# Declarations

decl_type: formula
theory: QuotientDistributive
library: prelude
signature: nil
location: 59 2 62 74
body:
    FunExtensionPreservesEq : LEMMA
      PreservesEq[[X -> Y], [X -> Y], [x : X -> Quotient(F(x))]]
          (FunExtension(F))
          (LAMBDA(f : [X -> Y]) : LAMBDA (x : X) : quotient_map(F(x))(f(x)))


decl_type: formula
theory: QuotientDistributive
library: prelude
signature: nil
location: 64 2 67 81
body:
    FunQuotientDistributive : LEMMA
      bijective?[Quotient(FunExtension(F)), [x : X -> Quotient(F(x))]]
        (lift[[X -> Y], [X -> Y], [x : X -> Quotient(F(x))]](FunExtension(F))
             (LAMBDA(f : [X -> Y]) : (LAMBDA (x : X): (quotient_map(F(x))(f(x))))))


decl_type: tcc
theory: QuotientDistributive
library: prelude
signature: nil
location: 74 0 78 999
body:
  % Judgement subtype TCC generated (at line 6227, column 4) for
      % EqualityExtension(S)
      % expected type  equivalence[[X, Y]]
  EqualityExtension_is_equivalence: OBLIGATION
    FORALL (S): equivalence?[[X, Y]](EqualityExtension(S));


decl_type: tcc
theory: QuotientDistributive
library: prelude
signature: nil
location: 80 0 88 999
body:
  % Subtype TCC generated (at line 6237, column 12) for
      % LAMBDA (x: X, y: Y): (quotient_map(S)(x), y)
      % expected type  (PreservesEq[[X, Y], [X, Y], [Quotient(S), Y]]
                     %      (EqualityExtension(S)))
  QuotientDistributive_TCC1: OBLIGATION
    FORALL (S: equivalence[X]):
      PreservesEq[[X, Y], [X, Y], [Quotient[X](S), Y]]
          (EqualityExtension(S))
          (LAMBDA (x: X, y: Y): (quotient_map[X](S)(x), y));


decl_type: tcc
theory: QuotientDistributive
library: prelude
signature: nil
location: 90 0 98 999
body:
  % Subtype TCC generated (at line 6236, column 46) for  EqualityExtension(S)
      % expected type  S:
                     %   {R: equivalence[[X, Y]] |
                     %            PreservesEq[[X, Y], [X, Y], bool]
                     %                (R)(LAMBDA (x: [X, Y]): TRUE)}
  QuotientDistributive_TCC2: OBLIGATION
    FORALL (S: equivalence[X]):
      PreservesEq[[X, Y], [X, Y], bool]
          (EqualityExtension(S))(LAMBDA (x: [X, Y]): TRUE);


decl_type: tcc
theory: QuotientDistributive
library: prelude
signature: nil
location: 100 0 105 999
body:
  % Subtype TCC generated (at line 6244, column 4) for
      % {z, w | S(z`1, w`1) AND R(z`2, w`2)}
      % expected type  equivalence[[X, Y]]
  RelExtension_TCC1: OBLIGATION
    FORALL (S: equivalence[X], R: equivalence[Y]):
      equivalence?[[X, Y]]({z, w | S(z`1, w`1) AND R(z`2, w`2)});


decl_type: tcc
theory: QuotientDistributive
library: prelude
signature: nil
location: 107 0 117 999
body:
  % Subtype TCC generated (at line 6254, column 12) for
      % LAMBDA (x: X, y: Y): (quotient_map(S)(x), quotient_map(R)(y))
      % expected type  (PreservesEq
                     %      [[X, Y], [X, Y], [Quotient(S), Quotient(R)]]
                     %      (RelExtension(S, R)))
  RelQuotientDistributive_TCC1: OBLIGATION
    FORALL (R: equivalence[Y], S: equivalence[X]):
      PreservesEq[[X, Y], [X, Y], [Quotient[X](S), Quotient[Y](R)]]
          (RelExtension(S, R))
          (LAMBDA (x: X, y: Y):
             (quotient_map[X](S)(x), quotient_map[Y](R)(y)));


decl_type: tcc
theory: QuotientDistributive
library: prelude
signature: nil
location: 119 0 127 999
body:
  % Subtype TCC generated (at line 6253, column 56) for  RelExtension(S, R)
      % expected type  S:
                     %   {R: equivalence[[X, Y]] |
                     %            PreservesEq[[X, Y], [X, Y], bool]
                     %                (R)(LAMBDA (x: [X, Y]): TRUE)}
  RelQuotientDistributive_TCC2: OBLIGATION
    FORALL (R: equivalence[Y], S: equivalence[X]):
      PreservesEq[[X, Y], [X, Y], bool]
          (RelExtension(S, R))(LAMBDA (x: [X, Y]): TRUE);


decl_type: tcc
theory: QuotientDistributive
library: prelude
signature: nil
location: 129 0 134 999
body:
  % Subtype TCC generated (at line 6262, column 4) for
      % {f, g | FORALL (x: X): F(x)(f(x), g(x))}
      % expected type  equivalence[[X -> Y]]
  FunExtension_TCC1: OBLIGATION
    FORALL (F: [X -> equivalence[Y]]):
      equivalence?[[X -> Y]]({f, g | FORALL (x: X): F(x)(f(x), g(x))});


decl_type: tcc
theory: QuotientDistributive
library: prelude
signature: nil
location: 136 0 146 999
body:
  % Subtype TCC generated (at line 6272, column 12) for
      % LAMBDA (f: [X -> Y]): (LAMBDA (x: X): (quotient_map(F(x))(f(x))))
      % expected type  (PreservesEq
                     %      [[X -> Y], [X -> Y], [x: X -> Quotient(F(x))]]
                     %      (FunExtension(F)))
  FunQuotientDistributive_TCC1: OBLIGATION
    FORALL (F: [X -> equivalence[Y]]):
      PreservesEq[[X -> Y], [X -> Y], [x: X -> Quotient[Y](F(x))]]
          (FunExtension(F))
          (LAMBDA (f: [X -> Y]):
             LAMBDA (x: X): (quotient_map[Y](F(x))(f(x))));


decl_type: tcc
theory: QuotientDistributive
library: prelude
signature: nil
location: 148 0 156 999
body:
  % Subtype TCC generated (at line 6271, column 59) for  FunExtension(F)
      % expected type  S:
                     %   {R: equivalence[[X -> Y]] |
                     %            PreservesEq[[X -> Y], [X -> Y], bool]
                     %                (R)(LAMBDA (x: [X -> Y]): TRUE)}
  FunQuotientDistributive_TCC2: OBLIGATION
    FORALL (F: [X -> equivalence[Y]]):
      PreservesEq[[X -> Y], [X -> Y], bool]
          (FunExtension(F))(LAMBDA (x: [X -> Y]): TRUE);


decl_type: tcc
theory: more_map_props
library: prelude
signature: nil
location: 17 0 21 999
body:
  % Subtype TCC generated (at line 4838, column 21) for  i
      % expected type  below[length[T2](map(f)(l))]
  map_nth_rw_TCC1: OBLIGATION
    FORALL (f: [T1 -> T2], l: list[T1], i: below(length[T1](l))):
      i < length[T2](map[T1, T2](f)(l));


decl_type: formula
theory: subrange_inductions
library: prelude
signature: nil
location: 11 2 13 32
body:
    subrange_induction: LEMMA
      (p(i) AND (FORALL k: k < j AND p(k) IMPLIES p(k + 1)))
          IMPLIES (FORALL k: p(k))


decl_type: formula
theory: subrange_inductions
library: prelude
signature: nil
location: 15 2 17 30
body:
    SUBRANGE_induction: LEMMA
      (FORALL k: (FORALL m: m < k IMPLIES p(m)) IMPLIES p(k))
        IMPLIES (FORALL k: p(k))


decl_type: tcc
theory: subrange_inductions
library: prelude
signature: nil
location: 24 0 26 999
body:
  % Subtype TCC generated (at line 3920, column 7) for  i
      % expected type  subrange(i, j)
  subrange_induction_TCC1: OBLIGATION i <= i AND i <= j;


decl_type: tcc
theory: subrange_inductions
library: prelude
signature: nil
location: 28 0 33 999
body:
  % Subtype TCC generated (at line 3920, column 50) for  k + 1
      % expected type  subrange(i, j)
  subrange_induction_TCC2: OBLIGATION
    FORALL (p: pred[subrange(i, j)]):
      p(i) IMPLIES
       (FORALL (k): k < j AND p(k) IMPLIES i <= k + 1 AND k + 1 <= j);


decl_type: formula
theory: mod
library: prelude
signature: nil
location: 34 2 36 38
body:
    mod_neg    : LEMMA mod(-i,j) = IF integer_pred(i/j) THEN 0
                                   ELSE j - mod(i,j)
                                   ENDIF


decl_type: formula
theory: mod
library: prelude
signature: nil
location: 38 2 40 38
body:
    mod_neg_d  : LEMMA mod(i,-j) = IF integer_pred(i/j) THEN 0
                                   ELSE mod(i,j) - j 
                                   ENDIF


decl_type: formula
theory: mod
library: prelude
signature: nil
location: 44 2 47 39
body:
    mod_lt     : LEMMA abs(i) < abs(j) IMPLIES mod(i,j) = 
                                    IF sgn(i) = sgn(j) OR i = 0 THEN i
                                    ELSE i + j
                                    ENDIF


decl_type: formula
theory: mod
library: prelude
signature: nil
location: 51 2 53 39
body:
    mod_lt_int : LEMMA -m < i AND i < m IMPLIES mod(i,m) = 
                                    IF i >= 0 THEN i ELSE i + m
                                    ENDIF


decl_type: formula
theory: mod
library: prelude
signature: nil
location: 62 2 65 47
body:
    mod_sum_nat: LEMMA (FORALL (n1,n2: below(m)):
                            mod(n1+n2,m) = IF n1 + n2 < m THEN n1+n2
                                           ELSE n1 + n2 - m
                                           ENDIF)


decl_type: formula
theory: mod
library: prelude
signature: nil
location: 72 2 75 40
body:
    mod_one    : LEMMA mod(1,j) = IF abs(j) = 1 THEN 0
                                     ELSIF j > 0 THEN 1
                                     ELSE j + 1
                                     ENDIF


decl_type: formula
theory: mod
library: prelude
signature: nil
location: 81 2 82 66
body:
    mod_inj_plus       : LEMMA a < m AND n < m AND c < m AND
                         mod(a + n, m) = mod(a + c, m) IMPLIES n = c


decl_type: formula
theory: mod
library: prelude
signature: nil
location: 84 2 85 67
body:
    mod_inj_minus       : LEMMA a < m AND n < m AND c < m AND
                          mod(a - n, m) = mod(a - c, m) IMPLIES n = c


decl_type: formula
theory: mod
library: prelude
signature: nil
location: 88 2 89 53
body:
    mod_wrap_around: LEMMA n < m AND (c <= m AND c >= m-n) IMPLIES
                                mod(n+c, m) = n - (m-c)


decl_type: formula
theory: mod
library: prelude
signature: nil
location: 95 2 96 66
body:
    mod_inj1:        LEMMA x < m AND n < m AND c < m AND
                         mod(x + n, m) = mod(x + c, m) IMPLIES n = c


decl_type: formula
theory: mod
library: prelude
signature: nil
location: 98 2 99 67
body:
    mod_inj2:        LEMMA x < m AND n < m AND c < m AND
                          mod(x - n, m) = mod(x - c, m) IMPLIES n = c


decl_type: formula
theory: mod
library: prelude
signature: nil
location: 101 2 102 75
body:
    mod_wrap_inj: LEMMA n < m AND a < m AND b < m AND a > 0 AND
                              mod(n + a, m) = mod(n - b, m) IMPLIES a + b = m


decl_type: formula
theory: mod
library: prelude
signature: nil
location: 104 2 106 61
body:
    mod_wrap_inj_eq: LEMMA
        x < m AND a < m AND b < m AND a > 0
          IMPLIES (mod(x + a, m) = mod(x - b, m)) = (a + b = m)


decl_type: formula
theory: mod
library: prelude
signature: nil
location: 109 2 110 70
body:
    mod_neg_limited: LEMMA 0 <= kk AND  kk < m AND vv < m AND
                        vv - kk < 0 IMPLIES mod(vv - kk,m) = m + vv - kk


decl_type: tcc
theory: mod
library: prelude
signature: nil
location: 125 0 128 999
body:
  % Subtype TCC generated (at line 5546, column 35) for  i - j * floor(i / j)
      % expected type  {k | abs(k) < abs(j)}
  mod_TCC1: OBLIGATION
    FORALL (i: int, j: nonzero_integer): abs(i - j * floor(i / j)) < abs(j);


decl_type: tcc
theory: mod
library: prelude
signature: nil
location: 130 0 133 999
body:
  % Judgement subtype TCC generated (at line 5550, column 12) for  mod(i, m)
      % expected type  below(m)
  mod_TCC2: OBLIGATION
    FORALL (i: int, m: posnat): mod(i, m) >= 0 AND mod(i, m) < m;


decl_type: tcc
theory: restrict_set_props
library: prelude
signature: nil
location: 22 0 26 999
body:
  % Judgement subtype TCC generated (at line 4318, column 4) for
      % restrict[T, S, bool](a)
      % expected type  finite_set[S]
  finite_restrict: OBLIGATION
    FORALL (a: finite_set[T]): is_finite[S](restrict[T, S, bool](a));


decl_type: tcc
theory: restrict_set_props
library: prelude
signature: nil
location: 28 0 32 999
body:
  % Judgement subtype TCC generated (at line 4321, column 4) for
      % restrict[T, S, bool](a)
      % expected type  (empty?[S])
  empty_restrict: OBLIGATION
    FORALL (a: (empty?[T])): empty?[S](restrict[T, S, bool](a));


decl_type: tcc
theory: real_props
library: prelude
signature: nil
location: 483 0 486 999
body:
  % Subtype TCC generated (at line 2608, column 54) for  w
      % expected type  nznum
  lt_div_lt_pos1_TCC1: OBLIGATION
    FORALL (px, pz: posreal, w, y: real): pz < w AND px <= y IMPLIES w /= 0;


decl_type: tcc
theory: real_props
library: prelude
signature: nil
location: 488 0 492 999
body:
  % Subtype TCC generated (at line 2610, column 56) for  w
      % expected type  nznum
  lt_div_lt_pos2_TCC1: OBLIGATION
    FORALL (nnx: nonneg_real, pz: posreal, w, y: real):
      pz <= w AND nnx < y IMPLIES w /= 0;


decl_type: tcc
theory: real_props
library: prelude
signature: nil
location: 494 0 497 999
body:
  % Subtype TCC generated (at line 2616, column 54) for  z
      % expected type  nznum
  lt_div_lt_neg1_TCC1: OBLIGATION
    FORALL (nw, ny: negreal, x, z: real): z < nw AND x <= ny IMPLIES z /= 0;


decl_type: tcc
theory: real_props
library: prelude
signature: nil
location: 499 0 503 999
body:
  % Subtype TCC generated (at line 2618, column 56) for  z
      % expected type  nznum
  lt_div_lt_neg2_TCC1: OBLIGATION
    FORALL (npy: nonpos_real, nw: negreal, x, z: real):
      z <= nw AND x < npy IMPLIES z /= 0;


decl_type: tcc
theory: real_props
library: prelude
signature: nil
location: 505 0 509 999
body:
  % Subtype TCC generated (at line 2690, column 56) for  w
      % expected type  nznum
  le_div_le_pos_TCC1: OBLIGATION
    FORALL (nnx: nonneg_real, pz: posreal, w, y: real):
      pz <= w AND nnx <= y IMPLIES w /= 0;


decl_type: tcc
theory: real_props
library: prelude
signature: nil
location: 511 0 515 999
body:
  % Subtype TCC generated (at line 2694, column 56) for  z
      % expected type  nznum
  le_div_le_neg_TCC1: OBLIGATION
    FORALL (npy: nonpos_real, nw: negreal, x, z: real):
      z <= nw AND x <= npy IMPLIES z /= 0;


decl_type: tcc
theory: real_props
library: prelude
signature: nil
location: 517 0 520 999
body:
  % Subtype TCC generated (at line 2765, column 61) for  z
      % expected type  nznum
  gt_div_gt_pos1_TCC1: OBLIGATION
    FORALL (pw, py: posreal, x, z: real): z > pw AND x >= py IMPLIES z /= 0;


decl_type: tcc
theory: real_props
library: prelude
signature: nil
location: 522 0 526 999
body:
  % Subtype TCC generated (at line 2767, column 63) for  z
      % expected type  nznum
  gt_div_gt_pos2_TCC1: OBLIGATION
    FORALL (nny: nonneg_real, pw: posreal, x, z: real):
      z >= pw AND x > nny IMPLIES z /= 0;


decl_type: tcc
theory: real_props
library: prelude
signature: nil
location: 528 0 531 999
body:
  % Subtype TCC generated (at line 2773, column 61) for  w
      % expected type  nznum
  gt_div_gt_neg1_TCC1: OBLIGATION
    FORALL (nx, nz: negreal, w, y: real): nz > w AND nx >= y IMPLIES w /= 0;


decl_type: tcc
theory: real_props
library: prelude
signature: nil
location: 533 0 537 999
body:
  % Subtype TCC generated (at line 2775, column 63) for  w
      % expected type  nznum
  gt_div_gt_neg2_TCC1: OBLIGATION
    FORALL (npx: nonpos_real, nz: negreal, w, y: real):
      nz >= w AND npx > y IMPLIES w /= 0;


decl_type: tcc
theory: real_props
library: prelude
signature: nil
location: 539 0 543 999
body:
  % Subtype TCC generated (at line 2847, column 64) for  z
      % expected type  nznum
  ge_div_ge_pos_TCC1: OBLIGATION
    FORALL (nny: nonneg_real, pw: posreal, x, z: real):
      z >= pw AND x >= nny IMPLIES z /= 0;


decl_type: tcc
theory: real_props
library: prelude
signature: nil
location: 545 0 549 999
body:
  % Subtype TCC generated (at line 2851, column 64) for  w
      % expected type  nznum
  ge_div_ge_neg_TCC1: OBLIGATION
    FORALL (npx: nonpos_real, nz: negreal, w, y: real):
      nz >= w AND npx >= y IMPLIES w /= 0;


decl_type: tcc
theory: real_props
library: prelude
signature: nil
location: 551 0 553 999
body:
  % Judgement subtype TCC generated (at line 2913, column 4) for  <
      % expected type  (strict_total_order?[real])
  real_lt_is_strict_total_order: OBLIGATION strict_total_order?[real](<);


decl_type: tcc
theory: real_props
library: prelude
signature: nil
location: 555 0 557 999
body:
  % Judgement subtype TCC generated (at line 2915, column 36) for  <=
      % expected type  (total_order?[real])
  real_le_is_total_order: OBLIGATION total_order?[real](<=);


decl_type: tcc
theory: real_props
library: prelude
signature: nil
location: 559 0 561 999
body:
  % Judgement subtype TCC generated (at line 2918, column 4) for  >
      % expected type  (strict_total_order?[real])
  real_gt_is_strict_total_order: OBLIGATION strict_total_order?[real](>);


decl_type: tcc
theory: real_props
library: prelude
signature: nil
location: 563 0 565 999
body:
  % Judgement subtype TCC generated (at line 2920, column 36) for  >=
      % expected type  (total_order?[real])
  real_ge_is_total_order: OBLIGATION total_order?[real](>=);


decl_type: formula
theory: modulo_arithmetic
library: prelude
signature: nil
location: 58 2 60 45
body:
    rem_sum: LEMMA
       rem(b)(x) = rem(b)(y) AND rem(b)(z) = rem(b)(t) 
          IMPLIES rem(b)(x + z) = rem(b)(y + t)


decl_type: formula
theory: modulo_arithmetic
library: prelude
signature: nil
location: 67 2 69 45
body:
    rem_diff: LEMMA
       rem(b)(x) = rem(b)(y) AND rem(b)(z) = rem(b)(t)
          IMPLIES rem(b)(x - z) = rem(b)(y - t)


decl_type: formula
theory: modulo_arithmetic
library: prelude
signature: nil
location: 81 2 83 45
body:
    rem_prod: LEMMA
       rem(b)(x) = rem(b)(y) AND rem(b)(z) = rem(b)(t)
          IMPLIES rem(b)(x * z) = rem(b)(y * t)


decl_type: formula
theory: modulo_arithmetic
library: prelude
signature: nil
location: 117 2 119 76
body:
    rem_base: LEMMA
      FORALL b, x, i, n:
        rem(b)(x) = rem(b + n)(x + i) IFF divides(b + n, i - n * floor(x / b))


decl_type: formula
theory: modulo_arithmetic
library: prelude
signature: nil
location: 121 2 123 68
body:
    rem_sum_floor: LEMMA
      FORALL b, x, i:
        rem(b)(x + i) = rem(b)(x) + i - b * floor((rem(b)(x) + i) / b)


decl_type: formula
theory: modulo_arithmetic
library: prelude
signature: nil
location: 128 2 131 48
body:
    rem_add_one: LEMMA
      FORALL b, x:
        rem(b)(x + 1) = rem(b)(x) + 1 OR
         (rem(b)(x) = b - 1 AND rem(b)(x + 1) = 0)


decl_type: formula
theory: modulo_arithmetic
library: prelude
signature: nil
location: 133 2 135 63
body:
    rem_wrap: LEMMA
      FORALL b, x, (n: below(b)):
        rem(b)(x) < rem(b)(x + n) IFF rem(b)(x) < b - n AND n > 0


decl_type: formula
theory: modulo_arithmetic
library: prelude
signature: nil
location: 137 2 139 71
body:
    rem_wrap_eq: COROLLARY
      FORALL b, x, (n: below(b)):
        rem(b)(x) <= rem(b)(x + n) IFF rem(b)(x) < b - n OR divides(b, n)


decl_type: tcc
theory: modulo_arithmetic
library: prelude
signature: nil
location: 146 0 152 999
body:
  % Existence TCC generated (at line 3779, column 2) for
      % rem(b)(x): {r: mod(b) | EXISTS q: x = b * q + r}
  rem_TCC1: OBLIGATION
    EXISTS (x1:
              [b: posnat ->
                 [x: int -> {r: mod(b) | EXISTS q: x = r + b * q}]]):
      TRUE;


decl_type: tcc
theory: modulo_arithmetic
library: prelude
signature: nil
location: 154 0 160 999
body:
  % Existence TCC generated (at line 3874, column 2) for
      % ndiv(x, b): {q: int | x = b * q + rem(b)(x)}
  ndiv_TCC1: OBLIGATION
    EXISTS (x1:
              [d: [int, posnat] ->
                 {q: int | d`1 = rem(d`2)(d`1) + d`2 * q}]):
      TRUE;


decl_type: tcc
theory: modulo_arithmetic
library: prelude
signature: nil
location: 162 0 164 999
body:
  % Judgement subtype TCC generated (at line 3878, column 12) for  ndiv(n, b)
      % expected type  upto(n)
  ndiv_TCC2: OBLIGATION FORALL (b, n): ndiv(n, b) >= 0 AND ndiv(n, b) <= n;


decl_type: function
theory: bv_extend_defs
library: prelude
signature: [k: above(N) -> [bvec[N] -> bvec[k]]]
location: 39 2 40 43
body:
    zero_extend_lsend(k: above(N)): [bvec[N] -> bvec[k]] =
          (LAMBDA bv:  bv o fill[k-N](FALSE))


decl_type: tcc
theory: bv_extend_defs
library: prelude
signature: nil
location: 60 0 62 999
body:
  % Subtype TCC generated (at line 5846, column 24) for  k - N
      % expected type  nat
  zero_extend_TCC1: OBLIGATION FORALL (k: above(N)): k - N >= 0;


decl_type: tcc
theory: bv_extend_defs
library: prelude
signature: nil
location: 64 0 66 999
body:
  % Subtype TCC generated (at line 5855, column 34) for  (N - 1)
      % expected type  below[N]
  sign_extend_TCC1: OBLIGATION (N - 1) >= 0 AND (N - 1) < N;


decl_type: tcc
theory: bv_extend_defs
library: prelude
signature: nil
location: 68 0 70 999
body:
  % Subtype TCC generated (at line 5872, column 37) for  0
      % expected type  below[N]
  lsb_extend_TCC1: OBLIGATION 0 < N;


decl_type: judgement
theory: extend_order_props
library: prelude
signature: (irreflexive?[T])
location: 5 2 7 34
body:
    irreflexive_extend: JUDGEMENT
      extend[[T, T], [S, S], bool, FALSE](R: (irreflexive?[S]))
          HAS_TYPE (irreflexive?[T])


decl_type: judgement
theory: extend_order_props
library: prelude
signature: (symmetric?[T])
location: 9 2 11 32
body:
    symmetric_extend: JUDGEMENT
      extend[[T, T], [S, S], bool, FALSE](R: (symmetric?[S]))
          HAS_TYPE (symmetric?[T])


decl_type: judgement
theory: extend_order_props
library: prelude
signature: (antisymmetric?[T])
location: 13 2 15 36
body:
    antisymmetric_extend: JUDGEMENT
      extend[[T, T], [S, S], bool, FALSE](R: (antisymmetric?[S]))
          HAS_TYPE (antisymmetric?[T])


decl_type: judgement
theory: extend_order_props
library: prelude
signature: (transitive?[T])
location: 17 2 19 33
body:
    transitive_extend: JUDGEMENT
      extend[[T, T], [S, S], bool, FALSE](R: (transitive?[S]))
          HAS_TYPE (transitive?[T])


decl_type: judgement
theory: extend_order_props
library: prelude
signature: (strict_order?[T])
location: 21 2 23 35
body:
    strict_order_extend: JUDGEMENT
      extend[[T, T], [S, S], bool, FALSE](R: (strict_order?[S]))
          HAS_TYPE (strict_order?[T])


decl_type: tcc
theory: extend_order_props
library: prelude
signature: nil
location: 30 0 35 999
body:
  % Judgement subtype TCC generated (at line 670, column 4) for
      % extend[[T, T], [S, S], bool, FALSE](R)
      % expected type  (irreflexive?[T])
  irreflexive_extend: OBLIGATION
    FORALL (R: (irreflexive?[S])):
      irreflexive?[T](extend[[T, T], [S, S], bool, FALSE](R));


decl_type: tcc
theory: extend_order_props
library: prelude
signature: nil
location: 37 0 42 999
body:
  % Judgement subtype TCC generated (at line 674, column 4) for
      % extend[[T, T], [S, S], bool, FALSE](R)
      % expected type  (symmetric?[T])
  symmetric_extend: OBLIGATION
    FORALL (R: (symmetric?[S])):
      symmetric?[T](extend[[T, T], [S, S], bool, FALSE](R));


decl_type: tcc
theory: extend_order_props
library: prelude
signature: nil
location: 44 0 49 999
body:
  % Judgement subtype TCC generated (at line 678, column 4) for
      % extend[[T, T], [S, S], bool, FALSE](R)
      % expected type  (antisymmetric?[T])
  antisymmetric_extend: OBLIGATION
    FORALL (R: (antisymmetric?[S])):
      antisymmetric?[T](extend[[T, T], [S, S], bool, FALSE](R));


decl_type: tcc
theory: extend_order_props
library: prelude
signature: nil
location: 51 0 56 999
body:
  % Judgement subtype TCC generated (at line 682, column 4) for
      % extend[[T, T], [S, S], bool, FALSE](R)
      % expected type  (transitive?[T])
  transitive_extend: OBLIGATION
    FORALL (R: (transitive?[S])):
      transitive?[T](extend[[T, T], [S, S], bool, FALSE](R));


decl_type: tcc
theory: extend_order_props
library: prelude
signature: nil
location: 58 0 63 999
body:
  % Judgement subtype TCC generated (at line 686, column 4) for
      % extend[[T, T], [S, S], bool, FALSE](R)
      % expected type  (strict_order?[T])
  strict_order_extend: OBLIGATION
    FORALL (R: (strict_order?[S])):
      strict_order?[T](extend[[T, T], [S, S], bool, FALSE](R));


decl_type: function
theory: PartialFunctionDefinitions
library: prelude
signature: [SubsetPartialFunction -> LiftPartialFunction]
location: 25 2 26 69
body:
    SPartFun_to_LPartFun(g) : LiftPartialFunction =
      LAMBDA(x : X) : IF dom(g)(x) THEN up(fun(g)(x)) ELSE bottom ENDIF


decl_type: function
theory: PartialFunctionDefinitions
library: prelude
signature: [LiftPartialFunction -> SubsetPartialFunction]
location: 28 2 32 6
body:
    LPartFun_to_SPartFun(f) : SubsetPartialFunction =
      (# 
        dom := {x : X | up?(f(x))}, 
        fun := LAMBDA(y : {x : X | up?(f(x))}) : down(f(y))
      #)


decl_type: function
theory: PartialFunctionDefinitions
library: prelude
signature: [[X -> Y] -> SubsetPartialFunction]
location: 34 2 38 6
body:
    TotalFun_to_SPartFun(h): SubsetPartialFunction =
      (#
        dom := {x : X | TRUE},
        fun := h
      #)


decl_type: tcc
theory: PartialFunctionDefinitions
library: prelude
signature: nil
location: 58 0 61 999
body:
  % Subtype TCC generated (at line 6336, column 52) for  f(y)
      % expected type  (up?[Y])
  LPartFun_to_SPartFun_TCC1: OBLIGATION
    FORALL (f: LiftPartialFunction, y: {x: X | up?[Y](f(x))}): up?[Y](f(y));


decl_type: formula
theory: finite_sets
library: prelude
signature: nil
location: 34 2 35 60
body:
    is_finite_surj: LEMMA (EXISTS (N: nat), (f: [below[N] -> (s)]):
                              surjective?(f)) IFF is_finite(s) 


decl_type: formula
theory: finite_sets
library: prelude
signature: nil
location: 102 2 103 74
body:
    inj_Card    : LEMMA Card(S) = n IMPLIES 
                            (EXISTS (f : [(S) -> below[n]]) : injective?(f))


decl_type: formula
theory: finite_sets
library: prelude
signature: nil
location: 105 2 107 77
body:
    reduce_inj  : LEMMA (FORALL (f : [(S)->below[p]]) :
                            injective?(f) AND NOT surjective?(f) IMPLIES 
                                (EXISTS (g: [(S)->below[p-1]]): injective?(g)))


decl_type: formula
theory: finite_sets
library: prelude
signature: nil
location: 109 2 110 48
body:
    Card_injection: LEMMA (EXISTS (f : [(S)->below[n]]) : injective?(f)) 
                              IMPLIES Card(S) <= n


decl_type: formula
theory: finite_sets
library: prelude
signature: nil
location: 112 2 113 50
body:
    Card_surjection : LEMMA (EXISTS (f : [(S)->below[n]]) : surjective?(f)) 
                                IMPLIES n <= Card(S) 


decl_type: formula
theory: finite_sets
library: prelude
signature: nil
location: 118 2 119 68
body:
    Card_disj_union: THEOREM disjoint?(S,S2) IMPLIES 
                                Card(union(S,S2)) = Card(S) + Card(S2)


decl_type: formula
theory: finite_sets
library: prelude
signature: nil
location: 144 2 145 66
body:
    card_disj_union : THEOREM disjoint?(A,B) IMPLIES 
                                card(union(A,B)) = card(A) + card(B)


decl_type: formula
theory: finite_sets
library: prelude
signature: nil
location: 147 2 148 76
body:
    card_diff_subset: THEOREM subset?(A, B) IMPLIES 
                                    card(difference(B, A)) = card(B) - card(A)


decl_type: formula
theory: finite_sets
library: prelude
signature: nil
location: 152 2 153 75
body:
    card_plus       : THEOREM card(A) + card(B) = 
                                  card(union(A, B)) + card(intersection(A,B))  


decl_type: formula
theory: finite_sets
library: prelude
signature: nil
location: 155 2 156 70
body:
    card_union      : THEOREM card(union(A,B)) = card(A) + card(B) -
                                                 card(intersection(A,B))


decl_type: formula
theory: finite_sets
library: prelude
signature: nil
location: 158 2 159 80
body:
    card_add        : THEOREM card(add(x, S)) = card(S) 
                                                     + IF S(x) THEN 0 ELSE 1 ENDIF


decl_type: formula
theory: finite_sets
library: prelude
signature: nil
location: 162 2 163 80
body:
    card_remove     : THEOREM card(remove(x, S)) = card(S)
                                                     - IF S(x) THEN 1 ELSE 0 ENDIF


decl_type: formula
theory: finite_sets
library: prelude
signature: nil
location: 167 2 168 44
body:
    same_card_subset: THEOREM subset?(A, B) AND card(A) = card(B) 
                                 IMPLIES A = B


decl_type: formula
theory: finite_sets
library: prelude
signature: nil
location: 170 2 171 79
body:
    smaller_card_subset : THEOREM subset?(A, B) AND card(A) < card(B) IMPLIES
                                   (EXISTS x : member(x, B) AND NOT member(x, A))


decl_type: formula
theory: finite_sets
library: prelude
signature: nil
location: 177 2 178 73
body:
    card_2_has_2    : THEOREM card(S) >= 2 IMPLIES
                                (EXISTS (x,y: T): x /= y AND S(x) AND S(y))


decl_type: formula
theory: finite_sets
library: prelude
signature: nil
location: 180 2 181 64
body:
    card_intersection_le: THEOREM card(intersection(A,B)) <= card(A) AND
                                card(intersection(A,B)) <= card(B)


decl_type: formula
theory: finite_sets
library: prelude
signature: nil
location: 183 2 184 79
body:
    card_bij        : THEOREM card(S) = N
                               IFF (EXISTS (f: [(S) -> below[N]]): bijective?(f))


decl_type: formula
theory: finite_sets
library: prelude
signature: nil
location: 186 2 187 79
body:
    card_bij_inv    : THEOREM card(S) = N
                               IFF (EXISTS (f: [below[N] -> (S)]): bijective?(f))


decl_type: formula
theory: finite_sets
library: prelude
signature: nil
location: 189 2 190 53
body:
    bij_exists      : COROLLARY (EXISTS (f: [(S) -> below(card(S))]):
                                         bijective?(f))


decl_type: formula
theory: finite_sets
library: prelude
signature: nil
location: 197 2 198 30
body:
    bij_ibij: LEMMA FORALL (S: non_empty_finite_set, ii: below(card(S))):
        bij(S)(ibij(S)(ii)) = ii


decl_type: formula
theory: finite_sets
library: prelude
signature: nil
location: 203 2 204 62
body:
    is_finite_exists_N: LEMMA FORALL (g: [below[N] -> T]):
              is_finite({r: T | EXISTS (n: below[N]): r = g(n)})


decl_type: formula
theory: finite_sets
library: prelude
signature: nil
location: 213 2 214 51
body:
    finite_pred: LEMMA is_finite(fullset[T]) IMPLIES
                          is_finite[T]({x: T | P(x)})


decl_type: formula
theory: finite_sets
library: prelude
signature: nil
location: 219 2 221 65
body:
    card_implies: LEMMA is_finite(fullset[T]) AND
                        (FORALL (x: T): P1(x) IMPLIES P2(x)) 
               IMPLIES card({x: T | P1(x)}) <= card({x: T | P2(x)})


decl_type: formula
theory: finite_sets
library: prelude
signature: nil
location: 223 2 227 42
body:
    finite_induction: THEOREM
      FORALL (p: pred[set[T]]):
        (FORALL (n: nat), (S: set[T]):
           (EXISTS (f: [(S) -> below[n]]): injective?(f)) => p(S))
         => (FORALL (FS: finite_set): p(FS))


decl_type: function
theory: finite_sets
library: prelude
signature: [finite_set -> (nonempty?[nat])]
location: 97 2 98 69
body:
    inj_set(S): (nonempty?[nat]) = 
                   { n | EXISTS (f : [(S)->below[n]]) : injective?(f) }


decl_type: function
theory: finite_sets
library: prelude
signature:
  [S: non_empty_finite_set ->
  {f: [below(card(S)) -> (S)] | bijective?(f)}]

location: 194 2 195 22
body:
    ibij(S: non_empty_finite_set): {f:[below(card(S)) -> (S)] | bijective?(f)} =
         inverse(bij(S))


decl_type: tcc
theory: finite_sets
library: prelude
signature: nil
location: 234 0 236 999
body:
  % Subtype TCC generated (at line 4108, column 44) for  emptyset[T]
      % expected type  finite_set
  finite_set_TCC1: OBLIGATION is_finite(emptyset[T]);


decl_type: tcc
theory: finite_sets
library: prelude
signature: nil
location: 238 0 241 999
body:
  % Judgement subtype TCC generated (at line 4126, column 4) for  x
      % expected type  (nonempty?[T])
  nonempty_finite_is_nonempty: OBLIGATION
    FORALL (x: non_empty_finite_set): nonempty?[T](x);


decl_type: tcc
theory: finite_sets
library: prelude
signature: nil
location: 243 0 245 999
body:
  % Judgement subtype TCC generated (at line 4128, column 30) for  singleton(x)
      % expected type  finite_set
  finite_singleton: OBLIGATION FORALL (x): is_finite(singleton[T](x));


decl_type: tcc
theory: finite_sets
library: prelude
signature: nil
location: 247 0 249 999
body:
  % Judgement subtype TCC generated (at line 4130, column 26) for  union(A, B)
      % expected type  finite_set
  finite_union: OBLIGATION FORALL (A, B): is_finite(union[T](A, B));


decl_type: tcc
theory: finite_sets
library: prelude
signature: nil
location: 251 0 255 999
body:
  % Judgement subtype TCC generated (at line 4131, column 34) for
      % intersection(s, A)
      % expected type  finite_set
  finite_intersection1: OBLIGATION
    FORALL (A, s): is_finite(intersection[T](s, A));


decl_type: tcc
theory: finite_sets
library: prelude
signature: nil
location: 257 0 261 999
body:
  % Judgement subtype TCC generated (at line 4132, column 34) for
      % intersection(A, s)
      % expected type  finite_set
  finite_intersection2: OBLIGATION
    FORALL (A, s): is_finite(intersection[T](A, s));


decl_type: tcc
theory: finite_sets
library: prelude
signature: nil
location: 263 0 266 999
body:
  % Judgement subtype TCC generated (at line 4133, column 31) for
      % difference(A, s)
      % expected type  finite_set
  finite_difference: OBLIGATION FORALL (A, s): is_finite(difference[T](A, s));


decl_type: tcc
theory: finite_sets
library: prelude
signature: nil
location: 268 0 271 999
body:
  % Judgement subtype TCC generated (at line 4135, column 36) for  union(NA, B)
      % expected type  non_empty_finite_set
  nonempty_finite_union1: OBLIGATION
    FORALL (B, NA): NOT empty?[T](union[T](NA, B));


decl_type: tcc
theory: finite_sets
library: prelude
signature: nil
location: 273 0 276 999
body:
  % Judgement subtype TCC generated (at line 4137, column 36) for  union(A, NB)
      % expected type  non_empty_finite_set
  nonempty_finite_union2: OBLIGATION
    FORALL (A, NB): NOT empty?[T](union[T](A, NB));


decl_type: tcc
theory: finite_sets
library: prelude
signature: nil
location: 278 0 281 999
body:
  % Judgement subtype TCC generated (at line 4139, column 33) for  add(x, A)
      % expected type  non_empty_finite_set
  nonempty_add_finite: OBLIGATION
    FORALL (A, x): is_finite(add[T](x, A)) AND NOT empty?[T](add[T](x, A));


decl_type: tcc
theory: finite_sets
library: prelude
signature: nil
location: 283 0 285 999
body:
  % Judgement subtype TCC generated (at line 4141, column 27) for  remove(x, A)
      % expected type  finite_set
  finite_remove: OBLIGATION FORALL (A, x): is_finite(remove[T](x, A));


decl_type: tcc
theory: finite_sets
library: prelude
signature: nil
location: 287 0 289 999
body:
  % Judgement subtype TCC generated (at line 4143, column 25) for  rest(A)
      % expected type  finite_set
  finite_rest: OBLIGATION FORALL (A): is_finite(rest[T](A));


decl_type: tcc
theory: finite_sets
library: prelude
signature: nil
location: 291 0 293 999
body:
  % Judgement subtype TCC generated (at line 4145, column 29) for  emptyset
      % expected type  finite_set
  finite_emptyset: OBLIGATION is_finite(emptyset[T]);


decl_type: tcc
theory: finite_sets
library: prelude
signature: nil
location: 295 0 298 999
body:
  % Judgement subtype TCC generated (at line 4148, column 3) for  singleton(x)
      % expected type  non_empty_finite_set
  nonempty_singleton_finite: OBLIGATION
    FORALL (x): NOT empty?[T](singleton[T](x));


decl_type: tcc
theory: finite_sets
library: prelude
signature: nil
location: 300 0 306 999
body:
  % Subtype TCC generated (at line 4176, column 17) for
      % {n | EXISTS (f: [(S) -> below[n]]): injective?(f)}
      % expected type  (nonempty?[nat])
  inj_set_TCC1: OBLIGATION
    FORALL (S: finite_set):
      nonempty?[nat]
          ({n | EXISTS (f: [(S) -> below[n]]): injective?[(S), below[n]](f)});


decl_type: tcc
theory: finite_sets
library: prelude
signature: nil
location: 308 0 312 999
body:
  % Subtype TCC generated (at line 4185, column 54) for  p - 1
      % expected type  nat
  reduce_inj_TCC1: OBLIGATION
    FORALL (S: finite_set, p: posnat, f: [(S) -> below[p]]):
      injective?(f) AND NOT surjective?(f) IMPLIES p - 1 >= 0;


decl_type: tcc
theory: finite_sets
library: prelude
signature: nil
location: 314 0 317 999
body:
  % Existence TCC generated (at line 4200, column 2) for
      % card(S): {n: nat | n = Card(S)}
  card_TCC1: OBLIGATION
    EXISTS (x: [S: finite_set -> {n: nat | n = Card(S)}]): TRUE;


decl_type: tcc
theory: finite_sets
library: prelude
signature: nil
location: 319 0 326 999
body:
  % Existence TCC generated (at line 4270, column 2) for
      % bij(S: finite_set): {f: [(S) -> below(card(S))] | bijective?(f)}
  bij_TCC1: OBLIGATION
    EXISTS (x:
              [S: finite_set ->
                 {f: [(S) -> below(card(S))] |
                          bijective?[(S), below(card(S))](f)}]):
      TRUE;


decl_type: tcc
theory: finite_sets
library: prelude
signature: nil
location: 328 0 330 999
body:
  % Existence TCC generated (at line 4273, column 7) for  inverse
  ibij_TCC1: OBLIGATION
    FORALL (S: non_empty_finite_set): EXISTS (x: (S)): TRUE;


decl_type: tcc
theory: finite_sets
library: prelude
signature: nil
location: 332 0 337 999
body:
  % Subtype TCC generated (at line 4299, column 26) for  {x: T | P1(x)}
      % expected type  S: finite_set
  card_implies_TCC1: OBLIGATION
    FORALL (P1, P2: pred[T]):
      (FORALL (x: T): P1(x) IMPLIES P2(x)) AND is_finite(fullset[T]) IMPLIES
       is_finite({x: T | P1(x)});


decl_type: tcc
theory: finite_sets
library: prelude
signature: nil
location: 339 0 344 999
body:
  % Subtype TCC generated (at line 4299, column 50) for  {x: T | P2(x)}
      % expected type  S: finite_set
  card_implies_TCC2: OBLIGATION
    FORALL (P1, P2: pred[T]):
      (FORALL (x: T): P1(x) IMPLIES P2(x)) AND is_finite(fullset[T]) IMPLIES
       is_finite({x: T | P2(x)});


decl_type: function
theory: stdpvs
library: prelude
signature: [T -> string]
location: 13 2 16 42
body:
    pvs2str(t:T) : MACRO string =
      catch("cant-translate",     
            pvs2str_lisp(t),
            LAMBDA(e:Exception[void]):"<?>")


decl_type: tcc
theory: K_props
library: prelude
signature: nil
location: 10 0 14 999
body:
  % Judgement subtype TCC generated (at line 418, column 25) for
      % K_conversion[T1, T2](x)(y)
      % expected type  S
  K_preserves: OBLIGATION
    FORALL (x: S, y: T2): S_pred(K_conversion[T1, T2](x)(y));


decl_type: tcc
theory: K_props
library: prelude
signature: nil
location: 16 0 20 999
body:
  % Judgement subtype TCC generated (at line 419, column 26) for
      % K_conversion[T1, T2](x)
      % expected type  [T2 -> S]
  K_preserves1: OBLIGATION
    FORALL (x: S, x1: T2): S_pred(K_conversion[T1, T2](x)(x1));


decl_type: tcc
theory: divides
library: prelude
signature: nil
location: 106 0 108 999
body:
  % Judgement subtype TCC generated (at line 3680, column 27) for  n * m
      % expected type  (divides(n))
  mult_divides1: OBLIGATION FORALL (m, n): divides(n)(n * m);


decl_type: tcc
theory: divides
library: prelude
signature: nil
location: 110 0 112 999
body:
  % Judgement subtype TCC generated (at line 3681, column 27) for  n * m
      % expected type  (divides(m))
  mult_divides2: OBLIGATION FORALL (m, n): divides(m)(n * m);


decl_type: formula
theory: bv_nat
library: prelude
signature: nil
location: 34 2 35 61
body:
    bv2nat_rec_bound: LEMMA FORALL (n: upto(N), bv: bvec[N]): 
                                    bv2nat_rec(n, bv) < exp2(n)


decl_type: formula
theory: bv_nat
library: prelude
signature: nil
location: 45 2 47 68
body:
    bv2nat_inj_rec: LEMMA
        bv2nat_rec(n, bv1) = bv2nat_rec(n, bv2)
          <=>  (FORALL (m: below(N)): (m < n) IMPLIES bv1(m) = bv2(m))


decl_type: formula
theory: bv_nat
library: prelude
signature: nil
location: 49 2 50 66
body:
    bv2nat_surj_rec: LEMMA FORALL (y:below(exp2(n))): 
                                     EXISTS bv:bv2nat_rec(n, bv) = y


decl_type: formula
theory: bv_nat
library: prelude
signature: nil
location: 52 2 54 55
body:
    bv2nat_inj     : THEOREM % injective?(bv2nat)
                              (FORALL (x, y: bvec[N]): (bv2nat(x) = bv2nat(y) 
                                        IMPLIES (x = y)))


decl_type: formula
theory: bv_nat
library: prelude
signature: nil
location: 56 2 58 74
body:
    bv2nat_surj    : THEOREM % surjective?(bv2nat)
                                (FORALL (y: below(exp2(N))): 
                                       (EXISTS (x: bvec[N]): bv2nat(x) = y))


decl_type: formula
theory: bv_nat
library: prelude
signature: nil
location: 72 2 74 81
body:
    bv2nat_top_bit    : THEOREM N > 0 IMPLIES
                               IF bv2nat(bv) < exp2(N-1) THEN bv^(N-1) = FALSE
                                                         ELSE bv^(N-1) = TRUE ENDIF


decl_type: function
theory: bv_nat
library: prelude
signature: [[upto(N), bvec[N]] -> nat]
location: 26 2 30 13
body:
    bv2nat_rec(n: upto(N), bv:bvec[N]): RECURSIVE nat =
        IF n = 0 THEN 0
        ELSE exp2(n-1) * bv^(n-1) + bv2nat_rec(n - 1, bv)
        ENDIF
      MEASURE n


decl_type: tcc
theory: bv_nat
library: prelude
signature: nil
location: 97 0 100 999
body:
  % Subtype TCC generated (at line 5394, column 16) for  n - 1
      % expected type  nat
  bv2nat_rec_TCC1: OBLIGATION
    FORALL (n: upto(N)): NOT n = 0 IMPLIES n - 1 >= 0;


decl_type: tcc
theory: bv_nat
library: prelude
signature: nil
location: 102 0 105 999
body:
  % Subtype TCC generated (at line 5394, column 27) for  (n - 1)
      % expected type  below[N]
  bv2nat_rec_TCC2: OBLIGATION
    FORALL (n: upto(N)): NOT n = 0 IMPLIES (n - 1) >= 0 AND (n - 1) < N;


decl_type: tcc
theory: bv_nat
library: prelude
signature: nil
location: 107 0 110 999
body:
  % Subtype TCC generated (at line 5394, column 45) for  n - 1
      % expected type  upto(N)
  bv2nat_rec_TCC3: OBLIGATION
    FORALL (n: upto(N)): NOT n = 0 IMPLIES n - 1 >= 0 AND n - 1 <= N;


decl_type: tcc
theory: bv_nat
library: prelude
signature: nil
location: 112 0 115 999
body:
  % Termination TCC generated (at line 5394, column 34) for
      % bv2nat_rec(n - 1, bv)
  bv2nat_rec_TCC4: OBLIGATION
    FORALL (n: upto(N)): NOT n = 0 IMPLIES n - 1 < n;


decl_type: tcc
theory: bv_nat
library: prelude
signature: nil
location: 117 0 124 999
body:
  % Subtype TCC generated (at line 5394, column 11) for
      % exp2(n - 1) * b2n(bv ^ (n - 1)) + bv2nat_rec(n - 1, bv)
      % expected type  nat
  bv2nat_rec_TCC5: OBLIGATION
    FORALL (n: upto(N), v: [{z: [upto(N), bvec[N]] | z`1 < n} -> nat],
            bv: bvec[N]):
      NOT n = 0 IMPLIES
       exp2(n - 1) * b2n(^[N](bv, (n - 1))) + v(n - 1, bv) >= 0;


decl_type: tcc
theory: bv_nat
library: prelude
signature: nil
location: 126 0 128 999
body:
  % Subtype TCC generated (at line 5403, column 50) for  N
      % expected type  upto(N)
  bv2nat_TCC1: OBLIGATION N <= N;


decl_type: tcc
theory: bv_nat
library: prelude
signature: nil
location: 130 0 132 999
body:
  % Subtype TCC generated (at line 5403, column 39) for  bv2nat_rec(N, bv)
      % expected type  below(exp2(N))
  bv2nat_TCC2: OBLIGATION FORALL (bv: bvec[N]): bv2nat_rec(N, bv) < exp2(N);


decl_type: tcc
theory: bv_nat
library: prelude
signature: nil
location: 134 0 136 999
body:
  % Subtype TCC generated (at line 5439, column 50) for  N - 1
      % expected type  nat
  bv2nat_top_bit_TCC1: OBLIGATION N > 0 IMPLIES N - 1 >= 0;


decl_type: tcc
theory: bv_nat
library: prelude
signature: nil
location: 138 0 142 999
body:
  % Subtype TCC generated (at line 5439, column 64) for  (N - 1)
      % expected type  below[N]
  bv2nat_top_bit_TCC2: OBLIGATION
    FORALL (bv: bvec[N]):
      N > 0 AND bv2nat(bv) < exp2(N - 1) IMPLIES (N - 1) >= 0 AND (N - 1) < N;


decl_type: tcc
theory: bv_nat
library: prelude
signature: nil
location: 144 0 149 999
body:
  % Subtype TCC generated (at line 5440, column 64) for  (N - 1)
      % expected type  below[N]
  bv2nat_top_bit_TCC3: OBLIGATION
    FORALL (bv: bvec[N]):
      N > 0 AND NOT bv2nat(bv) < exp2(N - 1) IMPLIES
       (N - 1) >= 0 AND (N - 1) < N;


decl_type: tcc
theory: bv_nat
library: prelude
signature: nil
location: 151 0 153 999
body:
  % Subtype TCC generated (at line 5442, column 47) for  (N - 1)
      % expected type  below[N]
  bv2nat_topbit_TCC1: OBLIGATION N > 0 IMPLIES (N - 1) >= 0 AND (N - 1) < N;


decl_type: tcc
theory: bv_nat
library: prelude
signature: nil
location: 155 0 159 999
body:
  % Existence TCC generated (at line 5446, column 2) for
      % nat2bv(val: below(exp2(N))): {bv: bvec[N] | bv2nat(bv) = val}
  nat2bv_TCC1: OBLIGATION
    EXISTS (x: [val: below(exp2(N)) -> {bv: bvec[N] | bv2nat(bv) = val}]):
      TRUE;


decl_type: formula
theory: function_image
library: prelude
signature: nil
location: 13 2 14 50
body:
    fun_exists: LEMMA (EXISTS y: TRUE) OR (NOT EXISTS x: TRUE)
                            IMPLIES (EXISTS f: TRUE)


decl_type: formula
theory: function_image
library: prelude
signature: nil
location: 33 2 34 79
body:
    inverse_image_subset: LEMMA
      subset?(Y1, Y2) IMPLIES subset?(inverse_image(f, Y1), inverse_image(f, Y2))


decl_type: formula
theory: function_image
library: prelude
signature: nil
location: 39 2 41 53
body:
    image_intersection: LEMMA
      subset?(image(f, intersection(X1, X2)),
              intersection(image(f, X1), image(f, X2)))


decl_type: formula
theory: function_image
library: prelude
signature: nil
location: 43 2 45 57
body:
    inverse_image_union: LEMMA
      inverse_image(f, union(Y1, Y2))
        = union(inverse_image(f, Y1), inverse_image(f, Y2))


decl_type: formula
theory: function_image
library: prelude
signature: nil
location: 47 2 49 64
body:
    inverse_image_intersection: LEMMA
      inverse_image(f, intersection(Y1, Y2))
        = intersection(inverse_image(f, Y1), inverse_image(f, Y2))


decl_type: formula
theory: function_image
library: prelude
signature: nil
location: 51 2 52 69
body:
    inverse_image_complement: LEMMA
      inverse_image(f, complement(Y)) = complement(inverse_image(f, Y))


decl_type: function
theory: filters
library: prelude
signature: [[list[T], pred[T]] -> list[T]]
location: 17 2 22 21
body:
    filter(l, p): RECURSIVE list[T] =
      CASES l OF
        null: null,
        cons(x, y): IF p(x) THEN cons(x, filter(y, p)) ELSE filter(y, p) ENDIF
      ENDCASES
      MEASURE length(l)


decl_type: function
theory: filters
library: prelude
signature: [pred[T] -> [list[T] -> list[T]]]
location: 24 2 29 21
body:
    filter(p)(l): RECURSIVE list[T] =
      CASES l OF
        null: null,
        cons(x, y): IF p(x) THEN cons(x, filter(p)(y)) ELSE filter(p)(y) ENDIF
      ENDCASES
      MEASURE length(l)


decl_type: tcc
theory: filters
library: prelude
signature: nil
location: 35 0 38 999
body:
  % Termination TCC generated (at line 4862, column 39) for  filter(y, p)
  filter_TCC1: OBLIGATION
    FORALL (l: list[T], p: pred[T], x: T, y: list[T]):
      p(x) AND l = cons(x, y) IMPLIES length[T](y) < length[T](l);


decl_type: tcc
theory: filters
library: prelude
signature: nil
location: 40 0 43 999
body:
  % Termination TCC generated (at line 4862, column 58) for  filter(y, p)
  filter_TCC2: OBLIGATION
    FORALL (l: list[T], p: pred[T], x: T, y: list[T]):
      NOT p(x) AND l = cons(x, y) IMPLIES length[T](y) < length[T](l);


decl_type: function
theory: list2finseq
library: prelude
signature: [list[T] -> finseq[T]]
location: 9 2 11 58
body:
    list2finseq(l): finseq[T] =
      (# length := length(l),
         seq := (LAMBDA (x: below[length(l)]): nth(l, x)) #)


decl_type: function
theory: list2finseq
library: prelude
signature: [[fs: finseq[T], {n: nat | n <= length(fs)}] -> list[T]]
location: 13 2 19 13
body:
    finseq2list_rec(fs, (n: nat | n <= length(fs))): RECURSIVE list[T] =
      IF n = 0
         THEN null
         ELSE cons(fs`seq(length(fs) - n),
                   finseq2list_rec(fs, n-1))
      ENDIF
      MEASURE n


decl_type: tcc
theory: list2finseq
library: prelude
signature: nil
location: 30 0 34 999
body:
  % Subtype TCC generated (at line 4890, column 24) for  length(fs) - n
      % expected type  below[fs`length]
  finseq2list_rec_TCC1: OBLIGATION
    FORALL (fs: finseq[T], (n: nat | n <= length(fs))):
      NOT n = 0 IMPLIES length(fs) - n >= 0 AND length(fs) - n < fs`length;


decl_type: tcc
theory: list2finseq
library: prelude
signature: nil
location: 36 0 40 999
body:
  % Subtype TCC generated (at line 4891, column 37) for  n - 1
      % expected type  {n: nat | n <= length(fs)}
  finseq2list_rec_TCC2: OBLIGATION
    FORALL (fs: finseq[T], (n: nat | n <= length(fs))):
      NOT n = 0 IMPLIES n - 1 >= 0 AND n - 1 <= length(fs);


decl_type: tcc
theory: list2finseq
library: prelude
signature: nil
location: 42 0 46 999
body:
  % Termination TCC generated (at line 4891, column 17) for
      % finseq2list_rec(fs, n - 1)
  finseq2list_rec_TCC3: OBLIGATION
    FORALL (fs: finseq[T], (n: nat | n <= length(fs))):
      NOT n = 0 IMPLIES n - 1 < n;


decl_type: tcc
theory: list2finseq
library: prelude
signature: nil
location: 48 0 51 999
body:
  % Subtype TCC generated (at line 4895, column 49) for  length(fs)
      % expected type  {n: nat | n <= length(fs)}
  finseq2list_TCC1: OBLIGATION
    FORALL (fs: finseq[T]): length(fs) <= length(fs);


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 120 0 123 999
body:
  % Subtype TCC generated (at line 2343, column 20) for  -m
      % expected type  {n: nonneg_real | n >= m AND n >= -m}
  abs_TCC1: OBLIGATION
    FORALL (m: real): m < 0 IMPLIES -m >= 0 AND -m >= m AND -m >= -m;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 125 0 128 999
body:
  % Subtype TCC generated (at line 2343, column 28) for  m
      % expected type  {n: nonneg_real | n >= m AND n >= -m}
  abs_TCC2: OBLIGATION
    FORALL (m: real): NOT m < 0 IMPLIES m >= 0 AND m >= m AND m >= -m;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 130 0 133 999
body:
  % Judgement subtype TCC generated (at line 2345, column 32) for  abs(x)
      % expected type  {y: posreal | y >= x}
  nonzero_abs_is_pos: OBLIGATION
    FORALL (x: nzreal): abs(x) > 0 AND abs(x) >= x;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 135 0 138 999
body:
  % Judgement subtype TCC generated (at line 2346, column 31) for  abs(q)
      % expected type  {r: nonneg_rat | r >= q}
  rat_abs_is_nonneg: OBLIGATION
    FORALL (q: rat): rational_pred(abs(q)) AND abs(q) >= 0 AND abs(q) >= q;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 140 0 142 999
body:
  % Judgement subtype TCC generated (at line 2347, column 30) for  abs(q)
      % expected type  {r: posrat | r >= q}
  nzrat_abs_is_pos: OBLIGATION FORALL (q: nzrat): abs(q) > 0 AND abs(q) >= q;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 144 0 147 999
body:
  % Judgement subtype TCC generated (at line 2348, column 31) for  abs(i)
      % expected type  {j: nonneg_int | j >= i}
  int_abs_is_nonneg: OBLIGATION
    FORALL (i: int): abs(i) >= i AND abs(i) >= 0 AND integer_pred(abs(i));


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 149 0 151 999
body:
  % Judgement subtype TCC generated (at line 2349, column 30) for  abs(i)
      % expected type  {j: posint | j >= i}
  nzint_abs_is_pos: OBLIGATION FORALL (i: nzint): abs(i) > 0 AND abs(i) >= i;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 153 0 156 999
body:
  % Subtype TCC generated (at line 2352, column 20) for  n
      % expected type  {p: real | p >= m AND p >= n}
  max_TCC1: OBLIGATION
    FORALL (m: real, n: real): m < n IMPLIES n >= m AND n >= n;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 158 0 161 999
body:
  % Subtype TCC generated (at line 2352, column 27) for  m
      % expected type  {p: real | p >= m AND p >= n}
  max_TCC2: OBLIGATION
    FORALL (m: real, n: real): NOT m < n IMPLIES m >= m AND m >= n;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 163 0 166 999
body:
  % Subtype TCC generated (at line 2355, column 20) for  n
      % expected type  {p: real | p <= m AND p <= n}
  min_TCC1: OBLIGATION
    FORALL (m: real, n: real): m > n IMPLIES n <= m AND n <= n;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 168 0 171 999
body:
  % Subtype TCC generated (at line 2355, column 27) for  m
      % expected type  {p: real | p <= m AND p <= n}
  min_TCC2: OBLIGATION
    FORALL (m: real, n: real): NOT m > n IMPLIES m <= m AND m <= n;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 173 0 177 999
body:
  % Judgement subtype TCC generated (at line 2360, column 4) for  max(x, y)
      % expected type  {z: nzreal | z >= x AND z >= y}
  nzreal_max: OBLIGATION
    FORALL (x, y: nzreal):
      max(x, y) /= 0 AND max(x, y) >= x AND max(x, y) >= y;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 179 0 183 999
body:
  % Judgement subtype TCC generated (at line 2362, column 4) for  min(x, y)
      % expected type  {z: nzreal | z <= x AND z <= y}
  nzreal_min: OBLIGATION
    FORALL (x, y: nzreal):
      min(x, y) /= 0 AND min(x, y) <= x AND min(x, y) <= y;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 185 0 189 999
body:
  % Judgement subtype TCC generated (at line 2365, column 4) for  max(x, y)
      % expected type  {z: nonneg_real | z >= x AND z >= y}
  nonneg_real_max: OBLIGATION
    FORALL (x, y: nonneg_real):
      max(x, y) >= 0 AND max(x, y) >= x AND max(x, y) >= y;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 191 0 195 999
body:
  % Judgement subtype TCC generated (at line 2367, column 4) for  min(x, y)
      % expected type  {z: nonneg_real | z <= x AND z <= y}
  nonneg_real_min: OBLIGATION
    FORALL (x, y: nonneg_real):
      min(x, y) >= 0 AND min(x, y) <= x AND min(x, y) <= y;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 197 0 201 999
body:
  % Judgement subtype TCC generated (at line 2370, column 4) for  max(x, y)
      % expected type  {z: posreal | z >= x AND z >= y}
  posreal_max: OBLIGATION
    FORALL (x, y: posreal):
      (max(x, y) >= x AND max(x, y) >= y) AND max(x, y) > 0;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 203 0 207 999
body:
  % Judgement subtype TCC generated (at line 2372, column 4) for  min(x, y)
      % expected type  {z: posreal | z <= x AND z <= y}
  posreal_min: OBLIGATION
    FORALL (x, y: posreal):
      (min(x, y) <= x AND min(x, y) <= y) AND min(x, y) > 0;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 209 0 213 999
body:
  % Judgement subtype TCC generated (at line 2377, column 4) for  max(q, r)
      % expected type  {s: rat | s >= q AND s >= r}
  rat_max: OBLIGATION
    FORALL (q, r: rat):
      rational_pred(max(q, r)) AND max(q, r) >= q AND max(q, r) >= r;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 215 0 219 999
body:
  % Judgement subtype TCC generated (at line 2379, column 4) for  min(q, r)
      % expected type  {s: rat | s <= q AND s <= r}
  rat_min: OBLIGATION
    FORALL (q, r: rat):
      rational_pred(min(q, r)) AND min(q, r) <= q AND min(q, r) <= r;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 221 0 225 999
body:
  % Judgement subtype TCC generated (at line 2382, column 4) for  max(q, r)
      % expected type  {s: nzrat | s >= q AND s >= r}
  nzrat_max: OBLIGATION
    FORALL (q, r: nzrat):
      (max(q, r) >= q AND max(q, r) >= r) AND max(q, r) /= 0;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 227 0 231 999
body:
  % Judgement subtype TCC generated (at line 2384, column 4) for  min(q, r)
      % expected type  {s: nzrat | s <= q AND s <= r}
  nzrat_min: OBLIGATION
    FORALL (q, r: nzrat):
      (min(q, r) <= q AND min(q, r) <= r) AND min(q, r) /= 0;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 233 0 237 999
body:
  % Judgement subtype TCC generated (at line 2387, column 4) for  max(q, r)
      % expected type  {s: nonneg_rat | s >= q AND s >= r}
  nonneg_rat_max: OBLIGATION
    FORALL (q, r: nonneg_rat):
      (max(q, r) >= q AND max(q, r) >= r) AND max(q, r) >= 0;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 239 0 243 999
body:
  % Judgement subtype TCC generated (at line 2389, column 4) for  min(q, r)
      % expected type  {s: nonneg_rat | s <= q AND s <= r}
  nonneg_rat_min: OBLIGATION
    FORALL (q, r: nonneg_rat):
      (min(q, r) <= q AND min(q, r) <= r) AND min(q, r) >= 0;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 245 0 249 999
body:
  % Judgement subtype TCC generated (at line 2392, column 4) for  max(q, r)
      % expected type  {s: posrat | s >= q AND s >= r}
  posrat_max: OBLIGATION
    FORALL (q, r: posrat):
      max(q, r) > 0 AND max(q, r) >= q AND max(q, r) >= r;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 251 0 255 999
body:
  % Judgement subtype TCC generated (at line 2394, column 4) for  min(q, r)
      % expected type  {s: posrat | s <= q AND s <= r}
  posrat_min: OBLIGATION
    FORALL (q, r: posrat):
      min(q, r) > 0 AND min(q, r) <= q AND min(q, r) <= r;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 257 0 261 999
body:
  % Judgement subtype TCC generated (at line 2399, column 4) for  max(i, j)
      % expected type  {k: int | i <= k AND j <= k}
  int_max: OBLIGATION
    FORALL (i, j: int):
      integer_pred(max(i, j)) AND i <= max(i, j) AND j <= max(i, j);


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 263 0 267 999
body:
  % Judgement subtype TCC generated (at line 2401, column 4) for  min(i, j)
      % expected type  {k: int | k <= i AND k <= j}
  int_min: OBLIGATION
    FORALL (i, j: int):
      integer_pred(min(i, j)) AND min(i, j) <= i AND min(i, j) <= j;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 269 0 273 999
body:
  % Judgement subtype TCC generated (at line 2404, column 4) for  max(i, j)
      % expected type  {k: nzint | i <= k AND j <= k}
  nzint_max: OBLIGATION
    FORALL (i, j: nzint):
      (i <= max(i, j) AND j <= max(i, j)) AND max(i, j) /= 0;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 275 0 279 999
body:
  % Judgement subtype TCC generated (at line 2406, column 4) for  min(i, j)
      % expected type  {k: nzint | k <= i AND k <= j}
  nzint_min: OBLIGATION
    FORALL (i, j: nzint):
      (min(i, j) <= i AND min(i, j) <= j) AND min(i, j) /= 0;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 281 0 285 999
body:
  % Judgement subtype TCC generated (at line 2409, column 4) for  max(i, j)
      % expected type  {k: nat | i <= k AND j <= k}
  nat_max: OBLIGATION
    FORALL (i, j: nat):
      (i <= max(i, j) AND j <= max(i, j)) AND max(i, j) >= 0;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 287 0 291 999
body:
  % Judgement subtype TCC generated (at line 2411, column 4) for  min(i, j)
      % expected type  {k: nat | k <= i AND k <= j}
  nat_min: OBLIGATION
    FORALL (i, j: nat):
      (min(i, j) <= i AND min(i, j) <= j) AND min(i, j) >= 0;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 293 0 297 999
body:
  % Judgement subtype TCC generated (at line 2414, column 4) for  max(i, j)
      % expected type  {k: posint | i <= k AND j <= k}
  posint_max: OBLIGATION
    FORALL (i, j: posint):
      max(i, j) > 0 AND i <= max(i, j) AND j <= max(i, j);


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 299 0 303 999
body:
  % Judgement subtype TCC generated (at line 2416, column 4) for  min(i, j)
      % expected type  {k: posint | k <= i AND k <= j}
  posint_min: OBLIGATION
    FORALL (i, j: posint):
      min(i, j) > 0 AND min(i, j) <= i AND min(i, j) <= j;


decl_type: formula
theory: bv_caret
library: prelude
signature: nil
location: 47 2 48 58
body:
    bv_caret_elim : LEMMA (FORALL (i: below(N), j: upto(i), k: below(i-j+1)): 
                                 bv ^ (i, j) ^ k = bv^(j+k))


decl_type: function
theory: bv_caret
library: prelude
signature:
  [d: [bvec[N], [i1: below(N), upto(i1)]] ->
  bvec[1 - PROJ_2(d`2) + PROJ_1(d`2)]]

location: 25 3 27 26
body:
     ^(bv: bvec[N], sp:[i1: below(N), upto(i1)]): bvec[proj_1(sp)-proj_2(sp)+1] =
         (LAMBDA  (ii: below(proj_1(sp) - proj_2(sp) + 1)):
                    bv(ii + proj_2(sp))) ;


decl_type: tcc
theory: bv_caret
library: prelude
signature: nil
location: 55 0 59 999
body:
  % Subtype TCC generated (at line 5494, column 48) for
      % bvec[PROJ_1(sp) - PROJ_2(sp) + 1]
      % expected type  nat
  caret_TCC1: OBLIGATION
    FORALL (sp: [i1: below(N), upto(i1)]): 1 - PROJ_2(sp) + PROJ_1(sp) >= 0;


decl_type: tcc
theory: bv_caret
library: prelude
signature: nil
location: 61 0 66 999
body:
  % Subtype TCC generated (at line 5496, column 7) for  ii + PROJ_2(sp)
      % expected type  below(N)
  caret_TCC2: OBLIGATION
    FORALL (sp: [i1: below(N), upto(i1)],
            ii: below(PROJ_1(sp) - PROJ_2(sp) + 1)):
      ii + PROJ_2(sp) < N;


decl_type: tcc
theory: bv_caret
library: prelude
signature: nil
location: 68 0 70 999
body:
  % Subtype TCC generated (at line 5510, column 42) for  N - 1
      % expected type  below(N)
  bv_caret_all_TCC1: OBLIGATION N > 0 IMPLIES N - 1 >= 0 AND N - 1 < N;


decl_type: tcc
theory: bv_caret
library: prelude
signature: nil
location: 72 0 74 999
body:
  % Subtype TCC generated (at line 5510, column 47) for  0
      % expected type  upto(N - 1)
  bv_caret_all_TCC2: OBLIGATION N > 0 IMPLIES 0 <= N - 1;


decl_type: tcc
theory: bv_caret
library: prelude
signature: nil
location: 76 0 78 999
body:
  % Subtype TCC generated (at line 5514, column 53) for  i
      % expected type  upto(i)
  bv_caret_ii_0_TCC1: OBLIGATION FORALL (i: below(N)): i <= i;


decl_type: tcc
theory: bv_caret
library: prelude
signature: nil
location: 80 0 83 999
body:
  % Subtype TCC generated (at line 89, column 18) for  1 + i - j
      % expected type  nat
  bv_caret_elim_TCC1: OBLIGATION
    FORALL (i: below(N), j: upto(i), k: below(i - j + 1)): 1 + i - j >= 0;


decl_type: tcc
theory: bv_caret
library: prelude
signature: nil
location: 85 0 88 999
body:
  % Subtype TCC generated (at line 5517, column 53) for  (j + k)
      % expected type  below[N]
  bv_caret_elim_TCC2: OBLIGATION
    FORALL (i: below(N), j: upto(i), k: below(i - j + 1)): (j + k) < N;


decl_type: tcc
theory: real_types
library: prelude
signature: nil
location: 58 0 60 999
body:
  % Judgement subtype TCC generated (at line 2005, column 31) for  x
      % expected type  nzreal
  posreal_is_nzreal: OBLIGATION FORALL (x: posreal): x /= 0;


decl_type: tcc
theory: real_types
library: prelude
signature: nil
location: 62 0 64 999
body:
  % Judgement subtype TCC generated (at line 2006, column 31) for  x
      % expected type  nzreal
  negreal_is_nzreal: OBLIGATION FORALL (x: negreal): x /= 0;


decl_type: tcc
theory: real_types
library: prelude
signature: nil
location: 66 0 68 999
body:
  % Judgement subtype TCC generated (at line 2020, column 43) for  nzx * nzy
      % expected type  nzreal
  nzreal_times_nzreal_is_nzreal: OBLIGATION FORALL (nzx, nzy): nzx * nzy /= 0;


decl_type: tcc
theory: real_types
library: prelude
signature: nil
location: 70 0 72 999
body:
  % Judgement subtype TCC generated (at line 2021, column 43) for  nzx / nzy
      % expected type  nzreal
  nzreal_div_nzreal_is_nzreal: OBLIGATION FORALL (nzx, nzy): nzx / nzy /= 0;


decl_type: tcc
theory: real_types
library: prelude
signature: nil
location: 74 0 76 999
body:
  % Judgement subtype TCC generated (at line 2022, column 43) for  -nzx
      % expected type  nzreal
  minus_nzreal_is_nzreal: OBLIGATION FORALL (nzx): -nzx /= 0;


decl_type: tcc
theory: real_types
library: prelude
signature: nil
location: 78 0 80 999
body:
  % Judgement subtype TCC generated (at line 2024, column 43) for  nnx + nny
      % expected type  nnreal
  nnreal_plus_nnreal_is_nnreal: OBLIGATION FORALL (nnx, nny): nnx + nny >= 0;


decl_type: tcc
theory: real_types
library: prelude
signature: nil
location: 82 0 84 999
body:
  % Judgement subtype TCC generated (at line 2025, column 43) for  nnx * nny
      % expected type  nnreal
  nnreal_times_nnreal_is_nnreal: OBLIGATION FORALL (nnx, nny): nnx * nny >= 0;


decl_type: tcc
theory: real_types
library: prelude
signature: nil
location: 86 0 88 999
body:
  % Judgement subtype TCC generated (at line 2026, column 43) for  nnx / py
      % expected type  nnreal
  nnreal_div_posreal_is_nnreal: OBLIGATION FORALL (nnx, py): nnx / py >= 0;


decl_type: tcc
theory: real_types
library: prelude
signature: nil
location: 90 0 92 999
body:
  % Judgement subtype TCC generated (at line 2027, column 43) for  nnx / ny
      % expected type  npreal
  nnreal_div_negreal_is_npreal: OBLIGATION FORALL (nnx, ny): nnx / ny <= 0;


decl_type: tcc
theory: real_types
library: prelude
signature: nil
location: 94 0 96 999
body:
  % Judgement subtype TCC generated (at line 2029, column 43) for  npx + npy
      % expected type  npreal
  npreal_plus_npreal_is_npreal: OBLIGATION FORALL (npx, npy): npx + npy <= 0;


decl_type: tcc
theory: real_types
library: prelude
signature: nil
location: 98 0 100 999
body:
  % Judgement subtype TCC generated (at line 2030, column 43) for  npx * npy
      % expected type  nnreal
  npreal_times_npreal_is_nnreal: OBLIGATION FORALL (npx, npy): npx * npy >= 0;


decl_type: tcc
theory: real_types
library: prelude
signature: nil
location: 102 0 104 999
body:
  % Judgement subtype TCC generated (at line 2031, column 43) for  npx / py
      % expected type  npreal
  npreal_div_posreal_is_npreal: OBLIGATION FORALL (npx, py): npx / py <= 0;


decl_type: tcc
theory: real_types
library: prelude
signature: nil
location: 106 0 108 999
body:
  % Judgement subtype TCC generated (at line 2032, column 43) for  npx / ny
      % expected type  nnreal
  npreal_div_negreal_is_nnreal: OBLIGATION FORALL (npx, ny): npx / ny >= 0;


decl_type: tcc
theory: real_types
library: prelude
signature: nil
location: 110 0 112 999
body:
  % Judgement subtype TCC generated (at line 2034, column 46) for  px + nny
      % expected type  posreal
  posreal_plus_nnreal_is_posreal: OBLIGATION FORALL (nny, px): px + nny > 0;


decl_type: tcc
theory: real_types
library: prelude
signature: nil
location: 114 0 116 999
body:
  % Judgement subtype TCC generated (at line 2035, column 46) for  nnx + py
      % expected type  posreal
  nnreal_plus_posreal_is_posreal: OBLIGATION FORALL (nnx, py): nnx + py > 0;


decl_type: tcc
theory: real_types
library: prelude
signature: nil
location: 118 0 120 999
body:
  % Judgement subtype TCC generated (at line 2036, column 46) for  px * py
      % expected type  posreal
  posreal_times_posreal_is_posreal: OBLIGATION FORALL (px, py): px * py > 0;


decl_type: tcc
theory: real_types
library: prelude
signature: nil
location: 122 0 124 999
body:
  % Judgement subtype TCC generated (at line 2037, column 46) for  px / py
      % expected type  posreal
  posreal_div_posreal_is_posreal: OBLIGATION FORALL (px, py): px / py > 0;


decl_type: tcc
theory: real_types
library: prelude
signature: nil
location: 126 0 128 999
body:
  % Judgement subtype TCC generated (at line 2039, column 46) for  nx + ny
      % expected type  negreal
  negreal_plus_negreal_is_negreal: OBLIGATION FORALL (nx, ny): nx + ny < 0;


decl_type: tcc
theory: real_types
library: prelude
signature: nil
location: 130 0 132 999
body:
  % Judgement subtype TCC generated (at line 2040, column 46) for  nx * ny
      % expected type  posreal
  negreal_times_negreal_is_posreal: OBLIGATION FORALL (nx, ny): nx * ny > 0;


decl_type: tcc
theory: real_types
library: prelude
signature: nil
location: 134 0 136 999
body:
  % Judgement subtype TCC generated (at line 2041, column 46) for  nx / ny
      % expected type  posreal
  negreal_div_negreal_is_posreal: OBLIGATION FORALL (nx, ny): nx / ny > 0;


decl_type: formula
theory: relations
library: prelude
signature: nil
location: 46 0 50 999
body:
  TC_weak_induction: AXIOM
    FORALL (R, P: [[T, T] -> boolean]):
      (FORALL (x, y):
         R(x, y) OR (EXISTS z: P(x, z) AND P(z, y)) IMPLIES P(x, y))
       IMPLIES (FORALL (x, y): TC(R)(x, y) IMPLIES P(x, y));


decl_type: formula
theory: relations
library: prelude
signature: nil
location: 52 0 58 999
body:
  TC_induction: AXIOM
    FORALL (R, P: [[T, T] -> boolean]):
      (FORALL (x, y):
         R(x, y) OR
          (EXISTS z: (TC(R)(x, z) AND P(x, z)) AND TC(R)(z, y) AND P(z, y))
          IMPLIES P(x, y))
       IMPLIES (FORALL (x, y): TC(R)(x, y) IMPLIES P(x, y));


decl_type: tcc
theory: relations
library: prelude
signature: nil
location: 60 0 62 999
body:
  % Judgement subtype TCC generated (at line 471, column 33) for  x
      % expected type  (reflexive?)
  equiv_is_reflexive: OBLIGATION FORALL (x: (equivalence?)): reflexive?(x);


decl_type: tcc
theory: relations
library: prelude
signature: nil
location: 64 0 66 999
body:
  % Judgement subtype TCC generated (at line 472, column 33) for  x
      % expected type  (symmetric?)
  equiv_is_symmetric: OBLIGATION FORALL (x: (equivalence?)): symmetric?(x);


decl_type: tcc
theory: relations
library: prelude
signature: nil
location: 68 0 70 999
body:
  % Judgement subtype TCC generated (at line 473, column 33) for  x
      % expected type  (transitive?)
  equiv_is_transitive: OBLIGATION FORALL (x: (equivalence?)): transitive?(x);


decl_type: tcc
theory: ctlops
library: prelude
signature: nil
location: 32 0 37 999
body:
  % Subtype TCC generated (at line 5095, column 27) for
      % LAMBDA Q: (LAMBDA (s: state): f(s) AND EX(N, Q)(s))
      % expected type  (monotonic?[state])
  EG_TCC1: OBLIGATION
    FORALL (N: [[state, state] -> bool], f: pred[state]):
      monotonic?[state](LAMBDA Q: LAMBDA (s: state): f(s) AND EX(N, Q)(s));


decl_type: tcc
theory: ctlops
library: prelude
signature: nil
location: 39 0 47 999
body:
  % Subtype TCC generated (at line 5097, column 29) for
      % LAMBDA Q:
      %   (LAMBDA (s1: state):
      %      g(s1) OR (LAMBDA (s: state): f(s) AND EX(N, Q)(s))(s1))
      % expected type  (monotonic?[state])
  EU_TCC1: OBLIGATION
    FORALL (N: [[state, state] -> bool], f: pred[state], g: pred[state]):
      monotonic?[state]
          (LAMBDA Q: LAMBDA (s1: state): g(s1) OR f(s1) AND EX(N, Q)(s1));


decl_type: formula
theory: nat_fun_props
library: prelude
signature: nil
location: 12 2 13 67
body:
    injection_n_to_m: THEOREM
          (EXISTS (f: [below(n) -> below(m)]): injective?(f)) IMPLIES n <= m


decl_type: formula
theory: nat_fun_props
library: prelude
signature: nil
location: 15 2 16 63
body:
    injection_n_to_m_var: THEOREM
          (EXISTS (f: [below(n) -> below(m)]): injective?(f)) IFF n <= m


decl_type: formula
theory: nat_fun_props
library: prelude
signature: nil
location: 18 2 19 68
body:
    surjection_n_to_m: THEOREM
          (EXISTS (f: [below(n) -> below(m)]): surjective?(f)) IMPLIES m <= n


decl_type: formula
theory: nat_fun_props
library: prelude
signature: nil
location: 21 2 23 44
body:
    surjection_n_to_m_var: THEOREM
          (EXISTS (f: [below(n) -> below(m)]): surjective?(f)) IFF 
              (m > 0 AND m <= n) OR (m = 0 AND n = 0)


decl_type: formula
theory: nat_fun_props
library: prelude
signature: nil
location: 39 2 40 69
body:
    surj_equiv_inj: THEOREM
          FORALL (f: [below(n) -> below(n)]): surjective?(f) IFF injective?(f)


decl_type: formula
theory: nat_fun_props
library: prelude
signature: nil
location: 42 2 43 68
body:
    inj_equiv_bij: THEOREM
          FORALL (f: [below(n) -> below(n)]): bijective?(f) IFF injective?(f)


decl_type: formula
theory: nat_fun_props
library: prelude
signature: nil
location: 45 2 46 69
body:
    surj_equiv_bij: THEOREM
          FORALL (f: [below(n) -> below(n)]): bijective?(f) IFF surjective?(f)


decl_type: formula
theory: nat_fun_props
library: prelude
signature: nil
location: 49 2 50 67
body:
    surj_equiv_inj2: THEOREM
          FORALL (f: [upto(n) -> upto(n)]): surjective?(f) IFF injective?(f)


decl_type: formula
theory: nat_fun_props
library: prelude
signature: nil
location: 55 2 56 67
body:
    surj_equiv_bij2: THEOREM
          FORALL (f: [upto(n) -> upto(n)]): bijective?(f) IFF surjective?(f)


decl_type: formula
theory: function_inverse
library: prelude
signature: nil
location: 22 2 24 41
body:
    surjective_inverse: LEMMA
      FORALL (f:(surjective?[D, R])):
         inverse(f)(y) = x IMPLIES y = f(x)


decl_type: formula
theory: function_inverse
library: prelude
signature: nil
location: 30 2 32 41
body:
    injective_inverse: LEMMA
      FORALL (f:(injective?[D, R])):
         y = f(x) IMPLIES inverse(f)(y) = x


decl_type: judgement
theory: function_inverse
library: prelude
signature: (bijective?[R, D])
location: 19 2 20 59
body:
    bijective_inverse_is_bijective: JUDGEMENT
      inverse(f:(bijective?[D,R])) HAS_TYPE (bijective?[R,D])


decl_type: tcc
theory: function_inverse
library: prelude
signature: nil
location: 79 0 82 999
body:
  % Judgement subtype TCC generated (at line 1298, column 4) for  inverse(f)(y)
      % expected type  {x: D | f(x) = y}
  unique_bijective_inverse: OBLIGATION
    FORALL (f: (bijective?[D, R]), y): f(inverse(f)(y)) = y;


decl_type: tcc
theory: function_inverse
library: prelude
signature: nil
location: 84 0 87 999
body:
  % Judgement subtype TCC generated (at line 1301, column 4) for  inverse(f)
      % expected type  (bijective?[R, D])
  bijective_inverse_is_bijective: OBLIGATION
    FORALL (f: (bijective?[D, R])): bijective?[R, D](inverse(f));


decl_type: tcc
theory: function_inverse
library: prelude
signature: nil
location: 89 0 92 999
body:
  % Judgement subtype TCC generated (at line 1339, column 4) for  inverse(f)
      % expected type  (surjective?[R, D])
  inv_inj_is_surj: OBLIGATION
    FORALL (f: (injective?[D, R])): surjective?[R, D](inverse(f));


decl_type: tcc
theory: function_inverse
library: prelude
signature: nil
location: 94 0 97 999
body:
  % Judgement subtype TCC generated (at line 1341, column 4) for  inverse(f)
      % expected type  (injective?[R, D])
  inv_surj_is_inj: OBLIGATION
    FORALL (f: (surjective?[D, R])): injective?[R, D](inverse(f));


decl_type: formula
theory: if_props
library: prelude
signature: nil
location: 12 2 15 49
body:
    lift_if2: LEMMA
      IF (IF a THEN b ELSE c ENDIF) THEN x ELSE y ENDIF
       = IF a THEN (IF b THEN x ELSE y ENDIF)
              ELSE (IF c THEN x ELSE y ENDIF) ENDIF


decl_type: formula
theory: list_adt
library: prelude
signature: nil
location: 20 2 22 64
body:
    list_ord_defaxiom: AXIOM
      list_ord(null) = 0 AND
       (FORALL (car: T, cdr: list): list_ord(cons(car, cdr)) = 1);


decl_type: formula
theory: list_adt
library: prelude
signature: nil
location: 27 2 29 29
body:
    list_null_extensionality: AXIOM
      FORALL (null?_var: (null?), null?_var2: (null?)):
        null?_var = null?_var2;


decl_type: formula
theory: list_adt
library: prelude
signature: nil
location: 31 2 34 38
body:
    list_cons_extensionality: AXIOM
      FORALL (cons?_var: (cons?), cons?_var2: (cons?)):
        car(cons?_var) = car(cons?_var2) AND cdr(cons?_var) = cdr(cons?_var2)
         IMPLIES cons?_var = cons?_var2;


decl_type: formula
theory: list_adt
library: prelude
signature: nil
location: 36 2 38 55
body:
    list_cons_eta: AXIOM
      FORALL (cons?_var: (cons?)):
        cons(car(cons?_var), cdr(cons?_var)) = cons?_var;


decl_type: formula
theory: list_adt
library: prelude
signature: nil
location: 40 2 42 50
body:
    list_car_cons: AXIOM
      FORALL (cons1_var: T, cons2_var: list):
        car(cons(cons1_var, cons2_var)) = cons1_var;


decl_type: formula
theory: list_adt
library: prelude
signature: nil
location: 44 2 46 50
body:
    list_cdr_cons: AXIOM
      FORALL (cons1_var: T, cons2_var: list):
        cdr(cons(cons1_var, cons2_var)) = cons2_var;


decl_type: formula
theory: list_adt
library: prelude
signature: nil
location: 51 2 56 54
body:
    list_induction: AXIOM
      FORALL (p: [list -> boolean]):
        (p(null) AND
          (FORALL (cons1_var: T, cons2_var: list):
             p(cons2_var) IMPLIES p(cons(cons1_var, cons2_var))))
         IMPLIES (FORALL (list_var: list): p(list_var));


decl_type: function
theory: list_adt
library: prelude
signature: [list -> upto(1)]
location: 24 2 25 64
body:
    ord(x: list): [list -> upto(1)] =
        CASES x OF null: 0, cons(cons1_var, cons2_var): 1 ENDCASES


decl_type: function
theory: list_adt
library: prelude
signature: [PRED[T] -> [list -> boolean]]
location: 58 2 62 17
body:
    every(p: PRED[T])(a: list):  boolean =
        CASES a
          OF null: TRUE,
             cons(cons1_var, cons2_var): p(cons1_var) AND every(p)(cons2_var)
          ENDCASES;


decl_type: function
theory: list_adt
library: prelude
signature: [[PRED[T], list] -> boolean]
location: 64 2 68 17
body:
    every(p: PRED[T], a: list):  boolean =
        CASES a
          OF null: TRUE,
             cons(cons1_var, cons2_var): p(cons1_var) AND every(p, cons2_var)
          ENDCASES;


decl_type: function
theory: list_adt
library: prelude
signature: [PRED[T] -> [list -> boolean]]
location: 70 2 74 17
body:
    some(p: PRED[T])(a: list):  boolean =
        CASES a
          OF null: FALSE,
             cons(cons1_var, cons2_var): p(cons1_var) OR some(p)(cons2_var)
          ENDCASES;


decl_type: function
theory: list_adt
library: prelude
signature: [[PRED[T], list] -> boolean]
location: 76 2 80 17
body:
    some(p: PRED[T], a: list):  boolean =
        CASES a
          OF null: FALSE,
             cons(cons1_var, cons2_var): p(cons1_var) OR some(p, cons2_var)
          ENDCASES;


decl_type: function
theory: list_adt
library: prelude
signature: [[list, list] -> boolean]
location: 82 2 86 18
body:
    subterm(x: list, y: list):  boolean =
        x = y OR
         CASES y
           OF null: FALSE, cons(cons1_var, cons2_var): subterm(x, cons2_var)
           ENDCASES;


decl_type: function
theory: list_adt
library: prelude
signature: [[nat, [[T, nat] -> nat]] -> [list -> nat]]
location: 97 2 105 21
body:
    reduce_nat(null?_fun: nat, cons?_fun: [[T, nat] -> nat]):
          [list -> nat] =
        LAMBDA (list_adtvar: list):
          LET red: [list -> nat] = reduce_nat(null?_fun, cons?_fun) IN
            CASES list_adtvar
              OF null: null?_fun,
                 cons(cons1_var, cons2_var):
                   cons?_fun(cons1_var, red(cons2_var))
              ENDCASES;


decl_type: function
theory: list_adt
library: prelude
signature: [[[list -> nat], [[T, nat, list] -> nat]] -> [list -> nat]]
location: 107 2 116 21
body:
    REDUCE_nat(null?_fun: [list -> nat],
               cons?_fun: [[T, nat, list] -> nat]):
          [list -> nat] =
        LAMBDA (list_adtvar: list):
          LET red: [list -> nat] = REDUCE_nat(null?_fun, cons?_fun) IN
            CASES list_adtvar
              OF null: null?_fun(list_adtvar),
                 cons(cons1_var, cons2_var):
                   cons?_fun(cons1_var, red(cons2_var), list_adtvar)
              ENDCASES;


decl_type: function
theory: list_adt
library: prelude
signature: [[ordinal, [[T, ordinal] -> ordinal]] -> [list -> ordinal]]
location: 118 2 128 21
body:
    reduce_ordinal(null?_fun: ordinal,
                   cons?_fun: [[T, ordinal] -> ordinal]):
          [list -> ordinal] =
        LAMBDA (list_adtvar: list):
          LET red: [list -> ordinal] = reduce_ordinal(null?_fun, cons?_fun)
            IN
            CASES list_adtvar
              OF null: null?_fun,
                 cons(cons1_var, cons2_var):
                   cons?_fun(cons1_var, red(cons2_var))
              ENDCASES;


decl_type: function
theory: list_adt
library: prelude
signature:
  [[[list -> ordinal], [[T, ordinal, list] -> ordinal]] ->
  [list -> ordinal]]

location: 130 2 140 21
body:
    REDUCE_ordinal(null?_fun: [list -> ordinal],
                   cons?_fun: [[T, ordinal, list] -> ordinal]):
          [list -> ordinal] =
        LAMBDA (list_adtvar: list):
          LET red: [list -> ordinal] = REDUCE_ordinal(null?_fun, cons?_fun)
            IN
            CASES list_adtvar
              OF null: null?_fun(list_adtvar),
                 cons(cons1_var, cons2_var):
                   cons?_fun(cons1_var, red(cons2_var), list_adtvar)
              ENDCASES;


decl_type: constant
theory: list_adt
library: prelude
signature: (strict_well_founded?[list])
location: 88 2 93 19
body:
    <<:  (strict_well_founded?[list]) =
        LAMBDA (x, y: list):
          CASES y
            OF null: FALSE,
               cons(cons1_var, cons2_var): x = cons2_var OR x << cons2_var
            ENDCASES;


decl_type: function
theory: list_adt_map
library: prelude
signature: [[T -> T1] -> [list[T] -> list[T1]]]
location: 6 2 11 17
body:
    map(f: [T -> T1])(a: list[T]):  list[T1] =
        CASES a
          OF null: null,
             cons(cons1_var, cons2_var):
               cons(f(cons1_var), map(f)(cons2_var))
          ENDCASES;


decl_type: function
theory: list_adt_map
library: prelude
signature: [[[T -> T1], list[T]] -> list[T1]]
location: 13 2 18 17
body:
    map(f: [T -> T1], a: list[T]):  list[T1] =
        CASES a
          OF null: null,
             cons(cons1_var, cons2_var):
               cons(f(cons1_var), map(f, cons2_var))
          ENDCASES;


decl_type: function
theory: list_adt_map
library: prelude
signature: [[[T, T1] -> boolean] -> [[list[T], list[T1]] -> boolean]]
location: 20 2 23 68
body:
    every(R: [[T, T1] -> boolean])(x: list[T], y: list[T1]):  boolean =
        null?(x) AND null?(y) OR
         cons?(x) AND
          cons?(y) AND R(car(x), car(y)) AND every(R)(cdr(x), cdr(y));


decl_type: function
theory: list_adt_reduce
library: prelude
signature: [[range, [[T, range] -> range]] -> [list[T] -> range]]
location: 6 2 14 21
body:
    reduce(null?_fun: range, cons?_fun: [[T, range] -> range]):
          [list[T] -> range] =
        LAMBDA (list_adtvar: list[T]):
          LET red: [list[T] -> range] = reduce(null?_fun, cons?_fun) IN
            CASES list_adtvar
              OF null: null?_fun,
                 cons(cons1_var, cons2_var):
                   cons?_fun(cons1_var, red(cons2_var))
              ENDCASES;


decl_type: function
theory: list_adt_reduce
library: prelude
signature:
  [[[list[T] -> range], [[T, range, list[T]] -> range]] ->
  [list[T] -> range]]

location: 16 2 25 21
body:
    REDUCE(null?_fun: [list[T] -> range],
           cons?_fun: [[T, range, list[T]] -> range]):
          [list[T] -> range] =
        LAMBDA (list_adtvar: list[T]):
          LET red: [list[T] -> range] = REDUCE(null?_fun, cons?_fun) IN
            CASES list_adtvar
              OF null: null?_fun(list_adtvar),
                 cons(cons1_var, cons2_var):
                   cons?_fun(cons1_var, red(cons2_var), list_adtvar)
              ENDCASES;


decl_type: formula
theory: character_adt
library: prelude
signature: nil
location: 22 2 24 72
body:
    character_char_extensionality: AXIOM
      FORALL (char?_var: (char?), char?_var2: (char?)):
        code(char?_var) = code(char?_var2) IMPLIES char?_var = char?_var2;


decl_type: formula
theory: character_adt
library: prelude
signature: nil
location: 35 2 38 61
body:
    character_induction: AXIOM
      FORALL (p: [character -> boolean]):
        (FORALL (char1_var: below[256]): p(char(char1_var))) IMPLIES
         (FORALL (character_var: character): p(character_var));


decl_type: function
theory: character_adt
library: prelude
signature: [[below[256] -> nat] -> [character -> nat]]
location: 46 2 50 21
body:
    reduce_nat(char?_fun: [below[256] -> nat]):  [character -> nat] =
        LAMBDA (character_adtvar: character):
          LET red: [character -> nat] = reduce_nat(char?_fun) IN
            CASES character_adtvar OF char(char1_var): char?_fun(char1_var)
              ENDCASES;


decl_type: function
theory: character_adt
library: prelude
signature: [[[below[256], character] -> nat] -> [character -> nat]]
location: 52 2 58 21
body:
    REDUCE_nat(char?_fun: [[below[256], character] -> nat]):
          [character -> nat] =
        LAMBDA (character_adtvar: character):
          LET red: [character -> nat] = REDUCE_nat(char?_fun) IN
            CASES character_adtvar
              OF char(char1_var): char?_fun(char1_var, character_adtvar)
              ENDCASES;


decl_type: function
theory: character_adt
library: prelude
signature: [[below[256] -> ordinal] -> [character -> ordinal]]
location: 60 2 65 21
body:
    reduce_ordinal(char?_fun: [below[256] -> ordinal]):
          [character -> ordinal] =
        LAMBDA (character_adtvar: character):
          LET red: [character -> ordinal] = reduce_ordinal(char?_fun) IN
            CASES character_adtvar OF char(char1_var): char?_fun(char1_var)
              ENDCASES;


decl_type: function
theory: character_adt
library: prelude
signature:
  [[[below[256], character] -> ordinal] ->
  [character -> ordinal]]

location: 67 2 73 21
body:
    REDUCE_ordinal(char?_fun: [[below[256], character] -> ordinal]):
          [character -> ordinal] =
        LAMBDA (character_adtvar: character):
          LET red: [character -> ordinal] = REDUCE_ordinal(char?_fun) IN
            CASES character_adtvar
              OF char(char1_var): char?_fun(char1_var, character_adtvar)
              ENDCASES;


decl_type: function
theory: character_adt_reduce
library: prelude
signature: [[below[256] -> range] -> [character -> range]]
location: 6 2 10 21
body:
    reduce(char?_fun: [below[256] -> range]):  [character -> range] =
        LAMBDA (character_adtvar: character):
          LET red: [character -> range] = reduce(char?_fun) IN
            CASES character_adtvar OF char(char1_var): char?_fun(char1_var)
              ENDCASES;


decl_type: function
theory: character_adt_reduce
library: prelude
signature: [[[below[256], character] -> range] -> [character -> range]]
location: 12 2 18 21
body:
    REDUCE(char?_fun: [[below[256], character] -> range]):
          [character -> range] =
        LAMBDA (character_adtvar: character):
          LET red: [character -> range] = REDUCE(char?_fun) IN
            CASES character_adtvar
              OF char(char1_var): char?_fun(char1_var, character_adtvar)
              ENDCASES;


decl_type: formula
theory: ordstruct_adt
library: prelude
signature: nil
location: 22 2 25 49
body:
    ordstruct_ord_defaxiom: AXIOM
      ordstruct_ord(zero) = 0 AND
       (FORALL (coef: posnat, exp: ordstruct, rest: ordstruct):
          ordstruct_ord(add(coef, exp, rest)) = 1);


decl_type: formula
theory: ordstruct_adt
library: prelude
signature: nil
location: 30 2 32 29
body:
    ordstruct_zero_extensionality: AXIOM
      FORALL (zero?_var: (zero?), zero?_var2: (zero?)):
        zero?_var = zero?_var2;


decl_type: formula
theory: ordstruct_adt
library: prelude
signature: nil
location: 34 2 39 44
body:
    ordstruct_add_extensionality: AXIOM
      FORALL (nonzero?_var: (nonzero?), nonzero?_var2: (nonzero?)):
        coef(nonzero?_var) = coef(nonzero?_var2) AND
         exp(nonzero?_var) = exp(nonzero?_var2) AND
          rest(nonzero?_var) = rest(nonzero?_var2)
         IMPLIES nonzero?_var = nonzero?_var2;


decl_type: formula
theory: ordstruct_adt
library: prelude
signature: nil
location: 41 2 44 20
body:
    ordstruct_add_eta: AXIOM
      FORALL (nonzero?_var: (nonzero?)):
        add(coef(nonzero?_var), exp(nonzero?_var), rest(nonzero?_var)) =
         nonzero?_var;


decl_type: formula
theory: ordstruct_adt
library: prelude
signature: nil
location: 46 2 48 57
body:
    ordstruct_coef_add: AXIOM
      FORALL (add1_var: posnat, add2_var: ordstruct, add3_var: ordstruct):
        coef(add(add1_var, add2_var, add3_var)) = add1_var;


decl_type: formula
theory: ordstruct_adt
library: prelude
signature: nil
location: 50 2 52 56
body:
    ordstruct_exp_add: AXIOM
      FORALL (add1_var: posnat, add2_var: ordstruct, add3_var: ordstruct):
        exp(add(add1_var, add2_var, add3_var)) = add2_var;


decl_type: formula
theory: ordstruct_adt
library: prelude
signature: nil
location: 54 2 56 57
body:
    ordstruct_rest_add: AXIOM
      FORALL (add1_var: posnat, add2_var: ordstruct, add3_var: ordstruct):
        rest(add(add1_var, add2_var, add3_var)) = add3_var;


decl_type: formula
theory: ordstruct_adt
library: prelude
signature: nil
location: 58 2 60 54
body:
    ordstruct_inclusive: AXIOM
      FORALL (ordstruct_var: ordstruct):
        zero?(ordstruct_var) OR nonzero?(ordstruct_var);


decl_type: formula
theory: ordstruct_adt
library: prelude
signature: nil
location: 62 2 69 69
body:
    ordstruct_induction: AXIOM
      FORALL (p: [ordstruct -> boolean]):
        (p(zero) AND
          (FORALL (add1_var: posnat, add2_var: ordstruct,
                   add3_var: ordstruct):
             p(add2_var) AND p(add3_var) IMPLIES
              p(add(add1_var, add2_var, add3_var))))
         IMPLIES (FORALL (ordstruct_var: ordstruct): p(ordstruct_var));


decl_type: function
theory: ordstruct_adt
library: prelude
signature: [ordstruct -> upto(1)]
location: 27 2 28 71
body:
    ord(x: ordstruct): [ordstruct -> upto(1)] =
        CASES x OF zero: 0, add(add1_var, add2_var, add3_var): 1 ENDCASES


decl_type: function
theory: ordstruct_adt
library: prelude
signature: [[ordstruct, ordstruct] -> boolean]
location: 71 2 77 18
body:
    subterm(x: ordstruct, y: ordstruct):  boolean =
        x = y OR
         CASES y
           OF zero: FALSE,
              add(add1_var, add2_var, add3_var):
                subterm(x, add2_var) OR subterm(x, add3_var)
           ENDCASES;


decl_type: function
theory: ordstruct_adt
library: prelude
signature: [[nat, [[posnat, nat, nat] -> nat]] -> [ordstruct -> nat]]
location: 90 2 99 21
body:
    reduce_nat(zero?_fun: nat, nonzero?_fun: [[posnat, nat, nat] -> nat]):
          [ordstruct -> nat] =
        LAMBDA (ordstruct_adtvar: ordstruct):
          LET red: [ordstruct -> nat] = reduce_nat(zero?_fun, nonzero?_fun)
            IN
            CASES ordstruct_adtvar
              OF zero: zero?_fun,
                 add(add1_var, add2_var, add3_var):
                   nonzero?_fun(add1_var, red(add2_var), red(add3_var))
              ENDCASES;


decl_type: function
theory: ordstruct_adt
library: prelude
signature:
  [[[ordstruct -> nat], [[posnat, nat, nat, ordstruct] -> nat]] ->
  [ordstruct -> nat]]

location: 101 2 112 21
body:
    REDUCE_nat(zero?_fun: [ordstruct -> nat],
               nonzero?_fun: [[posnat, nat, nat, ordstruct] -> nat]):
          [ordstruct -> nat] =
        LAMBDA (ordstruct_adtvar: ordstruct):
          LET red: [ordstruct -> nat] = REDUCE_nat(zero?_fun, nonzero?_fun)
            IN
            CASES ordstruct_adtvar
              OF zero: zero?_fun(ordstruct_adtvar),
                 add(add1_var, add2_var, add3_var):
                   nonzero?_fun(add1_var, red(add2_var), red(add3_var),
                                ordstruct_adtvar)
              ENDCASES;


decl_type: constant
theory: ordstruct_adt
library: prelude
signature: (strict_well_founded?[ordstruct])
location: 79 2 86 19
body:
    <<:  (strict_well_founded?[ordstruct]) =
        LAMBDA (x, y: ordstruct):
          CASES y
            OF zero: FALSE,
               add(add1_var, add2_var, add3_var):
                 (x = add2_var OR x << add2_var) OR
                  x = add3_var OR x << add3_var
            ENDCASES;


decl_type: function
theory: ordstruct_adt_reduce
library: prelude
signature:
  [[range, [[posnat, range, range] -> range]] ->
  [ordstruct -> range]]

location: 6 2 15 21
body:
    reduce(zero?_fun: range,
           nonzero?_fun: [[posnat, range, range] -> range]):
          [ordstruct -> range] =
        LAMBDA (ordstruct_adtvar: ordstruct):
          LET red: [ordstruct -> range] = reduce(zero?_fun, nonzero?_fun) IN
            CASES ordstruct_adtvar
              OF zero: zero?_fun,
                 add(add1_var, add2_var, add3_var):
                   nonzero?_fun(add1_var, red(add2_var), red(add3_var))
              ENDCASES;


decl_type: function
theory: ordstruct_adt_reduce
library: prelude
location: 17 2 27 21
signature:
  [[[ordstruct -> range],
         [[posnat, range, range, ordstruct] -> range]] ->
          [ordstruct -> range]]

body:
    REDUCE(zero?_fun: [ordstruct -> range],
           nonzero?_fun: [[posnat, range, range, ordstruct] -> range]):
          [ordstruct -> range] =
        LAMBDA (ordstruct_adtvar: ordstruct):
          LET red: [ordstruct -> range] = REDUCE(zero?_fun, nonzero?_fun) IN
            CASES ordstruct_adtvar
              OF zero: zero?_fun(ordstruct_adtvar),
                 add(add1_var, add2_var, add3_var):
                   nonzero?_fun(add1_var, red(add2_var), red(add3_var),
                                ordstruct_adtvar)
              ENDCASES;


decl_type: formula
theory: lift_adt
library: prelude
signature: nil
location: 24 2 26 33
body:
    lift_bottom_extensionality: AXIOM
      FORALL (bottom?_var: (bottom?), bottom?_var2: (bottom?)):
        bottom?_var = bottom?_var2;


decl_type: formula
theory: lift_adt
library: prelude
signature: nil
location: 28 2 30 64
body:
    lift_up_extensionality: AXIOM
      FORALL (up?_var: (up?), up?_var2: (up?)):
        down(up?_var) = down(up?_var2) IMPLIES up?_var = up?_var2;


decl_type: formula
theory: lift_adt
library: prelude
signature: nil
location: 39 2 42 46
body:
    lift_induction: AXIOM
      FORALL (p: [lift -> boolean]):
        (p(bottom) AND (FORALL (up1_var: T): p(up(up1_var)))) IMPLIES
         (FORALL (lift_var: lift): p(lift_var));


decl_type: function
theory: lift_adt
library: prelude
signature: [PRED[T] -> [lift -> boolean]]
location: 44 2 45 64
body:
    every(p: PRED[T])(a: lift):  boolean =
        CASES a OF bottom: TRUE, up(up1_var): p(up1_var) ENDCASES;


decl_type: function
theory: lift_adt
library: prelude
signature: [[PRED[T], lift] -> boolean]
location: 47 2 48 64
body:
    every(p: PRED[T], a: lift):  boolean =
        CASES a OF bottom: TRUE, up(up1_var): p(up1_var) ENDCASES;


decl_type: function
theory: lift_adt
library: prelude
signature: [PRED[T] -> [lift -> boolean]]
location: 50 2 51 65
body:
    some(p: PRED[T])(a: lift):  boolean =
        CASES a OF bottom: FALSE, up(up1_var): p(up1_var) ENDCASES;


decl_type: function
theory: lift_adt
library: prelude
signature: [[PRED[T], lift] -> boolean]
location: 53 2 54 65
body:
    some(p: PRED[T], a: lift):  boolean =
        CASES a OF bottom: FALSE, up(up1_var): p(up1_var) ENDCASES;


decl_type: function
theory: lift_adt
library: prelude
signature: [[nat, [T -> nat]] -> [lift -> nat]]
location: 62 2 67 21
body:
    reduce_nat(bottom?_fun: nat, up?_fun: [T -> nat]):  [lift -> nat] =
        LAMBDA (lift_adtvar: lift):
          LET red: [lift -> nat] = reduce_nat(bottom?_fun, up?_fun) IN
            CASES lift_adtvar
              OF bottom: bottom?_fun, up(up1_var): up?_fun(up1_var)
              ENDCASES;


decl_type: function
theory: lift_adt
library: prelude
signature: [[[lift -> nat], [[T, lift] -> nat]] -> [lift -> nat]]
location: 69 2 76 21
body:
    REDUCE_nat(bottom?_fun: [lift -> nat], up?_fun: [[T, lift] -> nat]):
          [lift -> nat] =
        LAMBDA (lift_adtvar: lift):
          LET red: [lift -> nat] = REDUCE_nat(bottom?_fun, up?_fun) IN
            CASES lift_adtvar
              OF bottom: bottom?_fun(lift_adtvar),
                 up(up1_var): up?_fun(up1_var, lift_adtvar)
              ENDCASES;


decl_type: function
theory: lift_adt
library: prelude
signature: [[ordinal, [T -> ordinal]] -> [lift -> ordinal]]
location: 78 2 85 21
body:
    reduce_ordinal(bottom?_fun: ordinal, up?_fun: [T -> ordinal]):
          [lift -> ordinal] =
        LAMBDA (lift_adtvar: lift):
          LET red: [lift -> ordinal] = reduce_ordinal(bottom?_fun, up?_fun)
            IN
            CASES lift_adtvar
              OF bottom: bottom?_fun, up(up1_var): up?_fun(up1_var)
              ENDCASES;


decl_type: function
theory: lift_adt
library: prelude
signature:
  [[[lift -> ordinal], [[T, lift] -> ordinal]] ->
  [lift -> ordinal]]

location: 87 2 96 21
body:
    REDUCE_ordinal(bottom?_fun: [lift -> ordinal],
                   up?_fun: [[T, lift] -> ordinal]):
          [lift -> ordinal] =
        LAMBDA (lift_adtvar: lift):
          LET red: [lift -> ordinal] = REDUCE_ordinal(bottom?_fun, up?_fun)
            IN
            CASES lift_adtvar
              OF bottom: bottom?_fun(lift_adtvar),
                 up(up1_var): up?_fun(up1_var, lift_adtvar)
              ENDCASES;


decl_type: function
theory: lift_adt_map
library: prelude
signature: [[T -> T1] -> [lift[T] -> lift[T1]]]
location: 6 2 7 70
body:
    map(f: [T -> T1])(a: lift[T]):  lift[T1] =
        CASES a OF bottom: bottom, up(up1_var): up(f(up1_var)) ENDCASES;


decl_type: function
theory: lift_adt_map
library: prelude
signature: [[[T -> T1], lift[T]] -> lift[T1]]
location: 9 2 10 70
body:
    map(f: [T -> T1], a: lift[T]):  lift[T1] =
        CASES a OF bottom: bottom, up(up1_var): up(f(up1_var)) ENDCASES;


decl_type: function
theory: lift_adt_map
library: prelude
signature: [[[T, T1] -> boolean] -> [[lift[T], lift[T1]] -> boolean]]
location: 12 2 14 49
body:
    every(R: [[T, T1] -> boolean])(x: lift[T], y: lift[T1]):  boolean =
        bottom?(x) AND bottom?(y) OR
         up?(x) AND up?(y) AND R(down(x), down(y));


decl_type: function
theory: lift_adt_reduce
library: prelude
signature: [[range, [T -> range]] -> [lift[T] -> range]]
location: 6 2 11 21
body:
    reduce(bottom?_fun: range, up?_fun: [T -> range]):  [lift[T] -> range] =
        LAMBDA (lift_adtvar: lift[T]):
          LET red: [lift[T] -> range] = reduce(bottom?_fun, up?_fun) IN
            CASES lift_adtvar
              OF bottom: bottom?_fun, up(up1_var): up?_fun(up1_var)
              ENDCASES;


decl_type: function
theory: lift_adt_reduce
library: prelude
signature:
  [[[lift[T] -> range], [[T, lift[T]] -> range]] ->
  [lift[T] -> range]]

location: 13 2 21 21
body:
    REDUCE(bottom?_fun: [lift[T] -> range],
           up?_fun: [[T, lift[T]] -> range]):
          [lift[T] -> range] =
        LAMBDA (lift_adtvar: lift[T]):
          LET red: [lift[T] -> range] = REDUCE(bottom?_fun, up?_fun) IN
            CASES lift_adtvar
              OF bottom: bottom?_fun(lift_adtvar),
                 up(up1_var): up?_fun(up1_var, lift_adtvar)
              ENDCASES;


decl_type: formula
theory: union_adt
library: prelude
signature: nil
location: 20 2 22 53
body:
    union_ord_defaxiom: AXIOM
      (FORALL (left: T1): union_ord(inl(left)) = 0) AND
       (FORALL (right: T2): union_ord(inr(right)) = 1);


decl_type: formula
theory: union_adt
library: prelude
signature: nil
location: 27 2 29 68
body:
    union_inl_extensionality: AXIOM
      FORALL (inl?_var: (inl?), inl?_var2: (inl?)):
        left(inl?_var) = left(inl?_var2) IMPLIES inl?_var = inl?_var2;


decl_type: formula
theory: union_adt
library: prelude
signature: nil
location: 34 2 36 70
body:
    union_inr_extensionality: AXIOM
      FORALL (inr?_var: (inr?), inr?_var2: (inr?)):
        right(inr?_var) = right(inr?_var2) IMPLIES inr?_var = inr?_var2;


decl_type: formula
theory: union_adt
library: prelude
signature: nil
location: 50 2 54 57
body:
    union_induction: AXIOM
      FORALL (p: [union -> boolean]):
        ((FORALL (inl1_var: T1): p(inl(inl1_var))) AND
          (FORALL (inr1_var: T2): p(inr(inr1_var))))
         IMPLIES (FORALL (union_var: union): p(union_var));


decl_type: function
theory: union_adt
library: prelude
signature: [[PRED[T1], PRED[T2]] -> [union -> boolean]]
location: 56 2 58 17
body:
    every(p1: PRED[T1], p2: PRED[T2])(a: union):  boolean =
        CASES a OF inl(inl1_var): p1(inl1_var), inr(inr1_var): p2(inr1_var)
          ENDCASES;


decl_type: function
theory: union_adt
library: prelude
signature: [[PRED[T1], PRED[T2], union] -> boolean]
location: 60 2 62 17
body:
    every(p1: PRED[T1], p2: PRED[T2], a: union):  boolean =
        CASES a OF inl(inl1_var): p1(inl1_var), inr(inr1_var): p2(inr1_var)
          ENDCASES;


decl_type: function
theory: union_adt
library: prelude
signature: [[PRED[T1], PRED[T2]] -> [union -> boolean]]
location: 64 2 66 17
body:
    some(p1: PRED[T1], p2: PRED[T2])(a: union):  boolean =
        CASES a OF inl(inl1_var): p1(inl1_var), inr(inr1_var): p2(inr1_var)
          ENDCASES;


decl_type: function
theory: union_adt
library: prelude
signature: [[PRED[T1], PRED[T2], union] -> boolean]
location: 68 2 70 17
body:
    some(p1: PRED[T1], p2: PRED[T2], a: union):  boolean =
        CASES a OF inl(inl1_var): p1(inl1_var), inr(inr1_var): p2(inr1_var)
          ENDCASES;


decl_type: function
theory: union_adt
library: prelude
signature: [[[T1 -> nat], [T2 -> nat]] -> [union -> nat]]
location: 78 2 85 21
body:
    reduce_nat(inl?_fun: [T1 -> nat], inr?_fun: [T2 -> nat]):
          [union -> nat] =
        LAMBDA (union_adtvar: union):
          LET red: [union -> nat] = reduce_nat(inl?_fun, inr?_fun) IN
            CASES union_adtvar
              OF inl(inl1_var): inl?_fun(inl1_var),
                 inr(inr1_var): inr?_fun(inr1_var)
              ENDCASES;


decl_type: function
theory: union_adt
library: prelude
signature:
  [[[[T1, union] -> nat], [[T2, union] -> nat]] ->
  [union -> nat]]

location: 87 2 95 21
body:
    REDUCE_nat(inl?_fun: [[T1, union] -> nat],
               inr?_fun: [[T2, union] -> nat]):
          [union -> nat] =
        LAMBDA (union_adtvar: union):
          LET red: [union -> nat] = REDUCE_nat(inl?_fun, inr?_fun) IN
            CASES union_adtvar
              OF inl(inl1_var): inl?_fun(inl1_var, union_adtvar),
                 inr(inr1_var): inr?_fun(inr1_var, union_adtvar)
              ENDCASES;


decl_type: function
theory: union_adt
library: prelude
signature: [[[T1 -> ordinal], [T2 -> ordinal]] -> [union -> ordinal]]
location: 97 2 104 21
body:
    reduce_ordinal(inl?_fun: [T1 -> ordinal], inr?_fun: [T2 -> ordinal]):
          [union -> ordinal] =
        LAMBDA (union_adtvar: union):
          LET red: [union -> ordinal] = reduce_ordinal(inl?_fun, inr?_fun) IN
            CASES union_adtvar
              OF inl(inl1_var): inl?_fun(inl1_var),
                 inr(inr1_var): inr?_fun(inr1_var)
              ENDCASES;


decl_type: function
theory: union_adt
library: prelude
signature:
  [[[[T1, union] -> ordinal], [[T2, union] -> ordinal]] ->
  [union -> ordinal]]

location: 106 2 114 21
body:
    REDUCE_ordinal(inl?_fun: [[T1, union] -> ordinal],
                   inr?_fun: [[T2, union] -> ordinal]):
          [union -> ordinal] =
        LAMBDA (union_adtvar: union):
          LET red: [union -> ordinal] = REDUCE_ordinal(inl?_fun, inr?_fun) IN
            CASES union_adtvar
              OF inl(inl1_var): inl?_fun(inl1_var, union_adtvar),
                 inr(inr1_var): inr?_fun(inr1_var, union_adtvar)
              ENDCASES;


decl_type: function
theory: union_adt_map
library: prelude
signature:
  [[[T1 -> T11], [T2 -> T21]] ->
  [union[T1, T2] -> union[T11, T21]]]

location: 6 2 11 17
body:
    map(f1: [T1 -> T11], f2: [T2 -> T21])(a: union[T1, T2]):
          union[T11, T21] =
        CASES a
          OF inl(inl1_var): inl(f1(inl1_var)),
             inr(inr1_var): inr(f2(inr1_var))
          ENDCASES;


decl_type: function
theory: union_adt_map
library: prelude
signature: [[[T1 -> T11], [T2 -> T21], union[T1, T2]] -> union[T11, T21]]
location: 13 2 18 17
body:
    map(f1: [T1 -> T11], f2: [T2 -> T21], a: union[T1, T2]):
          union[T11, T21] =
        CASES a
          OF inl(inl1_var): inl(f1(inl1_var)),
             inr(inr1_var): inr(f2(inr1_var))
          ENDCASES;


decl_type: function
theory: union_adt_map
library: prelude
location: 20 2 24 54
signature:
  [[[[T1, T11] -> boolean], [[T2, T21] -> boolean]] ->
          [[union[T1, T2], union[T11, T21]] -> boolean]]

body:
    every(R1: [[T1, T11] -> boolean], R2: [[T2, T21] -> boolean])
         (x: union[T1, T2], y: union[T11, T21]):
          boolean =
        inl?(x) AND inl?(y) AND R1(left(x), left(y)) OR
         inr?(x) AND inr?(y) AND R2(right(x), right(y));


decl_type: function
theory: union_adt_reduce
library: prelude
signature: [[[T1 -> range], [T2 -> range]] -> [union[T1, T2] -> range]]
location: 6 2 13 21
body:
    reduce(inl?_fun: [T1 -> range], inr?_fun: [T2 -> range]):
          [union[T1, T2] -> range] =
        LAMBDA (union_adtvar: union[T1, T2]):
          LET red: [union[T1, T2] -> range] = reduce(inl?_fun, inr?_fun) IN
            CASES union_adtvar
              OF inl(inl1_var): inl?_fun(inl1_var),
                 inr(inr1_var): inr?_fun(inr1_var)
              ENDCASES;


decl_type: function
theory: union_adt_reduce
library: prelude
location: 15 2 23 21
signature:
  [[[[T1, union[T1, T2]] -> range],
         [[T2, union[T1, T2]] -> range]] ->
          [union[T1, T2] -> range]]

body:
    REDUCE(inl?_fun: [[T1, union[T1, T2]] -> range],
           inr?_fun: [[T2, union[T1, T2]] -> range]):
          [union[T1, T2] -> range] =
        LAMBDA (union_adtvar: union[T1, T2]):
          LET red: [union[T1, T2] -> range] = REDUCE(inl?_fun, inr?_fun) IN
            CASES union_adtvar
              OF inl(inl1_var): inl?_fun(inl1_var, union_adtvar),
                 inr(inr1_var): inr?_fun(inr1_var, union_adtvar)
              ENDCASES;


decl_type: formula
theory: sums
library: bitvectors
signature: nil
location: 40 2 41 50
body:
    sigma_mult:  THEOREM sigma(low, high, (LAMBDA n: x * F(n)))
                           = x * sigma(low, high, F)


decl_type: formula
theory: sums
library: bitvectors
signature: nil
location: 43 2 44 78
body:
    sigma_split: THEOREM m >= low AND high > m 
            IMPLIES sigma(low, high, F) = sigma(low, m, F) + sigma(m+1, high, F)


decl_type: formula
theory: sums
library: bitvectors
signature: nil
location: 51 2 52 69
body:
    sigma_restrict_eq: THEOREM restrict(F,low,high) = restrict(G,low,high) 
                          IMPLIES sigma(low,high,F) = sigma(low,high,G) 


decl_type: function
theory: sums
library: bitvectors
signature: [[nat, nat, [nat -> nat]] -> nat]
location: 22 2 27 15
body:
    sigma(low, high, F): RECURSIVE nat
        = IF low > high THEN 0
          ELSIF high = low THEN F(low) 
          ELSE  F(high) + sigma(low, high-1, F)
          ENDIF
     MEASURE high


decl_type: function
theory: sums
library: bitvectors
signature: [[[nat -> nat], nat, nat] -> [nat -> nat]]
location: 48 2 49 63
body:
    restrict(F, low, high): function[nat -> nat] = 
       (LAMBDA n: IF n < low OR n > high THEN 0 ELSE F(n) ENDIF )


decl_type: tcc
theory: sums
library: bitvectors
signature: nil
location: 59 0 63 999
body:
  % Subtype TCC generated (at line 25, column 35) for  high - 1
      % expected type  nat
  sigma_TCC1: OBLIGATION
    FORALL (low: nat, high: nat):
      NOT high = low AND NOT low > high IMPLIES high - 1 >= 0;


decl_type: tcc
theory: sums
library: bitvectors
signature: nil
location: 65 0 69 999
body:
  % Termination TCC generated (at line 25, column 24) for
      % sigma(low, high - 1, F)
  sigma_TCC2: OBLIGATION
    FORALL (low: nat, high: nat):
      NOT high = low AND NOT low > high IMPLIES high - 1 < high;


decl_type: formula
theory: bv_sum
library: bitvectors
signature: nil
location: 26 2 27 55
body:
    bv2nat_rec_as_sum: LEMMA bv2nat_rec(n+1,bv) = 
       sigma(0,n, extend((LAMBDA ii: exp2(ii) * bv(ii))))


decl_type: formula
theory: bv_sum
library: bitvectors
signature: nil
location: 29 2 30 72
body:
    bv2nat_as_sum: THEOREM bv2nat(bv) = IF N = 0 THEN 0
           ELSE sigma(0,N-1, extend((LAMBDA ii: exp2(ii) * bv(ii)))) ENDIF


decl_type: tcc
theory: bv_sum
library: bitvectors
signature: nil
location: 37 0 39 999
body:
  % Subtype TCC generated (at line 26, column 38) for  n + 1
      % expected type  upto(N)
  bv2nat_rec_as_sum_TCC1: OBLIGATION FORALL (n: below(N)): n + 1 <= N;


decl_type: tcc
theory: bv_sum
library: bitvectors
signature: nil
location: 41 0 43 999
body:
  % Subtype TCC generated (at line 30, column 22) for  N - 1
      % expected type  nat
  bv2nat_as_sum_TCC1: OBLIGATION NOT N = 0 IMPLIES N - 1 >= 0;


decl_type: formula
theory: bv_concat
library: bitvectors
signature: nil
location: 21 2 22 60
body:
    bvconcat_bot0: THEOREM FORALL (bvm:bvec[m], bvn:bvec[n]):
                                 m = 0 IMPLIES bvn o bvm = bvn 


decl_type: formula
theory: bv_concat
library: bitvectors
signature: nil
location: 24 2 25 60
body:
    bvconcat_top0: THEOREM FORALL (bvm:bvec[m], bvn:bvec[n]):
                                 n = 0 IMPLIES bvn o bvm = bvm


decl_type: formula
theory: bv_concat
library: bitvectors
signature: nil
location: 27 2 28 49
body:
    bv_concat_bot: THEOREM FORALL (bvm:bvec[m], bvn:bvec[n], i: below(m)): 
                              (bvn o bvm)^i = bvm^i


decl_type: formula
theory: bv_concat
library: bitvectors
signature: nil
location: 30 2 31 80
body:
    bv_concat_top: THEOREM FORALL (bvm:bvec[m], bvn:bvec[n]): 
                             j >= m AND j < n+m IMPLIES  (bvn o bvm)^j = bvn^(j-m)


decl_type: formula
theory: bv_concat
library: bitvectors
signature: nil
location: 34 2 35 66
body:
    bv_concat_assoc   : LEMMA FORALL (bvm:bvec[m], bvn:bvec[n], bvp:bvec[p]):
                               (bvm o bvn) o bvp = bvm o (bvn o bvp)


decl_type: formula
theory: bv_concat
library: bitvectors
signature: nil
location: 37 2 38 68
body:
    bv_concat_top_bit : LEMMA FORALL (N: posnat, bvn: bvec[N], bvm: bvec[m]):
                                       (bvn o bvm)^(N+m-1) = bvn^(N-1)


decl_type: tcc
theory: bv_concat
library: bitvectors
signature: nil
location: 48 0 52 999
body:
  % Subtype TCC generated (at line 22, column 57) for  bvn
      % expected type  bvec[m + n]
  bvconcat_bot0_TCC1: OBLIGATION
    FORALL (m, n: nat, bvn: bvec[n]):
      m = 0 IMPLIES (FORALL (x: nat): bvn(x) IMPLIES (x < n IFF x < m + n));


decl_type: tcc
theory: bv_concat
library: bitvectors
signature: nil
location: 54 0 58 999
body:
  % Subtype TCC generated (at line 25, column 57) for  bvm
      % expected type  bvec[m + n]
  bvconcat_top0_TCC1: OBLIGATION
    FORALL (m, n: nat, bvm: bvec[m]):
      n = 0 IMPLIES (FORALL (x: nat): bvm(x) IMPLIES (x < m IFF x < m + n));


decl_type: tcc
theory: bv_concat
library: bitvectors
signature: nil
location: 60 0 62 999
body:
  % Subtype TCC generated (at line 28, column 40) for  i
      % expected type  below[m + n]
  bv_concat_bot_TCC1: OBLIGATION FORALL (m, n: nat, i: below(m)): i < m + n;


decl_type: tcc
theory: bv_concat
library: bitvectors
signature: nil
location: 64 0 67 999
body:
  % Subtype TCC generated (at line 31, column 67) for  j
      % expected type  below[m + n]
  bv_concat_top_TCC1: OBLIGATION
    FORALL (j, m, n: nat): j >= m AND j < n + m IMPLIES j < m + n;


decl_type: tcc
theory: bv_concat
library: bitvectors
signature: nil
location: 69 0 73 999
body:
  % Subtype TCC generated (at line 31, column 76) for  (j - m)
      % expected type  below[n]
  bv_concat_top_TCC2: OBLIGATION
    FORALL (j, m, n: nat):
      j >= m AND j < n + m IMPLIES (j - m) >= 0 AND (j - m) < n;


decl_type: tcc
theory: bv_concat
library: bitvectors
signature: nil
location: 75 0 78 999
body:
  % Subtype TCC generated (at line 38, column 50) for  (N + m - 1)
      % expected type  below[N + m]
  bv_concat_top_bit_TCC1: OBLIGATION
    FORALL (m: nat, N: posnat): (N + m - 1) >= 0 AND (N + m - 1) < N + m;


decl_type: tcc
theory: bv_concat
library: bitvectors
signature: nil
location: 80 0 83 999
body:
  % Subtype TCC generated (at line 38, column 64) for  (N - 1)
      % expected type  below[N]
  bv_concat_top_bit_TCC2: OBLIGATION
    FORALL (N: posnat): (N - 1) >= 0 AND (N - 1) < N;


decl_type: formula
theory: bv_arith_concat
library: bitvectors
signature: nil
location: 14 2 15 66
body:
    not_over_concat    : LEMMA FORALL (a: bvec[m], b: bvec[n]):
                                   (NOT (a o b)) = (NOT a) o (NOT b)


decl_type: formula
theory: bv_arith_concat
library: bitvectors
signature: nil
location: 20 2 22 74
body:
    bv2nat_concat: THEOREM FORALL (bvn: bvec[n], bvm: bvec[m]):
                      bv2nat[n+m](bvn o bvm) 
                                 = bv2nat[n](bvn) * exp2(m) + bv2nat[m](bvm)


decl_type: tcc
theory: div
library: bitvectors
signature: nil
location: 36 0 38 999
body:
  % Judgement subtype TCC generated (at line 15, column 12) for  div(n, m)
      % expected type  nat
  div_TCC1: OBLIGATION FORALL (m, n): div(n, m) >= 0;


decl_type: formula
theory: bv_arith_nat
library: bitvectors
signature: nil
location: 75 2 79 74
body:
    bv_add     : LEMMA (FORALL (bv1,bv2: bvec[N]):
                          bv2nat(bv1 + bv2) =
                             IF bv2nat(bv1) + bv2nat(bv2) < exp2(N)
                             THEN bv2nat(bv1) + bv2nat(bv2)
                             ELSE bv2nat(bv1) + bv2nat(bv2) - exp2(N) ENDIF)


decl_type: formula
theory: bv_arith_nat
library: bitvectors
signature: nil
location: 96 2 97 64
body:
    bv_minus_mod : LEMMA (FORALL (bv: bvec[N], i: int):
                                     bv - i = bv - mod(i,exp2(N)))


decl_type: formula
theory: bv_arith_nat
library: bitvectors
signature: nil
location: 99 2 100 76
body:
    bv_minus_plus : LEMMA (FORALL (bv: bvec[N], i: int):
                                    bv - i = bv + mod(exp2(N) - i, exp2(N))) ;


decl_type: formula
theory: bv_arith_nat
library: bitvectors
signature: nil
location: 107 2 108 65
body:
    bv_plus1     : LEMMA bv2nat(bv + 1) = IF bv2nat(bv) = (exp2(N)-1) THEN 0
                                          ELSE bv2nat(bv) + 1 ENDIF 


decl_type: formula
theory: bv_arith_nat
library: bitvectors
signature: nil
location: 110 2 111 65
body:
    bv_minus1    : LEMMA bv2nat(bv - 1) = IF bv2nat(bv) = 0 THEN exp2(N)-1
                                          ELSE bv2nat(bv) - 1 ENDIF


decl_type: formula
theory: bv_arith_caret
library: bitvectors
signature: nil
location: 13 2 14 71
body:
    bv_shift    : THEOREM (FORALL (bv:bvec[N], ss: below(N)):
                         bv2nat(bv^(N-1,ss)) = div(bv2nat(bv), exp2(ss)))


decl_type: formula
theory: bv_arith_caret
library: bitvectors
signature: nil
location: 16 2 17 74
body:
    bv_bottom   : THEOREM (FORALL (bv:bvec[N], ss: below(N)):
                            bv2nat(bv^(ss,0)) = mod(bv2nat(bv),exp2(ss+1)) )


decl_type: formula
theory: bv_arith_caret
library: bitvectors
signature: nil
location: 19 2 20 79
body:
    bv_top      : THEOREM (FORALL (bv:bvec[N], ss: below(N)):
                           bv^(N-1,ss) = nat2bv[N-ss](div(bv2nat(bv), exp2(ss))))


decl_type: formula
theory: bv_arith_caret
library: bitvectors
signature: nil
location: 22 2 23 79
body:
    bv_bot      : THEOREM (FORALL (bv:bvec[N], nn: below(N)):
                            bv^(nn,0) = nat2bv[nn+1](mod(bv2nat(bv),exp2(nn+1))))


decl_type: formula
theory: bv_arith_caret
library: bitvectors
signature: nil
location: 25 2 26 76
body:
    bv_add_subrange : THEOREM (FORALL (bv1,bv2:bvec[N], nn: below(N)):
                                 (bv1 + bv2)^(nn,0) = bv1^(nn,0) + bv2^(nn,0))


decl_type: formula
theory: bv_arith_caret
library: bitvectors
signature: nil
location: 28 2 29 65
body:
    bv_plus_caret: LEMMA (FORALL (bv1: bvec[N], nn: below(N)):
                                 (bv1 + i)^(nn,0) = bv1^(nn,0) + i)


decl_type: formula
theory: bv_arith_caret
library: bitvectors
signature: nil
location: 31 2 33 81
body:
    bv_middle      : THEOREM (FORALL (n: posnat, i,j: below(n), bv: bvec[n]): 
                        i >= j IMPLIES
                      bv2nat(bv^(i,j)) = mod(div(bv2nat(bv), exp2(j)),exp2(i-j+1)))


decl_type: formula
theory: bv_arith_caret
library: bitvectors
signature: nil
location: 36 2 37 58
body:
    bv2nat_caret_00: THEOREM FORALL (n: posnat, bv: bvec[n]):
                                bv2nat(bv^(0,0)) = b2n(bv^0)


decl_type: formula
theory: bv_arith_caret
library: bitvectors
signature: nil
location: 39 2 40 80
body:
    bv2nat_lem     : THEOREM FORALL (n: above(1), bv: bvec[n]):
                                bv2nat(bv)  = 2 * bv2nat(bv ^ (n - 1, 1)) + bv ^ 0


decl_type: tcc
theory: bv_arith_caret
library: bitvectors
signature: nil
location: 47 0 50 999
body:
  % Subtype TCC generated (at line 14, column 34) for  N - 1
      % expected type  below(N)
  bv_shift_TCC1: OBLIGATION
    FORALL (N: posnat, ss: below(N)): N - 1 >= 0 AND N - 1 < N;


decl_type: tcc
theory: bv_arith_caret
library: bitvectors
signature: nil
location: 52 0 54 999
body:
  % Subtype TCC generated (at line 14, column 38) for  ss
      % expected type  upto(N - 1)
  bv_shift_TCC2: OBLIGATION FORALL (N: posnat, ss: below(N)): ss <= N - 1;


decl_type: tcc
theory: bv_arith_caret
library: bitvectors
signature: nil
location: 56 0 58 999
body:
  % Subtype TCC generated (at line 14, column 34) for  N - ss
      % expected type  nat
  bv_shift_TCC3: OBLIGATION FORALL (N: posnat, ss: below(N)): N - ss >= 0;


decl_type: tcc
theory: bv_arith_caret
library: bitvectors
signature: nil
location: 60 0 62 999
body:
  % Subtype TCC generated (at line 17, column 40) for  0
      % expected type  upto(ss)
  bv_bottom_TCC1: OBLIGATION FORALL (N: posnat, ss: below(N)): 0 <= ss;


decl_type: tcc
theory: bv_arith_caret
library: bitvectors
signature: nil
location: 64 0 69 999
body:
  % Subtype TCC generated (at line 20, column 52) for
      % div(bv2nat(bv), exp2(ss))
      % expected type  val: below(exp2(N - ss))
  bv_top_TCC1: OBLIGATION
    FORALL (N: posnat, bv: bvec[N], ss: below(N)):
      div(bv2nat[N](bv), exp2(ss)) < exp2(N - ss);


decl_type: tcc
theory: bv_arith_caret
library: bitvectors
signature: nil
location: 71 0 74 999
body:
  % Subtype TCC generated (at line 33, column 33) for  j
      % expected type  upto(i)
  bv_middle_TCC1: OBLIGATION
    FORALL (n: posnat, i, j: below(n)): i >= j IMPLIES j <= i;


decl_type: tcc
theory: bv_arith_caret
library: bitvectors
signature: nil
location: 76 0 79 999
body:
  % Subtype TCC generated (at line 89, column 18) for  1 + i - j
      % expected type  nat
  bv_middle_TCC2: OBLIGATION
    FORALL (n: posnat, i, j: below(n)): i >= j IMPLIES 1 + i - j >= 0;


decl_type: tcc
theory: bv_arith_caret
library: bitvectors
signature: nil
location: 81 0 84 999
body:
  % Subtype TCC generated (at line 33, column 73) for  i - j + 1
      % expected type  nat
  bv_middle_TCC3: OBLIGATION
    FORALL (n: posnat, i, j: below(n)): i >= j IMPLIES i - j + 1 >= 0;


decl_type: tcc
theory: bv_arith_caret
library: bitvectors
signature: nil
location: 86 0 88 999
body:
  % Subtype TCC generated (at line 37, column 41) for  0
      % expected type  below(n)
  bv2nat_caret_00_TCC1: OBLIGATION FORALL (n: posnat): 0 < n;


decl_type: tcc
theory: bv_arith_caret
library: bitvectors
signature: nil
location: 90 0 92 999
body:
  % Subtype TCC generated (at line 40, column 61) for  n - 1
      % expected type  below(n)
  bv2nat_lem_TCC1: OBLIGATION FORALL (n: above(1)): n - 1 >= 0 AND n - 1 < n;


decl_type: tcc
theory: bv_arith_caret
library: bitvectors
signature: nil
location: 94 0 96 999
body:
  % Subtype TCC generated (at line 40, column 68) for  1
      % expected type  upto(n - 1)
  bv2nat_lem_TCC2: OBLIGATION FORALL (n: above(1)): 1 <= n - 1;


decl_type: tcc
theory: bv_arith_caret
library: bitvectors
signature: nil
location: 98 0 100 999
body:
  % Subtype TCC generated (at line 40, column 61) for  n - 1
      % expected type  nat
  bv2nat_lem_TCC3: OBLIGATION FORALL (n: above(1)): n - 1 >= 0;


decl_type: tcc
theory: bv_arith_caret
library: bitvectors
signature: nil
location: 102 0 104 999
body:
  % Subtype TCC generated (at line 40, column 79) for  0
      % expected type  below[n]
  bv2nat_lem_TCC4: OBLIGATION FORALL (n: above(1)): 0 < n;


decl_type: formula
theory: bv_arith_nat_caret_rules
library: bitvectors
signature: nil
location: 8 2 9 70
body:
    bv_shift_rule  : THEOREM FORALL (bv:bvec[N], ss: below(N)):
                         bv2nat(bv^(N-1,ss)) = div(bv2nat(bv), exp2(ss))


decl_type: formula
theory: bv_arith_nat_caret_rules
library: bitvectors
signature: nil
location: 11 2 12 69
body:
    bv_bottom_rule : THEOREM FORALL (bv:bvec[N], ss: below(N)):
                         bv2nat(bv^(ss,0)) = mod(bv2nat(bv),exp2(ss+1))


decl_type: formula
theory: bv_arith_nat_caret_rules
library: bitvectors
signature: nil
location: 15 2 17 69
body:
    bv_middle_rule : THEOREM (FORALL (i,j: below(N), bv: bvec[N]): i >= j IMPLIES
                         bv2nat(bv^(i,j)) = 
                             mod(div(bv2nat(bv), exp2(j)),exp2(i-j+1)))


decl_type: formula
theory: bv_arith_nat_caret_rules
library: bitvectors
signature: nil
location: 20 2 21 58
body:
    bv_caret_00_rule : THEOREM FORALL (n: posnat, bv: bvec[n]):
                                bv2nat(bv^(0,0)) = b2n(bv^0)


decl_type: formula
theory: bv_arith_nat_caret_rules
library: bitvectors
signature: nil
location: 23 2 25 45
body:
    bv2nat_lem_rule  : THEOREM FORALL (n: above(1), bv: bvec[n]):
                                2 * bv2nat(bv ^ (n - 1, 1)) + b2n(bv ^ 0) 
                                   = bv2nat(bv)


decl_type: tcc
theory: bv_arith_nat_caret_rules
library: bitvectors
signature: nil
location: 32 0 35 999
body:
  % Subtype TCC generated (at line 9, column 34) for  N - 1
      % expected type  below(N)
  bv_shift_rule_TCC1: OBLIGATION
    FORALL (N: posnat, ss: below(N)): N - 1 >= 0 AND N - 1 < N;


decl_type: tcc
theory: bv_arith_nat_caret_rules
library: bitvectors
signature: nil
location: 37 0 40 999
body:
  % Subtype TCC generated (at line 9, column 38) for  ss
      % expected type  upto(N - 1)
  bv_shift_rule_TCC2: OBLIGATION
    FORALL (N: posnat, ss: below(N)): ss <= N - 1;


decl_type: tcc
theory: bv_arith_nat_caret_rules
library: bitvectors
signature: nil
location: 42 0 45 999
body:
  % Subtype TCC generated (at line 9, column 34) for  N - ss
      % expected type  nat
  bv_shift_rule_TCC3: OBLIGATION
    FORALL (N: posnat, ss: below(N)): N - ss >= 0;


decl_type: tcc
theory: bv_arith_nat_caret_rules
library: bitvectors
signature: nil
location: 47 0 49 999
body:
  % Subtype TCC generated (at line 12, column 37) for  0
      % expected type  upto(ss)
  bv_bottom_rule_TCC1: OBLIGATION FORALL (N: posnat, ss: below(N)): 0 <= ss;


decl_type: tcc
theory: bv_arith_nat_caret_rules
library: bitvectors
signature: nil
location: 51 0 54 999
body:
  % Subtype TCC generated (at line 16, column 36) for  j
      % expected type  upto(i)
  bv_middle_rule_TCC1: OBLIGATION
    FORALL (N: posnat, i, j: below(N)): i >= j IMPLIES j <= i;


decl_type: tcc
theory: bv_arith_nat_caret_rules
library: bitvectors
signature: nil
location: 56 0 59 999
body:
  % Subtype TCC generated (at line 89, column 18) for  1 + i - j
      % expected type  nat
  bv_middle_rule_TCC2: OBLIGATION
    FORALL (N: posnat, i, j: below(N)): i >= j IMPLIES 1 + i - j >= 0;


decl_type: tcc
theory: bv_arith_nat_caret_rules
library: bitvectors
signature: nil
location: 61 0 64 999
body:
  % Subtype TCC generated (at line 17, column 61) for  i - j + 1
      % expected type  nat
  bv_middle_rule_TCC3: OBLIGATION
    FORALL (N: posnat, i, j: below(N)): i >= j IMPLIES i - j + 1 >= 0;


decl_type: tcc
theory: bv_arith_nat_caret_rules
library: bitvectors
signature: nil
location: 66 0 68 999
body:
  % Subtype TCC generated (at line 21, column 41) for  0
      % expected type  below(n)
  bv_caret_00_rule_TCC1: OBLIGATION FORALL (n: posnat): 0 < n;


decl_type: tcc
theory: bv_arith_nat_caret_rules
library: bitvectors
signature: nil
location: 70 0 73 999
body:
  % Subtype TCC generated (at line 24, column 47) for  n - 1
      % expected type  below(n)
  bv2nat_lem_rule_TCC1: OBLIGATION
    FORALL (n: above(1)): n - 1 >= 0 AND n - 1 < n;


decl_type: tcc
theory: bv_arith_nat_caret_rules
library: bitvectors
signature: nil
location: 75 0 77 999
body:
  % Subtype TCC generated (at line 24, column 54) for  1
      % expected type  upto(n - 1)
  bv2nat_lem_rule_TCC2: OBLIGATION FORALL (n: above(1)): 1 <= n - 1;


decl_type: tcc
theory: bv_arith_nat_caret_rules
library: bitvectors
signature: nil
location: 79 0 81 999
body:
  % Subtype TCC generated (at line 24, column 47) for  n - 1
      % expected type  nat
  bv2nat_lem_rule_TCC3: OBLIGATION FORALL (n: above(1)): n - 1 >= 0;


decl_type: tcc
theory: bv_arith_nat_caret_rules
library: bitvectors
signature: nil
location: 83 0 85 999
body:
  % Subtype TCC generated (at line 24, column 69) for  0
      % expected type  below[n]
  bv2nat_lem_rule_TCC4: OBLIGATION FORALL (n: above(1)): 0 < n;


decl_type: formula
theory: bv_arith_caret_rules
library: bitvectors
signature: nil
location: 10 2 11 80
body:
    bv_add_caret       : THEOREM FORALL (bv1, bv2:bvec[N]): nn < N => 
                                      (bv1 + bv2)^(nn,0) = bv1^(nn,0) + bv2^(nn,0)


decl_type: formula
theory: bv_arith_caret_rules
library: bitvectors
signature: nil
location: 14 2 15 69
body:
    bv_caret_over_plus : THEOREM FORALL (bvn:bvec[N]): nn < N => 
                                      (bvn + i)^(nn,0) = bvn^(nn,0) + i


decl_type: formula
theory: bv_arith_caret_rules
library: bitvectors
signature: nil
location: 17 2 18 69
body:
    bv_odd_even_pc     : THEOREM FORALL (bv: bvec[N]):
                                      (bv + nn)^0 = NOT (bv + (nn-1))^0


decl_type: formula
theory: bv_arith_caret_rules
library: bitvectors
signature: nil
location: 20 2 21 73
body:
    bv_even_odd_pc     : THEOREM FORALL (bv: bvec[N]):
                                      (bv + (-n))^0 = NOT ((bv + (-n+1))^0)


decl_type: formula
theory: bv_arith_caret_rules
library: bitvectors
signature: nil
location: 28 2 30 81
body:
    bv_plus_caret_rule : LEMMA FORALL (bv1, bv2 : bvec[N]):
                               m <= nn AND nn + 1 < N => 
                           (bv1 + bv2) ^ (nn, m) = (bv1^(nn,0) + bv2^(nn,0))^(nn,m)


decl_type: tcc
theory: bv_arith_caret_rules
library: bitvectors
signature: nil
location: 38 0 41 999
body:
  % Subtype TCC generated (at line 11, column 52) for  0
      % expected type  upto(nn)
  bv_add_caret_TCC1: OBLIGATION
    FORALL (N: posnat, nn: nat): nn < N IMPLIES 0 <= nn;


decl_type: tcc
theory: bv_arith_caret_rules
library: bitvectors
signature: nil
location: 43 0 45 999
body:
  % Subtype TCC generated (at line 18, column 46) for  0
      % expected type  below[N]
  bv_odd_even_pc_TCC1: OBLIGATION FORALL (N: posnat): 0 < N;


decl_type: tcc
theory: bv_arith_caret_rules
library: bitvectors
signature: nil
location: 47 0 50 999
body:
  % Subtype TCC generated (at line 30, column 40) for  nn
      % expected type  below(N)
  bv_plus_caret_rule_TCC1: OBLIGATION
    FORALL (N: posnat, m, nn: nat): m <= nn AND nn + 1 < N IMPLIES nn < N;


decl_type: tcc
theory: bv_arith_caret_rules
library: bitvectors
signature: nil
location: 52 0 55 999
body:
  % Subtype TCC generated (at line 30, column 58) for  0
      % expected type  upto(nn)
  bv_plus_caret_rule_TCC2: OBLIGATION
    FORALL (N: posnat, m, nn: nat): m <= nn AND nn + 1 < N IMPLIES 0 <= nn;


decl_type: tcc
theory: bv_arith_caret_rules
library: bitvectors
signature: nil
location: 57 0 61 999
body:
  % Subtype TCC generated (at line 30, column 76) for  nn
      % expected type  below(1 + nn)
  bv_plus_caret_rule_TCC3: OBLIGATION
    FORALL (N: posnat, m, nn: nat):
      m <= nn AND nn + 1 < N IMPLIES nn < 1 + nn;


decl_type: formula
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 10 2 11 44
body:
    caret_fill       : THEOREM FORALL (i: below(n), j: upto(i)): 
                                  fill[n](b)^(i,j) = fill[i-j+1](b)


decl_type: formula
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 13 2 15 55
body:
    caret_concat_bot : THEOREM FORALL (i: below(n+m), j: upto(i),
                                       bvn: bvec[n], bvm: bvec[m]):
                                   i < m IMPLIES (bvn o bvm)^(i,j) = bvm^(i,j)


decl_type: formula
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 17 2 20 48
body:
    caret_concat_top : THEOREM FORALL (i: below(n+m), j: upto(i),
                                       bvn: bvec[n], bvm: bvec[m]):
                                  j >= m 
                                    IMPLIES (bvn o bvm)^(i,j) = bvn^(i-m, j-m)


decl_type: formula
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 22 2 26 63
body:
    caret_concat_all : THEOREM FORALL (i: below(n+m), j: upto(i), 
                                       bvn: bvec[n], bvm: bvec[m]):
                                  i >= m AND j < m 
                                     IMPLIES (bvn o bvm)^(i,j) = 
                                        bvn^(i-m,0) o bvm^(m-1,j) 


decl_type: formula
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 28 2 29 63
body:
    bv_decomposition : THEOREM FORALL (N: above(1), k: below(N-1), bvn: bvec[N]):
                                  bvn^(N-1,k+1) o bvn^(k,0) = bvn


decl_type: formula
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 31 2 34 78
body:
    caret_concat_join: THEOREM FORALL (bvn: bvec[n], i1,i2: below[n],
                                           j1: upto[i1], j2: upto[i2]):
                                 (j1=i2+1) =>
                                     (bvn^(i1,j1) o bvn^(i2,j2) =  bvn^(i1,j2));


decl_type: formula
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 36 2 37 57
body:
    concat_bottom    : THEOREM FORALL (bvn: bvec[n], bvm: bvec[m]):
                                  (bvn o bvm)^(m-1,0) = bvm


decl_type: formula
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 39 2 40 62
body:
    concat_top       : THEOREM FORALL (bvn: bvec[n], bvm: bvec[m]):
                                   (bvn o bvm)^((n+m-1),m) = bvn


decl_type: tcc
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 47 0 50 999
body:
  % Subtype TCC generated (at line 11, column 39) for  1 + i - j
      % expected type  nat
  caret_fill_TCC1: OBLIGATION
    FORALL (n: posnat, i: below(n), j: upto(i)): 1 + i - j >= 0;


decl_type: tcc
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 52 0 56 999
body:
  % Subtype TCC generated (at line 20, column 39) for  i - m
      % expected type  below(n)
  caret_concat_top_TCC1: OBLIGATION
    FORALL (m, n: posnat, i: below(m + n), j: upto(i)):
      j >= m IMPLIES i - m >= 0 AND i - m < n;


decl_type: tcc
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 58 0 62 999
body:
  % Subtype TCC generated (at line 20, column 44) for  j - m
      % expected type  upto(i - m)
  caret_concat_top_TCC2: OBLIGATION
    FORALL (m, n: posnat, i: below(m + n), j: upto(i)):
      j >= m IMPLIES j - m >= 0 AND j - m <= i - m;


decl_type: tcc
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 64 0 68 999
body:
  % Subtype TCC generated (at line 26, column 43) for  i - m
      % expected type  below(n)
  caret_concat_all_TCC1: OBLIGATION
    FORALL (m, n: posnat, i: below(m + n), j: upto(i)):
      i >= m AND j < m IMPLIES i - m >= 0 AND i - m < n;


decl_type: tcc
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 70 0 74 999
body:
  % Subtype TCC generated (at line 26, column 47) for  0
      % expected type  upto(i - m)
  caret_concat_all_TCC2: OBLIGATION
    FORALL (m, n: posnat, i: below(m + n), j: upto(i)):
      i >= m AND j < m IMPLIES 0 <= i - m;


decl_type: tcc
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 76 0 80 999
body:
  % Subtype TCC generated (at line 26, column 57) for  m - 1
      % expected type  below(m)
  caret_concat_all_TCC3: OBLIGATION
    FORALL (m, n: posnat, i: below(m + n), j: upto(i)):
      i >= m AND j < m IMPLIES m - 1 >= 0 AND m - 1 < m;


decl_type: tcc
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 82 0 86 999
body:
  % Subtype TCC generated (at line 26, column 61) for  j
      % expected type  upto(m - 1)
  caret_concat_all_TCC4: OBLIGATION
    FORALL (m, n: posnat, i: below(m + n), j: upto(i)):
      i >= m AND j < m IMPLIES j <= m - 1;


decl_type: tcc
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 88 0 92 999
body:
  % Subtype TCC generated (at line 89, column 18) for  1 + i - m
      % expected type  nat
  caret_concat_all_TCC5: OBLIGATION
    FORALL (m, n: posnat, i: below(m + n), j: upto(i)):
      i >= m AND j < m IMPLIES 1 + i - m >= 0;


decl_type: tcc
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 94 0 98 999
body:
  % Subtype TCC generated (at line 26, column 57) for  m - j
      % expected type  nat
  caret_concat_all_TCC6: OBLIGATION
    FORALL (m, n: posnat, i: below(m + n), j: upto(i)):
      i >= m AND j < m IMPLIES m - j >= 0;


decl_type: tcc
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 100 0 103 999
body:
  % Subtype TCC generated (at line 29, column 37) for  N - 1
      % expected type  below(N)
  bv_decomposition_TCC1: OBLIGATION
    FORALL (N: above(1), k: below(N - 1)): N - 1 >= 0 AND N - 1 < N;


decl_type: tcc
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 105 0 108 999
body:
  % Subtype TCC generated (at line 29, column 41) for  k + 1
      % expected type  upto(N - 1)
  bv_decomposition_TCC2: OBLIGATION
    FORALL (N: above(1), k: below(N - 1)): k + 1 <= N - 1;


decl_type: tcc
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 110 0 113 999
body:
  % Subtype TCC generated (at line 29, column 53) for  k
      % expected type  below(N)
  bv_decomposition_TCC3: OBLIGATION
    FORALL (N: above(1), k: below(N - 1)): k < N;


decl_type: tcc
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 115 0 118 999
body:
  % Subtype TCC generated (at line 29, column 55) for  0
      % expected type  upto(k)
  bv_decomposition_TCC4: OBLIGATION
    FORALL (N: above(1), k: below(N - 1)): 0 <= k;


decl_type: tcc
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 120 0 123 999
body:
  % Subtype TCC generated (at line 29, column 37) for  N - 1 - k
      % expected type  nat
  bv_decomposition_TCC5: OBLIGATION
    FORALL (N: above(1), k: below(N - 1)): N - 1 - k >= 0;


decl_type: tcc
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 125 0 129 999
body:
  % Subtype TCC generated (at line 89, column 18) for  1 + i2 - j2
      % expected type  nat
  caret_concat_join_TCC1: OBLIGATION
    FORALL (n: posnat, i1, i2: below[n], j1: upto[i1], j2: upto[i2]):
      (j1 = i2 + 1) IMPLIES 1 + i2 - j2 >= 0;


decl_type: tcc
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 131 0 135 999
body:
  % Subtype TCC generated (at line 34, column 73) for  j2
      % expected type  upto(i1)
  caret_concat_join_TCC2: OBLIGATION
    FORALL (n: posnat, i1, i2: below[n], j1: upto[i1], j2: upto[i2]):
      (j1 = i2 + 1) IMPLIES j2 <= i1;


decl_type: tcc
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 137 0 145 999
body:
  % Subtype TCC generated (at line 34, column 65) for  bvn ^ (i1, j2)
      % expected type  bvec[2 + i1 + i2 - j1 - j2]
  caret_concat_join_TCC3: OBLIGATION
    FORALL (n: posnat, bvn: bvec[n], i1, i2: below[n], j1: upto[i1],
            j2: upto[i2]):
      (j1 = i2 + 1) IMPLIES
       (FORALL (x: nat):
          (^[n](bvn, (i1, j2)))(x) IMPLIES
           (x < 1 + i1 - j2 IFF x < 2 + i1 + i2 - j1 - j2));


decl_type: tcc
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 147 0 150 999
body:
  % Subtype TCC generated (at line 37, column 45) for  m - 1
      % expected type  below(m + n)
  concat_bottom_TCC1: OBLIGATION
    FORALL (m, n: posnat): m - 1 >= 0 AND m - 1 < m + n;


decl_type: tcc
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 152 0 154 999
body:
  % Subtype TCC generated (at line 37, column 49) for  0
      % expected type  upto(m - 1)
  concat_bottom_TCC2: OBLIGATION FORALL (m: posnat): 0 <= m - 1;


decl_type: tcc
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 156 0 159 999
body:
  % Subtype TCC generated (at line 40, column 47) for  (n + m - 1)
      % expected type  below(m + n)
  concat_top_TCC1: OBLIGATION
    FORALL (m, n: posnat): (n + m - 1) >= 0 AND (n + m - 1) < m + n;


decl_type: tcc
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 161 0 163 999
body:
  % Subtype TCC generated (at line 40, column 54) for  m
      % expected type  upto((m + n - 1))
  concat_top_TCC2: OBLIGATION FORALL (m, n: posnat): m <= (m + n - 1);


decl_type: formula
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 10 2 11 60
body:
    bv_concat_bottom     : LEMMA FORALL (bvn: bvec[n], bvm: bvec[m]):
                                  (bvn o bvm)^((m-1), 0) = bvm


decl_type: formula
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 13 2 14 63
body:
    bv_concat_top        : LEMMA FORALL (bvn: bvec[n], bvm: bvec[m]):
                                   (bvn o bvm)^((n+m-1), m) = bvn


decl_type: formula
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 16 2 18 66
body:
    bv_caret_concat_low  : LEMMA FORALL (bvn: bvec[n], bvm: bvec[m]):
                                   (i < m) AND (j <= i) =>  
                                     (bvn o bvm)^(i, j) = bvm^(i, j) 


decl_type: formula
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 20 2 22 50
body:
    bv_caret_concat_high : LEMMA FORALL (bvn: bvec[n], bvm: bvec[m]):
                                    i < n+m AND m <= j AND j <= i 
                                      IMPLIES (bvn o bvm)^(i,j) = bvn^(i-m, j-m)


decl_type: formula
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 25 2 28 75
body:
    bv_caret_concat_split: LEMMA FORALL (bvn: bvec[n], bvm: bvec[m]):
                                   (i < n+m) AND (i >= m) AND
                                    (j < m) AND (j <= i) =>
                               (bvn o bvm)^(i,j) = bvn^(i-m, 0) o bvm^(m-1,j)


decl_type: formula
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 31 2 34 75
body:
    bv_caret_recomp      : LEMMA FORALL (n: posnat, bvn: bvec[n], 
                                        i1,j1,i2,j2: below[n]):
                               (i1 >= j1) AND (i2 >= j2) AND (j1=i2+1) =>
                                  (bvn^(i1,j1) o bvn^(i2,j2) =  bvn^(i1,j2));


decl_type: formula
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 36 2 37 64
body:
    bv_ucaret_concat_1   : LEMMA FORALL (bvn: bvec[n], bvm: bvec[m]):
                                    i < m => (bvn o bvm)^i = bvm^i


decl_type: formula
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 39 2 41 61
body:
    bv_ucaret_concat_2   : LEMMA FORALL (bvn: bvec[n], bvm: bvec[m]): 
                                   (i < n+m) AND (i >= m) => 
                                      (bvn o bvm)^i = bvn^(i-m)  


decl_type: formula
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 43 2 44 42
body:
    bv_caret_fill        : LEMMA FORALL (i: below(n), j: upto(i)): 
                                fill[n](b)^(i,j) = fill[i-j+1](b)


decl_type: tcc
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 52 0 55 999
body:
  % Subtype TCC generated (at line 11, column 46) for  (m - 1)
      % expected type  below(m + n)
  bv_concat_bottom_TCC1: OBLIGATION
    FORALL (m, n: posnat): (m - 1) >= 0 AND (m - 1) < m + n;


decl_type: tcc
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 57 0 59 999
body:
  % Subtype TCC generated (at line 11, column 52) for  0
      % expected type  upto((m - 1))
  bv_concat_bottom_TCC2: OBLIGATION FORALL (m: posnat): 0 <= (m - 1);


decl_type: tcc
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 61 0 64 999
body:
  % Subtype TCC generated (at line 14, column 47) for  (n + m - 1)
      % expected type  below(m + n)
  bv_concat_top_TCC1: OBLIGATION
    FORALL (m, n: posnat): (n + m - 1) >= 0 AND (n + m - 1) < m + n;


decl_type: tcc
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 66 0 68 999
body:
  % Subtype TCC generated (at line 14, column 55) for  m
      % expected type  upto((m + n - 1))
  bv_concat_top_TCC2: OBLIGATION FORALL (m, n: posnat): m <= (m + n - 1);


decl_type: tcc
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 70 0 73 999
body:
  % Subtype TCC generated (at line 18, column 48) for  i
      % expected type  below(m + n)
  bv_caret_concat_low_TCC1: OBLIGATION
    FORALL (i, j: nat, m, n: posnat): (i < m) AND (j <= i) IMPLIES i < m + n;


decl_type: tcc
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 75 0 79 999
body:
  % Subtype TCC generated (at line 22, column 29) for  i
      % expected type  below(m + n)
  bv_caret_concat_high_TCC1: OBLIGATION
    FORALL (i, j: nat, m, n: posnat):
      i < n + m AND m <= j AND j <= i IMPLIES i < m + n;


decl_type: tcc
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 81 0 85 999
body:
  % Subtype TCC generated (at line 22, column 41) for  i - m
      % expected type  below(n)
  bv_caret_concat_high_TCC2: OBLIGATION
    FORALL (i, j: nat, m, n: posnat):
      i < n + m AND m <= j AND j <= i IMPLIES i - m >= 0 AND i - m < n;


decl_type: tcc
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 87 0 91 999
body:
  % Subtype TCC generated (at line 22, column 46) for  j - m
      % expected type  upto(i - m)
  bv_caret_concat_high_TCC3: OBLIGATION
    FORALL (i, j: nat, m, n: posnat):
      i < n + m AND m <= j AND j <= i IMPLIES j - m >= 0 AND j - m <= i - m;


decl_type: tcc
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 93 0 97 999
body:
  % Subtype TCC generated (at line 28, column 42) for  i
      % expected type  below(m + n)
  bv_caret_concat_split_TCC1: OBLIGATION
    FORALL (i, j: nat, m, n: posnat):
      (i < n + m) AND (i >= m) AND (j < m) AND (j <= i) IMPLIES i < m + n;


decl_type: tcc
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 99 0 104 999
body:
  % Subtype TCC generated (at line 28, column 54) for  i - m
      % expected type  below(n)
  bv_caret_concat_split_TCC2: OBLIGATION
    FORALL (i, j: nat, m, n: posnat):
      (i < n + m) AND (i >= m) AND (j < m) AND (j <= i) IMPLIES
       i - m >= 0 AND i - m < n;


decl_type: tcc
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 106 0 110 999
body:
  % Subtype TCC generated (at line 28, column 59) for  0
      % expected type  upto(i - m)
  bv_caret_concat_split_TCC3: OBLIGATION
    FORALL (i, j: nat, m, n: posnat):
      (i < n + m) AND (i >= m) AND (j < m) AND (j <= i) IMPLIES 0 <= i - m;


decl_type: tcc
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 112 0 117 999
body:
  % Subtype TCC generated (at line 28, column 69) for  m - 1
      % expected type  below(m)
  bv_caret_concat_split_TCC4: OBLIGATION
    FORALL (i, j: nat, m, n: posnat):
      (i < n + m) AND (i >= m) AND (j < m) AND (j <= i) IMPLIES
       m - 1 >= 0 AND m - 1 < m;


decl_type: tcc
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 119 0 123 999
body:
  % Subtype TCC generated (at line 28, column 73) for  j
      % expected type  upto(m - 1)
  bv_caret_concat_split_TCC5: OBLIGATION
    FORALL (i, j: nat, m, n: posnat):
      (i < n + m) AND (i >= m) AND (j < m) AND (j <= i) IMPLIES j <= m - 1;


decl_type: tcc
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 125 0 130 999
body:
  % Subtype TCC generated (at line 89, column 18) for  1 + i - m
      % expected type  nat
  bv_caret_concat_split_TCC6: OBLIGATION
    FORALL (i, j: nat, m, n: posnat):
      (i < n + m) AND (i >= m) AND (j < m) AND (j <= i) IMPLIES
       1 + i - m >= 0;


decl_type: tcc
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 132 0 136 999
body:
  % Subtype TCC generated (at line 28, column 69) for  m - j
      % expected type  nat
  bv_caret_concat_split_TCC7: OBLIGATION
    FORALL (i, j: nat, m, n: posnat):
      (i < n + m) AND (i >= m) AND (j < m) AND (j <= i) IMPLIES m - j >= 0;


decl_type: tcc
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 138 0 142 999
body:
  % Subtype TCC generated (at line 34, column 41) for  j1
      % expected type  upto(i1)
  bv_caret_recomp_TCC1: OBLIGATION
    FORALL (n: posnat, i1, j1, i2, j2: below[n]):
      (i1 >= j1) AND (i2 >= j2) AND (j1 = i2 + 1) IMPLIES j1 <= i1;


decl_type: tcc
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 144 0 148 999
body:
  % Subtype TCC generated (at line 34, column 55) for  j2
      % expected type  upto(i2)
  bv_caret_recomp_TCC2: OBLIGATION
    FORALL (n: posnat, i1, j1, i2, j2: below[n]):
      (i1 >= j1) AND (i2 >= j2) AND (j1 = i2 + 1) IMPLIES j2 <= i2;


decl_type: tcc
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 150 0 154 999
body:
  % Subtype TCC generated (at line 89, column 18) for  1 + i1 - j1
      % expected type  nat
  bv_caret_recomp_TCC3: OBLIGATION
    FORALL (n: posnat, i1, j1, i2, j2: below[n]):
      (i1 >= j1) AND (i2 >= j2) AND (j1 = i2 + 1) IMPLIES 1 + i1 - j1 >= 0;


decl_type: tcc
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 156 0 160 999
body:
  % Subtype TCC generated (at line 89, column 18) for  1 + i2 - j2
      % expected type  nat
  bv_caret_recomp_TCC4: OBLIGATION
    FORALL (n: posnat, i1, j1, i2, j2: below[n]):
      (i1 >= j1) AND (i2 >= j2) AND (j1 = i2 + 1) IMPLIES 1 + i2 - j2 >= 0;


decl_type: tcc
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 162 0 166 999
body:
  % Subtype TCC generated (at line 34, column 70) for  j2
      % expected type  upto(i1)
  bv_caret_recomp_TCC5: OBLIGATION
    FORALL (n: posnat, i1, j1, i2, j2: below[n]):
      (i1 >= j1) AND (i2 >= j2) AND (j1 = i2 + 1) IMPLIES j2 <= i1;


decl_type: tcc
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 168 0 175 999
body:
  % Subtype TCC generated (at line 34, column 62) for  bvn ^ (i1, j2)
      % expected type  bvec[2 + i1 + i2 - j1 - j2]
  bv_caret_recomp_TCC6: OBLIGATION
    FORALL (n: posnat, bvn: bvec[n], i1, j1, i2, j2: below[n]):
      (i1 >= j1) AND (i2 >= j2) AND (j1 = i2 + 1) IMPLIES
       (FORALL (x: nat):
          (^[n](bvn, (i1, j2)))(x) IMPLIES
           (x < 1 + i1 - j2 IFF x < 2 + i1 + i2 - j1 - j2));


decl_type: tcc
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 177 0 180 999
body:
  % Subtype TCC generated (at line 37, column 55) for  i
      % expected type  below[m + n]
  bv_ucaret_concat_1_TCC1: OBLIGATION
    FORALL (i: nat, m, n: posnat): i < m IMPLIES i < m + n;


decl_type: tcc
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 182 0 185 999
body:
  % Subtype TCC generated (at line 41, column 48) for  i
      % expected type  below[m + n]
  bv_ucaret_concat_2_TCC1: OBLIGATION
    FORALL (i: nat, m, n: posnat): (i < n + m) AND (i >= m) IMPLIES i < m + n;


decl_type: tcc
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 187 0 191 999
body:
  % Subtype TCC generated (at line 41, column 57) for  (i - m)
      % expected type  below[n]
  bv_ucaret_concat_2_TCC2: OBLIGATION
    FORALL (i: nat, m, n: posnat):
      (i < n + m) AND (i >= m) IMPLIES (i - m) >= 0 AND (i - m) < n;


decl_type: tcc
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 193 0 196 999
body:
  % Subtype TCC generated (at line 44, column 37) for  1 + i - j
      % expected type  nat
  bv_caret_fill_TCC1: OBLIGATION
    FORALL (n: posnat, i: below(n), j: upto(i)): 1 + i - j >= 0;


decl_type: formula
theory: bv_int
library: bitvectors
signature: nil
location: 48 2 49 76
body:
    bv2int_inj    : THEOREM % injective?(bv2int)
                                 bv2int(bv1) = bv2int(bv2) IMPLIES (bv1 = bv2)


decl_type: formula
theory: bv_int
library: bitvectors
signature: nil
location: 51 2 52 69
body:
    bv2int_surj   : THEOREM % surjective?(bv2int)
                                (EXISTS (bv: bvec[N]): bv2int(bv) = iv)


decl_type: formula
theory: bv_int
library: bitvectors
signature: nil
location: 62 2 63 52
body:
    bv2int_top_bit: THEOREM IF bv2int(bv) >= 0 THEN bv^(N-1) = FALSE 
                            ELSE bv^(N-1) = TRUE ENDIF


decl_type: formula
theory: bv_int
library: bitvectors
signature: nil
location: 80 2 81 67
body:
    int2bv_2nat: THEOREM  int2bv(ii) = IF ii >= 0 THEN nat2bv[N](ii)
                                     ELSE nat2bv[N](ii+exp2(N)) ENDIF


decl_type: tcc
theory: bv_int
library: bitvectors
signature: nil
location: 96 0 98 999
body:
  % Subtype TCC generated (at line 56, column 66) for  (N - 1)
      % expected type  below[N]
  bv2int_lem_TCC1: OBLIGATION (N - 1) >= 0 AND (N - 1) < N;


decl_type: tcc
theory: bv_int
library: bitvectors
signature: nil
location: 100 0 103 999
body:
  % Subtype TCC generated (at line 80, column 63) for  ii
      % expected type  val: below(exp2(N))
  int2bv_2nat_TCC1: OBLIGATION
    FORALL (ii: rng_2s_comp[N]): ii >= 0 IMPLIES ii < exp2(N);


decl_type: tcc
theory: bv_int
library: bitvectors
signature: nil
location: 105 0 109 999
body:
  % Subtype TCC generated (at line 81, column 50) for  ii + exp2(N)
      % expected type  val: below(exp2(N))
  int2bv_2nat_TCC2: OBLIGATION
    FORALL (ii: rng_2s_comp[N]):
      NOT ii >= 0 IMPLIES ii + exp2(N) >= 0 AND ii + exp2(N) < exp2(N);


decl_type: formula
theory: bv_arith_int_concat
library: bitvectors
signature: nil
location: 10 2 13 78
body:
    bv2int_concat      : LEMMA FORALL (n, m: posnat, bvn: bvec[n], bvm: bvec[m]):
                                  bv2int(bvn o bvm) = bv2int(bvn) * exp2(m) 
                                                      + bv2int(bvm) 
                                                      + b2n(bvm^(m-1)) * exp2(m)


decl_type: tcc
theory: bv_arith_int_concat
library: bitvectors
signature: nil
location: 20 0 22 999
body:
  % Subtype TCC generated (at line 10, column 75) for  m + n
      % expected type  posnat
  bv2int_concat_TCC1: OBLIGATION FORALL (n, m: posnat): m + n > 0;


decl_type: tcc
theory: bv_arith_int_concat
library: bitvectors
signature: nil
location: 24 0 27 999
body:
  % Subtype TCC generated (at line 13, column 63) for  (m - 1)
      % expected type  below[m]
  bv2int_concat_TCC2: OBLIGATION
    FORALL (n, m: posnat): (m - 1) >= 0 AND (m - 1) < m;


decl_type: formula
theory: bv_arithmetic
library: bitvectors
signature: nil
location: 49 2 50 78
body:
    bv2int_add  : THEOREM in_rng_2s_comp(bv2int(bv1) + bv2int(bv2))
                           IMPLIES bv2int(bv1 + bv2) = bv2int(bv1) + bv2int(bv2)  


decl_type: formula
theory: bv_arithmetic
library: bitvectors
signature: nil
location: 52 2 53 59
body:
    bv2int_neg : LEMMA bv2int(-bv) = IF bv2int(bv) = minint THEN bv2int(bv)
                                     ELSE -(bv2int(bv)) ENDIF 


decl_type: formula
theory: bv_arithmetic
library: bitvectors
signature: nil
location: 55 2 56 65
body:
    bv2int_minus_1  : LEMMA bv2int(bv1) > minint AND bv2int(bv) = 1 
                         IMPLIES bv2int(bv1 - bv) = bv2int(bv1) - 1


decl_type: formula
theory: bv_arithmetic
library: bitvectors
signature: nil
location: 58 2 59 64
body:
    bv2int_plus_1: LEMMA bv2int(bv + 1) = IF bv2int(bv) = maxint[N] THEN minint[N]
                                         ELSE bv2int(bv) + 1 ENDIF 


decl_type: formula
theory: bv_arithmetic
library: bitvectors
signature: nil
location: 64 2 66 58
body:
    bv2int_plus_i: LEMMA bv2int(bv+i) =
                         mod(bv2int(bv) + exp2(N) * b2n(bv^(N - 1)) + i, exp2(N))
                           - exp2(N) * b2n((bv + i)^(N - 1))


decl_type: formula
theory: bv_arithmetic
library: bitvectors
signature: nil
location: 76 2 77 39
body:
    bv2nat_compl_max  : THEOREM bv2nat_rec(n, bv) + bv2nat_rec(n, NOT bv) 
                            = exp2(n) - 1


decl_type: formula
theory: bv_arithmetic
library: bitvectors
signature: nil
location: 92 2 93 74
body:
    bv2nat_minus_bv: COROLLARY bv2nat(-bv) = IF bv2nat(bv) = 0 THEN 0
                                             ELSE exp2(N) - bv2nat(bv) ENDIF


decl_type: formula
theory: bv_arithmetic
library: bitvectors
signature: nil
location: 95 2 96 76
body:
    bv_is_minint   : COROLLARY bv2int(-bv) = bv2int(bv) 
                                 IMPLIES bv2int(bv) = minint OR bv2int(bv) = 0


decl_type: tcc
theory: bv_arithmetic
library: bitvectors
signature: nil
location: 109 0 111 999
body:
  % Subtype TCC generated (at line 47, column 27) for  (N - 1)
      % expected type  below[N]
  bv_top_bit_0_TCC1: OBLIGATION (N - 1) >= 0 AND (N - 1) < N;


decl_type: tcc
theory: bv_arithmetic
library: bitvectors
signature: nil
location: 113 0 115 999
body:
  % Subtype TCC generated (at line 47, column 62) for  N - 1
      % expected type  nat
  bv_top_bit_0_TCC2: OBLIGATION N - 1 >= 0;


decl_type: tcc
theory: bv_extend
library: bitvectors
signature: nil
location: 68 0 70 999
body:
  % Subtype TCC generated (at line 55, column 59) for  k - N
      % expected type  nat
  zero_extend_def_TCC1: OBLIGATION FORALL (k: above(N)): k - N >= 0;


decl_type: tcc
theory: bv_extend
library: bitvectors
signature: nil
location: 72 0 74 999
body:
  % Subtype TCC generated (at line 57, column 68) for  (N - 1)
      % expected type  below[N]
  sign_extend_def_TCC1: OBLIGATION (N - 1) >= 0 AND (N - 1) < N;


decl_type: tcc
theory: bv_extend
library: bitvectors
signature: nil
location: 76 0 78 999
body:
  % Subtype TCC generated (at line 61, column 77) for  0
      % expected type  below[N]
  lsb_extend__def_TCC1: OBLIGATION 0 < N;


decl_type: formula
theory: bv_arith_extend
library: bitvectors
signature: nil
location: 9 2 10 70
body:
    zero_extend_lem  : THEOREM (FORALL (bv: bvec[n], k: above(n)):
                          bv2nat[k](zero_extend[n](k)(bv)) = bv2nat(bv))


decl_type: formula
theory: bv_arith_extend
library: bitvectors
signature: nil
location: 12 2 17 18
body:
    sign_to_zero     : THEOREM (FORALL (bv: bvec[n], k: above(n)):
                                sign_extend[n](k)(bv) =
                                   IF bv(n-1) THEN 
                                      NOT(zero_extend[n](k)(NOT(bv)))
                                   ELSE zero_extend[n](k)(bv)
                                   ENDIF)


decl_type: formula
theory: bv_arith_extend
library: bitvectors
signature: nil
location: 19 2 20 77
body:
    sign_extend_lem  : THEOREM (FORALL (bv: bvec[n], k: above(n)):
                                 bv2int[k](sign_extend[n](k)(bv)) = bv2int(bv))


decl_type: formula
theory: bv_arith_extend
library: bitvectors
signature: nil
location: 22 2 24 60
body:
    zero_extend_lsend: THEOREM (FORALL (bv: bvec[n], k: above(n)):
                                  bv2nat(zero_extend_lsend[n](k)(bv)) 
                                     = bv2nat(bv) * exp2(k-n))


decl_type: formula
theory: bv_arith_extend
library: bitvectors
signature: nil
location: 27 2 29 76
body:
    bv2int_elim_gen  : LEMMA (FORALL (m: pos_nat_below(n),
                                      bv1: bvec[n],bv2: bvec[m]):
                          bv1 + sign_extend[m](n)(bv2) = bv1 + bv2int[m](bv2))


decl_type: tcc
theory: bv_arith_extend
library: bitvectors
signature: nil
location: 38 0 40 999
body:
  % Subtype TCC generated (at line 14, column 18) for  n - 1
      % expected type  below(n)
  sign_to_zero_TCC1: OBLIGATION FORALL (n: posnat): n - 1 >= 0 AND n - 1 < n;


decl_type: tcc
theory: bv_arith_extend
library: bitvectors
signature: nil
location: 42 0 45 999
body:
  % Subtype TCC generated (at line 24, column 55) for  k - n
      % expected type  nat
  zero_extend_lsend_TCC1: OBLIGATION
    FORALL (n: posnat, k: above(n)): k - n >= 0;


decl_type: tcc
theory: bv_arith_extend
library: bitvectors
signature: nil
location: 47 0 50 999
body:
  % Subtype TCC generated (at line 29, column 45) for  n
      % expected type  k: above(m)
  bv2int_elim_gen_TCC1: OBLIGATION
    FORALL (n: posnat, m: pos_nat_below(n)): n > m;


decl_type: formula
theory: bv_overflow
library: bitvectors
signature: nil
location: 11 2 12 59
body:
    overflow_then_eq: LEMMA overflow(bv1,bv2) IMPLIES 
                                bv1 ^ (N - 1) = bv2 ^ (N - 1)


decl_type: formula
theory: bv_overflow
library: bitvectors
signature: nil
location: 16 2 18 73
body:
    bv2int_overflow_nat : LEMMA NOT in_rng_2s_comp(bv2int(bv1) + bv2int(bv2))
                                      IMPLIES bv2int(bv1 + bv2) = 
                                        bv2nat(bv1) + bv2nat(bv2) - exp2(N)


decl_type: formula
theory: bv_overflow
library: bitvectors
signature: nil
location: 20 2 25 55
body:
    bv_not_in_rng_int   : LEMMA NOT in_rng_2s_comp(bv2int(bv1) + bv2int(bv2))
                                      IMPLIES bv2int(bv1 + bv2) =
                                          bv2int(bv1) + bv2int(bv2) 
                                                + exp2(N) * b2n(bv1(N - 1))
                                                + exp2(N) * b2n(bv2(N - 1))
                                                - exp2(N)


decl_type: formula
theory: bv_overflow
library: bitvectors
signature: nil
location: 27 2 32 36
body:
    bv2int_add_overflow : THEOREM NOT in_rng_2s_comp(bv2int(bv1) + bv2int(bv2))
                             IMPLIES bv2int(bv1 + bv2) =
                                 IF bv2int(bv1) >= 0 AND bv2int(bv2) >= 0
                                    THEN bv2int(bv1) + bv2int(bv2) - exp2(N)
                                 ELSE bv2int(bv1) + bv2int(bv2) + exp2(N) 
                                 ENDIF


decl_type: formula
theory: bv_overflow
library: bitvectors
signature: nil
location: 35 2 36 69
body:
    bv_sum_limits       : LEMMA bv2int(bv1) + bv2int(bv2) <= 2 * maxint AND
                                bv2int(bv1) + bv2int(bv2) >= 2 * minint  


decl_type: formula
theory: bv_overflow
library: bitvectors
signature: nil
location: 38 2 40 60
body:
    bv_bits_for_overflow: LEMMA (bv1 ^ (N - 1) = bv2 ^ (N - 1)
                                AND bv1 ^ (N - 1) /= (bv1 + bv2) ^ (N - 1))
                                    IMPLIES overflow(bv1, bv2)


decl_type: formula
theory: bv_overflow
library: bitvectors
signature: nil
location: 42 2 43 78
body:
    bv_overflow_bits_ne : LEMMA overflow(bv1,bv2) IMPLIES 
                                        (bv1 ^ (N - 1) /= (bv1 + bv2) ^ (N - 1))


decl_type: formula
theory: bv_overflow
library: bitvectors
signature: nil
location: 45 2 47 80
body:
    bv_overflow_def     : THEOREM overflow(bv1, bv2) =
                                     ((bv1 ^ (N - 1) = bv2 ^ (N - 1))
                                     AND (bv1 ^ (N - 1) /= (bv1 + bv2) ^ (N - 1)))


decl_type: tcc
theory: bv_overflow
library: bitvectors
signature: nil
location: 54 0 58 999
body:
  % Subtype TCC generated (at line 12, column 37) for  (N - 1)
      % expected type  below[N]
  overflow_then_eq_TCC1: OBLIGATION
    FORALL (bv1, bv2: bvec[N]):
      overflow(bv1, bv2) IMPLIES (N - 1) >= 0 AND (N - 1) < N;


decl_type: tcc
theory: bv_overflow
library: bitvectors
signature: nil
location: 60 0 65 999
body:
  % Subtype TCC generated (at line 23, column 66) for  N - 1
      % expected type  below(N)
  bv_not_in_rng_int_TCC1: OBLIGATION
    FORALL (bv1, bv2: bvec[N]):
      NOT in_rng_2s_comp(bv2int(bv1) + bv2int(bv2)) IMPLIES
       N - 1 >= 0 AND N - 1 < N;


decl_type: tcc
theory: bv_overflow
library: bitvectors
signature: nil
location: 67 0 69 999
body:
  % Subtype TCC generated (at line 38, column 38) for  (N - 1)
      % expected type  below[N]
  bv_bits_for_overflow_TCC1: OBLIGATION (N - 1) >= 0 AND (N - 1) < N;


decl_type: formula
theory: bv_arith_int_rules
library: bitvectors
signature: nil
location: 8 2 9 61
body:
    singleton_int: LEMMA FORALL (bv: bvec[n], i: below[n]):
                              bv2int[1](bv^(i,i)) = - b2n(bv^i)


decl_type: formula
theory: bv_arith_int_rules
library: bitvectors
signature: nil
location: 11 2 19 14
body:
    bv2int_add_combined_rule: LEMMA FORALL (bv1, bv2: bvec[n]):
         bv2int(bv1 + bv2) =
           IF in_rng_2s_comp[n](bv2int(bv1) + bv2int(bv2)) THEN 
                bv2int(bv1) + bv2int(bv2)
           ELSIF bv2int(bv1) >= 0 AND bv2int(bv2) >= 0 THEN 
                bv2int(bv1) + bv2int(bv2) - exp2(n)
           ELSE 
               bv2int(bv1) + bv2int(bv2) + exp2(n) 
           ENDIF


decl_type: formula
theory: bv_arith_int_rules
library: bitvectors
signature: nil
location: 21 3 23 70
body:
     bv2int_add_no_overflow: LEMMA FORALL (bv1, bv2: bvec[n]):
                        in_rng_2s_comp[n](bv2int(bv1) + bv2int(bv2)) =>
                           bv2int(bv1 + bv2) = bv2int(bv1) + bv2int(bv2)


decl_type: formula
theory: bv_arith_int_rules
library: bitvectors
signature: nil
location: 25 3 30 63
body:
     bv2int_add_overflow: LEMMA FORALL (bv1, bv2: bvec[n]):
                       (NOT in_rng_2s_comp[n](bv2int(bv1) + bv2int(bv2))) =>
                             bv2int(bv1 + bv2) =
                               IF bv2int(bv1) >= 0 & bv2int(bv2) >= 0
                                  THEN bv2int(bv1) + bv2int(bv2) - exp2(n)
                               ELSE bv2int(bv1) + bv2int(bv2) + exp2(n) ENDIF


decl_type: formula
theory: bv_arith_int_rules
library: bitvectors
signature: nil
location: 33 3 38 43
body:
     sign_bit_of_unary_minus: LEMMA FORALL (bv: bvec[n]):
               (-bv)^(n-1) = IF bv2int(bv) = minint[n] THEN TRUE
                             ELSIF NOT bv^(n-1) THEN 
                                 IF bv2int(bv) = 0 THEN FALSE 
                                 ELSE TRUE ENDIF
                             ELSE FALSE ENDIF


decl_type: tcc
theory: bv_arith_int_rules
library: bitvectors
signature: nil
location: 48 0 50 999
body:
  % Subtype TCC generated (at line 9, column 44) for  i
      % expected type  upto(i)
  singleton_int_TCC1: OBLIGATION FORALL (n: posnat, i: below[n]): i <= i;


decl_type: tcc
theory: bv_arith_int_rules
library: bitvectors
signature: nil
location: 52 0 55 999
body:
  % Subtype TCC generated (at line 34, column 20) for  (n - 1)
      % expected type  below[n]
  sign_bit_of_unary_minus_TCC1: OBLIGATION
    FORALL (n: posnat): (n - 1) >= 0 AND (n - 1) < n;


decl_type: formula
theory: bv_arith_nat_rules
library: bitvectors
signature: nil
location: 26 2 28 79
body:
    bv_add_rule              : LEMMA FORALL (bv1,bv2: bvec[N]):
                                 bv2nat(bv1) + bv2nat(bv2) < exp2(N) IMPLIES
                                    bv2nat(bv1 + bv2) = bv2nat(bv1) + bv2nat(bv2)


decl_type: formula
theory: bv_arith_nat_rules
library: bitvectors
signature: nil
location: 30 2 32 79
body:
    bv_add_overflow     : LEMMA FORALL (bv1,bv2: bvec[N]):
                                 bv2nat(bv1) + bv2nat(bv2) >= exp2(N) IMPLIES
                          bv2nat(bv1 + bv2) = bv2nat(bv1) + bv2nat(bv2) - exp2(N)


decl_type: formula
theory: bv_arith_nat_rules
library: bitvectors
signature: nil
location: 39 2 40 80
body:
    bv_plus_fill_T   : LEMMA FORALL (bv: bvec[N]): bv2nat(bv) /= 0 IMPLIES
                                       bv2nat(bv + fill[N](TRUE)) = bv2nat(bv) - 1


decl_type: formula
theory: bv_arith_nat_rules
library: bitvectors
signature: nil
location: 42 2 43 68
body:
    bv2nat_elim_rule : LEMMA FORALL (bv1,bv2: bvec[N]): 
                                         bv1 + bv2nat(bv2) = bv1 + bv2


decl_type: formula
theory: bv_arith_nat_rules
library: bitvectors
signature: nil
location: 45 2 46 76
body:
    bv2nat_plus: LEMMA FORALL (bv: bvec[N]): n < (exp2(N) - bv2nat(bv)) =>
                                               bv2nat(bv + n) = bv2nat(bv) + n


decl_type: formula
theory: bv_arith_nat_rules
library: bitvectors
signature: nil
location: 48 2 50 69
body:
    bv2nat_plus2: LEMMA FORALL (bv: bvec[N]): n < exp2(N) AND 
                                              bv2nat(bv) + n >= exp2(N) =>
                           bv2nat(bv +  n) = bv2nat(bv) - (exp2(N) - n)


decl_type: formula
theory: bv_arith_nat_rules
library: bitvectors
signature: nil
location: 53 2 54 78
body:
    bv2nat_minus : LEMMA FORALL (bv: bvec[N]):  n <= bv2nat(bv) =>
                                                 bv2nat(bv - n) = bv2nat(bv) - n


decl_type: formula
theory: bv_arith_nat_rules
library: bitvectors
signature: nil
location: 56 2 57 74
body:
    bv2nat_minus2 : LEMMA FORALL (bv: bvec[N]):  n > bv2nat(bv) AND n < exp2(N) =>
                                   bv2nat(bv - n) = bv2nat(bv) - n + exp2(N)


decl_type: formula
theory: bv_arith_nat_rules
library: bitvectors
signature: nil
location: 60 2 61 78
body:
    bv2nat_neg : LEMMA FORALL (bv: bvec[N]):  i < 0 AND (-i) <= bv2nat(bv) =>
                                                 bv2nat(bv + i) = bv2nat(bv) + i


decl_type: formula
theory: bv_arith_nat_rules
library: bitvectors
signature: nil
location: 63 2 65 73
body:
    bv2nat_neg2: LEMMA FORALL (bv: bvec[N]): i < 0 AND (-i) > bv2nat(bv) AND
                                               (-i) < exp2(N) =>
                                  bv2nat(bv + i) = bv2nat(bv) + i + exp2(N)


decl_type: formula
theory: bv_arith_nat_rules
library: bitvectors
signature: nil
location: 69 2 70 77
body:
    bv2nat_neg_modulo: LEMMA FORALL (bv: bvec[N]): i <= -exp2(N) =>
                              bv2nat(bv + i) = bv2nat(bv + (-mod(-i, exp2(N))))


decl_type: formula
theory: bv_arith_nat_rules
library: bitvectors
signature: nil
location: 75 2 76 66
body:
    singleton_nat_alt   : LEMMA FORALL (bv: bvec[N]):
                                  N = 1 => bv2nat[N](bv) = b2n(bv^0)


decl_type: tcc
theory: bv_arith_nat_rules
library: bitvectors
signature: nil
location: 86 0 88 999
body:
  % Subtype TCC generated (at line 76, column 64) for  0
      % expected type  below[N]
  singleton_nat_alt_TCC1: OBLIGATION FORALL (N: posnat): N = 1 IMPLIES 0 < N;


decl_type: formula
theory: bv_arith_minus_rules
library: bitvectors
signature: nil
location: 8 2 9 58
body:
    bv_assoc_obliviation : LEMMA FORALL (bv1,bv2: bvec[N]):
                                  bv1 + (-(bv1) + bv2) = bv2


decl_type: formula
theory: bv_arith_minus_rules
library: bitvectors
signature: nil
location: 13 2 14 59
body:
    bv_sub_normalization : LEMMA FORALL (bv1,bv2: bvec[N]):
                                   (bv1 - bv2) = bv1 + (-bv2)


decl_type: formula
theory: bv_arith_minus_rules
library: bitvectors
signature: nil
location: 16 2 17 59
body:
    bv_neg_distribution  : LEMMA FORALL (bv1,bv2: bvec[N]):
                                   -(bv1 + bv2) = -bv1 + -bv2


decl_type: formula
theory: bv_arith_minus_rules
library: bitvectors
signature: nil
location: 20 2 21 58
body:
    bv_plus_neg_distrib  : LEMMA FORALL (i: int, bv: bvec[N]):
                                      -(bv + i) = -bv + (-i)


decl_type: formula
theory: bv_arith_minus_rules
library: bitvectors
signature: nil
location: 23 2 24 61
body:
    bv_sub_identity_R    : LEMMA FORALL (bv1: bvec[N]):
                                  bv1 + -(fill[N](FALSE)) = bv1


decl_type: formula
theory: bv_arith_minus_rules
library: bitvectors
signature: nil
location: 26 2 27 61
body:
    bv_sub_identity_L    : LEMMA FORALL (bv1: bvec[N]):
                                  -(fill[N](FALSE)) + bv1 = bv1


decl_type: formula
theory: bv_arith_minus_rules
library: bitvectors
signature: nil
location: 29 2 30 66
body:
    bv_fill_increment_R  : LEMMA FORALL (bv1: bvec[N]):
                                  (bv1 + -(fill[N](TRUE))) = bv1 + 1


decl_type: formula
theory: bv_arith_minus_rules
library: bitvectors
signature: nil
location: 32 2 33 66
body:
    bv_fill_increment_L  : LEMMA FORALL (bv1: bvec[N]):
                                  (-(fill[N](TRUE)) + bv1) = bv1 + 1


decl_type: formula
theory: bv_arith_minus_rules
library: bitvectors
signature: nil
location: 35 2 36 59
body:
    bv_not_normalization : LEMMA FORALL (bv1,bv2: bvec[N]):
                                  (NOT (bv1)) = -(bv1) + (-1)


decl_type: formula
theory: bv_arith_rules
library: bitvectors
signature: nil
location: 13 2 14 78
body:
    bv_add_normalization     : LEMMA FORALL (bv1,bv2,bv3: bvec[N]): 
                                           bv1 + (bv2 + bv3) = (bv1 + bv2) + bv3


decl_type: formula
theory: bv_arith_rules
library: bitvectors
signature: nil
location: 16 2 17 74
body:
    bv_add_both_sides        : LEMMA FORALL (bv1,bv2,bv3: bvec[N]):
                                       (bv1 + bv3 = bv2 + bv3) IFF bv1 = bv2


decl_type: formula
theory: bv_arith_rules
library: bitvectors
signature: nil
location: 19 2 20 75
body:
    bv_add_associative       : LEMMA FORALL (bv1,bv2,bv3: bvec[N]):
                                        bv1 + (bv2 + bv3) = (bv1 + bv2) + bv3 


decl_type: formula
theory: bv_arith_rules
library: bitvectors
signature: nil
location: 22 2 23 67
body:
    bv_add_identity_R        : LEMMA FORALL (bv1: bvec[N]): 
                                           bv1 + fill[N](FALSE) = bv1


decl_type: formula
theory: bv_arith_rules
library: bitvectors
signature: nil
location: 25 2 26 67
body:
    bv_add_identity_L        : LEMMA FORALL (bv1: bvec[N]): 
                                           fill[N](FALSE) + bv1 = bv1


decl_type: formula
theory: bv_arith_rules
library: bitvectors
signature: nil
location: 37 2 38 69
body:
    bv_plus_inj_rule  : LEMMA FORALL (bv: bvec[N]),(n1,n2: below(exp2(N))):
                                        (bv + n1 = bv + n2) = (n1 = n2)


decl_type: formula
theory: bv_arith_rules
library: bitvectors
signature: nil
location: 45 2 46 66
body:
    bv_plus_assoc1           : LEMMA FORALL (bv1,bv2: bvec[N]):
                                   bv1 + (bv2 + i) = (bv1 + bv2) + i


decl_type: formula
theory: bv_arith_rules
library: bitvectors
signature: nil
location: 48 2 49 66
body:
    bv_plus_assoc2           : LEMMA FORALL (bv1,bv2: bvec[N]):
                                  (bv1 + i) + bv2  = (bv1 + bv2) + i


decl_type: formula
theory: bv_arith_rules
library: bitvectors
signature: nil
location: 51 2 52 66
body:
    bv_plus_2int_assoc       : LEMMA FORALL (bv1: bvec[N]):
                                  (bv1 + i1) + i2  = bv1 + (i1 + i2) 


decl_type: formula
theory: bv_arith_rules
library: bitvectors
signature: nil
location: 55 2 56 67
body:
    bv_add_2_consts_1   : LEMMA FORALL (bv: bvec[N]),(k1,k2: int):
                                        (bv + k1) + k2 = bv + (k1+k2)


decl_type: formula
theory: bv_arith_rules
library: bitvectors
signature: nil
location: 58 2 59 80
body:
    bv_add_2_consts_2   : LEMMA FORALL (bv1,bv2: bvec[N]),(k1,k2: int):
                                 (bv1 + k1) + (bv2 + k2) = (bv1 + bv2) + (k1 + k2) 


decl_type: formula
theory: bv_concat_rules
library: bitvectors
signature: nil
location: 14 3 15 52
body:
     bv_concat_null_r      : LEMMA FORALL (bvn:bvec[n], bv0: bvec[0]):
                                     (bvn o bv0 = bvn)


decl_type: formula
theory: bv_concat_rules
library: bitvectors
signature: nil
location: 17 3 18 52
body:
     bv_concat_null_l      : LEMMA FORALL (bvn:bvec[n], bv0: bvec[0]):
                                     (bv0 o bvn = bvn)


decl_type: formula
theory: bv_concat_rules
library: bitvectors
signature: nil
location: 20 3 21 76
body:
     bv_concat_associative : LEMMA FORALL (bvm:bvec[m], bvn:bvec[n], bvp:bvec[p]):
                                     (bvm o (bvn o bvp)) = ((bvm o bvn) o bvp) 


decl_type: formula
theory: bv_concat_rules
library: bitvectors
signature: nil
location: 29 3 31 65
body:
     bv_concat_2fill     : LEMMA FORALL (bv: bvec[n]): 
                                       (fill[n1](b) o (fill[n2](b)) o bv) 
                                           = (fill[n1+n2](b) o bv);


decl_type: formula
theory: bv_concat_rules
library: bitvectors
signature: nil
location: 35 2 36 72
body:
    bv_concat_top_rule  : LEMMA FORALL (N: posnat, bvn: bvec[N], bvm: bvec[m]):
                                           (bvn o bvm)^(N+m-1) = bvn^(N-1)


decl_type: formula
theory: bv_concat_rules
library: bitvectors
signature: nil
location: 38 2 39 79
body:
    bv_not_over_concat  : LEMMA FORALL (bvm: bvec[m], bvn: bvec[n]):
                                        (NOT (bvm o bvn)) = (NOT bvm) o (NOT bvn)


decl_type: tcc
theory: bv_concat_rules
library: bitvectors
signature: nil
location: 46 0 49 999
body:
  % Subtype TCC generated (at line 36, column 54) for  (N + m - 1)
      % expected type  below[N + m]
  bv_concat_top_rule_TCC1: OBLIGATION
    FORALL (m: nat, N: posnat): (N + m - 1) >= 0 AND (N + m - 1) < N + m;


decl_type: tcc
theory: bv_concat_rules
library: bitvectors
signature: nil
location: 51 0 54 999
body:
  % Subtype TCC generated (at line 36, column 68) for  (N - 1)
      % expected type  below[N]
  bv_concat_top_rule_TCC2: OBLIGATION
    FORALL (N: posnat): (N - 1) >= 0 AND (N - 1) < N;


decl_type: formula
theory: bv_caret_bitwise
library: bitvectors
signature: nil
location: 8 2 9 69
body:
    bv_OR_caret : LEMMA (FORALL (bv1,bv2: bvec[n], i: below(n), j: upto(i)):
                         (bv1 OR bv2)^(i,j) = (bv1^(i,j) OR bv2^(i,j)))


decl_type: formula
theory: bv_caret_bitwise
library: bitvectors
signature: nil
location: 11 2 12 71
body:
    bv_AND_caret: LEMMA (FORALL (bv1,bv2: bvec[n], i: below(n), j: upto(i)):
                         (bv1 AND bv2)^(i,j) = (bv1^(i,j) AND bv2^(i,j)))


decl_type: formula
theory: bv_caret_bitwise
library: bitvectors
signature: nil
location: 14 2 15 71
body:
    bv_IFF_caret: LEMMA (FORALL (bv1,bv2: bvec[n], i: below(n), j: upto(i)):
                         (bv1 IFF bv2)^(i,j) = (bv1^(i,j) IFF bv2^(i,j)))


decl_type: formula
theory: bv_caret_bitwise
library: bitvectors
signature: nil
location: 17 2 18 71
body:
    bv_XOR_caret: LEMMA (FORALL (bv1,bv2: bvec[n], i: below(n), j: upto(i)):
                         XOR(bv1,bv2)^(i,j) = (bv1^(i,j) XOR bv2^(i,j)) )


decl_type: formula
theory: bv_caret_bitwise
library: bitvectors
signature: nil
location: 20 2 21 54
body:
    bv_NOT_caret: LEMMA (FORALL (bv: bvec[n], i: below(n), j: upto(i)):
                         (NOT bv)^(i,j) = NOT bv^(i,j) )


decl_type: tcc
theory: bv_caret_bitwise
library: bitvectors
signature: nil
location: 28 0 31 999
body:
  % Subtype TCC generated (at line 89, column 18) for  1 + i - j
      % expected type  nat
  bv_OR_caret_TCC1: OBLIGATION
    FORALL (n: nat, i: below(n), j: upto(i)): 1 + i - j >= 0;


decl_type: formula
theory: bv_caret_bitwise_rules
library: bitvectors
signature: nil
location: 13 2 14 70
body:
    bv_caret_OR       : LEMMA (FORALL (bv1,bv2: bvec[N], i: below[N], j: upto(i)):
                          (bv1 OR bv2)^(i,j) = (bv1^(i,j) OR bv2^(i,j)))


decl_type: formula
theory: bv_caret_bitwise_rules
library: bitvectors
signature: nil
location: 16 2 17 72
body:
    bv_caret_AND      : LEMMA (FORALL (bv1,bv2: bvec[N], i: below[N], j: upto(i)):
                          (bv1 AND bv2)^(i,j) = (bv1^(i,j) AND bv2^(i,j)))


decl_type: formula
theory: bv_caret_bitwise_rules
library: bitvectors
signature: nil
location: 19 2 20 72
body:
    bv_caret_XOR      : LEMMA (FORALL (bv1,bv2: bvec[N], i: below[N], j: upto(i)):
                          XOR(bv1,bv2)^(i,j) = (bv1^(i,j) XOR bv2^(i,j)) )


decl_type: formula
theory: bv_caret_bitwise_rules
library: bitvectors
signature: nil
location: 22 2 23 72
body:
    bv_caret_IFF      : LEMMA (FORALL (bv1,bv2: bvec[N], i: below(N), j: upto(i)):
                          (bv1 IFF bv2)^(i,j) = (bv1^(i,j) IFF bv2^(i,j)))


decl_type: formula
theory: bv_caret_bitwise_rules
library: bitvectors
signature: nil
location: 25 2 26 55
body:
    bv_caret_NOT      : LEMMA (FORALL (bv: bvec[N], i: below(N), j: upto(i)):
                          (NOT bv)^(i,j) = NOT bv^(i,j) )


decl_type: formula
theory: bv_caret_bitwise_rules
library: bitvectors
signature: nil
location: 30 2 31 58
body:
    bv_caret_OR_unary : LEMMA (FORALL (bv1, bv2: bvec[N], i: below[N]):
                          (bv1 OR bv2)^i = (bv1^i OR bv2^i))


decl_type: formula
theory: bv_caret_bitwise_rules
library: bitvectors
signature: nil
location: 33 2 34 60
body:
    bv_caret_AND_unary: LEMMA (FORALL (bv1,bv2: bvec[N], i: below[N]):
                          (bv1 AND bv2)^i = (bv1^i AND bv2^i))


decl_type: formula
theory: bv_caret_bitwise_rules
library: bitvectors
signature: nil
location: 36 2 37 60
body:
    bv_caret_XOR_unary: LEMMA (FORALL (bv1,bv2: bvec[N], i: below[N]):
                          XOR(bv1,bv2)^i = (bv1^i XOR bv2^i) )


decl_type: formula
theory: bv_caret_bitwise_rules
library: bitvectors
signature: nil
location: 39 2 40 62
body:
    bv_caret_IFF_unary: LEMMA (FORALL (bv1,bv2: bvec[N], i: below[N]):
                            IFF(bv1,bv2)^i = (bv1^i IFF bv2^i) )


decl_type: formula
theory: bv_caret_bitwise_rules
library: bitvectors
signature: nil
location: 42 2 43 47
body:
    bv_caret_NOT_unary: LEMMA (FORALL (bv: bvec[N], i: below[N]):
                          (NOT bv)^i = NOT bv^i )


decl_type: tcc
theory: bv_caret_bitwise_rules
library: bitvectors
signature: nil
location: 51 0 54 999
body:
  % Subtype TCC generated (at line 89, column 18) for  1 + i - j
      % expected type  nat
  bv_caret_OR_TCC1: OBLIGATION
    FORALL (N: nat, i: below[N], j: upto(i)): 1 + i - j >= 0;


decl_type: formula
theory: bv_caret_rules
library: bitvectors
signature: nil
location: 13 2 14 62
body:
    bv_caret_remove     : LEMMA FORALL (bv: bvec[N]): 
                                  i=N-1 AND j=0 => bv^(i,j) = bv


decl_type: formula
theory: bv_caret_rules
library: bitvectors
signature: nil
location: 16 2 17 58
body:
    bv_caret_ii_0_rule  : LEMMA FORALL (bv: bvec[N]): 
                                  i < N => bv^(i,i)^0 = bv^i


decl_type: formula
theory: bv_caret_rules
library: bitvectors
signature: nil
location: 19 2 21 62
body:
    bv_caret_elim_rule  : LEMMA FORALL (bv: bvec[N]): 
                                  i < N AND j <= i AND k < i-j+1 => 
                                      bv ^ (i, j) ^ k = bv^(j+k)


decl_type: formula
theory: bv_caret_rules
library: bitvectors
signature: nil
location: 23 2 27 79
body:
    bv_caret_denormalize: LEMMA FORALL (n: posnat, bvn: bvec[n]):
                                  i1 < n         AND   j1 <= i1 AND 
                                  i2 < i1-j1+1   AND   j2 <= i2 AND 
                                  i2-j2+1 <= i1-j1+1 =>
                                     (bvn^(i1, j1))^(i2, j2) = bvn^(i2+j1, j2+j1)


decl_type: formula
theory: bv_caret_rules
library: bitvectors
signature: nil
location: 30 2 31 71
body:
    bv_fill_caret       : LEMMA n < m AND k < m AND k <= n =>
                                     (fill[m](b))^(n, k) = fill[n-k+1](b)


decl_type: tcc
theory: bv_caret_rules
library: bitvectors
signature: nil
location: 41 0 44 999
body:
  % Subtype TCC generated (at line 14, column 53) for  i
      % expected type  below(N)
  bv_caret_remove_TCC1: OBLIGATION
    FORALL (N, i, j: nat): i = N - 1 AND j = 0 IMPLIES i < N;


decl_type: tcc
theory: bv_caret_rules
library: bitvectors
signature: nil
location: 46 0 49 999
body:
  % Subtype TCC generated (at line 14, column 55) for  j
      % expected type  upto(i)
  bv_caret_remove_TCC2: OBLIGATION
    FORALL (N, i, j: nat): i = N - 1 AND j = 0 IMPLIES j <= i;


decl_type: tcc
theory: bv_caret_rules
library: bitvectors
signature: nil
location: 51 0 56 999
body:
  % Subtype TCC generated (at line 14, column 60) for  bv
      % expected type  bvec[1 + i - j]
  bv_caret_remove_TCC3: OBLIGATION
    FORALL (N, i, j: nat, bv: bvec[N]):
      i = N - 1 AND j = 0 IMPLIES
       (FORALL (x: nat): bv(x) IMPLIES (x < N IFF x < 1 + i - j));


decl_type: tcc
theory: bv_caret_rules
library: bitvectors
signature: nil
location: 58 0 61 999
body:
  % Subtype TCC generated (at line 17, column 47) for  i
      % expected type  upto(i)
  bv_caret_ii_0_rule_TCC1: OBLIGATION
    FORALL (N, i: nat): i < N IMPLIES i <= i;


decl_type: tcc
theory: bv_caret_rules
library: bitvectors
signature: nil
location: 63 0 67 999
body:
  % Subtype TCC generated (at line 21, column 50) for  k
      % expected type  below[1 + i - j]
  bv_caret_elim_rule_TCC1: OBLIGATION
    FORALL (N, i, j, k: nat):
      i < N AND j <= i AND k < i - j + 1 IMPLIES k < 1 + i - j;


decl_type: tcc
theory: bv_caret_rules
library: bitvectors
signature: nil
location: 69 0 73 999
body:
  % Subtype TCC generated (at line 89, column 18) for  1 + i - j
      % expected type  nat
  bv_caret_elim_rule_TCC2: OBLIGATION
    FORALL (N, i, j, k: nat):
      i < N AND j <= i AND k < i - j + 1 IMPLIES 1 + i - j >= 0;


decl_type: tcc
theory: bv_caret_rules
library: bitvectors
signature: nil
location: 75 0 79 999
body:
  % Subtype TCC generated (at line 21, column 58) for  (j + k)
      % expected type  below[N]
  bv_caret_elim_rule_TCC3: OBLIGATION
    FORALL (N, i, j, k: nat):
      i < N AND j <= i AND k < i - j + 1 IMPLIES (j + k) < N;


decl_type: tcc
theory: bv_caret_rules
library: bitvectors
signature: nil
location: 81 0 87 999
body:
  % Subtype TCC generated (at line 27, column 51) for  i2
      % expected type  below(1 + i1 - j1)
  bv_caret_denormalize_TCC1: OBLIGATION
    FORALL (i1, i2, j1, j2: nat, n: posnat):
           i1 < n AND j1 <= i1 AND i2 < i1 - j1 + 1 AND j2 <= i2
       AND i2 - j2 + 1 <= i1 - j1 + 1
       IMPLIES i2 < 1 + i1 - j1;


decl_type: tcc
theory: bv_caret_rules
library: bitvectors
signature: nil
location: 89 0 95 999
body:
  % Subtype TCC generated (at line 89, column 18) for  1 + i1 - j1
      % expected type  nat
  bv_caret_denormalize_TCC2: OBLIGATION
    FORALL (i1, i2, j1, j2: nat, n: posnat):
           i1 < n AND j1 <= i1 AND i2 < i1 - j1 + 1 AND j2 <= i2
       AND i2 - j2 + 1 <= i1 - j1 + 1
       IMPLIES 1 + i1 - j1 >= 0;


decl_type: tcc
theory: bv_caret_rules
library: bitvectors
signature: nil
location: 97 0 103 999
body:
  % Subtype TCC generated (at line 27, column 66) for  i2 + j1
      % expected type  below(n)
  bv_caret_denormalize_TCC3: OBLIGATION
    FORALL (i1, i2, j1, j2: nat, n: posnat):
           i1 < n AND j1 <= i1 AND i2 < i1 - j1 + 1 AND j2 <= i2
       AND i2 - j2 + 1 <= i1 - j1 + 1
       IMPLIES i2 + j1 < n;


decl_type: tcc
theory: bv_caret_rules
library: bitvectors
signature: nil
location: 105 0 111 999
body:
  % Subtype TCC generated (at line 27, column 73) for  j2 + j1
      % expected type  upto(i2 + j1)
  bv_caret_denormalize_TCC4: OBLIGATION
    FORALL (i1, i2, j1, j2: nat, n: posnat):
           i1 < n AND j1 <= i1 AND i2 < i1 - j1 + 1 AND j2 <= i2
       AND i2 - j2 + 1 <= i1 - j1 + 1
       IMPLIES j2 + j1 <= i2 + j1;


decl_type: tcc
theory: bv_caret_rules
library: bitvectors
signature: nil
location: 113 0 116 999
body:
  % Subtype TCC generated (at line 31, column 66) for  1 + n - k
      % expected type  nat
  bv_fill_caret_TCC1: OBLIGATION
    FORALL (k, m, n: nat): k <= n AND k < m AND n < m IMPLIES 1 + n - k >= 0;


decl_type: formula
theory: bv_bitwise_rules
library: bitvectors
signature: nil
location: 20 2 21 62
body:
    bv_NOT_caret         : LEMMA FORALL (bv:bvec[N]) (i: below(N)): 
                                        (NOT(bv))^i = NOT (bv^i)


decl_type: formula
theory: bv_bitwise_rules
library: bitvectors
signature: nil
location: 25 2 26 76
body:
    bv_AND_fill_normalize: LEMMA FORALL (bv1 : bvec[N]):
                                   (fill[N](b) AND bv1) = (bv1 AND fill[N](b))


decl_type: formula
theory: bv_bitwise_rules
library: bitvectors
signature: nil
location: 28 2 29 73
body:
    bv_AND_fill_F        : LEMMA FORALL (bv1: bvec[N]): 
                                  (bv1 AND fill[N](FALSE)) = fill[N](FALSE)


decl_type: formula
theory: bv_bitwise_rules
library: bitvectors
signature: nil
location: 31 2 32 77
body:
    bv_AND_fill_T        : LEMMA FORALL 
                                  (bv1: bvec[N]): (bv1 AND fill[N](TRUE)) = bv1


decl_type: formula
theory: bv_bitwise_rules
library: bitvectors
signature: nil
location: 34 2 35 68
body:
    bv_AND_same          : LEMMA FORALL (bv1, bv2: bvec[N]):
                                    (bv1 = bv2) => (bv1 AND bv2) = bv1


decl_type: formula
theory: bv_bitwise_rules
library: bitvectors
signature: nil
location: 37 2 38 80
body:
    bv_AND_associative   : LEMMA FORALL (bv1, bv2, bv3: bvec[N]):
                                 (bv1 AND (bv2 AND bv3)) = ((bv1 AND bv2) AND bv3)


decl_type: formula
theory: bv_bitwise_rules
library: bitvectors
signature: nil
location: 40 2 41 80
body:
    bv_AND_bv_2eq        : LEMMA FORALL (bv1, bv2, bv3: bvec[N]):
                              bv1 = bv2 => (bv1 AND (bv2 AND bv3)) = (bv2 AND bv3)


decl_type: formula
theory: bv_bitwise_rules
library: bitvectors
signature: nil
location: 43 2 44 75
body:
    bv_OR_fill_normalize : LEMMA FORALL (bv1: bvec[N]): 
                                    (fill[N](b) OR bv1) = (bv1 OR fill[N](b))


decl_type: formula
theory: bv_bitwise_rules
library: bitvectors
signature: nil
location: 46 2 47 62
body:
    bv_OR_fill_F          : LEMMA FORALL (bv1: bvec[N]): 
                                   (bv1 OR fill[N](FALSE)) = bv1


decl_type: formula
theory: bv_bitwise_rules
library: bitvectors
signature: nil
location: 49 2 50 72
body:
    bv_OR_fill_T          : LEMMA FORALL (bv1: bvec[N]): 
                                    (bv1 OR fill[N](TRUE)) = fill[N](TRUE)


decl_type: formula
theory: bv_bitwise_rules
library: bitvectors
signature: nil
location: 52 2 53 67
body:
    bv_OR_bv_eq          : LEMMA FORALL (bv1, bv2: bvec[N]):
                                    (bv1 = bv2) => (bv1 OR bv2) = bv1


decl_type: formula
theory: bv_bitwise_rules
library: bitvectors
signature: nil
location: 55 2 56 79
body:
    bv_OR_associative    : LEMMA FORALL (bv1, bv2, bv3: bvec[N]):
                                    (bv1 OR (bv2 OR bv3)) = ((bv1 OR bv2) OR bv3)


decl_type: formula
theory: bv_bitwise_rules
library: bitvectors
signature: nil
location: 58 2 59 78
body:
    bv_OR_bv_bv_2eq      : LEMMA FORALL (bv1, bv2, bv3: bvec[N]):
                             (bv1 = bv2) => (bv1 OR (bv2 OR bv3)) = (bv2 OR bv3)


decl_type: formula
theory: bv_bitwise_rules
library: bitvectors
signature: nil
location: 61 2 62 70
body:
    bv_XOR_fill_normalize: LEMMA FORALL (bv1 : bvec[N]):
                             (fill[N](b) XOR bv1) = (bv1 XOR fill[N](b))


decl_type: formula
theory: bv_bitwise_rules
library: bitvectors
signature: nil
location: 64 2 65 57
body:
    bv_XOR_fill_F        : LEMMA FORALL (bv1: bvec[N]): 
                             (bv1 XOR fill[N](FALSE)) = bv1


decl_type: formula
theory: bv_bitwise_rules
library: bitvectors
signature: nil
location: 67 2 68 62
body:
    bv_XOR_fill_T        : LEMMA FORALL (bv1: bvec[N]): 
                             (bv1 XOR fill[N](TRUE)) = (NOT bv1)


decl_type: formula
theory: bv_bitwise_rules
library: bitvectors
signature: nil
location: 70 2 71 72
body:
    bv_XOR_bv_2eq        : LEMMA FORALL (bv1, bv2: bvec[N]):
                             (bv1 = bv2) => (bv1 XOR bv2) = fill[N](FALSE)


decl_type: formula
theory: bv_bitwise_rules
library: bitvectors
signature: nil
location: 73 2 74 76
body:
    bv_XOR_associative   : LEMMA FORALL (bv1, bv2, bv3: bvec[N]):
                             (bv1 XOR (bv2 XOR bv3)) = ((bv1 XOR bv2) XOR bv3)


decl_type: formula
theory: bv_bitwise_rules
library: bitvectors
signature: nil
location: 76 2 77 70
body:
    bv_XOR_bv_bv_2eq     : LEMMA FORALL (bv1, bv2, bv3: bvec[N]):
                              bv1 = bv2 => (bv1 XOR (bv2 XOR bv3)) = bv3


decl_type: formula
theory: bv_nat_rules
library: bitvectors
signature: nil
location: 12 2 14 59
body:
    bv2nat_top_bit_F: LEMMA FORALL (bvn: bvec[n]):
                               n > 0 AND bv2nat(bvn) < exp2(n-1) 
                                    IMPLIES bvn^(n-1) = FALSE


decl_type: formula
theory: bv_nat_rules
library: bitvectors
signature: nil
location: 16 2 18 58
body:
    bv2nat_top_bit_T: LEMMA FORALL (bvn: bvec[n]): 
                               n > 0 AND bv2nat(bvn) >= exp2(n-1) 
                                    IMPLIES bvn^(n-1) = TRUE 


decl_type: formula
theory: bv_nat_rules
library: bitvectors
signature: nil
location: 20 2 21 73
body:
    bv2nat_inj_rule : LEMMA FORALL (bv1, bv2: bvec[n]): bv2nat(bv1) = bv2nat(bv2) 
                                                          IMPLIES bv1 = bv2


decl_type: tcc
theory: bv_nat_rules
library: bitvectors
signature: nil
location: 31 0 33 999
body:
  % Subtype TCC generated (at line 13, column 58) for  n - 1
      % expected type  nat
  bv2nat_top_bit_F_TCC1: OBLIGATION FORALL (n: nat): n > 0 IMPLIES n - 1 >= 0;


decl_type: tcc
theory: bv_nat_rules
library: bitvectors
signature: nil
location: 35 0 40 999
body:
  % Subtype TCC generated (at line 14, column 47) for  (n - 1)
      % expected type  below[n]
  bv2nat_top_bit_F_TCC2: OBLIGATION
    FORALL (n: nat, bvn: bvec[n]):
      n > 0 AND bv2nat(bvn) < exp2(n - 1) IMPLIES
       (n - 1) >= 0 AND (n - 1) < n;


decl_type: tcc
theory: bv_nat_rules
library: bitvectors
signature: nil
location: 42 0 47 999
body:
  % Subtype TCC generated (at line 18, column 47) for  (n - 1)
      % expected type  below[n]
  bv2nat_top_bit_T_TCC1: OBLIGATION
    FORALL (n: nat, bvn: bvec[n]):
      n > 0 AND bv2nat(bvn) >= exp2(n - 1) IMPLIES
       (n - 1) >= 0 AND (n - 1) < n;


decl_type: formula
theory: mod_rules
library: bitvectors
signature: nil
location: 22 2 23 57
body:
    mod_wrap_rule1: LEMMA n < m AND k <= m AND k >= m-n
                            IMPLIES mod(n+k, m) = n - (m-k)


decl_type: formula
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 11 2 12 75
body:
    bv_sign_of_frag_neg: LEMMA FORALL (bvn: bvec[N], i: below[N]):
                                  bv2int(bvn) < 0 => bv2int(bvn^(N-1, i)) < 0


decl_type: formula
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 14 2 15 77
body:
    bv_sign_of_frag_pos: LEMMA FORALL (bvn: bvec[N], i: below[N]):
                                  bv2int(bvn) >= 0 => bv2int(bvn^(N-1, i)) >= 0


decl_type: formula
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 18 2 19 78
body:
    bv2int_top   : THEOREM FORALL (bv: bvec[N], i: below[N]):
                                 bv2int(bv^(N-1,i)) = floor(bv2int(bv)/ exp2(i))


decl_type: formula
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 22 2 25 60
body:
    bv2int_concat : LEMMA FORALL (n, m: posnat, bvn: bvec[n], bvm: bvec[m]):
                           bv2int(bvn o bvm) = 
                               bv2int(bvn) * exp2(m) + bv2int(bvm) 
                                  + (b2n(bvm^(m-1)) * exp2(m))


decl_type: formula
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 27 2 29 80
body:
    bv2int_bottom : THEOREM FORALL (bv: bvec[N], i: below[N]):
                              bv2int(bv^(i,0)) 
                               = mod(bv2int(bv),exp2(i+1)) - exp2(i+1)*b2n(bv^(i)) 


decl_type: formula
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 31 2 33 70
body:
    in_small_rng   : LEMMA (FORALL (bv: bvec[N], i: below[N]):
                             i > 0 AND in_rng_2s_comp[i](bv2int(bv)) IMPLIES
                                       (bv = fill[N-i](bv^(N-1)) o bv^(i-1,0)))


decl_type: formula
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 36 2 38 70
body:
    in_rng_i_bv2int: LEMMA FORALL (bv: bvec[N], i: below[N]): i > 0 
                               AND in_rng_2s_comp[i](bv2int(bv)) IMPLIES
                                   bv2int[N](bv) = bv2int[i](bv^(i-1,0))


decl_type: formula
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 40 2 41 63
body:
    bv_caret_negate: LEMMA FORALL (bv1: bvec[N], m: below[N]): 
                                      (-bv1)^(m,0) = -(bv1^(m,0))


decl_type: formula
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 44 2 46 70
body:
    bv2int_in_rng_i    : LEMMA FORALL (bv: bvec[N], n: {np: posnat | np < N}):
                             in_rng_2s_comp[n](bv2int(bv)) => 
                                (bv = fill[N-n](bv^(n-1)) o bv^(n-1, 0))


decl_type: formula
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 48 2 50 66
body:
    bv2int_in_rng_i_top: LEMMA FORALL (bv: bvec[N], n: {np: posnat | np < N}):
                              in_rng_2s_comp[n](bv2int(bv)) => 
                                 (bv^(N-1, n) = fill[N-n](bv^(n-1)))


decl_type: formula
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 55 2 57 59
body:
    bv2int_of_sign_extension: LEMMA FORALL (bv: bvec[N], n: {np: posnat | np < N}):
                          in_rng_2s_comp[n](bv2int(bv)) =>
                             bv2int(bv^(n-1, 0)) = bv2int(bv)


decl_type: tcc
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 65 0 69 999
body:
  % Subtype TCC generated (at line 12, column 63) for  N - 1
      % expected type  below(N)
  bv_sign_of_frag_neg_TCC1: OBLIGATION
    FORALL (N: posnat, bvn: bvec[N], i: below[N]):
      bv2int(bvn) < 0 IMPLIES N - 1 >= 0 AND N - 1 < N;


decl_type: tcc
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 71 0 75 999
body:
  % Subtype TCC generated (at line 12, column 68) for  i
      % expected type  upto(N - 1)
  bv_sign_of_frag_neg_TCC2: OBLIGATION
    FORALL (N: posnat, bvn: bvec[N], i: below[N]):
      bv2int(bvn) < 0 IMPLIES i <= N - 1;


decl_type: tcc
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 77 0 81 999
body:
  % Subtype TCC generated (at line 12, column 63) for  N - i
      % expected type  posnat
  bv_sign_of_frag_neg_TCC3: OBLIGATION
    FORALL (N: posnat, bvn: bvec[N], i: below[N]):
      bv2int(bvn) < 0 IMPLIES N - i >= 0 AND N - i > 0;


decl_type: tcc
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 83 0 87 999
body:
  % Subtype TCC generated (at line 15, column 64) for  N - 1
      % expected type  below(N)
  bv_sign_of_frag_pos_TCC1: OBLIGATION
    FORALL (N: posnat, bvn: bvec[N], i: below[N]):
      bv2int(bvn) >= 0 IMPLIES N - 1 >= 0 AND N - 1 < N;


decl_type: tcc
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 89 0 93 999
body:
  % Subtype TCC generated (at line 15, column 69) for  i
      % expected type  upto(N - 1)
  bv_sign_of_frag_pos_TCC2: OBLIGATION
    FORALL (N: posnat, bvn: bvec[N], i: below[N]):
      bv2int(bvn) >= 0 IMPLIES i <= N - 1;


decl_type: tcc
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 95 0 99 999
body:
  % Subtype TCC generated (at line 15, column 64) for  N - i
      % expected type  posnat
  bv_sign_of_frag_pos_TCC3: OBLIGATION
    FORALL (N: posnat, bvn: bvec[N], i: below[N]):
      bv2int(bvn) >= 0 IMPLIES N - i >= 0 AND N - i > 0;


decl_type: tcc
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 101 0 104 999
body:
  % Subtype TCC generated (at line 19, column 42) for  N - 1
      % expected type  below(N)
  bv2int_top_TCC1: OBLIGATION
    FORALL (N: posnat, i: below[N]): N - 1 >= 0 AND N - 1 < N;


decl_type: tcc
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 106 0 108 999
body:
  % Subtype TCC generated (at line 19, column 46) for  i
      % expected type  upto(N - 1)
  bv2int_top_TCC2: OBLIGATION FORALL (N: posnat, i: below[N]): i <= N - 1;


decl_type: tcc
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 110 0 113 999
body:
  % Subtype TCC generated (at line 19, column 42) for  N - i
      % expected type  posnat
  bv2int_top_TCC3: OBLIGATION
    FORALL (N: posnat, i: below[N]): N - i >= 0 AND N - i > 0;


decl_type: tcc
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 115 0 117 999
body:
  % Subtype TCC generated (at line 22, column 70) for  m + n
      % expected type  posnat
  bv2int_concat_TCC1: OBLIGATION FORALL (n, m: posnat): m + n > 0;


decl_type: tcc
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 119 0 122 999
body:
  % Subtype TCC generated (at line 25, column 44) for  (m - 1)
      % expected type  below[m]
  bv2int_concat_TCC2: OBLIGATION
    FORALL (n, m: posnat): (m - 1) >= 0 AND (m - 1) < m;


decl_type: tcc
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 124 0 126 999
body:
  % Subtype TCC generated (at line 28, column 41) for  0
      % expected type  upto(i)
  bv2int_bottom_TCC1: OBLIGATION FORALL (N: posnat, i: below[N]): 0 <= i;


decl_type: tcc
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 128 0 132 999
body:
  % Subtype TCC generated (at line 33, column 41) for  N - i
      % expected type  nat
  in_small_rng_TCC1: OBLIGATION
    FORALL (N: posnat, bv: bvec[N], i: below[N]):
      i > 0 AND in_rng_2s_comp[i](bv2int(bv)) IMPLIES N - i >= 0;


decl_type: tcc
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 134 0 139 999
body:
  % Subtype TCC generated (at line 33, column 62) for  i - 1
      % expected type  below(N)
  in_small_rng_TCC2: OBLIGATION
    FORALL (N: posnat, bv: bvec[N], i: below[N]):
      i > 0 AND in_rng_2s_comp[i](bv2int(bv)) IMPLIES
       i - 1 >= 0 AND i - 1 < N;


decl_type: tcc
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 141 0 145 999
body:
  % Subtype TCC generated (at line 33, column 66) for  0
      % expected type  upto(i - 1)
  in_small_rng_TCC3: OBLIGATION
    FORALL (N: posnat, bv: bvec[N], i: below[N]):
      i > 0 AND in_rng_2s_comp[i](bv2int(bv)) IMPLIES 0 <= i - 1;


decl_type: tcc
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 147 0 151 999
body:
  % Subtype TCC generated (at line 46, column 50) for  (n - 1)
      % expected type  below[N]
  bv2int_in_rng_i_TCC1: OBLIGATION
    FORALL (N: posnat, bv: bvec[N], n: {np: posnat | np < N}):
      in_rng_2s_comp[n](bv2int(bv)) IMPLIES (n - 1) >= 0 AND (n - 1) < N;


decl_type: tcc
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 153 0 157 999
body:
  % Subtype TCC generated (at line 46, column 41) for  N - n
      % expected type  nat
  bv2int_in_rng_i_TCC2: OBLIGATION
    FORALL (N: posnat, bv: bvec[N], n: {np: posnat | np < N}):
      in_rng_2s_comp[n](bv2int(bv)) IMPLIES N - n >= 0;


decl_type: tcc
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 159 0 163 999
body:
  % Subtype TCC generated (at line 46, column 67) for  0
      % expected type  upto(n - 1)
  bv2int_in_rng_i_TCC3: OBLIGATION
    FORALL (N: posnat, bv: bvec[N], n: {np: posnat | np < N}):
      in_rng_2s_comp[n](bv2int(bv)) IMPLIES 0 <= n - 1;


decl_type: tcc
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 165 0 169 999
body:
  % Subtype TCC generated (at line 50, column 41) for  n
      % expected type  upto(N - 1)
  bv2int_in_rng_i_top_TCC1: OBLIGATION
    FORALL (N: posnat, bv: bvec[N], n: {np: posnat | np < N}):
      in_rng_2s_comp[n](bv2int(bv)) IMPLIES n <= N - 1;


decl_type: formula
theory: bv_adder
library: bitvectors
signature: nil
location: 78 3 80 52
body:
     adder_correct_rec: LEMMA 
         exp2(n+1)*n_cout_rec(n,x,y,a_cin)+bv2nat_rec(n+1,bv_adder(x,y,a_cin)) =
         bv2nat_rec(n+1,x) + bv2nat_rec(n+1,y) + a_cin


decl_type: formula
theory: bv_adder
library: bitvectors
signature: nil
location: 82 3 84 36
body:
     adder_correct: THEOREM 
         exp2(N)*n_cout_rec(N-1,x,y,a_cin) + bv2nat(bv_adder(x,y,a_cin)) =  
         bv2nat(x) + bv2nat(y) + a_cin


decl_type: function
theory: bv_adder
library: bitvectors
signature: [[below[N], bvec[N], bvec[N], bit] -> bit]
location: 66 3 70 14
body:
     n_cout_rec (n,x,y,a_cin): RECURSIVE bit =
       IF n =0 THEN oba_cout(x^(0),y^(0),a_cin)
       ELSE oba_cout(x^(n),y^(n),n_cout_rec(n-1,x,y,a_cin))
       ENDIF
       MEASURE n


decl_type: function
theory: bv_adder
library: bitvectors
signature: [[bvec[N], bvec[N], bit] -> bvec[N]]
location: 72 3 76 12
body:
     bv_adder(x,y,a_cin): bvec[N] =
       (LAMBDA (i:below(N)): 
        IF i=0 THEN oba_sum(x^(0),y^(0),a_cin)
        ELSE oba_sum(x^(i),y^(i),n_cout_rec(i-1,x,y,a_cin))
        ENDIF)


decl_type: tcc
theory: bv_adder
library: bitvectors
signature: nil
location: 104 0 106 999
body:
  % Subtype TCC generated (at line 67, column 30) for  (0)
      % expected type  below[N]
  n_cout_rec_TCC1: OBLIGATION FORALL (n: below[N]): n = 0 IMPLIES (0) < N;


decl_type: tcc
theory: bv_adder
library: bitvectors
signature: nil
location: 108 0 111 999
body:
  % Subtype TCC generated (at line 68, column 42) for  n - 1
      % expected type  below[N]
  n_cout_rec_TCC2: OBLIGATION
    FORALL (n: below[N]): NOT n = 0 IMPLIES n - 1 >= 0 AND n - 1 < N;


decl_type: tcc
theory: bv_adder
library: bitvectors
signature: nil
location: 113 0 116 999
body:
  % Termination TCC generated (at line 68, column 31) for
      % n_cout_rec(n - 1, x, y, a_cin)
  n_cout_rec_TCC3: OBLIGATION
    FORALL (n: below[N]): NOT n = 0 IMPLIES n - 1 < n;


decl_type: tcc
theory: bv_adder
library: bitvectors
signature: nil
location: 118 0 120 999
body:
  % Subtype TCC generated (at line 79, column 52) for  n + 1
      % expected type  upto(N)
  adder_correct_rec_TCC1: OBLIGATION FORALL (n: below[N]): n + 1 <= N;


decl_type: tcc
theory: bv_adder
library: bitvectors
signature: nil
location: 122 0 124 999
body:
  % Subtype TCC generated (at line 83, column 26) for  N - 1
      % expected type  below[N]
  adder_correct_TCC1: OBLIGATION N - 1 >= 0 AND N - 1 < N;


decl_type: formula
theory: bv_rotate
library: bitvectors
signature: nil
location: 33 2 34 75
body:
    rotate_right_lem : LEMMA rotate_right(k,bv)^i =
                               IF i+k < N THEN bv^(i+k) ELSE bv^(i+k-N) ENDIF


decl_type: formula
theory: bv_rotate
library: bitvectors
signature: nil
location: 38 2 39 76
body:
    rotate_left_lem  : LEMMA rotate_left(k,bv)^i = 
                               IF i-k >= 0 THEN bv^(i-k) ELSE bv^(N+i-k) ENDIF


decl_type: function
theory: bv_rotate
library: bitvectors
signature: [[upto(N), bvec[N]] -> bvec[N]]
location: 15 2 17 40
body:
    rotate_right(k: upto(N), bv: bvec[N]): bvec[N] = 
       IF (k = 0) OR (k = N) THEN bv 
       ELSE bv^(k-1,0) o bv^(N-1, k) ENDIF


decl_type: function
theory: bv_rotate
library: bitvectors
signature: [[upto(N), bvec[N]] -> bvec[N]]
location: 19 2 21 44
body:
    rotate_left(k: upto(N), bv: bvec[N]): bvec[N] =
       IF (k=0) OR (k = N) THEN bv 
       ELSE bv^(N-k-1, 0) o bv^(N-1,N-k) ENDIF


decl_type: tcc
theory: bv_rotate
library: bitvectors
signature: nil
location: 50 0 54 999
body:
  % Subtype TCC generated (at line 17, column 14) for  k - 1
      % expected type  below(N)
  rotate_right_TCC1: OBLIGATION
    FORALL (k: upto(N)):
      NOT (k = 0) AND NOT (k = N) IMPLIES k - 1 >= 0 AND k - 1 < N;


decl_type: tcc
theory: bv_rotate
library: bitvectors
signature: nil
location: 56 0 59 999
body:
  % Subtype TCC generated (at line 17, column 18) for  0
      % expected type  upto(k - 1)
  rotate_right_TCC2: OBLIGATION
    FORALL (k: upto(N)): NOT (k = 0) AND NOT (k = N) IMPLIES 0 <= k - 1;


decl_type: tcc
theory: bv_rotate
library: bitvectors
signature: nil
location: 61 0 65 999
body:
  % Subtype TCC generated (at line 17, column 27) for  N - 1
      % expected type  below(N)
  rotate_right_TCC3: OBLIGATION
    FORALL (k: upto(N)):
      NOT (k = 0) AND NOT (k = N) IMPLIES N - 1 >= 0 AND N - 1 < N;


decl_type: tcc
theory: bv_rotate
library: bitvectors
signature: nil
location: 67 0 70 999
body:
  % Subtype TCC generated (at line 17, column 32) for  k
      % expected type  upto(N - 1)
  rotate_right_TCC4: OBLIGATION
    FORALL (k: upto(N)): NOT (k = 0) AND NOT (k = N) IMPLIES k <= N - 1;


decl_type: tcc
theory: bv_rotate
library: bitvectors
signature: nil
location: 72 0 75 999
body:
  % Subtype TCC generated (at line 17, column 27) for  N - k
      % expected type  nat
  rotate_right_TCC5: OBLIGATION
    FORALL (k: upto(N)): NOT (k = 0) AND NOT (k = N) IMPLIES N - k >= 0;


decl_type: tcc
theory: bv_rotate
library: bitvectors
signature: nil
location: 77 0 81 999
body:
  % Subtype TCC generated (at line 21, column 14) for  N - k - 1
      % expected type  below(N)
  rotate_left_TCC1: OBLIGATION
    FORALL (k: upto(N)):
      NOT (k = 0) AND NOT (k = N) IMPLIES N - k - 1 >= 0 AND N - k - 1 < N;


decl_type: tcc
theory: bv_rotate
library: bitvectors
signature: nil
location: 83 0 86 999
body:
  % Subtype TCC generated (at line 21, column 21) for  0
      % expected type  upto(N - 1 - k)
  rotate_left_TCC2: OBLIGATION
    FORALL (k: upto(N)): NOT (k = 0) AND NOT (k = N) IMPLIES 0 <= N - 1 - k;


decl_type: tcc
theory: bv_rotate
library: bitvectors
signature: nil
location: 88 0 92 999
body:
  % Subtype TCC generated (at line 21, column 34) for  N - k
      % expected type  upto(N - 1)
  rotate_left_TCC3: OBLIGATION
    FORALL (k: upto(N)):
      NOT (k = 0) AND NOT (k = N) IMPLIES N - k >= 0 AND N - k <= N - 1;


decl_type: tcc
theory: bv_rotate
library: bitvectors
signature: nil
location: 94 0 96 999
body:
  % Subtype TCC generated (at line 23, column 46) for  1
      % expected type  upto(N)
  rot_r1_TCC1: OBLIGATION 1 <= N;


decl_type: tcc
theory: bv_rotate
library: bitvectors
signature: nil
location: 98 0 100 999
body:
  % Subtype TCC generated (at line 31, column 40) for  0
      % expected type  upto(N)
  rotate_right_0_TCC1: OBLIGATION 0 <= N;


decl_type: tcc
theory: bv_rotate
library: bitvectors
signature: nil
location: 102 0 106 999
body:
  % Subtype TCC generated (at line 34, column 63) for  (i + k - N)
      % expected type  below[N]
  rotate_right_lem_TCC1: OBLIGATION
    FORALL (i: below(N), k: upto(N)):
      NOT i + k < N IMPLIES (i + k - N) >= 0 AND (i + k - N) < N;


decl_type: tcc
theory: bv_rotate
library: bitvectors
signature: nil
location: 108 0 111 999
body:
  % Subtype TCC generated (at line 39, column 50) for  (i - k)
      % expected type  below[N]
  rotate_left_lem_TCC1: OBLIGATION
    FORALL (i: below(N), k: upto(N)): i - k >= 0 IMPLIES (i - k) < N;


decl_type: tcc
theory: bv_rotate
library: bitvectors
signature: nil
location: 113 0 117 999
body:
  % Subtype TCC generated (at line 39, column 64) for  (N + i - k)
      % expected type  below[N]
  rotate_left_lem_TCC2: OBLIGATION
    FORALL (i: below(N), k: upto(N)):
      NOT i - k >= 0 IMPLIES (N + i - k) >= 0 AND (N + i - k) < N;


decl_type: function
theory: bv_shift
library: bitvectors
signature: [[nat, bvec[N]] -> bvec[N]]
location: 20 2 23 29
body:
    right_shift(i: nat, bv: bvec[N]): bvec[N] =
      IF i = 0 THEN bv
      ELSIF i < N THEN fill[i](FALSE) o bv^(N-1, i) 
      ELSE fill[N](FALSE) ENDIF


decl_type: function
theory: bv_shift
library: bitvectors
signature: [[nat, bvec[N]] -> bvec[N]]
location: 26 2 29 29
body:
    left_shift(i: nat, bv: bvec[N]): bvec[N] =
      IF i = 0 THEN bv
      ELSIF i < N THEN bv^(N-i-1, 0) o fill[i](FALSE) 
      ELSE fill[N](FALSE) ENDIF


decl_type: function
theory: bv_shift
library: bitvectors
signature: [[k: upto(N), bvec[k], bvec[N]] -> bvec[N]]
location: 37 2 39 35
body:
    left_shift_with(k: upto(N), bvk: bvec[k], bv: bvec[N]): bvec[N] =
       IF k = N THEN bvk
       ELSE bv^(N-k-1, 0) o bvk ENDIF


decl_type: function
theory: bv_shift
library: bitvectors
signature: [[k: upto(N), bvec[k], bvec[N]] -> bvec[N]]
location: 41 2 43 33
body:
    right_shift_with(k: upto(N), bvk: bvec[k], bv: bvec[N]): bvec[N] =
       IF k = N THEN bvk
       ELSE bvk o bv^(N-1, k) ENDIF


decl_type: tcc
theory: bv_shift
library: bitvectors
signature: nil
location: 50 0 53 999
body:
  % Subtype TCC generated (at line 22, column 42) for  N - 1
      % expected type  below(N)
  right_shift_TCC1: OBLIGATION
    FORALL (i: nat): i < N AND NOT i = 0 IMPLIES N - 1 >= 0 AND N - 1 < N;


decl_type: tcc
theory: bv_shift
library: bitvectors
signature: nil
location: 55 0 58 999
body:
  % Subtype TCC generated (at line 22, column 47) for  i
      % expected type  upto(N - 1)
  right_shift_TCC2: OBLIGATION
    FORALL (i: nat): i < N AND NOT i = 0 IMPLIES i <= N - 1;


decl_type: tcc
theory: bv_shift
library: bitvectors
signature: nil
location: 60 0 63 999
body:
  % Subtype TCC generated (at line 22, column 42) for  N - i
      % expected type  nat
  right_shift_TCC3: OBLIGATION
    FORALL (i: nat): i < N AND NOT i = 0 IMPLIES N - i >= 0;


decl_type: tcc
theory: bv_shift
library: bitvectors
signature: nil
location: 65 0 69 999
body:
  % Subtype TCC generated (at line 28, column 25) for  N - i - 1
      % expected type  below(N)
  left_shift_TCC1: OBLIGATION
    FORALL (i: nat):
      i < N AND NOT i = 0 IMPLIES N - i - 1 >= 0 AND N - i - 1 < N;


decl_type: tcc
theory: bv_shift
library: bitvectors
signature: nil
location: 71 0 74 999
body:
  % Subtype TCC generated (at line 28, column 32) for  0
      % expected type  upto(N - 1 - i)
  left_shift_TCC2: OBLIGATION
    FORALL (i: nat): i < N AND NOT i = 0 IMPLIES 0 <= N - 1 - i;


decl_type: tcc
theory: bv_shift
library: bitvectors
signature: nil
location: 76 0 80 999
body:
  % Subtype TCC generated (at line 38, column 19) for  bvk
      % expected type  bvec[N]
  left_shift_with_TCC1: OBLIGATION
    FORALL (k: upto(N), bvk: bvec[k]):
      k = N IMPLIES (FORALL (x: nat): bvk(x) IMPLIES (x < k IFF x < N));


decl_type: tcc
theory: bv_shift
library: bitvectors
signature: nil
location: 82 0 85 999
body:
  % Subtype TCC generated (at line 39, column 14) for  N - k - 1
      % expected type  below(N)
  left_shift_with_TCC2: OBLIGATION
    FORALL (k: upto(N)): NOT k = N IMPLIES N - k - 1 >= 0 AND N - k - 1 < N;


decl_type: tcc
theory: bv_shift
library: bitvectors
signature: nil
location: 87 0 90 999
body:
  % Subtype TCC generated (at line 39, column 21) for  0
      % expected type  upto(N - 1 - k)
  left_shift_with_TCC3: OBLIGATION
    FORALL (k: upto(N)): NOT k = N IMPLIES 0 <= N - 1 - k;


decl_type: tcc
theory: bv_shift
library: bitvectors
signature: nil
location: 92 0 95 999
body:
  % Subtype TCC generated (at line 39, column 14) for  N - k
      % expected type  nat
  left_shift_with_TCC4: OBLIGATION
    FORALL (k: upto(N)): NOT k = N IMPLIES N - k >= 0;


decl_type: tcc
theory: bv_shift
library: bitvectors
signature: nil
location: 97 0 100 999
body:
  % Subtype TCC generated (at line 43, column 20) for  N - 1
      % expected type  below(N)
  right_shift_with_TCC1: OBLIGATION
    FORALL (k: upto(N)): NOT k = N IMPLIES N - 1 >= 0 AND N - 1 < N;


decl_type: tcc
theory: bv_shift
library: bitvectors
signature: nil
location: 102 0 105 999
body:
  % Subtype TCC generated (at line 43, column 25) for  k
      % expected type  upto(N - 1)
  right_shift_with_TCC2: OBLIGATION
    FORALL (k: upto(N)): NOT k = N IMPLIES k <= N - 1;


decl_type: tcc
theory: bv_fract
library: bitvectors
signature: nil
location: 49 0 51 999
body:
  % Subtype TCC generated (at line 19, column 52) for  N - 1
      % expected type  nat
  fract_numerator_range_TCC1: OBLIGATION N - 1 >= 0;


decl_type: tcc
theory: bv_fract
library: bitvectors
signature: nil
location: 53 0 55 999
body:
  % Subtype TCC generated (at line 24, column 53) for  0
      % expected type  bv2fract_range
  bv2fract_range_TCC1: OBLIGATION bv2fract_range(0);


decl_type: tcc
theory: bv_fract
library: bitvectors
signature: nil
location: 57 0 59 999
body:
  % Subtype TCC generated (at line 33, column 34) for  1 / exp2(N - 1)
      % expected type  bv2fract_range
  min_pos_fract_TCC1: OBLIGATION bv2fract_range(1 / exp2(N - 1));


decl_type: tcc
theory: bv_fract
library: bitvectors
signature: nil
location: 61 0 63 999
body:
  % Subtype TCC generated (at line 34, column 34) for  1 - 1 / exp2(N - 1)
      % expected type  bv2fract_range
  max_pos_fract_TCC1: OBLIGATION bv2fract_range(1 - 1 / exp2(N - 1));


decl_type: tcc
theory: bv_fract
library: bitvectors
signature: nil
location: 65 0 67 999
body:
  % Subtype TCC generated (at line 36, column 34) for  -1 / exp2(N - 1)
      % expected type  bv2fract_range
  min_neg_fract_TCC1: OBLIGATION bv2fract_range(-1 / exp2(N - 1));


decl_type: tcc
theory: bv_fract
library: bitvectors
signature: nil
location: 69 0 71 999
body:
  % Subtype TCC generated (at line 37, column 34) for  -1 + 1 / exp2(N - 1)
      % expected type  bv2fract_range
  max_neg_fract_TCC1: OBLIGATION bv2fract_range(-1 + 1 / exp2(N - 1));


decl_type: formula
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 32 2 38 32
body:
    bvec_induction : LEMMA % :-)
      FORALL(p:PRED[bvec[N]]) :
        p(fill[N](FALSE))
          AND
        (FORALL(bv:bvec[N]) : p(bv) IMPLIES p(bv+1))
          IMPLIES
        FORALL(bv:bvec[N]) : p(bv)


decl_type: formula
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 49 2 53 33
body:
    sum_upper_n : LEMMA % :-)
      FORALL(F : [nat -> nat], high,low,n : nat) :
        low <= n AND n <= high
          IMPLIES
        sigma(low, high, F) >= F(n)


decl_type: formula
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 59 2 63 51
body:
    bv2nat_upperbound : LEMMA % :-)
      FORALL(n:below(N)) :
        bv2nat(bv) < exp2(n) 
          IFF
        FORALL(k:below(N)) : k >= n IMPLIES NOT bv(k)


decl_type: formula
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 65 2 72 27
body:
    bv2nat_upperbound_caret : LEMMA % :-)
      FORALL(n:below(N)) :
        bv2nat[N](bv) < exp2(n) 
          IMPLIES
        bv2nat[N](bv) = IF n = 0
                        THEN 0
                        ELSE bv2nat[n](bv^(n-1,0))
                        ENDIF


decl_type: formula
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 106 2 107 74
body:
    bv2int_plus_widens : LEMMA % :-)
      bv2int[2*N](widen(bv1) + widen(bv2)) = bv2int[N](bv1) + bv2int[N](bv2)


decl_type: formula
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 112 2 116 29
body:
    bv2nat_widen : LEMMA % :-)
      bv2nat(widen(bv)) = IF bv2nat(bv) < exp2(N-1)
                          THEN bv2nat(bv)
                          ELSE bv2nat(bv) + exp2(2*N)-exp2(N)
                          ENDIF


decl_type: formula
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 123 2 126 43
body:
    bv2int_narrow : LEMMA % :-)
      -exp2(N-1) <= bv2int(BV) AND bv2int(BV) < exp2(N-1)
        IMPLIES
      bv2int[N](narrow(BV)) = bv2int[2*N](BV)


decl_type: formula
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 128 2 131 41
body:
    narrow_int2bv : LEMMA % :-)
      -exp2(N-1) <= k AND k < exp2(N-1)
        IMPLIES
      narrow(int2bv[2*N](k)) = int2bv[N](k)


decl_type: formula
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 161 2 165 60
body:
    leftshift_inc : LEMMA % :-)
      FORALL(n:below(N-1)) : 
        n > 0  % Condition needed to prevent circular rewriting
          IMPLIES
        left_shift(n+1, bv) = left_shift(1, left_shift(n, bv))


decl_type: formula
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 167 2 171 54
body:
    bv2nat_leftshift : LEMMA % :-)
      FORALL(n:below(N)) :
        bv2nat(bv) < exp2(N-n) 
          IMPLIES 
        bv2nat(left_shift(n, bv)) = exp2(n) * bv2nat(bv)


decl_type: formula
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 173 2 175 56
body:
    bv2nat_rightshift_upperbound : LEMMA % :-)
      FORALL(n:below(N)) :
        exp2(n) * bv2nat(right_shift(n, bv)) <= bv2nat(bv)


decl_type: formula
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 177 2 181 56
body:
    bv2int_rightshift_upperbound : LEMMA % :-)
      FORALL(n:below(N)) : 
        bv2int(bv) >= 0
          IMPLIES
        exp2(n) * bv2int(right_shift(n, bv)) <= bv2int(bv)


decl_type: formula
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 186 2 190 63
body:
    rightshift_inc : LEMMA % :-)
      FORALL(n:below(N-1)) :
        n > 0  % Condition needed to prevent circular rewriting
          IMPLIES
        right_shift(n+1, bv) = right_shift(1, right_shift(n, bv))


decl_type: formula
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 196 2 200 39
body:
    leftshift1_add_aux : LEMMA % :-)
      FORALL(n:below(N-1)) : 
        n_cout_rec[N](n+1, left_shift(1, bv1), left_shift(1, bv2), FALSE)
        =
        n_cout_rec[N](n, bv1, bv2, FALSE)


decl_type: formula
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 202 2 204 44
body:
    leftshift1_add : LEMMA % :-)
     left_shift(1, bv1 + bv2) = 
       left_shift(1, bv1) + left_shift(1, bv2)


decl_type: formula
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 206 2 210 61
body:
    narrow_rightshift : LEMMA % :-)
      FORALL(n:nat) :
      0 <= bv2int(BV) AND bv2int(BV) < exp2(N)
          IMPLIES
        narrow(right_shift(n, BV)) = right_shift(n, narrow(BV))


decl_type: function
theory: BitvectorUtil
library: bitvectors
signature: [bvec[N] -> bvec[2 * N]]
location: 94 2 98 32
body:
    widen(bv) : bvec[2*N] = 
      LAMBDA(k:below(2*N)) : IF k < N-1
                             THEN bv(k) 
                             ELSE bv(N-1) % negative byte
                             ENDIF


decl_type: tcc
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 217 0 219 999
body:
  % Subtype TCC generated (at line 22, column 26) for  N
      % expected type  posnat
  plus_min_zero_TCC1: OBLIGATION N > 0;


decl_type: tcc
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 221 0 223 999
body:
  % Subtype TCC generated (at line 47, column 11) for  0
      % expected type  below(N)
  inc_zero_TCC1: OBLIGATION 0 < N;


decl_type: tcc
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 225 0 229 999
body:
  % Subtype TCC generated (at line 71, column 41) for  n - 1
      % expected type  below(N)
  bv2nat_upperbound_caret_TCC1: OBLIGATION
    FORALL (bv: bvec[N], n: below(N)):
      NOT n = 0 AND bv2nat[N](bv) < exp2(n) IMPLIES n - 1 >= 0 AND n - 1 < N;


decl_type: tcc
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 231 0 235 999
body:
  % Subtype TCC generated (at line 71, column 45) for  0
      % expected type  upto(n - 1)
  bv2nat_upperbound_caret_TCC2: OBLIGATION
    FORALL (bv: bvec[N], n: below(N)):
      NOT n = 0 AND bv2nat[N](bv) < exp2(n) IMPLIES 0 <= n - 1;


decl_type: tcc
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 237 0 239 999
body:
  % Subtype TCC generated (at line 96, column 35) for  k
      % expected type  below(N)
  widen_TCC1: OBLIGATION FORALL (k: below(2 * N)): k < N - 1 IMPLIES k < N;


decl_type: tcc
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 241 0 244 999
body:
  % Subtype TCC generated (at line 97, column 35) for  N - 1
      % expected type  below(N)
  widen_TCC2: OBLIGATION
    FORALL (k: below(2 * N)): NOT k < N - 1 IMPLIES N - 1 >= 0 AND N - 1 < N;


decl_type: tcc
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 246 0 248 999
body:
  % Subtype TCC generated (at line 101, column 11) for  2 * N
      % expected type  posnat
  bv2int_widen_TCC1: OBLIGATION 2 * N > 0;


decl_type: tcc
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 250 0 252 999
body:
  % Subtype TCC generated (at line 113, column 45) for  N - 1
      % expected type  nat
  bv2nat_widen_TCC1: OBLIGATION N - 1 >= 0;


decl_type: tcc
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 254 0 256 999
body:
  % Subtype TCC generated (at line 121, column 29) for  N - 1
      % expected type  below(2 * N)
  narrow_TCC1: OBLIGATION N - 1 >= 0 AND N - 1 < 2 * N;


decl_type: tcc
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 258 0 260 999
body:
  % Subtype TCC generated (at line 121, column 33) for  0
      % expected type  upto(N - 1)
  narrow_TCC2: OBLIGATION 0 <= N - 1;


decl_type: tcc
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 262 0 267 999
body:
  % Subtype TCC generated (at line 131, column 23) for  k
      % expected type  iv: rng_2s_comp[2 * N]
  narrow_int2bv_TCC1: OBLIGATION
    FORALL (k: int):
      k < exp2(N - 1) AND -exp2(N - 1) <= k IMPLIES
       minint[2 * N] <= k AND k <= maxint[2 * N];


decl_type: tcc
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 269 0 274 999
body:
  % Subtype TCC generated (at line 131, column 39) for  k
      % expected type  iv: rng_2s_comp[N]
  narrow_int2bv_TCC2: OBLIGATION
    FORALL (k: int):
      k < exp2(N - 1) AND -exp2(N - 1) <= k IMPLIES
       minint[N] <= k AND k <= maxint[N];


decl_type: tcc
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 276 0 278 999
body:
  % Subtype TCC generated (at line 169, column 24) for  N - n
      % expected type  nat
  bv2nat_leftshift_TCC1: OBLIGATION FORALL (n: below(N)): N - n >= 0;


decl_type: tcc
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 280 0 282 999
body:
  % Subtype TCC generated (at line 198, column 20) for  n + 1
      % expected type  below[N]
  leftshift1_add_aux_TCC1: OBLIGATION FORALL (n: below(N - 1)): n + 1 < N;


decl_type: tcc
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 284 0 286 999
body:
  % Subtype TCC generated (at line 200, column 20) for  n
      % expected type  below[N]
  leftshift1_add_aux_TCC2: OBLIGATION FORALL (n: below(N - 1)): n < N;


decl_type: formula
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 41 2 43 55
body:
    times_rec_zero_right : LEMMA % :-)
      FORALL(n:nat) : 
        times_rec(bv, fill[N](FALSE), n) = fill[N](FALSE)


decl_type: formula
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 45 2 47 55
body:
    times_rec_zero_left : LEMMA % :-)
      FORALL(n:nat) : 
        times_rec(fill[N](FALSE), bv, n) = fill[N](FALSE)


decl_type: formula
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 49 2 53 55
body:
    times_rec_repeat : LEMMA % :-)
      FORALL(n,m:nat) : 
        bv2nat(bv1) < exp2(n)
          IMPLIES
        times_rec(bv1, bv2, n+m) = times_rec(bv1, bv2, n)


decl_type: formula
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 65 2 71 40
body:
    times_rec_inc_right : LEMMA % :-)
      FORALL(n:below(N+1)) : 
        times_rec(bv1, bv2+1, n) = 
          times_rec(bv1, bv2, n) + (IF n = 0
                                    THEN fill[N](FALSE)
                                    ELSE (fill[N-n](FALSE) o bv1 ^ (n-1, 0))
                                    ENDIF)


decl_type: formula
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 73 2 75 34
body:
    times_rec_max_inc_right : LEMMA % :-)
      times_rec(bv1, bv2+1, N) = 
        times_rec(bv1, bv2, N) + bv1


decl_type: formula
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 77 2 81 48
body:
    times_rec_max_inc_n_right : LEMMA % :-)
      FORALL(n:nat) : 
        times_rec(bv1, bv2+n, N) =
          iterate[bvec[N]](LAMBDA(b:bvec[N]) : b + bv1, n)
                          (times_rec(bv1, bv2, N))


decl_type: formula
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 83 2 86 38
body:
    times_rec_iterate : LEMMA % :-)
      times_rec(bv1, bv2, N) =
        iterate[bvec[N]](LAMBDA(b:bvec[N]) : b + bv1, bv2nat(bv2))
                        (fill[N](FALSE))


decl_type: formula
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 91 2 96 25
body:
    bv2nat_iterate : LEMMA % :-)
      FORALL(n:nat) :
        n * bv2nat(bv1) < exp2(N) 
          IMPLIES
        bv2nat(iterate[bvec[N]](LAMBDA(b:bvec[N]) : b + bv1, n)(fill[N](FALSE)))
          = n * bv2nat(bv1)


decl_type: formula
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 98 2 103 25
body:
    bv2int_iterate : LEMMA % :-)
      FORALL(n:nat) :
        -exp2(N-1) <= n * bv2int(bv1) AND n * bv2int(bv1) < exp2(N-1) 
          IMPLIES
        bv2int(iterate[bvec[N]](LAMBDA(b:bvec[N]) : b + bv1, n)(fill[N](FALSE)))
          = n * bv2int(bv1)


decl_type: formula
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 107 2 113 40
body:
    iterate_inc : LEMMA % :-)
      FORALL(n:nat) :
        iterate[bvec[N]](LAMBDA (b:bvec[N]): b + (bv1 + 1), n)
                        (fill[N](FALSE))
        =
        iterate[bvec[N]](LAMBDA (b:bvec[N]): b + bv1, n)
                      (fill[N](FALSE)) + n


decl_type: formula
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 115 2 121 46
body:
    iterate_inc_m : LEMMA % :-)
      FORALL(n,m:nat) :
        iterate[bvec[N]](LAMBDA (b:bvec[N]): b + (bv1 + m), n)
                        (fill[N](FALSE))
        =
        iterate[bvec[N]](LAMBDA (b:bvec[N]): b + bv1, n)
                      (fill[N](FALSE)) + (n * m)


decl_type: formula
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 123 2 128 20
body:
    iterate_modulo : LEMMA % :-)
      FORALL(i:nat) : 
        iterate[bvec[N]](LAMBDA(b:bvec[N]) : b + bv2, i * exp2(N))
                        (fill[N](FALSE))    
        = 
        fill[N](FALSE)


decl_type: formula
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 130 2 135 36
body:
    iterate_comm : LEMMA % :-)
      iterate[bvec[N]](LAMBDA(b:bvec[N]) : b + bv1, bv2nat(bv2))
                      (fill[N](FALSE))    
      =
      iterate[bvec[N]](LAMBDA(b:bvec[N]) : b + bv2, bv2nat(bv1))
                      (fill[N](FALSE))    


decl_type: formula
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 145 2 151 38
body:
    iterate_min_second : LEMMA % :-)
      FORALL(n:nat) : 
        iterate[bvec[N]](LAMBDA(b:bvec[N]) : b + (-bv), n)
                        (fill[N](FALSE))    
        =
        -iterate[bvec[N]](LAMBDA(b:bvec[N]) : b + bv, n)
                        (fill[N](FALSE))    


decl_type: formula
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 183 2 189 44
body:
    iterate_zero_add : LEMMA % :-)
      FORALL(n:nat) : 
        iterate[bvec[N]](LAMBDA(b:bvec[N]) : b + bv1, n)
                        (bv2)    
        =
        iterate[bvec[N]](LAMBDA(b:bvec[N]) : b + bv1, n)
                        (fill[N](FALSE)) + bv2


decl_type: formula
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 191 2 194 51
body:
    times_rec_distr : LEMMA % :-)
      times_rec(bv1, bv2 + bv3, N)
      =
      times_rec(bv1, bv2, N) + times_rec(bv1, bv3, N)


decl_type: formula
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 202 2 206 78
body:
    times_distr_iterate : LEMMA % :-)
      FORALL(n:nat) :
        bv2 * iterate[bvec[N]](LAMBDA(b:bvec[N]) : b + bv1, n)(fill[N](FALSE))
        =
        iterate[bvec[N]](LAMBDA(b:bvec[N]) : b + (bv2 * bv1), n)(fill[N](FALSE))


decl_type: function
theory: BitvectorMultiplication
library: bitvectors
signature: [[bvec[N], bvec[N], nat] -> bvec[N]]
location: 24 2 31 14
body:
    times_rec(bv1:bvec[N], bv2:bvec[N], n:nat) : RECURSIVE bvec[N] =
      IF n = 0
      THEN fill[N](FALSE)
      ELSIF bv1(0)
      THEN bv2 + left_shift(1, times_rec(right_shift(1, bv1), bv2, n-1))
      ELSE left_shift(1, times_rec(right_shift(1, bv1), bv2, n-1))
      ENDIF
      MEASURE n;


decl_type: tcc
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 225 0 227 999
body:
  % Assuming TCC generated (at line 20, column 12) for  BitvectorUtil[N]
      % generated from assumption BitvectorUtil.N_size
  IMP_BitvectorUtil_TCC1: OBLIGATION N >= 2;


decl_type: tcc
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 229 0 231 999
body:
  % Subtype TCC generated (at line 27, column 14) for  0
      % expected type  below(N)
  times_rec_TCC1: OBLIGATION FORALL (n: nat): NOT n = 0 IMPLIES 0 < N;


decl_type: tcc
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 233 0 236 999
body:
  % Subtype TCC generated (at line 28, column 65) for  n - 1
      % expected type  nat
  times_rec_TCC2: OBLIGATION
    FORALL (bv1: bvec[N], n: nat): bv1(0) AND NOT n = 0 IMPLIES n - 1 >= 0;


decl_type: tcc
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 238 0 241 999
body:
  % Termination TCC generated (at line 28, column 29) for
      % times_rec(right_shift(1, bv1), bv2, n - 1)
  times_rec_TCC3: OBLIGATION
    FORALL (bv1: bvec[N], n: nat): bv1(0) AND NOT n = 0 IMPLIES n - 1 < n;


decl_type: tcc
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 243 0 247 999
body:
  % Subtype TCC generated (at line 29, column 59) for  n - 1
      % expected type  nat
  times_rec_TCC4: OBLIGATION
    FORALL (bv1: bvec[N], n: nat):
      NOT bv1(0) AND NOT n = 0 IMPLIES n - 1 >= 0;


decl_type: tcc
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 249 0 252 999
body:
  % Termination TCC generated (at line 29, column 23) for
      % times_rec(right_shift(1, bv1), bv2, n - 1)
  times_rec_TCC5: OBLIGATION
    FORALL (bv1: bvec[N], n: nat): NOT bv1(0) AND NOT n = 0 IMPLIES n - 1 < n;


decl_type: tcc
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 254 0 257 999
body:
  % Subtype TCC generated (at line 70, column 45) for  N - n
      % expected type  nat
  times_rec_inc_right_TCC1: OBLIGATION
    FORALL (n: below(N + 1)): NOT n = 0 IMPLIES N - n >= 0;


decl_type: tcc
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 259 0 262 999
body:
  % Subtype TCC generated (at line 70, column 66) for  n - 1
      % expected type  below(N)
  times_rec_inc_right_TCC2: OBLIGATION
    FORALL (n: below(N + 1)): NOT n = 0 IMPLIES n - 1 >= 0 AND n - 1 < N;


decl_type: tcc
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 264 0 267 999
body:
  % Subtype TCC generated (at line 70, column 71) for  0
      % expected type  upto(n - 1)
  times_rec_inc_right_TCC3: OBLIGATION
    FORALL (n: below(N + 1)): NOT n = 0 IMPLIES 0 <= n - 1;


decl_type: tcc
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 269 0 271 999
body:
  % Subtype TCC generated (at line 100, column 12) for  N - 1
      % expected type  nat
  bv2int_iterate_TCC1: OBLIGATION N - 1 >= 0;


decl_type: formula
theory: BitvectorMultiplicationWidenNarrow
library: bitvectors
signature: nil
location: 28 2 31 69
body:
    bv2nat_times_rec : LEMMA % :-)
      bv2nat(BV1) < exp2(N) AND bv2nat(BV2) < exp2(N)
        IMPLIES
      bv2nat(times_rec[2*N](BV1, BV2, 2*N)) = bv2nat(BV1) * bv2nat(BV2)


decl_type: formula
theory: BitvectorMultiplicationWidenNarrow
library: bitvectors
signature: nil
location: 33 2 36 49
body:
    bv2nat_times : LEMMA % :-)
      bv2nat(BV1) * bv2nat(BV2) < exp2(2*N)
        IMPLIES
      bv2nat(BV1 * BV2) = bv2nat(BV1) * bv2nat(BV2)


decl_type: formula
theory: BitvectorMultiplicationWidenNarrow
library: bitvectors
signature: nil
location: 38 2 43 49
body:
    bv2int_times : LEMMA % :-)
     -exp2(2*N-1) < bv2int(BV1) * bv2int(BV2) 
       AND 
     bv2int(BV1) * bv2int(BV2) < exp2(2*N-1)
        IMPLIES
      bv2int(BV1 * BV2) = bv2int(BV1) * bv2int(BV2)


decl_type: formula
theory: BitvectorMultiplicationWidenNarrow
library: bitvectors
signature: nil
location: 50 2 56 54
body:
    bv2int_times_int2bv_first : LEMMA % :-)
      FORALL(k:int) :
       -exp2(2*N-1) < k * bv2int(BV) AND k * bv2int(BV) < exp2(2*N-1)      
         AND
       -exp2(2*N-1) <= k AND k < exp2(2*N-1)      
         IMPLIES
       bv2int[2*N](int2bv[2*N](k) * BV) = k * bv2int(BV)


decl_type: formula
theory: BitvectorMultiplicationWidenNarrow
library: bitvectors
signature: nil
location: 58 2 64 54
body:
    bv2int_times_int2bv_second : LEMMA % :-)
      FORALL(k:int) :
       -exp2(2*N-1) < k * bv2int(BV) AND k * bv2int(BV) < exp2(2*N-1)      
         AND
       -exp2(2*N-1) <= k AND k < exp2(2*N-1)      
         IMPLIES
       bv2int[2*N](BV * int2bv[2*N](k)) = k * bv2int(BV)


decl_type: formula
theory: BitvectorMultiplicationWidenNarrow
library: bitvectors
signature: nil
location: 68 2 73 78
body:
    narrow_iterate : LEMMA % :-)
      FORALL(n:nat) :
        narrow(iterate[bvec[2*N]](LAMBDA(b:bvec[2*N]) : b + BV1, n)
                                 (fill[2*N](FALSE)))
        =
        iterate[bvec[N]](LAMBDA(b:bvec[N]) : b + narrow(BV1), n)(fill[N](FALSE))


decl_type: tcc
theory: BitvectorMultiplicationWidenNarrow
library: bitvectors
signature: nil
location: 105 0 108 999
body:
  % Assuming TCC generated (at line 19, column 12) for
      % BitvectorMultiplication[N]
      % generated from assumption BitvectorMultiplication.N_size
  IMP_BitvectorMultiplication_TCC1: OBLIGATION N >= 2;


decl_type: tcc
theory: BitvectorMultiplicationWidenNarrow
library: bitvectors
signature: nil
location: 110 0 113 999
body:
  % Assuming TCC generated (at line 20, column 12) for
      % BitvectorMultiplication[2 * N]
      % generated from assumption BitvectorMultiplication.N_size
  IMP_BitvectorMultiplication_TCC2: OBLIGATION 2 * N >= 2;


decl_type: tcc
theory: BitvectorMultiplicationWidenNarrow
library: bitvectors
signature: nil
location: 115 0 117 999
body:
  % Subtype TCC generated (at line 39, column 9) for  2 * N - 1
      % expected type  nat
  bv2int_times_TCC1: OBLIGATION 2 * N - 1 >= 0;


decl_type: tcc
theory: BitvectorMultiplicationWidenNarrow
library: bitvectors
signature: nil
location: 119 0 126 999
body:
  % Subtype TCC generated (at line 56, column 29) for  k
      % expected type  iv: rng_2s_comp[2 * N]
  bv2int_times_int2bv_first_TCC1: OBLIGATION
    FORALL (BV: bvec[2 * N], k: int):
      -exp2(2 * N - 1) < k * bv2int(BV) AND
       k * bv2int(BV) < exp2(2 * N - 1) AND
        -exp2(2 * N - 1) <= k AND k < exp2(2 * N - 1)
       IMPLIES minint[2 * N] <= k AND k <= maxint[2 * N];


decl_type: tcc
theory: BitvectorMultiplicationWidenNarrow
library: bitvectors
signature: nil
location: 128 0 130 999
body:
  % Subtype TCC generated (at line 76, column 38) for  2 * N - 1
      % expected type  below(2 * N)
  bv2nat_split_TCC1: OBLIGATION 2 * N - 1 >= 0 AND 2 * N - 1 < 2 * N;


decl_type: tcc
theory: BitvectorMultiplicationWidenNarrow
library: bitvectors
signature: nil
location: 132 0 134 999
body:
  % Subtype TCC generated (at line 76, column 44) for  N
      % expected type  upto(2 * N - 1)
  bv2nat_split_TCC2: OBLIGATION N <= 2 * N - 1;


decl_type: tcc
theory: BitvectorMultiplicationWidenNarrow
library: bitvectors
signature: nil
location: 136 0 138 999
body:
  % Subtype TCC generated (at line 76, column 61) for  N - 1
      % expected type  below(2 * N)
  bv2nat_split_TCC3: OBLIGATION N - 1 >= 0 AND N - 1 < 2 * N;


decl_type: tcc
theory: BitvectorMultiplicationWidenNarrow
library: bitvectors
signature: nil
location: 140 0 142 999
body:
  % Subtype TCC generated (at line 76, column 65) for  0
      % expected type  upto(N - 1)
  bv2nat_split_TCC4: OBLIGATION 0 <= N - 1;


decl_type: formula
theory: DivisionUtil
library: bitvectors
signature: nil
location: 18 2 22 79
body:
    leftshift_with : LEMMA % :-)
      FORALL(n:nat, bv:bvec[n], b:bool) : 
        n > 1 AND bv2nat[n](bv) < exp2(n-1)
          IMPLIES
        bv2nat[n](left_shift(1, bv) WITH [(0) := b]) = 2 * bv2nat[n](bv) + b2n(b)


decl_type: formula
theory: DivisionUtil
library: bitvectors
signature: nil
location: 24 2 28 61
body:
    bv2nat_minus3 : LEMMA % :-)
      FORALL(n:posnat, bv1, bv2:bvec[n]) :
        bv2nat[n](bv1) <= bv2nat[n](bv2)
          IMPLIES
        bv2nat[n](bv2 - bv1) = bv2nat[n](bv2) - bv2nat[n](bv1);


decl_type: tcc
theory: DivisionUtil
library: bitvectors
signature: nil
location: 35 0 37 999
body:
  % Subtype TCC generated (at line 20, column 37) for  n - 1
      % expected type  nat
  leftshift_with_TCC1: OBLIGATION FORALL (n: nat): n > 1 IMPLIES n - 1 >= 0;


decl_type: tcc
theory: DivisionUtil
library: bitvectors
signature: nil
location: 39 0 43 999
body:
  % Subtype TCC generated (at line 22, column 41) for  0
      % expected type  below(n)
  leftshift_with_TCC2: OBLIGATION
    FORALL (n: nat, bv: bvec[n]):
      n > 1 AND bv2nat[n](bv) < exp2(n - 1) IMPLIES 0 < n;


decl_type: formula
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 71 2 73 46
body:
    divrem_dvd : LEMMA % :-)
      FORALL(n:below(N+1), k:below(N-n)) :
        divrem(dvd, dvs, rem, n)`1(k+n) = dvd(k)


decl_type: formula
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 75 2 86 38
body:
    divrem_dvs0 : LEMMA % :-)
      FORALL(n:below(N+1)) :
        divrem(dvd, fill[N](FALSE), rem, n) = 
          ((LAMBDA(i:below(N)) : IF i < n
                                 THEN TRUE
                                 ELSE dvd(i-n)
                                 ENDIF),

           (LAMBDA(i:below(N)) : IF i < n
                                 THEN dvd(N-n+i)
                                 ELSE rem(i-n)
                                 ENDIF))


decl_type: formula
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 91 2 103 47
body:
    bv2nat_left_false_inc : LEMMA % :-)
      FORALL(n:below(N)) :
        bv2nat[N](LAMBDA(i:below(N)) :
                    IF i < n+1
                    THEN bv(i)
                    ELSE FALSE
                    ENDIF)
        =
        bv2nat[N](LAMBDA(i:below(N)) :
                    IF i < n
                    THEN bv(i)
                    ELSE FALSE
                    ENDIF) + exp2(n) * b2n(bv(n))


decl_type: formula
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 105 2 117 47
body:
    bv2nat_right_false_inc : LEMMA % :-)
      FORALL(n:below(N)) :
        bv2nat[N](LAMBDA(i:below(N)) :
                    IF i < n
                    THEN FALSE
                    ELSE bv(i)
                    ENDIF) 
        =
        bv2nat[N](LAMBDA(i:below(N)) :
                    IF i < n+1
                    THEN FALSE
                    ELSE bv(i)
                    ENDIF) + exp2(n) * b2n(bv(n))


decl_type: formula
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 119 2 131 53
body:
    bv2nat_left_false_dec : LEMMA % :-)
      FORALL(n:below(N)) :
        bv2nat[N](LAMBDA(i:below(N)) :
                    IF i < N-n
                    THEN bv(i+n)
                    ELSE FALSE
                    ENDIF)
        =
        bv2nat[N](LAMBDA(i:below(N)) :
                    IF i < N-n-1
                    THEN bv(i+n)
                    ELSE FALSE
                    ENDIF) + exp2(N-n-1) * b2n(bv(N-1))


decl_type: formula
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 133 2 150 36
body:
    bv2nat_split : LEMMA % :-)
      FORALL(m:below(N+1)) :
        bv2nat[N](LAMBDA(i:below(N)) :
                    IF i < m
                    THEN bv1(i+N-m)
                    ELSE bv2(i-m)
                    ENDIF)
        =
        bv2nat[N](LAMBDA(i:below(N)) :
                    IF i < m
                    THEN bv1(i+N-m)
                    ELSE FALSE
                    ENDIF)
        + exp2(m) * bv2nat[N](LAMBDA(i:below(N)) :
                                IF i < N-m
                                THEN bv2(i)
                                ELSE FALSE
                                ENDIF)


decl_type: formula
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 152 2 165 18
body:
    bv2nat_left_false_minus : LEMMA % :-)
      FORALL(n:below(N)) :
        bv2nat[N](LAMBDA (i: below(N)):
                    IF i < N - n
                    THEN bv(i + n)
                    ELSE FALSE
                    ENDIF)
        =
        2 * bv2nat[N](LAMBDA (i: below(N)):
                    IF i < N - n - 1
                    THEN bv(1 + i + n)
                    ELSE FALSE
                    ENDIF)
        + b2n(bv(n))


decl_type: formula
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 167 2 168 71
body:
    bv2nat_leftshift_exp : LEMMA % :-)
      bv2nat(bv) = bv2nat(left_shift(1, bv))/2 + exp2(N-1) * b2n(bv(N-1))


decl_type: formula
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 207 2 223 22
body:
    divrem_mem_first_second_third : LEMMA % :-)
      FORALL(n:below(N+1)) :
        LET
            drm = divrem_mem(aux, dvs, quot, rem, n),
            dr  = divrem(quot, dvs, (LAMBDA(i:below(N)) : IF i < N-n
                                                          THEN rem(i)
                                                          ELSE FALSE
                                                          ENDIF), n)
        IN 
            drm`1 = (LAMBDA(i:below(N)) : IF i < n
                                          THEN quot(N-n+i)
                                          ELSE aux(i-n)
                                          ENDIF)
              AND
            drm`2 = dr`1
              AND
            drm`3 = dr`2


decl_type: formula
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 225 2 232 47
body:
    divrem_mem_rem : LEMMA % :-)
      FORALL(n:below(N+1)) :
        (LAMBDA(i:below(N)) : IF i < N-n
                              THEN rem(i)
                              ELSE FALSE
                              ENDIF) < dvs 
          IMPLIES 
        divrem_mem(aux, dvs, dvd, rem, n)`3 < dvs


decl_type: formula
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 234 2 235 77
body:
    div_divrem_mem : LEMMA % :-)
      div(dvd, dvs) = divrem_mem(fill[N](FALSE), dvs, dvd, fill[N](FALSE), N)`2


decl_type: formula
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 237 2 238 77
body:
    rem_divrem_mem : LEMMA % :-)
      rem(dvd, dvs) = divrem_mem(fill[N](FALSE), dvs, dvd, fill[N](FALSE), N)`3


decl_type: formula
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 248 2 269 64
body:
    divrem_mem_invariant : LEMMA % :-)
      FORALL(n:below(N+1)) : 
        LET 
            start_n = (LAMBDA(i:below(N)) : IF i < n
                                            THEN quot(N-n+i)
                                            ELSE aux(i-n)
                                            ENDIF),
            quot_n =  (LAMBDA(i:below(N)) : IF i < N-n
                                            THEN quot(i)
                                            ELSE FALSE
                                            ENDIF),
            rem_n =   (LAMBDA(i:below(N)) : IF i < n
                                            THEN quot(N-n+i)
                                            ELSE rem(i-n)
                                            ENDIF),
            drm = divrem_mem(aux, dvs, quot, rem, n)
        IN
            bv2nat[N](start_n) = 
              exp2(n) * bv2nat[N](dvs) * bv2nat[N](quot_n) + bv2nat[N](rem_n)
              IMPLIES
            bv2nat[N](drm`1) = 
              bv2nat[N](dvs) * bv2nat[N](drm`2) + bv2nat[N](drm`3)


decl_type: formula
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 275 2 276 77
body:
    divrem1_eq : LEMMA % :-)
      bv2nat(div(dvd, dvs)) * bv2nat(dvs) + bv2nat(rem(dvd, dvs)) = bv2nat(dvd)


decl_type: formula
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 290 2 294 62
body:
    divrem1_uniqueness : LEMMA % :-)
      FORALL(q,r:nat) : 
        r < bv2nat(dvs) AND q * bv2nat(dvs) + r = bv2nat(dvd)
          IMPLIES
        q = bv2nat(div(dvd, dvs)) AND r = bv2nat(rem(dvd, dvs));


decl_type: function
theory: BitvectorOneComplementDivision
library: bitvectors
signature: [[bvec[N], bvec[N], bvec[N], nat] -> [bvec[N], bvec[N]]]
location: 47 2 59 14
body:
    divrem(dvd, dvs, rem : bvec[N], n : nat) : RECURSIVE [bvec[N], bvec[N]] =
      IF n = 0
      THEN (dvd, rem)
      ELSE LET 
               rem1 = left_shift(1, rem) WITH [(0) := dvd(N-1)],
               dvd1 = left_shift(1, dvd)
           IN
               IF bv2nat[N](dvs) <= bv2nat[N](rem1)
               THEN divrem(dvd1 WITH [(0) := TRUE], dvs, rem1-dvs, n-1)
               ELSE divrem(dvd1, dvs, rem1, n-1)
               ENDIF
      ENDIF
      MEASURE n;


decl_type: function
theory: BitvectorOneComplementDivision
library: bitvectors
signature:
  [[bvec[N], bvec[N], bvec[N], bvec[N], below(1 + N)] ->
  [bvec[N], bvec[N], bvec[N]]]

location: 182 2 203 16
body:
    divrem_mem(aux, dvs, quot, rem : bvec[N], n : below(N+1)) : 
      RECURSIVE [bvec[N], bvec[N], bvec[N]] =
        IF n = 0
        THEN (aux, quot, rem)
        ELSE LET 
                 aux1  = left_shift(1, aux) WITH [(0) := quot(N-1)],
                 rem1  = left_shift(1, rem) WITH [(0) := quot(N-1)],
                 quot1 = left_shift(1, quot)
             IN
                 IF bv2nat[N](dvs) <= bv2nat[N](LAMBDA(i:below(N)) : IF i < N-n+1
                                                                     THEN rem1(i)
                                                                     ELSE FALSE
                                                                     ENDIF)
                 THEN divrem_mem(aux1, dvs, quot1 WITH [(0) := TRUE], 
                                 (LAMBDA(i:below(N)) : IF i < N-n+1
                                                       THEN rem1(i)
                                                       ELSE FALSE
                                                       ENDIF) - dvs, n-1)
                 ELSE divrem_mem(aux1, dvs, quot1, rem1, n-1)
                 ENDIF
        ENDIF
        MEASURE n;


decl_type: tcc
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 307 0 310 999
body:
  % Assuming TCC generated (at line 21, column 12) for
      % BitvectorMultiplication[N]
      % generated from assumption BitvectorMultiplication.N_size
  IMP_BitvectorMultiplication_TCC1: OBLIGATION N >= 2;


decl_type: tcc
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 312 0 321 999
body:
  % Subtype TCC generated (at line 55, column 37) for  0
      % expected type  below(N)
  divrem_TCC1: OBLIGATION
    FORALL (dvd, dvs, rem: bvec[N], n: nat):
      NOT n = 0 IMPLIES
       (FORALL (rem1: bvec[N]):
          rem1 = left_shift(1, rem) WITH [(0) := dvd(N - 1)] IMPLIES
           (FORALL (dvd1: bvec[N]):
              bv2nat[N](dvs) <= bv2nat[N](rem1) AND dvd1 = left_shift(1, dvd)
               IMPLIES 0 < N));


decl_type: tcc
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 323 0 332 999
body:
  % Subtype TCC generated (at line 55, column 65) for  n - 1
      % expected type  nat
  divrem_TCC2: OBLIGATION
    FORALL (dvd, dvs, rem: bvec[N], n: nat):
      NOT n = 0 IMPLIES
       (FORALL (rem1: bvec[N]):
          rem1 = left_shift(1, rem) WITH [(0) := dvd(N - 1)] IMPLIES
           (FORALL (dvd1: bvec[N]):
              bv2nat[N](dvs) <= bv2nat[N](rem1) AND dvd1 = left_shift(1, dvd)
               IMPLIES n - 1 >= 0));


decl_type: tcc
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 334 0 343 999
body:
  % Termination TCC generated (at line 55, column 18) for
      % divrem(dvd1 WITH [(0) := TRUE], dvs, rem1 - dvs, n - 1)
  divrem_TCC3: OBLIGATION
    FORALL (dvd, dvs, rem: bvec[N], n: nat):
      NOT n = 0 IMPLIES
       (FORALL (rem1: bvec[N]):
          rem1 = left_shift(1, rem) WITH [(0) := dvd(N - 1)] IMPLIES
           (FORALL (dvd1: bvec[N]):
              bv2nat[N](dvs) <= bv2nat[N](rem1) AND dvd1 = left_shift(1, dvd)
               IMPLIES n - 1 < n));


decl_type: tcc
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 345 0 355 999
body:
  % Subtype TCC generated (at line 56, column 42) for  n - 1
      % expected type  nat
  divrem_TCC4: OBLIGATION
    FORALL (dvd, dvs, rem: bvec[N], n: nat):
      NOT n = 0 IMPLIES
       (FORALL (rem1: bvec[N]):
          rem1 = left_shift(1, rem) WITH [(0) := dvd(N - 1)] IMPLIES
           (FORALL (dvd1: bvec[N]):
              NOT bv2nat[N](dvs) <= bv2nat[N](rem1) AND
               dvd1 = left_shift(1, dvd)
               IMPLIES n - 1 >= 0));


decl_type: tcc
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 357 0 367 999
body:
  % Termination TCC generated (at line 56, column 18) for
      % divrem(dvd1, dvs, rem1, n - 1)
  divrem_TCC5: OBLIGATION
    FORALL (dvd, dvs, rem: bvec[N], n: nat):
      NOT n = 0 IMPLIES
       (FORALL (rem1: bvec[N]):
          rem1 = left_shift(1, rem) WITH [(0) := dvd(N - 1)] IMPLIES
           (FORALL (dvd1: bvec[N]):
              NOT bv2nat[N](dvs) <= bv2nat[N](rem1) AND
               dvd1 = left_shift(1, dvd)
               IMPLIES n - 1 < n));


decl_type: tcc
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 369 0 371 999
body:
  % Subtype TCC generated (at line 51, column 46) for  0
      % expected type  below(N)
  divrem_TCC6: OBLIGATION FORALL (n: nat): NOT n = 0 IMPLIES 0 < N;


decl_type: tcc
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 373 0 376 999
body:
  % Subtype TCC generated (at line 51, column 56) for  N - 1
      % expected type  below(N)
  divrem_TCC7: OBLIGATION
    FORALL (n: nat): NOT n = 0 IMPLIES N - 1 >= 0 AND N - 1 < N;


decl_type: tcc
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 378 0 381 999
body:
  % Subtype TCC generated (at line 73, column 33) for  k + n
      % expected type  below(N)
  divrem_dvd_TCC1: OBLIGATION
    FORALL (n: below(N + 1), k: below(N - n)): k + n < N;


decl_type: tcc
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 383 0 386 999
body:
  % Subtype TCC generated (at line 73, column 44) for  k
      % expected type  below(N)
  divrem_dvd_TCC2: OBLIGATION
    FORALL (n: below(N + 1), k: below(N - n)): k < N;


decl_type: tcc
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 388 0 392 999
body:
  % Subtype TCC generated (at line 80, column 40) for  i - n
      % expected type  below(N)
  divrem_dvs0_TCC1: OBLIGATION
    FORALL (n: below(N + 1), i: below(N)):
      NOT i < n IMPLIES i - n >= 0 AND i - n < N;


decl_type: tcc
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 394 0 398 999
body:
  % Subtype TCC generated (at line 84, column 40) for  N - n + i
      % expected type  below(N)
  divrem_dvs0_TCC2: OBLIGATION
    FORALL (n: below(N + 1), i: below(N)):
      i < n IMPLIES N - n + i >= 0 AND N - n + i < N;


decl_type: tcc
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 400 0 403 999
body:
  % Subtype TCC generated (at line 123, column 26) for  i + n
      % expected type  below(N)
  bv2nat_left_false_dec_TCC1: OBLIGATION
    FORALL (n: below(N), i: below(N)): i < N - n IMPLIES i + n < N;


decl_type: tcc
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 405 0 408 999
body:
  % Subtype TCC generated (at line 129, column 26) for  i + n
      % expected type  below(N)
  bv2nat_left_false_dec_TCC2: OBLIGATION
    FORALL (n: below(N), i: below(N)): i < N - n - 1 IMPLIES i + n < N;


decl_type: tcc
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 410 0 412 999
body:
  % Subtype TCC generated (at line 131, column 32) for  N - n - 1
      % expected type  nat
  bv2nat_left_false_dec_TCC3: OBLIGATION FORALL (n: below(N)): N - n - 1 >= 0;


decl_type: tcc
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 414 0 417 999
body:
  % Subtype TCC generated (at line 131, column 48) for  N - 1
      % expected type  below(N)
  bv2nat_left_false_dec_TCC4: OBLIGATION
    FORALL (n: below(N)): N - 1 >= 0 AND N - 1 < N;


decl_type: tcc
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 419 0 423 999
body:
  % Subtype TCC generated (at line 137, column 27) for  i + N - m
      % expected type  below(N)
  bv2nat_split_TCC1: OBLIGATION
    FORALL (m: below(N + 1), i: below(N)):
      i < m IMPLIES i + N - m >= 0 AND i + N - m < N;


decl_type: tcc
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 425 0 428 999
body:
  % Subtype TCC generated (at line 162, column 26) for  1 + i + n
      % expected type  below(N)
  bv2nat_left_false_minus_TCC1: OBLIGATION
    FORALL (n: below(N), i: below(N)): i < N - n - 1 IMPLIES 1 + i + n < N;


decl_type: tcc
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 430 0 432 999
body:
  % Subtype TCC generated (at line 168, column 52) for  N - 1
      % expected type  nat
  bv2nat_leftshift_exp_TCC1: OBLIGATION N - 1 >= 0;


decl_type: tcc
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 434 0 449 999
body:
  % Subtype TCC generated (at line 199, column 67) for  n - 1
      % expected type  below(1 + N)
  divrem_mem_TCC1: OBLIGATION
    FORALL (aux, dvs, quot, rem: bvec[N], n: below(N + 1)):
      NOT n = 0 IMPLIES
       (FORALL (aux1: bvec[N]):
          aux1 = left_shift(1, aux) WITH [(0) := quot(N - 1)] IMPLIES
           (FORALL (rem1: bvec[N]):
              rem1 = left_shift(1, rem) WITH [(0) := quot(N - 1)] IMPLIES
               (FORALL (quot1: bvec[N]):
                  bv2nat[N](dvs) <=
                   bv2nat[N]
                       (LAMBDA (i: below(N)):
                          IF i < N - n + 1 THEN rem1(i) ELSE FALSE ENDIF)
                   AND quot1 = left_shift(1, quot)
                   IMPLIES n - 1 >= 0 AND n - 1 < 1 + N)));


decl_type: tcc
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 451 0 470 999
body:
  % Termination TCC generated (at line 195, column 20) for
      % divrem_mem(aux1, dvs, quot1 WITH [(0) := TRUE],
      %            (LAMBDA (i: below(N)):
      %               IF i < N - n + 1 THEN rem1(i) ELSE FALSE ENDIF)
      %             - dvs,
      %            n - 1)
  divrem_mem_TCC2: OBLIGATION
    FORALL (aux, dvs, quot, rem: bvec[N], n: below(N + 1)):
      NOT n = 0 IMPLIES
       (FORALL (aux1: bvec[N]):
          aux1 = left_shift(1, aux) WITH [(0) := quot(N - 1)] IMPLIES
           (FORALL (rem1: bvec[N]):
              rem1 = left_shift(1, rem) WITH [(0) := quot(N - 1)] IMPLIES
               (FORALL (quot1: bvec[N]):
                  bv2nat[N](dvs) <=
                   bv2nat[N]
                       (LAMBDA (i: below(N)):
                          IF i < N - n + 1 THEN rem1(i) ELSE FALSE ENDIF)
                   AND quot1 = left_shift(1, quot)
                   IMPLIES n - 1 < n)));


decl_type: tcc
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 472 0 487 999
body:
  % Subtype TCC generated (at line 200, column 55) for  n - 1
      % expected type  below(1 + N)
  divrem_mem_TCC3: OBLIGATION
    FORALL (aux, dvs, quot, rem: bvec[N], n: below(N + 1)):
      NOT n = 0 IMPLIES
       (FORALL (aux1: bvec[N]):
          aux1 = left_shift(1, aux) WITH [(0) := quot(N - 1)] IMPLIES
           (FORALL (rem1: bvec[N]):
              rem1 = left_shift(1, rem) WITH [(0) := quot(N - 1)] IMPLIES
               (FORALL (quot1: bvec[N]):
                  NOT bv2nat[N](dvs) <=
                       bv2nat[N]
                           (LAMBDA (i: below(N)):
                              IF i < N - n + 1 THEN rem1(i) ELSE FALSE ENDIF)
                   AND quot1 = left_shift(1, quot)
                   IMPLIES n - 1 >= 0 AND n - 1 < 1 + N)));


decl_type: tcc
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 489 0 504 999
body:
  % Termination TCC generated (at line 200, column 20) for
      % divrem_mem(aux1, dvs, quot1, rem1, n - 1)
  divrem_mem_TCC4: OBLIGATION
    FORALL (aux, dvs, quot, rem: bvec[N], n: below(N + 1)):
      NOT n = 0 IMPLIES
       (FORALL (aux1: bvec[N]):
          aux1 = left_shift(1, aux) WITH [(0) := quot(N - 1)] IMPLIES
           (FORALL (rem1: bvec[N]):
              rem1 = left_shift(1, rem) WITH [(0) := quot(N - 1)] IMPLIES
               (FORALL (quot1: bvec[N]):
                  NOT bv2nat[N](dvs) <=
                       bv2nat[N]
                           (LAMBDA (i: below(N)):
                              IF i < N - n + 1 THEN rem1(i) ELSE FALSE ENDIF)
                   AND quot1 = left_shift(1, quot)
                   IMPLIES n - 1 < n)));


decl_type: tcc
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 506 0 508 999
body:
  % Subtype TCC generated (at line 235, column 73) for  N
      % expected type  below(1 + N)
  div_divrem_mem_TCC1: OBLIGATION N < 1 + N;


decl_type: formula
theory: BitvectorTwoComplementDivision
library: bitvectors
signature: nil
location: 33 2 43 53
body:
    div1_cancel : LEMMA % :-)
      bv2nat(BV) * bv2nat(DVD) < exp2(2*N)
        AND
      bv2nat(BV) * bv2nat(DVS) < exp2(2*N)
        AND
      bv2nat(BV) /= 0
        IMPLIES
      div(BV * DVD, BV * DVS) = div(DVD, DVS)
        AND
      (bv2nat(DVS) /= 0 IMPLIES 
         rem(BV * DVD, BV * DVS) = BV * rem(DVD, DVS));


decl_type: formula
theory: BitvectorTwoComplementDivision
library: bitvectors
signature: nil
location: 140 2 144 32
body:
    div_dvs0 : LEMMA % :-)
      dvd / fill[N](FALSE) = IF bv2int[N](dvd) >= 0
                             THEN fill[N](TRUE)  % -1
                             ELSE one[N]         % 1
                             ENDIF


decl_type: formula
theory: BitvectorTwoComplementDivision
library: bitvectors
signature: nil
location: 149 2 152 46
body:
    rem_below_dvs : LEMMA % :-)
      bv2int(dvs) /= 0
        IMPLIES
      abs(bv2int(dvd // dvs)) < abs(bv2int(dvs))


decl_type: formula
theory: BitvectorTwoComplementDivision
library: bitvectors
signature: nil
location: 154 2 158 22
body:
    divrem_eq : LEMMA % :-)
      NOT (bv2int(dvd) = -exp2(N-1) AND bv2int(dvs) = -1)
        IMPLIES
      bv2int[N](dvd / dvs) * bv2int[N](dvs) + bv2int[N](dvd // dvs) 
        = bv2int[N](dvd)


decl_type: formula
theory: BitvectorTwoComplementDivision
library: bitvectors
signature: nil
location: 160 2 163 67
body:
    divrem_overflow : LEMMA % :-)
      bv2int(dvd) = -exp2(N-1) AND bv2int(dvs) = -1
        IMPLIES
      bv2int[N](dvd / dvs) = -exp2(N-1) AND bv2int[N](dvd // dvs) = 0


decl_type: formula
theory: BitvectorTwoComplementDivision
library: bitvectors
signature: nil
location: 165 2 181 60
body:
    div_sgn : LEMMA % :-)
      NOT (bv2int(dvd) = -exp2(N-1) AND bv2int(dvs) = -1)
        AND
      bv2int(dvs) /= 0
        IMPLIES
      ((bv2int(dvd / dvs) > 0) = 
          ((bv2int(dvd) >= bv2int(dvs) AND bv2int(dvs) > 0)
           OR
           (bv2int(dvd) <= bv2int(dvs) AND bv2int(dvs) < 0)))
        AND
      ((bv2int(dvd / dvs) = 0) = 
          (abs(bv2int(dvd)) < abs(bv2int(dvs))))
        AND
      ((bv2int(dvd / dvs) < 0) = 
          ((bv2int(dvd) >= -bv2int(dvs) AND bv2int(dvs) < 0)
           OR
           (bv2int(dvd) <= -bv2int(dvs) AND bv2int(dvs) > 0)))


decl_type: formula
theory: BitvectorTwoComplementDivision
library: bitvectors
signature: nil
location: 183 2 186 57
body:
    rem_sgn : LEMMA % :-)
      ((bv2int(dvd) > 0) IMPLIES (bv2int(dvd // dvs) >= 0))
         AND
      ((bv2int(dvd) < 0) IMPLIES (bv2int(dvd // dvs) <= 0))


decl_type: formula
theory: BitvectorTwoComplementDivision
library: bitvectors
signature: nil
location: 188 2 215 54
body:
    divrem_uniqueness : LEMMA % :-)
      FORALL(q,r:int) : 
        (NOT (bv2int(dvd) = -exp2(N-1) AND bv2int(dvs) = -1))
          AND
        bv2int(dvs) /= 0
          AND
        ((q > 0) = 
          ((bv2int(dvd) >= bv2int(dvs) AND bv2int(dvs) > 0)
           OR
           (bv2int(dvd) <= bv2int(dvs) AND bv2int(dvs) < 0)))
          AND
        ((q = 0) = 
           (abs(bv2int(dvd)) < abs(bv2int(dvs))))
          AND
        ((q < 0) = 
           ((bv2int(dvd) >= -bv2int(dvs) AND bv2int(dvs) < 0)
            OR
            (bv2int(dvd) <= -bv2int(dvs) AND bv2int(dvs) > 0)))
          AND
        ((bv2int(dvd) > 0) IMPLIES (r >= 0))
          AND
        ((bv2int(dvd) < 0) IMPLIES (r <= 0))
          AND
        abs(r) < abs(bv2int(dvs)) 
          AND 
        q * bv2int(dvs) + r = bv2int(dvd)
          IMPLIES
        q = bv2int(dvd / dvs) AND r = bv2int(dvd // dvs)


decl_type: formula
theory: BitvectorTwoComplementDivision
library: bitvectors
signature: nil
location: 221 2 227 36
body:
    div_largest : LEMMA % :-)
      FORALL(q:int) : 
        bv2int(dvs) /= 0
          AND
        abs(bv2int(dvs) * q) <= abs(bv2int(dvd)) 
          IMPLIES 
        abs(q) <= abs(bv2int(dvd/dvs))


decl_type: function
theory: BitvectorTwoComplementDivision
library: bitvectors
signature: [[bvec[N], bvec[N]] -> bvec[N]]
location: 51 2 61 10
body:
    /(dvd, dvs) : bvec[N] =
      IF bv2int[N](dvd) >= 0
      THEN IF bv2int[N](dvs) >= 0
           THEN div[N](dvd, dvs)
           ELSE -div[N](dvd, -dvs)
           ENDIF
      ELSE IF bv2int[N](dvs) >= 0
           THEN -div[N](-dvd, dvs)
           ELSE div[N](-dvd, -dvs)
           ENDIF
      ENDIF;


decl_type: function
theory: BitvectorTwoComplementDivision
library: bitvectors
signature: [[bvec[N], bvec[N]] -> bvec[N]]
location: 63 2 73 9
body:
    //(dvd, dvs) : bvec[N] =
      IF bv2int[N](dvd) >= 0
      THEN IF bv2int[N](dvs) >= 0
           THEN rem[N](dvd, dvs)
           ELSE rem[N](dvd, -dvs)
           ENDIF
      ELSE IF bv2int[N](dvs) >= 0
           THEN -rem[N](-dvd, dvs)
           ELSE -rem[N](-dvd, -dvs)
           ENDIF
      ENDIF


decl_type: tcc
theory: BitvectorTwoComplementDivision
library: bitvectors
signature: nil
location: 234 0 237 999
body:
  % Assuming TCC generated (at line 20, column 12) for
      % BitvectorOneComplementDivision[N]
      % generated from assumption BitvectorOneComplementDivision.N_size
  IMP_BitvectorOneComplementDivision_TCC1: OBLIGATION N >= 2;


decl_type: tcc
theory: BitvectorTwoComplementDivision
library: bitvectors
signature: nil
location: 239 0 242 999
body:
  % Assuming TCC generated (at line 21, column 12) for
      % BitvectorOneComplementDivision[2 * N]
      % generated from assumption BitvectorOneComplementDivision.N_size
  IMP_BitvectorOneComplementDivision_TCC2: OBLIGATION 2 * N >= 2;


decl_type: tcc
theory: BitvectorTwoComplementDivision
library: bitvectors
signature: nil
location: 244 0 246 999
body:
  % Subtype TCC generated (at line 155, column 29) for  N - 1
      % expected type  nat
  divrem_eq_TCC1: OBLIGATION N - 1 >= 0;


decl_type: formula
theory: BitvectorTwoComplementDivisionWidenNarrow
library: bitvectors
signature: nil
location: 29 2 34 48
body:
    divrem_widens : LEMMA % :-)
      NOT (bv2int(dvd) = -exp2(N-1) AND bv2int(dvs) = -1)
        IMPLIES
      widen(dvd) / widen(dvs) = widen(dvd / dvs)
        AND
      widen(dvd) // widen(dvs) = widen(dvd // dvs)


decl_type: formula
theory: BitvectorTwoComplementDivisionWidenNarrow
library: bitvectors
signature: nil
location: 36 2 53 48
body:
    div_cancel : LEMMA % :-)
     -exp2(2*N-1) < bv2int(BV) * bv2int(DVD) 
       AND 
      bv2int(BV) * bv2int(DVD) < exp2(2*N-1)
        AND
     -exp2(2*N-1) < bv2int(BV) * bv2int(DVS) 
       AND 
      bv2int(BV) * bv2int(DVS) < exp2(2*N-1)
        AND
      bv2int(BV) /= 0
        AND
      bv2int(DVS) /= 0
        AND
      NOT (bv2int(DVD) = -exp2(2 * N - 1) AND bv2int(DVS) = -1)
        IMPLIES
      (BV * DVD) / (BV * DVS) = DVD / DVS
        AND
      (BV * DVD) // (BV * DVS) = BV * (DVD // DVS)


decl_type: tcc
theory: BitvectorTwoComplementDivisionWidenNarrow
library: bitvectors
signature: nil
location: 60 0 63 999
body:
  % Assuming TCC generated (at line 20, column 12) for
      % BitvectorTwoComplementDivision[N]
      % generated from assumption BitvectorTwoComplementDivision.N_size
  IMP_BitvectorTwoComplementDivision_TCC1: OBLIGATION N >= 2;


decl_type: tcc
theory: BitvectorTwoComplementDivisionWidenNarrow
library: bitvectors
signature: nil
location: 65 0 68 999
body:
  % Assuming TCC generated (at line 21, column 12) for
      % BitvectorTwoComplementDivision[2 * N]
      % generated from assumption BitvectorTwoComplementDivision.N_size
  IMP_BitvectorTwoComplementDivision_TCC2: OBLIGATION 2 * N >= 2;


decl_type: tcc
theory: BitvectorTwoComplementDivisionWidenNarrow
library: bitvectors
signature: nil
location: 70 0 72 999
body:
  % Subtype TCC generated (at line 30, column 29) for  N - 1
      % expected type  nat
  divrem_widens_TCC1: OBLIGATION N - 1 >= 0;


decl_type: tcc
theory: BitvectorTwoComplementDivisionWidenNarrow
library: bitvectors
signature: nil
location: 74 0 76 999
body:
  % Subtype TCC generated (at line 37, column 9) for  2 * N - 1
      % expected type  nat
  div_cancel_TCC1: OBLIGATION 2 * N - 1 >= 0;


decl_type: formula
theory: card_tricks
library: finite_sets
signature: nil
location: 22 2 24 74
body:
    extend_restrict: LEMMA
        empty?(non_subtype_elements(V))
        IMPLIES extend[T, S, boolean, FALSE](restrict[T, S, boolean](V)) = V


decl_type: formula
theory: card_tricks
library: finite_sets
signature: nil
location: 26 2 29 9
body:
    union_extend_restrict: LEMMA
        union(non_subtype_elements(V),
              extend[T, S, boolean, FALSE](restrict[T, S, boolean](V)))
        = V


decl_type: formula
theory: card_tricks
library: finite_sets
signature: nil
location: 31 2 33 73
body:
    disjoint_extend_restrict: LEMMA
        disjoint?(non_subtype_elements(V),
                  extend[T, S, boolean, FALSE](restrict[T, S, boolean](V)))


decl_type: formula
theory: card_tricks
library: finite_sets
signature: nil
location: 35 2 37 56
body:
    card_restrict_subtype: LEMMA
        empty?(non_subtype_elements(B))
        IMPLIES card(restrict[T, S, boolean](B)) = card(B)


decl_type: formula
theory: card_tricks
library: finite_sets
signature: nil
location: 39 2 41 49
body:
    same_card_subset_extend: LEMMA
        subset?(extend[T, S, boolean, FALSE](A), B) AND card(A) = card(B) 
        IMPLIES extend[T, S, boolean, FALSE](A) = B


decl_type: formula
theory: card_tricks
library: finite_sets
signature: nil
location: 43 2 45 15
body:
    card_restrict_plus: LEMMA
        card(non_subtype_elements(B)) + card(restrict[T, S, boolean](B))
        = card(B)


decl_type: formula
theory: card_tricks
library: finite_sets
signature: nil
location: 47 2 49 56
body:
    card_restrict_less: LEMMA
        nonempty?(non_subtype_elements(B))
        IMPLIES card(restrict[T, S, boolean](B)) < card(B)


decl_type: tcc
theory: card_tricks
library: finite_sets
signature: nil
location: 57 0 60 999
body:
  % Subtype TCC generated (at line 44, column 11) for  non_subtype_elements(B)
      % expected type  S: finite_set[T]
  card_restrict_plus_TCC1: OBLIGATION
    FORALL (B: finite_set[T]): is_finite[T](non_subtype_elements(B));


decl_type: formula
theory: finite_sets_subtype_props
library: finite_sets
signature: nil
location: 14 2 15 71
body:
    only_subtype_elements: LEMMA empty?(non_subtype_elements[T1, (A)](A)) AND
                                 empty?(non_subtype_elements[T2, (B)](B))


decl_type: formula
theory: finite_sets_subtype_props
library: finite_sets
signature: nil
location: 17 2 19 63
body:
    same_card_inj_bij: LEMMA
        FORALL (f: [ (A) -> (B) ]):
            card(A) = card(B) AND injective?(f) IMPLIES bijective?(f)


decl_type: formula
theory: finite_sets_inductions
library: finite_sets
signature: nil
location: 14 2 15 78
body:
    cardinal_induction       : LEMMA (FORALL S : P(S)) IFF 
                                        (FORALL n, S : card(S) = n IMPLIES P(S)) 


decl_type: formula
theory: finite_sets_inductions
library: finite_sets
signature: nil
location: 17 2 19 65
body:
    finite_set_induction     : THEOREM P(emptyset[T])
                                        AND (FORALL e,S: P(S) IMPLIES P(add(e,S)))
                                           IMPLIES (FORALL S: P(S))


decl_type: formula
theory: finite_sets_inductions
library: finite_sets
signature: nil
location: 21 2 23 63
body:
    finite_set_ind_modified  : THEOREM  P(emptyset[T]) AND 
                               (FORALL e,S: NOT S(e) AND P(S) IMPLIES P(add(e,S)))
                                         IMPLIES (FORALL S: P(S))


decl_type: formula
theory: finite_sets_inductions
library: finite_sets
signature: nil
location: 25 2 27 70
body:
    finite_set_induction_rest: THEOREM P(emptyset[T])
                                       AND (FORALL SS : P(rest(SS)) IMPLIES P(SS))
                                               IMPLIES (FORALL S : P(S))


decl_type: formula
theory: finite_sets_inductions
library: finite_sets
signature: nil
location: 29 2 32 61
body:
    finite_set_induction_union: THEOREM P(emptyset[T])
                                        AND (FORALL e: P(singleton(e)))
                    AND (FORALL S1,S2: P(S1) AND P(S2) IMPLIES P(union(S1,S2)))
                                       IMPLIES (FORALL S: P(S))


decl_type: formula
theory: finite_sets_inductions
library: finite_sets
signature: nil
location: 35 2 38 58
body:
    finite_set_induction_gen: THEOREM (FORALL S:
                                   (FORALL S2: card(S2) < card(S) IMPLIES P(S2))
                                                  IMPLIES P(S))
                                    IMPLIES (FORALL S: P(S))


decl_type: formula
theory: finite_sets_inductions
library: finite_sets
signature: nil
location: 44 2 45 73
body:
    nonempty_card_induction : LEMMA (FORALL U : Q(U)) IFF 
                                (FORALL S, n : n > 0 AND card(S) = n IMPLIES Q(S))


decl_type: formula
theory: finite_sets_inductions
library: finite_sets
signature: nil
location: 47 2 49 65
body:
    nonempty_finite_set_induct : THEOREM (FORALL e : Q(singleton(e)))
         AND (FORALL e, U : Q(U) AND NOT U(e) IMPLIES Q(add(e, U)))
                                          IMPLIES (FORALL U : Q(U))


decl_type: tcc
theory: finite_sets_inductions
library: finite_sets
signature: nil
location: 57 0 60 999
body:
  % Subtype TCC generated (at line 45, column 70) for  S
      % expected type  non_empty_finite_set[T]
  nonempty_card_induction_TCC1: OBLIGATION
    FORALL (S, n): n > 0 AND card(S) = n IMPLIES NOT empty?[T](S);


decl_type: formula
theory: finite_sets_product
library: finite_sets
signature: nil
location: 39 2 40 78
body:
    product_x         : THEOREM (FORALL (x: (S)): 
                                product(S, f) = f(x) * product(remove(x, S), f))


decl_type: formula
theory: finite_sets_product
library: finite_sets
signature: nil
location: 42 2 43 64
body:
    product_x1_x2     : LEMMA (FORALL (x1,x2: (S)): f(x1) * product(remove(x1,S),f) 
                                = f(x2) * product(remove(x2,S),f))


decl_type: formula
theory: finite_sets_product
library: finite_sets
signature: nil
location: 45 2 46 82
body:
    product_add       : THEOREM product(add(x,S),f) 
                            = product(S,f) * IF member(x,S) THEN one ELSE f(x) ENDIF


decl_type: formula
theory: finite_sets_product
library: finite_sets
signature: nil
location: 48 2 49 82
body:
    product_remove    : THEOREM product(remove(x,S),f) 
                            * IF member(x,S) THEN f(x) ELSE one ENDIF = product(S,f)


decl_type: formula
theory: finite_sets_product
library: finite_sets
signature: nil
location: 51 2 52 76
body:
    product_rest      : THEOREM NOT empty?(S) IMPLIES
                              f(choose(S)) * product(rest(S),f) = product(S,f)


decl_type: formula
theory: finite_sets_product
library: finite_sets
signature: nil
location: 54 2 55 79
body:
    product_disj_union: THEOREM disjoint?(A,B) IMPLIES 
                              product(union(A,B),f) = product(A,f) * product(B,f) 


decl_type: formula
theory: finite_sets_product
library: finite_sets
signature: nil
location: 57 2 58 74
body:
    product_diff_subset: THEOREM subset?(A, B) IMPLIES 
                              product(difference(B, A), f) * product(A, f) = product(B, f) 


decl_type: formula
theory: finite_sets_product
library: finite_sets
signature: nil
location: 60 2 61 62
body:
    product_union      : THEOREM product(union(A,B),f) * product(intersection(A,B),f) 
                                   = product(A,f) * product(B,f) 


decl_type: formula
theory: finite_sets_product
library: finite_sets
signature: nil
location: 63 2 64 85
body:
    product_diff_intersection: THEOREM product(A,f) = 
                              product(difference(A,B),f) * product(intersection(A,B),f) 


decl_type: formula
theory: finite_sets_product
library: finite_sets
signature: nil
location: 66 2 67 68
body:
    product_f_g         : LEMMA (FORALL (x: (S)): f(x) = g(x)) 
                                 IMPLIES product(S, f) = product(S, g)


decl_type: formula
theory: finite_sets_product
library: finite_sets
signature: nil
location: 69 2 70 44
body:
    product_particular  : THEOREM product(S,f) = product(S, f WITH [x := one])
                                 * IF S(x) THEN f(x) ELSE one ENDIF 


decl_type: formula
theory: finite_sets_product
library: finite_sets
signature: nil
location: 72 2 73 66
body:
    product_distributive: THEOREM product(A,f) * product(A,g) = 
                                  product(A,(LAMBDA x: f(x) * g(x))) 


decl_type: function
theory: finite_sets_product
library: finite_sets
signature: [[finite_set[T], [T -> R]] -> R]
location: 30 2 33 39
body:
    product(S,f) : RECURSIVE R = 
      IF (empty?(S)) THEN one
      ELSE f(choose(S)) * product(rest(S),f)
      ENDIF MEASURE (LAMBDA S,f: card(S))


decl_type: tcc
theory: finite_sets_product
library: finite_sets
signature: nil
location: 80 0 84 999
body:
  % Subtype TCC generated (at line 32, column 18) for  S
      % expected type  p: (nonempty?[T])
  product_TCC1: OBLIGATION
    FORALL (S: finite_set[T], f: [T -> R]):
      NOT (empty?(S)) IMPLIES nonempty?[T](S);


decl_type: tcc
theory: finite_sets_product
library: finite_sets
signature: nil
location: 86 0 89 999
body:
  % Termination TCC generated (at line 32, column 24) for  product(rest(S), f)
  product_TCC2: OBLIGATION
    FORALL (S: finite_set[T], f: [T -> R]):
      NOT (empty?(S)) IMPLIES card[T](rest[T](S)) < card[T](S);


decl_type: tcc
theory: finite_sets_product
library: finite_sets
signature: nil
location: 91 0 94 999
body:
  % Subtype TCC generated (at line 52, column 37) for  S
      % expected type  p: (nonempty?[T])
  product_rest_TCC1: OBLIGATION
    FORALL (S: finite_set[T]): NOT empty?(S) IMPLIES nonempty?[T](S);


decl_type: formula
theory: finite_sets_product_real
library: finite_sets
signature: nil
location: 37 2 38 68
body:
    product_eq_0        : THEOREM product(S,f) = 0 IMPLIES  
                                            (EXISTS (t:(S)): f(t) = 0)


decl_type: formula
theory: finite_sets_product_real
library: finite_sets
signature: nil
location: 50 2 52 62
body:
    product_remove_rew   : THEOREM f(t) /= 0 IMPLIES 
                            product(remove(t,S),f) = product(S,f) /
                                  IF S(t) THEN f(t) ELSE 1 ENDIF 


decl_type: formula
theory: finite_sets_product_real
library: finite_sets
signature: nil
location: 54 2 55 80
body:
    product_rest_rew     : THEOREM NOT empty?(S) AND f(choose(S)) /= 0 IMPLIES
                                  product(rest(S),f) = product(S,f) / f(choose(S))


decl_type: formula
theory: finite_sets_product_real
library: finite_sets
signature: nil
location: 57 2 58 63
body:
    product_union_rew    : THEOREM product(union(A,B),f)*product(intersection(A,B),f) 
                                    = product(A,f) * product(B,f)


decl_type: formula
theory: finite_sets_product_real
library: finite_sets
signature: nil
location: 62 2 63 68
body:
    product_eq_funs       : THEOREM (FORALL (t: (S)): f(t) = g(t)) 
                                 IMPLIES product(S, f) = product(S, g)


decl_type: formula
theory: finite_sets_product_real
library: finite_sets
signature: nil
location: 65 2 66 46
body:
    product_particular_gen: THEOREM product(S,f) = product(S, f WITH [t := cnz])
                                 * IF S(t) THEN f(t)/cnz ELSE 1 ENDIF 


decl_type: formula
theory: finite_sets_product_real
library: finite_sets
signature: nil
location: 73 2 74 67
body:
    product_pos      : LEMMA (FORALL (t: (S)): f(t) > 0) IMPLIES product(S,f) > 0 OR
                                                      S = emptyset[T]


decl_type: formula
theory: finite_sets_product_real
library: finite_sets
signature: nil
location: 91 2 92 71
body:
    product_eq_1        : THEOREM product(S,Fnat) = 1 IMPLIES  
                                            (FORALL (t:(S)): Fnat(t) = 1)


decl_type: judgement
theory: finite_sets_product_real
library: finite_sets
signature: posreal
location: 78 2 79 28
body:
    product_posreal: JUDGEMENT product(A: non_empty_finite_set[T], f: [T -> posreal])
              HAS_TYPE posreal


decl_type: tcc
theory: finite_sets_product_real
library: finite_sets
signature: nil
location: 116 0 123 999
body:
  % Assuming TCC generated (at line 20, column 12) for
      % finite_sets_product
      %     [T, real, 1,
      %      restrict[[numfield, numfield], [real, real], numfield](*)]
      % generated from assumption finite_sets_product.one_identity
  IMP_finite_sets_product_TCC1: OBLIGATION
    identity?[real]
        (restrict[[numfield, numfield], [real, real], numfield](*))(1);


decl_type: tcc
theory: finite_sets_product_real
library: finite_sets
signature: nil
location: 125 0 135 999
body:
  % Assuming TCC generated (at line 20, column 12) for
      % finite_sets_product
      %     [T, real, 1,
      %      restrict[[numfield, numfield], [real, real], numfield](*)]
      % generated from assumption finite_sets_product.mult_ac
  IMP_finite_sets_product_TCC2: OBLIGATION
    associative?[real]
        (restrict[[numfield, numfield], [real, real], numfield](*))
     AND
     commutative?[real]
         (restrict[[numfield, numfield], [real, real], numfield](*));


decl_type: tcc
theory: finite_sets_product_real
library: finite_sets
signature: nil
location: 137 0 140 999
body:
  % Subtype TCC generated (at line 30, column 63) for  card(S)
      % expected type  {i: int | c /= 0 OR i >= 0}
  product_const_TCC1: OBLIGATION
    FORALL (S: finite_set[T], c: real): c /= 0 OR card[T](S) >= 0;


decl_type: tcc
theory: finite_sets_product_real
library: finite_sets
signature: nil
location: 142 0 145 999
body:
  % Subtype TCC generated (at line 54, column 60) for  S
      % expected type  p: (nonempty?[T])
  product_rest_rew_TCC1: OBLIGATION
    FORALL (S: finite_set[T]): NOT empty?(S) IMPLIES nonempty?[T](S);


decl_type: tcc
theory: finite_sets_product_real
library: finite_sets
signature: nil
location: 147 0 161 999
body:
  % Judgement subtype TCC generated (at line 78, column 29) for  product(A, f)
      % expected type  posreal
  product_posreal: OBLIGATION
    FORALL (A: non_empty_finite_set[T], f: [T -> posreal]):
      product
          [T, real, 1,
           restrict[[numfield, numfield], [real, real], numfield](*)]
          (A, f)
       >= 0
       AND
       product
           [T, real, 1,
            restrict[[numfield, numfield], [real, real], numfield](*)]
           (A, f)
        > 0;


decl_type: tcc
theory: finite_sets_product_real
library: finite_sets
signature: nil
location: 163 0 179 999
body:
  % Judgement subtype TCC generated (at line 81, column 25) for  product(A, f)
      % expected type  int
  product_int: OBLIGATION
    FORALL (A: finite_set[T], f: [T -> int]):
      rational_pred(product
                        [T, real, 1,
                         restrict
                             [[numfield, numfield], [real, real], numfield]
                             (*)]
                        (A, f))
       AND
       integer_pred(product
                        [T, real, 1,
                         restrict
                             [[numfield, numfield], [real, real], numfield]
                             (*)]
                        (A, f));


decl_type: tcc
theory: finite_sets_product_real
library: finite_sets
signature: nil
location: 181 0 189 999
body:
  % Judgement subtype TCC generated (at line 83, column 25) for  product(A, f)
      % expected type  nat
  product_nat: OBLIGATION
    FORALL (A: finite_set[T], f: [T -> nat]):
      product
          [T, real, 1,
           restrict[[numfield, numfield], [real, real], numfield](*)]
          (A, f)
       >= 0;


decl_type: tcc
theory: finite_sets_product_real
library: finite_sets
signature: nil
location: 191 0 199 999
body:
  % Judgement subtype TCC generated (at line 101, column 12) for  product(A, f)
      % expected type  nonneg_real
  product_TCC1: OBLIGATION
    FORALL (A: finite_set[T], f: [T -> nonneg_real]):
      product
          [T, real, 1,
           restrict[[numfield, numfield], [real, real], numfield](*)]
          (A, f)
       >= 0;


decl_type: tcc
theory: finite_sets_product_real
library: finite_sets
signature: nil
location: 201 0 209 999
body:
  % Judgement subtype TCC generated (at line 104, column 12) for  product(A, f)
      % expected type  posnat
  product_TCC2: OBLIGATION
    FORALL (A: non_empty_finite_set[T], f: [T -> posnat]):
      product
          [T, real, 1,
           restrict[[numfield, numfield], [real, real], numfield](*)]
          (A, f)
       > 0;


decl_type: function
theory: fs_constructors
library: finite_sets
signature: [[T, T, T, T, T] -> non_empty_finite_set[T]]
location: 14 2 15 61
body:
    fs(a1,a2,a3,a4,a5): non_empty_finite_set[T] 
       = {t:T | t = a1 OR t = a2 OR t = a3 OR t = a4 OR t = a5}


decl_type: tcc
theory: fs_constructors
library: finite_sets
signature: nil
location: 23 0 27 999
body:
  % Subtype TCC generated (at line 6, column 36) for  {t: T | t = a1}
      % expected type  non_empty_finite_set[T]
  fs_TCC1: OBLIGATION
    FORALL (a1: T):
      is_finite[T]({t: T | t = a1}) AND NOT empty?[T]({t: T | t = a1});


decl_type: tcc
theory: fs_constructors
library: finite_sets
signature: nil
location: 29 0 35 999
body:
  % Subtype TCC generated (at line 8, column 39) for
      % {t: T | t = a1 OR t = a2}
      % expected type  non_empty_finite_set[T]
  fs_TCC2: OBLIGATION
    FORALL (a1: T, a2: T):
      is_finite[T]({t: T | t = a1 OR t = a2}) AND
       NOT empty?[T]({t: T | t = a1 OR t = a2});


decl_type: tcc
theory: fs_constructors
library: finite_sets
signature: nil
location: 37 0 43 999
body:
  % Subtype TCC generated (at line 10, column 42) for
      % {t: T | t = a1 OR t = a2 OR t = a3}
      % expected type  non_empty_finite_set[T]
  fs_TCC3: OBLIGATION
    FORALL (a1: T, a2: T, a3: T):
      is_finite[T]({t: T | t = a1 OR t = a2 OR t = a3}) AND
       NOT empty?[T]({t: T | t = a1 OR t = a2 OR t = a3});


decl_type: tcc
theory: fs_constructors
library: finite_sets
signature: nil
location: 45 0 51 999
body:
  % Subtype TCC generated (at line 12, column 45) for
      % {t: T | t = a1 OR t = a2 OR t = a3 OR t = a4}
      % expected type  non_empty_finite_set[T]
  fs_TCC4: OBLIGATION
    FORALL (a1: T, a2: T, a3: T, a4: T):
      is_finite[T]({t: T | t = a1 OR t = a2 OR t = a3 OR t = a4}) AND
       NOT empty?[T]({t: T | t = a1 OR t = a2 OR t = a3 OR t = a4});


decl_type: tcc
theory: fs_constructors
library: finite_sets
signature: nil
location: 53 0 62 999
body:
  % Subtype TCC generated (at line 15, column 7) for
      % {t: T |     t = a1 OR t = a2 OR t = a3 OR t = a4 OR t = a5}
      % expected type  non_empty_finite_set[T]
  fs_TCC5: OBLIGATION
    FORALL (a1: T, a2: T, a3: T, a4: T, a5: T):
      is_finite[T]
          ({t: T |     t = a1 OR t = a2 OR t = a3 OR t = a4 OR t = a5})
       AND
       NOT empty?[T]
               ({t: T |     t = a1 OR t = a2 OR t = a3 OR t = a4 OR t = a5});


decl_type: formula
theory: finite_cross
library: finite_sets
signature: nil
location: 12 2 13 59
body:
    is_finite_cross: LEMMA is_finite_type[T1] AND is_finite_type[T2] 
                              IMPLIES is_finite_type[[T1,T2]]


decl_type: formula
theory: finite_sets_minmax
library: finite_sets
signature: nil
location: 41 2 42 50
body:
    min_union: LEMMA min(A) = x AND min(B) = y IMPLIES
                        min(union(A,B)) = fsmin(x,y)


decl_type: formula
theory: finite_sets_minmax
library: finite_sets
signature: nil
location: 44 2 45 50
body:
    max_union: LEMMA max(A) = x AND max(B) = y IMPLIES
                        max(union(A,B)) = fsmax(x,y)


decl_type: function
theory: finite_sets_minmax
library: finite_sets
signature: [non_empty_finite_set[T] -> T]
location: 12 2 16 43
body:
    minrec(SS): RECURSIVE T = 
                  IF empty?(rest(SS)) THEN choose(SS)
                  ELSE fsmin(choose(SS),minrec(rest(SS)))
                  ENDIF
                MEASURE (LAMBDA SS: card(SS))


decl_type: function
theory: finite_sets_minmax
library: finite_sets
signature: [non_empty_finite_set[T] -> T]
location: 18 2 22 43
body:
    maxrec(SS): RECURSIVE T = 
                  IF empty?(rest(SS)) THEN choose(SS)
                  ELSE fsmax(choose(SS),maxrec(rest(SS)))
                  ENDIF
                MEASURE (LAMBDA SS: card(SS))


decl_type: tcc
theory: finite_sets_minmax
library: finite_sets
signature: nil
location: 53 0 56 999
body:
  % Termination TCC generated (at line 14, column 38) for  minrec(rest(SS))
  minrec_TCC1: OBLIGATION
    FORALL (SS: non_empty_finite_set[T]):
      NOT empty?(rest(SS)) IMPLIES card[T](rest[T](SS)) < card[T](SS);


decl_type: tcc
theory: finite_sets_minmax
library: finite_sets
signature: nil
location: 58 0 64 999
body:
  % Existence TCC generated (at line 29, column 2) for
      % min(SS): {a: T | SS(a) AND (FORALL (x: T): SS(x) IMPLIES a <= x)}
  min_TCC1: OBLIGATION
    EXISTS (x1:
              [SS: non_empty_finite_set[T] ->
                 {a: T | SS(a) AND (FORALL (x: T): SS(x) IMPLIES a <= x)}]):
      TRUE;


decl_type: tcc
theory: finite_sets_minmax
library: finite_sets
signature: nil
location: 66 0 72 999
body:
  % Existence TCC generated (at line 30, column 2) for
      % max(SS): {a: T | SS(a) AND (FORALL (x: T): SS(x) IMPLIES x <= a)}
  max_TCC1: OBLIGATION
    EXISTS (x1:
              [SS: non_empty_finite_set[T] ->
                 {a: T | SS(a) AND (FORALL (x: T): SS(x) IMPLIES x <= a)}]):
      TRUE;


decl_type: formula
theory: func_composition
library: finite_sets
signature: nil
location: 13 2 14 62
body:
    composition_injective : LEMMA injective?(f1) AND injective?(f2) 
                                     IMPLIES injective?(f2 o f1)


decl_type: formula
theory: func_composition
library: finite_sets
signature: nil
location: 16 2 17 63
body:
    composition_surjective: LEMMA surjective?(f1) AND surjective?(f2) 
                                     IMPLIES surjective?(f2 o f1)


decl_type: formula
theory: func_composition
library: finite_sets
signature: nil
location: 19 2 20 62
body:
    composition_bijective : LEMMA bijective?(f1) AND bijective?(f2) 
                                     IMPLIES bijective?(f2 o f1)


decl_type: formula
theory: func_composition
library: finite_sets
signature: nil
location: 29 2 30 72
body:
    composition_left_cancel1 : LEMMA injective?(h)  
                                        IMPLIES  (h o f = h o g IFF f = g)


decl_type: formula
theory: func_composition
library: finite_sets
signature: nil
location: 32 2 33 72
body:
    composition_left_cancel2 : LEMMA bijective?(h)  
                                        IMPLIES  (h o f = h o g IFF f = g)


decl_type: formula
theory: func_composition
library: finite_sets
signature: nil
location: 36 2 37 72
body:
    composition_right_cancel1: LEMMA surjective?(f)  
                                        IMPLIES  (h o f = k o f IFF h = k)


decl_type: formula
theory: func_composition
library: finite_sets
signature: nil
location: 39 2 40 72
body:
    composition_right_cancel2: LEMMA bijective?(f) 
                                        IMPLIES  (h o f = k o f IFF h = k)


decl_type: formula
theory: finite_sets_eq
library: finite_sets
signature: nil
location: 23 2 24 68
body:
    injection_to_finite_set    : LEMMA
          (EXISTS (f: [(S)->(F)]): injective?(f)) IMPLIES is_finite(S)


decl_type: formula
theory: finite_sets_eq
library: finite_sets
signature: nil
location: 26 2 27 69
body:
    surjection_from_finite_set : LEMMA
          (EXISTS (f: [(E)->(U)]): surjective?(f)) IMPLIES is_finite(U)


decl_type: formula
theory: finite_sets_eq
library: finite_sets
signature: nil
location: 29 2 30 74
body:
    injection_to_finite_set2   : LEMMA
          (FORALL S, F, (f: [(S)->(F)]): injective?(f) IMPLIES is_finite(S))


decl_type: formula
theory: finite_sets_eq
library: finite_sets
signature: nil
location: 32 2 33 75
body:
    surjection_from_finite_set2: LEMMA
          (FORALL E, U, (f: [(E)->(U)]): surjective?(f) IMPLIES is_finite(U))


decl_type: formula
theory: finite_sets_eq
library: finite_sets
signature: nil
location: 35 2 36 68
body:
    bijection_finite_set1      : LEMMA
          (EXISTS (f: [(S)->(F)]): bijective?(f)) IMPLIES is_finite(S)


decl_type: formula
theory: finite_sets_eq
library: finite_sets
signature: nil
location: 38 2 39 68
body:
    bijection_finite_set2      : LEMMA
          (EXISTS (f: [(E)->(U)]): bijective?(f)) IMPLIES is_finite(U)


decl_type: formula
theory: finite_sets_card_eq
library: finite_sets
signature: nil
location: 21 2 22 57
body:
    card_injection         : LEMMA (EXISTS (f : [(E)->below[N]]) : injective?(f)) 
                                       IMPLIES card(E) <= N


decl_type: formula
theory: finite_sets_card_eq
library: finite_sets
signature: nil
location: 24 2 25 57
body:
    card_surjection        : LEMMA (EXISTS (f : [(E)->below[N]]) : surjective?(f)) 
                                       IMPLIES N <= card(E) 


decl_type: formula
theory: finite_sets_card_eq
library: finite_sets
signature: nil
location: 28 2 29 70
body:
    injection_and_cardinal : LEMMA (EXISTS (f : [(E)->(F)]): injective?(f))
                                              IMPLIES card(E) <= card(F)


decl_type: formula
theory: finite_sets_card_eq
library: finite_sets
signature: nil
location: 31 2 32 70
body:
    surjection_and_cardinal: LEMMA (EXISTS (f: [(E)->(F)]): surjective?(f))
                                              IMPLIES card(F) <= card(E)


decl_type: formula
theory: finite_sets_card_eq
library: finite_sets
signature: nil
location: 34 2 35 79
body:
    card_eq_bij            : LEMMA card(E) = card(F) IFF 
                                            EXISTS (f: [(E)->(F)]): bijective?(f)


decl_type: formula
theory: finite_sets_below
library: finite_sets
signature: nil
location: 22 2 23 60
body:
    pidgeon_hole      : LEMMA card(A) + card(B) >= N + k IMPLIES 
                                  card(intersection(A,B)) >= k


decl_type: tcc
theory: finite_sets_below
library: finite_sets
signature: nil
location: 31 0 33 999
body:
  % Subtype TCC generated (at line 11, column 43) for  fullset[below(N)]
      % expected type  S: finite_set[below(N)]
  card_below_fullset_TCC1: OBLIGATION is_finite[below(N)](fullset[below(N)]);


decl_type: tcc
theory: finite_sets_below
library: finite_sets
signature: nil
location: 35 0 38 999
body:
  % Subtype TCC generated (at line 13, column 43) for  BS
      % expected type  S: finite_set[below(N)]
  card_below_TCC1: OBLIGATION
    FORALL (BS: set[below(N)]): is_finite[below(N)](BS);


decl_type: tcc
theory: finite_sets_below
library: finite_sets
signature: nil
location: 40 0 42 999
body:
  % Subtype TCC generated (at line 17, column 42) for  fullset[upto(N)]
      % expected type  S: finite_set[upto(N)]
  card_upto_fullset_TCC1: OBLIGATION is_finite[upto(N)](fullset[upto(N)]);


decl_type: tcc
theory: finite_sets_below
library: finite_sets
signature: nil
location: 44 0 47 999
body:
  % Subtype TCC generated (at line 19, column 42) for  US
      % expected type  S: finite_set[upto(N)]
  card_upto_TCC1: OBLIGATION
    FORALL (US: set[upto(N)]): is_finite[upto(N)](US);


decl_type: tcc
theory: finite_sets_below
library: finite_sets
signature: nil
location: 49 0 54 999
body:
  % Subtype TCC generated (at line 23, column 37) for  intersection(A, B)
      % expected type  S: finite_set[below(N)]
  pidgeon_hole_TCC1: OBLIGATION
    FORALL (A, B: set[below(N)], k: nat):
      card(A) + card(B) >= N + k IMPLIES
       is_finite[below(N)](intersection[below(N)](A, B));


decl_type: tcc
theory: finite_sets_pred
library: finite_sets
signature: nil
location: 21 0 26 999
body:
  % Subtype TCC generated (at line 14, column 26) for  {x: T | P1(x)}
      % expected type  S: finite_set[T]
  card_implies_TCC1: OBLIGATION
    FORALL (P1, P2: pred[T]):
      (FORALL (x: T): P1(x) IMPLIES P2(x)) AND is_finite(fullset[T]) IMPLIES
       is_finite[T]({x: T | P1(x)});


decl_type: tcc
theory: finite_sets_pred
library: finite_sets
signature: nil
location: 28 0 33 999
body:
  % Subtype TCC generated (at line 14, column 50) for  {x: T | P2(x)}
      % expected type  S: finite_set[T]
  card_implies_TCC2: OBLIGATION
    FORALL (P1, P2: pred[T]):
      (FORALL (x: T): P1(x) IMPLIES P2(x)) AND is_finite(fullset[T]) IMPLIES
       is_finite[T]({x: T | P2(x)});


decl_type: formula
theory: finite_sets_nat
library: finite_sets
signature: nil
location: 31 2 32 74
body:
    finite_nat_subrange: LEMMA
        is_finite[nat](restrict[int, nat, bool]({x: subrange(i, j) | TRUE}))


decl_type: formula
theory: finite_sets_nat
library: finite_sets
signature: nil
location: 34 2 36 68
body:
    card_nat_subrange  : LEMMA
        card[nat](restrict[int, nat, bool]({x: subrange(i, j) | TRUE})) =
                                 IF i <= j THEN j - i + 1 ELSE 0 ENDIF


decl_type: tcc
theory: finite_sets_nat
library: finite_sets
signature: nil
location: 44 0 47 999
body:
  % Subtype TCC generated (at line 11, column 36) for  {j: nat | j < N}
      % expected type  S: finite_set[nat]
  card_bounded_TCC1: OBLIGATION
    FORALL (N: nat): is_finite[nat]({j: nat | j < N});


decl_type: tcc
theory: finite_sets_nat
library: finite_sets
signature: nil
location: 49 0 53 999
body:
  % Subtype TCC generated (at line 15, column 36) for
      % {j: nat | j < N AND p(j)}
      % expected type  S: finite_set[nat]
  card_bounded_subset_TCC1: OBLIGATION
    FORALL (N: nat, p: pred[nat]): is_finite[nat]({j: nat | j < N AND p(j)});


decl_type: tcc
theory: finite_sets_nat
library: finite_sets
signature: nil
location: 55 0 61 999
body:
  % Subtype TCC generated (at line 25, column 39) for
      % extend[nat, below(n), bool, FALSE]({x: below(n) | TRUE})
      % expected type  S: finite_set[nat]
  card_nat_below_TCC1: OBLIGATION
    FORALL (n: nat):
      is_finite[nat]
          (extend[nat, below(n), bool, FALSE]({x: below(n) | TRUE}));


decl_type: tcc
theory: finite_sets_nat
library: finite_sets
signature: nil
location: 63 0 68 999
body:
  % Subtype TCC generated (at line 29, column 39) for
      % extend[nat, upto(n), bool, FALSE]({x: upto(n) | TRUE})
      % expected type  S: finite_set[nat]
  card_nat_upto_TCC1: OBLIGATION
    FORALL (n: nat):
      is_finite[nat](extend[nat, upto(n), bool, FALSE]({x: upto(n) | TRUE}));


decl_type: tcc
theory: finite_sets_nat
library: finite_sets
signature: nil
location: 70 0 80 999
body:
  % Subtype TCC generated (at line 35, column 16) for
      % restrict[int, nat, bool]
      %     (extend[int, subrange(i, j), bool, FALSE]
      %          ({x: subrange(i, j) | TRUE}))
      % expected type  S: finite_set[nat]
  card_nat_subrange_TCC1: OBLIGATION
    FORALL (i, j: nat):
      is_finite[nat]
          (restrict[int, nat, bool]
               (extend[int, subrange(i, j), bool, FALSE]
                    ({x: subrange(i, j) | TRUE})));


decl_type: formula
theory: finite_sets_int
library: finite_sets
signature: nil
location: 15 2 16 72
body:
    card_subrng         : LEMMA card({x | in_subrng(x,i,j)}) =
                                    IF i <= j THEN abs(j-i+1) ELSE 0 ENDIF


decl_type: formula
theory: finite_sets_int
library: finite_sets
signature: nil
location: 29 2 30 74
body:
    card_int_subrange       : LEMMA card[int]({x: subrange(i, j) | TRUE}) =
                                      IF i <= j THEN abs(j-i+1) ELSE 0 ENDIF


decl_type: tcc
theory: finite_sets_int
library: finite_sets
signature: nil
location: 37 0 41 999
body:
  % Subtype TCC generated (at line 15, column 35) for
      % {x | in_subrng(x, i, j)}
      % expected type  S: finite_set[int]
  card_subrng_TCC1: OBLIGATION
    FORALL (i, j: int): is_finite[int]({x | in_subrng(x, i, j)});


decl_type: tcc
theory: finite_sets_int
library: finite_sets
signature: nil
location: 43 0 50 999
body:
  % Subtype TCC generated (at line 29, column 44) for
      % extend[int, subrange(i, j), bool, FALSE]({x: subrange(i, j) | TRUE})
      % expected type  S: finite_set[int]
  card_int_subrange_TCC1: OBLIGATION
    FORALL (i, j: int):
      is_finite[int]
          (extend[int, subrange(i, j), bool, FALSE]
               ({x: subrange(i, j) | TRUE}));


decl_type: formula
theory: prelude_aux
library: finite_sets
signature: nil
location: 7 2 8 58
body:
    rest_emptyset: LEMMA (FORALL (S: set[T], t:T): rest(S) = emptyset[T]
                             AND S(t) IMPLIES choose(S) = t)


decl_type: tcc
theory: prelude_aux
library: finite_sets
signature: nil
location: 16 0 20 999
body:
  % Subtype TCC generated (at line 8, column 51) for  S
      % expected type  p: (nonempty?[T])
  rest_emptyset_TCC1: OBLIGATION
    FORALL (S: set[T], t: T):
      rest(S) = emptyset[T] AND S(t) IMPLIES nonempty?[T](S);


decl_type: formula
theory: finite_sets_sum
library: finite_sets
signature: nil
location: 40 2 41 70
body:
    sum_x         : THEOREM (FORALL (x: (S)): 
                                sum(S, f) = f(x) + sum(remove(x, S), f))


decl_type: formula
theory: finite_sets_sum
library: finite_sets
signature: nil
location: 43 2 44 60
body:
    sum_x1_x2     : LEMMA (FORALL (x1,x2: (S)): f(x1) + sum(remove(x1,S),f) 
                                = f(x2) + sum(remove(x2,S),f))


decl_type: formula
theory: finite_sets_sum
library: finite_sets
signature: nil
location: 46 2 47 79
body:
    sum_add       : THEOREM sum(add(x,S),f) 
                            = sum(S,f) + IF member(x,S) THEN zero ELSE f(x) ENDIF


decl_type: formula
theory: finite_sets_sum
library: finite_sets
signature: nil
location: 49 2 50 79
body:
    sum_remove    : THEOREM sum(remove(x,S),f) 
                            + IF member(x,S) THEN f(x) ELSE zero ENDIF = sum(S,f)


decl_type: formula
theory: finite_sets_sum
library: finite_sets
signature: nil
location: 52 2 53 68
body:
    sum_rest      : THEOREM NOT empty?(S) IMPLIES
                              f(choose(S)) + sum(rest(S),f) = sum(S,f)


decl_type: formula
theory: finite_sets_sum
library: finite_sets
signature: nil
location: 55 2 56 67
body:
    sum_disj_union: THEOREM disjoint?(A,B) IMPLIES 
                              sum(union(A,B),f) = sum(A,f) + sum(B,f) 


decl_type: formula
theory: finite_sets_sum
library: finite_sets
signature: nil
location: 58 2 59 62
body:
    sum_diff_subset: THEOREM subset?(A, B) IMPLIES 
                              sum(difference(B, A), f) + sum(A, f) = sum(B, f) 


decl_type: formula
theory: finite_sets_sum
library: finite_sets
signature: nil
location: 61 2 62 60
body:
    sum_union      : THEOREM sum(union(A,B),f) + sum(intersection(A,B),f) =
                                           sum(A,f) + sum(B,f) 


decl_type: formula
theory: finite_sets_sum
library: finite_sets
signature: nil
location: 64 2 65 77
body:
    sum_diff_intersection: THEOREM sum(A,f) = 
                              sum(difference(A,B),f) + sum(intersection(A,B),f) 


decl_type: formula
theory: finite_sets_sum
library: finite_sets
signature: nil
location: 67 2 68 60
body:
    sum_f_g         : LEMMA (FORALL (x: (S)): f(x) = g(x)) 
                                 IMPLIES sum(S, f) = sum(S, g)


decl_type: formula
theory: finite_sets_sum
library: finite_sets
signature: nil
location: 70 2 71 45
body:
    sum_particular  : THEOREM sum(S,f) = sum(S, f WITH [x := zero])
                                 + IF S(x) THEN f(x) ELSE zero ENDIF 


decl_type: formula
theory: finite_sets_sum
library: finite_sets
signature: nil
location: 73 2 74 62
body:
    sum_distributive: THEOREM sum(A,f) + sum(A,g) = 
                                  sum(A,(LAMBDA x: f(x) + g(x))) 


decl_type: function
theory: finite_sets_sum
library: finite_sets
signature: [[finite_set[T], [T -> R]] -> R]
location: 31 2 34 39
body:
    sum(S,f) : RECURSIVE R = 
      IF (empty?(S)) THEN zero
      ELSE f(choose(S)) + sum(rest(S),f)
      ENDIF MEASURE (LAMBDA S,f: card(S))


decl_type: tcc
theory: finite_sets_sum
library: finite_sets
signature: nil
location: 81 0 85 999
body:
  % Subtype TCC generated (at line 33, column 18) for  S
      % expected type  p: (nonempty?[T])
  sum_TCC1: OBLIGATION
    FORALL (S: finite_set[T], f: [T -> R]):
      NOT (empty?(S)) IMPLIES nonempty?[T](S);


decl_type: tcc
theory: finite_sets_sum
library: finite_sets
signature: nil
location: 87 0 90 999
body:
  % Termination TCC generated (at line 33, column 24) for  sum(rest(S), f)
  sum_TCC2: OBLIGATION
    FORALL (S: finite_set[T], f: [T -> R]):
      NOT (empty?(S)) IMPLIES card[T](rest[T](S)) < card[T](S);


decl_type: tcc
theory: finite_sets_sum
library: finite_sets
signature: nil
location: 92 0 95 999
body:
  % Subtype TCC generated (at line 53, column 37) for  S
      % expected type  p: (nonempty?[T])
  sum_rest_TCC1: OBLIGATION
    FORALL (S: finite_set[T]): NOT empty?(S) IMPLIES nonempty?[T](S);


decl_type: formula
theory: finite_sets_sum_real
library: finite_sets
signature: nil
location: 41 2 42 69
body:
    sum_remove_rew   : THEOREM sum(remove(t,S),f) = sum(S,f) -
                                  IF member(t,S) THEN f(t) ELSE 0 ENDIF 


decl_type: formula
theory: finite_sets_sum_real
library: finite_sets
signature: nil
location: 45 2 46 72
body:
    sum_rest_rew     : THEOREM NOT empty?(S) IMPLIES
                                  sum(rest(S),f) = sum(S,f) - f(choose(S))


decl_type: formula
theory: finite_sets_sum_real
library: finite_sets
signature: nil
location: 48 2 49 59
body:
    sum_union_rew    : THEOREM sum(union(A,B),f) = sum(A,f) + sum(B,f)
                                   - sum(intersection(A,B),f) 


decl_type: formula
theory: finite_sets_sum_real
library: finite_sets
signature: nil
location: 54 2 55 60
body:
    sum_eq_funs       : THEOREM (FORALL (t: (S)): f(t) = g(t)) 
                                 IMPLIES sum(S, f) = sum(S, g)


decl_type: formula
theory: finite_sets_sum_real
library: finite_sets
signature: nil
location: 57 2 58 46
body:
    sum_particular_gen: THEOREM sum(S,f) = sum(S, f WITH [t := c])
                                 + IF S(t) THEN f(t) - c ELSE 0 ENDIF 


decl_type: formula
theory: finite_sets_sum_real
library: finite_sets
signature: nil
location: 63 2 64 58
body:
    sum_bound    : THEOREM (FORALL (t: (S)): f(t) <= N) 
                               IMPLIES sum(S,f) <= N*card(S)


decl_type: formula
theory: finite_sets_sum_real
library: finite_sets
signature: nil
location: 66 2 67 47
body:
    sum_order    : THEOREM (FORALL (t:T): f(t) <= g(t)) IMPLIES
                             sum(S,f) <= sum(S,g)


decl_type: formula
theory: finite_sets_sum_real
library: finite_sets
signature: nil
location: 71 2 72 67
body:
    sum_pos      : LEMMA (FORALL (t: (S)): f(t) > 0) IMPLIES sum(S,f) > 0 OR
                                                      S = emptyset[T]


decl_type: formula
theory: finite_sets_sum_real
library: finite_sets
signature: nil
location: 87 2 88 59
body:
    sum_order_sub: THEOREM subset?(A,B) AND (FORALL (t:T): fnr(t) <= gnr(t))
                             IMPLIES sum(A,fnr) <= sum(B,gnr)


decl_type: formula
theory: finite_sets_sum_real
library: finite_sets
signature: nil
location: 93 2 94 69
body:
    sum_0_nat       : THEOREM sum(S,gn) = 0 IMPLIES  S = emptyset[T] OR
                                            (FORALL (t:(S)): gn(t) = 0)


decl_type: formula
theory: finite_sets_sum_real
library: finite_sets
signature: nil
location: 98 2 99 77
body:
    sum_0_int       : THEOREM sum(S,gi) = 0 IMPLIES S = emptyset[T]
                                                 OR (FORALL (t:(S)): gi(t) = 0)


decl_type: formula
theory: finite_sets_sum_real
library: finite_sets
signature: nil
location: 101 2 103 67
body:
    sum_0_non_neg   : THEOREM sum(S,f) = 0 AND (FORALL (t: (S)): f(t) >= 0) 
                               IMPLIES S = emptyset[T] 
                                        OR (FORALL (t:(S)): f(t) = 0)


decl_type: tcc
theory: finite_sets_sum_real
library: finite_sets
signature: nil
location: 120 0 127 999
body:
  % Assuming TCC generated (at line 20, column 12) for
      % finite_sets_sum
      %     [T, real, 0,
      %      restrict[[numfield, numfield], [real, real], numfield](+)]
      % generated from assumption finite_sets_sum.zero_identity
  IMP_finite_sets_sum_TCC1: OBLIGATION
    identity?[real]
        (restrict[[numfield, numfield], [real, real], numfield](+))(0);


decl_type: tcc
theory: finite_sets_sum_real
library: finite_sets
signature: nil
location: 129 0 139 999
body:
  % Assuming TCC generated (at line 20, column 12) for
      % finite_sets_sum
      %     [T, real, 0,
      %      restrict[[numfield, numfield], [real, real], numfield](+)]
      % generated from assumption finite_sets_sum.plus_ac
  IMP_finite_sets_sum_TCC2: OBLIGATION
    associative?[real]
        (restrict[[numfield, numfield], [real, real], numfield](+))
     AND
     commutative?[real]
         (restrict[[numfield, numfield], [real, real], numfield](+));


decl_type: tcc
theory: finite_sets_sum_real
library: finite_sets
signature: nil
location: 141 0 144 999
body:
  % Subtype TCC generated (at line 46, column 69) for  S
      % expected type  p: (nonempty?[T])
  sum_rest_rew_TCC1: OBLIGATION
    FORALL (S: finite_set[T]): NOT empty?(S) IMPLIES nonempty?[T](S);


decl_type: tcc
theory: finite_sets_sum_real
library: finite_sets
signature: nil
location: 146 0 160 999
body:
  % Judgement subtype TCC generated (at line 74, column 12) for  sum(A, f)
      % expected type  posreal
  sum_TCC1: OBLIGATION
    FORALL (A: non_empty_finite_set[T], f: [T -> posreal]):
      sum
          [T, real, 0,
           restrict[[numfield, numfield], [real, real], numfield](+)]
          (A, f)
       >= 0
       AND
       sum
           [T, real, 0,
            restrict[[numfield, numfield], [real, real], numfield](+)]
           (A, f)
        > 0;


decl_type: tcc
theory: finite_sets_sum_real
library: finite_sets
signature: nil
location: 162 0 178 999
body:
  % Judgement subtype TCC generated (at line 77, column 12) for  sum(A, f)
      % expected type  int
  sum_TCC2: OBLIGATION
    FORALL (A: finite_set[T], f: [T -> int]):
      rational_pred(sum
                        [T, real, 0,
                         restrict
                             [[numfield, numfield], [real, real], numfield]
                             (+)]
                        (A, f))
       AND
       integer_pred(sum
                        [T, real, 0,
                         restrict
                             [[numfield, numfield], [real, real], numfield]
                             (+)]
                        (A, f));


decl_type: tcc
theory: finite_sets_sum_real
library: finite_sets
signature: nil
location: 180 0 188 999
body:
  % Judgement subtype TCC generated (at line 79, column 12) for  sum(A, f)
      % expected type  nat
  sum_TCC3: OBLIGATION
    FORALL (A: finite_set[T], f: [T -> nat]):
      sum
          [T, real, 0,
           restrict[[numfield, numfield], [real, real], numfield](+)]
          (A, f)
       >= 0;


decl_type: tcc
theory: finite_sets_sum_real
library: finite_sets
signature: nil
location: 190 0 198 999
body:
  % Judgement subtype TCC generated (at line 105, column 12) for  sum(A, f)
      % expected type  nonneg_real
  sum_TCC4: OBLIGATION
    FORALL (A: finite_set[T], f: [T -> nonneg_real]):
      sum
          [T, real, 0,
           restrict[[numfield, numfield], [real, real], numfield](+)]
          (A, f)
       >= 0;


decl_type: tcc
theory: finite_sets_sum_real
library: finite_sets
signature: nil
location: 200 0 208 999
body:
  % Judgement subtype TCC generated (at line 108, column 12) for  sum(A, f)
      % expected type  posnat
  sum_TCC5: OBLIGATION
    FORALL (A: non_empty_finite_set[T], f: [T -> posnat]):
      sum
          [T, real, 0,
           restrict[[numfield, numfield], [real, real], numfield](+)]
          (A, f)
       > 0;


