], bool, FALSE](S)))
  quotient_map_is_Quotient_EqivalenceRespecting: OBLIGATION
    FORALL (S):
      PreservesEq[X, X1, Quotient(S)]
          (extend[[X, X], [X1, X1], bool, FALSE](S))(quotient_map[X1](S));


decl_type: tcc
theory: QuotientKernelProperties
library: prelude
signature: nil
location: 39 0 44 999
body:
  % Subtype TCC generated (at line 6155, column 44) for  quotient_map(S)
      % expected type  [X1 -> ECQuotient[X1](S)]
  Kernel_ECquotient_map_TCC1: OBLIGATION
    FORALL (S: equivalence[X1], x1: X1):
      EXISTS (x: X1):
        quotient_map[X1](S)(x1) = EquivClass[X1](EquivClos[X1](S))(x);


decl_type: tcc
theory: QuotientKernelProperties
library: prelude
signature: nil
location: 46 0 57 999
body:
  % Judgement subtype TCC generated (at line 6161, column 4) for
      % quotient_map(S)
      % expected type  (PreservesEq[X, X1, ECQuotient(S)]
                     %      (extend[[X, X], [X1, X1], bool, FALSE](S)))
  quotient_map_is_ECQuotient_EqivalenceRespecting: OBLIGATION
    FORALL (S):
      (FORALL (x1: X1):
         EXISTS (x: X1):
           quotient_map[X1](S)(x1) = EquivClass[X1](EquivClos[X1](S))(x))
       AND
       PreservesEq[X, X1, ECQuotient(S)]
           (extend[[X, X], [X1, X1], bool, FALSE](S))(quotient_map[X1](S));


decl_type: tcc
theory: integer_props
library: prelude
signature: nil
location: 37 0 42 999
body:
  % Subtype TCC generated (at line 3299, column 20) for
      % extend[real, nat, bool, FALSE](N)
      % expected type  (nonempty?[real])
  lub_nat_TCC1: OBLIGATION
    FORALL (N: (nonempty?[nat])):
      nonempty?[real](extend[real, nat, bool, FALSE](N));


decl_type: tcc
theory: integer_props
library: prelude
signature: nil
location: 44 0 49 999
body:
  % Subtype TCC generated (at line 3303, column 20) for
      % extend[real, int, bool, FALSE](I)
      % expected type  (nonempty?[real])
  lub_int_TCC1: OBLIGATION
    FORALL (I: (nonempty?[int])):
      nonempty?[real](extend[real, int, bool, FALSE](I));


decl_type: formula
theory: bounded_real_defs
library: prelude
signature: nil
location: 30 2 33 44
body:
    real_complete: AXIOM
      FORALL S:
        (EXISTS y: upper_bound?(y, S)) IMPLIES
          (EXISTS y: least_upper_bound?(y, S))


decl_type: formula
theory: bounded_real_defs
library: prelude
signature: nil
location: 35 2 38 47
body:
    real_lower_complete: LEMMA
      FORALL S:
        (EXISTS y: lower_bound?(y, S)) IMPLIES 
          (EXISTS x: greatest_lower_bound?(x, S))


decl_type: function
theory: bounded_real_defs
library: prelude
signature: [[real, (nonempty?[real])] -> bool]
location: 18 2 20 51
body:
    least_upper_bound?(x, S): bool =
      upper_bound?(x, S) AND
        FORALL y: upper_bound?(y, S) IMPLIES (x <= y)


decl_type: function
theory: bounded_real_defs
library: prelude
signature: [[real, (nonempty?[real])] -> bool]
location: 24 2 26 51
body:
    greatest_lower_bound?(x, S): bool =
      lower_bound?(x, S) AND
        FORALL y: lower_bound?(y, S) IMPLIES (y <= x)


decl_type: tcc
theory: bounded_real_defs
library: prelude
signature: nil
location: 72 0 76 999
body:
  % Existence TCC generated (at line 1958, column 2) for
      % lub(SA): {x | least_upper_bound?(x, SA)}
  lub_TCC1: OBLIGATION
    EXISTS (x1: [SA: (bounded_above?) -> {x | least_upper_bound?(x, SA)}]):
      TRUE;


decl_type: tcc
theory: bounded_real_defs
library: prelude
signature: nil
location: 78 0 83 999
body:
  % Existence TCC generated (at line 1966, column 2) for
      % glb(SB): {x | greatest_lower_bound?(x, SB)}
  glb_TCC1: OBLIGATION
    EXISTS (x1:
              [SB: (bounded_below?) -> {x | greatest_lower_bound?(x, SB)}]):
      TRUE;


decl_type: tcc
theory: QuotientSubDefinition
library: prelude
signature: nil
location: 18 0 23 999
body:
  % Subtype TCC generated (at line 6176, column 4) for  EquivClass(S)(x)
      % expected type  QuotientSub(S)
  quotient_sub_map_TCC1: OBLIGATION
    FORALL (S: {R: equivalence[X] | PreservesEq[X, X, bool](R)(X1_pred)},
            x: X1):
      EXISTS (x_1: X1): EquivClass[X](S)(x) = EquivClass[X](S)(x_1);


decl_type: function
theory: Fairctlops
library: prelude
location: 14 2 21 26
signature:
  [[pred[state], [[state, state] -> bool], pred[state],
         list[pred[state]]] ->
          pred[state]]

body:
    CheckFair(Q, N, f, Fflist): RECURSIVE pred[state] =
      (CASES Fflist OF
       cons(Ff, Gflist):
               EU(N, f, f AND Ff AND
                        EX(N, CheckFair(Q, N, f, Gflist))),
       null : Q
       ENDCASES)
      MEASURE length(Fflist)


decl_type: function
theory: Fairctlops
library: prelude
location: 32 2 32 67
body: FairEU(N,f,g)(Fflist):pred[state] = EU(N,f,g AND Fair?(N,Fflist))
signature:
  [[[[state, state] -> bool], pred[state], pred[state]] ->
          [list[pred[state]] -> pred[state]]]


decl_type: function
theory: Fairctlops
library: prelude
location: 40 2 42 28
signature:
  [[[[state, state] -> bool], pred[state], pred[state]] ->
          [list[pred[state]] -> pred[state]]]

body:
    FairAU(N,f,g)(Fflist):pred[state] =
          NOT FairEU(N,NOT g,NOT f AND NOT g)(Fflist)
              AND FairAF(N,g)(Fflist)


decl_type: tcc
theory: Fairctlops
library: prelude
signature: nil
location: 51 0 61 999
body:
  % Termination TCC generated (at line 5171, column 14) for
      % CheckFair(Q, N, f, Gflist)
  CheckFair_TCC1: OBLIGATION
    FORALL (f: pred[state], Fflist: list[pred[state]], Ff: pred[state],
            Gflist: list[pred[state]]):
      Fflist = cons(Ff, Gflist) IMPLIES
       (FORALL (s1: state):
          f(s1) IMPLIES
           (FORALL (s: state):
              Ff(s) AND s = s1 IMPLIES
               length[pred[state]](Gflist) < length[pred[state]](Fflist)));


decl_type: tcc
theory: Fairctlops
library: prelude
signature: nil
location: 63 0 69 999
body:
  % Subtype TCC generated (at line 5177, column 7) for
      % LAMBDA P: CheckFair(P, N, f, Fflist)
      % expected type  (monotonic?[state])
  FairEG_TCC1: OBLIGATION
    FORALL (N: [[state, state] -> bool], f: pred[state],
            Fflist: list[pred[state]]):
      monotonic?[state](LAMBDA P: CheckFair(P, N, f, Fflist));


decl_type: function
theory: fairctlops
library: prelude
signature:
  [[[[state, state] -> bool], pred[state], pred[state]] ->
  [pred[state] -> pred[state]]]

location: 36 2 38 24
body:
    fairAU(N,f,g)(Ff):pred[state] =
          NOT fairEU(N,NOT g,NOT f AND NOT g)(Ff)
              AND fairAF(N,g)(Ff)


decl_type: tcc
theory: fairctlops
library: prelude
signature: nil
location: 47 0 60 999
body:
  % Subtype TCC generated (at line 5129, column 7) for
      % LAMBDA P:
      %   EU(N, f,
      %      LAMBDA (s1: state):
      %        f(s1) AND (LAMBDA (s: state): Ff(s) AND EX(N, P)(s))(s1))
      % expected type  (monotonic?[state])
  fairEG_TCC1: OBLIGATION
    FORALL (N: [[state, state] -> bool], f: pred[state], Ff: pred[state]):
      monotonic?[state]
          (LAMBDA P:
             EU[state]
                 (N, f,
                  LAMBDA (s1: state):
                    f(s1) AND Ff(s1) AND EX[state](N, P)(s1)));


decl_type: judgement
theory: extend_func_props
library: prelude
signature: (surjective?[T, R])
location: 13 2 14 75
body:
    surjective_extend: JUDGEMENT
      extend[T, S, R, d](f: (surjective?[S, R])) HAS_TYPE (surjective?[T, R])


decl_type: tcc
theory: extend_func_props
library: prelude
signature: nil
location: 21 0 25 999
body:
  % Judgement subtype TCC generated (at line 402, column 4) for
      % extend[T, S, R, d](f)
      % expected type  (surjective?[T, R])
  surjective_extend: OBLIGATION
    FORALL (f: (surjective?[S, R])): surjective?[T, R](extend[T, S, R, d](f));


decl_type: judgement
theory: restrict_order_props
library: prelude
signature: (antisymmetric?[S])
location: 22 2 23 65
body:
    antisymmetric_restrict: JUDGEMENT
      restrict(R: (antisymmetric?[T])) HAS_TYPE (antisymmetric?[S])


decl_type: judgement
theory: restrict_order_props
library: prelude
signature: (partial_order?[S])
location: 37 2 38 65
body:
    partial_order_restrict: JUDGEMENT
      restrict(R: (partial_order?[T])) HAS_TYPE (partial_order?[S])


decl_type: judgement
theory: restrict_order_props
library: prelude
signature: (strict_total_order?[S])
location: 52 2 53 75
body:
    strict_total_order_restrict: JUDGEMENT
      restrict(R: (strict_total_order?[T])) HAS_TYPE (strict_total_order?[S])


decl_type: tcc
theory: restrict_order_props
library: prelude
signature: nil
location: 66 0 70 999
body:
  % Judgement subtype TCC generated (at line 615, column 4) for  restrict(R)
      % expected type  (reflexive?[S])
  reflexive_restrict: OBLIGATION
    FORALL (R: (reflexive?[T])):
      reflexive?[S](restrict[[T, T], [S, S], boolean](R));


decl_type: tcc
theory: restrict_order_props
library: prelude
signature: nil
location: 72 0 76 999
body:
  % Judgement subtype TCC generated (at line 618, column 4) for  restrict(R)
      % expected type  (irreflexive?[S])
  irreflexive_restrict: OBLIGATION
    FORALL (R: (irreflexive?[T])):
      irreflexive?[S](restrict[[T, T], [S, S], boolean](R));


decl_type: tcc
theory: restrict_order_props
library: prelude
signature: nil
location: 78 0 82 999
body:
  % Judgement subtype TCC generated (at line 621, column 4) for  restrict(R)
      % expected type  (symmetric?[S])
  symmetric_restrict: OBLIGATION
    FORALL (R: (symmetric?[T])):
      symmetric?[S](restrict[[T, T], [S, S], boolean](R));


decl_type: tcc
theory: restrict_order_props
library: prelude
signature: nil
location: 84 0 88 999
body:
  % Judgement subtype TCC generated (at line 624, column 4) for  restrict(R)
      % expected type  (antisymmetric?[S])
  antisymmetric_restrict: OBLIGATION
    FORALL (R: (antisymmetric?[T])):
      antisymmetric?[S](restrict[[T, T], [S, S], boolean](R));


decl_type: tcc
theory: restrict_order_props
library: prelude
signature: nil
location: 90 0 94 999
body:
  % Judgement subtype TCC generated (at line 627, column 4) for  restrict(R)
      % expected type  (connected?[S])
  connected_restrict: OBLIGATION
    FORALL (R: (connected?[T])):
      connected?[S](restrict[[T, T], [S, S], boolean](R));


decl_type: tcc
theory: restrict_order_props
library: prelude
signature: nil
location: 96 0 100 999
body:
  % Judgement subtype TCC generated (at line 630, column 4) for  restrict(R)
      % expected type  (transitive?[S])
  transitive_restrict: OBLIGATION
    FORALL (R: (transitive?[T])):
      transitive?[S](restrict[[T, T], [S, S], boolean](R));


decl_type: tcc
theory: restrict_order_props
library: prelude
signature: nil
location: 102 0 106 999
body:
  % Judgement subtype TCC generated (at line 633, column 4) for  restrict(R)
      % expected type  (equivalence?[S])
  equivalence_restrict: OBLIGATION
    FORALL (R: (equivalence?[T])):
      equivalence?[S](restrict[[T, T], [S, S], boolean](R));


decl_type: tcc
theory: restrict_order_props
library: prelude
signature: nil
location: 108 0 112 999
body:
  % Judgement subtype TCC generated (at line 636, column 4) for  restrict(R)
      % expected type  (preorder?[S])
  preorder_restrict: OBLIGATION
    FORALL (R: (preorder?[T])):
      preorder?[S](restrict[[T, T], [S, S], boolean](R));


decl_type: tcc
theory: restrict_order_props
library: prelude
signature: nil
location: 114 0 118 999
body:
  % Judgement subtype TCC generated (at line 639, column 4) for  restrict(R)
      % expected type  (partial_order?[S])
  partial_order_restrict: OBLIGATION
    FORALL (R: (partial_order?[T])):
      partial_order?[S](restrict[[T, T], [S, S], boolean](R));


decl_type: tcc
theory: restrict_order_props
library: prelude
signature: nil
location: 120 0 124 999
body:
  % Judgement subtype TCC generated (at line 642, column 4) for  restrict(R)
      % expected type  (strict_order?[S])
  strict_order_restrict: OBLIGATION
    FORALL (R: (strict_order?[T])):
      strict_order?[S](restrict[[T, T], [S, S], boolean](R));


decl_type: tcc
theory: restrict_order_props
library: prelude
signature: nil
location: 126 0 130 999
body:
  % Judgement subtype TCC generated (at line 645, column 4) for  restrict(R)
      % expected type  (dichotomous?[S])
  dichotomous_restrict: OBLIGATION
    FORALL (R: (dichotomous?[T])):
      dichotomous?[S](restrict[[T, T], [S, S], boolean](R));


decl_type: tcc
theory: restrict_order_props
library: prelude
signature: nil
location: 132 0 136 999
body:
  % Judgement subtype TCC generated (at line 648, column 4) for  restrict(R)
      % expected type  (total_order?[S])
  total_order_restrict: OBLIGATION
    FORALL (R: (total_order?[T])):
      total_order?[S](restrict[[T, T], [S, S], boolean](R));


decl_type: tcc
theory: restrict_order_props
library: prelude
signature: nil
location: 138 0 142 999
body:
  % Judgement subtype TCC generated (at line 651, column 4) for  restrict(R)
      % expected type  (trichotomous?[S])
  trichotomous_restrict: OBLIGATION
    FORALL (R: (trichotomous?[T])):
      trichotomous?[S](restrict[[T, T], [S, S], boolean](R));


decl_type: tcc
theory: restrict_order_props
library: prelude
signature: nil
location: 144 0 148 999
body:
  % Judgement subtype TCC generated (at line 654, column 4) for  restrict(R)
      % expected type  (strict_total_order?[S])
  strict_total_order_restrict: OBLIGATION
    FORALL (R: (strict_total_order?[T])):
      strict_total_order?[S](restrict[[T, T], [S, S], boolean](R));


decl_type: tcc
theory: restrict_order_props
library: prelude
signature: nil
location: 150 0 154 999
body:
  % Judgement subtype TCC generated (at line 657, column 4) for  restrict(R)
      % expected type  (well_founded?[S])
  well_founded_restrict: OBLIGATION
    FORALL (R: (well_founded?[T])):
      well_founded?[S](restrict[[T, T], [S, S], boolean](R));


decl_type: tcc
theory: restrict_order_props
library: prelude
signature: nil
location: 156 0 160 999
body:
  % Judgement subtype TCC generated (at line 660, column 4) for  restrict(R)
      % expected type  (well_ordered?[S])
  well_ordered_restrict: OBLIGATION
    FORALL (R: (well_ordered?[T])):
      well_ordered?[S](restrict[[T, T], [S, S], boolean](R));


decl_type: function
theory: finite_sequences
library: prelude
signature: [[finseq, finseq] -> finseq]
location: 22 2 30 32
body:
    o(fs1, fs2): finseq =
       LET l1 = fs1`length,
           lsum = l1 + fs2`length
        IN (# length := lsum,
              seq := (LAMBDA (n:below[lsum]):
                        IF n < l1
                           THEN fs1`seq(n)
                           ELSE fs2`seq(n-l1)
                        ENDIF) #);


decl_type: function
theory: finite_sequences
library: prelude
signature: [[finseq, [nat, nat]] -> finseq]
location: 34 2 41 14
body:
    ^(fs, p): finseq =
      LET (m, n) = p
       IN IF m > n OR m >= fs`length
          THEN empty_seq
          ELSE LET len = min(n - m + 1, fs`length - m)
                IN (# length := len,
                      seq := (LAMBDA (x: below[len]): fs`seq(x + m)) #)
          ENDIF;


decl_type: function
theory: finite_sequences
library: prelude
signature: [[finseq, [nat, nat]] -> finseq]
location: 45 2 52 13
body:
    ^^(fs, p): finseq =
      LET (m, n) = p
       IN IF m >= n OR m >= fs`length
          THEN empty_seq
          ELSE LET len = min(n - m, fs`length - m)
                IN (# length := len,
                      seq := (LAMBDA (x: below[len]): fs`seq(x + m)) #)
          ENDIF


decl_type: constant
theory: finite_sequences
library: prelude
signature: finseq
location: 14 2 16 61
body:
    empty_seq: finseq =
      (# length := 0,
         seq := (LAMBDA (x: below[0]): epsilon! (t:T): true) #)


decl_type: tcc
theory: finite_sequences
library: prelude
signature: nil
location: 65 0 66 999
body:
  % Existence TCC generated (at line 4546, column 37) for  epsilon
  empty_seq_TCC1: OBLIGATION FORALL (x: below[0]): EXISTS (x1: T): TRUE;


decl_type: tcc
theory: finite_sequences
library: prelude
signature: nil
location: 68 0 75 999
body:
  % Subtype TCC generated (at line 4558, column 38) for  n
      % expected type  below[fs1`length]
  oh_TCC1: OBLIGATION
    FORALL (fs1: finseq, fs2: finseq, l1: nat):
      l1 = fs1`length IMPLIES
       (FORALL (lsum: nonneg_int):
          lsum = l1 + fs2`length IMPLIES
           (FORALL (n: below[lsum]): n < l1 IMPLIES n < fs1`length));


decl_type: tcc
theory: finite_sequences
library: prelude
signature: nil
location: 77 0 85 999
body:
  % Subtype TCC generated (at line 4559, column 38) for  n - l1
      % expected type  below[fs2`length]
  oh_TCC2: OBLIGATION
    FORALL (fs1: finseq, fs2: finseq, l1: nat):
      l1 = fs1`length IMPLIES
       (FORALL (lsum: nonneg_int):
          lsum = l1 + fs2`length IMPLIES
           (FORALL (n: below[lsum]):
              NOT n < l1 IMPLIES n - l1 >= 0 AND n - l1 < fs2`length));


decl_type: tcc
theory: finite_sequences
library: prelude
signature: nil
location: 87 0 93 999
body:
  % Subtype TCC generated (at line 4569, column 30) for  len
      % expected type  nat
  caret_TCC1: OBLIGATION
    FORALL (fs: finseq, p: [nat, nat], m: nat, n: nat):
      NOT m > n AND NOT m >= fs`length AND n = p`2 AND m = p`1 IMPLIES
       (FORALL (len: {k: int | k <= 1 + n - m AND k <= fs`length - m}):
          len = min(n - m + 1, fs`length - m) IMPLIES len >= 0);


decl_type: tcc
theory: finite_sequences
library: prelude
signature: nil
location: 95 0 102 999
body:
  % Subtype TCC generated (at line 4570, column 59) for  x + m
      % expected type  below[fs`length]
  caret_TCC2: OBLIGATION
    FORALL (fs: finseq, p: [nat, nat], m: nat, n: nat):
      NOT m > n AND NOT m >= fs`length AND n = p`2 AND m = p`1 IMPLIES
       (FORALL (len: {k: int | k <= 1 + n - m AND k <= fs`length - m}):
          len = min(n - m + 1, fs`length - m) IMPLIES
           (FORALL (x: below[len]): x + m < fs`length));


decl_type: tcc
theory: finite_sequences
library: prelude
signature: nil
location: 104 0 110 999
body:
  % Subtype TCC generated (at line 4580, column 30) for  len
      % expected type  nat
  doublecaret_TCC1: OBLIGATION
    FORALL (fs: finseq, p: [nat, nat], m: nat, n: nat):
      NOT m >= n AND NOT m >= fs`length AND n = p`2 AND m = p`1 IMPLIES
       (FORALL (len: {k: int | k <= n - m AND k <= fs`length - m}):
          len = min(n - m, fs`length - m) IMPLIES len >= 0);


decl_type: tcc
theory: finite_sequences
library: prelude
signature: nil
location: 112 0 119 999
body:
  % Subtype TCC generated (at line 4581, column 59) for  x + m
      % expected type  below[fs`length]
  doublecaret_TCC2: OBLIGATION
    FORALL (fs: finseq, p: [nat, nat], m: nat, n: nat):
      NOT m >= n AND NOT m >= fs`length AND n = p`2 AND m = p`1 IMPLIES
       (FORALL (len: {k: int | k <= n - m AND k <= fs`length - m}):
          len = min(n - m, fs`length - m) IMPLIES
           (FORALL (x: below[len]): x + m < fs`length));


decl_type: tcc
theory: finite_sequences
library: prelude
signature: nil
location: 121 0 123 999
body:
  % Subtype TCC generated (at line 4584, column 48) for  0
      % expected type  below[fs`length]
  extract1_TCC1: OBLIGATION FORALL (fs: {fs | fs`length = 1}): 0 < fs`length;


decl_type: formula
theory: naturalnumbers
library: prelude
signature: nil
location: 41 2 43 32
body:
    nat_induction: LEMMA
      (p(0) AND (FORALL j: p(j) IMPLIES p(j+1)))
          IMPLIES (FORALL i: p(i))


decl_type: formula
theory: naturalnumbers
library: prelude
signature: nil
location: 47 2 49 31
body:
    NAT_induction: LEMMA 
      (FORALL j: (FORALL k: k < j IMPLIES p(k)) IMPLIES p(j))
         IMPLIES (FORALL i: p(i))


decl_type: tcc
theory: naturalnumbers
library: prelude
signature: nil
location: 72 0 74 999
body:
  % Judgement subtype TCC generated (at line 2262, column 33) for  x
      % expected type  nat
  upfrom_nat_is_nat: OBLIGATION FORALL (i, x: upfrom(i)): x >= 0;


decl_type: tcc
theory: naturalnumbers
library: prelude
signature: nil
location: 76 0 78 999
body:
  % Judgement subtype TCC generated (at line 2263, column 37) for  x
      % expected type  posnat
  upfrom_posnat_is_posnat: OBLIGATION FORALL (n, x: upfrom(n)): x > 0;


decl_type: tcc
theory: naturalnumbers
library: prelude
signature: nil
location: 80 0 82 999
body:
  % Judgement subtype TCC generated (at line 2264, column 33) for  x
      % expected type  posnat
  above_nat_is_posnat: OBLIGATION FORALL (i, x: above(i)): x >= 0 AND x > 0;


decl_type: tcc
theory: naturalnumbers
library: prelude
signature: nil
location: 84 0 86 999
body:
  % Judgement subtype TCC generated (at line 2265, column 33) for  x
      % expected type  nat
  subrange_nat_is_nat: OBLIGATION FORALL (i, j, x: subrange(i, j)): x >= 0;


decl_type: tcc
theory: naturalnumbers
library: prelude
signature: nil
location: 88 0 91 999
body:
  % Judgement subtype TCC generated (at line 2266, column 39) for  x
      % expected type  posnat
  subrange_posnat_is_posnat: OBLIGATION
    FORALL (j, n, x: subrange(n, j)): x > 0;


decl_type: tcc
theory: naturalnumbers
library: prelude
signature: nil
location: 93 0 95 999
body:
  % Subtype TCC generated (at line 2268, column 58) for  i
      % expected type  upto(i)
  upto_TCC1: OBLIGATION FORALL (i: nat): i <= i;


decl_type: tcc
theory: naturalnumbers
library: prelude
signature: nil
location: 97 0 99 999
body:
  % Subtype TCC generated (at line 2276, column 31) for  i - 1
      % expected type  nat
  pred_TCC1: OBLIGATION FORALL (i: nat): i > 0 IMPLIES i - 1 >= 0;


decl_type: tcc
theory: naturalnumbers
library: prelude
signature: nil
location: 101 0 103 999
body:
  % Subtype TCC generated (at line 2278, column 31) for  i - j
      % expected type  nat
  tilde_TCC1: OBLIGATION FORALL (i: nat, j: nat): i > j IMPLIES i - j >= 0;


decl_type: tcc
theory: identity_props
library: prelude
signature: nil
location: 12 0 14 999
body:
  % Judgement subtype TCC generated (at line 438, column 25) for  I[T](x)
      % expected type  S
  I_preserves: OBLIGATION FORALL (x): S_pred(I[T](x));


decl_type: tcc
theory: identity_props
library: prelude
signature: nil
location: 16 0 18 999
body:
  % Judgement subtype TCC generated (at line 439, column 26) for  id[T](x)
      % expected type  S
  id_preserves: OBLIGATION FORALL (x): S_pred(id[T](x));


decl_type: tcc
theory: identity_props
library: prelude
signature: nil
location: 20 0 23 999
body:
  % Judgement subtype TCC generated (at line 440, column 32) for
      % identity[T](x)
      % expected type  S
  identity_preserves: OBLIGATION FORALL (x): S_pred(identity[T](x));


decl_type: tcc
theory: bounded_real_defs_alt
library: prelude
signature: nil
location: 21 0 24 999
body:
  % Judgement subtype TCC generated (at line 1983, column 4) for  x
      % expected type  (upper_bound?)
  lub_is_upper_bound: OBLIGATION
    FORALL (x: (least_upper_bound?)): upper_bound?(x);


decl_type: tcc
theory: bounded_real_defs_alt
library: prelude
signature: nil
location: 26 0 29 999
body:
  % Judgement subtype TCC generated (at line 1986, column 4) for  x
      % expected type  (lower_bound?)
  glb_is_lower_bound: OBLIGATION
    FORALL (x: (greatest_lower_bound?)): lower_bound?(x);


decl_type: tcc
theory: min_nat
library: prelude
signature: nil
location: 18 0 24 999
body:
  % Existence TCC generated (at line 2318, column 2) for
      % min(S): {a | S(a) AND (FORALL x: S(x) IMPLIES a <= x)}
  min_TCC1: OBLIGATION
    EXISTS (x1:
              [S: (nonempty?[T]) ->
                 {a | S(a) AND (FORALL x: S(x) IMPLIES a <= x)}]):
      TRUE;


decl_type: function
theory: disjointness
library: prelude
signature: [list[bool] -> boolean]
location: 10 2 16 20
body:
    pairwise_disjoint?(l): RECURSIVE boolean =
      cases l of
        null: true,
        cons(x,y): every(LAMBDA (z:bool): NOT (x AND z))(y)
                    AND pairwise_disjoint?(y)
      endcases
     MEASURE length(l)


decl_type: tcc
theory: disjointness
library: prelude
signature: nil
location: 22 0 27 999
body:
  % Termination TCC generated (at line 4934, column 22) for
      % pairwise_disjoint?(y)
  pairwise_disjoint?_TCC1: OBLIGATION
    FORALL (l: list[bool], x: bool, y: list[bool]):
      every(LAMBDA (z: bool): NOT (x AND z))(y) AND l = cons(x, y) IMPLIES
       length[boolean](y) < length[boolean](l);


decl_type: judgement
theory: relation_props
library: prelude
signature: (total?[T1, T3])
location: 17 2 18 75
body:
    composition_total: JUDGEMENT
      o(R1: (total?[T1, T2]), R2: (total?[T2, T3])) HAS_TYPE (total?[T1, T3])


decl_type: judgement
theory: relation_props
library: prelude
signature: (onto?[T1, T3])
location: 20 2 21 72
body:
    composition_onto: JUDGEMENT
      o(R1: (onto?[T1, T2]), R2: (onto?[T2, T3])) HAS_TYPE (onto?[T1, T3])


decl_type: tcc
theory: relation_props
library: prelude
signature: nil
location: 28 0 32 999
body:
  % Judgement subtype TCC generated (at line 1609, column 4) for  R1 o R2
      % expected type  (total?[T1, T3])
  composition_total: OBLIGATION
    FORALL (R1: (total?[T1, T2]), R2: (total?[T2, T3])):
      total?[T1, T3](R1 o R2);


decl_type: tcc
theory: relation_props
library: prelude
signature: nil
location: 34 0 37 999
body:
  % Judgement subtype TCC generated (at line 1612, column 4) for  R1 o R2
      % expected type  (onto?[T1, T3])
  composition_onto: OBLIGATION
    FORALL (R1: (onto?[T1, T2]), R2: (onto?[T2, T3])): onto?[T1, T3](R1 o R2);


decl_type: function
theory: function_iterate
library: prelude
signature: [[[T -> T], nat] -> [T -> T]]
location: 12 2 14 13
body:
    iterate(f, n)(x): RECURSIVE T =
      IF n = 0 THEN x ELSE f(iterate(f, n-1)(x)) ENDIF
      MEASURE n


decl_type: tcc
theory: function_iterate
library: prelude
signature: nil
location: 36 0 39 999
body:
  % Subtype TCC generated (at line 4437, column 38) for  n - 1
      % expected type  nat
  iterate_TCC1: OBLIGATION
    FORALL (f: [T -> T], n: nat, x: T): NOT n = 0 IMPLIES n - 1 >= 0;


decl_type: tcc
theory: function_iterate
library: prelude
signature: nil
location: 41 0 43 999
body:
  % Termination TCC generated (at line 4437, column 27) for  iterate(f, n - 1)
  iterate_TCC2: OBLIGATION
    FORALL (f: [T -> T], n: nat, x: T): NOT n = 0 IMPLIES n - 1 < n;


decl_type: formula
theory: list_props
library: prelude
signature: nil
location: 76 2 77 75
body:
    every_conjunct2: LEMMA
      (every(P)(l) AND every(Q)(l)) => every(LAMBDA (x: T): P(x) AND Q(x))(l)


decl_type: function
theory: list_props
library: prelude
signature: [list[T] -> nat]
location: 12 2 17 58
body:
    length(l): RECURSIVE nat =
      CASES l OF
        null: 0,
        cons(x, y): length(y) + 1
      ENDCASES
     MEASURE reduce_nat(0, (LAMBDA (x: T), (n: nat): n + 1))


decl_type: function
theory: list_props
library: prelude
signature: [[T, list[T]] -> bool]
location: 19 2 24 20
body:
    member(x, l): RECURSIVE bool =
      CASES l OF
        null: FALSE,
        cons(hd, tl): x = hd OR member(x, tl)
      ENDCASES
     MEASURE length(l)


decl_type: function
theory: list_props
library: prelude
signature: [[l: list[T], below[length(l)]] -> T]
location: 28 2 30 20
body:
    nth(l, (n:below[length(l)])): RECURSIVE T =
      IF n = 0 THEN car(l) ELSE nth(cdr(l), n-1) ENDIF
     MEASURE length(l)


decl_type: function
theory: list_props
library: prelude
signature: [[list[T], list[T]] -> list[T]]
location: 32 2 37 22
body:
    append(l1, l2): RECURSIVE list[T] =
      CASES l1 OF
        null: l2,
        cons(x, y): cons(x, append(y, l2))
      ENDCASES
      MEASURE length(l1)


decl_type: function
theory: list_props
library: prelude
signature: [list[T] -> list[T]]
location: 39 2 44 18
body:
    reverse(l): RECURSIVE list[T] =
      CASES l OF
        null: l,
        cons(x, y): append(reverse(y), cons(x, null))
      ENDCASES
      MEASURE length


decl_type: tcc
theory: list_props
library: prelude
signature: nil
location: 89 0 94 999
body:
  % Termination TCC generated (at line 4741, column 18) for  length(y)
  length_TCC1: OBLIGATION
    FORALL (l: list[T], x: T, y: list[T]):
      l = cons(x, y) IMPLIES
       reduce_nat[T](0, (LAMBDA (x: T), (n: nat): n + 1))(y) <
        reduce_nat[T](0, (LAMBDA (x: T), (n: nat): n + 1))(l);


decl_type: tcc
theory: list_props
library: prelude
signature: nil
location: 96 0 99 999
body:
  % Termination TCC generated (at line 4748, column 30) for  member(x, tl)
  member_TCC1: OBLIGATION
    FORALL (x: T, l: list[T], hd: T, tl: list[T]):
      NOT x = hd AND l = cons(hd, tl) IMPLIES length(tl) < length(l);


decl_type: tcc
theory: list_props
library: prelude
signature: nil
location: 101 0 104 999
body:
  % Subtype TCC generated (at line 4755, column 22) for  l
      % expected type  (cons?[T])
  nth_TCC1: OBLIGATION
    FORALL (l: list[T], (n: below[length(l)])): n = 0 IMPLIES cons?[T](l);


decl_type: tcc
theory: list_props
library: prelude
signature: nil
location: 106 0 109 999
body:
  % Subtype TCC generated (at line 4755, column 38) for  l
      % expected type  (cons?[T])
  nth_TCC2: OBLIGATION
    FORALL (l: list[T], (n: below[length(l)])): NOT n = 0 IMPLIES cons?[T](l);


decl_type: tcc
theory: list_props
library: prelude
signature: nil
location: 111 0 115 999
body:
  % Subtype TCC generated (at line 4755, column 42) for  n - 1
      % expected type  below[length(cdr(l))]
  nth_TCC3: OBLIGATION
    FORALL (l: list[T], (n: below[length(l)])):
      NOT n = 0 IMPLIES n - 1 >= 0 AND n - 1 < length(cdr[T](l));


decl_type: tcc
theory: list_props
library: prelude
signature: nil
location: 117 0 121 999
body:
  % Termination TCC generated (at line 4755, column 30) for
      % nth(cdr(l), n - 1)
  nth_TCC4: OBLIGATION
    FORALL (l: list[T], (n: below[length(l)])):
      NOT n = 0 IMPLIES length(cdr[T](l)) < length(l);


decl_type: tcc
theory: list_props
library: prelude
signature: nil
location: 123 0 126 999
body:
  % Termination TCC generated (at line 4761, column 26) for  append(y, l2)
  append_TCC1: OBLIGATION
    FORALL (l1: list[T], x: T, y: list[T]):
      l1 = cons(x, y) IMPLIES length(y) < length(l1);


decl_type: tcc
theory: QuotientDefinition
library: prelude
signature: nil
location: 59 0 62 999
body:
  % Subtype TCC generated (at line 6075, column 26) for  EquivClass(S)(x)
      % expected type  p: (nonempty?[T])
  repEC_TCC1: OBLIGATION
    FORALL (S: equivalence[T], x: T): nonempty?[T](EquivClass(S)(x));


decl_type: tcc
theory: QuotientDefinition
library: prelude
signature: nil
location: 64 0 67 999
body:
  % Subtype TCC generated (at line 6088, column 37) for  P
      % expected type  p: (nonempty?[T])
  rep_TCC1: OBLIGATION
    FORALL (S: equivalence[T], P: Quotient(S)): nonempty?[T](P);


decl_type: tcc
theory: QuotientDefinition
library: prelude
signature: nil
location: 69 0 73 999
body:
  % Subtype TCC generated (at line 6091, column 12) for  EquivClass(S)(x)
      % expected type  Quotient(S)
  rep_is_repEC_TCC1: OBLIGATION
    FORALL (S: equivalence[T], x: T):
      EXISTS (x_1: T): EquivClass(S)(x) = EquivClass(S)(x_1);


decl_type: function
theory: stdmath
library: prelude
signature: [real -> nnreal]
location: 28 2 32 9
body:
    SQRT(x:real):nnreal =
      IF x < 0 THEN 
        throw[nnreal,string](NotARealNumber,"SQRT("+x+")")
      ELSE sqrt_lisp(x)
      ENDIF


decl_type: function
theory: stdmath
library: prelude
signature: [real -> real]
location: 34 2 38 9
body:
    LOG(x:real):real =
      IF x <= 0 THEN 
        throw[real,string](NotARealNumber,"LOG("+x+")")
      ELSE log_lisp(x)
      ENDIF


decl_type: function
theory: stdmath
library: prelude
signature: [real -> real]
location: 40 2 46 9
body:
    TAN(x:real):real =
      LET d = COS(x) IN
      IF d = 0 THEN 
        throw[real,string](NotARealNumber,"TAN("+x+"0)")
      ELSE
        SIN(x)/COS(x)
      ENDIF


decl_type: function
theory: stdmath
library: prelude
signature: [[real, real] -> real]
location: 48 2 52 9
body:
    ATAN(y,x:real):real = 
      IF x=0 AND y= 0 THEN 
        throw[real,string](NotARealNumber,"ATAN(0,0)")
      ELSE atan_lisp(y,x)
      ENDIF


decl_type: function
theory: stdmath
library: prelude
signature: [real -> real]
location: 54 2 58 9
body:
    ASIN(x:real) : real =
      IF x < -1 OR x > 1 THEN
        throw[real,string](NotARealNumber,"ASIN("+x+")")
      ELSE asin_lisp(x)
      ENDIF


decl_type: function
theory: stdmath
library: prelude
signature: [real -> real]
location: 60 2 64 9
body:
    ACOS(x:real) : real =
      IF x < -1 OR x > 1 THEN
        throw[real,string](NotARealNumber,"ACOS("+x+")")
      ELSE acos_lisp(x)
      ENDIF


decl_type: tcc
theory: stdmath
library: prelude
signature: nil
location: 74 0 77 999
body:
  % Existence TCC generated (at line 6935, column 2) for
      % SIN(x: real): {x: real | -1 <= x AND x <= 1}
  SIN_TCC1: OBLIGATION
    EXISTS (x1: [real -> {x: real | -1 <= x AND x <= 1}]): TRUE;


decl_type: tcc
theory: stdmath
library: prelude
signature: nil
location: 79 0 81 999
body:
  % Existence TCC generated (at line 6938, column 2) for
      % RANDOM: {y: nnreal | 0 <= y AND y <= 1}
  RANDOM_TCC1: OBLIGATION EXISTS (x: {y: nnreal | y <= 1}): TRUE;


decl_type: tcc
theory: stdmath
library: prelude
signature: nil
location: 83 0 85 999
body:
  % Existence TCC generated (at line 6939, column 2) for
      % NRANDOM(n: posnat): {y: nat | 0 <= y AND y < n}
  NRANDOM_TCC1: OBLIGATION EXISTS (x: [n: posnat -> {y: nat | y < n}]): TRUE;


decl_type: tcc
theory: stdmath
library: prelude
signature: nil
location: 87 0 89 999
body:
  % Subtype TCC generated (at line 6950, column 19) for  x
      % expected type  nnreal
  SQRT_TCC1: OBLIGATION FORALL (x: real): NOT x < 0 IMPLIES x >= 0;


decl_type: tcc
theory: stdmath
library: prelude
signature: nil
location: 91 0 93 999
body:
  % Subtype TCC generated (at line 6956, column 18) for  x
      % expected type  posreal
  LOG_TCC1: OBLIGATION FORALL (x: real): NOT x <= 0 IMPLIES x >= 0 AND x > 0;


decl_type: tcc
theory: stdmath
library: prelude
signature: nil
location: 95 0 99 999
body:
  % Subtype TCC generated (at line 6964, column 13) for  COS(x)
      % expected type  nznum
  TAN_TCC1: OBLIGATION
    FORALL (x: real, d: {x: real | -1 <= x AND x <= 1}):
      NOT d = 0 AND d = COS(x) IMPLIES COS(x) /= 0;


decl_type: judgement
theory: orders_alt
library: prelude
signature: (lower_bound?)
location: 12 2 13 53
body:
    greatest_lower_bound_is_lower_bound: JUDGEMENT
      (greatest_lower_bound?) SUBTYPE_OF (lower_bound?)


decl_type: tcc
theory: orders_alt
library: prelude
signature: nil
location: 19 0 22 999
body:
  % Judgement subtype TCC generated (at line 595, column 4) for  x
      % expected type  (upper_bound?)
  least_upper_bound_is_upper_bound: OBLIGATION
    FORALL (x: (least_upper_bound?)): upper_bound?(x);


decl_type: tcc
theory: orders_alt
library: prelude
signature: nil
location: 24 0 27 999
body:
  % Judgement subtype TCC generated (at line 598, column 4) for  x
      % expected type  (lower_bound?)
  greatest_lower_bound_is_lower_bound: OBLIGATION
    FORALL (x: (greatest_lower_bound?)): lower_bound?(x);


decl_type: formula
theory: bv_arith_nat_defs
library: prelude
signature: nil
location: 51 2 52 73
body:
    bv_plus : LEMMA (FORALL (bv: bvec[N], i: int):
                           bv2nat(bv + i) = mod(bv2nat(bv) + i, exp2(N))) ;


decl_type: formula
theory: bv_arith_nat_defs
library: prelude
signature: nil
location: 58 2 59 68
body:
    bv_minus     : LEMMA (FORALL (bv: bvec[N], i: int):
                      bv2nat(bv - i) = mod(bv2nat(bv) - i, exp2(N))) ;


decl_type: function
theory: bv_arith_nat_defs
library: prelude
location: 48 2 49 72
signature:
  [d: [bvec[N], int] ->
          {bvn: bvec[N] |
                   bv2nat(bvn) = mod(bv2nat(d`1) + d`2, exp2(N))}]

body:
    +(bv: bvec[N], i: int): {bvn: bvec[N] | 
                               bv2nat(bvn) = mod(bv2nat(bv) + i, exp2(N))}


decl_type: function
theory: bv_arith_nat_defs
library: prelude
location: 64 2 68 36
signature:
  [d: [bvec[N], bvec[N]] ->
          {bv: bvec[N] |
                   bv2nat(bv) =
                    IF bv2nat(d`1) + bv2nat(d`2) < exp2(N)
                      THEN bv2nat(d`1) + bv2nat(d`2)
                    ELSE bv2nat(d`1) + bv2nat(d`2) - exp2(N)
                    ENDIF}]

body:
    +(bv1: bvec[N], bv2: bvec[N]): {bv: bvec[N] | bv2nat(bv) = 
                                IF bv2nat(bv1) + bv2nat(bv2) < exp2(N)
                                THEN bv2nat(bv1) + bv2nat(bv2)
                                ELSE bv2nat(bv1) + bv2nat(bv2) - exp2(N) 
                                ENDIF}


decl_type: function
theory: bv_arith_nat_defs
library: prelude
signature:
  [d: [bvec[N], bvec[N]] ->
  {bv: bvec[2 * N] | bv2nat(bv) = bv2nat(d`1) * bv2nat(d`2)}]

location: 72 2 73 70
body:
    *(bv1: bvec[N], bv2: bvec[N]): {bv: bvec[2*N] | bv2nat(bv) = 
                                            bv2nat(bv1) * bv2nat(bv2)} ;


decl_type: tcc
theory: bv_arith_nat_defs
library: prelude
signature: nil
location: 82 0 91 999
body:
  % Existence TCC generated (at line 5691, column 2) for
      % +(bv: bvec[N], i: int):
      %       {bvn: bvec[N] | bv2nat(bvn) = mod(bv2nat(bv) + i, exp2(N))}
  plus_TCC1: OBLIGATION
    EXISTS (x:
              [d: [bvec[N], int] ->
                 {bvn: bvec[N] |
                          bv2nat[N](bvn) =
                           mod(bv2nat[N](d`1) + d`2, exp2(N))}]):
      TRUE;


decl_type: tcc
theory: bv_arith_nat_defs
library: prelude
signature: nil
location: 93 0 110 999
body:
  % Existence TCC generated (at line 5707, column 2) for
      % +(bv1: bvec[N], bv2: bvec[N]):
      %       {bv: bvec[N] |
      %                bv2nat(bv) =
      %                 IF bv2nat(bv1) + bv2nat(bv2) < exp2(N)
      %                   THEN bv2nat(bv1) + bv2nat(bv2)
      %                 ELSE bv2nat(bv1) + bv2nat(bv2) - exp2(N)
      %                 ENDIF}
  plus_TCC2: OBLIGATION
    EXISTS (x:
              [d: [bvec[N], bvec[N]] ->
                 {bv: bvec[N] |
                          bv2nat[N](bv) =
                           IF bv2nat[N](d`1) + bv2nat[N](d`2) < exp2(N)
                             THEN bv2nat[N](d`1) + bv2nat[N](d`2)
                           ELSE bv2nat[N](d`1) + bv2nat[N](d`2) - exp2(N)
                           ENDIF}]):
      TRUE;


decl_type: tcc
theory: bv_arith_nat_defs
library: prelude
signature: nil
location: 112 0 121 999
body:
  % Existence TCC generated (at line 5715, column 2) for
      % *(bv1: bvec[N], bv2: bvec[N]):
      %       {bv: bvec[2 * N] | bv2nat(bv) = bv2nat(bv1) * bv2nat(bv2)};
  times_TCC1: OBLIGATION
    EXISTS (x:
              [d: [bvec[N], bvec[N]] ->
                 {bv: bvec[2 * N] |
                          bv2nat[2 * N](bv) =
                           bv2nat[N](d`1) * bv2nat[N](d`2)}]):
      TRUE;


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 49 0 50 74
body:
  both_sides_times_pos_neg_lt1: LEMMA
    IF n0z > 0 THEN x * n0z < y * n0z ELSE y * n0z < x * n0z ENDIF IFF x < y


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 52 0 53 74
body:
  both_sides_times_pos_neg_lt2: LEMMA
    IF n0z > 0 THEN n0z * x < n0z * y ELSE n0z * y < n0z * x ENDIF IFF x < y


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 55 0 56 77
body:
  both_sides_times_pos_neg_le1: LEMMA
    IF n0z > 0 THEN x * n0z <= y * n0z ELSE y * n0z <= x * n0z ENDIF IFF x <= y


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 58 0 59 77
body:
  both_sides_times_pos_neg_le2: LEMMA
    IF n0z > 0 THEN n0z * x <= n0z * y ELSE n0z * y <= n0z * x ENDIF IFF x <= y


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 61 0 62 74
body:
  both_sides_times_pos_neg_gt1: LEMMA
    IF n0z > 0 THEN x * n0z > y * n0z ELSE y * n0z > x * n0z ENDIF IFF x > y


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 64 0 65 74
body:
  both_sides_times_pos_neg_gt2: LEMMA
    IF n0z > 0 THEN n0z * x > n0z * y ELSE n0z * y > n0z * x ENDIF IFF x > y


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 67 0 68 77
body:
  both_sides_times_pos_neg_ge1: LEMMA
    IF n0z > 0 THEN x * n0z >= y * n0z ELSE y * n0z >= x * n0z ENDIF IFF x >= y


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 70 0 71 77
body:
  both_sides_times_pos_neg_ge2: LEMMA
    IF n0z > 0 THEN n0z * x >= n0z * y ELSE n0z * y >= n0z * x ENDIF IFF x >= y


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 77 0 78 66
body:
  both_sides_div_pos_neg_lt1: LEMMA
    IF n0z > 0 THEN x/n0z < y/n0z ELSE y/n0z < x/n0z ENDIF IFF x < y


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 80 0 81 72
body:
  both_sides_div_pos_neg_lt2: LEMMA
    IF n0z > 0 THEN n0z/px < n0z/py ELSE n0z/py < n0z/px ENDIF IFF py < px


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 83 0 84 72
body:
  both_sides_div_pos_neg_lt3: LEMMA
    IF n0z > 0 THEN n0z/nx < n0z/ny ELSE n0z/ny < n0z/nx ENDIF IFF ny < nx


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 86 0 87 69
body:
  both_sides_div_pos_neg_le1: LEMMA
    IF n0z > 0 THEN x/n0z <= y/n0z ELSE y/n0z <= x/n0z ENDIF IFF x <= y


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 89 0 90 75
body:
  both_sides_div_pos_neg_le2: LEMMA
    IF n0z > 0 THEN n0z/px <= n0z/py ELSE n0z/py <= n0z/px ENDIF IFF py <= px


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 92 0 93 75
body:
  both_sides_div_pos_neg_le3: LEMMA
    IF n0z > 0 THEN n0z/nx <= n0z/ny ELSE n0z/ny <= n0z/nx ENDIF IFF ny <= nx


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 95 0 96 66
body:
  both_sides_div_pos_neg_gt1: LEMMA
    IF n0z > 0 THEN x/n0z > y/n0z ELSE y/n0z > x/n0z ENDIF IFF x > y


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 98 0 99 72
body:
  both_sides_div_pos_neg_gt2: LEMMA
    IF n0z > 0 THEN n0z/px > n0z/py ELSE n0z/py > n0z/px ENDIF IFF py > px


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 101 0 102 72
body:
  both_sides_div_pos_neg_gt3: LEMMA
    IF n0z > 0 THEN n0z/nx > n0z/ny ELSE n0z/ny > n0z/nx ENDIF IFF ny > nx


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 104 0 105 69
body:
  both_sides_div_pos_neg_ge1: LEMMA
    IF n0z > 0 THEN x/n0z >= y/n0z ELSE y/n0z >= x/n0z ENDIF IFF x >= y


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 107 0 108 75
body:
  both_sides_div_pos_neg_ge2: LEMMA
    IF n0z > 0 THEN n0z/px >= n0z/py ELSE n0z/py >= n0z/px ENDIF IFF py >= px


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 110 0 111 75
body:
  both_sides_div_pos_neg_ge3: LEMMA
    IF n0z > 0 THEN n0z/nx >= n0z/ny ELSE n0z/ny >= n0z/nx ENDIF IFF ny >= nx


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 140 2 141 74
body:
    both_sides_times_pos_neg_le1_imp: LEMMA
      x <= y IMPLIES IF w >= 0 THEN x * w <= y * w ELSE y * w <= x * w ENDIF


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 143 2 144 74
body:
    both_sides_times_pos_neg_le2_imp: LEMMA
      x <= y IMPLIES IF w >= 0 THEN w * x <= w * y ELSE w * y <= w * x ENDIF


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 146 2 147 74
body:
    both_sides_times_pos_neg_ge1_imp: LEMMA
      x >= y IMPLIES IF w >= 0 THEN x * w >= y * w ELSE y * w >= x * w ENDIF


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 149 2 150 74
body:
    both_sides_times_pos_neg_ge2_imp: LEMMA
      x >= y IMPLIES IF w >= 0 THEN w * x >= w * y ELSE w * y >= w * x ENDIF


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 186 0 197 25
body:
  le_times_le_any1: LEMMA
          IF w >= 0 IFF x >= 0
             THEN IF y >= 0 IFF z >= 0
                     THEN abs(w) <= abs(y) AND abs(x) <= abs(z)
                     ELSE (w = 0 OR x = 0) AND (y = 0 OR z = 0)
                  ENDIF
             ELSE IF y >= 0 IFF z >= 0
                     THEN true
                     ELSE abs(w) >= abs(y) AND abs(x) >= abs(z)
                  ENDIF
          ENDIF
            IMPLIES w * x <= y * z


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 199 0 210 25
body:
  ge_times_ge_any1: LEMMA
          IF y >= 0 IFF z >= 0
             THEN IF w >= 0 IFF x >= 0
                     THEN abs(w) >= abs(y) AND abs(x) >= abs(z)
                     ELSE (w = 0 OR x = 0) AND (y = 0 OR z = 0)
                  ENDIF
             ELSE IF w >= 0 IFF x >= 0
                     THEN true
                     ELSE abs(w) <= abs(y) AND abs(x) <= abs(z)
                  ENDIF
          ENDIF
            IMPLIES w * x >= y * z


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 212 0 224 24
body:
  lt_times_lt_any1: LEMMA
          IF w = 0 OR x = 0
             THEN 0 < y AND 0 < z OR y < 0 AND z < 0
          ELSIF w > 0 IFF x > 0
             THEN (y > 0 IFF z > 0) AND
                  (abs(w) <= abs(y) AND abs(x) <  abs(z) OR
                   abs(w) <  abs(y) AND abs(x) <= abs(z))
          ELSIF y > 0 IFF z > 0
             THEN true
             ELSE abs(w) >= abs(y) AND abs(x) >  abs(z) OR
                  abs(w) >  abs(y) AND abs(x) >= abs(z)
          ENDIF
            IMPLIES w * x < y * z


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 226 0 238 24
body:
  gt_times_gt_any1: LEMMA
          IF y = 0 OR z = 0
             THEN 0 < w AND 0 < x OR w < 0 AND x < 0
          ELSIF y > 0 IFF z > 0
             THEN (w > 0 IFF x > 0) AND
                  (abs(w) >= abs(y) AND abs(x) >  abs(z) OR
                   abs(w) >  abs(y) AND abs(x) >= abs(z))
          ELSIF w > 0 IFF x > 0
             THEN true
             ELSE abs(w) <= abs(y) AND abs(x) <  abs(z) OR
                  abs(w) <  abs(y) AND abs(x) <= abs(z)
          ENDIF
            IMPLIES w * x > y * z


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 244 0 255 13
body:
  le_times_le_any2: LEMMA
          w * x <= y * z IMPLIES
          IF y = 0 OR z = 0
             THEN (0 >= w OR 0 >= x) AND (w >= 0 OR x >= 0)
          ELSIF y > 0 IFF z > 0
             THEN (w > 0 IFF x > 0) IMPLIES
                  (abs(w) <  abs(y) OR abs(x) <= abs(z)) AND
                  (abs(w) <= abs(y) OR abs(x) <  abs(z))
          ELSE NOT (w > 0 IFF x > 0) AND
               (abs(w) >  abs(y) OR abs(x) >= abs(z)) AND
               (abs(w) >= abs(y) OR abs(x) >  abs(z))
          ENDIF


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 257 0 268 13
body:
  ge_times_ge_any2: LEMMA
          w * x >= y * z IMPLIES
          IF w = 0 OR x = 0
             THEN (0 >= y OR 0 >= z) AND (y >= 0 OR z >= 0)
          ELSIF w > 0 IFF x > 0
             THEN (y > 0 IFF z > 0) IMPLIES
                  (abs(w) >  abs(y) OR abs(x) >= abs(z)) AND
                  (abs(w) >= abs(y) OR abs(x) > abs(z))
          ELSE NOT (y > 0 IFF z > 0) AND
               (abs(w) <  abs(y) OR abs(x) <= abs(z)) AND
               (abs(w) <= abs(y) OR abs(x) <  abs(z))
          ENDIF


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 270 0 279 13
body:
  lt_times_lt_any2: LEMMA
          w * x < y * z IMPLIES
          IF y >= 0 IFF z >= 0
             THEN IF w >= 0 IFF x >= 0
                     THEN abs(w) < abs(y) OR abs(x) < abs(z)
                     ELSE (w /= 0 AND x /= 0) OR (y /= 0 AND z /= 0)
                  ENDIF
             ELSE NOT (w >= 0 IFF x >= 0) AND
                  (abs(w) > abs(y) OR abs(x) > abs(z))
          ENDIF


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 281 0 290 13
body:
  gt_times_gt_any2: LEMMA
          w * x > y * z IMPLIES
          IF w >= 0 IFF x >= 0
             THEN IF y >= 0 IFF z >= 0
                     THEN abs(w) > abs(y) OR abs(x) > abs(z)
                     ELSE (w /= 0 AND x /= 0) OR (y /= 0 AND z /= 0)
                  ENDIF
             ELSE NOT (y >= 0 IFF z >= 0) AND
                  (abs(w) < abs(y) OR abs(x) < abs(z))
          ENDIF


decl_type: formula
theory: ordinals
library: prelude
signature: nil
location: 58 2 60 30
body:
    ordinal_induction: AXIOM
      (FORALL r: (FORALL s: s < r IMPLIES p(s)) IMPLIES p(r))
        IMPLIES (FORALL r: p(r))


decl_type: function
theory: ordinals
library: prelude
signature: [[ordstruct, ordstruct] -> bool]
location: 15 2 25 19
body:
    <(x, y): RECURSIVE bool =
       CASES x OF
          zero: NOT zero?(y),
          add(i, u, v): CASES y OF
                          zero: FALSE,
                          add(j, z, w): (u<z) OR
                                        (u=z) AND (i<j) OR
                                        (u=z) AND (i=j) AND (v<w)
                        ENDCASES
       ENDCASES
     MEASURE size(x);


decl_type: function
theory: ordinals
library: prelude
signature: [ordstruct -> bool]
location: 31 2 40 15
body:
    ordinal?(x): RECURSIVE bool =
      CASES x OF
        zero: TRUE,
        add(i, u, v): (ordinal?(u) AND ordinal?(v) AND 
                        CASES v OF
                          zero: TRUE,
                          add(k, r, s): r < u
                        ENDCASES)
      ENDCASES
     MEASURE size


decl_type: tcc
theory: ordinals
library: prelude
signature: nil
location: 70 0 76 999
body:
  % Termination TCC generated (at line 4644, column 39) for  (u < z)
  lessp_TCC1: OBLIGATION
    FORALL (x: ordstruct, y: ordstruct, i: posnat, u: ordstruct,
            v: ordstruct):
      x = add(i, u, v) IMPLIES
       (FORALL (j: posnat, z: ordstruct, w: ordstruct):
          y = add(j, z, w) IMPLIES size(u) < size(x));


decl_type: tcc
theory: ordinals
library: prelude
signature: nil
location: 78 0 87 999
body:
  % Termination TCC generated (at line 4646, column 59) for  (v < w)
  lessp_TCC2: OBLIGATION
    FORALL (x: ordstruct,
            v1: [{z: [ordstruct, ordstruct] | size(z`1) < size(x)} -> bool],
            y: ordstruct, i: posnat, u: ordstruct, v: ordstruct):
      x = add(i, u, v) IMPLIES
       (FORALL (j: posnat, z: ordstruct, w: ordstruct):
               (i = j) AND (u = z) AND NOT ((u = z) AND (i < j))
           AND NOT v1(u, z) AND y = add(j, z, w)
           IMPLIES size(v) < size(x));


decl_type: tcc
theory: ordinals
library: prelude
signature: nil
location: 89 0 92 999
body:
  % Termination TCC generated (at line 4658, column 21) for  ordinal?(u)
  ordinal?_TCC1: OBLIGATION
    FORALL (x: ordstruct, i: posnat, u: ordstruct, v: ordstruct):
      x = add(i, u, v) IMPLIES size(u) < size(x);


decl_type: tcc
theory: ordinals
library: prelude
signature: nil
location: 94 0 98 999
body:
  % Termination TCC generated (at line 4658, column 37) for  ordinal?(v)
  ordinal?_TCC2: OBLIGATION
    FORALL (x: ordstruct, v1: [{z: ordstruct | size(z) < size(x)} -> bool],
            i: posnat, u: ordstruct, v: ordstruct):
      v1(u) AND x = add(i, u, v) IMPLIES size(v) < size(x);


decl_type: tcc
theory: ordinals
library: prelude
signature: nil
location: 100 0 102 999
body:
  % Existence TCC generated (at line 4666, column 2) for
      % ordinal: TYPE+ = (ordinal?)
  ordinal_TCC1: OBLIGATION EXISTS (x: {x: ordstruct | ordinal?(x)}): TRUE;


decl_type: formula
theory: bounded_int_inductions
library: prelude
signature: nil
location: 9 2 11 34
body:
    upfrom_induction: LEMMA
      (pf(m) AND (FORALL jf: pf(jf) IMPLIES pf(jf + 1)))
         IMPLIES (FORALL jf: pf(jf))


decl_type: formula
theory: bounded_int_inductions
library: prelude
signature: nil
location: 13 2 15 33
body:
    UPFROM_induction: LEMMA
      (FORALL jf: (FORALL kf: kf < jf IMPLIES pf(kf)) IMPLIES pf(jf))
        IMPLIES (FORALL jf: pf(jf))


decl_type: formula
theory: bounded_int_inductions
library: prelude
signature: nil
location: 20 2 22 33
body:
    above_induction: LEMMA
      (pa(m+1) AND (FORALL ja: pa(ja) IMPLIES pa(ja + 1)))
        IMPLIES (FORALL ja: pa(ja))


decl_type: formula
theory: bounded_int_inductions
library: prelude
signature: nil
location: 24 2 26 33
body:
    ABOVE_induction: LEMMA
      (FORALL ja: (FORALL ka: ka < ja IMPLIES pa(ka)) IMPLIES pa(ja))
        IMPLIES (FORALL ja: pa(ja))


decl_type: tcc
theory: bounded_int_inductions
library: prelude
signature: nil
location: 33 0 35 999
body:
  % Subtype TCC generated (at line 3939, column 8) for  m
      % expected type  upfrom(m)
  upfrom_induction_TCC1: OBLIGATION m >= m;


decl_type: tcc
theory: bounded_int_inductions
library: prelude
signature: nil
location: 37 0 41 999
body:
  % Subtype TCC generated (at line 3939, column 45) for  jf + 1
      % expected type  upfrom(m)
  upfrom_induction_TCC2: OBLIGATION
    FORALL (pf: pred[upfrom(m)]):
      pf(m) IMPLIES (FORALL (jf): pf(jf) IMPLIES jf + 1 >= m);


decl_type: tcc
theory: bounded_int_inductions
library: prelude
signature: nil
location: 43 0 45 999
body:
  % Subtype TCC generated (at line 3950, column 8) for  m + 1
      % expected type  above(m)
  above_induction_TCC1: OBLIGATION m + 1 > m;


decl_type: tcc
theory: bounded_int_inductions
library: prelude
signature: nil
location: 47 0 51 999
body:
  % Subtype TCC generated (at line 3950, column 47) for  ja + 1
      % expected type  above(m)
  above_induction_TCC2: OBLIGATION
    FORALL (pa: pred[above(m)]):
      pa(m + 1) IMPLIES (FORALL (ja): pa(ja) IMPLIES ja + 1 > m);


decl_type: function
theory: bv_arithmetic_defs
library: prelude
location: 21 2 23 55
signature:
  [bv: bvec[N] ->
          {bvn: bvec[N] |
                   bv2int(bvn) =
                    IF bv2int(bv) = minint[N] THEN bv2int(bv)
                    ELSE -(bv2int(bv))
                    ENDIF}]

body:
    -(bv: bvec[N]): { bvn: bvec[N] | bv2int(bvn) = 
                                IF bv2int(bv) = minint[N] THEN bv2int(bv)
                                ELSE -(bv2int(bv)) ENDIF}


decl_type: function
theory: bv_arithmetic_defs
library: prelude
signature: [[bvec[N], bvec[N]] -> bool]
location: 32 2 33 71
body:
    overflow(bv1,bv2): bool = (bv2int(bv1) + bv2int(bv2)) > maxint[N]
                               OR (bv2int(bv1) + bv2int(bv2)) < minint[N]


decl_type: function
theory: bv_arithmetic_defs
library: prelude
signature: [[bvec[N], bvec[N]] -> bool]
location: 51 2 52 73
body:
    mult_overflow(bv1, bv2): bool = (bv2int(bv1) * bv2int(bv2)) > maxint[N]
                                 OR (bv2int(bv1) * bv2int(bv2)) < minint[N]


decl_type: function
theory: bv_arithmetic_defs
library: prelude
signature:
  [[bv1: bvec[N], {bv2 | NOT mult_overflow(bv1, bv2)}] ->
  bvec[N]]

location: 54 2 55 37
body:
    bv_stimes(bv1, (bv2 | NOT mult_overflow(bv1, bv2))): bvec[N] =
      int2bv(bv2int(bv1) * bv2int(bv2))


decl_type: tcc
theory: bv_arithmetic_defs
library: prelude
signature: nil
location: 62 0 77 999
body:
  % Existence TCC generated (at line 5785, column 2) for
      % -(bv: bvec[N]):
      %       {bvn: bvec[N] |
      %                bv2int(bvn) =
      %                 IF bv2int(bv) = minint[N] THEN bv2int(bv)
      %                 ELSE -(bv2int(bv))
      %                 ENDIF}
  difference_TCC1: OBLIGATION
    EXISTS (x:
              [bv: bvec[N] ->
                 {bvn: bvec[N] |
                          bv2int[N](bvn) =
                           IF bv2int[N](bv) = minint[N] THEN bv2int[N](bv)
                           ELSE -(bv2int[N](bv))
                           ENDIF}]):
      TRUE;


decl_type: tcc
theory: bv_arithmetic_defs
library: prelude
signature: nil
location: 79 0 85 999
body:
  % Subtype TCC generated (at line 5813, column 11) for
      % bv2int(bv1) + bv2int(bv2)
      % expected type  iv: rng_2s_comp
  bv_splus_TCC1: OBLIGATION
    FORALL (bv1: bvec[N], (bv2: bvec[N] | NOT overflow(bv1, bv2))):
      minint[N] <= bv2int[N](bv1) + bv2int[N](bv2) AND
       bv2int[N](bv1) + bv2int[N](bv2) <= maxint[N];


decl_type: tcc
theory: bv_arithmetic_defs
library: prelude
signature: nil
location: 87 0 93 999
body:
  % Subtype TCC generated (at line 5819, column 11) for
      % bv2int(bv1) * bv2int(bv2)
      % expected type  iv: rng_2s_comp
  bv_stimes_TCC1: OBLIGATION
    FORALL (bv1: bvec[N], (bv2: bvec[N] | NOT mult_overflow(bv1, bv2))):
      minint[N] <= bv2int[N](bv1) * bv2int[N](bv2) AND
       bv2int[N](bv1) * bv2int[N](bv2) <= maxint[N];


decl_type: function
theory: stdprog
library: prelude
signature: [[ExceptionTag[void], T, T] -> T]
location: 15 2 16 75
body:
    catch(tag:ExceptionTag[void],t1,t2:T): MACRO T =
      catch_lift[T,void](tag,LAMBDA(d:Dummy):t1,LAMBDA(e:Exception[void]):t2)


decl_type: function
theory: stdprog
library: prelude
signature: [[list[ExceptionTag[void]], T, T] -> T]
location: 20 2 21 78
body:
    catch(l:list[ExceptionTag[void]],t1,t2:T) : MACRO T =
      catch_list_lift[T,void](l,LAMBDA(d:Dummy):t1,LAMBDA(e:Exception[void]):t2)


decl_type: function
theory: stdprog
library: prelude
signature: [Mutable -> T]
location: 36 2 40 9
body:
    val(v:Mutable): T = 
      if undef(v) then 
        throw(UndefinedMutableVariable)
      else val_lisp(v)
      endif


decl_type: formula
theory: QuotientIteration
library: prelude
signature: nil
location: 20 2 25 47
body:
    QuotientAction : LEMMA
      FORALL(R : equivalence[Quotient(S)]) :
        bijective?[Quotient(R), Quotient(action(S)(R))]
          (lift[Quotient(S), Quotient(S), Quotient(action(S)(R))](R)
             (lift[X, X, Quotient(action(S)(R))](S)
                (quotient_map[X](action(S)(R)))))


decl_type: judgement
theory: QuotientIteration
library: prelude
signature: equivalence[X]
location: 17 2 18 67
body:
    action_equivalence_is_equivalence: JUDGEMENT
      action(S)(R : equivalence[Quotient(S)]) HAS_TYPE equivalence[X]


decl_type: tcc
theory: QuotientIteration
library: prelude
signature: nil
location: 32 0 36 999
body:
  % Subtype TCC generated (at line 6291, column 6) for  EquivClass(S)(x)
      % expected type  Quotient[X](S)
  action_TCC1: OBLIGATION
    FORALL (S: equivalence[X], R: equivalence[Quotient[X](S)], x: X, y: X):
      EXISTS (x_1: X): EquivClass[X](S)(x) = EquivClass[X](S)(x_1);


decl_type: tcc
theory: QuotientIteration
library: prelude
signature: nil
location: 38 0 42 999
body:
  % Subtype TCC generated (at line 6291, column 24) for  EquivClass(S)(y)
      % expected type  Quotient[X](S)
  action_TCC2: OBLIGATION
    FORALL (S: equivalence[X], R: equivalence[Quotient[X](S)], x: X, y: X):
      EXISTS (x: X): EquivClass[X](S)(y) = EquivClass[X](S)(x);


decl_type: tcc
theory: QuotientIteration
library: prelude
signature: nil
location: 44 0 47 999
body:
  % Judgement subtype TCC generated (at line 6294, column 4) for  action(S)(R)
      % expected type  equivalence[X]
  action_equivalence_is_equivalence: OBLIGATION
    FORALL (S, R: equivalence[Quotient(S)]): equivalence?[X](action(S)(R));


decl_type: tcc
theory: QuotientIteration
library: prelude
signature: nil
location: 49 0 55 999
body:
  % Subtype TCC generated (at line 6301, column 15) for
      % quotient_map[X](action(S)(R))
      % expected type  (PreservesEq[X, X, Quotient(action(S)(R))](S))
  QuotientAction_TCC1: OBLIGATION
    FORALL (S: equivalence[X], R: equivalence[Quotient[X](S)]):
      PreservesEq[X, X, Quotient[X](action(S)(R))]
          (S)(quotient_map[X](action(S)(R)));


decl_type: tcc
theory: QuotientIteration
library: prelude
signature: nil
location: 57 0 64 999
body:
  % Subtype TCC generated (at line 6300, column 47) for  S
      % expected type  S:
                     %   {R: equivalence[X] |
                     %            PreservesEq[X, X, bool]
                     %                (R)(LAMBDA (x: X): TRUE)}
  QuotientAction_TCC2: OBLIGATION
    FORALL (S: equivalence[X], R: equivalence[Quotient[X](S)]):
      PreservesEq[X, X, bool](S)(LAMBDA (x: X): TRUE);


decl_type: tcc
theory: QuotientIteration
library: prelude
signature: nil
location: 66 0 76 999
body:
  % Subtype TCC generated (at line 6300, column 12) for
      % lift[X, X, Quotient(action(S)(R))](S)(quotient_map[X](action(S)(R)))
      % expected type  (PreservesEq
                     %      [Quotient(S), Quotient(S), Quotient(action(S)(R))]
                     %      (R))
  QuotientAction_TCC3: OBLIGATION
    FORALL (S: equivalence[X], R: equivalence[Quotient[X](S)]):
      PreservesEq[Quotient[X](S), Quotient[X](S), Quotient[X](action(S)(R))]
          (R)
          (lift[X, X, Quotient[X](action(S)(R))]
               (S)(quotient_map[X](action(S)(R))));


decl_type: tcc
theory: QuotientIteration
library: prelude
signature: nil
location: 78 0 86 999
body:
  % Subtype TCC generated (at line 6299, column 64) for  R
      % expected type  S:
                     %   {R: equivalence[Quotient(S)] |
                     %            PreservesEq[Quotient(S), Quotient(S), bool]
                     %                (R)(LAMBDA (x: Quotient[X](S)): TRUE)}
  QuotientAction_TCC4: OBLIGATION
    FORALL (S: equivalence[X], R: equivalence[Quotient[X](S)]):
      PreservesEq[Quotient[X](S), Quotient[X](S), bool]
          (R)(LAMBDA (x: Quotient[X](S)): TRUE);


decl_type: formula
theory: function_inverse_alt
library: prelude
signature: nil
location: 29 2 30 72
body:
    bijective_inverse_is_inverse_alt: COROLLARY
      FORALL (f: (bijective?[D, R])), (g: inverses(f)): g = inverse_alt(f)


decl_type: judgement
theory: function_inverse_alt
library: prelude
signature: {d | f(d) = r}
location: 32 2 33 64
body:
    unique_bijective_inverse_alt: JUDGEMENT
      inverse_alt(f: (bijective?[D,R]))(r) HAS_TYPE {d | f(d) = r}


decl_type: judgement
theory: function_inverse_alt
library: prelude
signature: (bijective?[R, D])
location: 35 2 36 64
body:
    bijective_inverse_alt_is_bijective: JUDGEMENT
      inverse_alt(f: (bijective?[D,R])) HAS_TYPE (bijective?[R,D])


decl_type: judgement
theory: function_inverse_alt
library: prelude
signature: (surjective?[R, D])
location: 38 2 39 67
body:
    inv_inj_is_surj_alt: JUDGEMENT
      inverse_alt(f: (injective?[D, R])) HAS_TYPE (surjective?[R, D])


decl_type: judgement
theory: function_inverse_alt
library: prelude
signature: (injective?[R, D])
location: 41 2 42 67
body:
    inv_surj_is_inj_alt: JUDGEMENT
      inverse_alt(f: (surjective?[D, R])) HAS_TYPE (injective?[R, D])


decl_type: tcc
theory: function_inverse_alt
library: prelude
signature: nil
location: 49 0 52 999
body:
  % Existence TCC generated (at line 1381, column 2) for
      % inverses(f): TYPE+ = (LAMBDA (g: [R -> D]): inverse?(g, f))
  inverses_TCC1: OBLIGATION
    FORALL (f: [D -> R]): EXISTS (x: {g | inverse?[D, R](g, f)}): TRUE;


decl_type: tcc
theory: function_inverse_alt
library: prelude
signature: nil
location: 54 0 58 999
body:
  % Subtype TCC generated (at line 1383, column 39) for
      % {g: inverses(f) | TRUE}
      % expected type  p: (nonempty?[inverses(f)])
  inverse_alt_TCC1: OBLIGATION
    FORALL (f: [D -> R]): nonempty?[inverses(f)]({g: inverses(f) | TRUE});


decl_type: tcc
theory: function_inverse_alt
library: prelude
signature: nil
location: 60 0 64 999
body:
  % Judgement subtype TCC generated (at line 1390, column 4) for
      % inverse_alt(f)(r)
      % expected type  {d | f(d) = r}
  unique_bijective_inverse_alt: OBLIGATION
    FORALL (f: (bijective?[D, R]), r): f(inverse_alt(f)(r)) = r;


decl_type: tcc
theory: function_inverse_alt
library: prelude
signature: nil
location: 66 0 70 999
body:
  % Judgement subtype TCC generated (at line 1393, column 4) for
      % inverse_alt(f)
      % expected type  (bijective?[R, D])
  bijective_inverse_alt_is_bijective: OBLIGATION
    FORALL (f: (bijective?[D, R])): bijective?[R, D](inverse_alt(f));


decl_type: tcc
theory: function_inverse_alt
library: prelude
signature: nil
location: 72 0 76 999
body:
  % Judgement subtype TCC generated (at line 1396, column 4) for
      % inverse_alt(f)
      % expected type  (surjective?[R, D])
  inv_inj_is_surj_alt: OBLIGATION
    FORALL (f: (injective?[D, R])): surjective?[R, D](inverse_alt(f));


decl_type: tcc
theory: function_inverse_alt
library: prelude
signature: nil
location: 78 0 82 999
body:
  % Judgement subtype TCC generated (at line 1399, column 4) for
      % inverse_alt(f)
      % expected type  (injective?[R, D])
  inv_surj_is_inj_alt: OBLIGATION
    FORALL (f: (surjective?[D, R])): injective?[R, D](inverse_alt(f));


decl_type: judgement
theory: orders
library: prelude
signature: (well_founded?)
location: 63 2 64 53
body:
    strict_well_founded_is_well_founded: JUDGEMENT
      (strict_well_founded?) SUBTYPE_OF (well_founded?)


decl_type: function
theory: orders
library: prelude
signature: [pred[[T, T]] -> bool]
location: 54 2 57 60
body:
    well_founded?(<): bool =
       (FORALL p:
          (EXISTS y: p(y))
             IMPLIES (EXISTS (y:(p)): (FORALL (x:(p)): (NOT x < y))))


decl_type: function
theory: orders
library: prelude
signature: [pred[[T, T]] -> [[T, pred[T]] -> bool]]
location: 85 2 87 63
body:
    least_upper_bound?(<)(x, pe): bool =
      upper_bound?(<)(x, pe) AND
        FORALL y: upper_bound?(<)(y, pe) IMPLIES (x < y OR x = y)


decl_type: function
theory: orders
library: prelude
signature: [pred[[T, T]] -> [[T, pred[T]] -> bool]]
location: 91 2 93 63
body:
    greatest_lower_bound?(<)(x, pe): bool =
      lower_bound?(<)(x, pe) AND
        FORALL y: lower_bound?(<)(y, pe) IMPLIES (y < x OR x = y)


decl_type: tcc
theory: orders
library: prelude
signature: nil
location: 102 0 104 999
body:
  % Judgement subtype TCC generated (at line 500, column 36) for  x
      % expected type  (reflexive?[T])
  preorder_is_reflexive: OBLIGATION FORALL (x: (preorder?)): reflexive?[T](x);


decl_type: tcc
theory: orders
library: prelude
signature: nil
location: 106 0 109 999
body:
  % Judgement subtype TCC generated (at line 501, column 36) for  x
      % expected type  (transitive?[T])
  preorder_is_transitive: OBLIGATION
    FORALL (x: (preorder?)): transitive?[T](x);


decl_type: tcc
theory: orders
library: prelude
signature: nil
location: 111 0 113 999
body:
  % Judgement subtype TCC generated (at line 502, column 36) for  x
      % expected type  (preorder?)
  equiv_is_preorder: OBLIGATION FORALL (x: (equivalence?[T])): preorder?(x);


decl_type: tcc
theory: orders
library: prelude
signature: nil
location: 115 0 117 999
body:
  % Judgement subtype TCC generated (at line 506, column 33) for  x
      % expected type  (preorder?)
  po_is_preorder: OBLIGATION FORALL (x: (partial_order?)): preorder?(x);


decl_type: tcc
theory: orders
library: prelude
signature: nil
location: 119 0 122 999
body:
  % Judgement subtype TCC generated (at line 508, column 4) for  x
      % expected type  (antisymmetric?[T])
  po_is_antisymmetric: OBLIGATION
    FORALL (x: (partial_order?)): antisymmetric?[T](x);


decl_type: tcc
theory: orders
library: prelude
signature: nil
location: 124 0 127 999
body:
  % Judgement subtype TCC generated (at line 513, column 4) for  x
      % expected type  (irreflexive?[T])
  strict_is_irreflexive: OBLIGATION
    FORALL (x: (strict_order?)): irreflexive?[T](x);


decl_type: tcc
theory: orders
library: prelude
signature: nil
location: 129 0 132 999
body:
  % Judgement subtype TCC generated (at line 515, column 4) for  x
      % expected type  (antisymmetric?[T])
  strict_order_is_antisymmetric: OBLIGATION
    FORALL (x: (strict_order?)): antisymmetric?[T](x);


decl_type: tcc
theory: orders
library: prelude
signature: nil
location: 134 0 137 999
body:
  % Judgement subtype TCC generated (at line 517, column 4) for  x
      % expected type  (transitive?[T])
  strict_is_transitive: OBLIGATION
    FORALL (x: (strict_order?)): transitive?[T](x);


decl_type: tcc
theory: orders
library: prelude
signature: nil
location: 139 0 141 999
body:
  % Judgement subtype TCC generated (at line 523, column 34) for  x
      % expected type  (partial_order?)
  total_is_po: OBLIGATION FORALL (x: (total_order?)): partial_order?(x);


decl_type: tcc
theory: orders
library: prelude
signature: nil
location: 143 0 146 999
body:
  % Judgement subtype TCC generated (at line 524, column 34) for  x
      % expected type  (dichotomous?)
  total_is_dichotomous: OBLIGATION
    FORALL (x: (total_order?)): dichotomous?(x);


decl_type: tcc
theory: orders
library: prelude
signature: nil
location: 148 0 150 999
body:
  % Judgement subtype TCC generated (at line 528, column 29) for  x
      % expected type  (total_order?)
  linear_is_total: OBLIGATION FORALL (x: (linear_order?)): total_order?(x);


decl_type: tcc
theory: orders
library: prelude
signature: nil
location: 152 0 154 999
body:
  % Judgement subtype TCC generated (at line 529, column 29) for  x
      % expected type  (linear_order?)
  total_is_linear: OBLIGATION FORALL (x: (total_order?)): linear_order?(x);


decl_type: tcc
theory: orders
library: prelude
signature: nil
location: 156 0 159 999
body:
  % Judgement subtype TCC generated (at line 536, column 4) for  x
      % expected type  (strict_order?)
  strict_total_is_strict: OBLIGATION
    FORALL (x: (strict_total_order?)): strict_order?(x);


decl_type: tcc
theory: orders
library: prelude
signature: nil
location: 161 0 164 999
body:
  % Judgement subtype TCC generated (at line 538, column 4) for  x
      % expected type  (trichotomous?)
  strict_total_is_trichotomous: OBLIGATION
    FORALL (x: (strict_total_order?)): trichotomous?(x);


decl_type: tcc
theory: orders
library: prelude
signature: nil
location: 166 0 169 999
body:
  % Judgement subtype TCC generated (at line 548, column 4) for  x
      % expected type  (strict_order?)
  strict_well_founded_is_strict: OBLIGATION
    FORALL (x: (strict_well_founded?)): strict_order?(x);


decl_type: tcc
theory: orders
library: prelude
signature: nil
location: 171 0 174 999
body:
  % Judgement subtype TCC generated (at line 550, column 4) for  x
      % expected type  (well_founded?)
  strict_well_founded_is_well_founded: OBLIGATION
    FORALL (x: (strict_well_founded?)): well_founded?(x);


decl_type: tcc
theory: orders
library: prelude
signature: nil
location: 176 0 179 999
body:
  % Judgement subtype TCC generated (at line 555, column 4) for  x
      % expected type  (strict_total_order?)
  well_ordered_is_strict_total: OBLIGATION
    FORALL (x: (well_ordered?)): strict_total_order?(x);


decl_type: tcc
theory: orders
library: prelude
signature: nil
location: 181 0 184 999
body:
  % Judgement subtype TCC generated (at line 557, column 4) for  x
      % expected type  (well_founded?)
  well_ordered_is_well_founded: OBLIGATION
    FORALL (x: (well_ordered?)): well_founded?(x);


decl_type: function
theory: bv_int_defs
library: prelude
signature: [bvec[N] -> rng_2s_comp]
location: 35 2 36 68
body:
    bv2int(bv: bvec[N]): rng_2s_comp = IF bv2nat(bv) < exp2(N-1) THEN bv2nat(bv)
                                       ELSE bv2nat(bv) - exp2(N) ENDIF


decl_type: tcc
theory: bv_int_defs
library: prelude
signature: nil
location: 45 0 47 999
body:
  % Subtype TCC generated (at line 5748, column 22) for  N - 1
      % expected type  nat
  minint_TCC1: OBLIGATION N - 1 >= 0;


decl_type: tcc
theory: bv_int_defs
library: prelude
signature: nil
location: 49 0 54 999
body:
  % Subtype TCC generated (at line 5757, column 68) for  bv2nat(bv)
      % expected type  rng_2s_comp
  bv2int_TCC1: OBLIGATION
    FORALL (bv: bvec[N]):
      bv2nat(bv) < exp2(N - 1) IMPLIES
       minint <= bv2nat[N](bv) AND bv2nat[N](bv) <= maxint;


decl_type: tcc
theory: bv_int_defs
library: prelude
signature: nil
location: 56 0 62 999
body:
  % Subtype TCC generated (at line 5758, column 42) for  bv2nat(bv) - exp2(N)
      % expected type  rng_2s_comp
  bv2int_TCC2: OBLIGATION
    FORALL (bv: bvec[N]):
      NOT bv2nat(bv) < exp2(N - 1) IMPLIES
       minint <= bv2nat[N](bv) - exp2(N) AND
        bv2nat[N](bv) - exp2(N) <= maxint;


decl_type: tcc
theory: bv_int_defs
library: prelude
signature: nil
location: 64 0 67 999
body:
  % Existence TCC generated (at line 5760, column 2) for
      % int2bv(iv: rng_2s_comp): {bv: bvec[N] | bv2int(bv) = iv}
  int2bv_TCC1: OBLIGATION
    EXISTS (x: [iv: rng_2s_comp -> {bv: bvec[N] | bv2int(bv) = iv}]): TRUE;


decl_type: formula
theory: QuotientDistributive
library: prelude
signature: nil
location: 24 2 27 56
body:
    EqualityExtensionPreservesEq : LEMMA
      PreservesEq[[X, Y], [X, Y], [Quotient(S), Y]]
          (EqualityExtension(S))
          (LAMBDA(x : X, y : Y) : (quotient_map(S)(x), y))


decl_type: formula
theory: QuotientDistributive
library: prelude
signature: nil
location: 29 2 32 60
body:
    QuotientDistributive : LEMMA
      bijective?[Quotient(EqualityExtension(S)), [Quotient(S), Y]]
        (lift[[X, Y], [X, Y], [Quotient(S), Y]](EqualityExtension(S))
             (LAMBDA(x : X, y : Y) : (quotient_map(S)(x), y)))


decl_type: formula
theory: QuotientDistributive
library: prelude
signature: nil
location: 41 2 44 73
body:
    RelExtensionPreservesEq : LEMMA
      PreservesEq[[X, Y], [X, Y], [Quotient(S), Quotient(R)]]
          (RelExtension(S,R))
          (LAMBDA(x : X, y : Y) : (quotient_map(S)(x), quotient_map(R)(y)))


decl_type: formula
theory: QuotientDistributive
library: prelude
signature: nil
location: 46 2 49 77
body:
    RelQuotientDistributive : LEMMA
      bijective?[Quotient(RelExtension(S,R)), [Quotient(S), Quotient(R)]]
        (lift[[X, Y], [X, Y], [Quotient(S), Quotient(R)]](RelExtension(S, R))
             (LAMBDA(x : X, y : Y) : (quotient_map(S)(x), quotient_map(R)(y))))


