# TheoryBodies

body:
  %------------------------------------------------------------------------------
  % A Direct Semantics for the While Language
  %
  % All references are to HR and F Nielson "Semantics with Applications:
  % A Formal Introduction", John Wiley & Sons, 1992. (revised edition
  % available: http://www.daimi.au.dk/~hrn )
  %
  %     Author: David Lester, Manchester University, NIA, Université Perpignan
  %
  %     Version 1.0            25/12/07  Initial Version
  %------------------------------------------------------------------------------

  direct[V:TYPE+]: THEORY

  BEGIN

    IMPORTING AExp[V], BExp[V], State[V], Stm[V], Cont[V],
              scott@partial_function_props[State,State],
              scott@fixpoints[Cont,(sq_le)]

    s: VAR State
    S: VAR Stm
    c: VAR Cont

    SS(S) : RECURSIVE Cont =
      cases S of
        Assign(x,a)          : (LAMBDA s: up(assign(x,A(a))(s))),
        Skip                 : (LAMBDA s: up(s)),
        Sequence(S1,S2)      : SS(S2) o SS(S1),
        Conditional(b,S1,S2) : conditional(B(b),SS(S1),SS(S2)),
        While(b,S1)          : fix(LAMBDA c: conditional(B(b), c o SS(S1),
                                             LAMBDA s: up(s)))
      endcases MEASURE S by <<

  END direct

addendum:
  %%% ================ Addendum: generated declarations ================

  % Termination TCC generated (at line 29, column 29) for  SS(S2)
  SS_TCC1: OBLIGATION
    FORALL (S: Stm[V], S1: Stm[V], S2: Stm[V]):
      S = Sequence(S1, S2) IMPLIES <<[V](S2, S);

  % Termination TCC generated (at line 29, column 38) for  SS(S1)
  SS_TCC2: OBLIGATION
    FORALL (S: Stm[V], S1: Stm[V], S2: Stm[V]):
      S = Sequence(S1, S2) IMPLIES <<[V](S1, S);

  % Termination TCC generated (at line 30, column 46) for  SS(S1)
  SS_TCC3: OBLIGATION
    FORALL (S: Stm[V], b: BExp[V], S1: Stm[V], S2: Stm[V]):
      S = Conditional(b, S1, S2) IMPLIES <<[V](S1, S);

  % Termination TCC generated (at line 30, column 53) for  SS(S2)
  SS_TCC4: OBLIGATION
    FORALL (S: Stm[V], b: BExp[V], S1: Stm[V], S2: Stm[V]):
      S = Conditional(b, S1, S2) IMPLIES <<[V](S2, S);

  % Termination TCC generated (at line 31, column 65) for  SS(S1)
  SS_TCC5: OBLIGATION
    FORALL (S: Stm[V], b: BExp[V], S1: Stm[V]):
      S = While(b, S1) IMPLIES <<[V](S1, S);

  % Subtype TCC generated (at line 31, column 33) for
      % LAMBDA c: conditional(B(b), c o SS(S1), LAMBDA s: up(s))
      % expected type  (increasing?)
  SS_TCC6: OBLIGATION
    FORALL (S: Stm[V], v: [{z: Stm[V] | z << S} -> Cont[V]], b: BExp[V],
            S1: Stm[V]):
      S = While(b, S1) IMPLIES
       increasing?[Cont, Cont, (sq_le), (sq_le)]
           (LAMBDA c:
              conditional[V]
                  (B[V](b), o[State[V], State[V], State[V]](c, v(S1)),
                   LAMBDA s: up[State[V]](s)));


body:
  %------------------------------------------------------------------------------
  % The Equivalence of a Direct and Structural Operational Semantics
  %
  % All references are to HR and F Nielson "Semantics with Applications:
  % A Formal Introduction", John Wiley & Sons, 1992. (revised edition
  % available: http://www.daimi.au.dk/~hrn )
  %
  %     Author: David Lester, Manchester University, NIA, Université Perpignan
  %
  %     Version 1.0            25/12/07  Initial Version
  %------------------------------------------------------------------------------

  direct_sos[V:TYPE+]: THEORY

  BEGIN

    IMPORTING direct[V], sos[V], Cont[V], continuation[V]

    S: VAR Stm

    sos_le_direct: LEMMA sq_le(sos.SS(S),direct.SS(S))                 % N&N 4.56

    direct_le_sos: LEMMA sq_le(direct.SS(S),sos.SS(S))                 % N&N 4.57

    direct_eq_sos: LEMMA direct.SS(S) = sos.SS(S)                      % N&N 4.55

  END direct_sos


body:
  %------------------------------------------------------------------------------
  % The Equivalence of a Direct and Continuation Semantics
  %
  % All references are to HR and F Nielson "Semantics with Applications:
  % A Formal Introduction", John Wiley & Sons, 1992. (revised edition
  % available: http://www.daimi.au.dk/~hrn )
  %
  %     Author: David Lester, Manchester University, NIA, Université Perpignan
  %
  %     Version 1.0            25/12/07  Initial Version
  %------------------------------------------------------------------------------

  congruence[V:TYPE+]: THEORY

  BEGIN

    IMPORTING direct[V], continuation[V],
              scott@admissible[Cont,sq_le],
              scott@admissible[(scott_continuous?[Cont,Cont,sq_le,sq_le]),
                               (continuous_pointwise(sq_le,sq_le))]

    s:   VAR State
    c:   VAR Cont
    S:   VAR Stm
    phi: VAR scott_continuous[Cont,Cont,(sq_le),(sq_le)]
    psi: VAR Cont

    P(phi,psi):bool = FORALL c: phi(c) = c o psi

    P_bottom: LEMMA P(LAMBDA c: LAMBDA s: bottom[State], LAMBDA s: bottom[State])

    IMPORTING
    orders@product_orders[(scott_continuous?[Cont,Cont,(sq_le),(sq_le)]),Cont],
    scott@scott_continuity[[(scott_continuous?[Cont,Cont,(sq_le),(sq_le)]),Cont],
                           bool,(continuous_pointwise(sq_le,sq_le)*sq_le),when],
    scott@dual_fixpoints[(scott_continuous?[Cont,Cont,(sq_le),(sq_le)]),Cont,
                         continuous_pointwise(sq_le,sq_le),sq_le]

    admissible_P: LEMMA admissible_pred?(P)

    continuation_direct: LEMMA P(continuation.SS(S),direct.SS(S))      % N&N 4.74

  END congruence

addendum:
  %%% ================ Addendum: generated declarations ================

  % Existence TCC generated (at line 19, column 12) for
      % scott@admissible
      %     [(scott_continuous?[Cont, Cont, sq_le, sq_le]),
      %      (continuous_pointwise(sq_le, sq_le))]
  IMP_admissible_TCC1: OBLIGATION
    EXISTS (x: (scott_continuous?[Cont[V], Cont[V], sq_le[V], sq_le[V]])):
      TRUE;

  % Subtype TCC generated (at line 30, column 20) for
      % LAMBDA c: LAMBDA s: bottom[State]
      % expected type  scott_continuous[Cont, Cont, (sq_le), (sq_le)]
  P_bottom_TCC1: OBLIGATION
    scott_continuous?[Cont[V], Cont[V], (sq_le), (sq_le)]
        (LAMBDA c: LAMBDA s: bottom[State[V]]);

  % Subtype TCC generated (at line 35, column 72) for  WHEN
      % expected type  (directed_complete_partial_order?[boolean])
  IMP_scott_continuity_TCC1: OBLIGATION
    directed_complete_partial_order?[boolean](WHEN);


# Declarations

decl_type: tcc
theory: rationals
library: prelude
signature: nil
location: 91 0 93 999
body:
  % Judgement subtype TCC generated (at line 2077, column 34) for  x + y
      % expected type  rat
  rat_plus_rat_is_rat: OBLIGATION FORALL (x, y): rational_pred(x + y);


decl_type: tcc
theory: rationals
library: prelude
signature: nil
location: 95 0 97 999
body:
  % Judgement subtype TCC generated (at line 2078, column 34) for  x - y
      % expected type  rat
  rat_minus_rat_is_rat: OBLIGATION FORALL (x, y): rational_pred(x - y);


decl_type: tcc
theory: rationals
library: prelude
signature: nil
location: 99 0 101 999
body:
  % Judgement subtype TCC generated (at line 2079, column 34) for  x * y
      % expected type  rat
  rat_times_rat_is_rat: OBLIGATION FORALL (x, y): rational_pred(x * y);


decl_type: tcc
theory: rationals
library: prelude
signature: nil
location: 103 0 105 999
body:
  % Judgement subtype TCC generated (at line 2080, column 34) for  x / n0z
      % expected type  rat
  rat_div_nzrat_is_rat: OBLIGATION FORALL (n0z, x): rational_pred(x / n0z);


decl_type: tcc
theory: rationals
library: prelude
signature: nil
location: 107 0 109 999
body:
  % Judgement subtype TCC generated (at line 2082, column 30) for  -x
      % expected type  rat
  minus_rat_is_rat: OBLIGATION FORALL (x): rational_pred(-x);


decl_type: tcc
theory: rationals
library: prelude
signature: nil
location: 111 0 113 999
body:
  % Judgement subtype TCC generated (at line 2101, column 31) for  x
      % expected type  nzrat
  posrat_is_nzrat: OBLIGATION FORALL (x: posrat): x /= 0;


decl_type: tcc
theory: rationals
library: prelude
signature: nil
location: 115 0 117 999
body:
  % Judgement subtype TCC generated (at line 2102, column 31) for  x
      % expected type  nzrat
  negrat_is_nzrat: OBLIGATION FORALL (x: negrat): x /= 0;


decl_type: tcc
theory: rationals
library: prelude
signature: nil
location: 119 0 121 999
body:
  % Judgement subtype TCC generated (at line 2104, column 40) for  n0x * n0y
      % expected type  nzrat
  nzrat_times_nzrat_is_nzrat: OBLIGATION FORALL (n0x, n0y): n0x * n0y /= 0;


decl_type: tcc
theory: rationals
library: prelude
signature: nil
location: 123 0 125 999
body:
  % Judgement subtype TCC generated (at line 2105, column 40) for  n0x / n0y
      % expected type  nzrat
  nzrat_div_nzrat_is_nzrat: OBLIGATION FORALL (n0x, n0y): n0x / n0y /= 0;


decl_type: tcc
theory: rationals
library: prelude
signature: nil
location: 127 0 129 999
body:
  % Judgement subtype TCC generated (at line 2106, column 40) for  -n0x
      % expected type  nzrat
  minus_nzrat_is_nzrat: OBLIGATION FORALL (n0x): -n0x /= 0;


decl_type: tcc
theory: rationals
library: prelude
signature: nil
location: 131 0 133 999
body:
  % Judgement subtype TCC generated (at line 2108, column 40) for  nnx + nny
      % expected type  nonneg_rat
  nnrat_plus_nnrat_is_nnrat: OBLIGATION FORALL (nnx, nny): nnx + nny >= 0;


decl_type: tcc
theory: rationals
library: prelude
signature: nil
location: 135 0 137 999
body:
  % Judgement subtype TCC generated (at line 2109, column 40) for  nnx * nny
      % expected type  nonneg_rat
  nnrat_times_nnrat_is_nnrat: OBLIGATION FORALL (nnx, nny): nnx * nny >= 0;


decl_type: tcc
theory: rationals
library: prelude
signature: nil
location: 139 0 141 999
body:
  % Judgement subtype TCC generated (at line 2110, column 40) for  nnx / py
      % expected type  nonneg_rat
  nnrat_div_posrat_is_nnrat: OBLIGATION FORALL (nnx, py): nnx / py >= 0;


decl_type: tcc
theory: rationals
library: prelude
signature: nil
location: 143 0 145 999
body:
  % Judgement subtype TCC generated (at line 2111, column 40) for  nnx / ny
      % expected type  nprat
  nnrrat_div_negrat_is_nprat: OBLIGATION FORALL (nnx, ny): nnx / ny <= 0;


decl_type: tcc
theory: rationals
library: prelude
signature: nil
location: 147 0 149 999
body:
  % Judgement subtype TCC generated (at line 2113, column 40) for  npx + npy
      % expected type  nprat
  nprat_plus_nprat_is_nprat: OBLIGATION FORALL (npx, npy): npx + npy <= 0;


decl_type: tcc
theory: rationals
library: prelude
signature: nil
location: 151 0 153 999
body:
  % Judgement subtype TCC generated (at line 2114, column 40) for  npx * npy
      % expected type  nnrat
  nprat_times_nprat_is_nnrat: OBLIGATION FORALL (npx, npy): npx * npy >= 0;


decl_type: tcc
theory: rationals
library: prelude
signature: nil
location: 155 0 157 999
body:
  % Judgement subtype TCC generated (at line 2115, column 40) for  npx / py
      % expected type  nprat
  nprat_div_posrat_is_nprat: OBLIGATION FORALL (npx, py): npx / py <= 0;


decl_type: tcc
theory: rationals
library: prelude
signature: nil
location: 159 0 161 999
body:
  % Judgement subtype TCC generated (at line 2116, column 40) for  npx / ny
      % expected type  nnrat
  nprat_div_negrat_is_nnrat: OBLIGATION FORALL (npx, ny): npx / ny >= 0;


decl_type: tcc
theory: rationals
library: prelude
signature: nil
location: 163 0 165 999
body:
  % Judgement subtype TCC generated (at line 2118, column 43) for  px + nny
      % expected type  posrat
  posrat_plus_nnrat_is_posrat: OBLIGATION FORALL (nny, px): px + nny > 0;


decl_type: tcc
theory: rationals
library: prelude
signature: nil
location: 167 0 169 999
body:
  % Judgement subtype TCC generated (at line 2119, column 43) for  nnx + py
      % expected type  posrat
  nnrat_plus_posrat_is_posrat: OBLIGATION FORALL (nnx, py): nnx + py > 0;


decl_type: tcc
theory: rationals
library: prelude
signature: nil
location: 171 0 173 999
body:
  % Judgement subtype TCC generated (at line 2120, column 43) for  px * py
      % expected type  posrat
  posrat_times_posrat_is_posrat: OBLIGATION FORALL (px, py): px * py > 0;


decl_type: tcc
theory: rationals
library: prelude
signature: nil
location: 175 0 177 999
body:
  % Judgement subtype TCC generated (at line 2121, column 43) for  px / py
      % expected type  posrat
  posrat_div_posrat_is_posrat: OBLIGATION FORALL (px, py): px / py > 0;


decl_type: tcc
theory: rationals
library: prelude
signature: nil
location: 179 0 181 999
body:
  % Judgement subtype TCC generated (at line 2123, column 43) for  nx + ny
      % expected type  negrat
  negrat_plus_negrat_is_negrat: OBLIGATION FORALL (nx, ny): nx + ny < 0;


decl_type: tcc
theory: rationals
library: prelude
signature: nil
location: 183 0 185 999
body:
  % Judgement subtype TCC generated (at line 2124, column 43) for  nx * ny
      % expected type  posrat
  negrat_times_negrat_is_posrat: OBLIGATION FORALL (nx, ny): nx * ny > 0;


decl_type: tcc
theory: rationals
library: prelude
signature: nil
location: 187 0 189 999
body:
  % Judgement subtype TCC generated (at line 2125, column 43) for  nx / ny
      % expected type  posrat
  negrat_div_negrat_is_posrat: OBLIGATION FORALL (nx, ny): nx / ny > 0;


decl_type: formula
theory: finite_sets_of_sets
library: prelude
signature: nil
location: 17 2 22 46
body:
    powerset_natfun_rec_bound: LEMMA
     FORALL (A: finite_set[T],
             n: upto(card(A)),
             f: (bijective?[(A), below(card(A))]),
             B: (powerset(A))):
       powerset_natfun_rec(A, n, f, B) < exp2(n)


decl_type: formula
theory: finite_sets_of_sets
library: prelude
signature: nil
location: 28 2 36 73
body:
    powerset_natfun_inj_rec: LEMMA
     FORALL (A: finite_set[T],
             n: upto(card(A)),
             f: (bijective?[(A), below(card(A))]),
             B1, B2: (powerset(A))):
      powerset_natfun_rec(A, n, f, B1) = powerset_natfun_rec(A, n, f, B2)
        <=> (FORALL (m: upto(card(A))):
              (m < n) IMPLIES
                 (member(inverse(f)(m), B1) IFF member(inverse(f)(m), B2)))


decl_type: formula
theory: finite_sets_of_sets
library: prelude
signature: nil
location: 38 2 41 71
body:
    powerset_natfun_inj: LEMMA
      FORALL (A: finite_set[T]):
        FORALL (B1, B2: (powerset(A))):
          powerset_natfun(A)(B1) = powerset_natfun(A)(B2) IMPLIES B1 = B2


decl_type: formula
theory: finite_sets_of_sets
library: prelude
signature: nil
location: 48 2 49 78
body:
    Union_finite: THEOREM
      FORALL SS: is_finite(Union(SS)) IFF is_finite(SS) AND every(is_finite)(SS)


decl_type: formula
theory: finite_sets_of_sets
library: prelude
signature: nil
location: 51 2 52 49
body:
    finite_Union_finite: LEMMA is_finite(SS) AND every(is_finite[T])(SS) IMPLIES
                               is_finite(Union(SS))


decl_type: formula
theory: finite_sets_of_sets
library: prelude
signature: nil
location: 54 2 56 73
body:
    Union_infinite: COROLLARY
      FORALL SS:
        is_infinite(Union(SS)) IFF is_infinite(SS) OR some(is_infinite)(SS)


decl_type: formula
theory: finite_sets_of_sets
library: prelude
signature: nil
location: 58 2 60 75
body:
    Intersection_finite: THEOREM
      FORALL SS:
        nonempty?(SS) AND every(is_finite)(SS) => is_finite(Intersection(SS))


decl_type: formula
theory: finite_sets_of_sets
library: prelude
signature: nil
location: 62 2 63 70
body:
    Intersection_infinite: COROLLARY
      FORALL SS: is_infinite(Intersection(SS)) => every(is_infinite)(SS)


decl_type: judgement
theory: finite_sets_of_sets
library: prelude
signature: finite_set[set[T]]
location: 68 2 69 66
body:
    Complement_is_finite: JUDGEMENT
      Complement(SS: finite_set[set[T]]) HAS_TYPE finite_set[set[T]]


decl_type: judgement
theory: finite_sets_of_sets
library: prelude
signature: infinite_set[set[T]]
location: 74 2 75 70
body:
    Complement_is_infinite: JUDGEMENT
      Complement(SS: infinite_set[set[T]]) HAS_TYPE infinite_set[set[T]]


decl_type: function
theory: finite_sets_of_sets
library: prelude
location: 6 2 15 11
signature:
  [[A: finite_set[T], upto(card(A)),
         (bijective?[(A), below(card(A))]), (powerset(A))] ->
          nat]

body:
    powerset_natfun_rec(A: finite_set[T],
                        n: upto(card(A)),
                        f: (bijective?[(A), below(card(A))]),
                        B: (powerset(A))):
          RECURSIVE nat =
     IF n = 0 THEN 0
     ELSE LET nval = exp2(n-1) * IF member(inverse(f)(n-1), B) THEN 1 ELSE 0 ENDIF
           IN nval + powerset_natfun_rec(A, n-1, f, B)
     ENDIF
    MEASURE n


decl_type: function
theory: finite_sets_of_sets
library: prelude
signature: [A: finite_set[T] -> [(powerset(A)) -> below(exp2(card(A)))]]
location: 24 2 26 45
body:
    powerset_natfun(A: finite_set[T])(B: (powerset(A))): below(exp2(card(A))) =
      LET f = choose(bijective?[(A), below(card(A))])
       IN powerset_natfun_rec(A, card(A), f, B)


decl_type: tcc
theory: finite_sets_of_sets
library: prelude
signature: nil
location: 82 0 91 999
body:
  % Subtype TCC generated (at line 5955, column 42) for  n - 1
      % expected type  upto(card(A))
  powerset_natfun_rec_TCC1: OBLIGATION
    FORALL (A: finite_set[T], n: upto(card[T](A)),
            f: (bijective?[(A), below(card[T](A))]), B: (powerset[T](A))):
      NOT n = 0 IMPLIES
       (FORALL (nval: (divides(exp2(n - 1)))):
          nval =
           exp2(n - 1) * IF member(inverse(f)(n - 1), B) THEN 1 ELSE 0 ENDIF
           IMPLIES n - 1 >= 0 AND n - 1 <= card[T](A));


decl_type: tcc
theory: finite_sets_of_sets
library: prelude
signature: nil
location: 93 0 102 999
body:
  % Termination TCC generated (at line 5955, column 19) for
      % powerset_natfun_rec(A, n - 1, f, B)
  powerset_natfun_rec_TCC2: OBLIGATION
    FORALL (A: finite_set[T], n: upto(card[T](A)),
            f: (bijective?[(A), below(card[T](A))]), B: (powerset[T](A))):
      NOT n = 0 IMPLIES
       (FORALL (nval: (divides(exp2(n - 1)))):
          nval =
           exp2(n - 1) * IF member(inverse(f)(n - 1), B) THEN 1 ELSE 0 ENDIF
           IMPLIES n - 1 < n);


decl_type: tcc
theory: finite_sets_of_sets
library: prelude
signature: nil
location: 104 0 120 999
body:
  % Subtype TCC generated (at line 5955, column 12) for
      % nval + powerset_natfun_rec(A, n - 1, f, B)
      % expected type  nat
  powerset_natfun_rec_TCC3: OBLIGATION
    FORALL (A: finite_set[T], n: upto(card[T](A)),
            v:
              [{z:
                  [A: finite_set[T], upto(card(A)),
                   (bijective?[(A), below(card(A))]), (powerset(A))] |
                        z`2 < n} ->
                 nat],
            f: (bijective?[(A), below(card[T](A))]), B: (powerset[T](A))):
      NOT n = 0 IMPLIES
       (FORALL (nval: (divides(exp2(n - 1)))):
          nval =
           exp2(n - 1) * IF member(inverse(f)(n - 1), B) THEN 1 ELSE 0 ENDIF
           IMPLIES nval + v(A, n - 1, f, B) >= 0);


decl_type: tcc
theory: finite_sets_of_sets
library: prelude
signature: nil
location: 122 0 127 999
body:
  % Subtype TCC generated (at line 5954, column 24) for  n - 1
      % expected type  nat
  powerset_natfun_rec_TCC4: OBLIGATION
    FORALL (A: finite_set[T], n: upto(card[T](A)),
            f: (bijective?[(A), below(card[T](A))]), B: (powerset[T](A))):
      NOT n = 0 IMPLIES n - 1 >= 0;


decl_type: tcc
theory: finite_sets_of_sets
library: prelude
signature: nil
location: 129 0 134 999
body:
  % Subtype TCC generated (at line 5954, column 52) for  n - 1
      % expected type  below(card(A))
  powerset_natfun_rec_TCC5: OBLIGATION
    FORALL (A: finite_set[T], n: upto(card[T](A)),
            f: (bijective?[(A), below(card[T](A))]), B: (powerset[T](A))):
      NOT n = 0 IMPLIES n - 1 >= 0 AND n - 1 < card[T](A);


decl_type: tcc
theory: finite_sets_of_sets
library: prelude
signature: nil
location: 136 0 140 999
body:
  % Existence TCC generated (at line 5954, column 41) for  inverse
  powerset_natfun_rec_TCC6: OBLIGATION
    FORALL (A: finite_set[T], n: upto(card[T](A)),
            f: (bijective?[(A), below(card[T](A))]), B: (powerset[T](A))):
      NOT n = 0 IMPLIES (EXISTS (x: (A)): TRUE);


decl_type: tcc
theory: finite_sets_of_sets
library: prelude
signature: nil
location: 142 0 148 999
body:
  % Subtype TCC generated (at line 5967, column 19) for
      % bijective?[(A), below(card(A))]
      % expected type  p: (nonempty?[[(A) -> below(card(A))]])
  powerset_natfun_TCC1: OBLIGATION
    FORALL (A: finite_set[T], B: (powerset[T](A))):
      nonempty?[[(A) -> below(card[T](A))]]
          (bijective?[(A), below(card[T](A))]);


decl_type: tcc
theory: finite_sets_of_sets
library: prelude
signature: nil
location: 150 0 156 999
body:
  % Subtype TCC generated (at line 5968, column 31) for  card(A)
      % expected type  upto(card(A))
  powerset_natfun_TCC2: OBLIGATION
    FORALL (A: finite_set[T], B: (powerset[T](A)),
            f: (bijective?[(A), below(card[T](A))])):
      f = choose(bijective?[(A), below(card(A))]) IMPLIES
       card[T](A) <= card[T](A);


decl_type: tcc
theory: finite_sets_of_sets
library: prelude
signature: nil
location: 158 0 165 999
body:
  % Subtype TCC generated (at line 5968, column 8) for
      % powerset_natfun_rec(A, card(A), f, B)
      % expected type  below(exp2(card(A)))
  powerset_natfun_TCC3: OBLIGATION
    FORALL (A: finite_set[T], B: (powerset[T](A)),
            f: (bijective?[(A), below(card[T](A))])):
      f = choose(bijective?[(A), below(card(A))]) IMPLIES
       powerset_natfun_rec(A, card[T](A), f, B) < exp2(card[T](A));


decl_type: tcc
theory: finite_sets_of_sets
library: prelude
signature: nil
location: 167 0 173 999
body:
  % Subtype TCC generated (at line 5978, column 34) for  m
      % expected type  below(card(A))
  powerset_natfun_inj_rec_TCC1: OBLIGATION
    FORALL (A: finite_set[T], n: upto(card[T](A)),
            f: (bijective?[(A), below(card[T](A))]),
            B1, B2: (powerset[T](A)), m: upto(card[T](A))):
      (m < n) IMPLIES m < card[T](A);


decl_type: tcc
theory: finite_sets_of_sets
library: prelude
signature: nil
location: 175 0 180 999
body:
  % Existence TCC generated (at line 5978, column 23) for  inverse
  powerset_natfun_inj_rec_TCC2: OBLIGATION
    FORALL (A: finite_set[T], n: upto(card[T](A)),
            f: (bijective?[(A), below(card[T](A))]),
            B1, B2: (powerset[T](A)), m: upto(card[T](A))):
      (m < n) IMPLIES (EXISTS (x: (A)): TRUE);


decl_type: tcc
theory: finite_sets_of_sets
library: prelude
signature: nil
location: 182 0 185 999
body:
  % Judgement subtype TCC generated (at line 5986, column 4) for  powerset(A)
      % expected type  finite_set[set[T]]
  powerset_finite: OBLIGATION
    FORALL (A: finite_set[T]): is_finite[set[T]](powerset[T](A));


decl_type: tcc
theory: finite_sets_of_sets
library: prelude
signature: nil
location: 187 0 191 999
body:
  % Judgement subtype TCC generated (at line 6011, column 4) for
      % Complement(SS)
      % expected type  finite_set[set[T]]
  Complement_is_finite: OBLIGATION
    FORALL (SS: finite_set[set[T]]): is_finite[set[T]](Complement[T](SS));


decl_type: tcc
theory: finite_sets_of_sets
library: prelude
signature: nil
location: 193 0 198 999
body:
  % Judgement subtype TCC generated (at line 6017, column 4) for
      % Complement(SS)
      % expected type  infinite_set[set[T]]
  Complement_is_infinite: OBLIGATION
    FORALL (SS: infinite_set[set[T]]):
      NOT is_finite[set[T]](Complement[T](SS));


decl_type: formula
theory: bounded_nat_inductions
library: prelude
signature: nil
location: 9 2 11 33
body:
    upto_induction: LEMMA
      (pt(0) AND (FORALL jt: jt < m AND pt(jt) IMPLIES pt(jt + 1)))
        IMPLIES (FORALL jt: pt(jt))


decl_type: formula
theory: bounded_nat_inductions
library: prelude
signature: nil
location: 13 2 15 33
body:
    UPTO_induction: LEMMA
      (FORALL jt: (FORALL kt: kt < jt IMPLIES pt(kt)) IMPLIES pt(jt))
        IMPLIES (FORALL jt: pt(jt))


decl_type: formula
theory: bounded_nat_inductions
library: prelude
signature: nil
location: 20 2 23 33
body:
    below_induction: LEMMA
      ((m > 0 IMPLIES pb(0))
          AND (FORALL jb: jb < m - 1 AND pb(jb) IMPLIES pb(jb + 1)))
        IMPLIES (FORALL jb: pb(jb))


decl_type: formula
theory: bounded_nat_inductions
library: prelude
signature: nil
location: 25 2 27 33
body:
    BELOW_induction: LEMMA
      (FORALL jb: (FORALL kb: kb < jb IMPLIES pb(kb)) IMPLIES pb(jb))
        IMPLIES (FORALL jb: pb(jb))


decl_type: tcc
theory: bounded_nat_inductions
library: prelude
signature: nil
location: 34 0 36 999
body:
  % Subtype TCC generated (at line 3969, column 8) for  0
      % expected type  upto(m)
  upto_induction_TCC1: OBLIGATION 0 <= m;


decl_type: tcc
theory: bounded_nat_inductions
library: prelude
signature: nil
location: 38 0 42 999
body:
  % Subtype TCC generated (at line 3969, column 56) for  jt + 1
      % expected type  upto(m)
  upto_induction_TCC2: OBLIGATION
    FORALL (pt: pred[upto(m)]):
      pt(0) IMPLIES (FORALL (jt): jt < m AND pt(jt) IMPLIES jt + 1 <= m);


decl_type: tcc
theory: bounded_nat_inductions
library: prelude
signature: nil
location: 44 0 46 999
body:
  % Subtype TCC generated (at line 3980, column 23) for  0
      % expected type  below(m)
  below_induction_TCC1: OBLIGATION m > 0 IMPLIES 0 < m;


decl_type: tcc
theory: bounded_nat_inductions
library: prelude
signature: nil
location: 48 0 53 999
body:
  % Subtype TCC generated (at line 3981, column 57) for  jb + 1
      % expected type  below(m)
  below_induction_TCC2: OBLIGATION
    FORALL (pb: pred[below(m)]):
      (m > 0 IMPLIES pb(0)) IMPLIES
       (FORALL (jb): jb < m - 1 AND pb(jb) IMPLIES jb + 1 < m);


decl_type: function
theory: list2set
library: prelude
signature: [list[T] -> set[T]]
location: 8 2 13 17
body:
    list2set(l) : RECURSIVE set[T] =
      CASES l OF
        null: emptyset[T],
        cons(x, y): add(x, list2set(y))
      ENDCASES
     MEASURE length


decl_type: tcc
theory: list2set
library: prelude
signature: nil
location: 22 0 25 999
body:
  % Termination TCC generated (at line 4912, column 25) for  list2set(y)
  list2set_TCC1: OBLIGATION
    FORALL (l: list[T], x: T, y: list[T]):
      l = cons(x, y) IMPLIES length[T](y) < length[T](l);


decl_type: tcc
theory: function_image_aux
library: prelude
signature: nil
location: 31 0 33 999
body:
  % Judgement subtype TCC generated (at line 4413, column 26) for  image(f, S)
      % expected type  finite_set[R]
  finite_image: OBLIGATION FORALL (S, f): is_finite[R](image[D, R](f, S));


decl_type: tcc
theory: function_image_aux
library: prelude
signature: nil
location: 35 0 38 999
body:
  % Subtype TCC generated (at line 4420, column 56) for  inj
      % expected type  [D -> (image(inj, fullset[D]))]
  bijective_image_TCC1: OBLIGATION
    FORALL (inj): FORALL (x1: D): image[D, R](inj, fullset[D])(inj(x1));


decl_type: formula
theory: wf_induction
library: prelude
signature: nil
location: 7 2 13 27
body:
    wf_induction: LEMMA
      (FORALL (p: pred[T]):
        (FORALL (x: T):
          (FORALL (y: T): y<x IMPLIES p(y))
             IMPLIES p(x))
      IMPLIES
        (FORALL (x:T): p(x)))


decl_type: formula
theory: sets
library: prelude
signature: nil
location: 85 2 87 27
body:
    is_singleton: LEMMA
      FORALL a: (nonempty?(a) AND FORALL x, y: a(x) AND a(y) IMPLIES (x=y))
        IMPLIES singleton?(a)


decl_type: tcc
theory: sets
library: prelude
signature: nil
location: 120 0 122 999
body:
  % Subtype TCC generated (at line 803, column 31) for  {y | y = x}
      % expected type  (singleton?)
  singleton_TCC1: OBLIGATION FORALL (x: T): singleton?({y | y = x});


decl_type: tcc
theory: sets
library: prelude
signature: nil
location: 124 0 128 999
body:
  % Subtype TCC generated (at line 807, column 27) for
      % {y | x = y OR member(y, a)}
      % expected type  (nonempty?)
  add_TCC1: OBLIGATION
    FORALL (x: T, a: set): nonempty?({y | x = y OR member(y, a)});


decl_type: tcc
theory: sets
library: prelude
signature: nil
location: 130 0 132 999
body:
  % Existence TCC generated (at line 815, column 2) for
      % choose(p: (nonempty?)): (p)
  choose_TCC1: OBLIGATION EXISTS (x: [p: (nonempty?) -> (p)]): TRUE;


decl_type: tcc
theory: sets
library: prelude
signature: nil
location: 134 0 136 999
body:
  % Existence TCC generated (at line 817, column 64) for  epsilon
  choose_is_epsilon_TCC1: OBLIGATION
    FORALL (p: (nonempty?)): EXISTS (x: T): TRUE;


decl_type: tcc
theory: sets
library: prelude
signature: nil
location: 138 0 140 999
body:
  % Existence TCC generated (at line 819, column 2) for
      % the(p: (singleton?)): (p)
  the_TCC1: OBLIGATION EXISTS (x: [p: (singleton?) -> (p)]): TRUE;


decl_type: tcc
theory: sets
library: prelude
signature: nil
location: 142 0 145 999
body:
  % Subtype TCC generated for  LAMBDA x: member(x, a)
      % expected type  p: (singleton?)
  singleton_elt_TCC1: OBLIGATION
    FORALL (a: (singleton?)): singleton?(LAMBDA x: member(x, a));


decl_type: tcc
theory: sets
library: prelude
signature: nil
location: 147 0 150 999
body:
  % Subtype TCC generated (at line 835, column 75) for  a
      % expected type  p: (nonempty?)
  singleton_elt_def_TCC1: OBLIGATION
    FORALL (a: set): singleton?(a) IMPLIES nonempty?(a);


decl_type: tcc
theory: sets
library: prelude
signature: nil
location: 152 0 154 999
body:
  % Subtype TCC generated (at line 843, column 56) for  a
      % expected type  p: (nonempty?)
  rest_TCC1: OBLIGATION FORALL (a: set): NOT empty?(a) IMPLIES nonempty?(a);


decl_type: tcc
theory: sets
library: prelude
signature: nil
location: 156 0 158 999
body:
  % Judgement subtype TCC generated (at line 855, column 32) for  x
      % expected type  (nonempty?)
  nonempty_singleton: OBLIGATION FORALL (x: (singleton?)): nonempty?(x);


decl_type: tcc
theory: sets
library: prelude
signature: nil
location: 160 0 163 999
body:
  % Judgement subtype TCC generated (at line 856, column 29) for  union(a, b)
      % expected type  (nonempty?)
  nonempty_union1: OBLIGATION
    FORALL (a: (nonempty?), b: set): nonempty?(union(a, b));


decl_type: tcc
theory: sets
library: prelude
signature: nil
location: 165 0 168 999
body:
  % Judgement subtype TCC generated (at line 857, column 29) for  union(a, b)
      % expected type  (nonempty?)
  nonempty_union2: OBLIGATION
    FORALL (a: set, b: (nonempty?)): nonempty?(union(a, b));


decl_type: function
theory: exponentiation
library: prelude
signature: [[real, nat] -> real]
location: 24 2 28 13
body:
    expt(r, n): RECURSIVE real =
      IF n = 0 THEN 1
      ELSE r * expt(r, n-1)
      ENDIF
     MEASURE n;


decl_type: function
theory: exponentiation
library: prelude
signature: [[r: real, {i: int | r /= 0 OR i >= 0}] -> real]
location: 44 2 45 56
body:
    ^(r: real, i:{i:int | r /= 0 OR i >= 0}): real
      = IF i >= 0 THEN expt(r, i) ELSE 1/expt(r, -i) ENDIF


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 230 0 232 999
body:
  % Subtype TCC generated (at line 3421, column 21) for  n - 1
      % expected type  nat
  expt_TCC1: OBLIGATION FORALL (n: nat): NOT n = 0 IMPLIES n - 1 >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 234 0 235 999
body:
  % Termination TCC generated (at line 3421, column 13) for  expt(r, n - 1)
  expt_TCC2: OBLIGATION FORALL (n: nat): NOT n = 0 IMPLIES n - 1 < n;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 237 0 239 999
body:
  % Judgement subtype TCC generated (at line 3429, column 26) for  expt(x, n)
      % expected type  nnreal
  nnreal_expt: OBLIGATION FORALL (n: nat, x: nnreal): expt(x, n) >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 241 0 243 999
body:
  % Judgement subtype TCC generated (at line 3430, column 26) for  expt(x, n)
      % expected type  posreal
  posreal_expt: OBLIGATION FORALL (n: nat, x: posreal): expt(x, n) > 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 245 0 247 999
body:
  % Judgement subtype TCC generated (at line 3431, column 26) for  expt(x, n)
      % expected type  nzreal
  nzreal_expt: OBLIGATION FORALL (n: nat, x: nzreal): expt(x, n) /= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 249 0 251 999
body:
  % Judgement subtype TCC generated (at line 3432, column 26) for  expt(x, n)
      % expected type  rat
  rat_expt: OBLIGATION FORALL (n: nat, x: rat): rational_pred(expt(x, n));


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 253 0 255 999
body:
  % Judgement subtype TCC generated (at line 3433, column 26) for  expt(x, n)
      % expected type  nnrat
  nnrat_expt: OBLIGATION FORALL (n: nat, x: nnrat): expt(x, n) >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 257 0 259 999
body:
  % Judgement subtype TCC generated (at line 3434, column 26) for  expt(x, n)
      % expected type  posrat
  posrat_expt: OBLIGATION FORALL (n: nat, x: posrat): expt(x, n) > 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 261 0 263 999
body:
  % Judgement subtype TCC generated (at line 3435, column 26) for  expt(x, n)
      % expected type  int
  int_expt: OBLIGATION FORALL (n: nat, x: int): integer_pred(expt(x, n));


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 265 0 267 999
body:
  % Judgement subtype TCC generated (at line 3436, column 26) for  expt(x, n)
      % expected type  nat
  nat_expt: OBLIGATION FORALL (n, x: nat): expt(x, n) >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 269 0 271 999
body:
  % Judgement subtype TCC generated (at line 3437, column 26) for  expt(x, n)
      % expected type  posnat
  posnat_expt: OBLIGATION FORALL (n: nat, x: posnat): expt(x, n) > 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 273 0 277 999
body:
  % Subtype TCC generated (at line 3440, column 47) for  -i
      % expected type  nat
  caret_TCC1: OBLIGATION
    FORALL (r: real, i: {i: int | r /= 0 OR i >= 0}):
      NOT i >= 0 IMPLIES -i >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 279 0 283 999
body:
  % Subtype TCC generated (at line 3440, column 39) for  expt(r, -i)
      % expected type  nznum
  caret_TCC2: OBLIGATION
    FORALL (r: real, i: {i: int | r /= 0 OR i >= 0}):
      NOT i >= 0 IMPLIES expt(r, -i) /= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 285 0 287 999
body:
  % Subtype TCC generated (at line 3442, column 21) for  i
      % expected type  {i: int | px /= 0 OR i >= 0}
  expt_pos_TCC1: OBLIGATION FORALL (i: int, px: posreal): px /= 0 OR i >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 289 0 292 999
body:
  % Subtype TCC generated (at line 3444, column 26) for  i
      % expected type  {i: int | n0x /= 0 OR i >= 0}
  expt_nonzero_TCC1: OBLIGATION
    FORALL (i: int, n0x: nzreal): n0x /= 0 OR i >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 294 0 297 999
body:
  % Judgement subtype TCC generated (at line 3446, column 25) for  x ^ i
      % expected type  nnreal
  nnreal_exp: OBLIGATION
    FORALL (x: nnreal, i: int | x /= 0 OR i >= 0): x ^ i >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 299 0 301 999
body:
  % Judgement subtype TCC generated (at line 3447, column 25) for  x ^ i
      % expected type  posreal
  posreal_exp: OBLIGATION FORALL (i: int, x: posreal): x ^ i > 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 303 0 305 999
body:
  % Judgement subtype TCC generated (at line 3448, column 25) for  x ^ i
      % expected type  nzreal
  nzreal_exp: OBLIGATION FORALL (i: int, x: nzreal): x ^ i /= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 307 0 310 999
body:
  % Judgement subtype TCC generated (at line 3449, column 25) for  x ^ i
      % expected type  rat
  rat_exp: OBLIGATION
    FORALL (x: rat, i: int | x /= 0 OR i >= 0): rational_pred(x ^ i);


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 312 0 315 999
body:
  % Judgement subtype TCC generated (at line 3450, column 25) for  x ^ i
      % expected type  nnrat
  nnrat_exp: OBLIGATION
    FORALL (x: nnrat, i: int | x /= 0 OR i >= 0): x ^ i >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 317 0 319 999
body:
  % Subtype TCC generated (at line 3451, column 38) for  i
      % expected type  {i: int | x /= 0 OR i >= 0}
  posrat_exp_TCC1: OBLIGATION FORALL (i: int, x: posrat): x /= 0 OR i >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 321 0 323 999
body:
  % Judgement subtype TCC generated (at line 3451, column 25) for  x ^ i
      % expected type  posrat
  posrat_exp: OBLIGATION FORALL (i: int, x: posrat): x ^ i > 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 325 0 327 999
body:
  % Subtype TCC generated (at line 3452, column 34) for  n
      % expected type  {i: int | x /= 0 OR i >= 0}
  int_exp_TCC1: OBLIGATION FORALL (n: nat, x: int): x /= 0 OR n >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 329 0 331 999
body:
  % Judgement subtype TCC generated (at line 3452, column 25) for  x ^ n
      % expected type  int
  int_exp: OBLIGATION FORALL (n: nat, x: int): integer_pred(x ^ n);


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 333 0 335 999
body:
  % Judgement subtype TCC generated (at line 3453, column 25) for  x ^ n
      % expected type  nat
  nat_exp: OBLIGATION FORALL (n, x: nat): x ^ n >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 337 0 339 999
body:
  % Judgement subtype TCC generated (at line 3454, column 25) for  x ^ n
      % expected type  posint
  posint_exp: OBLIGATION FORALL (n: nat, x: posint): x ^ n > 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 341 0 344 999
body:
  % Subtype TCC generated (at line 3473, column 29) for  m - n
      % expected type  nat
  expt_minus_aux_TCC1: OBLIGATION
    FORALL (m, n: nat): m >= n IMPLIES m - n >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 346 0 348 999
body:
  % Subtype TCC generated (at line 3531, column 19) for  0
      % expected type  {i: int | x /= 0 OR i >= 0}
  expt_x0_TCC1: OBLIGATION FORALL (x: real): x /= 0 OR 0 >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 350 0 352 999
body:
  % Subtype TCC generated (at line 3533, column 19) for  1
      % expected type  {i: int | x /= 0 OR i >= 0}
  expt_x1_TCC1: OBLIGATION FORALL (x: real): x /= 0 OR 1 >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 354 0 356 999
body:
  % Subtype TCC generated (at line 3534, column 19) for  2
      % expected type  {i: int | x /= 0 OR i >= 0}
  expt_x2_TCC1: OBLIGATION FORALL (x: real): x /= 0 OR 2 >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 358 0 360 999
body:
  % Subtype TCC generated (at line 3535, column 19) for  3
      % expected type  {i: int | x /= 0 OR i >= 0}
  expt_x3_TCC1: OBLIGATION FORALL (x: real): x /= 0 OR 3 >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 362 0 364 999
body:
  % Subtype TCC generated (at line 3536, column 19) for  4
      % expected type  {i: int | x /= 0 OR i >= 0}
  expt_x4_TCC1: OBLIGATION FORALL (x: real): x /= 0 OR 4 >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 366 0 368 999
body:
  % Subtype TCC generated (at line 3540, column 21) for  pn
      % expected type  {i: int | x /= 0 OR i >= 0}
  expt_eq_0_TCC1: OBLIGATION FORALL (pn: posnat, x: real): x /= 0 OR pn >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 370 0 373 999
body:
  % Subtype TCC generated (at line 3542, column 24) for  (i + j)
      % expected type  {i: int | n0x /= 0 OR i >= 0}
  expt_plus_TCC1: OBLIGATION
    FORALL (i, j: int, n0x: nzreal): n0x /= 0 OR (i + j) >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 375 0 378 999
body:
  % Subtype TCC generated (at line 3544, column 25) for  (i * j)
      % expected type  {i: int | n0x /= 0 OR i >= 0}
  expt_times_TCC1: OBLIGATION
    FORALL (i, j: int, n0x: nzreal): n0x /= 0 OR (i * j) >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 380 0 383 999
body:
  % Subtype TCC generated (at line 3546, column 27) for  (-i)
      % expected type  {i: int | n0x /= 0 OR i >= 0}
  expt_inverse_TCC1: OBLIGATION
    FORALL (i: int, n0x: nzreal): n0x /= 0 OR (-i) >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 385 0 388 999
body:
  % Subtype TCC generated (at line 3548, column 37) for  (i - j)
      % expected type  {i: int | n0x /= 0 OR i >= 0}
  expt_div_TCC1: OBLIGATION
    FORALL (i, j: int, n0x: nzreal): n0x /= 0 OR (i - j) >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 390 0 393 999
body:
  % Subtype TCC generated (at line 3550, column 31) for  n0i
      % expected type  {i: int | px /= 0 OR i >= 0}
  both_sides_expt1_TCC1: OBLIGATION
    FORALL (n0i: nzint, px: posreal): px /= 0 OR n0i >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 395 0 397 999
body:
  % Subtype TCC generated (at line 3556, column 27) for  n
      % expected type  {i: int | b /= 0 OR i >= 0}
  pos_expt_gt_TCC1: OBLIGATION FORALL (b: above(1), n: nat): b /= 0 OR n >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 399 0 402 999
body:
  % Subtype TCC generated (at line 3560, column 37) for  pm
      % expected type  {i: int | px /= 0 OR i >= 0}
  both_sides_expt_pos_lt_TCC1: OBLIGATION
    FORALL (pm: posnat, px: posreal): px /= 0 OR pm >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 404 0 407 999
body:
  % Subtype TCC generated (at line 3562, column 39) for  i
      % expected type  {i: int | gt1x /= 0 OR i >= 0}
  both_sides_expt_gt1_lt_TCC1: OBLIGATION
    FORALL (gt1x: {r: posreal | r > 1}, i: int): gt1x /= 0 OR i >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 409 0 412 999
body:
  % Subtype TCC generated (at line 3564, column 39) for  i
      % expected type  {i: int | lt1x /= 0 OR i >= 0}
  both_sides_expt_lt1_lt_TCC1: OBLIGATION
    FORALL (i: int, lt1x: {r: posreal | r < 1}): lt1x /= 0 OR i >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 414 0 417 999
body:
  % Subtype TCC generated (at line 3584, column 27) for  pm
      % expected type  {i: int | gt1x /= 0 OR i >= 0}
  expt_gt1_pos_TCC1: OBLIGATION
    FORALL (gt1x: {r: posreal | r > 1}, pm: posnat): gt1x /= 0 OR pm >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 419 0 422 999
body:
  % Subtype TCC generated (at line 3586, column 28) for  (-pm)
      % expected type  {i: int | gt1x /= 0 OR i >= 0}
  expt_gt1_neg_TCC1: OBLIGATION
    FORALL (gt1x: {r: posreal | r > 1}, pm: posnat): gt1x /= 0 OR (-pm) >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 424 0 427 999
body:
  % Subtype TCC generated (at line 3588, column 31) for  (-m)
      % expected type  {i: int | gt1x /= 0 OR i >= 0}
  expt_gt1_nonpos_TCC1: OBLIGATION
    FORALL (gt1x: {r: posreal | r > 1}, m: nat): gt1x /= 0 OR (-m) >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 429 0 432 999
body:
  % Subtype TCC generated (at line 3590, column 32) for  i
      % expected type  {i: int | (n0x * n0y) /= 0 OR i >= 0}
  mult_expt_TCC1: OBLIGATION
    FORALL (i: int, n0x, n0y: nzreal): (n0x * n0y) /= 0 OR i >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 434 0 437 999
body:
  % Subtype TCC generated (at line 3592, column 31) for  i
      % expected type  {i: int | (n0x / n0y) /= 0 OR i >= 0}
  div_expt_TCC1: OBLIGATION
    FORALL (i: int, n0x, n0y: nzreal): (n0x / n0y) /= 0 OR i >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 439 0 442 999
body:
  % Subtype TCC generated (at line 3596, column 27) for  i
      % expected type  {i: int | abs(n0x) /= 0 OR i >= 0}
  abs_expt_TCC1: OBLIGATION
    FORALL (i: int, n0x: nzreal): abs(n0x) /= 0 OR i >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 444 0 447 999
body:
  % Subtype TCC generated (at line 3598, column 29) for  n
      % expected type  {i: int | abs(x) /= 0 OR i >= 0}
  abs_hat_nat_TCC1: OBLIGATION
    FORALL (n: nat, x: real): abs(x) /= 0 OR n >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 449 0 451 999
body:
  % Subtype TCC generated (at line 3598, column 39) for  n
      % expected type  {i: int | x /= 0 OR i >= 0}
  abs_hat_nat_TCC2: OBLIGATION FORALL (n: nat, x: real): x /= 0 OR n >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 453 0 456 999
body:
  % Subtype TCC generated (at line 3616, column 27) for  i
      % expected type  {i: int | b /= 0 OR i >= 0}
  exponent_adjust_TCC1: OBLIGATION
    FORALL (b: above(1), i: int): b /= 0 OR i >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 458 0 461 999
body:
  % Subtype TCC generated (at line 3616, column 32) for  (i - pm)
      % expected type  {i: int | b /= 0 OR i >= 0}
  exponent_adjust_TCC2: OBLIGATION
    FORALL (b: above(1), i: int, pm: posnat): b /= 0 OR (i - pm) >= 0;


decl_type: tcc
theory: exponentiation
library: prelude
signature: nil
location: 463 0 466 999
body:
  % Subtype TCC generated (at line 3616, column 43) for  (i + 1)
      % expected type  {i: int | b /= 0 OR i >= 0}
  exponent_adjust_TCC3: OBLIGATION
    FORALL (b: above(1), i: int): b /= 0 OR (i + 1) >= 0;


decl_type: formula
theory: sets_lemmas
library: prelude
signature: nil
location: 48 2 50 25
body:
    strict_subset_transitive: LEMMA
      strict_subset?(a, b) AND strict_subset?(b, c) IMPLIES
       strict_subset?(a, c)


decl_type: formula
theory: sets_lemmas
library: prelude
signature: nil
location: 84 2 85 77
body:
    intersection_associative: LEMMA
      intersection(intersection(a, b), c) = intersection(a, intersection(b, c))


decl_type: formula
theory: sets_lemmas
library: prelude
signature: nil
location: 95 2 96 74
body:
    intersection_lower_bound: LEMMA
      subset?(c, a) and subset?(c, b) IMPLIES subset?(c, intersection(a, b))


decl_type: formula
theory: sets_lemmas
library: prelude
signature: nil
location: 98 2 100 55
body:
    distribute_intersection_union: LEMMA
      intersection(a, union(b, c))
          = union(intersection(a, b), intersection(a, c))


decl_type: formula
theory: sets_lemmas
library: prelude
signature: nil
location: 102 2 103 73
body:
    distribute_union_intersection: LEMMA
      union(a, intersection(b, c)) = intersection(union(a, b), union(a, c))


decl_type: formula
theory: sets_lemmas
library: prelude
signature: nil
location: 136 2 138 51
body:
    difference_difference2: LEMMA
      difference(a, difference(b, c))
        = union(difference(a, b), intersection(a, c))


decl_type: formula
theory: sets_lemmas
library: prelude
signature: nil
location: 200 2 201 58
body:
    rest_empty_lem: LEMMA NOT empty?(a) AND empty?(rest(a))
                            IMPLIES a = singleton(choose(a))


decl_type: formula
theory: sets_lemmas
library: prelude
signature: nil
location: 211 2 213 53
body:
    union_disj_remove_left: LEMMA
      disjoint?(a, b) AND a(x) IMPLIES
        union(remove(x, a), b) = remove(x, union(a, b))


decl_type: formula
theory: sets_lemmas
library: prelude
signature: nil
location: 215 2 217 53
body:
    union_disj_remove_right: LEMMA
      disjoint?(a, b) AND b(x) IMPLIES
        union(a, remove(x, b)) = remove(x, union(a, b))


decl_type: formula
theory: sets_lemmas
library: prelude
signature: nil
location: 247 2 248 71
body:
    Union_union_rew: LEMMA nonempty?(A) IMPLIES
                              Union(A) = union(choose(A), Union(rest(A)))


decl_type: formula
theory: sets_lemmas
library: prelude
signature: nil
location: 250 2 252 50
body:
    Intersection_empty: LEMMA
      empty?(Intersection(A)) IFF
       (FORALL x: EXISTS (a: (A)): NOT member(x, a))


decl_type: formula
theory: sets_lemmas
library: prelude
signature: nil
location: 266 2 268 70
body:
    Intersection_intersection_rew: LEMMA
      nonempty?(A) IMPLIES
        Intersection(A) = intersection(choose(A), Intersection(rest(A)))


decl_type: tcc
theory: sets_lemmas
library: prelude
signature: nil
location: 292 0 294 999
body:
  % Judgement subtype TCC generated (at line 905, column 4) for  subset?[T]
      % expected type  (partial_order?[set[T]])
  subset_is_partial_order: OBLIGATION partial_order?[set[T]](subset?[T]);


decl_type: tcc
theory: sets_lemmas
library: prelude
signature: nil
location: 296 0 300 999
body:
  % Judgement subtype TCC generated (at line 916, column 4) for
      % strict_subset?[T]
      % expected type  (strict_order?[set[T]])
  strict_subset_is_strict_order: OBLIGATION
    strict_order?[set[T]](strict_subset?[T]);


decl_type: tcc
theory: sets_lemmas
library: prelude
signature: nil
location: 302 0 305 999
body:
  % Subtype TCC generated (at line 1037, column 54) for  a
      % expected type  p: (nonempty?)
  choose_rest_TCC1: OBLIGATION
    FORALL (a: set[T]): NOT empty?(a) IMPLIES nonempty?[T](a);


decl_type: tcc
theory: sets_lemmas
library: prelude
signature: nil
location: 307 0 311 999
body:
  % Subtype TCC generated (at line 1053, column 56) for  a
      % expected type  p: (nonempty?)
  choose_rest_or_TCC1: OBLIGATION
    FORALL (a: set[T], x: T):
      member(x, a) AND NOT member(x, rest(a)) IMPLIES nonempty?[T](a);


decl_type: tcc
theory: sets_lemmas
library: prelude
signature: nil
location: 313 0 315 999
body:
  % Judgement subtype TCC generated (at line 1086, column 31) for  powerset(a)
      % expected type  (nonempty?[set[T]])
  nonempty_powerset: OBLIGATION FORALL (a): nonempty?[set[T]](powerset[T](a));


decl_type: tcc
theory: sets_lemmas
library: prelude
signature: nil
location: 317 0 319 999
body:
  % Judgement subtype TCC generated (at line 1104, column 4) for  Union
      % expected type  (surjective?[setofsets[T], set[T]])
  Union_surjective: OBLIGATION surjective?[setofsets[T], set[T]](Union[T]);


decl_type: tcc
theory: sets_lemmas
library: prelude
signature: nil
location: 321 0 324 999
body:
  % Judgement subtype TCC generated (at line 1125, column 4) for  Intersection
      % expected type  (surjective?[setofsets[T], set[T]])
  Intersection_surjective: OBLIGATION
    surjective?[setofsets[T], set[T]](Intersection[T]);


decl_type: tcc
theory: sets_lemmas
library: prelude
signature: nil
location: 326 0 329 999
body:
  % Judgement subtype TCC generated (at line 1143, column 4) for  Complement
      % expected type  (bijective?[setofsets[T], setofsets[T]])
  Complement_bijective: OBLIGATION
    bijective?[setofsets[T], setofsets[T]](Complement);


decl_type: judgement
theory: function_props_alt
library: prelude
signature: (preserves[T1, T3, R1, R3])
location: 4 3 6 43
body:
     composition_preserves: JUDGEMENT
       o(f2: (preserves[T2, T3, R2, R3]), f1: (preserves[T1, T2, R1, R2]))
         HAS_TYPE (preserves[T1, T3, R1, R3])


decl_type: judgement
theory: function_props_alt
library: prelude
signature: (inverts[T1, T3, R1, R3])
location: 8 3 10 41
body:
     composition_inverts1: JUDGEMENT
       o(f2: (preserves[T2, T3, R2, R3]), f1: (inverts[T1, T2, R1, R2]))
         HAS_TYPE (inverts[T1, T3, R1, R3])


decl_type: judgement
theory: function_props_alt
library: prelude
signature: (inverts[T1, T3, R1, R3])
location: 12 3 14 41
body:
     composition_inverts2: JUDGEMENT
       o(f2: (inverts[T2, T3, R2, R3]), f1: (preserves[T1, T2, R1, R2]))
         HAS_TYPE (inverts[T1, T3, R1, R3])


decl_type: tcc
theory: function_props_alt
library: prelude
signature: nil
location: 20 0 25 999
body:
  % Judgement subtype TCC generated (at line 1509, column 5) for  f2 o f1
      % expected type  (preserves[T1, T3, R1, R3])
  composition_preserves: OBLIGATION
    FORALL (f1: (preserves[T1, T2, R1, R2]),
            f2: (preserves[T2, T3, R2, R3])):
      preserves[T1, T3, R1, R3](o[T1, T2, T3](f2, f1));


decl_type: tcc
theory: function_props_alt
library: prelude
signature: nil
location: 27 0 31 999
body:
  % Judgement subtype TCC generated (at line 1513, column 5) for  f2 o f1
      % expected type  (inverts[T1, T3, R1, R3])
  composition_inverts1: OBLIGATION
    FORALL (f1: (inverts[T1, T2, R1, R2]), f2: (preserves[T2, T3, R2, R3])):
      inverts[T1, T3, R1, R3](o[T1, T2, T3](f2, f1));


decl_type: tcc
theory: function_props_alt
library: prelude
signature: nil
location: 33 0 37 999
body:
  % Judgement subtype TCC generated (at line 1517, column 5) for  f2 o f1
      % expected type  (inverts[T1, T3, R1, R3])
  composition_inverts2: OBLIGATION
    FORALL (f1: (preserves[T1, T2, R1, R2]), f2: (inverts[T2, T3, R2, R3])):
      inverts[T1, T3, R1, R3](o[T1, T2, T3](f2, f1));


decl_type: judgement
theory: relation_converse_props
library: prelude
signature: (antisymmetric?[T])
location: 21 2 22 65
body:
    antisymmetric_converse: JUDGEMENT
      converse(R: (antisymmetric?[T])) HAS_TYPE (antisymmetric?[T])


decl_type: judgement
theory: relation_converse_props
library: prelude
signature: (partial_order?[T])
location: 36 2 37 65
body:
    partial_order_converse: JUDGEMENT
      converse(R: (partial_order?[T])) HAS_TYPE (partial_order?[T])


decl_type: judgement
theory: relation_converse_props
library: prelude
signature: (strict_total_order?[T])
location: 51 2 52 75
body:
    strict_total_order_converse: JUDGEMENT
      converse(R: (strict_total_order?[T])) HAS_TYPE (strict_total_order?[T])


decl_type: tcc
theory: relation_converse_props
library: prelude
signature: nil
location: 59 0 62 999
body:
  % Judgement subtype TCC generated (at line 1639, column 4) for  converse(R)
      % expected type  (reflexive?[T])
  reflexive_converse: OBLIGATION
    FORALL (R: (reflexive?[T])): reflexive?[T](converse[T, T](R));


decl_type: tcc
theory: relation_converse_props
library: prelude
signature: nil
location: 64 0 67 999
body:
  % Judgement subtype TCC generated (at line 1642, column 4) for  converse(R)
      % expected type  (irreflexive?[T])
  irreflexive_converse: OBLIGATION
    FORALL (R: (irreflexive?[T])): irreflexive?[T](converse[T, T](R));


decl_type: tcc
theory: relation_converse_props
library: prelude
signature: nil
location: 69 0 72 999
body:
  % Judgement subtype TCC generated (at line 1645, column 4) for  converse(R)
      % expected type  (symmetric?[T])
  symmetric_converse: OBLIGATION
    FORALL (R: (symmetric?[T])): symmetric?[T](converse[T, T](R));


decl_type: tcc
theory: relation_converse_props
library: prelude
signature: nil
location: 74 0 77 999
body:
  % Judgement subtype TCC generated (at line 1648, column 4) for  converse(R)
      % expected type  (antisymmetric?[T])
  antisymmetric_converse: OBLIGATION
    FORALL (R: (antisymmetric?[T])): antisymmetric?[T](converse[T, T](R));


decl_type: tcc
theory: relation_converse_props
library: prelude
signature: nil
location: 79 0 82 999
body:
  % Judgement subtype TCC generated (at line 1651, column 4) for  converse(R)
      % expected type  (connected?[T])
  connected_converse: OBLIGATION
    FORALL (R: (connected?[T])): connected?[T](converse[T, T](R));


decl_type: tcc
theory: relation_converse_props
library: prelude
signature: nil
location: 84 0 87 999
body:
  % Judgement subtype TCC generated (at line 1654, column 4) for  converse(R)
      % expected type  (transitive?[T])
  transitive_converse: OBLIGATION
    FORALL (R: (transitive?[T])): transitive?[T](converse[T, T](R));


decl_type: tcc
theory: relation_converse_props
library: prelude
signature: nil
location: 89 0 92 999
body:
  % Judgement subtype TCC generated (at line 1657, column 4) for  converse(R)
      % expected type  (equivalence?[T])
  equivalence_converse: OBLIGATION
    FORALL (R: (equivalence?[T])): equivalence?[T](converse[T, T](R));


decl_type: tcc
theory: relation_converse_props
library: prelude
signature: nil
location: 94 0 97 999
body:
  % Judgement subtype TCC generated (at line 1660, column 4) for  converse(R)
      % expected type  (preorder?[T])
  preorder_converse: OBLIGATION
    FORALL (R: (preorder?[T])): preorder?[T](converse[T, T](R));


decl_type: tcc
theory: relation_converse_props
library: prelude
signature: nil
location: 99 0 102 999
body:
  % Judgement subtype TCC generated (at line 1663, column 4) for  converse(R)
      % expected type  (partial_order?[T])
  partial_order_converse: OBLIGATION
    FORALL (R: (partial_order?[T])): partial_order?[T](converse[T, T](R));


decl_type: tcc
theory: relation_converse_props
library: prelude
signature: nil
location: 104 0 107 999
body:
  % Judgement subtype TCC generated (at line 1666, column 4) for  converse(R)
      % expected type  (strict_order?[T])
  strict_order_converse: OBLIGATION
    FORALL (R: (strict_order?[T])): strict_order?[T](converse[T, T](R));


decl_type: tcc
theory: relation_converse_props
library: prelude
signature: nil
location: 109 0 112 999
body:
  % Judgement subtype TCC generated (at line 1669, column 4) for  converse(R)
      % expected type  (dichotomous?[T])
  dichotomous_converse: OBLIGATION
    FORALL (R: (dichotomous?[T])): dichotomous?[T](converse[T, T](R));


decl_type: tcc
theory: relation_converse_props
library: prelude
signature: nil
location: 114 0 117 999
body:
  % Judgement subtype TCC generated (at line 1672, column 4) for  converse(R)
      % expected type  (total_order?[T])
  total_order_converse: OBLIGATION
    FORALL (R: (total_order?[T])): total_order?[T](converse[T, T](R));


decl_type: tcc
theory: relation_converse_props
library: prelude
signature: nil
location: 119 0 122 999
body:
  % Judgement subtype TCC generated (at line 1675, column 4) for  converse(R)
      % expected type  (trichotomous?[T])
  trichotomous_converse: OBLIGATION
    FORALL (R: (trichotomous?[T])): trichotomous?[T](converse[T, T](R));


decl_type: tcc
theory: relation_converse_props
library: prelude
signature: nil
location: 124 0 128 999
body:
  % Judgement subtype TCC generated (at line 1678, column 4) for  converse(R)
      % expected type  (strict_total_order?[T])
  strict_total_order_converse: OBLIGATION
    FORALL (R: (strict_total_order?[T])):
      strict_total_order?[T](converse[T, T](R));


decl_type: function
theory: stdfmap
library: prelude
signature:
  [[IStream, [IStream -> string], T, [[string, T] -> T], nat] ->
  T]

location: 8 2 19 13
body:
    fmap(f:IStream,fread:[IStream->string],t:T,st:[[string,T]->T],n:nat) : 
      RECURSIVE T =
      IF fopen?(f) THEN
        IF n=0 or eof?(f) THEN t
        ELSE
          LET s  = fread(f) IN
          LET nt = st(s,t) IN
            fmap(f,fread,nt,st,n-1)
        ENDIF
      ELSE throw(ClosedStream,fname(f))
      ENDIF
      MEASURE n


decl_type: function
theory: stdfmap
library: prelude
signature: [[IStream, [IStream -> string], T, [[string, T] -> T]] -> T]
location: 22 2 25 22
body:
    fmap(f:IStream,fread:[IStream->string],t:T,st:[[string,T]->T]) : T =
      let l  = flength(f) in
      let nt = fmap(f,fread,t,st,l) in  
      prog(fclose(f),nt)


decl_type: function
theory: stdfmap
library: prelude
signature: [[IStream, T, [[string, T] -> T]] -> T]
location: 28 2 31 22
body:
    fmap_line(f:IStream,t:T,st:[[string,T]->T]):T =
      let l  = flength(f) in
      let nt = fmap(f,fread_line,t,st,l) in  
      prog(fclose(f),nt)


decl_type: tcc
theory: stdfmap
library: prelude
signature: nil
location: 45 0 53 999
body:
  % Subtype TCC generated (at line 7004, column 29) for  n - 1
      % expected type  nat
  fmap_TCC1: OBLIGATION
    FORALL (f: IStream, fread: [IStream -> string], t: T,
            st: [[string, T] -> T], n: nat):
      NOT n = 0 AND NOT eof?(f) AND fopen?(f) IMPLIES
       (FORALL (s: string):
          s = fread(f) IMPLIES
           (FORALL (nt: T): nt = st(s, t) IMPLIES n - 1 >= 0));


decl_type: tcc
theory: stdfmap
library: prelude
signature: nil
location: 55 0 63 999
body:
  % Termination TCC generated (at line 7004, column 10) for
      % fmap(f, fread, nt, st, n - 1)
  fmap_TCC2: OBLIGATION
    FORALL (f: IStream, fread: [IStream -> string], t: T,
            st: [[string, T] -> T], n: nat):
      NOT n = 0 AND NOT eof?(f) AND fopen?(f) IMPLIES
       (FORALL (s: string):
          s = fread(f) IMPLIES
           (FORALL (nt: T): nt = st(s, t) IMPLIES n - 1 < n));


decl_type: type
theory: stdsys
library: prelude
signature: nil
location: 7 2 17 4
body:
    Time : TYPE = [# 
      second : below(60),
      minute : below(60),
      hour   : below(24),
      day    : subrange(1,31),
      month  : subrange(1,12),
      year   : nat,
      dow    : below(7), % Day of week: 0 Monday
      dst    : bool,     % Dayligth saving time?
      tz     : {x:rat| -24 <= x AND x <= 24} % Time zone 
    #]


decl_type: function
theory: stdsys
library: prelude
signature: [below(7) -> string]
location: 31 2 39 9
body:
    days_of_week(dow:below(7)):string =
      if    dow=0 then "Monday"
      elsif dow=1 then "Tuesday"
      elsif dow=2 then "Wednesday"
      elsif dow=3 then "Thursday" 
      elsif dow=4 then "Friday"
      elsif dow=5 then "Saturday"
      else  "Sunday"
      endif


decl_type: function
theory: stdsys
library: prelude
signature: [subrange(1, 12) -> string]
location: 41 2 54 9
body:
    months(month:subrange(1,12)):string =
      if    month=1  then "January"
      elsif month=2  then "February"
      elsif month=3  then "March"
      elsif month=4  then "April"
      elsif month=5  then "May"
      elsif month=6  then "June"
      elsif month=7  then "July"
      elsif month=8  then "August"
      elsif month=9  then "September"
      elsif month=10 then "October"
      elsif month=11 then "November"
      else "December"
      endif


decl_type: function
theory: stdsys
library: prelude
signature: [Time -> string]
location: 56 2 60 29
body:
    tostr(t:Time): string =
      days_of_week(dow(t))+" "+months(month(t))+
      format(" ~2,'0d ",day(t))+year(t)+
      format(", ~2,'0d:~2,'0d:~2,'0d ",(hour(t),minute(t),second(t)))+
      format("(GMT~@d)",-tz(t))


decl_type: constant
theory: stdsys
library: prelude
signature: Time
location: 19 2 29 4
body:
    tinybang : Time = (#
      day    := 1,
      dow    := 0,
      dst    := false,
      hour   := 0,
      minute := 0,
      month  := 1,
      second := 0,
      tz     := 0,
      year   := 0
    #)


decl_type: function
theory: bv_concat_def
library: prelude
signature: [[bvec[n], bvec[m]] -> bvec[n + m]]
location: 21 2 24 39
body:
    o(bvn: bvec[n], bvm: bvec[m]): bvec[n+m] =
         (LAMBDA (nm: below(n+m)): IF nm < m THEN bvm(nm)
                                   ELSE bvn(nm - m)
                                   ENDIF)


decl_type: tcc
theory: bv_concat_def
library: prelude
signature: nil
location: 31 0 34 999
body:
  % Subtype TCC generated (at line 5319, column 42) for  nm - m
      % expected type  below(n)
  oh_TCC1: OBLIGATION
    FORALL (nm: below(n + m)): NOT nm < m IMPLIES nm - m >= 0 AND nm - m < n;


decl_type: formula
theory: function_inverse_def
library: prelude
signature: nil
location: 59 2 60 76
body:
    injective_inverse_alt: LEMMA
      FORALL (f: (injective?[D, R])), (g: (inverse?(f))): r = f(d) => g(r) = d


decl_type: formula
theory: function_inverse_def
library: prelude
signature: nil
location: 62 2 63 67
body:
    comp_inverse_left_inj_alt: LEMMA
      FORALL (f: (injective?[D, R])), (g: (inverse?(f))): g(f(d)) = d


decl_type: formula
theory: function_inverse_def
library: prelude
signature: nil
location: 76 2 77 77
body:
    surj_right_alt: LEMMA
      FORALL (f: (surjective?[D, R])), (g: (inverse?(f))): right_inverse?(g, f)


decl_type: formula
theory: function_inverse_def
library: prelude
signature: nil
location: 82 2 83 77
body:
    surjective_inverse_alt: LEMMA
      FORALL (f: (surjective?[D, R])), (g: (inverse?(f))): g(r) = d => r = f(d)


decl_type: formula
theory: function_inverse_def
library: prelude
signature: nil
location: 85 2 86 68
body:
    comp_inverse_right_surj_alt: LEMMA
      FORALL (f: (surjective?[D, R])), (g: (inverse?(f))): f(g(r)) = r


decl_type: formula
theory: function_inverse_def
library: prelude
signature: nil
location: 93 2 96 38
body:
    left_right_bij: COROLLARY
      FORALL f, g:
        right_inverse?(g, f) AND left_inverse?(g, f) =>
         bijective?(f) AND bijective?(g)


decl_type: formula
theory: function_inverse_def
library: prelude
signature: nil
location: 98 2 100 50
body:
    bij_left_right: COROLLARY
      FORALL (f: (bijective?[D, R])), (g: (inverse?(f))):
        right_inverse?(g, f) AND left_inverse?(g, f)


decl_type: formula
theory: function_inverse_def
library: prelude
signature: nil
location: 102 2 103 69
body:
    bij_inv_is_bij_alt: COROLLARY
      FORALL (f: (bijective?[D, R])), (g: (inverse?(f))): bijective?(g)


decl_type: formula
theory: function_inverse_def
library: prelude
signature: nil
location: 105 2 106 77
body:
    bijective_inverse_alt: COROLLARY
      FORALL (f: (bijective?[D, R])), (g: (inverse?(f))): g(r) = d IFF r = f(d)


decl_type: formula
theory: function_inverse_def
library: prelude
signature: nil
location: 108 2 109 67
body:
    comp_inverse_right_alt: COROLLARY
      FORALL (f: (bijective?[D, R])), (g: (inverse?(f))): f(g(r)) = r


decl_type: formula
theory: function_inverse_def
library: prelude
signature: nil
location: 111 2 112 67
body:
    comp_inverse_left_alt: COROLLARY
      FORALL (f: (bijective?[D, R])), (g: (inverse?(f))): g(f(d)) = d


decl_type: formula
theory: function_inverse_def
library: prelude
signature: nil
location: 122 2 124 56
body:
    exists_inv2: LEMMA
      (EXISTS (f: (surjective?[D, R])): TRUE) =>
         ((EXISTS (d: D): TRUE) OR (FORALL (r: R): FALSE))


decl_type: formula
theory: function_inverse_def
library: prelude
signature: nil
location: 125 2 127 56
body:
    exists_inv3: LEMMA
      (EXISTS f: NOT injective?(f)) =>
         ((EXISTS (d: D): TRUE) OR (FORALL (r: R): FALSE))


decl_type: formula
theory: measure_induction
library: prelude
signature: nil
location: 7 1 12 34
body:
   measure_induction: LEMMA
    (FORALL (p: pred[T]):
       (FORALL (x: T): 
           (FORALL (y: T): m(y) < m(x) IMPLIES  p(y))
               IMPLIES p(x))
      IMPLIES (FORALL (x: T): p(x)))


decl_type: tcc
theory: functions
library: prelude
signature: nil
location: 59 0 61 999
body:
  % Judgement subtype TCC generated (at line 270, column 24) for  x
      % expected type  (injective?)
  bij_is_inj: OBLIGATION FORALL (x: (bijective?)): injective?(x);


decl_type: tcc
theory: functions
library: prelude
signature: nil
location: 63 0 65 999
body:
  % Judgement subtype TCC generated (at line 272, column 25) for  x
      % expected type  (surjective?)
  bij_is_surj: OBLIGATION FORALL (x: (bijective?)): surjective?(x);


decl_type: formula
theory: floor_ceil
library: prelude
signature: nil
location: 53 2 54 81
body:
    floor_plus: LEMMA 
          floor(x + y) = floor(x) + floor(y) + floor(fractional(x) + fractional(y))


decl_type: formula
theory: floor_ceil
library: prelude
signature: nil
location: 56 2 57 85
body:
    ceiling_plus: LEMMA
          ceiling(x + y) = floor(x) + floor(y) + ceiling(fractional(x) + fractional(y))


decl_type: formula
theory: floor_ceil
library: prelude
signature: nil
location: 67 2 68 70
body:
    floor_small: LEMMA  abs(i) < abs(j) IMPLIES
                           floor(i/j) = IF i/j >= 0 THEN 0 ELSE -1 ENDIF


decl_type: tcc
theory: floor_ceil
library: prelude
signature: nil
location: 83 0 86 999
body:
  % Existence TCC generated (at line 3334, column 2) for
      % floor(x): {i | i <= x & x < i + 1}
  floor_TCC1: OBLIGATION
    EXISTS (x1: [x: real -> {i | i <= x & x < 1 + i}]): TRUE;


decl_type: tcc
theory: floor_ceil
library: prelude
signature: nil
location: 88 0 91 999
body:
  % Subtype TCC generated (at line 3336, column 40) for  x - floor(x)
      % expected type  {x | 0 <= x & x < 1}
  fractional_TCC1: OBLIGATION
    FORALL (x: real): 0 <= x - floor(x) & x - floor(x) < 1;


decl_type: tcc
theory: floor_ceil
library: prelude
signature: nil
location: 93 0 96 999
body:
  % Existence TCC generated (at line 3338, column 2) for
      % ceiling(x): {i | x <= i & i < x + 1}
  ceiling_TCC1: OBLIGATION
    EXISTS (x1: [x: real -> {i | x <= i & i < 1 + x}]): TRUE;


decl_type: tcc
theory: floor_ceil
library: prelude
signature: nil
location: 98 0 100 999
body:
  % Judgement subtype TCC generated (at line 3348, column 33) for  floor(x)
      % expected type  nat
  nonneg_floor_is_nat: OBLIGATION FORALL (x: nonneg_real): floor(x) >= 0;


decl_type: tcc
theory: floor_ceil
library: prelude
signature: nil
location: 102 0 104 999
body:
  % Judgement subtype TCC generated (at line 3349, column 35) for  ceiling(x)
      % expected type  nat
  nonneg_ceiling_is_nat: OBLIGATION FORALL (x: nonneg_real): ceiling(x) >= 0;


decl_type: formula
theory: infinite_sets_def
library: prelude
signature: nil
location: 45 2 47 66
body:
    infinite_union: THEOREM
      FORALL S, R:
        is_infinite(union(S, R)) => is_infinite(S) OR is_infinite(R)


decl_type: formula
theory: infinite_sets_def
library: prelude
signature: nil
location: 49 2 51 74
body:
    infinite_intersection: THEOREM
      FORALL S, R:
        is_infinite(intersection(S, R)) => is_infinite(S) AND is_infinite(R)


decl_type: tcc
theory: infinite_sets_def
library: prelude
signature: nil
location: 65 0 67 999
body:
  % Judgement subtype TCC generated (at line 5914, column 31) for  x
      % expected type  (nonempty?[T])
  infinite_nonempty: OBLIGATION FORALL (x: infinite_set): nonempty?[T](x);


decl_type: tcc
theory: infinite_sets_def
library: prelude
signature: nil
location: 69 0 71 999
body:
  % Judgement subtype TCC generated (at line 5916, column 26) for  add(t, Inf)
      % expected type  infinite_set
  infinite_add: OBLIGATION FORALL (Inf, t): NOT is_finite[T](add[T](t, Inf));


decl_type: tcc
theory: infinite_sets_def
library: prelude
signature: nil
location: 73 0 77 999
body:
  % Judgement subtype TCC generated (at line 5918, column 29) for
      % remove(t, Inf)
      % expected type  infinite_set
  infinite_remove: OBLIGATION
    FORALL (Inf, t): NOT is_finite[T](remove[T](t, Inf));


decl_type: tcc
theory: infinite_sets_def
library: prelude
signature: nil
location: 79 0 83 999
body:
  % Judgement subtype TCC generated (at line 5922, column 33) for
      % union(Inf, S)
      % expected type  infinite_set
  infinite_union_left: OBLIGATION
    FORALL (Inf, S): NOT is_finite[T](union[T](Inf, S));


decl_type: tcc
theory: infinite_sets_def
library: prelude
signature: nil
location: 85 0 89 999
body:
  % Judgement subtype TCC generated (at line 5923, column 34) for
      % union(S, Inf)
      % expected type  infinite_set
  infinite_union_right: OBLIGATION
    FORALL (Inf, S): NOT is_finite[T](union[T](S, Inf));


decl_type: tcc
theory: infinite_sets_def
library: prelude
signature: nil
location: 91 0 95 999
body:
  % Judgement subtype TCC generated (at line 5933, column 33) for
      % difference(Inf, Fin)
      % expected type  infinite_set
  infinite_difference: OBLIGATION
    FORALL (Fin, Inf): NOT is_finite[T](difference[T](Inf, Fin));


decl_type: tcc
theory: infinite_sets_def
library: prelude
signature: nil
location: 97 0 99 999
body:
  % Judgement subtype TCC generated (at line 5935, column 27) for  rest(Inf)
      % expected type  infinite_set
  infinite_rest: OBLIGATION FORALL (Inf): NOT is_finite[T](rest[T](Inf));


decl_type: formula
theory: KernelDefinition
library: prelude
signature: nil
location: 20 2 21 73
body:
    PreservesEq_is_preserving: LEMMA
      PreservesEq(R) = preserves(restrict[[X, X], [X1, X1], bool](R), =[Y])


decl_type: tcc
theory: KernelDefinition
library: prelude
signature: nil
location: 28 0 32 999
body:
  % Subtype TCC generated (at line 6126, column 4) for
      % {x1, x2 | f(x1) = f(x2)}
      % expected type  equivalence[X1]
  EquivalenceKernel_TCC1: OBLIGATION
    FORALL (f: [X1 -> Y]): equivalence?[X1]({x1, x2 | f(x1) = f(x2)});


decl_type: formula
theory: stdtokenizer
library: prelude
signature: nil
location: 155 2 158 46
body:
    pos_go_next : LEMMA
      FORALL (t1:Tokenizer):
        LET t2= go_next(t1) IN
        NOT error?(t2) IMPLIES t2`pos = t1`pos+1


decl_type: formula
theory: stdtokenizer
library: prelude
signature: nil
location: 174 2 177 46
body:
    pos_accept_word : LEMMA
      FORALL (t1:Tokenizer,test:[string->bool]):
        LET t2= accept_word(t1,test) IN
        NOT error?(t2) IMPLIES t2`pos = t1`pos+1


decl_type: formula
theory: stdtokenizer
library: prelude
signature: nil
location: 210 2 213 46
body:
    pos_accept_int : LEMMA
      FORALL (t1:Tokenizer,test:[int->bool]):
        LET t2= accept_int(t1,test) IN
        NOT error?(t2) IMPLIES t2`pos = t1`pos+1


decl_type: formula
theory: stdtokenizer
library: prelude
signature: nil
location: 239 2 242 46
body:
    pos_accept_real : LEMMA
      FORALL (t1:Tokenizer,test:[real->bool]):
        LET t2= accept_real(t1,test) IN
        NOT error?(t2) IMPLIES t2`pos = t1`pos+1


decl_type: type
theory: stdtokenizer
library: prelude
signature: nil
location: 20 2 30 4
body:
    Tokenizer : TYPE = [#
      stream   : ARRAY[nat->string],
      lines    : ARRAY[nat->nat],
      casesen  : boolean,
      separ    : string,
      error    : int,
      val_int  : int,
      val_real : real,
      length   : nat,
      pos      : upto(length)
    #]


decl_type: function
theory: stdtokenizer
library: prelude
signature: [[bool, string] -> Tokenizer]
location: 32 2 42 4
body:
    init_tokenizer(casesen:bool,separ:string) : Tokenizer = (#
      stream   := LAMBDA(x:nat):emptystr,
      lines    := LAMBDA(x:nat):0,
      casesen  := casesen,
      separ    := separ,
      error    := NoError,
      val_int  := 0,
      val_real := 0, 
      length   := 0,
      pos      := 0
    #)


decl_type: function
theory: stdtokenizer
library: prelude
signature: [Tokenizer -> string]
location: 70 2 73 9
body:
    last_token(t:Tokenizer): string =
      IF t`pos = 0 THEN emptystr
      ELSE t`stream(t`pos-1)
      ENDIF


decl_type: function
theory: stdtokenizer
library: prelude
signature: [[t: Tokenizer, upto(t`length)] -> string]
location: 81 2 88 24
body:
    tostr(t:Tokenizer,i:upto(t`length)) : RECURSIVE string =
      IF i = t`length THEN emptystr
      ELSIF i=t`pos THEN
        "["+t`stream(i)+"] " + tostr(t,i+1)
      ELSE 
        t`stream(i)+space + tostr(t,i+1)
      ENDIF
      MEASURE t`length - i


decl_type: function
theory: stdtokenizer
library: prelude
signature: [[string, Tokenizer, nat] -> Tokenizer]
location: 90 2 94 32
body:
    add_token(s:string,t:Tokenizer,l:nat): MACRO Tokenizer =
      LET n = t`length IN
      t WITH [`stream(n) := s,
              `lines(n)  := l,
              `length    := n + 1]


decl_type: function
theory: stdtokenizer
library: prelude
signature: [[string, [Tokenizer, nat]] -> [Tokenizer, nat]]
location: 98 2 103 28
body:
    line_tokenizer(s:string,tl:[Tokenizer,nat]):[Tokenizer,nat] =
      LET (t,l) = tl IN
      LET g = fopenin(str,s) IN
      LET f = (LAMBDA(mys:string,myt:Tokenizer):add_token(mys,myt,l)) IN
      LET nt = fmap(g,read_token(t),t,f,length(s)) IN
      prog(fclose(g),(nt,l+1))


decl_type: function
theory: stdtokenizer
library: prelude
signature: [[string, Tokenizer] -> Tokenizer]
location: 106 2 118 9
body:
    file2tokenizer(s:string,t:Tokenizer):Tokenizer=
      IF fexists(s) THEN 
        LET (nt,l) = fmap_line(fopenin(s),
                               (t,1),
                               line_tokenizer) IN 
          nt
      ELSE        
        LET filename = s IN
        t WITH [
          `stream(0) := filename,
          `error     := FileNotFound
        ]
      ENDIF


decl_type: function
theory: stdtokenizer
library: prelude
signature: [[string, Tokenizer] -> Tokenizer]
location: 124 2 127 10
body:
    str2tokenizer(s:string,t:Tokenizer):Tokenizer= 
      LET f = fopenin(str,s) IN
      LET (nt,l) = fmap_line(f,(t,1),line_tokenizer) IN 
          nt


decl_type: function
theory: stdtokenizer
library: prelude
signature: [d: [Tokenizer, posnat] -> TokenizerOfLength(d`1`length)]
location: 138 2 144 9
body:
    consume(t:Tokenizer,n:posnat) : TokenizerOfLength(t`length) = 
      IF error?(t) THEN t
      ELSIF eot?(t) OR t`pos + n > t`length THEN 
        t WITH [`error := EndOfTokenizer]
      ELSE 
        t WITH [`pos := t`pos + n]
      ENDIF


decl_type: function
theory: stdtokenizer
library: prelude
signature: [t: Tokenizer -> TokenizerOfLength(t`length)]
location: 149 2 153 9
body:
    go_back(t:Tokenizer) : TokenizerOfLength(t`length) = 
      IF t`pos = 0 THEN t
      ELSE 
        t WITH [`pos := t`pos - 1]
      ENDIF


decl_type: function
theory: stdtokenizer
library: prelude
signature:
  [d: [Tokenizer, [string -> bool]] ->
  TokenizerOfLength(d`1`length)]

location: 161 2 172 9
body:
    accept_word(t:Tokenizer,test:[string->bool])
      : TokenizerOfLength(t`length) =
      IF error?(t) THEN t
      ELSIF eot?(t) THEN 
        t WITH [`error := EndOfTokenizer]
      ELSIF number?(t`stream(t`pos)) THEN
        t WITH [`error := ExpectingWord]
      ELSIF test(t`stream(t`pos)) THEN 
        t WITH [`pos := t`pos + 1]
      ELSE 
        t WITH [`error := ExpectingTestWord]
      ENDIF


decl_type: function
theory: stdtokenizer
library: prelude
signature: [d: [Tokenizer, string] -> TokenizerOfLength(d`1`length)]
location: 183 2 184 30
body:
    accept_word(t:Tokenizer,s:string) : MACRO TokenizerOfLength(t`length) =
      accept_word(t,the_word(s))


decl_type: function
theory: stdtokenizer
library: prelude
signature:
  [d: [Tokenizer, [int -> bool]] ->
  TokenizerOfLength(d`1`length)]

location: 193 2 208 9
body:
    accept_int(t:Tokenizer,test:[int->bool])
      : TokenizerOfLength(t`length) =
      IF error?(t) THEN t
      ELSIF eot?(t) THEN 
        t WITH [`error := EndOfTokenizer]
      ELSIF NOT int?(t`stream(t`pos)) THEN
        t WITH [`error := ExpectingInt]
      ELSE
        LET i = str2int(t`stream(t`pos)) IN
        IF test(i) THEN 
          t WITH [`pos := t`pos + 1, `val_int := i, `val_real := i]

        ELSE 
          t WITH [`error := ExpectingTestInt]
        ENDIF
      ENDIF


decl_type: function
theory: stdtokenizer
library: prelude
signature:
  [d: [Tokenizer, [real -> bool]] ->
  TokenizerOfLength(d`1`length)]

location: 222 2 237 9
body:
    accept_real(t:Tokenizer,test:[real->bool])
      : TokenizerOfLength(t`length) =
      IF error?(t) THEN t
      ELSIF eot?(t) THEN 
        t WITH [`error := EndOfTokenizer]
      ELSIF NOT number?(t`stream(t`pos)) THEN
        t WITH [`error := ExpectingReal]
      ELSE
        LET r = str2real(t`stream(t`pos)) IN
        IF test(r) THEN 
          t WITH [`pos := t`pos + 1, `val_real := r]

        ELSE 
          t WITH [`error := ExpectingTestReal]
        ENDIF
      ENDIF


decl_type: function
theory: stdtokenizer
library: prelude
signature: [Tokenizer -> [int -> string]]
location: 254 2 279 9
body:
    std_mssg(t:Tokenizer)(code:int):string =
      IF    code <= 0 THEN emptystr
      ELSIF code = FileNotFound THEN
        "File not found: "+doublequote+next_token(t)+doublequote+"."
      ELSIF code = EndOfTokenizer THEN
        "Found EOT."
      ELSIF code = InvalidToken THEN 
        "Invalid Token: "+doublequote+next_token(t)+doublequote+"."
      ELSIF code = ExpectingWord THEN 
        "Expecting a word. Found: "+doublequote+next_token(t)+doublequote+"."
      ELSIF code = ExpectingTestWord THEN 
        "Expecting word that satisfies test. Found: "+doublequote+next_token(t)+
        doublequote+"."
      ELSIF code = ExpectingInt THEN 
        "Expecting an integer. Found: "+doublequote+next_token(t)+doublequote+"."
      ELSIF code = ExpectingTestInt THEN 
        "Expecting integer that satisfies test. Found: "+
        doublequote+next_token(t)+doublequote+"."
      ELSIF code = ExpectingReal THEN 
        "Expecting a real. Found: "+doublequote+next_token(t)+doublequote+"."
      ELSIF code = ExpectingTestReal THEN 
        "Expecting real that satisfies test. Found: "+doublequote+next_token(t)+
        doublequote+"."
      ELSE
        emptystr
      ENDIF


decl_type: function
theory: stdtokenizer
library: prelude
signature: [[Tokenizer, Messenger] -> void]
location: 281 2 287 9
body:
    print_error(t:Tokenizer,m:Messenger): MACRO void = 
      IF error?(t) THEN  
        println("Syntax Error. "+"Line "+get_line(t)+": "+m(error(t))) &
        fail
      ELSE
        skip
      ENDIF


decl_type: function
theory: stdtokenizer
library: prelude
signature: [Tokenizer -> void]
location: 289 2 292 3
body:
    print_error(t:Tokenizer): MACRO void = 
      print_error(t,std_mssg(t))

    ;*(m:Messenger,cs:[int,string]) : Messenger =


decl_type: constant
theory: stdtokenizer
library: prelude
signature: Tokenizer
location: 44 2 54 4
body:
    empty_tokenizer : Tokenizer = (#
      stream   := LAMBDA(x:nat):emptystr,
      lines    := LAMBDA(x:nat):0,
      casesen  := true,
      separ    := emptystr,
      error    := NoError,
      val_int  := 0,
      val_real := 0, 
      length   := 0,
      pos      := 0
    #)


decl_type: tcc
theory: stdtokenizer
library: prelude
signature: nil
location: 307 0 310 999
body:
  % Subtype TCC generated (at line 7139, column 4) for
      % t WITH [`error := code]
      % expected type  TokenizerOfLength(t`length)
  set_error_TCC1: OBLIGATION FORALL (t: Tokenizer): t`length = t`length;


decl_type: tcc
theory: stdtokenizer
library: prelude
signature: nil
location: 312 0 315 999
body:
  % Subtype TCC generated (at line 7144, column 18) for  t`pos - 1
      % expected type  nat
  last_token_TCC1: OBLIGATION
    FORALL (t: Tokenizer): NOT t`pos = 0 IMPLIES t`pos - 1 >= 0;


decl_type: tcc
theory: stdtokenizer
library: prelude
signature: nil
location: 317 0 319 999
body:
  % Subtype TCC generated (at line 7148, column 54) for  t`pos + n - 1
      % expected type  nat
  peek_TCC1: OBLIGATION FORALL (t: Tokenizer, n: posnat): t`pos + n - 1 >= 0;


decl_type: tcc
theory: stdtokenizer
library: prelude
signature: nil
location: 321 0 324 999
body:
  % Subtype TCC generated (at line 7160, column 12) for  t`length - i
      % expected type  naturalnumber
  tostr_TCC1: OBLIGATION
    FORALL (t: Tokenizer, i: upto(t`length)): t`length - i >= 0;


decl_type: tcc
theory: stdtokenizer
library: prelude
signature: nil
location: 326 0 330 999
body:
  % Subtype TCC generated (at line 7156, column 37) for  i + 1
      % expected type  upto(t`length)
  tostr_TCC2: OBLIGATION
    FORALL (t: Tokenizer, i: upto(t`length)):
      i = t`pos AND NOT i = t`length IMPLIES i + 1 <= t`length;


decl_type: tcc
theory: stdtokenizer
library: prelude
signature: nil
location: 332 0 336 999
body:
  % Termination TCC generated (at line 7156, column 29) for  tostr(t, i + 1)
  tostr_TCC3: OBLIGATION
    FORALL (t: Tokenizer, i: upto(t`length)):
      i = t`pos AND NOT i = t`length IMPLIES
       t`length - (i + 1) < t`length - i;


decl_type: tcc
theory: stdtokenizer
library: prelude
signature: nil
location: 338 0 342 999
body:
  % Subtype TCC generated (at line 7158, column 34) for  i + 1
      % expected type  upto(t`length)
  tostr_TCC4: OBLIGATION
    FORALL (t: Tokenizer, i: upto(t`length)):
      NOT i = t`pos AND NOT i = t`length IMPLIES i + 1 <= t`length;


decl_type: tcc
theory: stdtokenizer
library: prelude
signature: nil
location: 344 0 348 999
body:
  % Termination TCC generated (at line 7158, column 26) for  tostr(t, i + 1)
  tostr_TCC5: OBLIGATION
    FORALL (t: Tokenizer, i: upto(t`length)):
      NOT i = t`pos AND NOT i = t`length IMPLIES
       t`length - (i + 1) < t`length - i;


decl_type: tcc
theory: stdtokenizer
library: prelude
signature: nil
location: 350 0 353 999
body:
  % Subtype TCC generated for  t`pos
      % expected type  upto(1 + n)
  add_token_TCC1: OBLIGATION
    FORALL (t: Tokenizer, n: nat): n = t`length IMPLIES t`pos <= 1 + n;


decl_type: tcc
theory: stdtokenizer
library: prelude
signature: nil
location: 355 0 362 999
body:
  % Subtype TCC generated for  myt`pos
      % expected type  upto(1 + myt`length)
  line_tokenizer_TCC1: OBLIGATION
    FORALL (s: string, tl: [Tokenizer, nat], t: Tokenizer, l: nat):
      l = tl`2 AND t = tl`1 IMPLIES
       (FORALL (g: IStream):
          g = fopenin(str, s) IMPLIES
           (FORALL (myt: Tokenizer): myt`pos <= 1 + myt`length));


decl_type: tcc
theory: stdtokenizer
library: prelude
signature: nil
location: 364 0 392 999
body:
  % Subtype TCC generated (at line 7175, column 4) for
      % prog(fclose(g), (nt, l + 1))
      % expected type  [Tokenizer, nat]
  line_tokenizer_TCC2: OBLIGATION
    FORALL (s: string, tl: [Tokenizer, nat], t: Tokenizer, l: nat):
      l = tl`2 AND t = tl`1 IMPLIES
       (FORALL (g: IStream):
          g = fopenin(str, s) IMPLIES
           (FORALL (f: [[string, Tokenizer] -> Tokenizer]):
              (f =
                (LAMBDA (mys: string, myt: Tokenizer):
                   myt
                     WITH [`stream(myt`length) := mys,
                           `lines(myt`length) := l,
                           `length := myt`length + 1]))
               IMPLIES
               (FORALL (nt: Tokenizer):
                  nt = fmap(g, read_token(t), t, f, length(s)) IMPLIES
                   real_pred(prog[[Tokenizer, numfield]]
                                 (fclose(g), (nt, l + 1))`2)
                    AND
                    rational_pred(prog[[Tokenizer, numfield]]
                                      (fclose(g), (nt, l + 1))`2)
                     AND
                     integer_pred(prog[[Tokenizer, numfield]]
                                      (fclose(g), (nt, l + 1))`2)
                      AND
                      prog[[Tokenizer, numfield]](fclose(g), (nt, l + 1))`2
                       >= 0)));


decl_type: tcc
theory: stdtokenizer
library: prelude
signature: nil
location: 394 0 399 999
body:
  % Subtype TCC generated (at line 7215, column 22) for  t`pos + n
      % expected type  upto(t`length)
  consume_TCC1: OBLIGATION
    FORALL (t: Tokenizer, n: posnat):
      NOT eot?(t) AND NOT t`pos + n > t`length AND NOT t`error /= NoError
       IMPLIES t`pos + n <= t`length;


decl_type: tcc
theory: stdtokenizer
library: prelude
signature: nil
location: 401 0 405 999
body:
  % Subtype TCC generated (at line 7224, column 22) for  t`pos - 1
      % expected type  upto(t`length)
  go_back_TCC1: OBLIGATION
    FORALL (t: Tokenizer):
      NOT t`pos = 0 IMPLIES t`pos - 1 >= 0 AND t`pos - 1 <= t`length;


decl_type: tcc
theory: stdtokenizer
library: prelude
signature: nil
location: 407 0 414 999
body:
  % Subtype TCC generated (at line 7241, column 22) for  t`pos + 1
      % expected type  upto(t`length)
  accept_word_TCC1: OBLIGATION
    FORALL (t: Tokenizer, test: [string -> bool]):
      test(t`stream(t`pos)) AND
       NOT number?(t`stream(t`pos)) AND
        NOT eot?(t) AND NOT t`error /= NoError
       IMPLIES t`pos + 1 <= t`length;


decl_type: tcc
theory: stdtokenizer
library: prelude
signature: nil
location: 416 0 424 999
body:
  % Subtype TCC generated (at line 7275, column 24) for  t`pos + 1
      % expected type  upto(t`length)
  accept_int_TCC1: OBLIGATION
    FORALL (t: Tokenizer, test: [int -> bool]):
      int?(t`stream(t`pos)) AND NOT eot?(t) AND NOT t`error /= NoError
       IMPLIES
       (FORALL (i: int):
          test(i) AND i = str2int(t`stream(t`pos)) IMPLIES
           t`pos + 1 <= t`length);


decl_type: tcc
theory: stdtokenizer
library: prelude
signature: nil
location: 426 0 434 999
body:
  % Subtype TCC generated (at line 7304, column 24) for  t`pos + 1
      % expected type  upto(t`length)
  accept_real_TCC1: OBLIGATION
    FORALL (t: Tokenizer, test: [real -> bool]):
      number?(t`stream(t`pos)) AND NOT eot?(t) AND NOT t`error /= NoError
       IMPLIES
       (FORALL (r: rat):
          test(r) AND r = str2real(t`stream(t`pos)) IMPLIES
           t`pos + 1 <= t`length);


decl_type: tcc
theory: stdtokenizer
library: prelude
signature: nil
location: 436 0 440 999
body:
  % Subtype TCC generated (at line 7148, column 54) for  t`pos + 1 - 1
      % expected type  nat
  std_mssg_TCC1: OBLIGATION
    FORALL (t: Tokenizer, code: int):
      code = FileNotFound AND NOT code <= 0 IMPLIES t`pos + 1 - 1 >= 0;


decl_type: tcc
theory: stdtokenizer
library: prelude
signature: nil
location: 442 0 449 999
body:
  % Subtype TCC generated (at line 7148, column 54) for  t`pos + 1 - 1
      % expected type  nat
  std_mssg_TCC2: OBLIGATION
    FORALL (t: Tokenizer, code: int):
      code = InvalidToken AND
       NOT code = EndOfTokenizer AND
        NOT code = FileNotFound AND NOT code <= 0
       IMPLIES t`pos + 1 - 1 >= 0;


decl_type: tcc
theory: stdtokenizer
library: prelude
signature: nil
location: 451 0 458 999
body:
  % Subtype TCC generated (at line 7148, column 54) for  t`pos + 1 - 1
      % expected type  nat
  std_mssg_TCC3: OBLIGATION
    FORALL (t: Tokenizer, code: int):
           code = ExpectingWord AND NOT code = InvalidToken
       AND NOT code = EndOfTokenizer AND NOT code = FileNotFound
       AND NOT code <= 0
       IMPLIES t`pos + 1 - 1 >= 0;


decl_type: tcc
theory: stdtokenizer
library: prelude
signature: nil
location: 460 0 467 999
body:
  % Subtype TCC generated (at line 7148, column 54) for  t`pos + 1 - 1
      % expected type  nat
  std_mssg_TCC4: OBLIGATION
    FORALL (t: Tokenizer, code: int):
           code = ExpectingTestWord AND NOT code = ExpectingWord
       AND NOT code = InvalidToken AND NOT code = EndOfTokenizer
       AND NOT code = FileNotFound AND NOT code <= 0
       IMPLIES t`pos + 1 - 1 >= 0;


decl_type: tcc
theory: stdtokenizer
library: prelude
signature: nil
location: 469 0 477 999
body:
  % Subtype TCC generated (at line 7148, column 54) for  t`pos + 1 - 1
      % expected type  nat
  std_mssg_TCC5: OBLIGATION
    FORALL (t: Tokenizer, code: int):
           code = ExpectingInt AND NOT code = ExpectingTestWord
       AND NOT code = ExpectingWord AND NOT code = InvalidToken
       AND NOT code = EndOfTokenizer AND NOT code = FileNotFound
       AND NOT code <= 0
       IMPLIES t`pos + 1 - 1 >= 0;


decl_type: tcc
theory: stdtokenizer
library: prelude
signature: nil
location: 479 0 487 999
body:
  % Subtype TCC generated (at line 7148, column 54) for  t`pos + 1 - 1
      % expected type  nat
  std_mssg_TCC6: OBLIGATION
    FORALL (t: Tokenizer, code: int):
           code = ExpectingTestInt AND NOT code = ExpectingInt
       AND NOT code = ExpectingTestWord AND NOT code = ExpectingWord
       AND NOT code = InvalidToken AND NOT code = EndOfTokenizer
       AND NOT code = FileNotFound AND NOT code <= 0
       IMPLIES t`pos + 1 - 1 >= 0;


decl_type: tcc
theory: stdtokenizer
library: prelude
signature: nil
location: 489 0 498 999
body:
  % Subtype TCC generated (at line 7148, column 54) for  t`pos + 1 - 1
      % expected type  nat
  std_mssg_TCC7: OBLIGATION
    FORALL (t: Tokenizer, code: int):
           code = ExpectingReal AND NOT code = ExpectingTestInt
       AND NOT code = ExpectingInt AND NOT code = ExpectingTestWord
       AND NOT code = ExpectingWord AND NOT code = InvalidToken
       AND NOT code = EndOfTokenizer AND NOT code = FileNotFound
       AND NOT code <= 0
       IMPLIES t`pos + 1 - 1 >= 0;


decl_type: tcc
theory: stdtokenizer
library: prelude
signature: nil
location: 500 0 509 999
body:
  % Subtype TCC generated (at line 7148, column 54) for  t`pos + 1 - 1
      % expected type  nat
  std_mssg_TCC8: OBLIGATION
    FORALL (t: Tokenizer, code: int):
           code = ExpectingTestReal AND NOT code = ExpectingReal
       AND NOT code = ExpectingTestInt AND NOT code = ExpectingInt
       AND NOT code = ExpectingTestWord AND NOT code = ExpectingWord
       AND NOT code = InvalidToken AND NOT code = EndOfTokenizer
       AND NOT code = FileNotFound AND NOT code <= 0
       IMPLIES t`pos + 1 - 1 >= 0;


decl_type: tcc
theory: stdtokenizer
library: prelude
signature: nil
location: 511 0 513 999
body:
  % Subtype TCC generated (at line 7368, column 12) for  0
      % expected type  upto(t`length)
  tokenizer2str_TCC1: OBLIGATION FORALL (t: Tokenizer): 0 <= t`length;


decl_type: formula
theory: PartialFunctionComposition
library: prelude
signature: nil
location: 26 2 28 57
body:
    SPartFun_to_LPartFun_CompositionPreservation : LEMMA
      SPartFun_to_LPartFun(k o h)
        = SPartFun_to_LPartFun(k) o SPartFun_to_LPartFun(h)


decl_type: formula
theory: PartialFunctionComposition
library: prelude
signature: nil
location: 30 2 32 57
body:
    LPartFun_to_SPartFun_CompositionPreservation : LEMMA
      LPartFun_to_SPartFun(g o f)
        = LPartFun_to_SPartFun(g) o LPartFun_to_SPartFun(f)


decl_type: function
theory: PartialFunctionComposition
library: prelude
signature:
  [[LiftPartialFunction[Y, Z], LiftPartialFunction[X, Y]] ->
  LiftPartialFunction[X, Z]]

location: 7 2 12 14
body:
    o(g, f) : LiftPartialFunction[X, Z] =
      LAMBDA(x : X) :
        CASES f(x) OF
          bottom : bottom,
          up(y) : g(y)
        ENDCASES


decl_type: function
theory: PartialFunctionComposition
library: prelude
signature:
  [[SubsetPartialFunction[Y, Z], SubsetPartialFunction[X, Y]] ->
  SubsetPartialFunction[X, Z]]

location: 20 2 24 6
body:
    o(k, h) : SubsetPartialFunction[X, Z] =
      (# 
        dom := CompDom(k, h),
        fun := LAMBDA(x : (CompDom(k, h))) : fun(k)(fun(h)(x))
      #)


decl_type: tcc
theory: PartialFunctionComposition
library: prelude
signature: nil
location: 39 0 44 999
body:
  % Subtype TCC generated (at line 6383, column 57) for  x
      % expected type  (h`dom)
  oh_TCC1: OBLIGATION
    FORALL (k: SubsetPartialFunction[Y, Z], h: SubsetPartialFunction[X, Y],
            x: (CompDom(k, h))):
      h`dom(x);


decl_type: tcc
theory: PartialFunctionComposition
library: prelude
signature: nil
location: 46 0 51 999
body:
  % Subtype TCC generated (at line 6383, column 50) for  fun(h)(x)
      % expected type  (k`dom)
  oh_TCC2: OBLIGATION
    FORALL (k: SubsetPartialFunction[Y, Z], h: SubsetPartialFunction[X, Y],
            x: (CompDom(k, h))):
      k`dom(fun(h)(x));


decl_type: tcc
theory: if_def
library: prelude
signature: nil
location: 15 0 17 999
body:
  % Existence TCC generated (at line 82, column 2) for
      % IF: [boolean, T, T -> T]
  IF_TCC1: OBLIGATION EXISTS (x: [[boolean, T, T] -> T]): TRUE;


decl_type: tcc
theory: identity
library: prelude
signature: nil
location: 16 0 18 999
body:
  % Subtype TCC generated (at line 429, column 27) for  (LAMBDA x: x)
      % expected type  (bijective?[T, T])
  I_TCC1: OBLIGATION bijective?[T, T]((LAMBDA x: x));


decl_type: formula
theory: indexed_sets
library: prelude
signature: nil
location: 21 2 23 58
body:
    IIntersection_intersection: LEMMA
      IIntersection(LAMBDA i: intersection(A(i), B(i)))
          = intersection(IIntersection(A), IIntersection(B))


decl_type: formula
theory: indexed_sets
library: prelude
signature: nil
location: 25 2 27 36
body:
    IUnion_intersection: LEMMA
      IUnion(LAMBDA i: intersection(A(i), S))
          = intersection(IUnion(A), S)


decl_type: formula
theory: indexed_sets
library: prelude
signature: nil
location: 29 2 31 36
body:
    IIntersection_union: LEMMA
      IIntersection(LAMBDA i: union(A(i), S))
          = union(IIntersection(A), S)


decl_type: formula
theory: stdio
library: prelude
signature: nil
location: 243 0 246 999
body:
  Mode_ord_defaxiom: AXIOM
         Mode_ord(input) = 0 AND Mode_ord(output) = 1 AND Mode_ord(create) = 2
     AND Mode_ord(append) = 3 AND Mode_ord(overwrite) = 4
     AND Mode_ord(rename) = 5 AND Mode_ord(str) = 6;


decl_type: formula
theory: stdio
library: prelude
signature: nil
location: 248 0 252 999
body:
  Mode_inclusive: AXIOM
    FORALL (Mode_var: Mode):
          input?(Mode_var) OR output?(Mode_var) OR create?(Mode_var)
       OR append?(Mode_var) OR overwrite?(Mode_var) OR rename?(Mode_var)
       OR str?(Mode_var);


decl_type: formula
theory: stdio
library: prelude
signature: nil
location: 254 0 258 999
body:
  Mode_induction: AXIOM
    FORALL (p: [Mode -> boolean]):
           p(input) AND p(output) AND p(create) AND p(append) AND p(overwrite)
       AND p(rename) AND p(str)
       IMPLIES (FORALL (Mode_var: Mode): p(Mode_var));


decl_type: function
theory: stdio
library: prelude
signature: [Mode -> upto(6)]
location: 284 0 293 999
body:
  ord(x: Mode): [Mode -> upto(6)] =
      CASES x
        OF input: 0,
           output: 1,
           create: 2,
           append: 3,
           overwrite: 4,
           rename: 5,
           str: 6
        ENDCASES


decl_type: function
theory: stdio
library: prelude
signature: [Mode -> string]
location: 86 2 94 10
body:
    mode2str(m:Mode) : string = CASES m OF
      input     : "input",
      output    : "output",
      create    : "create",
      append    : "append",
      overwrite : "overwrite",
      rename    : "rename",
      str       : "str"
    ENDCASES


decl_type: function
theory: stdio
library: prelude
signature: [[Mode, string] -> IStream]
location: 104 2 109 9
body:
    fopenin(m:Mode,s:string) : IStream = 
      IF    m = input AND length(s)=0 THEN stdin 
      ELSIF m = input THEN fopenin_lisp(s)
      ELSIF m = str   THEN sopenin(s)
      ELSE throw(WrongInputStreamMode,tostr(m))
      ENDIF


decl_type: function
theory: stdio
library: prelude
signature: [[Mode, string] -> OStream]
location: 115 2 124 9
body:
    fopenout(m:Mode,s:string): OStream =
      IF    m = output AND length(s)=0 THEN stdout
      ELSIF m = output    THEN fopenout_lisp(s,0) 
      ELSIF m = create    THEN fopenout_lisp(s,1)
      ELSIF m = append    THEN fopenout_lisp(s,2)
      ELSIF m = overwrite THEN fopenout_lisp(s,3)
      ELSIF m = rename    THEN fopenout_lisp(s,4)
      ELSIF m = str       THEN sopenout(s)
      ELSE throw(WrongOutputStreamMode,tostr(m))
      ENDIF


decl_type: function
theory: stdio
library: prelude
signature: [Stream -> string]
location: 138 2 143 9
body:
    fname(f:Stream):string =
      if filestream?(f) then 
        fname_lisp(f)
      else
        emptystr
      endif


decl_type: function
theory: stdio
library: prelude
signature: [OStream -> string]
location: 146 2 149 9
body:
    fgetstr(f:OStream):string =
      if fopen?(f) then fgetstr_lisp(f)
      else throw(ClosedStream,fname(f))
      endif


decl_type: function
theory: stdio
library: prelude
signature: [IStream -> bool]
location: 152 2 155 9
body:
    eof?(f:IStream):bool =
      if fopen?(f) then eof_lisp(f)
      else throw(ClosedStream,fname(f))
      endif


decl_type: function
theory: stdio
library: prelude
signature: [Stream -> nat]
location: 158 2 161 9
body:
    flength(f:Stream):nat =
      if fopen?(f) then flength_lisp(f)
      else throw(ClosedStream,fname(f))
      endif


decl_type: function
theory: stdio
library: prelude
signature: [Stream -> nat]
location: 164 2 167 9
body:
    fgetpos(f:Stream):nat = 
      if fopen?(f) then fgetpos_lisp(f)
      else throw(ClosedStream,fname(f))
      endif


decl_type: function
theory: stdio
library: prelude
signature: [[OStream, string] -> void]
location: 170 2 173 9
body:
    fprint(f:OStream,s:string):void = 
      if fopen?(f) then fprint_lisp(f,s)
      else throw(ClosedStream,fname(f))
      endif


decl_type: function
theory: stdio
library: prelude
signature: [[Stream, nat] -> void]
location: 178 2 181 9
body:
    fsetpos(f:Stream,n:nat):void =
      if fopen?(f) then fsetpos_lisp(f,n)
      else throw(ClosedStream,fname(f))
      endif


decl_type: function
theory: stdio
library: prelude
signature: [IStream -> bool]
location: 204 2 206 46
body:
    fcheck(f:IStream): bool = 
      (fopen?(f)   OR throw(ClosedStream,fname(f))) AND
      (NOT eof?(f) OR throw(EndOfFile,fname(f)))


decl_type: constant
theory: stdio
library: prelude
signature: list[ExceptionTag[string]]
location: 15 2 18 33
body:
    IOExceptionTags : list[ExceptionTag[string]] = 
      (: NotARealNumber, NotAnInteger, FileNotFound,
         FileAlreadyExists, WrongInputStreamMode, WrongOutputStreamMode,
         ClosedStream, EndOfFile :)


decl_type: function
theory: stdcatch
library: prelude
signature:
  [[ExceptionTag[T2], [Dummy -> T1], [Exception[T2] -> T1]] ->
  T1]

location: 7 2 9 41
body:
    catch_lift(tag:ExceptionTag[T2],
               t1:[Dummy->T1],
               t2:[Exception[T2]->T1]) : T1


decl_type: function
theory: stdcatch
library: prelude
signature: [[ExceptionTag[T2], T1, [Exception[T2] -> T1]] -> T1]
location: 11 2 14 41
body:
    catch(tag:ExceptionTag[T2],
          t1:T1,
          t2:[Exception[T2]->T1]) : MACRO T1 =
      catch_lift(tag,LAMBDA(d:Dummy):t1,t2)


decl_type: function
theory: stdcatch
library: prelude
signature:
  [[list[ExceptionTag[T2]], [Dummy -> T1], [Exception[T2] -> T1]] ->
  T1]

location: 16 2 25 19
body:
    catch_list_lift(l:list[ExceptionTag[T2]],
                    f1:[Dummy->T1],
                    f2:[Exception[T2]->T1]) : RECURSIVE T1 =
      CASES l OF
        null : f1(dummy),
        cons(e,r) : catch_lift(e,
                               LAMBDA(d:Dummy):catch_list_lift(r,f1,f2),
                               f2)
      ENDCASES
      MEASURE l BY <<  


decl_type: function
theory: stdcatch
library: prelude
signature: [[list[ExceptionTag[T2]], T1, [Exception[T2] -> T1]] -> T1]
location: 27 2 28 44
body:
    catch(l:list[ExceptionTag[T2]],t1:T1,t2:[Exception[T2]->T1]) : MACRO T1 =
      catch_list_lift(l,LAMBDA(d:Dummy):t1,t2)


decl_type: tcc
theory: stdcatch
library: prelude
signature: nil
location: 40 0 45 999
body:
  % Termination TCC generated (at line 6461, column 45) for
      % catch_list_lift(r, f1, f2)
  catch_list_lift_TCC1: OBLIGATION
    FORALL (l: list[ExceptionTag[T2]], e: ExceptionTag[T2],
            r: list[ExceptionTag[T2]]):
      l = cons(e, r) IMPLIES <<[ExceptionTag[T2]](r, l);


decl_type: tcc
theory: restrict
library: prelude
signature: nil
location: 27 0 30 999
body:
  % Judgement subtype TCC generated (at line 332, column 4) for  restrict(f)
      % expected type  (injective?[S, R])
  restrict_of_inj_is_inj: OBLIGATION
    FORALL (f: (injective?[T, R])): injective?[S, R](restrict(f));


decl_type: tcc
theory: reals
library: prelude
signature: nil
location: 62 0 64 999
body:
  % Judgement subtype TCC generated (at line 1854, column 37) for  x + y
      % expected type  real
  real_plus_real_is_real: OBLIGATION FORALL (x, y): real_pred(x + y);


decl_type: tcc
theory: reals
library: prelude
signature: nil
location: 66 0 68 999
body:
  % Judgement subtype TCC generated (at line 1855, column 37) for  x - y
      % expected type  real
  real_minus_real_is_real: OBLIGATION FORALL (x, y): real_pred(x - y);


decl_type: tcc
theory: reals
library: prelude
signature: nil
location: 70 0 72 999
body:
  % Judgement subtype TCC generated (at line 1856, column 37) for  x * y
      % expected type  real
  real_times_real_is_real: OBLIGATION FORALL (x, y): real_pred(x * y);


decl_type: tcc
theory: reals
library: prelude
signature: nil
location: 74 0 76 999
body:
  % Judgement subtype TCC generated (at line 1857, column 37) for  x / n0z
      % expected type  real
  real_div_nzreal_is_real: OBLIGATION FORALL (n0z, x): real_pred(x / n0z);


decl_type: tcc
theory: reals
library: prelude
signature: nil
location: 78 0 80 999
body:
  % Judgement subtype TCC generated (at line 1859, column 32) for  -x
      % expected type  real
  minus_real_is_real: OBLIGATION FORALL (x): real_pred(-x);


decl_type: function
theory: integers
library: prelude
signature: [number -> bool]
location: 11 2 13 46
body:
    integer?(n:number): bool =
      number_field_pred(n) AND real_pred(n)
        AND rational_pred(n) AND integer_pred(n)


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 121 0 123 999
body:
  % Subtype TCC generated (at line 2161, column 58) for  i
      % expected type  upfrom(i)
  upfrom_TCC1: OBLIGATION FORALL (i: int): i >= i;


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 125 0 127 999
body:
  % Subtype TCC generated (at line 2162, column 57) for  i + 1
      % expected type  above(i)
  above_TCC1: OBLIGATION FORALL (i: int): integer_pred(i + 1) AND i + 1 > i;


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 129 0 131 999
body:
  % Judgement subtype TCC generated (at line 2164, column 34) for  i + j
      % expected type  int
  int_plus_int_is_int: OBLIGATION FORALL (i, j): integer_pred(i + j);


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 133 0 135 999
body:
  % Judgement subtype TCC generated (at line 2165, column 34) for  i - j
      % expected type  int
  int_minus_int_is_int: OBLIGATION FORALL (i, j): integer_pred(i - j);


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 137 0 139 999
body:
  % Judgement subtype TCC generated (at line 2166, column 34) for  i * j
      % expected type  int
  int_times_int_is_int: OBLIGATION FORALL (i, j): integer_pred(i * j);


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 141 0 143 999
body:
  % Judgement subtype TCC generated (at line 2168, column 30) for  -i
      % expected type  int
  minus_int_is_int: OBLIGATION FORALL (i): integer_pred(-i);


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 145 0 147 999
body:
  % Judgement subtype TCC generated (at line 2169, column 34) for  -n0i
      % expected type  nzint
  minus_nzint_is_nzint: OBLIGATION FORALL (n0i): -n0i /= 0;


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 149 0 151 999
body:
  % Judgement subtype TCC generated (at line 2190, column 30) for  x
      % expected type  nzint
  posint_is_nzint: OBLIGATION FORALL (x: posint): x /= 0;


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 153 0 155 999
body:
  % Judgement subtype TCC generated (at line 2191, column 30) for  x
      % expected type  nzint
  negint_is_nzint: OBLIGATION FORALL (x: negint): x /= 0;


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 157 0 159 999
body:
  % Judgement subtype TCC generated (at line 2193, column 43) for  n0i * n0j
      % expected type  nzint
  nzint_times_nzint_is_nzint: OBLIGATION FORALL (n0i, n0j): n0i * n0j /= 0;


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 161 0 163 999
body:
  % Judgement subtype TCC generated (at line 2195, column 40) for  nni + nnj
      % expected type  nonneg_int
  nnint_plus_nnint_is_nnint: OBLIGATION FORALL (nni, nnj): nni + nnj >= 0;


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 165 0 167 999
body:
  % Judgement subtype TCC generated (at line 2196, column 43) for  nni * nnj
      % expected type  nonneg_int
  nnint_times_nnint_is_nnint: OBLIGATION FORALL (nni, nnj): nni * nnj >= 0;


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 169 0 171 999
body:
  % Judgement subtype TCC generated (at line 2198, column 40) for  npi + npj
      % expected type  nonpos_int
  npint_plus_npint_is_npint: OBLIGATION FORALL (npi, npj): npi + npj <= 0;


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 173 0 175 999
body:
  % Judgement subtype TCC generated (at line 2199, column 43) for  npi * npj
      % expected type  nonneg_int
  npint_times_npint_is_nnint: OBLIGATION FORALL (npi, npj): npi * npj >= 0;


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 177 0 179 999
body:
  % Judgement subtype TCC generated (at line 2201, column 43) for  pi + nnj
      % expected type  posint
  posint_plus_nnint_is_posint: OBLIGATION FORALL (nnj, pi): pi + nnj > 0;


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 181 0 183 999
body:
  % Judgement subtype TCC generated (at line 2202, column 43) for  nni + pj
      % expected type  posint
  nnint_plus_posint_is_posint: OBLIGATION FORALL (nni, pj): nni + pj > 0;


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 185 0 187 999
body:
  % Judgement subtype TCC generated (at line 2203, column 43) for  pi * pj
      % expected type  posint
  posint_times_posint_is_posint: OBLIGATION FORALL (pi, pj): pi * pj > 0;


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 189 0 191 999
body:
  % Judgement subtype TCC generated (at line 2205, column 43) for  ni + nj
      % expected type  negint
  negint_plus_negint_is_negint: OBLIGATION FORALL (ni, nj): ni + nj < 0;


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 193 0 195 999
body:
  % Judgement subtype TCC generated (at line 2206, column 43) for  ni * nj
      % expected type  posint
  negint_times_negint_is_posint: OBLIGATION FORALL (ni, nj): ni * nj > 0;


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 197 0 199 999
body:
  % Subtype TCC generated (at line 2214, column 47) for  0
      % expected type  even_int
  even_int_TCC1: OBLIGATION even?(0);


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 201 0 203 999
body:
  % Subtype TCC generated (at line 2215, column 47) for  1
      % expected type  odd_int
  odd_int_TCC1: OBLIGATION odd?(1);


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 205 0 207 999
body:
  % Judgement subtype TCC generated (at line 2225, column 26) for  x
      % expected type  nzint
  odd_is_nzint: OBLIGATION FORALL (x: odd_int): x /= 0;


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 209 0 211 999
body:
  % Judgement subtype TCC generated (at line 2227, column 37) for  e1 + e2
      % expected type  even_int
  even_plus_even_is_even: OBLIGATION FORALL (e1, e2): even?(e1 + e2);


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 213 0 215 999
body:
  % Judgement subtype TCC generated (at line 2228, column 37) for  e1 - e2
      % expected type  even_int
  even_minus_even_is_even: OBLIGATION FORALL (e1, e2): even?(e1 - e2);


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 217 0 219 999
body:
  % Judgement subtype TCC generated (at line 2229, column 37) for  o1 + o2
      % expected type  even_int
  odd_plus_odd_is_even: OBLIGATION FORALL (o1, o2): even?(o1 + o2);


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 221 0 223 999
body:
  % Judgement subtype TCC generated (at line 2230, column 37) for  o1 - o2
      % expected type  even_int
  odd_minus_odd_is_even: OBLIGATION FORALL (o1, o2): even?(o1 - o2);


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 225 0 227 999
body:
  % Judgement subtype TCC generated (at line 2231, column 37) for  o1 + e2
      % expected type  odd_int
  odd_plus_even_is_odd: OBLIGATION FORALL (e2, o1): odd?(o1 + e2);


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 229 0 231 999
body:
  % Judgement subtype TCC generated (at line 2232, column 37) for  o1 - e2
      % expected type  odd_int
  odd_minus_even_is_odd: OBLIGATION FORALL (e2, o1): odd?(o1 - e2);


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 233 0 235 999
body:
  % Judgement subtype TCC generated (at line 2233, column 37) for  e1 + o2
      % expected type  odd_int
  even_plus_odd_is_odd: OBLIGATION FORALL (e1, o2): odd?(e1 + o2);


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 237 0 239 999
body:
  % Judgement subtype TCC generated (at line 2234, column 37) for  e1 - o2
      % expected type  odd_int
  even_minus_odd_is_odd: OBLIGATION FORALL (e1, o2): odd?(e1 - o2);


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 241 0 243 999
body:
  % Judgement subtype TCC generated (at line 2235, column 37) for  e1 * i
      % expected type  even_int
  even_times_int_is_even: OBLIGATION FORALL (e1, i): even?(e1 * i);


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 245 0 247 999
body:
  % Judgement subtype TCC generated (at line 2236, column 37) for  i * e2
      % expected type  even_int
  int_times_even_is_even: OBLIGATION FORALL (e2, i): even?(i * e2);


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 249 0 251 999
body:
  % Judgement subtype TCC generated (at line 2237, column 37) for  o1 * o2
      % expected type  odd_int
  odd_times_odd_is_odd: OBLIGATION FORALL (o1, o2): odd?(o1 * o2);


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 253 0 255 999
body:
  % Judgement subtype TCC generated (at line 2238, column 35) for  -e1
      % expected type  even_int
  minus_even_is_even: OBLIGATION FORALL (e1): even?(-e1);


decl_type: tcc
theory: integers
library: prelude
signature: nil
location: 257 0 259 999
body:
  % Judgement subtype TCC generated (at line 2239, column 33) for  -o1
      % expected type  odd_int
  minus_odd_is_odd: OBLIGATION FORALL (o1): odd?(-o1);


decl_type: formula
theory: QuotientExtensionProperties
library: prelude
signature: nil
location: 12 2 15 49
body:
    lift_commutation : LEMMA
      FORALL (S),
             (g : (PreservesEq[X, X1, Y](S))) : 
        lift(S)(g) o quotient_sub_map[X, X1](S) = g


decl_type: formula
theory: QuotientExtensionProperties
library: prelude
signature: nil
location: 17 2 21 65
body:
    lift_unicity : LEMMA
      FORALL (S | PreservesEq[X, X, bool](S)(X1_pred)),
             (g : (PreservesEq[X, X1, Y](S))) :
        FORALL(h : [QuotientSub[X, X1](S) -> Y]) :
          h o quotient_sub_map[X, X1](S) = g IMPLIES h = lift(S)(g)


decl_type: function
theory: QuotientExtensionProperties
library: prelude
location: 6 2 10 18
signature:
  [S: {R: equivalence[X] | PreservesEq[X, X, bool](R)(X1_pred)} ->
          [(PreservesEq[X, X1, Y](S)) ->
             [QuotientSub[X, X1](S) -> Y]]]

body:
    lift(S)
        (g : (PreservesEq[X, X1, Y](S)))
        (P : QuotientSub[X, X1](S))
        : Y
      = g(rep(S)(P))


decl_type: tcc
theory: QuotientExtensionProperties
library: prelude
signature: nil
location: 28 0 33 999
body:
  % Subtype TCC generated (at line 6190, column 15) for  P
      % expected type  Quotient[X](S)
  lift_TCC1: OBLIGATION
    FORALL (S: {R: equivalence[X] | PreservesEq[X, X, bool](R)(X1_pred)},
            g: (PreservesEq[X, X1, Y](S)), P: QuotientSub[X, X1](S)):
      EXISTS (x: X): P = EquivClass[X](S)(x);


decl_type: tcc
theory: QuotientExtensionProperties
library: prelude
signature: nil
location: 35 0 40 999
body:
  % Subtype TCC generated (at line 6190, column 8) for  rep(S)(P)
      % expected type  X1
  lift_TCC2: OBLIGATION
    FORALL (S: {R: equivalence[X] | PreservesEq[X, X, bool](R)(X1_pred)},
            g: (PreservesEq[X, X1, Y](S)), P: QuotientSub[X, X1](S)):
      X1_pred(rep[X](S)(P));


decl_type: formula
theory: extend_set_props
library: prelude
signature: nil
location: 5 2 7 62
body:
    finite_extension: LEMMA
      FORALL (a: set[S]):
        is_finite(extend[T, S, bool, FALSE](a)) IFF is_finite(a)


decl_type: formula
theory: extend_set_props
library: prelude
signature: nil
location: 24 2 26 56
body:
    empty?_extend: LEMMA
      FORALL (a: set[S]): 
        empty?(extend[T, S, bool, FALSE](a)) IFF empty?(a)


decl_type: formula
theory: extend_set_props
library: prelude
signature: nil
location: 28 2 30 62
body:
    nonempty?_extend: LEMMA
      FORALL (a: set[S]): 
        nonempty?(extend[T, S, bool, FALSE](a)) IFF nonempty?(a)


decl_type: formula
theory: extend_set_props
library: prelude
signature: nil
location: 32 2 34 64
body:
    singleton?_extend: LEMMA
      FORALL (a: set[S]): 
        singleton?(extend[T, S, bool, FALSE](a)) IFF singleton?(a)


decl_type: formula
theory: extend_set_props
library: prelude
signature: nil
location: 36 2 39 22
body:
    subset_extend: LEMMA
      FORALL (a, b: set[S]): 
        subset?(extend[T, S, bool, FALSE](a), extend[T, S, bool, FALSE](b)) IFF
           subset?(a, b)


decl_type: formula
theory: extend_set_props
library: prelude
signature: nil
location: 41 2 44 48
body:
    union_extend: LEMMA
      FORALL (a, b: set[S]): 
        union(extend[T, S, bool, FALSE](a), extend[T, S, bool, FALSE](b))
          = extend[T, S, bool, FALSE](union(a, b))


decl_type: formula
theory: extend_set_props
library: prelude
signature: nil
location: 46 2 49 55
body:
    intersection_extend: LEMMA
      FORALL (a, b: set[S]): 
        intersection(extend[T, S, bool, FALSE](a), extend[T, S, bool, FALSE](b))
          = extend[T, S, bool, FALSE](intersection(a, b))


decl_type: formula
theory: extend_set_props
library: prelude
signature: nil
location: 51 2 54 53
body:
    difference_extend: LEMMA
      FORALL (a, b: set[S]): 
        difference(extend[T, S, bool, FALSE](a), extend[T, S, bool, FALSE](b))
          = extend[T, S, bool, FALSE](difference(a, b))


decl_type: formula
theory: extend_set_props
library: prelude
signature: nil
location: 56 2 59 46
body:
    add_extend: LEMMA
      FORALL (x: S, a: set[S]): 
        add(x, extend[T, S, bool, FALSE](a))
          = extend[T, S, bool, FALSE](add(x, a))


decl_type: formula
theory: extend_set_props
library: prelude
signature: nil
location: 61 2 64 49
body:
    remove_extend: LEMMA
      FORALL (x: S, a: set[S]): 
        remove(x, extend[T, S, bool, FALSE](a))
          = extend[T, S, bool, FALSE](remove(x, a))


decl_type: judgement
theory: extend_set_props
library: prelude
signature: (nonempty?[T])
location: 15 2 16 72
body:
    nonempty_extend: JUDGEMENT
      extend[T, S, bool, FALSE](a: (nonempty?[S])) HAS_TYPE (nonempty?[T])


decl_type: judgement
theory: extend_set_props
library: prelude
signature: (singleton?[T])
location: 18 2 19 74
body:
    singleton_extend: JUDGEMENT
      extend[T, S, bool, FALSE](a: (singleton?[S])) HAS_TYPE (singleton?[T])


decl_type: tcc
theory: extend_set_props
library: prelude
signature: nil
location: 71 0 75 999
body:
  % Judgement subtype TCC generated (at line 4338, column 4) for
      % extend[T, S, bool, FALSE](a)
      % expected type  finite_set[T]
  finite_extend: OBLIGATION
    FORALL (a: finite_set[S]): is_finite[T](extend[T, S, bool, FALSE](a));


decl_type: tcc
theory: extend_set_props
library: prelude
signature: nil
location: 77 0 81 999
body:
  % Judgement subtype TCC generated (at line 4341, column 4) for
      % extend[T, S, bool, FALSE](a)
      % expected type  (empty?[T])
  empty_extend: OBLIGATION
    FORALL (a: (empty?[S])): empty?[T](extend[T, S, bool, FALSE](a));


decl_type: tcc
theory: extend_set_props
library: prelude
signature: nil
location: 83 0 87 999
body:
  % Judgement subtype TCC generated (at line 4344, column 4) for
      % extend[T, S, bool, FALSE](a)
      % expected type  (nonempty?[T])
  nonempty_extend: OBLIGATION
    FORALL (a: (nonempty?[S])): nonempty?[T](extend[T, S, bool, FALSE](a));


decl_type: tcc
theory: extend_set_props
library: prelude
signature: nil
location: 89 0 93 999
body:
  % Judgement subtype TCC generated (at line 4347, column 4) for
      % extend[T, S, bool, FALSE](a)
      % expected type  (singleton?[T])
  singleton_extend: OBLIGATION
    FORALL (a: (singleton?[S])): singleton?[T](extend[T, S, bool, FALSE](a));


decl_type: function
theory: more_finseq
library: prelude
signature: [[seq, seq] -> bool]
location: 9 3 11 60
body:
     prefix?(rr, ss): bool =
       rr`length <= ss`length AND
         (FORALL (i: below(rr`length)): rr`seq(i) = ss`seq(i))


decl_type: function
theory: more_finseq
library: prelude
signature: [set[seq] -> bool]
location: 13 3 14 68
body:
     prefix_closed?(X : set[seq]): bool =
       FORALL ss: X(ss) IMPLIES (FORALL (rr | prefix?(rr, ss)): X(rr))


decl_type: function
theory: more_finseq
library: prelude
signature: [[T, seq] -> finseq[T]]
location: 16 3 18 35
body:
     add(x, rr): finseq[T] =
       rr WITH [`length := rr`length + 1,
                `seq(rr`length) := x]


decl_type: tcc
theory: more_finseq
library: prelude
signature: nil
location: 25 0 30 999
body:
  % Subtype TCC generated (at line 4603, column 57) for  i
      % expected type  below[ss`length]
  prefix?_TCC1: OBLIGATION
    FORALL (rr: seq, ss: seq):
      rr`length <= ss`length IMPLIES
       (FORALL (i: below(rr`length)): i < ss`length);


decl_type: tcc
theory: more_finseq
library: prelude
signature: nil
location: 32 0 34 999
body:
  % Subtype TCC generated (at line 4610, column 19) for  rr`length
      % expected type  below[1 + rr`length]
  add_TCC1: OBLIGATION FORALL (x: T, rr: seq): rr`length < 1 + rr`length;


decl_type: formula
theory: exp2
library: prelude
signature: nil
location: 27 2 28 66
body:
    exp_prop       : LEMMA x1 < exp2(n) AND  x2 < exp2(m) 
                             IMPLIES x1 * exp2(m) + x2 < exp2(n + m)


decl_type: tcc
theory: exp2
library: prelude
signature: nil
location: 35 0 37 999
body:
  % Subtype TCC generated (at line 5270, column 65) for  n - 1
      % expected type  nat
  exp2_TCC1: OBLIGATION FORALL (n: nat): NOT n = 0 IMPLIES n - 1 >= 0;


decl_type: tcc
theory: exp2
library: prelude
signature: nil
location: 39 0 40 999
body:
  % Termination TCC generated (at line 5270, column 60) for  exp2(n - 1)
  exp2_TCC2: OBLIGATION FORALL (n: nat): NOT n = 0 IMPLIES n - 1 < n;


decl_type: tcc
theory: exp2
library: prelude
signature: nil
location: 42 0 44 999
body:
  % Judgement subtype TCC generated (at line 5273, column 12) for  exp2(n)
      % expected type  above(n)
  exp2_TCC3: OBLIGATION FORALL (n: nat): exp2(n) > n;


decl_type: tcc
theory: exp2
library: prelude
signature: nil
location: 46 0 48 999
body:
  % Subtype TCC generated (at line 5285, column 50) for  n - k
      % expected type  nat
  exp2_minus_TCC1: OBLIGATION FORALL (n, k: upto(n)): n - k >= 0;


decl_type: function
theory: EquivalenceClosure
library: prelude
signature: [PRED[[T, T]] -> equivalence[T]]
location: 18 2 19 75
body:
    EquivClos(R) : equivalence[T] =
      { (x, y) | FORALL(S : equivalence[T]) : subset?(R, S) IMPLIES S(x, y) }


decl_type: tcc
theory: EquivalenceClosure
library: prelude
signature: nil
location: 41 0 49 999
body:
  % Subtype TCC generated (at line 6040, column 4) for
      % {x, y | FORALL (S: equivalence[T]): subset?(R, S) IMPLIES S(x, y)}
      % expected type  equivalence[T]
  EquivClos_TCC1: OBLIGATION
    FORALL (R: PRED[[T, T]]):
      equivalence?[T]
          ({x, y |
              FORALL (S: equivalence[T]):
                subset?[[T, T]](R, S) IMPLIES S(x, y)});


decl_type: formula
theory: sequences
library: prelude
signature: nil
location: 47 2 49 27
body:
    sequence_induction: LEMMA
      p(nth(seq, 0)) AND (FORALL n: p(nth(seq, n)) IMPLIES p(nth(seq, n + 1)))
        IMPLIES every(p)(seq)


decl_type: function
theory: sequences
library: prelude
signature: [[T, nat, sequence] -> sequence]
location: 28 2 31 39
body:
    insert(x, n, seq): sequence =
      (LAMBDA i: (IF i < n THEN seq(i)
                  ELSIF i = n THEN x
                  ELSE seq(i - 1) ENDIF))


decl_type: tcc
theory: sequences
library: prelude
signature: nil
location: 60 0 64 999
body:
  % Subtype TCC generated (at line 4488, column 25) for  i - 1
      % expected type  nat
  insert_TCC1: OBLIGATION
    FORALL (x: T, n: nat, seq: sequence, i):
      NOT i = n AND NOT i < n IMPLIES i - 1 >= 0;


decl_type: formula
theory: euclidean_division
library: prelude
signature: nil
location: 26 2 28 53
body:
    unique_quotient : PROPOSITION
          FORALL (q1, q2 : int), (r1, r2 : mod(b)) :
              b * q1 + r1 = b * q2 + r2 IMPLIES q1 = q2


decl_type: formula
theory: euclidean_division
library: prelude
signature: nil
location: 30 2 32 53
body:
    unique_remainder : COROLLARY
          FORALL (q1, q2 : int), (r1, r2 : mod(b)) :
              b * q1 + r1 = b * q2 + r2 IMPLIES r1 = r2


decl_type: formula
theory: euclidean_division
library: prelude
signature: nil
location: 34 2 36 65
body:
    unique_division : COROLLARY
          FORALL (q1, q2 : int), (r1, r2 : mod(b)) :
              b * q1 + r1 = b * q2 + r2 IMPLIES q1 = q2 AND r1 = r2


decl_type: tcc
theory: euclidean_division
library: prelude
signature: nil
location: 43 0 45 999
body:
  % Existence TCC generated (at line 3636, column 2) for
      % mod(b): TYPE+ = {i | i < b}
  mod_TCC1: OBLIGATION FORALL (b: posnat): EXISTS (x: {i | i < b}): TRUE;


decl_type: formula
theory: quantifier_props
library: prelude
signature: nil
location: 16 2 17 78
body:
    exists_implies: LEMMA
      (EXISTS x: p(x) IMPLIES q(x)) = ((EXISTS x: NOT p(x)) OR (EXISTS x: q(x)))


decl_type: formula
theory: function_props
library: prelude
signature: nil
location: 31 2 33 40
body:
    preserves_composition: LEMMA
      preserves(f1, R1, R2) AND preserves(f2, R2, R3)
        IMPLIES preserves(f2 o f1, R1, R3)


decl_type: formula
theory: function_props
library: prelude
signature: nil
location: 35 2 37 38
body:
    inverts_composition1: LEMMA
      preserves(f1, R1, R2) AND inverts(f2, R2, R3)
        IMPLIES inverts(f2 o f1, R1, R3)


decl_type: formula
theory: function_props
library: prelude
signature: nil
location: 39 2 41 38
body:
    inverts_composition2: LEMMA
      inverts(f1, R1, R2) AND preserves(f2, R2, R3)
        IMPLIES inverts(f2 o f1, R1, R3)


decl_type: judgement
theory: function_props
library: prelude
signature: (injective?[T1, T3])
location: 16 2 18 35
body:
    composition_injective: JUDGEMENT
      o(f2: (injective?[T2, T3]), f1: (injective?[T1, T2]))
        HAS_TYPE (injective?[T1, T3])


decl_type: judgement
theory: function_props
library: prelude
signature: (surjective?[T1, T3])
location: 20 2 22 36
body:
    composition_surjective: JUDGEMENT
      o(f2: (surjective?[T2, T3]), f1: (surjective?[T1, T2]))
        HAS_TYPE (surjective?[T1, T3])


decl_type: judgement
theory: function_props
library: prelude
signature: (bijective?[T1, T3])
location: 24 2 26 35
body:
    composition_bijective: JUDGEMENT
      o(f2: (bijective?[T2, T3]), f1: (bijective?[T1, T2]))
        HAS_TYPE (bijective?[T1, T3])


decl_type: tcc
theory: function_props
library: prelude
signature: nil
location: 48 0 52 999
body:
  % Judgement subtype TCC generated (at line 1476, column 4) for  f2 o f1
      % expected type  (injective?[T1, T3])
  composition_injective: OBLIGATION
    FORALL (f1: (injective?[T1, T2]), f2: (injective?[T2, T3])):
      injective?[T1, T3](f2 o f1);


decl_type: tcc
theory: function_props
library: prelude
signature: nil
location: 54 0 58 999
body:
  % Judgement subtype TCC generated (at line 1480, column 4) for  f2 o f1
      % expected type  (surjective?[T1, T3])
  composition_surjective: OBLIGATION
    FORALL (f1: (surjective?[T1, T2]), f2: (surjective?[T2, T3])):
      surjective?[T1, T3](f2 o f1);


decl_type: tcc
theory: function_props
library: prelude
signature: nil
location: 60 0 64 999
body:
  % Judgement subtype TCC generated (at line 1484, column 4) for  f2 o f1
      % expected type  (bijective?[T1, T3])
  composition_bijective: OBLIGATION
    FORALL (f1: (bijective?[T1, T2]), f2: (bijective?[T2, T3])):
      bijective?[T1, T3](f2 o f1);


decl_type: function
theory: stdstr
library: prelude
signature: [[string, string] -> string]
location: 57 2 58 3
body:
    concat(s1:string,s2:string):string = s1 o s2
    ;+(s1:string,s2:string): MACRO string = concat(s1,s2)


decl_type: function
theory: stdstr
library: prelude
signature: [[string, string] -> string]
location: 58 3 59 3
body:
    ;+(s1:string,s2:string): MACRO string = concat(s1,s2)
    ;+(r:real,s:string): MACRO string = concat(tostr(r),s)


decl_type: function
theory: stdstr
library: prelude
signature: [[real, string] -> string]
location: 59 3 60 3
body:
    ;+(r:real,s:string): MACRO string = concat(tostr(r),s)
    ;+(s:string,r:real): MACRO string = concat(s,tostr(r))


decl_type: function
theory: stdstr
library: prelude
signature: [[string, real] -> string]
location: 60 3 61 3
body:
    ;+(s:string,r:real): MACRO string = concat(s,tostr(r))
    ;+(b:bool,s:string): MACRO string = concat(tostr(b),s)


decl_type: function
theory: stdstr
library: prelude
signature: [[bool, string] -> string]
location: 61 3 62 3
body:
    ;+(b:bool,s:string): MACRO string = concat(tostr(b),s)
    ;+(s:string,b:bool): MACRO string = concat(s,tostr(b))


decl_type: function
theory: stdstr
library: prelude
signature: [[nat, string] -> string]
location: 65 2 69 13
body:
    pad(n:nat,s:string): RECURSIVE string = 
      IF n=0 THEN emptystr
      ELSE s+pad(n-1,s)
      ENDIF
      MEASURE n


decl_type: tcc
theory: stdstr
library: prelude
signature: nil
location: 116 0 118 999
body:
  % Subtype TCC generated (at line 6641, column 15) for  n - 1
      % expected type  nat
  pad_TCC1: OBLIGATION FORALL (n: nat): NOT n = 0 IMPLIES n - 1 >= 0;


decl_type: tcc
theory: stdstr
library: prelude
signature: nil
location: 120 0 121 999
body:
  % Termination TCC generated (at line 6641, column 11) for  pad(n - 1, s)
  pad_TCC2: OBLIGATION FORALL (n: nat): NOT n = 0 IMPLIES n - 1 < n;


decl_type: function
theory: lex2
library: prelude
signature: [[nat, nat] -> ordinal]
location: 9 2 17 11
body:
    lex2(m, n): ordinal = 
      (IF m=0
         THEN IF n = 0
                 THEN zero
                 ELSE add(n, zero, zero)
              ENDIF
         ELSIF n = 0 THEN add(m, add(1,zero,zero),zero)
         ELSE add(m, add(1,zero,zero), add(n,zero, zero))
       ENDIF)


decl_type: tcc
theory: lex2
library: prelude
signature: nil
location: 28 0 31 999
body:
  % Subtype TCC generated (at line 4703, column 20) for  zero
      % expected type  ordinal
  lex2_TCC1: OBLIGATION
    FORALL (m: nat, n: nat): n = 0 AND m = 0 IMPLIES ordinal?(zero);


decl_type: tcc
theory: lex2
library: prelude
signature: nil
location: 33 0 36 999
body:
  % Subtype TCC generated (at line 4704, column 24) for  n
      % expected type  posnat
  lex2_TCC2: OBLIGATION
    FORALL (m: nat, n: nat): NOT n = 0 AND m = 0 IMPLIES n > 0;


decl_type: tcc
theory: lex2
library: prelude
signature: nil
location: 38 0 42 999
body:
  % Subtype TCC generated (at line 4704, column 20) for  add(n, zero, zero)
      % expected type  ordinal
  lex2_TCC3: OBLIGATION
    FORALL (m: nat, n: nat):
      NOT n = 0 AND m = 0 IMPLIES ordinal?(add(n, zero, zero));


decl_type: tcc
theory: lex2
library: prelude
signature: nil
location: 44 0 47 999
body:
  % Subtype TCC generated (at line 4706, column 28) for  m
      % expected type  posnat
  lex2_TCC4: OBLIGATION
    FORALL (m: nat, n: nat): n = 0 AND NOT m = 0 IMPLIES m > 0;


decl_type: tcc
theory: lex2
library: prelude
signature: nil
location: 49 0 54 999
body:
  % Subtype TCC generated (at line 4706, column 24) for
      % add(m, add(1, zero, zero), zero)
      % expected type  ordinal
  lex2_TCC5: OBLIGATION
    FORALL (m: nat, n: nat):
      n = 0 AND NOT m = 0 IMPLIES ordinal?(add(m, add(1, zero, zero), zero));


decl_type: tcc
theory: lex2
library: prelude
signature: nil
location: 56 0 59 999
body:
  % Subtype TCC generated (at line 4707, column 16) for  m
      % expected type  posnat
  lex2_TCC6: OBLIGATION
    FORALL (m: nat, n: nat): NOT n = 0 AND NOT m = 0 IMPLIES m > 0;


decl_type: tcc
theory: lex2
library: prelude
signature: nil
location: 61 0 64 999
body:
  % Subtype TCC generated (at line 4707, column 41) for  n
      % expected type  posnat
  lex2_TCC7: OBLIGATION
    FORALL (m: nat, n: nat): NOT n = 0 AND NOT m = 0 IMPLIES n > 0;


decl_type: tcc
theory: lex2
library: prelude
signature: nil
location: 66 0 72 999
body:
  % Subtype TCC generated (at line 4707, column 12) for
      % add(m, add(1, zero, zero), add(n, zero, zero))
      % expected type  ordinal
  lex2_TCC8: OBLIGATION
    FORALL (m: nat, n: nat):
      NOT n = 0 AND NOT m = 0 IMPLIES
       ordinal?(add(m, add(1, zero, zero), add(n, zero, zero)));


decl_type: judgement
theory: QuotientKernelProperties
library: prelude
signature:
  (PreservesEq[X, X1, Quotient(S)]
  (extend[[X, X], [X1, X1], bool, FALSE](S)))

location: 13 2 14 65
body:
    quotient_map_is_Quotient_EqivalenceRespecting: JUDGEMENT
      quotient_map(S) HAS_TYPE (PreservesEq[X, X1, Quotient(S)](S))


decl_type: judgement
theory: QuotientKernelProperties
library: prelude
signature:
  (PreservesEq[X, X1, ECQuotient(S)]
  (extend[[X, X], [X1, X1], bool, FALSE](S)))

location: 22 2 23 67
body:
    quotient_map_is_ECQuotient_EqivalenceRespecting: JUDGEMENT
      quotient_map(S) HAS_TYPE (PreservesEq[X, X1, ECQuotient(S)](S))


decl_type: tcc
theory: QuotientKernelProperties
library: prelude
signature: nil
location: 30 0 37 999
body:
  % Judgement subtype TCC generated (at line 6152, column 4) for
      % quotient_map(S)
      % expected type  (PreservesEq[X, X1, Quotient(S)]
                     %      (extend[[X, X], [X1, X1], bool, FALSE](S)))
  quotient_map_is_Quotient_EqivalenceRespecting: OBLIGATION
    FORALL (S):
      PreservesEq[X, X1, Quotient(S)]
          (extend[[X, X], [X1, X1], bool, FALSE](S))(quotient_map[X1](S));


decl_type: tcc
theory: QuotientKernelProperties
library: prelude
signature: nil
location: 39 0 44 999
body:
  % Subtype TCC generated (at line 6155, column 44) for  quotient_map(S)
      % expected type  [X1 -> ECQuotient[X1](S)]
  Kernel_ECquotient_map_TCC1: OBLIGATION
    FORALL (S: equivalence[X1], x1: X1):
      EXISTS (x: X1):
        quotient_map[X1](S)(x1) = EquivClass[X1](EquivClos[X1](S))(x);


decl_type: tcc
theory: QuotientKernelProperties
library: prelude
signature: nil
location: 46 0 57 999
body:
  % Judgement subtype TCC generated (at line 6161, column 4) for
      % quotient_map(S)
      % expected type  (PreservesEq[X, X1, ECQuotient(S)]
                     %      (extend[[X, X], [X1, X1], bool, FALSE](S)))
  quotient_map_is_ECQuotient_EqivalenceRespecting: OBLIGATION
    FORALL (S):
      (FORALL (x1: X1):
         EXISTS (x: X1):
           quotient_map[X1](S)(x1) = EquivClass[X1](EquivClos[X1](S))(x))
       AND
       PreservesEq[X, X1, ECQuotient(S)]
           (extend[[X, X], [X1, X1], bool, FALSE](S))(quotient_map[X1](S));


decl_type: tcc
theory: integer_props
library: prelude
signature: nil
location: 37 0 42 999
body:
  % Subtype TCC generated (at line 3299, column 20) for
      % extend[real, nat, bool, FALSE](N)
      % expected type  (nonempty?[real])
  lub_nat_TCC1: OBLIGATION
    FORALL (N: (nonempty?[nat])):
      nonempty?[real](extend[real, nat, bool, FALSE](N));


decl_type: tcc
theory: integer_props
library: prelude
signature: nil
location: 44 0 49 999
body:
  % Subtype TCC generated (at line 3303, column 20) for
      % extend[real, int, bool, FALSE](I)
      % expected type  (nonempty?[real])
  lub_int_TCC1: OBLIGATION
    FORALL (I: (nonempty?[int])):
      nonempty?[real](extend[real, int, bool, FALSE](I));


decl_type: formula
theory: bounded_real_defs
library: prelude
signature: nil
location: 30 2 33 44
body:
    real_complete: AXIOM
      FORALL S:
        (EXISTS y: upper_bound?(y, S)) IMPLIES
          (EXISTS y: least_upper_bound?(y, S))


decl_type: formula
theory: bounded_real_defs
library: prelude
signature: nil
location: 35 2 38 47
body:
    real_lower_complete: LEMMA
      FORALL S:
        (EXISTS y: lower_bound?(y, S)) IMPLIES 
          (EXISTS x: greatest_lower_bound?(x, S))


decl_type: function
theory: bounded_real_defs
library: prelude
signature: [[real, (nonempty?[real])] -> bool]
location: 18 2 20 51
body:
    least_upper_bound?(x, S): bool =
      upper_bound?(x, S) AND
        FORALL y: upper_bound?(y, S) IMPLIES (x <= y)


decl_type: function
theory: bounded_real_defs
library: prelude
signature: [[real, (nonempty?[real])] -> bool]
location: 24 2 26 51
body:
    greatest_lower_bound?(x, S): bool =
      lower_bound?(x, S) AND
        FORALL y: lower_bound?(y, S) IMPLIES (y <= x)


decl_type: tcc
theory: bounded_real_defs
library: prelude
signature: nil
location: 72 0 76 999
body:
  % Existence TCC generated (at line 1958, column 2) for
      % lub(SA): {x | least_upper_bound?(x, SA)}
  lub_TCC1: OBLIGATION
    EXISTS (x1: [SA: (bounded_above?) -> {x | least_upper_bound?(x, SA)}]):
      TRUE;


decl_type: tcc
theory: bounded_real_defs
library: prelude
signature: nil
location: 78 0 83 999
body:
  % Existence TCC generated (at line 1966, column 2) for
      % glb(SB): {x | greatest_lower_bound?(x, SB)}
  glb_TCC1: OBLIGATION
    EXISTS (x1:
              [SB: (bounded_below?) -> {x | greatest_lower_bound?(x, SB)}]):
      TRUE;


decl_type: tcc
theory: QuotientSubDefinition
library: prelude
signature: nil
location: 18 0 23 999
body:
  % Subtype TCC generated (at line 6176, column 4) for  EquivClass(S)(x)
      % expected type  QuotientSub(S)
  quotient_sub_map_TCC1: OBLIGATION
    FORALL (S: {R: equivalence[X] | PreservesEq[X, X, bool](R)(X1_pred)},
            x: X1):
      EXISTS (x_1: X1): EquivClass[X](S)(x) = EquivClass[X](S)(x_1);


decl_type: function
theory: Fairctlops
library: prelude
location: 14 2 21 26
signature:
  [[pred[state], [[state, state] -> bool], pred[state],
         list[pred[state]]] ->
          pred[state]]

body:
    CheckFair(Q, N, f, Fflist): RECURSIVE pred[state] =
      (CASES Fflist OF
       cons(Ff, Gflist):
               EU(N, f, f AND Ff AND
                        EX(N, CheckFair(Q, N, f, Gflist))),
       null : Q
       ENDCASES)
      MEASURE length(Fflist)


decl_type: function
theory: Fairctlops
library: prelude
location: 32 2 32 67
body: FairEU(N,f,g)(Fflist):pred[state] = EU(N,f,g AND Fair?(N,Fflist))
signature:
  [[[[state, state] -> bool], pred[state], pred[state]] ->
          [list[pred[state]] -> pred[state]]]


decl_type: function
theory: Fairctlops
library: prelude
location: 40 2 42 28
signature:
  [[[[state, state] -> bool], pred[state], pred[state]] ->
          [list[pred[state]] -> pred[state]]]

body:
    FairAU(N,f,g)(Fflist):pred[state] =
          NOT FairEU(N,NOT g,NOT f AND NOT g)(Fflist)
              AND FairAF(N,g)(Fflist)


decl_type: tcc
theory: Fairctlops
library: prelude
signature: nil
location: 51 0 61 999
body:
  % Termination TCC generated (at line 5171, column 14) for
      % CheckFair(Q, N, f, Gflist)
  CheckFair_TCC1: OBLIGATION
    FORALL (f: pred[state], Fflist: list[pred[state]], Ff: pred[state],
            Gflist: list[pred[state]]):
      Fflist = cons(Ff, Gflist) IMPLIES
       (FORALL (s1: state):
          f(s1) IMPLIES
           (FORALL (s: state):
              Ff(s) AND s = s1 IMPLIES
               length[pred[state]](Gflist) < length[pred[state]](Fflist)));


decl_type: tcc
theory: Fairctlops
library: prelude
signature: nil
location: 63 0 69 999
body:
  % Subtype TCC generated (at line 5177, column 7) for
      % LAMBDA P: CheckFair(P, N, f, Fflist)
      % expected type  (monotonic?[state])
  FairEG_TCC1: OBLIGATION
    FORALL (N: [[state, state] -> bool], f: pred[state],
            Fflist: list[pred[state]]):
      monotonic?[state](LAMBDA P: CheckFair(P, N, f, Fflist));


decl_type: function
theory: fairctlops
library: prelude
signature:
  [[[[state, state] -> bool], pred[state], pred[state]] ->
  [pred[state] -> pred[state]]]

location: 36 2 38 24
body:
    fairAU(N,f,g)(Ff):pred[state] =
          NOT fairEU(N,NOT g,NOT f AND NOT g)(Ff)
              AND fairAF(N,g)(Ff)


decl_type: tcc
theory: fairctlops
library: prelude
signature: nil
location: 47 0 60 999
body:
  % Subtype TCC generated (at line 5129, column 7) for
      % LAMBDA P:
      %   EU(N, f,
      %      LAMBDA (s1: state):
      %        f(s1) AND (LAMBDA (s: state): Ff(s) AND EX(N, P)(s))(s1))
      % expected type  (monotonic?[state])
  fairEG_TCC1: OBLIGATION
    FORALL (N: [[state, state] -> bool], f: pred[state], Ff: pred[state]):
      monotonic?[state]
          (LAMBDA P:
             EU[state]
                 (N, f,
                  LAMBDA (s1: state):
                    f(s1) AND Ff(s1) AND EX[state](N, P)(s1)));


decl_type: judgement
theory: extend_func_props
library: prelude
signature: (surjective?[T, R])
location: 13 2 14 75
body:
    surjective_extend: JUDGEMENT
      extend[T, S, R, d](f: (surjective?[S, R])) HAS_TYPE (surjective?[T, R])


decl_type: tcc
theory: extend_func_props
library: prelude
signature: nil
location: 21 0 25 999
body:
  % Judgement subtype TCC generated (at line 402, column 4) for
      % extend[T, S, R, d](f)
      % expected type  (surjective?[T, R])
  surjective_extend: OBLIGATION
    FORALL (f: (surjective?[S, R])): surjective?[T, R](extend[T, S, R, d](f));


decl_type: judgement
theory: restrict_order_props
library: prelude
signature: (antisymmetric?[S])
location: 22 2 23 65
body:
    antisymmetric_restrict: JUDGEMENT
      restrict(R: (antisymmetric?[T])) HAS_TYPE (antisymmetric?[S])


decl_type: judgement
theory: restrict_order_props
library: prelude
signature: (partial_order?[S])
location: 37 2 38 65
body:
    partial_order_restrict: JUDGEMENT
      restrict(R: (partial_order?[T])) HAS_TYPE (partial_order?[S])


decl_type: judgement
theory: restrict_order_props
library: prelude
signature: (strict_total_order?[S])
location: 52 2 53 75
body:
    strict_total_order_restrict: JUDGEMENT
      restrict(R: (strict_total_order?[T])) HAS_TYPE (strict_total_order?[S])


decl_type: tcc
theory: restrict_order_props
library: prelude
signature: nil
location: 66 0 70 999
body:
  % Judgement subtype TCC generated (at line 615, column 4) for  restrict(R)
      % expected type  (reflexive?[S])
  reflexive_restrict: OBLIGATION
    FORALL (R: (reflexive?[T])):
      reflexive?[S](restrict[[T, T], [S, S], boolean](R));


decl_type: tcc
theory: restrict_order_props
library: prelude
signature: nil
location: 72 0 76 999
body:
  % Judgement subtype TCC generated (at line 618, column 4) for  restrict(R)
      % expected type  (irreflexive?[S])
  irreflexive_restrict: OBLIGATION
    FORALL (R: (irreflexive?[T])):
      irreflexive?[S](restrict[[T, T], [S, S], boolean](R));


decl_type: tcc
theory: restrict_order_props
library: prelude
signature: nil
location: 78 0 82 999
body:
  % Judgement subtype TCC generated (at line 621, column 4) for  restrict(R)
      % expected type  (symmetric?[S])
  symmetric_restrict: OBLIGATION
    FORALL (R: (symmetric?[T])):
      symmetric?[S](restrict[[T, T], [S, S], boolean](R));


decl_type: tcc
theory: restrict_order_props
library: prelude
signature: nil
location: 84 0 88 999
body:
  % Judgement subtype TCC generated (at line 624, column 4) for  restrict(R)
      % expected type  (antisymmetric?[S])
  antisymmetric_restrict: OBLIGATION
    FORALL (R: (antisymmetric?[T])):
      antisymmetric?[S](restrict[[T, T], [S, S], boolean](R));


decl_type: tcc
theory: restrict_order_props
library: prelude
signature: nil
location: 90 0 94 999
body:
  % Judgement subtype TCC generated (at line 627, column 4) for  restrict(R)
      % expected type  (connected?[S])
  connected_restrict: OBLIGATION
    FORALL (R: (connected?[T])):
      connected?[S](restrict[[T, T], [S, S], boolean](R));


decl_type: tcc
theory: restrict_order_props
library: prelude
signature: nil
location: 96 0 100 999
body:
  % Judgement subtype TCC generated (at line 630, column 4) for  restrict(R)
      % expected type  (transitive?[S])
  transitive_restrict: OBLIGATION
    FORALL (R: (transitive?[T])):
      transitive?[S](restrict[[T, T], [S, S], boolean](R));


decl_type: tcc
theory: restrict_order_props
library: prelude
signature: nil
location: 102 0 106 999
body:
  % Judgement subtype TCC generated (at line 633, column 4) for  restrict(R)
      % expected type  (equivalence?[S])
  equivalence_restrict: OBLIGATION
    FORALL (R: (equivalence?[T])):
      equivalence?[S](restrict[[T, T], [S, S], boolean](R));


decl_type: tcc
theory: restrict_order_props
library: prelude
signature: nil
location: 108 0 112 999
body:
  % Judgement subtype TCC generated (at line 636, column 4) for  restrict(R)
      % expected type  (preorder?[S])
  preorder_restrict: OBLIGATION
    FORALL (R: (preorder?[T])):
      preorder?[S](restrict[[T, T], [S, S], boolean](R));


decl_type: tcc
theory: restrict_order_props
library: prelude
signature: nil
location: 114 0 118 999
body:
  % Judgement subtype TCC generated (at line 639, column 4) for  restrict(R)
      % expected type  (partial_order?[S])
  partial_order_restrict: OBLIGATION
    FORALL (R: (partial_order?[T])):
      partial_order?[S](restrict[[T, T], [S, S], boolean](R));


decl_type: tcc
theory: restrict_order_props
library: prelude
signature: nil
location: 120 0 124 999
body:
  % Judgement subtype TCC generated (at line 642, column 4) for  restrict(R)
      % expected type  (strict_order?[S])
  strict_order_restrict: OBLIGATION
    FORALL (R: (strict_order?[T])):
      strict_order?[S](restrict[[T, T], [S, S], boolean](R));


decl_type: tcc
theory: restrict_order_props
library: prelude
signature: nil
location: 126 0 130 999
body:
  % Judgement subtype TCC generated (at line 645, column 4) for  restrict(R)
      % expected type  (dichotomous?[S])
  dichotomous_restrict: OBLIGATION
    FORALL (R: (dichotomous?[T])):
      dichotomous?[S](restrict[[T, T], [S, S], boolean](R));


decl_type: tcc
theory: restrict_order_props
library: prelude
signature: nil
location: 132 0 136 999
body:
  % Judgement subtype TCC generated (at line 648, column 4) for  restrict(R)
      % expected type  (total_order?[S])
  total_order_restrict: OBLIGATION
    FORALL (R: (total_order?[T])):
      total_order?[S](restrict[[T, T], [S, S], boolean](R));


decl_type: tcc
theory: restrict_order_props
library: prelude
signature: nil
location: 138 0 142 999
body:
  % Judgement subtype TCC generated (at line 651, column 4) for  restrict(R)
      % expected type  (trichotomous?[S])
  trichotomous_restrict: OBLIGATION
    FORALL (R: (trichotomous?[T])):
      trichotomous?[S](restrict[[T, T], [S, S], boolean](R));


decl_type: tcc
theory: restrict_order_props
library: prelude
signature: nil
location: 144 0 148 999
body:
  % Judgement subtype TCC generated (at line 654, column 4) for  restrict(R)
      % expected type  (strict_total_order?[S])
  strict_total_order_restrict: OBLIGATION
    FORALL (R: (strict_total_order?[T])):
      strict_total_order?[S](restrict[[T, T], [S, S], boolean](R));


decl_type: tcc
theory: restrict_order_props
library: prelude
signature: nil
location: 150 0 154 999
body:
  % Judgement subtype TCC generated (at line 657, column 4) for  restrict(R)
      % expected type  (well_founded?[S])
  well_founded_restrict: OBLIGATION
    FORALL (R: (well_founded?[T])):
      well_founded?[S](restrict[[T, T], [S, S], boolean](R));


decl_type: tcc
theory: restrict_order_props
library: prelude
signature: nil
location: 156 0 160 999
body:
  % Judgement subtype TCC generated (at line 660, column 4) for  restrict(R)
      % expected type  (well_ordered?[S])
  well_ordered_restrict: OBLIGATION
    FORALL (R: (well_ordered?[T])):
      well_ordered?[S](restrict[[T, T], [S, S], boolean](R));


decl_type: function
theory: finite_sequences
library: prelude
signature: [[finseq, finseq] -> finseq]
location: 22 2 30 32
body:
    o(fs1, fs2): finseq =
       LET l1 = fs1`length,
           lsum = l1 + fs2`length
        IN (# length := lsum,
              seq := (LAMBDA (n:below[lsum]):
                        IF n < l1
                           THEN fs1`seq(n)
                           ELSE fs2`seq(n-l1)
                        ENDIF) #);


decl_type: function
theory: finite_sequences
library: prelude
signature: [[finseq, [nat, nat]] -> finseq]
location: 34 2 41 14
body:
    ^(fs, p): finseq =
      LET (m, n) = p
       IN IF m > n OR m >= fs`length
          THEN empty_seq
          ELSE LET len = min(n - m + 1, fs`length - m)
                IN (# length := len,
                      seq := (LAMBDA (x: below[len]): fs`seq(x + m)) #)
          ENDIF;


decl_type: function
theory: finite_sequences
library: prelude
signature: [[finseq, [nat, nat]] -> finseq]
location: 45 2 52 13
body:
    ^^(fs, p): finseq =
      LET (m, n) = p
       IN IF m >= n OR m >= fs`length
          THEN empty_seq
          ELSE LET len = min(n - m, fs`length - m)
                IN (# length := len,
                      seq := (LAMBDA (x: below[len]): fs`seq(x + m)) #)
          ENDIF


decl_type: constant
theory: finite_sequences
library: prelude
signature: finseq
location: 14 2 16 61
body:
    empty_seq: finseq =
      (# length := 0,
         seq := (LAMBDA (x: below[0]): epsilon! (t:T): true) #)


decl_type: tcc
theory: finite_sequences
library: prelude
signature: nil
location: 65 0 66 999
body:
  % Existence TCC generated (at line 4546, column 37) for  epsilon
  empty_seq_TCC1: OBLIGATION FORALL (x: below[0]): EXISTS (x1: T): TRUE;


decl_type: tcc
theory: finite_sequences
library: prelude
signature: nil
location: 68 0 75 999
body:
  % Subtype TCC generated (at line 4558, column 38) for  n
      % expected type  below[fs1`length]
  oh_TCC1: OBLIGATION
    FORALL (fs1: finseq, fs2: finseq, l1: nat):
      l1 = fs1`length IMPLIES
       (FORALL (lsum: nonneg_int):
          lsum = l1 + fs2`length IMPLIES
           (FORALL (n: below[lsum]): n < l1 IMPLIES n < fs1`length));


decl_type: tcc
theory: finite_sequences
library: prelude
signature: nil
location: 77 0 85 999
body:
  % Subtype TCC generated (at line 4559, column 38) for  n - l1
      % expected type  below[fs2`length]
  oh_TCC2: OBLIGATION
    FORALL (fs1: finseq, fs2: finseq, l1: nat):
      l1 = fs1`length IMPLIES
       (FORALL (lsum: nonneg_int):
          lsum = l1 + fs2`length IMPLIES
           (FORALL (n: below[lsum]):
              NOT n < l1 IMPLIES n - l1 >= 0 AND n - l1 < fs2`length));


decl_type: tcc
theory: finite_sequences
library: prelude
signature: nil
location: 87 0 93 999
body:
  % Subtype TCC generated (at line 4569, column 30) for  len
      % expected type  nat
  caret_TCC1: OBLIGATION
    FORALL (fs: finseq, p: [nat, nat], m: nat, n: nat):
      NOT m > n AND NOT m >= fs`length AND n = p`2 AND m = p`1 IMPLIES
       (FORALL (len: {k: int | k <= 1 + n - m AND k <= fs`length - m}):
          len = min(n - m + 1, fs`length - m) IMPLIES len >= 0);


decl_type: tcc
theory: finite_sequences
library: prelude
signature: nil
location: 95 0 102 999
body:
  % Subtype TCC generated (at line 4570, column 59) for  x + m
      % expected type  below[fs`length]
  caret_TCC2: OBLIGATION
    FORALL (fs: finseq, p: [nat, nat], m: nat, n: nat):
      NOT m > n AND NOT m >= fs`length AND n = p`2 AND m = p`1 IMPLIES
       (FORALL (len: {k: int | k <= 1 + n - m AND k <= fs`length - m}):
          len = min(n - m + 1, fs`length - m) IMPLIES
           (FORALL (x: below[len]): x + m < fs`length));


decl_type: tcc
theory: finite_sequences
library: prelude
signature: nil
location: 104 0 110 999
body:
  % Subtype TCC generated (at line 4580, column 30) for  len
      % expected type  nat
  doublecaret_TCC1: OBLIGATION
    FORALL (fs: finseq, p: [nat, nat], m: nat, n: nat):
      NOT m >= n AND NOT m >= fs`length AND n = p`2 AND m = p`1 IMPLIES
       (FORALL (len: {k: int | k <= n - m AND k <= fs`length - m}):
          len = min(n - m, fs`length - m) IMPLIES len >= 0);


decl_type: tcc
theory: finite_sequences
library: prelude
signature: nil
location: 112 0 119 999
body:
  % Subtype TCC generated (at line 4581, column 59) for  x + m
      % expected type  below[fs`length]
  doublecaret_TCC2: OBLIGATION
    FORALL (fs: finseq, p: [nat, nat], m: nat, n: nat):
      NOT m >= n AND NOT m >= fs`length AND n = p`2 AND m = p`1 IMPLIES
       (FORALL (len: {k: int | k <= n - m AND k <= fs`length - m}):
          len = min(n - m, fs`length - m) IMPLIES
           (FORALL (x: below[len]): x + m < fs`length));


decl_type: tcc
theory: finite_sequences
library: prelude
signature: nil
location: 121 0 123 999
body:
  % Subtype TCC generated (at line 4584, column 48) for  0
      % expected type  below[fs`length]
  extract1_TCC1: OBLIGATION FORALL (fs: {fs | fs`length = 1}): 0 < fs`length;


decl_type: formula
theory: naturalnumbers
library: prelude
signature: nil
location: 41 2 43 32
body:
    nat_induction: LEMMA
      (p(0) AND (FORALL j: p(j) IMPLIES p(j+1)))
          IMPLIES (FORALL i: p(i))


decl_type: formula
theory: naturalnumbers
library: prelude
signature: nil
location: 47 2 49 31
body:
    NAT_induction: LEMMA 
      (FORALL j: (FORALL k: k < j IMPLIES p(k)) IMPLIES p(j))
         IMPLIES (FORALL i: p(i))


decl_type: tcc
theory: naturalnumbers
library: prelude
signature: nil
location: 72 0 74 999
body:
  % Judgement subtype TCC generated (at line 2262, column 33) for  x
      % expected type  nat
  upfrom_nat_is_nat: OBLIGATION FORALL (i, x: upfrom(i)): x >= 0;


decl_type: tcc
theory: naturalnumbers
library: prelude
signature: nil
location: 76 0 78 999
body:
  % Judgement subtype TCC generated (at line 2263, column 37) for  x
      % expected type  posnat
  upfrom_posnat_is_posnat: OBLIGATION FORALL (n, x: upfrom(n)): x > 0;


decl_type: tcc
theory: naturalnumbers
library: prelude
signature: nil
location: 80 0 82 999
body:
  % Judgement subtype TCC generated (at line 2264, column 33) for  x
      % expected type  posnat
  above_nat_is_posnat: OBLIGATION FORALL (i, x: above(i)): x >= 0 AND x > 0;


decl_type: tcc
theory: naturalnumbers
library: prelude
signature: nil
location: 84 0 86 999
body:
  % Judgement subtype TCC generated (at line 2265, column 33) for  x
      % expected type  nat
  subrange_nat_is_nat: OBLIGATION FORALL (i, j, x: subrange(i, j)): x >= 0;


decl_type: tcc
theory: naturalnumbers
library: prelude
signature: nil
location: 88 0 91 999
body:
  % Judgement subtype TCC generated (at line 2266, column 39) for  x
      % expected type  posnat
  subrange_posnat_is_posnat: OBLIGATION
    FORALL (j, n, x: subrange(n, j)): x > 0;


decl_type: tcc
theory: naturalnumbers
library: prelude
signature: nil
location: 93 0 95 999
body:
  % Subtype TCC generated (at line 2268, column 58) for  i
      % expected type  upto(i)
  upto_TCC1: OBLIGATION FORALL (i: nat): i <= i;


decl_type: tcc
theory: naturalnumbers
library: prelude
signature: nil
location: 97 0 99 999
body:
  % Subtype TCC generated (at line 2276, column 31) for  i - 1
      % expected type  nat
  pred_TCC1: OBLIGATION FORALL (i: nat): i > 0 IMPLIES i - 1 >= 0;


decl_type: tcc
theory: naturalnumbers
library: prelude
signature: nil
location: 101 0 103 999
body:
  % Subtype TCC generated (at line 2278, column 31) for  i - j
      % expected type  nat
  tilde_TCC1: OBLIGATION FORALL (i: nat, j: nat): i > j IMPLIES i - j >= 0;


decl_type: tcc
theory: identity_props
library: prelude
signature: nil
location: 12 0 14 999
body:
  % Judgement subtype TCC generated (at line 438, column 25) for  I[T](x)
      % expected type  S
  I_preserves: OBLIGATION FORALL (x): S_pred(I[T](x));


decl_type: tcc
theory: identity_props
library: prelude
signature: nil
location: 16 0 18 999
body:
  % Judgement subtype TCC generated (at line 439, column 26) for  id[T](x)
      % expected type  S
  id_preserves: OBLIGATION FORALL (x): S_pred(id[T](x));


decl_type: tcc
theory: identity_props
library: prelude
signature: nil
location: 20 0 23 999
body:
  % Judgement subtype TCC generated (at line 440, column 32) for
      % identity[T](x)
      % expected type  S
  identity_preserves: OBLIGATION FORALL (x): S_pred(identity[T](x));


decl_type: tcc
theory: bounded_real_defs_alt
library: prelude
signature: nil
location: 21 0 24 999
body:
  % Judgement subtype TCC generated (at line 1983, column 4) for  x
      % expected type  (upper_bound?)
  lub_is_upper_bound: OBLIGATION
    FORALL (x: (least_upper_bound?)): upper_bound?(x);


decl_type: tcc
theory: bounded_real_defs_alt
library: prelude
signature: nil
location: 26 0 29 999
body:
  % Judgement subtype TCC generated (at line 1986, column 4) for  x
      % expected type  (lower_bound?)
  glb_is_lower_bound: OBLIGATION
    FORALL (x: (greatest_lower_bound?)): lower_bound?(x);


decl_type: tcc
theory: min_nat
library: prelude
signature: nil
location: 18 0 24 999
body:
  % Existence TCC generated (at line 2318, column 2) for
      % min(S): {a | S(a) AND (FORALL x: S(x) IMPLIES a <= x)}
  min_TCC1: OBLIGATION
    EXISTS (x1:
              [S: (nonempty?[T]) ->
                 {a | S(a) AND (FORALL x: S(x) IMPLIES a <= x)}]):
      TRUE;


decl_type: function
theory: disjointness
library: prelude
signature: [list[bool] -> boolean]
location: 10 2 16 20
body:
    pairwise_disjoint?(l): RECURSIVE boolean =
      cases l of
        null: true,
        cons(x,y): every(LAMBDA (z:bool): NOT (x AND z))(y)
                    AND pairwise_disjoint?(y)
      endcases
     MEASURE length(l)


decl_type: tcc
theory: disjointness
library: prelude
signature: nil
location: 22 0 27 999
body:
  % Termination TCC generated (at line 4934, column 22) for
      % pairwise_disjoint?(y)
  pairwise_disjoint?_TCC1: OBLIGATION
    FORALL (l: list[bool], x: bool, y: list[bool]):
      every(LAMBDA (z: bool): NOT (x AND z))(y) AND l = cons(x, y) IMPLIES
       length[boolean](y) < length[boolean](l);


decl_type: judgement
theory: relation_props
library: prelude
signature: (total?[T1, T3])
location: 17 2 18 75
body:
    composition_total: JUDGEMENT
      o(R1: (total?[T1, T2]), R2: (total?[T2, T3])) HAS_TYPE (total?[T1, T3])


decl_type: judgement
theory: relation_props
library: prelude
signature: (onto?[T1, T3])
location: 20 2 21 72
body:
    composition_onto: JUDGEMENT
      o(R1: (onto?[T1, T2]), R2: (onto?[T2, T3])) HAS_TYPE (onto?[T1, T3])


decl_type: tcc
theory: relation_props
library: prelude
signature: nil
location: 28 0 32 999
body:
  % Judgement subtype TCC generated (at line 1609, column 4) for  R1 o R2
      % expected type  (total?[T1, T3])
  composition_total: OBLIGATION
    FORALL (R1: (total?[T1, T2]), R2: (total?[T2, T3])):
      total?[T1, T3](R1 o R2);


decl_type: tcc
theory: relation_props
library: prelude
signature: nil
location: 34 0 37 999
body:
  % Judgement subtype TCC generated (at line 1612, column 4) for  R1 o R2
      % expected type  (onto?[T1, T3])
  composition_onto: OBLIGATION
    FORALL (R1: (onto?[T1, T2]), R2: (onto?[T2, T3])): onto?[T1, T3](R1 o R2);


decl_type: function
theory: function_iterate
library: prelude
signature: [[[T -> T], nat] -> [T -> T]]
location: 12 2 14 13
body:
    iterate(f, n)(x): RECURSIVE T =
      IF n = 0 THEN x ELSE f(iterate(f, n-1)(x)) ENDIF
      MEASURE n


decl_type: tcc
theory: function_iterate
library: prelude
signature: nil
location: 36 0 39 999
body:
  % Subtype TCC generated (at line 4437, column 38) for  n - 1
      % expected type  nat
  iterate_TCC1: OBLIGATION
    FORALL (f: [T -> T], n: nat, x: T): NOT n = 0 IMPLIES n - 1 >= 0;


decl_type: tcc
theory: function_iterate
library: prelude
signature: nil
location: 41 0 43 999
body:
  % Termination TCC generated (at line 4437, column 27) for  iterate(f, n - 1)
  iterate_TCC2: OBLIGATION
    FORALL (f: [T -> T], n: nat, x: T): NOT n = 0 IMPLIES n - 1 < n;


decl_type: formula
theory: list_props
library: prelude
signature: nil
location: 76 2 77 75
body:
    every_conjunct2: LEMMA
      (every(P)(l) AND every(Q)(l)) => every(LAMBDA (x: T): P(x) AND Q(x))(l)


decl_type: function
theory: list_props
library: prelude
signature: [list[T] -> nat]
location: 12 2 17 58
body:
    length(l): RECURSIVE nat =
      CASES l OF
        null: 0,
        cons(x, y): length(y) + 1
      ENDCASES
     MEASURE reduce_nat(0, (LAMBDA (x: T), (n: nat): n + 1))


decl_type: function
theory: list_props
library: prelude
signature: [[T, list[T]] -> bool]
location: 19 2 24 20
body:
    member(x, l): RECURSIVE bool =
      CASES l OF
        null: FALSE,
        cons(hd, tl): x = hd OR member(x, tl)
      ENDCASES
     MEASURE length(l)


decl_type: function
theory: list_props
library: prelude
signature: [[l: list[T], below[length(l)]] -> T]
location: 28 2 30 20
body:
    nth(l, (n:below[length(l)])): RECURSIVE T =
      IF n = 0 THEN car(l) ELSE nth(cdr(l), n-1) ENDIF
     MEASURE length(l)


decl_type: function
theory: list_props
library: prelude
signature: [[list[T], list[T]] -> list[T]]
location: 32 2 37 22
body:
    append(l1, l2): RECURSIVE list[T] =
      CASES l1 OF
        null: l2,
        cons(x, y): cons(x, append(y, l2))
      ENDCASES
      MEASURE length(l1)


decl_type: function
theory: list_props
library: prelude
signature: [list[T] -> list[T]]
location: 39 2 44 18
body:
    reverse(l): RECURSIVE list[T] =
      CASES l OF
        null: l,
        cons(x, y): append(reverse(y), cons(x, null))
      ENDCASES
      MEASURE length


decl_type: tcc
theory: list_props
library: prelude
signature: nil
location: 89 0 94 999
body:
  % Termination TCC generated (at line 4741, column 18) for  length(y)
  length_TCC1: OBLIGATION
    FORALL (l: list[T], x: T, y: list[T]):
      l = cons(x, y) IMPLIES
       reduce_nat[T](0, (LAMBDA (x: T), (n: nat): n + 1))(y) <
        reduce_nat[T](0, (LAMBDA (x: T), (n: nat): n + 1))(l);


decl_type: tcc
theory: list_props
library: prelude
signature: nil
location: 96 0 99 999
body:
  % Termination TCC generated (at line 4748, column 30) for  member(x, tl)
  member_TCC1: OBLIGATION
    FORALL (x: T, l: list[T], hd: T, tl: list[T]):
      NOT x = hd AND l = cons(hd, tl) IMPLIES length(tl) < length(l);


decl_type: tcc
theory: list_props
library: prelude
signature: nil
location: 101 0 104 999
body:
  % Subtype TCC generated (at line 4755, column 22) for  l
      % expected type  (cons?[T])
  nth_TCC1: OBLIGATION
    FORALL (l: list[T], (n: below[length(l)])): n = 0 IMPLIES cons?[T](l);


decl_type: tcc
theory: list_props
library: prelude
signature: nil
location: 106 0 109 999
body:
  % Subtype TCC generated (at line 4755, column 38) for  l
      % expected type  (cons?[T])
  nth_TCC2: OBLIGATION
    FORALL (l: list[T], (n: below[length(l)])): NOT n = 0 IMPLIES cons?[T](l);


decl_type: tcc
theory: list_props
library: prelude
signature: nil
location: 111 0 115 999
body:
  % Subtype TCC generated (at line 4755, column 42) for  n - 1
      % expected type  below[length(cdr(l))]
  nth_TCC3: OBLIGATION
    FORALL (l: list[T], (n: below[length(l)])):
      NOT n = 0 IMPLIES n - 1 >= 0 AND n - 1 < length(cdr[T](l));


decl_type: tcc
theory: list_props
library: prelude
signature: nil
location: 117 0 121 999
body:
  % Termination TCC generated (at line 4755, column 30) for
      % nth(cdr(l), n - 1)
  nth_TCC4: OBLIGATION
    FORALL (l: list[T], (n: below[length(l)])):
      NOT n = 0 IMPLIES length(cdr[T](l)) < length(l);


decl_type: tcc
theory: list_props
library: prelude
signature: nil
location: 123 0 126 999
body:
  % Termination TCC generated (at line 4761, column 26) for  append(y, l2)
  append_TCC1: OBLIGATION
    FORALL (l1: list[T], x: T, y: list[T]):
      l1 = cons(x, y) IMPLIES length(y) < length(l1);


decl_type: tcc
theory: QuotientDefinition
library: prelude
signature: nil
location: 59 0 62 999
body:
  % Subtype TCC generated (at line 6075, column 26) for  EquivClass(S)(x)
      % expected type  p: (nonempty?[T])
  repEC_TCC1: OBLIGATION
    FORALL (S: equivalence[T], x: T): nonempty?[T](EquivClass(S)(x));


decl_type: tcc
theory: QuotientDefinition
library: prelude
signature: nil
location: 64 0 67 999
body:
  % Subtype TCC generated (at line 6088, column 37) for  P
      % expected type  p: (nonempty?[T])
  rep_TCC1: OBLIGATION
    FORALL (S: equivalence[T], P: Quotient(S)): nonempty?[T](P);


decl_type: tcc
theory: QuotientDefinition
library: prelude
signature: nil
location: 69 0 73 999
body:
  % Subtype TCC generated (at line 6091, column 12) for  EquivClass(S)(x)
      % expected type  Quotient(S)
  rep_is_repEC_TCC1: OBLIGATION
    FORALL (S: equivalence[T], x: T):
      EXISTS (x_1: T): EquivClass(S)(x) = EquivClass(S)(x_1);


decl_type: function
theory: stdmath
library: prelude
signature: [real -> nnreal]
location: 28 2 32 9
body:
    SQRT(x:real):nnreal =
      IF x < 0 THEN 
        throw[nnreal,string](NotARealNumber,"SQRT("+x+")")
      ELSE sqrt_lisp(x)
      ENDIF


decl_type: function
theory: stdmath
library: prelude
signature: [real -> real]
location: 34 2 38 9
body:
    LOG(x:real):real =
      IF x <= 0 THEN 
        throw[real,string](NotARealNumber,"LOG("+x+")")
      ELSE log_lisp(x)
      ENDIF


decl_type: function
theory: stdmath
library: prelude
signature: [real -> real]
location: 40 2 46 9
body:
    TAN(x:real):real =
      LET d = COS(x) IN
      IF d = 0 THEN 
        throw[real,string](NotARealNumber,"TAN("+x+"0)")
      ELSE
        SIN(x)/COS(x)
      ENDIF


decl_type: function
theory: stdmath
library: prelude
signature: [[real, real] -> real]
location: 48 2 52 9
body:
    ATAN(y,x:real):real = 
      IF x=0 AND y= 0 THEN 
        throw[real,string](NotARealNumber,"ATAN(0,0)")
      ELSE atan_lisp(y,x)
      ENDIF


decl_type: function
theory: stdmath
library: prelude
signature: [real -> real]
location: 54 2 58 9
body:
    ASIN(x:real) : real =
      IF x < -1 OR x > 1 THEN
        throw[real,string](NotARealNumber,"ASIN("+x+")")
      ELSE asin_lisp(x)
      ENDIF


decl_type: function
theory: stdmath
library: prelude
signature: [real -> real]
location: 60 2 64 9
body:
    ACOS(x:real) : real =
      IF x < -1 OR x > 1 THEN
        throw[real,string](NotARealNumber,"ACOS("+x+")")
      ELSE acos_lisp(x)
      ENDIF


decl_type: tcc
theory: stdmath
library: prelude
signature: nil
location: 74 0 77 999
body:
  % Existence TCC generated (at line 6935, column 2) for
      % SIN(x: real): {x: real | -1 <= x AND x <= 1}
  SIN_TCC1: OBLIGATION
    EXISTS (x1: [real -> {x: real | -1 <= x AND x <= 1}]): TRUE;


decl_type: tcc
theory: stdmath
library: prelude
signature: nil
location: 79 0 81 999
body:
  % Existence TCC generated (at line 6938, column 2) for
      % RANDOM: {y: nnreal | 0 <= y AND y <= 1}
  RANDOM_TCC1: OBLIGATION EXISTS (x: {y: nnreal | y <= 1}): TRUE;


decl_type: tcc
theory: stdmath
library: prelude
signature: nil
location: 83 0 85 999
body:
  % Existence TCC generated (at line 6939, column 2) for
      % NRANDOM(n: posnat): {y: nat | 0 <= y AND y < n}
  NRANDOM_TCC1: OBLIGATION EXISTS (x: [n: posnat -> {y: nat | y < n}]): TRUE;


decl_type: tcc
theory: stdmath
library: prelude
signature: nil
location: 87 0 89 999
body:
  % Subtype TCC generated (at line 6950, column 19) for  x
      % expected type  nnreal
  SQRT_TCC1: OBLIGATION FORALL (x: real): NOT x < 0 IMPLIES x >= 0;


decl_type: tcc
theory: stdmath
library: prelude
signature: nil
location: 91 0 93 999
body:
  % Subtype TCC generated (at line 6956, column 18) for  x
      % expected type  posreal
  LOG_TCC1: OBLIGATION FORALL (x: real): NOT x <= 0 IMPLIES x >= 0 AND x > 0;


decl_type: tcc
theory: stdmath
library: prelude
signature: nil
location: 95 0 99 999
body:
  % Subtype TCC generated (at line 6964, column 13) for  COS(x)
      % expected type  nznum
  TAN_TCC1: OBLIGATION
    FORALL (x: real, d: {x: real | -1 <= x AND x <= 1}):
      NOT d = 0 AND d = COS(x) IMPLIES COS(x) /= 0;


decl_type: judgement
theory: orders_alt
library: prelude
signature: (lower_bound?)
location: 12 2 13 53
body:
    greatest_lower_bound_is_lower_bound: JUDGEMENT
      (greatest_lower_bound?) SUBTYPE_OF (lower_bound?)


decl_type: tcc
theory: orders_alt
library: prelude
signature: nil
location: 19 0 22 999
body:
  % Judgement subtype TCC generated (at line 595, column 4) for  x
      % expected type  (upper_bound?)
  least_upper_bound_is_upper_bound: OBLIGATION
    FORALL (x: (least_upper_bound?)): upper_bound?(x);


decl_type: tcc
theory: orders_alt
library: prelude
signature: nil
location: 24 0 27 999
body:
  % Judgement subtype TCC generated (at line 598, column 4) for  x
      % expected type  (lower_bound?)
  greatest_lower_bound_is_lower_bound: OBLIGATION
    FORALL (x: (greatest_lower_bound?)): lower_bound?(x);


decl_type: formula
theory: bv_arith_nat_defs
library: prelude
signature: nil
location: 51 2 52 73
body:
    bv_plus : LEMMA (FORALL (bv: bvec[N], i: int):
                           bv2nat(bv + i) = mod(bv2nat(bv) + i, exp2(N))) ;


decl_type: formula
theory: bv_arith_nat_defs
library: prelude
signature: nil
location: 58 2 59 68
body:
    bv_minus     : LEMMA (FORALL (bv: bvec[N], i: int):
                      bv2nat(bv - i) = mod(bv2nat(bv) - i, exp2(N))) ;


decl_type: function
theory: bv_arith_nat_defs
library: prelude
location: 48 2 49 72
signature:
  [d: [bvec[N], int] ->
          {bvn: bvec[N] |
                   bv2nat(bvn) = mod(bv2nat(d`1) + d`2, exp2(N))}]

body:
    +(bv: bvec[N], i: int): {bvn: bvec[N] | 
                               bv2nat(bvn) = mod(bv2nat(bv) + i, exp2(N))}


decl_type: function
theory: bv_arith_nat_defs
library: prelude
location: 64 2 68 36
signature:
  [d: [bvec[N], bvec[N]] ->
          {bv: bvec[N] |
                   bv2nat(bv) =
                    IF bv2nat(d`1) + bv2nat(d`2) < exp2(N)
                      THEN bv2nat(d`1) + bv2nat(d`2)
                    ELSE bv2nat(d`1) + bv2nat(d`2) - exp2(N)
                    ENDIF}]

body:
    +(bv1: bvec[N], bv2: bvec[N]): {bv: bvec[N] | bv2nat(bv) = 
                                IF bv2nat(bv1) + bv2nat(bv2) < exp2(N)
                                THEN bv2nat(bv1) + bv2nat(bv2)
                                ELSE bv2nat(bv1) + bv2nat(bv2) - exp2(N) 
                                ENDIF}


decl_type: function
theory: bv_arith_nat_defs
library: prelude
signature:
  [d: [bvec[N], bvec[N]] ->
  {bv: bvec[2 * N] | bv2nat(bv) = bv2nat(d`1) * bv2nat(d`2)}]

location: 72 2 73 70
body:
    *(bv1: bvec[N], bv2: bvec[N]): {bv: bvec[2*N] | bv2nat(bv) = 
                                            bv2nat(bv1) * bv2nat(bv2)} ;


decl_type: tcc
theory: bv_arith_nat_defs
library: prelude
signature: nil
location: 82 0 91 999
body:
  % Existence TCC generated (at line 5691, column 2) for
      % +(bv: bvec[N], i: int):
      %       {bvn: bvec[N] | bv2nat(bvn) = mod(bv2nat(bv) + i, exp2(N))}
  plus_TCC1: OBLIGATION
    EXISTS (x:
              [d: [bvec[N], int] ->
                 {bvn: bvec[N] |
                          bv2nat[N](bvn) =
                           mod(bv2nat[N](d`1) + d`2, exp2(N))}]):
      TRUE;


decl_type: tcc
theory: bv_arith_nat_defs
library: prelude
signature: nil
location: 93 0 110 999
body:
  % Existence TCC generated (at line 5707, column 2) for
      % +(bv1: bvec[N], bv2: bvec[N]):
      %       {bv: bvec[N] |
      %                bv2nat(bv) =
      %                 IF bv2nat(bv1) + bv2nat(bv2) < exp2(N)
      %                   THEN bv2nat(bv1) + bv2nat(bv2)
      %                 ELSE bv2nat(bv1) + bv2nat(bv2) - exp2(N)
      %                 ENDIF}
  plus_TCC2: OBLIGATION
    EXISTS (x:
              [d: [bvec[N], bvec[N]] ->
                 {bv: bvec[N] |
                          bv2nat[N](bv) =
                           IF bv2nat[N](d`1) + bv2nat[N](d`2) < exp2(N)
                             THEN bv2nat[N](d`1) + bv2nat[N](d`2)
                           ELSE bv2nat[N](d`1) + bv2nat[N](d`2) - exp2(N)
                           ENDIF}]):
      TRUE;


decl_type: tcc
theory: bv_arith_nat_defs
library: prelude
signature: nil
location: 112 0 121 999
body:
  % Existence TCC generated (at line 5715, column 2) for
      % *(bv1: bvec[N], bv2: bvec[N]):
      %       {bv: bvec[2 * N] | bv2nat(bv) = bv2nat(bv1) * bv2nat(bv2)};
  times_TCC1: OBLIGATION
    EXISTS (x:
              [d: [bvec[N], bvec[N]] ->
                 {bv: bvec[2 * N] |
                          bv2nat[2 * N](bv) =
                           bv2nat[N](d`1) * bv2nat[N](d`2)}]):
      TRUE;


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 49 0 50 74
body:
  both_sides_times_pos_neg_lt1: LEMMA
    IF n0z > 0 THEN x * n0z < y * n0z ELSE y * n0z < x * n0z ENDIF IFF x < y


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 52 0 53 74
body:
  both_sides_times_pos_neg_lt2: LEMMA
    IF n0z > 0 THEN n0z * x < n0z * y ELSE n0z * y < n0z * x ENDIF IFF x < y


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 55 0 56 77
body:
  both_sides_times_pos_neg_le1: LEMMA
    IF n0z > 0 THEN x * n0z <= y * n0z ELSE y * n0z <= x * n0z ENDIF IFF x <= y


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 58 0 59 77
body:
  both_sides_times_pos_neg_le2: LEMMA
    IF n0z > 0 THEN n0z * x <= n0z * y ELSE n0z * y <= n0z * x ENDIF IFF x <= y


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 61 0 62 74
body:
  both_sides_times_pos_neg_gt1: LEMMA
    IF n0z > 0 THEN x * n0z > y * n0z ELSE y * n0z > x * n0z ENDIF IFF x > y


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 64 0 65 74
body:
  both_sides_times_pos_neg_gt2: LEMMA
    IF n0z > 0 THEN n0z * x > n0z * y ELSE n0z * y > n0z * x ENDIF IFF x > y


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 67 0 68 77
body:
  both_sides_times_pos_neg_ge1: LEMMA
    IF n0z > 0 THEN x * n0z >= y * n0z ELSE y * n0z >= x * n0z ENDIF IFF x >= y


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 70 0 71 77
body:
  both_sides_times_pos_neg_ge2: LEMMA
    IF n0z > 0 THEN n0z * x >= n0z * y ELSE n0z * y >= n0z * x ENDIF IFF x >= y


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 77 0 78 66
body:
  both_sides_div_pos_neg_lt1: LEMMA
    IF n0z > 0 THEN x/n0z < y/n0z ELSE y/n0z < x/n0z ENDIF IFF x < y


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 80 0 81 72
body:
  both_sides_div_pos_neg_lt2: LEMMA
    IF n0z > 0 THEN n0z/px < n0z/py ELSE n0z/py < n0z/px ENDIF IFF py < px


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 83 0 84 72
body:
  both_sides_div_pos_neg_lt3: LEMMA
    IF n0z > 0 THEN n0z/nx < n0z/ny ELSE n0z/ny < n0z/nx ENDIF IFF ny < nx


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 86 0 87 69
body:
  both_sides_div_pos_neg_le1: LEMMA
    IF n0z > 0 THEN x/n0z <= y/n0z ELSE y/n0z <= x/n0z ENDIF IFF x <= y


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 89 0 90 75
body:
  both_sides_div_pos_neg_le2: LEMMA
    IF n0z > 0 THEN n0z/px <= n0z/py ELSE n0z/py <= n0z/px ENDIF IFF py <= px


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 92 0 93 75
body:
  both_sides_div_pos_neg_le3: LEMMA
    IF n0z > 0 THEN n0z/nx <= n0z/ny ELSE n0z/ny <= n0z/nx ENDIF IFF ny <= nx


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 95 0 96 66
body:
  both_sides_div_pos_neg_gt1: LEMMA
    IF n0z > 0 THEN x/n0z > y/n0z ELSE y/n0z > x/n0z ENDIF IFF x > y


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 98 0 99 72
body:
  both_sides_div_pos_neg_gt2: LEMMA
    IF n0z > 0 THEN n0z/px > n0z/py ELSE n0z/py > n0z/px ENDIF IFF py > px


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 101 0 102 72
body:
  both_sides_div_pos_neg_gt3: LEMMA
    IF n0z > 0 THEN n0z/nx > n0z/ny ELSE n0z/ny > n0z/nx ENDIF IFF ny > nx


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 104 0 105 69
body:
  both_sides_div_pos_neg_ge1: LEMMA
    IF n0z > 0 THEN x/n0z >= y/n0z ELSE y/n0z >= x/n0z ENDIF IFF x >= y


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 107 0 108 75
body:
  both_sides_div_pos_neg_ge2: LEMMA
    IF n0z > 0 THEN n0z/px >= n0z/py ELSE n0z/py >= n0z/px ENDIF IFF py >= px


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 110 0 111 75
body:
  both_sides_div_pos_neg_ge3: LEMMA
    IF n0z > 0 THEN n0z/nx >= n0z/ny ELSE n0z/ny >= n0z/nx ENDIF IFF ny >= nx


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 140 2 141 74
body:
    both_sides_times_pos_neg_le1_imp: LEMMA
      x <= y IMPLIES IF w >= 0 THEN x * w <= y * w ELSE y * w <= x * w ENDIF


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 143 2 144 74
body:
    both_sides_times_pos_neg_le2_imp: LEMMA
      x <= y IMPLIES IF w >= 0 THEN w * x <= w * y ELSE w * y <= w * x ENDIF


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 146 2 147 74
body:
    both_sides_times_pos_neg_ge1_imp: LEMMA
      x >= y IMPLIES IF w >= 0 THEN x * w >= y * w ELSE y * w >= x * w ENDIF


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 149 2 150 74
body:
    both_sides_times_pos_neg_ge2_imp: LEMMA
      x >= y IMPLIES IF w >= 0 THEN w * x >= w * y ELSE w * y >= w * x ENDIF


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 186 0 197 25
body:
  le_times_le_any1: LEMMA
          IF w >= 0 IFF x >= 0
             THEN IF y >= 0 IFF z >= 0
                     THEN abs(w) <= abs(y) AND abs(x) <= abs(z)
                     ELSE (w = 0 OR x = 0) AND (y = 0 OR z = 0)
                  ENDIF
             ELSE IF y >= 0 IFF z >= 0
                     THEN true
                     ELSE abs(w) >= abs(y) AND abs(x) >= abs(z)
                  ENDIF
          ENDIF
            IMPLIES w * x <= y * z


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 199 0 210 25
body:
  ge_times_ge_any1: LEMMA
          IF y >= 0 IFF z >= 0
             THEN IF w >= 0 IFF x >= 0
                     THEN abs(w) >= abs(y) AND abs(x) >= abs(z)
                     ELSE (w = 0 OR x = 0) AND (y = 0 OR z = 0)
                  ENDIF
             ELSE IF w >= 0 IFF x >= 0
                     THEN true
                     ELSE abs(w) <= abs(y) AND abs(x) <= abs(z)
                  ENDIF
          ENDIF
            IMPLIES w * x >= y * z


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 212 0 224 24
body:
  lt_times_lt_any1: LEMMA
          IF w = 0 OR x = 0
             THEN 0 < y AND 0 < z OR y < 0 AND z < 0
          ELSIF w > 0 IFF x > 0
             THEN (y > 0 IFF z > 0) AND
                  (abs(w) <= abs(y) AND abs(x) <  abs(z) OR
                   abs(w) <  abs(y) AND abs(x) <= abs(z))
          ELSIF y > 0 IFF z > 0
             THEN true
             ELSE abs(w) >= abs(y) AND abs(x) >  abs(z) OR
                  abs(w) >  abs(y) AND abs(x) >= abs(z)
          ENDIF
            IMPLIES w * x < y * z


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 226 0 238 24
body:
  gt_times_gt_any1: LEMMA
          IF y = 0 OR z = 0
             THEN 0 < w AND 0 < x OR w < 0 AND x < 0
          ELSIF y > 0 IFF z > 0
             THEN (w > 0 IFF x > 0) AND
                  (abs(w) >= abs(y) AND abs(x) >  abs(z) OR
                   abs(w) >  abs(y) AND abs(x) >= abs(z))
          ELSIF w > 0 IFF x > 0
             THEN true
             ELSE abs(w) <= abs(y) AND abs(x) <  abs(z) OR
                  abs(w) <  abs(y) AND abs(x) <= abs(z)
          ENDIF
            IMPLIES w * x > y * z


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 244 0 255 13
body:
  le_times_le_any2: LEMMA
          w * x <= y * z IMPLIES
          IF y = 0 OR z = 0
             THEN (0 >= w OR 0 >= x) AND (w >= 0 OR x >= 0)
          ELSIF y > 0 IFF z > 0
             THEN (w > 0 IFF x > 0) IMPLIES
                  (abs(w) <  abs(y) OR abs(x) <= abs(z)) AND
                  (abs(w) <= abs(y) OR abs(x) <  abs(z))
          ELSE NOT (w > 0 IFF x > 0) AND
               (abs(w) >  abs(y) OR abs(x) >= abs(z)) AND
               (abs(w) >= abs(y) OR abs(x) >  abs(z))
          ENDIF


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 257 0 268 13
body:
  ge_times_ge_any2: LEMMA
          w * x >= y * z IMPLIES
          IF w = 0 OR x = 0
             THEN (0 >= y OR 0 >= z) AND (y >= 0 OR z >= 0)
          ELSIF w > 0 IFF x > 0
             THEN (y > 0 IFF z > 0) IMPLIES
                  (abs(w) >  abs(y) OR abs(x) >= abs(z)) AND
                  (abs(w) >= abs(y) OR abs(x) > abs(z))
          ELSE NOT (y > 0 IFF z > 0) AND
               (abs(w) <  abs(y) OR abs(x) <= abs(z)) AND
               (abs(w) <= abs(y) OR abs(x) <  abs(z))
          ENDIF


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 270 0 279 13
body:
  lt_times_lt_any2: LEMMA
          w * x < y * z IMPLIES
          IF y >= 0 IFF z >= 0
             THEN IF w >= 0 IFF x >= 0
                     THEN abs(w) < abs(y) OR abs(x) < abs(z)
                     ELSE (w /= 0 AND x /= 0) OR (y /= 0 AND z /= 0)
                  ENDIF
             ELSE NOT (w >= 0 IFF x >= 0) AND
                  (abs(w) > abs(y) OR abs(x) > abs(z))
          ENDIF


decl_type: formula
theory: extra_real_props
library: prelude
signature: nil
location: 281 0 290 13
body:
  gt_times_gt_any2: LEMMA
          w * x > y * z IMPLIES
          IF w >= 0 IFF x >= 0
             THEN IF y >= 0 IFF z >= 0
                     THEN abs(w) > abs(y) OR abs(x) > abs(z)
                     ELSE (w /= 0 AND x /= 0) OR (y /= 0 AND z /= 0)
                  ENDIF
             ELSE NOT (y >= 0 IFF z >= 0) AND
                  (abs(w) < abs(y) OR abs(x) < abs(z))
          ENDIF


decl_type: formula
theory: ordinals
library: prelude
signature: nil
location: 58 2 60 30
body:
    ordinal_induction: AXIOM
      (FORALL r: (FORALL s: s < r IMPLIES p(s)) IMPLIES p(r))
        IMPLIES (FORALL r: p(r))


decl_type: function
theory: ordinals
library: prelude
signature: [[ordstruct, ordstruct] -> bool]
location: 15 2 25 19
body:
    <(x, y): RECURSIVE bool =
       CASES x OF
          zero: NOT zero?(y),
          add(i, u, v): CASES y OF
                          zero: FALSE,
                          add(j, z, w): (u<z) OR
                                        (u=z) AND (i<j) OR
                                        (u=z) AND (i=j) AND (v<w)
                        ENDCASES
       ENDCASES
     MEASURE size(x);


decl_type: function
theory: ordinals
library: prelude
signature: [ordstruct -> bool]
location: 31 2 40 15
body:
    ordinal?(x): RECURSIVE bool =
      CASES x OF
        zero: TRUE,
        add(i, u, v): (ordinal?(u) AND ordinal?(v) AND 
                        CASES v OF
                          zero: TRUE,
                          add(k, r, s): r < u
                        ENDCASES)
      ENDCASES
     MEASURE size


decl_type: tcc
theory: ordinals
library: prelude
signature: nil
location: 70 0 76 999
body:
  % Termination TCC generated (at line 4644, column 39) for  (u < z)
  lessp_TCC1: OBLIGATION
    FORALL (x: ordstruct, y: ordstruct, i: posnat, u: ordstruct,
            v: ordstruct):
      x = add(i, u, v) IMPLIES
       (FORALL (j: posnat, z: ordstruct, w: ordstruct):
          y = add(j, z, w) IMPLIES size(u) < size(x));


decl_type: tcc
theory: ordinals
library: prelude
signature: nil
location: 78 0 87 999
body:
  % Termination TCC generated (at line 4646, column 59) for  (v < w)
  lessp_TCC2: OBLIGATION
    FORALL (x: ordstruct,
            v1: [{z: [ordstruct, ordstruct] | size(z`1) < size(x)} -> bool],
            y: ordstruct, i: posnat, u: ordstruct, v: ordstruct):
      x = add(i, u, v) IMPLIES
       (FORALL (j: posnat, z: ordstruct, w: ordstruct):
               (i = j) AND (u = z) AND NOT ((u = z) AND (i < j))
           AND NOT v1(u, z) AND y = add(j, z, w)
           IMPLIES size(v) < size(x));


decl_type: tcc
theory: ordinals
library: prelude
signature: nil
location: 89 0 92 999
body:
  % Termination TCC generated (at line 4658, column 21) for  ordinal?(u)
  ordinal?_TCC1: OBLIGATION
    FORALL (x: ordstruct, i: posnat, u: ordstruct, v: ordstruct):
      x = add(i, u, v) IMPLIES size(u) < size(x);


decl_type: tcc
theory: ordinals
library: prelude
signature: nil
location: 94 0 98 999
body:
  % Termination TCC generated (at line 4658, column 37) for  ordinal?(v)
  ordinal?_TCC2: OBLIGATION
    FORALL (x: ordstruct, v1: [{z: ordstruct | size(z) < size(x)} -> bool],
            i: posnat, u: ordstruct, v: ordstruct):
      v1(u) AND x = add(i, u, v) IMPLIES size(v) < size(x);


decl_type: tcc
theory: ordinals
library: prelude
signature: nil
location: 100 0 102 999
body:
  % Existence TCC generated (at line 4666, column 2) for
      % ordinal: TYPE+ = (ordinal?)
  ordinal_TCC1: OBLIGATION EXISTS (x: {x: ordstruct | ordinal?(x)}): TRUE;


decl_type: formula
theory: bounded_int_inductions
library: prelude
signature: nil
location: 9 2 11 34
body:
    upfrom_induction: LEMMA
      (pf(m) AND (FORALL jf: pf(jf) IMPLIES pf(jf + 1)))
         IMPLIES (FORALL jf: pf(jf))


decl_type: formula
theory: bounded_int_inductions
library: prelude
signature: nil
location: 13 2 15 33
body:
    UPFROM_induction: LEMMA
      (FORALL jf: (FORALL kf: kf < jf IMPLIES pf(kf)) IMPLIES pf(jf))
        IMPLIES (FORALL jf: pf(jf))


decl_type: formula
theory: bounded_int_inductions
library: prelude
signature: nil
location: 20 2 22 33
body:
    above_induction: LEMMA
      (pa(m+1) AND (FORALL ja: pa(ja) IMPLIES pa(ja + 1)))
        IMPLIES (FORALL ja: pa(ja))


decl_type: formula
theory: bounded_int_inductions
library: prelude
signature: nil
location: 24 2 26 33
body:
    ABOVE_induction: LEMMA
      (FORALL ja: (FORALL ka: ka < ja IMPLIES pa(ka)) IMPLIES pa(ja))
        IMPLIES (FORALL ja: pa(ja))


decl_type: tcc
theory: bounded_int_inductions
library: prelude
signature: nil
location: 33 0 35 999
body:
  % Subtype TCC generated (at line 3939, column 8) for  m
      % expected type  upfrom(m)
  upfrom_induction_TCC1: OBLIGATION m >= m;


decl_type: tcc
theory: bounded_int_inductions
library: prelude
signature: nil
location: 37 0 41 999
body:
  % Subtype TCC generated (at line 3939, column 45) for  jf + 1
      % expected type  upfrom(m)
  upfrom_induction_TCC2: OBLIGATION
    FORALL (pf: pred[upfrom(m)]):
      pf(m) IMPLIES (FORALL (jf): pf(jf) IMPLIES jf + 1 >= m);


decl_type: tcc
theory: bounded_int_inductions
library: prelude
signature: nil
location: 43 0 45 999
body:
  % Subtype TCC generated (at line 3950, column 8) for  m + 1
      % expected type  above(m)
  above_induction_TCC1: OBLIGATION m + 1 > m;


decl_type: tcc
theory: bounded_int_inductions
library: prelude
signature: nil
location: 47 0 51 999
body:
  % Subtype TCC generated (at line 3950, column 47) for  ja + 1
      % expected type  above(m)
  above_induction_TCC2: OBLIGATION
    FORALL (pa: pred[above(m)]):
      pa(m + 1) IMPLIES (FORALL (ja): pa(ja) IMPLIES ja + 1 > m);


decl_type: function
theory: bv_arithmetic_defs
library: prelude
location: 21 2 23 55
signature:
  [bv: bvec[N] ->
          {bvn: bvec[N] |
                   bv2int(bvn) =
                    IF bv2int(bv) = minint[N] THEN bv2int(bv)
                    ELSE -(bv2int(bv))
                    ENDIF}]

body:
    -(bv: bvec[N]): { bvn: bvec[N] | bv2int(bvn) = 
                                IF bv2int(bv) = minint[N] THEN bv2int(bv)
                                ELSE -(bv2int(bv)) ENDIF}


decl_type: function
theory: bv_arithmetic_defs
library: prelude
signature: [[bvec[N], bvec[N]] -> bool]
location: 32 2 33 71
body:
    overflow(bv1,bv2): bool = (bv2int(bv1) + bv2int(bv2)) > maxint[N]
                               OR (bv2int(bv1) + bv2int(bv2)) < minint[N]


decl_type: function
theory: bv_arithmetic_defs
library: prelude
signature: [[bvec[N], bvec[N]] -> bool]
location: 51 2 52 73
body:
    mult_overflow(bv1, bv2): bool = (bv2int(bv1) * bv2int(bv2)) > maxint[N]
                                 OR (bv2int(bv1) * bv2int(bv2)) < minint[N]


decl_type: function
theory: bv_arithmetic_defs
library: prelude
signature:
  [[bv1: bvec[N], {bv2 | NOT mult_overflow(bv1, bv2)}] ->
  bvec[N]]

location: 54 2 55 37
body:
    bv_stimes(bv1, (bv2 | NOT mult_overflow(bv1, bv2))): bvec[N] =
      int2bv(bv2int(bv1) * bv2int(bv2))


decl_type: tcc
theory: bv_arithmetic_defs
library: prelude
signature: nil
location: 62 0 77 999
body:
  % Existence TCC generated (at line 5785, column 2) for
      % -(bv: bvec[N]):
      %       {bvn: bvec[N] |
      %                bv2int(bvn) =
      %                 IF bv2int(bv) = minint[N] THEN bv2int(bv)
      %                 ELSE -(bv2int(bv))
      %                 ENDIF}
  difference_TCC1: OBLIGATION
    EXISTS (x:
              [bv: bvec[N] ->
                 {bvn: bvec[N] |
                          bv2int[N](bvn) =
                           IF bv2int[N](bv) = minint[N] THEN bv2int[N](bv)
                           ELSE -(bv2int[N](bv))
                           ENDIF}]):
      TRUE;


decl_type: tcc
theory: bv_arithmetic_defs
library: prelude
signature: nil
location: 79 0 85 999
body:
  % Subtype TCC generated (at line 5813, column 11) for
      % bv2int(bv1) + bv2int(bv2)
      % expected type  iv: rng_2s_comp
  bv_splus_TCC1: OBLIGATION
    FORALL (bv1: bvec[N], (bv2: bvec[N] | NOT overflow(bv1, bv2))):
      minint[N] <= bv2int[N](bv1) + bv2int[N](bv2) AND
       bv2int[N](bv1) + bv2int[N](bv2) <= maxint[N];


decl_type: tcc
theory: bv_arithmetic_defs
library: prelude
signature: nil
location: 87 0 93 999
body:
  % Subtype TCC generated (at line 5819, column 11) for
      % bv2int(bv1) * bv2int(bv2)
      % expected type  iv: rng_2s_comp
  bv_stimes_TCC1: OBLIGATION
    FORALL (bv1: bvec[N], (bv2: bvec[N] | NOT mult_overflow(bv1, bv2))):
      minint[N] <= bv2int[N](bv1) * bv2int[N](bv2) AND
       bv2int[N](bv1) * bv2int[N](bv2) <= maxint[N];


decl_type: function
theory: stdprog
library: prelude
signature: [[ExceptionTag[void], T, T] -> T]
location: 15 2 16 75
body:
    catch(tag:ExceptionTag[void],t1,t2:T): MACRO T =
      catch_lift[T,void](tag,LAMBDA(d:Dummy):t1,LAMBDA(e:Exception[void]):t2)


decl_type: function
theory: stdprog
library: prelude
signature: [[list[ExceptionTag[void]], T, T] -> T]
location: 20 2 21 78
body:
    catch(l:list[ExceptionTag[void]],t1,t2:T) : MACRO T =
      catch_list_lift[T,void](l,LAMBDA(d:Dummy):t1,LAMBDA(e:Exception[void]):t2)


decl_type: function
theory: stdprog
library: prelude
signature: [Mutable -> T]
location: 36 2 40 9
body:
    val(v:Mutable): T = 
      if undef(v) then 
        throw(UndefinedMutableVariable)
      else val_lisp(v)
      endif


decl_type: formula
theory: QuotientIteration
library: prelude
signature: nil
location: 20 2 25 47
body:
    QuotientAction : LEMMA
      FORALL(R : equivalence[Quotient(S)]) :
        bijective?[Quotient(R), Quotient(action(S)(R))]
          (lift[Quotient(S), Quotient(S), Quotient(action(S)(R))](R)
             (lift[X, X, Quotient(action(S)(R))](S)
                (quotient_map[X](action(S)(R)))))


decl_type: judgement
theory: QuotientIteration
library: prelude
signature: equivalence[X]
location: 17 2 18 67
body:
    action_equivalence_is_equivalence: JUDGEMENT
      action(S)(R : equivalence[Quotient(S)]) HAS_TYPE equivalence[X]


decl_type: tcc
theory: QuotientIteration
library: prelude
signature: nil
location: 32 0 36 999
body:
  % Subtype TCC generated (at line 6291, column 6) for  EquivClass(S)(x)
      % expected type  Quotient[X](S)
  action_TCC1: OBLIGATION
    FORALL (S: equivalence[X], R: equivalence[Quotient[X](S)], x: X, y: X):
      EXISTS (x_1: X): EquivClass[X](S)(x) = EquivClass[X](S)(x_1);


decl_type: tcc
theory: QuotientIteration
library: prelude
signature: nil
location: 38 0 42 999
body:
  % Subtype TCC generated (at line 6291, column 24) for  EquivClass(S)(y)
      % expected type  Quotient[X](S)
  action_TCC2: OBLIGATION
    FORALL (S: equivalence[X], R: equivalence[Quotient[X](S)], x: X, y: X):
      EXISTS (x: X): EquivClass[X](S)(y) = EquivClass[X](S)(x);


decl_type: tcc
theory: QuotientIteration
library: prelude
signature: nil
location: 44 0 47 999
body:
  % Judgement subtype TCC generated (at line 6294, column 4) for  action(S)(R)
      % expected type  equivalence[X]
  action_equivalence_is_equivalence: OBLIGATION
    FORALL (S, R: equivalence[Quotient(S)]): equivalence?[X](action(S)(R));


decl_type: tcc
theory: QuotientIteration
library: prelude
signature: nil
location: 49 0 55 999
body:
  % Subtype TCC generated (at line 6301, column 15) for
      % quotient_map[X](action(S)(R))
      % expected type  (PreservesEq[X, X, Quotient(action(S)(R))](S))
  QuotientAction_TCC1: OBLIGATION
    FORALL (S: equivalence[X], R: equivalence[Quotient[X](S)]):
      PreservesEq[X, X, Quotient[X](action(S)(R))]
          (S)(quotient_map[X](action(S)(R)));


decl_type: tcc
theory: QuotientIteration
library: prelude
signature: nil
location: 57 0 64 999
body:
  % Subtype TCC generated (at line 6300, column 47) for  S
      % expected type  S:
                     %   {R: equivalence[X] |
                     %            PreservesEq[X, X, bool]
                     %                (R)(LAMBDA (x: X): TRUE)}
  QuotientAction_TCC2: OBLIGATION
    FORALL (S: equivalence[X], R: equivalence[Quotient[X](S)]):
      PreservesEq[X, X, bool](S)(LAMBDA (x: X): TRUE);


decl_type: tcc
theory: QuotientIteration
library: prelude
signature: nil
location: 66 0 76 999
body:
  % Subtype TCC generated (at line 6300, column 12) for
      % lift[X, X, Quotient(action(S)(R))](S)(quotient_map[X](action(S)(R)))
      % expected type  (PreservesEq
                     %      [Quotient(S), Quotient(S), Quotient(action(S)(R))]
                     %      (R))
  QuotientAction_TCC3: OBLIGATION
    FORALL (S: equivalence[X], R: equivalence[Quotient[X](S)]):
      PreservesEq[Quotient[X](S), Quotient[X](S), Quotient[X](action(S)(R))]
          (R)
          (lift[X, X, Quotient[X](action(S)(R))]
               (S)(quotient_map[X](action(S)(R))));


decl_type: tcc
theory: QuotientIteration
library: prelude
signature: nil
location: 78 0 86 999
body:
  % Subtype TCC generated (at line 6299, column 64) for  R
      % expected type  S:
                     %   {R: equivalence[Quotient(S)] |
                     %            PreservesEq[Quotient(S), Quotient(S), bool]
                     %                (R)(LAMBDA (x: Quotient[X](S)): TRUE)}
  QuotientAction_TCC4: OBLIGATION
    FORALL (S: equivalence[X], R: equivalence[Quotient[X](S)]):
      PreservesEq[Quotient[X](S), Quotient[X](S), bool]
          (R)(LAMBDA (x: Quotient[X](S)): TRUE);


decl_type: formula
theory: function_inverse_alt
library: prelude
signature: nil
location: 29 2 30 72
body:
    bijective_inverse_is_inverse_alt: COROLLARY
      FORALL (f: (bijective?[D, R])), (g: inverses(f)): g = inverse_alt(f)


decl_type: judgement
theory: function_inverse_alt
library: prelude
signature: {d | f(d) = r}
location: 32 2 33 64
body:
    unique_bijective_inverse_alt: JUDGEMENT
      inverse_alt(f: (bijective?[D,R]))(r) HAS_TYPE {d | f(d) = r}


decl_type: judgement
theory: function_inverse_alt
library: prelude
signature: (bijective?[R, D])
location: 35 2 36 64
body:
    bijective_inverse_alt_is_bijective: JUDGEMENT
      inverse_alt(f: (bijective?[D,R])) HAS_TYPE (bijective?[R,D])


decl_type: judgement
theory: function_inverse_alt
library: prelude
signature: (surjective?[R, D])
location: 38 2 39 67
body:
    inv_inj_is_surj_alt: JUDGEMENT
      inverse_alt(f: (injective?[D, R])) HAS_TYPE (surjective?[R, D])


decl_type: judgement
theory: function_inverse_alt
library: prelude
signature: (injective?[R, D])
location: 41 2 42 67
body:
    inv_surj_is_inj_alt: JUDGEMENT
      inverse_alt(f: (surjective?[D, R])) HAS_TYPE (injective?[R, D])


decl_type: tcc
theory: function_inverse_alt
library: prelude
signature: nil
location: 49 0 52 999
body:
  % Existence TCC generated (at line 1381, column 2) for
      % inverses(f): TYPE+ = (LAMBDA (g: [R -> D]): inverse?(g, f))
  inverses_TCC1: OBLIGATION
    FORALL (f: [D -> R]): EXISTS (x: {g | inverse?[D, R](g, f)}): TRUE;


decl_type: tcc
theory: function_inverse_alt
library: prelude
signature: nil
location: 54 0 58 999
body:
  % Subtype TCC generated (at line 1383, column 39) for
      % {g: inverses(f) | TRUE}
      % expected type  p: (nonempty?[inverses(f)])
  inverse_alt_TCC1: OBLIGATION
    FORALL (f: [D -> R]): nonempty?[inverses(f)]({g: inverses(f) | TRUE});


decl_type: tcc
theory: function_inverse_alt
library: prelude
signature: nil
location: 60 0 64 999
body:
  % Judgement subtype TCC generated (at line 1390, column 4) for
      % inverse_alt(f)(r)
      % expected type  {d | f(d) = r}
  unique_bijective_inverse_alt: OBLIGATION
    FORALL (f: (bijective?[D, R]), r): f(inverse_alt(f)(r)) = r;


decl_type: tcc
theory: function_inverse_alt
library: prelude
signature: nil
location: 66 0 70 999
body:
  % Judgement subtype TCC generated (at line 1393, column 4) for
      % inverse_alt(f)
      % expected type  (bijective?[R, D])
  bijective_inverse_alt_is_bijective: OBLIGATION
    FORALL (f: (bijective?[D, R])): bijective?[R, D](inverse_alt(f));


decl_type: tcc
theory: function_inverse_alt
library: prelude
signature: nil
location: 72 0 76 999
body:
  % Judgement subtype TCC generated (at line 1396, column 4) for
      % inverse_alt(f)
      % expected type  (surjective?[R, D])
  inv_inj_is_surj_alt: OBLIGATION
    FORALL (f: (injective?[D, R])): surjective?[R, D](inverse_alt(f));


decl_type: tcc
theory: function_inverse_alt
library: prelude
signature: nil
location: 78 0 82 999
body:
  % Judgement subtype TCC generated (at line 1399, column 4) for
      % inverse_alt(f)
      % expected type  (injective?[R, D])
  inv_surj_is_inj_alt: OBLIGATION
    FORALL (f: (surjective?[D, R])): injective?[R, D](inverse_alt(f));


decl_type: judgement
theory: orders
library: prelude
signature: (well_founded?)
location: 63 2 64 53
body:
    strict_well_founded_is_well_founded: JUDGEMENT
      (strict_well_founded?) SUBTYPE_OF (well_founded?)


decl_type: function
theory: orders
library: prelude
signature: [pred[[T, T]] -> bool]
location: 54 2 57 60
body:
    well_founded?(<): bool =
       (FORALL p:
          (EXISTS y: p(y))
             IMPLIES (EXISTS (y:(p)): (FORALL (x:(p)): (NOT x < y))))


decl_type: function
theory: orders
library: prelude
signature: [pred[[T, T]] -> [[T, pred[T]] -> bool]]
location: 85 2 87 63
body:
    least_upper_bound?(<)(x, pe): bool =
      upper_bound?(<)(x, pe) AND
        FORALL y: upper_bound?(<)(y, pe) IMPLIES (x < y OR x = y)


decl_type: function
theory: orders
library: prelude
signature: [pred[[T, T]] -> [[T, pred[T]] -> bool]]
location: 91 2 93 63
body:
    greatest_lower_bound?(<)(x, pe): bool =
      lower_bound?(<)(x, pe) AND
        FORALL y: lower_bound?(<)(y, pe) IMPLIES (y < x OR x = y)


decl_type: tcc
theory: orders
library: prelude
signature: nil
location: 102 0 104 999
body:
  % Judgement subtype TCC generated (at line 500, column 36) for  x
      % expected type  (reflexive?[T])
  preorder_is_reflexive: OBLIGATION FORALL (x: (preorder?)): reflexive?[T](x);


decl_type: tcc
theory: orders
library: prelude
signature: nil
location: 106 0 109 999
body:
  % Judgement subtype TCC generated (at line 501, column 36) for  x
      % expected type  (transitive?[T])
  preorder_is_transitive: OBLIGATION
    FORALL (x: (preorder?)): transitive?[T](x);


decl_type: tcc
theory: orders
library: prelude
signature: nil
location: 111 0 113 999
body:
  % Judgement subtype TCC generated (at line 502, column 36) for  x
      % expected type  (preorder?)
  equiv_is_preorder: OBLIGATION FORALL (x: (equivalence?[T])): preorder?(x);


decl_type: tcc
theory: orders
library: prelude
signature: nil
location: 115 0 117 999
body:
  % Judgement subtype TCC generated (at line 506, column 33) for  x
      % expected type  (preorder?)
  po_is_preorder: OBLIGATION FORALL (x: (partial_order?)): preorder?(x);


decl_type: tcc
theory: orders
library: prelude
signature: nil
location: 119 0 122 999
body:
  % Judgement subtype TCC generated (at line 508, column 4) for  x
      % expected type  (antisymmetric?[T])
  po_is_antisymmetric: OBLIGATION
    FORALL (x: (partial_order?)): antisymmetric?[T](x);


decl_type: tcc
theory: orders
library: prelude
signature: nil
location: 124 0 127 999
body:
  % Judgement subtype TCC generated (at line 513, column 4) for  x
      % expected type  (irreflexive?[T])
  strict_is_irreflexive: OBLIGATION
    FORALL (x: (strict_order?)): irreflexive?[T](x);


decl_type: tcc
theory: orders
library: prelude
signature: nil
location: 129 0 132 999
body:
  % Judgement subtype TCC generated (at line 515, column 4) for  x
      % expected type  (antisymmetric?[T])
  strict_order_is_antisymmetric: OBLIGATION
    FORALL (x: (strict_order?)): antisymmetric?[T](x);


decl_type: tcc
theory: orders
library: prelude
signature: nil
location: 134 0 137 999
body:
  % Judgement subtype TCC generated (at line 517, column 4) for  x
      % expected type  (transitive?[T])
  strict_is_transitive: OBLIGATION
    FORALL (x: (strict_order?)): transitive?[T](x);


decl_type: tcc
theory: orders
library: prelude
signature: nil
location: 139 0 141 999
body:
  % Judgement subtype TCC generated (at line 523, column 34) for  x
      % expected type  (partial_order?)
  total_is_po: OBLIGATION FORALL (x: (total_order?)): partial_order?(x);


decl_type: tcc
theory: orders
library: prelude
signature: nil
location: 143 0 146 999
body:
  % Judgement subtype TCC generated (at line 524, column 34) for  x
      % expected type  (dichotomous?)
  total_is_dichotomous: OBLIGATION
    FORALL (x: (total_order?)): dichotomous?(x);


decl_type: tcc
theory: orders
library: prelude
signature: nil
location: 148 0 150 999
body:
  % Judgement subtype TCC generated (at line 528, column 29) for  x
      % expected type  (total_order?)
  linear_is_total: OBLIGATION FORALL (x: (linear_order?)): total_order?(x);


decl_type: tcc
theory: orders
library: prelude
signature: nil
location: 152 0 154 999
body:
  % Judgement subtype TCC generated (at line 529, column 29) for  x
      % expected type  (linear_order?)
  total_is_linear: OBLIGATION FORALL (x: (total_order?)): linear_order?(x);


decl_type: tcc
theory: orders
library: prelude
signature: nil
location: 156 0 159 999
body:
  % Judgement subtype TCC generated (at line 536, column 4) for  x
      % expected type  (strict_order?)
  strict_total_is_strict: OBLIGATION
    FORALL (x: (strict_total_order?)): strict_order?(x);


decl_type: tcc
theory: orders
library: prelude
signature: nil
location: 161 0 164 999
body:
  % Judgement subtype TCC generated (at line 538, column 4) for  x
      % expected type  (trichotomous?)
  strict_total_is_trichotomous: OBLIGATION
    FORALL (x: (strict_total_order?)): trichotomous?(x);


decl_type: tcc
theory: orders
library: prelude
signature: nil
location: 166 0 169 999
body:
  % Judgement subtype TCC generated (at line 548, column 4) for  x
      % expected type  (strict_order?)
  strict_well_founded_is_strict: OBLIGATION
    FORALL (x: (strict_well_founded?)): strict_order?(x);


decl_type: tcc
theory: orders
library: prelude
signature: nil
location: 171 0 174 999
body:
  % Judgement subtype TCC generated (at line 550, column 4) for  x
      % expected type  (well_founded?)
  strict_well_founded_is_well_founded: OBLIGATION
    FORALL (x: (strict_well_founded?)): well_founded?(x);


decl_type: tcc
theory: orders
library: prelude
signature: nil
location: 176 0 179 999
body:
  % Judgement subtype TCC generated (at line 555, column 4) for  x
      % expected type  (strict_total_order?)
  well_ordered_is_strict_total: OBLIGATION
    FORALL (x: (well_ordered?)): strict_total_order?(x);


decl_type: tcc
theory: orders
library: prelude
signature: nil
location: 181 0 184 999
body:
  % Judgement subtype TCC generated (at line 557, column 4) for  x
      % expected type  (well_founded?)
  well_ordered_is_well_founded: OBLIGATION
    FORALL (x: (well_ordered?)): well_founded?(x);


decl_type: function
theory: bv_int_defs
library: prelude
signature: [bvec[N] -> rng_2s_comp]
location: 35 2 36 68
body:
    bv2int(bv: bvec[N]): rng_2s_comp = IF bv2nat(bv) < exp2(N-1) THEN bv2nat(bv)
                                       ELSE bv2nat(bv) - exp2(N) ENDIF


decl_type: tcc
theory: bv_int_defs
library: prelude
signature: nil
location: 45 0 47 999
body:
  % Subtype TCC generated (at line 5748, column 22) for  N - 1
      % expected type  nat
  minint_TCC1: OBLIGATION N - 1 >= 0;


decl_type: tcc
theory: bv_int_defs
library: prelude
signature: nil
location: 49 0 54 999
body:
  % Subtype TCC generated (at line 5757, column 68) for  bv2nat(bv)
      % expected type  rng_2s_comp
  bv2int_TCC1: OBLIGATION
    FORALL (bv: bvec[N]):
      bv2nat(bv) < exp2(N - 1) IMPLIES
       minint <= bv2nat[N](bv) AND bv2nat[N](bv) <= maxint;


decl_type: tcc
theory: bv_int_defs
library: prelude
signature: nil
location: 56 0 62 999
body:
  % Subtype TCC generated (at line 5758, column 42) for  bv2nat(bv) - exp2(N)
      % expected type  rng_2s_comp
  bv2int_TCC2: OBLIGATION
    FORALL (bv: bvec[N]):
      NOT bv2nat(bv) < exp2(N - 1) IMPLIES
       minint <= bv2nat[N](bv) - exp2(N) AND
        bv2nat[N](bv) - exp2(N) <= maxint;


decl_type: tcc
theory: bv_int_defs
library: prelude
signature: nil
location: 64 0 67 999
body:
  % Existence TCC generated (at line 5760, column 2) for
      % int2bv(iv: rng_2s_comp): {bv: bvec[N] | bv2int(bv) = iv}
  int2bv_TCC1: OBLIGATION
    EXISTS (x: [iv: rng_2s_comp -> {bv: bvec[N] | bv2int(bv) = iv}]): TRUE;


decl_type: formula
theory: QuotientDistributive
library: prelude
signature: nil
location: 24 2 27 56
body:
    EqualityExtensionPreservesEq : LEMMA
      PreservesEq[[X, Y], [X, Y], [Quotient(S), Y]]
          (EqualityExtension(S))
          (LAMBDA(x : X, y : Y) : (quotient_map(S)(x), y))


decl_type: formula
theory: QuotientDistributive
library: prelude
signature: nil
location: 29 2 32 60
body:
    QuotientDistributive : LEMMA
      bijective?[Quotient(EqualityExtension(S)), [Quotient(S), Y]]
        (lift[[X, Y], [X, Y], [Quotient(S), Y]](EqualityExtension(S))
             (LAMBDA(x : X, y : Y) : (quotient_map(S)(x), y)))


decl_type: formula
theory: QuotientDistributive
library: prelude
signature: nil
location: 41 2 44 73
body:
    RelExtensionPreservesEq : LEMMA
      PreservesEq[[X, Y], [X, Y], [Quotient(S), Quotient(R)]]
          (RelExtension(S,R))
          (LAMBDA(x : X, y : Y) : (quotient_map(S)(x), quotient_map(R)(y)))


decl_type: formula
theory: QuotientDistributive
library: prelude
signature: nil
location: 46 2 49 77
body:
    RelQuotientDistributive : LEMMA
      bijective?[Quotient(RelExtension(S,R)), [Quotient(S), Quotient(R)]]
        (lift[[X, Y], [X, Y], [Quotient(S), Quotient(R)]](RelExtension(S, R))
             (LAMBDA(x : X, y : Y) : (quotient_map(S)(x), quotient_map(R)(y))))


decl_type: formula
theory: QuotientDistributive
library: prelude
signature: nil
location: 59 2 62 74
body:
    FunExtensionPreservesEq : LEMMA
      PreservesEq[[X -> Y], [X -> Y], [x : X -> Quotient(F(x))]]
          (FunExtension(F))
          (LAMBDA(f : [X -> Y]) : LAMBDA (x : X) : quotient_map(F(x))(f(x)))


decl_type: formula
theory: QuotientDistributive
library: prelude
signature: nil
location: 64 2 67 81
body:
    FunQuotientDistributive : LEMMA
      bijective?[Quotient(FunExtension(F)), [x : X -> Quotient(F(x))]]
        (lift[[X -> Y], [X -> Y], [x : X -> Quotient(F(x))]](FunExtension(F))
             (LAMBDA(f : [X -> Y]) : (LAMBDA (x : X): (quotient_map(F(x))(f(x))))))


decl_type: tcc
theory: QuotientDistributive
library: prelude
signature: nil
location: 74 0 78 999
body:
  % Judgement subtype TCC generated (at line 6227, column 4) for
      % EqualityExtension(S)
      % expected type  equivalence[[X, Y]]
  EqualityExtension_is_equivalence: OBLIGATION
    FORALL (S): equivalence?[[X, Y]](EqualityExtension(S));


decl_type: tcc
theory: QuotientDistributive
library: prelude
signature: nil
location: 80 0 88 999
body:
  % Subtype TCC generated (at line 6237, column 12) for
      % LAMBDA (x: X, y: Y): (quotient_map(S)(x), y)
      % expected type  (PreservesEq[[X, Y], [X, Y], [Quotient(S), Y]]
                     %      (EqualityExtension(S)))
  QuotientDistributive_TCC1: OBLIGATION
    FORALL (S: equivalence[X]):
      PreservesEq[[X, Y], [X, Y], [Quotient[X](S), Y]]
          (EqualityExtension(S))
          (LAMBDA (x: X, y: Y): (quotient_map[X](S)(x), y));


decl_type: tcc
theory: QuotientDistributive
library: prelude
signature: nil
location: 90 0 98 999
body:
  % Subtype TCC generated (at line 6236, column 46) for  EqualityExtension(S)
      % expected type  S:
                     %   {R: equivalence[[X, Y]] |
                     %            PreservesEq[[X, Y], [X, Y], bool]
                     %                (R)(LAMBDA (x: [X, Y]): TRUE)}
  QuotientDistributive_TCC2: OBLIGATION
    FORALL (S: equivalence[X]):
      PreservesEq[[X, Y], [X, Y], bool]
          (EqualityExtension(S))(LAMBDA (x: [X, Y]): TRUE);


decl_type: tcc
theory: QuotientDistributive
library: prelude
signature: nil
location: 100 0 105 999
body:
  % Subtype TCC generated (at line 6244, column 4) for
      % {z, w | S(z`1, w`1) AND R(z`2, w`2)}
      % expected type  equivalence[[X, Y]]
  RelExtension_TCC1: OBLIGATION
    FORALL (S: equivalence[X], R: equivalence[Y]):
      equivalence?[[X, Y]]({z, w | S(z`1, w`1) AND R(z`2, w`2)});


decl_type: tcc
theory: QuotientDistributive
library: prelude
signature: nil
location: 107 0 117 999
body:
  % Subtype TCC generated (at line 6254, column 12) for
      % LAMBDA (x: X, y: Y): (quotient_map(S)(x), quotient_map(R)(y))
      % expected type  (PreservesEq
                     %      [[X, Y], [X, Y], [Quotient(S), Quotient(R)]]
                     %      (RelExtension(S, R)))
  RelQuotientDistributive_TCC1: OBLIGATION
    FORALL (R: equivalence[Y], S: equivalence[X]):
      PreservesEq[[X, Y], [X, Y], [Quotient[X](S), Quotient[Y](R)]]
          (RelExtension(S, R))
          (LAMBDA (x: X, y: Y):
             (quotient_map[X](S)(x), quotient_map[Y](R)(y)));


decl_type: tcc
theory: QuotientDistributive
library: prelude
signature: nil
location: 119 0 127 999
body:
  % Subtype TCC generated (at line 6253, column 56) for  RelExtension(S, R)
      % expected type  S:
                     %   {R: equivalence[[X, Y]] |
                     %            PreservesEq[[X, Y], [X, Y], bool]
                     %                (R)(LAMBDA (x: [X, Y]): TRUE)}
  RelQuotientDistributive_TCC2: OBLIGATION
    FORALL (R: equivalence[Y], S: equivalence[X]):
      PreservesEq[[X, Y], [X, Y], bool]
          (RelExtension(S, R))(LAMBDA (x: [X, Y]): TRUE);


decl_type: tcc
theory: QuotientDistributive
library: prelude
signature: nil
location: 129 0 134 999
body:
  % Subtype TCC generated (at line 6262, column 4) for
      % {f, g | FORALL (x: X): F(x)(f(x), g(x))}
      % expected type  equivalence[[X -> Y]]
  FunExtension_TCC1: OBLIGATION
    FORALL (F: [X -> equivalence[Y]]):
      equivalence?[[X -> Y]]({f, g | FORALL (x: X): F(x)(f(x), g(x))});


decl_type: tcc
theory: QuotientDistributive
library: prelude
signature: nil
location: 136 0 146 999
body:
  % Subtype TCC generated (at line 6272, column 12) for
      % LAMBDA (f: [X -> Y]): (LAMBDA (x: X): (quotient_map(F(x))(f(x))))
      % expected type  (PreservesEq
                     %      [[X -> Y], [X -> Y], [x: X -> Quotient(F(x))]]
                     %      (FunExtension(F)))
  FunQuotientDistributive_TCC1: OBLIGATION
    FORALL (F: [X -> equivalence[Y]]):
      PreservesEq[[X -> Y], [X -> Y], [x: X -> Quotient[Y](F(x))]]
          (FunExtension(F))
          (LAMBDA (f: [X -> Y]):
             LAMBDA (x: X): (quotient_map[Y](F(x))(f(x))));


decl_type: tcc
theory: QuotientDistributive
library: prelude
signature: nil
location: 148 0 156 999
body:
  % Subtype TCC generated (at line 6271, column 59) for  FunExtension(F)
      % expected type  S:
                     %   {R: equivalence[[X -> Y]] |
                     %            PreservesEq[[X -> Y], [X -> Y], bool]
                     %                (R)(LAMBDA (x: [X -> Y]): TRUE)}
  FunQuotientDistributive_TCC2: OBLIGATION
    FORALL (F: [X -> equivalence[Y]]):
      PreservesEq[[X -> Y], [X -> Y], bool]
          (FunExtension(F))(LAMBDA (x: [X -> Y]): TRUE);


decl_type: tcc
theory: more_map_props
library: prelude
signature: nil
location: 17 0 21 999
body:
  % Subtype TCC generated (at line 4838, column 21) for  i
      % expected type  below[length[T2](map(f)(l))]
  map_nth_rw_TCC1: OBLIGATION
    FORALL (f: [T1 -> T2], l: list[T1], i: below(length[T1](l))):
      i < length[T2](map[T1, T2](f)(l));


decl_type: formula
theory: subrange_inductions
library: prelude
signature: nil
location: 11 2 13 32
body:
    subrange_induction: LEMMA
      (p(i) AND (FORALL k: k < j AND p(k) IMPLIES p(k + 1)))
          IMPLIES (FORALL k: p(k))


decl_type: formula
theory: subrange_inductions
library: prelude
signature: nil
location: 15 2 17 30
body:
    SUBRANGE_induction: LEMMA
      (FORALL k: (FORALL m: m < k IMPLIES p(m)) IMPLIES p(k))
        IMPLIES (FORALL k: p(k))


decl_type: tcc
theory: subrange_inductions
library: prelude
signature: nil
location: 24 0 26 999
body:
  % Subtype TCC generated (at line 3920, column 7) for  i
      % expected type  subrange(i, j)
  subrange_induction_TCC1: OBLIGATION i <= i AND i <= j;


decl_type: tcc
theory: subrange_inductions
library: prelude
signature: nil
location: 28 0 33 999
body:
  % Subtype TCC generated (at line 3920, column 50) for  k + 1
      % expected type  subrange(i, j)
  subrange_induction_TCC2: OBLIGATION
    FORALL (p: pred[subrange(i, j)]):
      p(i) IMPLIES
       (FORALL (k): k < j AND p(k) IMPLIES i <= k + 1 AND k + 1 <= j);


decl_type: formula
theory: mod
library: prelude
signature: nil
location: 34 2 36 38
body:
    mod_neg    : LEMMA mod(-i,j) = IF integer_pred(i/j) THEN 0
                                   ELSE j - mod(i,j)
                                   ENDIF


decl_type: formula
theory: mod
library: prelude
signature: nil
location: 38 2 40 38
body:
    mod_neg_d  : LEMMA mod(i,-j) = IF integer_pred(i/j) THEN 0
                                   ELSE mod(i,j) - j 
                                   ENDIF


decl_type: formula
theory: mod
library: prelude
signature: nil
location: 44 2 47 39
body:
    mod_lt     : LEMMA abs(i) < abs(j) IMPLIES mod(i,j) = 
                                    IF sgn(i) = sgn(j) OR i = 0 THEN i
                                    ELSE i + j
                                    ENDIF


decl_type: formula
theory: mod
library: prelude
signature: nil
location: 51 2 53 39
body:
    mod_lt_int : LEMMA -m < i AND i < m IMPLIES mod(i,m) = 
                                    IF i >= 0 THEN i ELSE i + m
                                    ENDIF


decl_type: formula
theory: mod
library: prelude
signature: nil
location: 62 2 65 47
body:
    mod_sum_nat: LEMMA (FORALL (n1,n2: below(m)):
                            mod(n1+n2,m) = IF n1 + n2 < m THEN n1+n2
                                           ELSE n1 + n2 - m
                                           ENDIF)


decl_type: formula
theory: mod
library: prelude
signature: nil
location: 72 2 75 40
body:
    mod_one    : LEMMA mod(1,j) = IF abs(j) = 1 THEN 0
                                     ELSIF j > 0 THEN 1
                                     ELSE j + 1
                                     ENDIF


decl_type: formula
theory: mod
library: prelude
signature: nil
location: 81 2 82 66
body:
    mod_inj_plus       : LEMMA a < m AND n < m AND c < m AND
                         mod(a + n, m) = mod(a + c, m) IMPLIES n = c


decl_type: formula
theory: mod
library: prelude
signature: nil
location: 84 2 85 67
body:
    mod_inj_minus       : LEMMA a < m AND n < m AND c < m AND
                          mod(a - n, m) = mod(a - c, m) IMPLIES n = c


decl_type: formula
theory: mod
library: prelude
signature: nil
location: 88 2 89 53
body:
    mod_wrap_around: LEMMA n < m AND (c <= m AND c >= m-n) IMPLIES
                                mod(n+c, m) = n - (m-c)


decl_type: formula
theory: mod
library: prelude
signature: nil
location: 95 2 96 66
body:
    mod_inj1:        LEMMA x < m AND n < m AND c < m AND
                         mod(x + n, m) = mod(x + c, m) IMPLIES n = c


decl_type: formula
theory: mod
library: prelude
signature: nil
location: 98 2 99 67
body:
    mod_inj2:        LEMMA x < m AND n < m AND c < m AND
                          mod(x - n, m) = mod(x - c, m) IMPLIES n = c


decl_type: formula
theory: mod
library: prelude
signature: nil
location: 101 2 102 75
body:
    mod_wrap_inj: LEMMA n < m AND a < m AND b < m AND a > 0 AND
                              mod(n + a, m) = mod(n - b, m) IMPLIES a + b = m


decl_type: formula
theory: mod
library: prelude
signature: nil
location: 104 2 106 61
body:
    mod_wrap_inj_eq: LEMMA
        x < m AND a < m AND b < m AND a > 0
          IMPLIES (mod(x + a, m) = mod(x - b, m)) = (a + b = m)


decl_type: formula
theory: mod
library: prelude
signature: nil
location: 109 2 110 70
body:
    mod_neg_limited: LEMMA 0 <= kk AND  kk < m AND vv < m AND
                        vv - kk < 0 IMPLIES mod(vv - kk,m) = m + vv - kk


decl_type: tcc
theory: mod
library: prelude
signature: nil
location: 125 0 128 999
body:
  % Subtype TCC generated (at line 5546, column 35) for  i - j * floor(i / j)
      % expected type  {k | abs(k) < abs(j)}
  mod_TCC1: OBLIGATION
    FORALL (i: int, j: nonzero_integer): abs(i - j * floor(i / j)) < abs(j);


decl_type: tcc
theory: mod
library: prelude
signature: nil
location: 130 0 133 999
body:
  % Judgement subtype TCC generated (at line 5550, column 12) for  mod(i, m)
      % expected type  below(m)
  mod_TCC2: OBLIGATION
    FORALL (i: int, m: posnat): mod(i, m) >= 0 AND mod(i, m) < m;


decl_type: tcc
theory: restrict_set_props
library: prelude
signature: nil
location: 22 0 26 999
body:
  % Judgement subtype TCC generated (at line 4318, column 4) for
      % restrict[T, S, bool](a)
      % expected type  finite_set[S]
  finite_restrict: OBLIGATION
    FORALL (a: finite_set[T]): is_finite[S](restrict[T, S, bool](a));


decl_type: tcc
theory: restrict_set_props
library: prelude
signature: nil
location: 28 0 32 999
body:
  % Judgement subtype TCC generated (at line 4321, column 4) for
      % restrict[T, S, bool](a)
      % expected type  (empty?[S])
  empty_restrict: OBLIGATION
    FORALL (a: (empty?[T])): empty?[S](restrict[T, S, bool](a));


decl_type: tcc
theory: real_props
library: prelude
signature: nil
location: 483 0 486 999
body:
  % Subtype TCC generated (at line 2608, column 54) for  w
      % expected type  nznum
  lt_div_lt_pos1_TCC1: OBLIGATION
    FORALL (px, pz: posreal, w, y: real): pz < w AND px <= y IMPLIES w /= 0;


decl_type: tcc
theory: real_props
library: prelude
signature: nil
location: 488 0 492 999
body:
  % Subtype TCC generated (at line 2610, column 56) for  w
      % expected type  nznum
  lt_div_lt_pos2_TCC1: OBLIGATION
    FORALL (nnx: nonneg_real, pz: posreal, w, y: real):
      pz <= w AND nnx < y IMPLIES w /= 0;


decl_type: tcc
theory: real_props
library: prelude
signature: nil
location: 494 0 497 999
body:
  % Subtype TCC generated (at line 2616, column 54) for  z
      % expected type  nznum
  lt_div_lt_neg1_TCC1: OBLIGATION
    FORALL (nw, ny: negreal, x, z: real): z < nw AND x <= ny IMPLIES z /= 0;


decl_type: tcc
theory: real_props
library: prelude
signature: nil
location: 499 0 503 999
body:
  % Subtype TCC generated (at line 2618, column 56) for  z
      % expected type  nznum
  lt_div_lt_neg2_TCC1: OBLIGATION
    FORALL (npy: nonpos_real, nw: negreal, x, z: real):
      z <= nw AND x < npy IMPLIES z /= 0;


decl_type: tcc
theory: real_props
library: prelude
signature: nil
location: 505 0 509 999
body:
  % Subtype TCC generated (at line 2690, column 56) for  w
      % expected type  nznum
  le_div_le_pos_TCC1: OBLIGATION
    FORALL (nnx: nonneg_real, pz: posreal, w, y: real):
      pz <= w AND nnx <= y IMPLIES w /= 0;


decl_type: tcc
theory: real_props
library: prelude
signature: nil
location: 511 0 515 999
body:
  % Subtype TCC generated (at line 2694, column 56) for  z
      % expected type  nznum
  le_div_le_neg_TCC1: OBLIGATION
    FORALL (npy: nonpos_real, nw: negreal, x, z: real):
      z <= nw AND x <= npy IMPLIES z /= 0;


decl_type: tcc
theory: real_props
library: prelude
signature: nil
location: 517 0 520 999
body:
  % Subtype TCC generated (at line 2765, column 61) for  z
      % expected type  nznum
  gt_div_gt_pos1_TCC1: OBLIGATION
    FORALL (pw, py: posreal, x, z: real): z > pw AND x >= py IMPLIES z /= 0;


decl_type: tcc
theory: real_props
library: prelude
signature: nil
location: 522 0 526 999
body:
  % Subtype TCC generated (at line 2767, column 63) for  z
      % expected type  nznum
  gt_div_gt_pos2_TCC1: OBLIGATION
    FORALL (nny: nonneg_real, pw: posreal, x, z: real):
      z >= pw AND x > nny IMPLIES z /= 0;


decl_type: tcc
theory: real_props
library: prelude
signature: nil
location: 528 0 531 999
body:
  % Subtype TCC generated (at line 2773, column 61) for  w
      % expected type  nznum
  gt_div_gt_neg1_TCC1: OBLIGATION
    FORALL (nx, nz: negreal, w, y: real): nz > w AND nx >= y IMPLIES w /= 0;


decl_type: tcc
theory: real_props
library: prelude
signature: nil
location: 533 0 537 999
body:
  % Subtype TCC generated (at line 2775, column 63) for  w
      % expected type  nznum
  gt_div_gt_neg2_TCC1: OBLIGATION
    FORALL (npx: nonpos_real, nz: negreal, w, y: real):
      nz >= w AND npx > y IMPLIES w /= 0;


decl_type: tcc
theory: real_props
library: prelude
signature: nil
location: 539 0 543 999
body:
  % Subtype TCC generated (at line 2847, column 64) for  z
      % expected type  nznum
  ge_div_ge_pos_TCC1: OBLIGATION
    FORALL (nny: nonneg_real, pw: posreal, x, z: real):
      z >= pw AND x >= nny IMPLIES z /= 0;


decl_type: tcc
theory: real_props
library: prelude
signature: nil
location: 545 0 549 999
body:
  % Subtype TCC generated (at line 2851, column 64) for  w
      % expected type  nznum
  ge_div_ge_neg_TCC1: OBLIGATION
    FORALL (npx: nonpos_real, nz: negreal, w, y: real):
      nz >= w AND npx >= y IMPLIES w /= 0;


decl_type: tcc
theory: real_props
library: prelude
signature: nil
location: 551 0 553 999
body:
  % Judgement subtype TCC generated (at line 2913, column 4) for  <
      % expected type  (strict_total_order?[real])
  real_lt_is_strict_total_order: OBLIGATION strict_total_order?[real](<);


decl_type: tcc
theory: real_props
library: prelude
signature: nil
location: 555 0 557 999
body:
  % Judgement subtype TCC generated (at line 2915, column 36) for  <=
      % expected type  (total_order?[real])
  real_le_is_total_order: OBLIGATION total_order?[real](<=);


decl_type: tcc
theory: real_props
library: prelude
signature: nil
location: 559 0 561 999
body:
  % Judgement subtype TCC generated (at line 2918, column 4) for  >
      % expected type  (strict_total_order?[real])
  real_gt_is_strict_total_order: OBLIGATION strict_total_order?[real](>);


decl_type: tcc
theory: real_props
library: prelude
signature: nil
location: 563 0 565 999
body:
  % Judgement subtype TCC generated (at line 2920, column 36) for  >=
      % expected type  (total_order?[real])
  real_ge_is_total_order: OBLIGATION total_order?[real](>=);


decl_type: formula
theory: modulo_arithmetic
library: prelude
signature: nil
location: 58 2 60 45
body:
    rem_sum: LEMMA
       rem(b)(x) = rem(b)(y) AND rem(b)(z) = rem(b)(t) 
          IMPLIES rem(b)(x + z) = rem(b)(y + t)


decl_type: formula
theory: modulo_arithmetic
library: prelude
signature: nil
location: 67 2 69 45
body:
    rem_diff: LEMMA
       rem(b)(x) = rem(b)(y) AND rem(b)(z) = rem(b)(t)
          IMPLIES rem(b)(x - z) = rem(b)(y - t)


decl_type: formula
theory: modulo_arithmetic
library: prelude
signature: nil
location: 81 2 83 45
body:
    rem_prod: LEMMA
       rem(b)(x) = rem(b)(y) AND rem(b)(z) = rem(b)(t)
          IMPLIES rem(b)(x * z) = rem(b)(y * t)


decl_type: formula
theory: modulo_arithmetic
library: prelude
signature: nil
location: 117 2 119 76
body:
    rem_base: LEMMA
      FORALL b, x, i, n:
        rem(b)(x) = rem(b + n)(x + i) IFF divides(b + n, i - n * floor(x / b))


decl_type: formula
theory: modulo_arithmetic
library: prelude
signature: nil
location: 121 2 123 68
body:
    rem_sum_floor: LEMMA
      FORALL b, x, i:
        rem(b)(x + i) = rem(b)(x) + i - b * floor((rem(b)(x) + i) / b)


decl_type: formula
theory: modulo_arithmetic
library: prelude
signature: nil
location: 128 2 131 48
body:
    rem_add_one: LEMMA
      FORALL b, x:
        rem(b)(x + 1) = rem(b)(x) + 1 OR
         (rem(b)(x) = b - 1 AND rem(b)(x + 1) = 0)


decl_type: formula
theory: modulo_arithmetic
library: prelude
signature: nil
location: 133 2 135 63
body:
    rem_wrap: LEMMA
      FORALL b, x, (n: below(b)):
        rem(b)(x) < rem(b)(x + n) IFF rem(b)(x) < b - n AND n > 0


decl_type: formula
theory: modulo_arithmetic
library: prelude
signature: nil
location: 137 2 139 71
body:
    rem_wrap_eq: COROLLARY
      FORALL b, x, (n: below(b)):
        rem(b)(x) <= rem(b)(x + n) IFF rem(b)(x) < b - n OR divides(b, n)


decl_type: tcc
theory: modulo_arithmetic
library: prelude
signature: nil
location: 146 0 152 999
body:
  % Existence TCC generated (at line 3779, column 2) for
      % rem(b)(x): {r: mod(b) | EXISTS q: x = b * q + r}
  rem_TCC1: OBLIGATION
    EXISTS (x1:
              [b: posnat ->
                 [x: int -> {r: mod(b) | EXISTS q: x = r + b * q}]]):
      TRUE;


decl_type: tcc
theory: modulo_arithmetic
library: prelude
signature: nil
location: 154 0 160 999
body:
  % Existence TCC generated (at line 3874, column 2) for
      % ndiv(x, b): {q: int | x = b * q + rem(b)(x)}
  ndiv_TCC1: OBLIGATION
    EXISTS (x1:
              [d: [int, posnat] ->
                 {q: int | d`1 = rem(d`2)(d`1) + d`2 * q}]):
      TRUE;


decl_type: tcc
theory: modulo_arithmetic
library: prelude
signature: nil
location: 162 0 164 999
body:
  % Judgement subtype TCC generated (at line 3878, column 12) for  ndiv(n, b)
      % expected type  upto(n)
  ndiv_TCC2: OBLIGATION FORALL (b, n): ndiv(n, b) >= 0 AND ndiv(n, b) <= n;


decl_type: function
theory: bv_extend_defs
library: prelude
signature: [k: above(N) -> [bvec[N] -> bvec[k]]]
location: 39 2 40 43
body:
    zero_extend_lsend(k: above(N)): [bvec[N] -> bvec[k]] =
          (LAMBDA bv:  bv o fill[k-N](FALSE))


decl_type: tcc
theory: bv_extend_defs
library: prelude
signature: nil
location: 60 0 62 999
body:
  % Subtype TCC generated (at line 5846, column 24) for  k - N
      % expected type  nat
  zero_extend_TCC1: OBLIGATION FORALL (k: above(N)): k - N >= 0;


decl_type: tcc
theory: bv_extend_defs
library: prelude
signature: nil
location: 64 0 66 999
body:
  % Subtype TCC generated (at line 5855, column 34) for  (N - 1)
      % expected type  below[N]
  sign_extend_TCC1: OBLIGATION (N - 1) >= 0 AND (N - 1) < N;


decl_type: tcc
theory: bv_extend_defs
library: prelude
signature: nil
location: 68 0 70 999
body:
  % Subtype TCC generated (at line 5872, column 37) for  0
      % expected type  below[N]
  lsb_extend_TCC1: OBLIGATION 0 < N;


decl_type: judgement
theory: extend_order_props
library: prelude
signature: (irreflexive?[T])
location: 5 2 7 34
body:
    irreflexive_extend: JUDGEMENT
      extend[[T, T], [S, S], bool, FALSE](R: (irreflexive?[S]))
          HAS_TYPE (irreflexive?[T])


decl_type: judgement
theory: extend_order_props
library: prelude
signature: (symmetric?[T])
location: 9 2 11 32
body:
    symmetric_extend: JUDGEMENT
      extend[[T, T], [S, S], bool, FALSE](R: (symmetric?[S]))
          HAS_TYPE (symmetric?[T])


decl_type: judgement
theory: extend_order_props
library: prelude
signature: (antisymmetric?[T])
location: 13 2 15 36
body:
    antisymmetric_extend: JUDGEMENT
      extend[[T, T], [S, S], bool, FALSE](R: (antisymmetric?[S]))
          HAS_TYPE (antisymmetric?[T])


decl_type: judgement
theory: extend_order_props
library: prelude
signature: (transitive?[T])
location: 17 2 19 33
body:
    transitive_extend: JUDGEMENT
      extend[[T, T], [S, S], bool, FALSE](R: (transitive?[S]))
          HAS_TYPE (transitive?[T])


decl_type: judgement
theory: extend_order_props
library: prelude
signature: (strict_order?[T])
location: 21 2 23 35
body:
    strict_order_extend: JUDGEMENT
      extend[[T, T], [S, S], bool, FALSE](R: (strict_order?[S]))
          HAS_TYPE (strict_order?[T])


decl_type: tcc
theory: extend_order_props
library: prelude
signature: nil
location: 30 0 35 999
body:
  % Judgement subtype TCC generated (at line 670, column 4) for
      % extend[[T, T], [S, S], bool, FALSE](R)
      % expected type  (irreflexive?[T])
  irreflexive_extend: OBLIGATION
    FORALL (R: (irreflexive?[S])):
      irreflexive?[T](extend[[T, T], [S, S], bool, FALSE](R));


decl_type: tcc
theory: extend_order_props
library: prelude
signature: nil
location: 37 0 42 999
body:
  % Judgement subtype TCC generated (at line 674, column 4) for
      % extend[[T, T], [S, S], bool, FALSE](R)
      % expected type  (symmetric?[T])
  symmetric_extend: OBLIGATION
    FORALL (R: (symmetric?[S])):
      symmetric?[T](extend[[T, T], [S, S], bool, FALSE](R));


decl_type: tcc
theory: extend_order_props
library: prelude
signature: nil
location: 44 0 49 999
body:
  % Judgement subtype TCC generated (at line 678, column 4) for
      % extend[[T, T], [S, S], bool, FALSE](R)
      % expected type  (antisymmetric?[T])
  antisymmetric_extend: OBLIGATION
    FORALL (R: (antisymmetric?[S])):
      antisymmetric?[T](extend[[T, T], [S, S], bool, FALSE](R));


decl_type: tcc
theory: extend_order_props
library: prelude
signature: nil
location: 51 0 56 999
body:
  % Judgement subtype TCC generated (at line 682, column 4) for
      % extend[[T, T], [S, S], bool, FALSE](R)
      % expected type  (transitive?[T])
  transitive_extend: OBLIGATION
    FORALL (R: (transitive?[S])):
      transitive?[T](extend[[T, T], [S, S], bool, FALSE](R));


decl_type: tcc
theory: extend_order_props
library: prelude
signature: nil
location: 58 0 63 999
body:
  % Judgement subtype TCC generated (at line 686, column 4) for
      % extend[[T, T], [S, S], bool, FALSE](R)
      % expected type  (strict_order?[T])
  strict_order_extend: OBLIGATION
    FORALL (R: (strict_order?[S])):
      strict_order?[T](extend[[T, T], [S, S], bool, FALSE](R));


decl_type: function
theory: PartialFunctionDefinitions
library: prelude
signature: [SubsetPartialFunction -> LiftPartialFunction]
location: 25 2 26 69
body:
    SPartFun_to_LPartFun(g) : LiftPartialFunction =
      LAMBDA(x : X) : IF dom(g)(x) THEN up(fun(g)(x)) ELSE bottom ENDIF


decl_type: function
theory: PartialFunctionDefinitions
library: prelude
signature: [LiftPartialFunction -> SubsetPartialFunction]
location: 28 2 32 6
body:
    LPartFun_to_SPartFun(f) : SubsetPartialFunction =
      (# 
        dom := {x : X | up?(f(x))}, 
        fun := LAMBDA(y : {x : X | up?(f(x))}) : down(f(y))
      #)


decl_type: function
theory: PartialFunctionDefinitions
library: prelude
signature: [[X -> Y] -> SubsetPartialFunction]
location: 34 2 38 6
body:
    TotalFun_to_SPartFun(h): SubsetPartialFunction =
      (#
        dom := {x : X | TRUE},
        fun := h
      #)


decl_type: tcc
theory: PartialFunctionDefinitions
library: prelude
signature: nil
location: 58 0 61 999
body:
  % Subtype TCC generated (at line 6336, column 52) for  f(y)
      % expected type  (up?[Y])
  LPartFun_to_SPartFun_TCC1: OBLIGATION
    FORALL (f: LiftPartialFunction, y: {x: X | up?[Y](f(x))}): up?[Y](f(y));


decl_type: formula
theory: finite_sets
library: prelude
signature: nil
location: 34 2 35 60
body:
    is_finite_surj: LEMMA (EXISTS (N: nat), (f: [below[N] -> (s)]):
                              surjective?(f)) IFF is_finite(s) 


decl_type: formula
theory: finite_sets
library: prelude
signature: nil
location: 102 2 103 74
body:
    inj_Card    : LEMMA Card(S) = n IMPLIES 
                            (EXISTS (f : [(S) -> below[n]]) : injective?(f))


decl_type: formula
theory: finite_sets
library: prelude
signature: nil
location: 105 2 107 77
body:
    reduce_inj  : LEMMA (FORALL (f : [(S)->below[p]]) :
                            injective?(f) AND NOT surjective?(f) IMPLIES 
                                (EXISTS (g: [(S)->below[p-1]]): injective?(g)))


decl_type: formula
theory: finite_sets
library: prelude
signature: nil
location: 109 2 110 48
body:
    Card_injection: LEMMA (EXISTS (f : [(S)->below[n]]) : injective?(f)) 
                              IMPLIES Card(S) <= n


decl_type: formula
theory: finite_sets
library: prelude
signature: nil
location: 112 2 113 50
body:
    Card_surjection : LEMMA (EXISTS (f : [(S)->below[n]]) : surjective?(f)) 
                                IMPLIES n <= Card(S) 


decl_type: formula
theory: finite_sets
library: prelude
signature: nil
location: 118 2 119 68
body:
    Card_disj_union: THEOREM disjoint?(S,S2) IMPLIES 
                                Card(union(S,S2)) = Card(S) + Card(S2)


decl_type: formula
theory: finite_sets
library: prelude
signature: nil
location: 144 2 145 66
body:
    card_disj_union : THEOREM disjoint?(A,B) IMPLIES 
                                card(union(A,B)) = card(A) + card(B)


decl_type: formula
theory: finite_sets
library: prelude
signature: nil
location: 147 2 148 76
body:
    card_diff_subset: THEOREM subset?(A, B) IMPLIES 
                                    card(difference(B, A)) = card(B) - card(A)


decl_type: formula
theory: finite_sets
library: prelude
signature: nil
location: 152 2 153 75
body:
    card_plus       : THEOREM card(A) + card(B) = 
                                  card(union(A, B)) + card(intersection(A,B))  


decl_type: formula
theory: finite_sets
library: prelude
signature: nil
location: 155 2 156 70
body:
    card_union      : THEOREM card(union(A,B)) = card(A) + card(B) -
                                                 card(intersection(A,B))


decl_type: formula
theory: finite_sets
library: prelude
signature: nil
location: 158 2 159 80
body:
    card_add        : THEOREM card(add(x, S)) = card(S) 
                                                     + IF S(x) THEN 0 ELSE 1 ENDIF


decl_type: formula
theory: finite_sets
library: prelude
signature: nil
location: 162 2 163 80
body:
    card_remove     : THEOREM card(remove(x, S)) = card(S)
                                                     - IF S(x) THEN 1 ELSE 0 ENDIF


decl_type: formula
theory: finite_sets
library: prelude
signature: nil
location: 167 2 168 44
body:
    same_card_subset: THEOREM subset?(A, B) AND card(A) = card(B) 
                                 IMPLIES A = B


decl_type: formula
theory: finite_sets
library: prelude
signature: nil
location: 170 2 171 79
body:
    smaller_card_subset : THEOREM subset?(A, B) AND card(A) < card(B) IMPLIES
                                   (EXISTS x : member(x, B) AND NOT member(x, A))


decl_type: formula
theory: finite_sets
library: prelude
signature: nil
location: 177 2 178 73
body:
    card_2_has_2    : THEOREM card(S) >= 2 IMPLIES
                                (EXISTS (x,y: T): x /= y AND S(x) AND S(y))


decl_type: formula
theory: finite_sets
library: prelude
signature: nil
location: 180 2 181 64
body:
    card_intersection_le: THEOREM card(intersection(A,B)) <= card(A) AND
                                card(intersection(A,B)) <= card(B)


decl_type: formula
theory: finite_sets
library: prelude
signature: nil
location: 183 2 184 79
body:
    card_bij        : THEOREM card(S) = N
                               IFF (EXISTS (f: [(S) -> below[N]]): bijective?(f))


decl_type: formula
theory: finite_sets
library: prelude
signature: nil
location: 186 2 187 79
body:
    card_bij_inv    : THEOREM card(S) = N
                               IFF (EXISTS (f: [below[N] -> (S)]): bijective?(f))


decl_type: formula
theory: finite_sets
library: prelude
signature: nil
location: 189 2 190 53
body:
    bij_exists      : COROLLARY (EXISTS (f: [(S) -> below(card(S))]):
                                         bijective?(f))


decl_type: formula
theory: finite_sets
library: prelude
signature: nil
location: 197 2 198 30
body:
    bij_ibij: LEMMA FORALL (S: non_empty_finite_set, ii: below(card(S))):
        bij(S)(ibij(S)(ii)) = ii


decl_type: formula
theory: finite_sets
library: prelude
signature: nil
location: 203 2 204 62
body:
    is_finite_exists_N: LEMMA FORALL (g: [below[N] -> T]):
              is_finite({r: T | EXISTS (n: below[N]): r = g(n)})


decl_type: formula
theory: finite_sets
library: prelude
signature: nil
location: 213 2 214 51
body:
    finite_pred: LEMMA is_finite(fullset[T]) IMPLIES
                          is_finite[T]({x: T | P(x)})


decl_type: formula
theory: finite_sets
library: prelude
signature: nil
location: 219 2 221 65
body:
    card_implies: LEMMA is_finite(fullset[T]) AND
                        (FORALL (x: T): P1(x) IMPLIES P2(x)) 
               IMPLIES card({x: T | P1(x)}) <= card({x: T | P2(x)})


decl_type: formula
theory: finite_sets
library: prelude
signature: nil
location: 223 2 227 42
body:
    finite_induction: THEOREM
      FORALL (p: pred[set[T]]):
        (FORALL (n: nat), (S: set[T]):
           (EXISTS (f: [(S) -> below[n]]): injective?(f)) => p(S))
         => (FORALL (FS: finite_set): p(FS))


decl_type: function
theory: finite_sets
library: prelude
signature: [finite_set -> (nonempty?[nat])]
location: 97 2 98 69
body:
    inj_set(S): (nonempty?[nat]) = 
                   { n | EXISTS (f : [(S)->below[n]]) : injective?(f) }


decl_type: function
theory: finite_sets
library: prelude
signature:
  [S: non_empty_finite_set ->
  {f: [below(card(S)) -> (S)] | bijective?(f)}]

location: 194 2 195 22
body:
    ibij(S: non_empty_finite_set): {f:[below(card(S)) -> (S)] | bijective?(f)} =
         inverse(bij(S))


decl_type: tcc
theory: finite_sets
library: prelude
signature: nil
location: 234 0 236 999
body:
  % Subtype TCC generated (at line 4108, column 44) for  emptyset[T]
      % expected type  finite_set
  finite_set_TCC1: OBLIGATION is_finite(emptyset[T]);


decl_type: tcc
theory: finite_sets
library: prelude
signature: nil
location: 238 0 241 999
body:
  % Judgement subtype TCC generated (at line 4126, column 4) for  x
      % expected type  (nonempty?[T])
  nonempty_finite_is_nonempty: OBLIGATION
    FORALL (x: non_empty_finite_set): nonempty?[T](x);


decl_type: tcc
theory: finite_sets
library: prelude
signature: nil
location: 243 0 245 999
body:
  % Judgement subtype TCC generated (at line 4128, column 30) for  singleton(x)
      % expected type  finite_set
  finite_singleton: OBLIGATION FORALL (x): is_finite(singleton[T](x));


decl_type: tcc
theory: finite_sets
library: prelude
signature: nil
location: 247 0 249 999
body:
  % Judgement subtype TCC generated (at line 4130, column 26) for  union(A, B)
      % expected type  finite_set
  finite_union: OBLIGATION FORALL (A, B): is_finite(union[T](A, B));


decl_type: tcc
theory: finite_sets
library: prelude
signature: nil
location: 251 0 255 999
body:
  % Judgement subtype TCC generated (at line 4131, column 34) for
      % intersection(s, A)
      % expected type  finite_set
  finite_intersection1: OBLIGATION
    FORALL (A, s): is_finite(intersection[T](s, A));


decl_type: tcc
theory: finite_sets
library: prelude
signature: nil
location: 257 0 261 999
body:
  % Judgement subtype TCC generated (at line 4132, column 34) for
      % intersection(A, s)
      % expected type  finite_set
  finite_intersection2: OBLIGATION
    FORALL (A, s): is_finite(intersection[T](A, s));


decl_type: tcc
theory: finite_sets
library: prelude
signature: nil
location: 263 0 266 999
body:
  % Judgement subtype TCC generated (at line 4133, column 31) for
      % difference(A, s)
      % expected type  finite_set
  finite_difference: OBLIGATION FORALL (A, s): is_finite(difference[T](A, s));


decl_type: tcc
theory: finite_sets
library: prelude
signature: nil
location: 268 0 271 999
body:
  % Judgement subtype TCC generated (at line 4135, column 36) for  union(NA, B)
      % expected type  non_empty_finite_set
  nonempty_finite_union1: OBLIGATION
    FORALL (B, NA): NOT empty?[T](union[T](NA, B));


decl_type: tcc
theory: finite_sets
library: prelude
signature: nil
location: 273 0 276 999
body:
  % Judgement subtype TCC generated (at line 4137, column 36) for  union(A, NB)
      % expected type  non_empty_finite_set
  nonempty_finite_union2: OBLIGATION
    FORALL (A, NB): NOT empty?[T](union[T](A, NB));


decl_type: tcc
theory: finite_sets
library: prelude
signature: nil
location: 278 0 281 999
body:
  % Judgement subtype TCC generated (at line 4139, column 33) for  add(x, A)
      % expected type  non_empty_finite_set
  nonempty_add_finite: OBLIGATION
    FORALL (A, x): is_finite(add[T](x, A)) AND NOT empty?[T](add[T](x, A));


decl_type: tcc
theory: finite_sets
library: prelude
signature: nil
location: 283 0 285 999
body:
  % Judgement subtype TCC generated (at line 4141, column 27) for  remove(x, A)
      % expected type  finite_set
  finite_remove: OBLIGATION FORALL (A, x): is_finite(remove[T](x, A));


decl_type: tcc
theory: finite_sets
library: prelude
signature: nil
location: 287 0 289 999
body:
  % Judgement subtype TCC generated (at line 4143, column 25) for  rest(A)
      % expected type  finite_set
  finite_rest: OBLIGATION FORALL (A): is_finite(rest[T](A));


decl_type: tcc
theory: finite_sets
library: prelude
signature: nil
location: 291 0 293 999
body:
  % Judgement subtype TCC generated (at line 4145, column 29) for  emptyset
      % expected type  finite_set
  finite_emptyset: OBLIGATION is_finite(emptyset[T]);


decl_type: tcc
theory: finite_sets
library: prelude
signature: nil
location: 295 0 298 999
body:
  % Judgement subtype TCC generated (at line 4148, column 3) for  singleton(x)
      % expected type  non_empty_finite_set
  nonempty_singleton_finite: OBLIGATION
    FORALL (x): NOT empty?[T](singleton[T](x));


decl_type: tcc
theory: finite_sets
library: prelude
signature: nil
location: 300 0 306 999
body:
  % Subtype TCC generated (at line 4176, column 17) for
      % {n | EXISTS (f: [(S) -> below[n]]): injective?(f)}
      % expected type  (nonempty?[nat])
  inj_set_TCC1: OBLIGATION
    FORALL (S: finite_set):
      nonempty?[nat]
          ({n | EXISTS (f: [(S) -> below[n]]): injective?[(S), below[n]](f)});


decl_type: tcc
theory: finite_sets
library: prelude
signature: nil
location: 308 0 312 999
body:
  % Subtype TCC generated (at line 4185, column 54) for  p - 1
      % expected type  nat
  reduce_inj_TCC1: OBLIGATION
    FORALL (S: finite_set, p: posnat, f: [(S) -> below[p]]):
      injective?(f) AND NOT surjective?(f) IMPLIES p - 1 >= 0;


decl_type: tcc
theory: finite_sets
library: prelude
signature: nil
location: 314 0 317 999
body:
  % Existence TCC generated (at line 4200, column 2) for
      % card(S): {n: nat | n = Card(S)}
  card_TCC1: OBLIGATION
    EXISTS (x: [S: finite_set -> {n: nat | n = Card(S)}]): TRUE;


decl_type: tcc
theory: finite_sets
library: prelude
signature: nil
location: 319 0 326 999
body:
  % Existence TCC generated (at line 4270, column 2) for
      % bij(S: finite_set): {f: [(S) -> below(card(S))] | bijective?(f)}
  bij_TCC1: OBLIGATION
    EXISTS (x:
              [S: finite_set ->
                 {f: [(S) -> below(card(S))] |
                          bijective?[(S), below(card(S))](f)}]):
      TRUE;


decl_type: tcc
theory: finite_sets
library: prelude
signature: nil
location: 328 0 330 999
body:
  % Existence TCC generated (at line 4273, column 7) for  inverse
  ibij_TCC1: OBLIGATION
    FORALL (S: non_empty_finite_set): EXISTS (x: (S)): TRUE;


decl_type: tcc
theory: finite_sets
library: prelude
signature: nil
location: 332 0 337 999
body:
  % Subtype TCC generated (at line 4299, column 26) for  {x: T | P1(x)}
      % expected type  S: finite_set
  card_implies_TCC1: OBLIGATION
    FORALL (P1, P2: pred[T]):
      (FORALL (x: T): P1(x) IMPLIES P2(x)) AND is_finite(fullset[T]) IMPLIES
       is_finite({x: T | P1(x)});


decl_type: tcc
theory: finite_sets
library: prelude
signature: nil
location: 339 0 344 999
body:
  % Subtype TCC generated (at line 4299, column 50) for  {x: T | P2(x)}
      % expected type  S: finite_set
  card_implies_TCC2: OBLIGATION
    FORALL (P1, P2: pred[T]):
      (FORALL (x: T): P1(x) IMPLIES P2(x)) AND is_finite(fullset[T]) IMPLIES
       is_finite({x: T | P2(x)});


decl_type: function
theory: stdpvs
library: prelude
signature: [T -> string]
location: 13 2 16 42
body:
    pvs2str(t:T) : MACRO string =
      catch("cant-translate",     
            pvs2str_lisp(t),
            LAMBDA(e:Exception[void]):"<?>")


decl_type: tcc
theory: K_props
library: prelude
signature: nil
location: 10 0 14 999
body:
  % Judgement subtype TCC generated (at line 418, column 25) for
      % K_conversion[T1, T2](x)(y)
      % expected type  S
  K_preserves: OBLIGATION
    FORALL (x: S, y: T2): S_pred(K_conversion[T1, T2](x)(y));


decl_type: tcc
theory: K_props
library: prelude
signature: nil
location: 16 0 20 999
body:
  % Judgement subtype TCC generated (at line 419, column 26) for
      % K_conversion[T1, T2](x)
      % expected type  [T2 -> S]
  K_preserves1: OBLIGATION
    FORALL (x: S, x1: T2): S_pred(K_conversion[T1, T2](x)(x1));


decl_type: tcc
theory: divides
library: prelude
signature: nil
location: 106 0 108 999
body:
  % Judgement subtype TCC generated (at line 3680, column 27) for  n * m
      % expected type  (divides(n))
  mult_divides1: OBLIGATION FORALL (m, n): divides(n)(n * m);


decl_type: tcc
theory: divides
library: prelude
signature: nil
location: 110 0 112 999
body:
  % Judgement subtype TCC generated (at line 3681, column 27) for  n * m
      % expected type  (divides(m))
  mult_divides2: OBLIGATION FORALL (m, n): divides(m)(n * m);


decl_type: formula
theory: bv_nat
library: prelude
signature: nil
location: 34 2 35 61
body:
    bv2nat_rec_bound: LEMMA FORALL (n: upto(N), bv: bvec[N]): 
                                    bv2nat_rec(n, bv) < exp2(n)


decl_type: formula
theory: bv_nat
library: prelude
signature: nil
location: 45 2 47 68
body:
    bv2nat_inj_rec: LEMMA
        bv2nat_rec(n, bv1) = bv2nat_rec(n, bv2)
          <=>  (FORALL (m: below(N)): (m < n) IMPLIES bv1(m) = bv2(m))


decl_type: formula
theory: bv_nat
library: prelude
signature: nil
location: 49 2 50 66
body:
    bv2nat_surj_rec: LEMMA FORALL (y:below(exp2(n))): 
                                     EXISTS bv:bv2nat_rec(n, bv) = y


decl_type: formula
theory: bv_nat
library: prelude
signature: nil
location: 52 2 54 55
body:
    bv2nat_inj     : THEOREM % injective?(bv2nat)
                              (FORALL (x, y: bvec[N]): (bv2nat(x) = bv2nat(y) 
                                        IMPLIES (x = y)))


decl_type: formula
theory: bv_nat
library: prelude
signature: nil
location: 56 2 58 74
body:
    bv2nat_surj    : THEOREM % surjective?(bv2nat)
                                (FORALL (y: below(exp2(N))): 
                                       (EXISTS (x: bvec[N]): bv2nat(x) = y))


decl_type: formula
theory: bv_nat
library: prelude
signature: nil
location: 72 2 74 81
body:
    bv2nat_top_bit    : THEOREM N > 0 IMPLIES
                               IF bv2nat(bv) < exp2(N-1) THEN bv^(N-1) = FALSE
                                                         ELSE bv^(N-1) = TRUE ENDIF


decl_type: function
theory: bv_nat
library: prelude
signature: [[upto(N), bvec[N]] -> nat]
location: 26 2 30 13
body:
    bv2nat_rec(n: upto(N), bv:bvec[N]): RECURSIVE nat =
        IF n = 0 THEN 0
        ELSE exp2(n-1) * bv^(n-1) + bv2nat_rec(n - 1, bv)
        ENDIF
      MEASURE n


decl_type: tcc
theory: bv_nat
library: prelude
signature: nil
location: 97 0 100 999
body:
  % Subtype TCC generated (at line 5394, column 16) for  n - 1
      % expected type  nat
  bv2nat_rec_TCC1: OBLIGATION
    FORALL (n: upto(N)): NOT n = 0 IMPLIES n - 1 >= 0;


decl_type: tcc
theory: bv_nat
library: prelude
signature: nil
location: 102 0 105 999
body:
  % Subtype TCC generated (at line 5394, column 27) for  (n - 1)
      % expected type  below[N]
  bv2nat_rec_TCC2: OBLIGATION
    FORALL (n: upto(N)): NOT n = 0 IMPLIES (n - 1) >= 0 AND (n - 1) < N;


decl_type: tcc
theory: bv_nat
library: prelude
signature: nil
location: 107 0 110 999
body:
  % Subtype TCC generated (at line 5394, column 45) for  n - 1
      % expected type  upto(N)
  bv2nat_rec_TCC3: OBLIGATION
    FORALL (n: upto(N)): NOT n = 0 IMPLIES n - 1 >= 0 AND n - 1 <= N;


decl_type: tcc
theory: bv_nat
library: prelude
signature: nil
location: 112 0 115 999
body:
  % Termination TCC generated (at line 5394, column 34) for
      % bv2nat_rec(n - 1, bv)
  bv2nat_rec_TCC4: OBLIGATION
    FORALL (n: upto(N)): NOT n = 0 IMPLIES n - 1 < n;


decl_type: tcc
theory: bv_nat
library: prelude
signature: nil
location: 117 0 124 999
body:
  % Subtype TCC generated (at line 5394, column 11) for
      % exp2(n - 1) * b2n(bv ^ (n - 1)) + bv2nat_rec(n - 1, bv)
      % expected type  nat
  bv2nat_rec_TCC5: OBLIGATION
    FORALL (n: upto(N), v: [{z: [upto(N), bvec[N]] | z`1 < n} -> nat],
            bv: bvec[N]):
      NOT n = 0 IMPLIES
       exp2(n - 1) * b2n(^[N](bv, (n - 1))) + v(n - 1, bv) >= 0;


decl_type: tcc
theory: bv_nat
library: prelude
signature: nil
location: 126 0 128 999
body:
  % Subtype TCC generated (at line 5403, column 50) for  N
      % expected type  upto(N)
  bv2nat_TCC1: OBLIGATION N <= N;


decl_type: tcc
theory: bv_nat
library: prelude
signature: nil
location: 130 0 132 999
body:
  % Subtype TCC generated (at line 5403, column 39) for  bv2nat_rec(N, bv)
      % expected type  below(exp2(N))
  bv2nat_TCC2: OBLIGATION FORALL (bv: bvec[N]): bv2nat_rec(N, bv) < exp2(N);


decl_type: tcc
theory: bv_nat
library: prelude
signature: nil
location: 134 0 136 999
body:
  % Subtype TCC generated (at line 5439, column 50) for  N - 1
      % expected type  nat
  bv2nat_top_bit_TCC1: OBLIGATION N > 0 IMPLIES N - 1 >= 0;


decl_type: tcc
theory: bv_nat
library: prelude
signature: nil
location: 138 0 142 999
body:
  % Subtype TCC generated (at line 5439, column 64) for  (N - 1)
      % expected type  below[N]
  bv2nat_top_bit_TCC2: OBLIGATION
    FORALL (bv: bvec[N]):
      N > 0 AND bv2nat(bv) < exp2(N - 1) IMPLIES (N - 1) >= 0 AND (N - 1) < N;


decl_type: tcc
theory: bv_nat
library: prelude
signature: nil
location: 144 0 149 999
body:
  % Subtype TCC generated (at line 5440, column 64) for  (N - 1)
      % expected type  below[N]
  bv2nat_top_bit_TCC3: OBLIGATION
    FORALL (bv: bvec[N]):
      N > 0 AND NOT bv2nat(bv) < exp2(N - 1) IMPLIES
       (N - 1) >= 0 AND (N - 1) < N;


decl_type: tcc
theory: bv_nat
library: prelude
signature: nil
location: 151 0 153 999
body:
  % Subtype TCC generated (at line 5442, column 47) for  (N - 1)
      % expected type  below[N]
  bv2nat_topbit_TCC1: OBLIGATION N > 0 IMPLIES (N - 1) >= 0 AND (N - 1) < N;


decl_type: tcc
theory: bv_nat
library: prelude
signature: nil
location: 155 0 159 999
body:
  % Existence TCC generated (at line 5446, column 2) for
      % nat2bv(val: below(exp2(N))): {bv: bvec[N] | bv2nat(bv) = val}
  nat2bv_TCC1: OBLIGATION
    EXISTS (x: [val: below(exp2(N)) -> {bv: bvec[N] | bv2nat(bv) = val}]):
      TRUE;


decl_type: formula
theory: function_image
library: prelude
signature: nil
location: 13 2 14 50
body:
    fun_exists: LEMMA (EXISTS y: TRUE) OR (NOT EXISTS x: TRUE)
                            IMPLIES (EXISTS f: TRUE)


decl_type: formula
theory: function_image
library: prelude
signature: nil
location: 33 2 34 79
body:
    inverse_image_subset: LEMMA
      subset?(Y1, Y2) IMPLIES subset?(inverse_image(f, Y1), inverse_image(f, Y2))


decl_type: formula
theory: function_image
library: prelude
signature: nil
location: 39 2 41 53
body:
    image_intersection: LEMMA
      subset?(image(f, intersection(X1, X2)),
              intersection(image(f, X1), image(f, X2)))


decl_type: formula
theory: function_image
library: prelude
signature: nil
location: 43 2 45 57
body:
    inverse_image_union: LEMMA
      inverse_image(f, union(Y1, Y2))
        = union(inverse_image(f, Y1), inverse_image(f, Y2))


decl_type: formula
theory: function_image
library: prelude
signature: nil
location: 47 2 49 64
body:
    inverse_image_intersection: LEMMA
      inverse_image(f, intersection(Y1, Y2))
        = intersection(inverse_image(f, Y1), inverse_image(f, Y2))


decl_type: formula
theory: function_image
library: prelude
signature: nil
location: 51 2 52 69
body:
    inverse_image_complement: LEMMA
      inverse_image(f, complement(Y)) = complement(inverse_image(f, Y))


decl_type: function
theory: filters
library: prelude
signature: [[list[T], pred[T]] -> list[T]]
location: 17 2 22 21
body:
    filter(l, p): RECURSIVE list[T] =
      CASES l OF
        null: null,
        cons(x, y): IF p(x) THEN cons(x, filter(y, p)) ELSE filter(y, p) ENDIF
      ENDCASES
      MEASURE length(l)


decl_type: function
theory: filters
library: prelude
signature: [pred[T] -> [list[T] -> list[T]]]
location: 24 2 29 21
body:
    filter(p)(l): RECURSIVE list[T] =
      CASES l OF
        null: null,
        cons(x, y): IF p(x) THEN cons(x, filter(p)(y)) ELSE filter(p)(y) ENDIF
      ENDCASES
      MEASURE length(l)


decl_type: tcc
theory: filters
library: prelude
signature: nil
location: 35 0 38 999
body:
  % Termination TCC generated (at line 4862, column 39) for  filter(y, p)
  filter_TCC1: OBLIGATION
    FORALL (l: list[T], p: pred[T], x: T, y: list[T]):
      p(x) AND l = cons(x, y) IMPLIES length[T](y) < length[T](l);


decl_type: tcc
theory: filters
library: prelude
signature: nil
location: 40 0 43 999
body:
  % Termination TCC generated (at line 4862, column 58) for  filter(y, p)
  filter_TCC2: OBLIGATION
    FORALL (l: list[T], p: pred[T], x: T, y: list[T]):
      NOT p(x) AND l = cons(x, y) IMPLIES length[T](y) < length[T](l);


decl_type: function
theory: list2finseq
library: prelude
signature: [list[T] -> finseq[T]]
location: 9 2 11 58
body:
    list2finseq(l): finseq[T] =
      (# length := length(l),
         seq := (LAMBDA (x: below[length(l)]): nth(l, x)) #)


decl_type: function
theory: list2finseq
library: prelude
signature: [[fs: finseq[T], {n: nat | n <= length(fs)}] -> list[T]]
location: 13 2 19 13
body:
    finseq2list_rec(fs, (n: nat | n <= length(fs))): RECURSIVE list[T] =
      IF n = 0
         THEN null
         ELSE cons(fs`seq(length(fs) - n),
                   finseq2list_rec(fs, n-1))
      ENDIF
      MEASURE n


decl_type: tcc
theory: list2finseq
library: prelude
signature: nil
location: 30 0 34 999
body:
  % Subtype TCC generated (at line 4890, column 24) for  length(fs) - n
      % expected type  below[fs`length]
  finseq2list_rec_TCC1: OBLIGATION
    FORALL (fs: finseq[T], (n: nat | n <= length(fs))):
      NOT n = 0 IMPLIES length(fs) - n >= 0 AND length(fs) - n < fs`length;


decl_type: tcc
theory: list2finseq
library: prelude
signature: nil
location: 36 0 40 999
body:
  % Subtype TCC generated (at line 4891, column 37) for  n - 1
      % expected type  {n: nat | n <= length(fs)}
  finseq2list_rec_TCC2: OBLIGATION
    FORALL (fs: finseq[T], (n: nat | n <= length(fs))):
      NOT n = 0 IMPLIES n - 1 >= 0 AND n - 1 <= length(fs);


decl_type: tcc
theory: list2finseq
library: prelude
signature: nil
location: 42 0 46 999
body:
  % Termination TCC generated (at line 4891, column 17) for
      % finseq2list_rec(fs, n - 1)
  finseq2list_rec_TCC3: OBLIGATION
    FORALL (fs: finseq[T], (n: nat | n <= length(fs))):
      NOT n = 0 IMPLIES n - 1 < n;


decl_type: tcc
theory: list2finseq
library: prelude
signature: nil
location: 48 0 51 999
body:
  % Subtype TCC generated (at line 4895, column 49) for  length(fs)
      % expected type  {n: nat | n <= length(fs)}
  finseq2list_TCC1: OBLIGATION
    FORALL (fs: finseq[T]): length(fs) <= length(fs);


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 120 0 123 999
body:
  % Subtype TCC generated (at line 2343, column 20) for  -m
      % expected type  {n: nonneg_real | n >= m AND n >= -m}
  abs_TCC1: OBLIGATION
    FORALL (m: real): m < 0 IMPLIES -m >= 0 AND -m >= m AND -m >= -m;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 125 0 128 999
body:
  % Subtype TCC generated (at line 2343, column 28) for  m
      % expected type  {n: nonneg_real | n >= m AND n >= -m}
  abs_TCC2: OBLIGATION
    FORALL (m: real): NOT m < 0 IMPLIES m >= 0 AND m >= m AND m >= -m;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 130 0 133 999
body:
  % Judgement subtype TCC generated (at line 2345, column 32) for  abs(x)
      % expected type  {y: posreal | y >= x}
  nonzero_abs_is_pos: OBLIGATION
    FORALL (x: nzreal): abs(x) > 0 AND abs(x) >= x;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 135 0 138 999
body:
  % Judgement subtype TCC generated (at line 2346, column 31) for  abs(q)
      % expected type  {r: nonneg_rat | r >= q}
  rat_abs_is_nonneg: OBLIGATION
    FORALL (q: rat): rational_pred(abs(q)) AND abs(q) >= 0 AND abs(q) >= q;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 140 0 142 999
body:
  % Judgement subtype TCC generated (at line 2347, column 30) for  abs(q)
      % expected type  {r: posrat | r >= q}
  nzrat_abs_is_pos: OBLIGATION FORALL (q: nzrat): abs(q) > 0 AND abs(q) >= q;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 144 0 147 999
body:
  % Judgement subtype TCC generated (at line 2348, column 31) for  abs(i)
      % expected type  {j: nonneg_int | j >= i}
  int_abs_is_nonneg: OBLIGATION
    FORALL (i: int): abs(i) >= i AND abs(i) >= 0 AND integer_pred(abs(i));


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 149 0 151 999
body:
  % Judgement subtype TCC generated (at line 2349, column 30) for  abs(i)
      % expected type  {j: posint | j >= i}
  nzint_abs_is_pos: OBLIGATION FORALL (i: nzint): abs(i) > 0 AND abs(i) >= i;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 153 0 156 999
body:
  % Subtype TCC generated (at line 2352, column 20) for  n
      % expected type  {p: real | p >= m AND p >= n}
  max_TCC1: OBLIGATION
    FORALL (m: real, n: real): m < n IMPLIES n >= m AND n >= n;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 158 0 161 999
body:
  % Subtype TCC generated (at line 2352, column 27) for  m
      % expected type  {p: real | p >= m AND p >= n}
  max_TCC2: OBLIGATION
    FORALL (m: real, n: real): NOT m < n IMPLIES m >= m AND m >= n;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 163 0 166 999
body:
  % Subtype TCC generated (at line 2355, column 20) for  n
      % expected type  {p: real | p <= m AND p <= n}
  min_TCC1: OBLIGATION
    FORALL (m: real, n: real): m > n IMPLIES n <= m AND n <= n;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 168 0 171 999
body:
  % Subtype TCC generated (at line 2355, column 27) for  m
      % expected type  {p: real | p <= m AND p <= n}
  min_TCC2: OBLIGATION
    FORALL (m: real, n: real): NOT m > n IMPLIES m <= m AND m <= n;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 173 0 177 999
body:
  % Judgement subtype TCC generated (at line 2360, column 4) for  max(x, y)
      % expected type  {z: nzreal | z >= x AND z >= y}
  nzreal_max: OBLIGATION
    FORALL (x, y: nzreal):
      max(x, y) /= 0 AND max(x, y) >= x AND max(x, y) >= y;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 179 0 183 999
body:
  % Judgement subtype TCC generated (at line 2362, column 4) for  min(x, y)
      % expected type  {z: nzreal | z <= x AND z <= y}
  nzreal_min: OBLIGATION
    FORALL (x, y: nzreal):
      min(x, y) /= 0 AND min(x, y) <= x AND min(x, y) <= y;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 185 0 189 999
body:
  % Judgement subtype TCC generated (at line 2365, column 4) for  max(x, y)
      % expected type  {z: nonneg_real | z >= x AND z >= y}
  nonneg_real_max: OBLIGATION
    FORALL (x, y: nonneg_real):
      max(x, y) >= 0 AND max(x, y) >= x AND max(x, y) >= y;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 191 0 195 999
body:
  % Judgement subtype TCC generated (at line 2367, column 4) for  min(x, y)
      % expected type  {z: nonneg_real | z <= x AND z <= y}
  nonneg_real_min: OBLIGATION
    FORALL (x, y: nonneg_real):
      min(x, y) >= 0 AND min(x, y) <= x AND min(x, y) <= y;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 197 0 201 999
body:
  % Judgement subtype TCC generated (at line 2370, column 4) for  max(x, y)
      % expected type  {z: posreal | z >= x AND z >= y}
  posreal_max: OBLIGATION
    FORALL (x, y: posreal):
      (max(x, y) >= x AND max(x, y) >= y) AND max(x, y) > 0;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 203 0 207 999
body:
  % Judgement subtype TCC generated (at line 2372, column 4) for  min(x, y)
      % expected type  {z: posreal | z <= x AND z <= y}
  posreal_min: OBLIGATION
    FORALL (x, y: posreal):
      (min(x, y) <= x AND min(x, y) <= y) AND min(x, y) > 0;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 209 0 213 999
body:
  % Judgement subtype TCC generated (at line 2377, column 4) for  max(q, r)
      % expected type  {s: rat | s >= q AND s >= r}
  rat_max: OBLIGATION
    FORALL (q, r: rat):
      rational_pred(max(q, r)) AND max(q, r) >= q AND max(q, r) >= r;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 215 0 219 999
body:
  % Judgement subtype TCC generated (at line 2379, column 4) for  min(q, r)
      % expected type  {s: rat | s <= q AND s <= r}
  rat_min: OBLIGATION
    FORALL (q, r: rat):
      rational_pred(min(q, r)) AND min(q, r) <= q AND min(q, r) <= r;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 221 0 225 999
body:
  % Judgement subtype TCC generated (at line 2382, column 4) for  max(q, r)
      % expected type  {s: nzrat | s >= q AND s >= r}
  nzrat_max: OBLIGATION
    FORALL (q, r: nzrat):
      (max(q, r) >= q AND max(q, r) >= r) AND max(q, r) /= 0;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 227 0 231 999
body:
  % Judgement subtype TCC generated (at line 2384, column 4) for  min(q, r)
      % expected type  {s: nzrat | s <= q AND s <= r}
  nzrat_min: OBLIGATION
    FORALL (q, r: nzrat):
      (min(q, r) <= q AND min(q, r) <= r) AND min(q, r) /= 0;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 233 0 237 999
body:
  % Judgement subtype TCC generated (at line 2387, column 4) for  max(q, r)
      % expected type  {s: nonneg_rat | s >= q AND s >= r}
  nonneg_rat_max: OBLIGATION
    FORALL (q, r: nonneg_rat):
      (max(q, r) >= q AND max(q, r) >= r) AND max(q, r) >= 0;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 239 0 243 999
body:
  % Judgement subtype TCC generated (at line 2389, column 4) for  min(q, r)
      % expected type  {s: nonneg_rat | s <= q AND s <= r}
  nonneg_rat_min: OBLIGATION
    FORALL (q, r: nonneg_rat):
      (min(q, r) <= q AND min(q, r) <= r) AND min(q, r) >= 0;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 245 0 249 999
body:
  % Judgement subtype TCC generated (at line 2392, column 4) for  max(q, r)
      % expected type  {s: posrat | s >= q AND s >= r}
  posrat_max: OBLIGATION
    FORALL (q, r: posrat):
      max(q, r) > 0 AND max(q, r) >= q AND max(q, r) >= r;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 251 0 255 999
body:
  % Judgement subtype TCC generated (at line 2394, column 4) for  min(q, r)
      % expected type  {s: posrat | s <= q AND s <= r}
  posrat_min: OBLIGATION
    FORALL (q, r: posrat):
      min(q, r) > 0 AND min(q, r) <= q AND min(q, r) <= r;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 257 0 261 999
body:
  % Judgement subtype TCC generated (at line 2399, column 4) for  max(i, j)
      % expected type  {k: int | i <= k AND j <= k}
  int_max: OBLIGATION
    FORALL (i, j: int):
      integer_pred(max(i, j)) AND i <= max(i, j) AND j <= max(i, j);


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 263 0 267 999
body:
  % Judgement subtype TCC generated (at line 2401, column 4) for  min(i, j)
      % expected type  {k: int | k <= i AND k <= j}
  int_min: OBLIGATION
    FORALL (i, j: int):
      integer_pred(min(i, j)) AND min(i, j) <= i AND min(i, j) <= j;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 269 0 273 999
body:
  % Judgement subtype TCC generated (at line 2404, column 4) for  max(i, j)
      % expected type  {k: nzint | i <= k AND j <= k}
  nzint_max: OBLIGATION
    FORALL (i, j: nzint):
      (i <= max(i, j) AND j <= max(i, j)) AND max(i, j) /= 0;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 275 0 279 999
body:
  % Judgement subtype TCC generated (at line 2406, column 4) for  min(i, j)
      % expected type  {k: nzint | k <= i AND k <= j}
  nzint_min: OBLIGATION
    FORALL (i, j: nzint):
      (min(i, j) <= i AND min(i, j) <= j) AND min(i, j) /= 0;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 281 0 285 999
body:
  % Judgement subtype TCC generated (at line 2409, column 4) for  max(i, j)
      % expected type  {k: nat | i <= k AND j <= k}
  nat_max: OBLIGATION
    FORALL (i, j: nat):
      (i <= max(i, j) AND j <= max(i, j)) AND max(i, j) >= 0;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 287 0 291 999
body:
  % Judgement subtype TCC generated (at line 2411, column 4) for  min(i, j)
      % expected type  {k: nat | k <= i AND k <= j}
  nat_min: OBLIGATION
    FORALL (i, j: nat):
      (min(i, j) <= i AND min(i, j) <= j) AND min(i, j) >= 0;


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 293 0 297 999
body:
  % Judgement subtype TCC generated (at line 2414, column 4) for  max(i, j)
      % expected type  {k: posint | i <= k AND j <= k}
  posint_max: OBLIGATION
    FORALL (i, j: posint):
      max(i, j) > 0 AND i <= max(i, j) AND j <= max(i, j);


decl_type: tcc
theory: real_defs
library: prelude
signature: nil
location: 299 0 303 999
body:
  % Judgement subtype TCC generated (at line 2416, column 4) for  min(i, j)
      % expected type  {k: posint | k <= i AND k <= j}
  posint_min: OBLIGATION
    FORALL (i, j: posint):
      min(i, j) > 0 AND min(i, j) <= i AND min(i, j) <= j;


decl_type: formula
theory: bv_caret
library: prelude
signature: nil
location: 47 2 48 58
body:
    bv_caret_elim : LEMMA (FORALL (i: below(N), j: upto(i), k: below(i-j+1)): 
                                 bv ^ (i, j) ^ k = bv^(j+k))


decl_type: function
theory: bv_caret
library: prelude
signature:
  [d: [bvec[N], [i1: below(N), upto(i1)]] ->
  bvec[1 - PROJ_2(d`2) + PROJ_1(d`2)]]

location: 25 3 27 26
body:
     ^(bv: bvec[N], sp:[i1: below(N), upto(i1)]): bvec[proj_1(sp)-proj_2(sp)+1] =
         (LAMBDA  (ii: below(proj_1(sp) - proj_2(sp) + 1)):
                    bv(ii + proj_2(sp))) ;


decl_type: tcc
theory: bv_caret
library: prelude
signature: nil
location: 55 0 59 999
body:
  % Subtype TCC generated (at line 5494, column 48) for
      % bvec[PROJ_1(sp) - PROJ_2(sp) + 1]
      % expected type  nat
  caret_TCC1: OBLIGATION
    FORALL (sp: [i1: below(N), upto(i1)]): 1 - PROJ_2(sp) + PROJ_1(sp) >= 0;


decl_type: tcc
theory: bv_caret
library: prelude
signature: nil
location: 61 0 66 999
body:
  % Subtype TCC generated (at line 5496, column 7) for  ii + PROJ_2(sp)
      % expected type  below(N)
  caret_TCC2: OBLIGATION
    FORALL (sp: [i1: below(N), upto(i1)],
            ii: below(PROJ_1(sp) - PROJ_2(sp) + 1)):
      ii + PROJ_2(sp) < N;


decl_type: tcc
theory: bv_caret
library: prelude
signature: nil
location: 68 0 70 999
body:
  % Subtype TCC generated (at line 5510, column 42) for  N - 1
      % expected type  below(N)
  bv_caret_all_TCC1: OBLIGATION N > 0 IMPLIES N - 1 >= 0 AND N - 1 < N;


decl_type: tcc
theory: bv_caret
library: prelude
signature: nil
location: 72 0 74 999
body:
  % Subtype TCC generated (at line 5510, column 47) for  0
      % expected type  upto(N - 1)
  bv_caret_all_TCC2: OBLIGATION N > 0 IMPLIES 0 <= N - 1;


decl_type: tcc
theory: bv_caret
library: prelude
signature: nil
location: 76 0 78 999
body:
  % Subtype TCC generated (at line 5514, column 53) for  i
      % expected type  upto(i)
  bv_caret_ii_0_TCC1: OBLIGATION FORALL (i: below(N)): i <= i;


decl_type: tcc
theory: bv_caret
library: prelude
signature: nil
location: 80 0 83 999
body:
  % Subtype TCC generated (at line 89, column 18) for  1 + i - j
      % expected type  nat
  bv_caret_elim_TCC1: OBLIGATION
    FORALL (i: below(N), j: upto(i), k: below(i - j + 1)): 1 + i - j >= 0;


decl_type: tcc
theory: bv_caret
library: prelude
signature: nil
location: 85 0 88 999
body:
  % Subtype TCC generated (at line 5517, column 53) for  (j + k)
      % expected type  below[N]
  bv_caret_elim_TCC2: OBLIGATION
    FORALL (i: below(N), j: upto(i), k: below(i - j + 1)): (j + k) < N;


decl_type: tcc
theory: real_types
library: prelude
signature: nil
location: 58 0 60 999
body:
  % Judgement subtype TCC generated (at line 2005, column 31) for  x
      % expected type  nzreal
  posreal_is_nzreal: OBLIGATION FORALL (x: posreal): x /= 0;


decl_type: tcc
theory: real_types
library: prelude
signature: nil
location: 62 0 64 999
body:
  % Judgement subtype TCC generated (at line 2006, column 31) for  x
      % expected type  nzreal
  negreal_is_nzreal: OBLIGATION FORALL (x: negreal): x /= 0;


decl_type: tcc
theory: real_types
library: prelude
signature: nil
location: 66 0 68 999
body:
  % Judgement subtype TCC generated (at line 2020, column 43) for  nzx * nzy
      % expected type  nzreal
  nzreal_times_nzreal_is_nzreal: OBLIGATION FORALL (nzx, nzy): nzx * nzy /= 0;


decl_type: tcc
theory: real_types
library: prelude
signature: nil
location: 70 0 72 999
body:
  % Judgement subtype TCC generated (at line 2021, column 43) for  nzx / nzy
      % expected type  nzreal
  nzreal_div_nzreal_is_nzreal: OBLIGATION FORALL (nzx, nzy): nzx / nzy /= 0;


decl_type: tcc
theory: real_types
library: prelude
signature: nil
location: 74 0 76 999
body:
  % Judgement subtype TCC generated (at line 2022, column 43) for  -nzx
      % expected type  nzreal
  minus_nzreal_is_nzreal: OBLIGATION FORALL (nzx): -nzx /= 0;


decl_type: tcc
theory: real_types
library: prelude
signature: nil
location: 78 0 80 999
body:
  % Judgement subtype TCC generated (at line 2024, column 43) for  nnx + nny
      % expected type  nnreal
  nnreal_plus_nnreal_is_nnreal: OBLIGATION FORALL (nnx, nny): nnx + nny >= 0;


decl_type: tcc
theory: real_types
library: prelude
signature: nil
location: 82 0 84 999
body:
  % Judgement subtype TCC generated (at line 2025, column 43) for  nnx * nny
      % expected type  nnreal
  nnreal_times_nnreal_is_nnreal: OBLIGATION FORALL (nnx, nny): nnx * nny >= 0;


decl_type: tcc
theory: real_types
library: prelude
signature: nil
location: 86 0 88 999
body:
  % Judgement subtype TCC generated (at line 2026, column 43) for  nnx / py
      % expected type  nnreal
  nnreal_div_posreal_is_nnreal: OBLIGATION FORALL (nnx, py): nnx / py >= 0;


decl_type: tcc
theory: real_types
library: prelude
signature: nil
location: 90 0 92 999
body:
  % Judgement subtype TCC generated (at line 2027, column 43) for  nnx / ny
      % expected type  npreal
  nnreal_div_negreal_is_npreal: OBLIGATION FORALL (nnx, ny): nnx / ny <= 0;


decl_type: tcc
theory: real_types
library: prelude
signature: nil
location: 94 0 96 999
body:
  % Judgement subtype TCC generated (at line 2029, column 43) for  npx + npy
      % expected type  npreal
  npreal_plus_npreal_is_npreal: OBLIGATION FORALL (npx, npy): npx + npy <= 0;


decl_type: tcc
theory: real_types
library: prelude
signature: nil
location: 98 0 100 999
body:
  % Judgement subtype TCC generated (at line 2030, column 43) for  npx * npy
      % expected type  nnreal
  npreal_times_npreal_is_nnreal: OBLIGATION FORALL (npx, npy): npx * npy >= 0;


decl_type: tcc
theory: real_types
library: prelude
signature: nil
location: 102 0 104 999
body:
  % Judgement subtype TCC generated (at line 2031, column 43) for  npx / py
      % expected type  npreal
  npreal_div_posreal_is_npreal: OBLIGATION FORALL (npx, py): npx / py <= 0;


decl_type: tcc
theory: real_types
library: prelude
signature: nil
location: 106 0 108 999
body:
  % Judgement subtype TCC generated (at line 2032, column 43) for  npx / ny
      % expected type  nnreal
  npreal_div_negreal_is_nnreal: OBLIGATION FORALL (npx, ny): npx / ny >= 0;


decl_type: tcc
theory: real_types
library: prelude
signature: nil
location: 110 0 112 999
body:
  % Judgement subtype TCC generated (at line 2034, column 46) for  px + nny
      % expected type  posreal
  posreal_plus_nnreal_is_posreal: OBLIGATION FORALL (nny, px): px + nny > 0;


decl_type: tcc
theory: real_types
library: prelude
signature: nil
location: 114 0 116 999
body:
  % Judgement subtype TCC generated (at line 2035, column 46) for  nnx + py
      % expected type  posreal
  nnreal_plus_posreal_is_posreal: OBLIGATION FORALL (nnx, py): nnx + py > 0;


decl_type: tcc
theory: real_types
library: prelude
signature: nil
location: 118 0 120 999
body:
  % Judgement subtype TCC generated (at line 2036, column 46) for  px * py
      % expected type  posreal
  posreal_times_posreal_is_posreal: OBLIGATION FORALL (px, py): px * py > 0;


decl_type: tcc
theory: real_types
library: prelude
signature: nil
location: 122 0 124 999
body:
  % Judgement subtype TCC generated (at line 2037, column 46) for  px / py
      % expected type  posreal
  posreal_div_posreal_is_posreal: OBLIGATION FORALL (px, py): px / py > 0;


decl_type: tcc
theory: real_types
library: prelude
signature: nil
location: 126 0 128 999
body:
  % Judgement subtype TCC generated (at line 2039, column 46) for  nx + ny
      % expected type  negreal
  negreal_plus_negreal_is_negreal: OBLIGATION FORALL (nx, ny): nx + ny < 0;


decl_type: tcc
theory: real_types
library: prelude
signature: nil
location: 130 0 132 999
body:
  % Judgement subtype TCC generated (at line 2040, column 46) for  nx * ny
      % expected type  posreal
  negreal_times_negreal_is_posreal: OBLIGATION FORALL (nx, ny): nx * ny > 0;


decl_type: tcc
theory: real_types
library: prelude
signature: nil
location: 134 0 136 999
body:
  % Judgement subtype TCC generated (at line 2041, column 46) for  nx / ny
      % expected type  posreal
  negreal_div_negreal_is_posreal: OBLIGATION FORALL (nx, ny): nx / ny > 0;


decl_type: formula
theory: relations
library: prelude
signature: nil
location: 46 0 50 999
body:
  TC_weak_induction: AXIOM
    FORALL (R, P: [[T, T] -> boolean]):
      (FORALL (x, y):
         R(x, y) OR (EXISTS z: P(x, z) AND P(z, y)) IMPLIES P(x, y))
       IMPLIES (FORALL (x, y): TC(R)(x, y) IMPLIES P(x, y));


decl_type: formula
theory: relations
library: prelude
signature: nil
location: 52 0 58 999
body:
  TC_induction: AXIOM
    FORALL (R, P: [[T, T] -> boolean]):
      (FORALL (x, y):
         R(x, y) OR
          (EXISTS z: (TC(R)(x, z) AND P(x, z)) AND TC(R)(z, y) AND P(z, y))
          IMPLIES P(x, y))
       IMPLIES (FORALL (x, y): TC(R)(x, y) IMPLIES P(x, y));


decl_type: tcc
theory: relations
library: prelude
signature: nil
location: 60 0 62 999
body:
  % Judgement subtype TCC generated (at line 471, column 33) for  x
      % expected type  (reflexive?)
  equiv_is_reflexive: OBLIGATION FORALL (x: (equivalence?)): reflexive?(x);


decl_type: tcc
theory: relations
library: prelude
signature: nil
location: 64 0 66 999
body:
  % Judgement subtype TCC generated (at line 472, column 33) for  x
      % expected type  (symmetric?)
  equiv_is_symmetric: OBLIGATION FORALL (x: (equivalence?)): symmetric?(x);


decl_type: tcc
theory: relations
library: prelude
signature: nil
location: 68 0 70 999
body:
  % Judgement subtype TCC generated (at line 473, column 33) for  x
      % expected type  (transitive?)
  equiv_is_transitive: OBLIGATION FORALL (x: (equivalence?)): transitive?(x);


decl_type: tcc
theory: ctlops
library: prelude
signature: nil
location: 32 0 37 999
body:
  % Subtype TCC generated (at line 5095, column 27) for
      % LAMBDA Q: (LAMBDA (s: state): f(s) AND EX(N, Q)(s))
      % expected type  (monotonic?[state])
  EG_TCC1: OBLIGATION
    FORALL (N: [[state, state] -> bool], f: pred[state]):
      monotonic?[state](LAMBDA Q: LAMBDA (s: state): f(s) AND EX(N, Q)(s));


decl_type: tcc
theory: ctlops
library: prelude
signature: nil
location: 39 0 47 999
body:
  % Subtype TCC generated (at line 5097, column 29) for
      % LAMBDA Q:
      %   (LAMBDA (s1: state):
      %      g(s1) OR (LAMBDA (s: state): f(s) AND EX(N, Q)(s))(s1))
      % expected type  (monotonic?[state])
  EU_TCC1: OBLIGATION
    FORALL (N: [[state, state] -> bool], f: pred[state], g: pred[state]):
      monotonic?[state]
          (LAMBDA Q: LAMBDA (s1: state): g(s1) OR f(s1) AND EX(N, Q)(s1));


decl_type: formula
theory: nat_fun_props
library: prelude
signature: nil
location: 12 2 13 67
body:
    injection_n_to_m: THEOREM
          (EXISTS (f: [below(n) -> below(m)]): injective?(f)) IMPLIES n <= m


decl_type: formula
theory: nat_fun_props
library: prelude
signature: nil
location: 15 2 16 63
body:
    injection_n_to_m_var: THEOREM
          (EXISTS (f: [below(n) -> below(m)]): injective?(f)) IFF n <= m


decl_type: formula
theory: nat_fun_props
library: prelude
signature: nil
location: 18 2 19 68
body:
    surjection_n_to_m: THEOREM
          (EXISTS (f: [below(n) -> below(m)]): surjective?(f)) IMPLIES m <= n


decl_type: formula
theory: nat_fun_props
library: prelude
signature: nil
location: 21 2 23 44
body:
    surjection_n_to_m_var: THEOREM
          (EXISTS (f: [below(n) -> below(m)]): surjective?(f)) IFF 
              (m > 0 AND m <= n) OR (m = 0 AND n = 0)


decl_type: formula
theory: nat_fun_props
library: prelude
signature: nil
location: 39 2 40 69
body:
    surj_equiv_inj: THEOREM
          FORALL (f: [below(n) -> below(n)]): surjective?(f) IFF injective?(f)


decl_type: formula
theory: nat_fun_props
library: prelude
signature: nil
location: 42 2 43 68
body:
    inj_equiv_bij: THEOREM
          FORALL (f: [below(n) -> below(n)]): bijective?(f) IFF injective?(f)


decl_type: formula
theory: nat_fun_props
library: prelude
signature: nil
location: 45 2 46 69
body:
    surj_equiv_bij: THEOREM
          FORALL (f: [below(n) -> below(n)]): bijective?(f) IFF surjective?(f)


decl_type: formula
theory: nat_fun_props
library: prelude
signature: nil
location: 49 2 50 67
body:
    surj_equiv_inj2: THEOREM
          FORALL (f: [upto(n) -> upto(n)]): surjective?(f) IFF injective?(f)


decl_type: formula
theory: nat_fun_props
library: prelude
signature: nil
location: 55 2 56 67
body:
    surj_equiv_bij2: THEOREM
          FORALL (f: [upto(n) -> upto(n)]): bijective?(f) IFF surjective?(f)


decl_type: formula
theory: function_inverse
library: prelude
signature: nil
location: 22 2 24 41
body:
    surjective_inverse: LEMMA
      FORALL (f:(surjective?[D, R])):
         inverse(f)(y) = x IMPLIES y = f(x)


decl_type: formula
theory: function_inverse
library: prelude
signature: nil
location: 30 2 32 41
body:
    injective_inverse: LEMMA
      FORALL (f:(injective?[D, R])):
         y = f(x) IMPLIES inverse(f)(y) = x


decl_type: judgement
theory: function_inverse
library: prelude
signature: (bijective?[R, D])
location: 19 2 20 59
body:
    bijective_inverse_is_bijective: JUDGEMENT
      inverse(f:(bijective?[D,R])) HAS_TYPE (bijective?[R,D])


decl_type: tcc
theory: function_inverse
library: prelude
signature: nil
location: 79 0 82 999
body:
  % Judgement subtype TCC generated (at line 1298, column 4) for  inverse(f)(y)
      % expected type  {x: D | f(x) = y}
  unique_bijective_inverse: OBLIGATION
    FORALL (f: (bijective?[D, R]), y): f(inverse(f)(y)) = y;


decl_type: tcc
theory: function_inverse
library: prelude
signature: nil
location: 84 0 87 999
body:
  % Judgement subtype TCC generated (at line 1301, column 4) for  inverse(f)
      % expected type  (bijective?[R, D])
  bijective_inverse_is_bijective: OBLIGATION
    FORALL (f: (bijective?[D, R])): bijective?[R, D](inverse(f));


decl_type: tcc
theory: function_inverse
library: prelude
signature: nil
location: 89 0 92 999
body:
  % Judgement subtype TCC generated (at line 1339, column 4) for  inverse(f)
      % expected type  (surjective?[R, D])
  inv_inj_is_surj: OBLIGATION
    FORALL (f: (injective?[D, R])): surjective?[R, D](inverse(f));


decl_type: tcc
theory: function_inverse
library: prelude
signature: nil
location: 94 0 97 999
body:
  % Judgement subtype TCC generated (at line 1341, column 4) for  inverse(f)
      % expected type  (injective?[R, D])
  inv_surj_is_inj: OBLIGATION
    FORALL (f: (surjective?[D, R])): injective?[R, D](inverse(f));


decl_type: formula
theory: if_props
library: prelude
signature: nil
location: 12 2 15 49
body:
    lift_if2: LEMMA
      IF (IF a THEN b ELSE c ENDIF) THEN x ELSE y ENDIF
       = IF a THEN (IF b THEN x ELSE y ENDIF)
              ELSE (IF c THEN x ELSE y ENDIF) ENDIF


decl_type: formula
theory: list_adt
library: prelude
signature: nil
location: 20 2 22 64
body:
    list_ord_defaxiom: AXIOM
      list_ord(null) = 0 AND
       (FORALL (car: T, cdr: list): list_ord(cons(car, cdr)) = 1);


decl_type: formula
theory: list_adt
library: prelude
signature: nil
location: 27 2 29 29
body:
    list_null_extensionality: AXIOM
      FORALL (null?_var: (null?), null?_var2: (null?)):
        null?_var = null?_var2;


decl_type: formula
theory: list_adt
library: prelude
signature: nil
location: 31 2 34 38
body:
    list_cons_extensionality: AXIOM
      FORALL (cons?_var: (cons?), cons?_var2: (cons?)):
        car(cons?_var) = car(cons?_var2) AND cdr(cons?_var) = cdr(cons?_var2)
         IMPLIES cons?_var = cons?_var2;


decl_type: formula
theory: list_adt
library: prelude
signature: nil
location: 36 2 38 55
body:
    list_cons_eta: AXIOM
      FORALL (cons?_var: (cons?)):
        cons(car(cons?_var), cdr(cons?_var)) = cons?_var;


decl_type: formula
theory: list_adt
library: prelude
signature: nil
location: 40 2 42 50
body:
    list_car_cons: AXIOM
      FORALL (cons1_var: T, cons2_var: list):
        car(cons(cons1_var, cons2_var)) = cons1_var;


decl_type: formula
theory: list_adt
library: prelude
signature: nil
location: 44 2 46 50
body:
    list_cdr_cons: AXIOM
      FORALL (cons1_var: T, cons2_var: list):
        cdr(cons(cons1_var, cons2_var)) = cons2_var;


decl_type: formula
theory: list_adt
library: prelude
signature: nil
location: 51 2 56 54
body:
    list_induction: AXIOM
      FORALL (p: [list -> boolean]):
        (p(null) AND
          (FORALL (cons1_var: T, cons2_var: list):
             p(cons2_var) IMPLIES p(cons(cons1_var, cons2_var))))
         IMPLIES (FORALL (list_var: list): p(list_var));


decl_type: function
theory: list_adt
library: prelude
signature: [list -> upto(1)]
location: 24 2 25 64
body:
    ord(x: list): [list -> upto(1)] =
        CASES x OF null: 0, cons(cons1_var, cons2_var): 1 ENDCASES


decl_type: function
theory: list_adt
library: prelude
signature: [PRED[T] -> [list -> boolean]]
location: 58 2 62 17
body:
    every(p: PRED[T])(a: list):  boolean =
        CASES a
          OF null: TRUE,
             cons(cons1_var, cons2_var): p(cons1_var) AND every(p)(cons2_var)
          ENDCASES;


decl_type: function
theory: list_adt
library: prelude
signature: [[PRED[T], list] -> boolean]
location: 64 2 68 17
body:
    every(p: PRED[T], a: list):  boolean =
        CASES a
          OF null: TRUE,
             cons(cons1_var, cons2_var): p(cons1_var) AND every(p, cons2_var)
          ENDCASES;


decl_type: function
theory: list_adt
library: prelude
signature: [PRED[T] -> [list -> boolean]]
location: 70 2 74 17
body:
    some(p: PRED[T])(a: list):  boolean =
        CASES a
          OF null: FALSE,
             cons(cons1_var, cons2_var): p(cons1_var) OR some(p)(cons2_var)
          ENDCASES;


decl_type: function
theory: list_adt
library: prelude
signature: [[PRED[T], list] -> boolean]
location: 76 2 80 17
body:
    some(p: PRED[T], a: list):  boolean =
        CASES a
          OF null: FALSE,
             cons(cons1_var, cons2_var): p(cons1_var) OR some(p, cons2_var)
          ENDCASES;


decl_type: function
theory: list_adt
library: prelude
signature: [[list, list] -> boolean]
location: 82 2 86 18
body:
    subterm(x: list, y: list):  boolean =
        x = y OR
         CASES y
           OF null: FALSE, cons(cons1_var, cons2_var): subterm(x, cons2_var)
           ENDCASES;


decl_type: function
theory: list_adt
library: prelude
signature: [[nat, [[T, nat] -> nat]] -> [list -> nat]]
location: 97 2 105 21
body:
    reduce_nat(null?_fun: nat, cons?_fun: [[T, nat] -> nat]):
          [list -> nat] =
        LAMBDA (list_adtvar: list):
          LET red: [list -> nat] = reduce_nat(null?_fun, cons?_fun) IN
            CASES list_adtvar
              OF null: null?_fun,
                 cons(cons1_var, cons2_var):
                   cons?_fun(cons1_var, red(cons2_var))
              ENDCASES;


decl_type: function
theory: list_adt
library: prelude
signature: [[[list -> nat], [[T, nat, list] -> nat]] -> [list -> nat]]
location: 107 2 116 21
body:
    REDUCE_nat(null?_fun: [list -> nat],
               cons?_fun: [[T, nat, list] -> nat]):
          [list -> nat] =
        LAMBDA (list_adtvar: list):
          LET red: [list -> nat] = REDUCE_nat(null?_fun, cons?_fun) IN
            CASES list_adtvar
              OF null: null?_fun(list_adtvar),
                 cons(cons1_var, cons2_var):
                   cons?_fun(cons1_var, red(cons2_var), list_adtvar)
              ENDCASES;


decl_type: function
theory: list_adt
library: prelude
signature: [[ordinal, [[T, ordinal] -> ordinal]] -> [list -> ordinal]]
location: 118 2 128 21
body:
    reduce_ordinal(null?_fun: ordinal,
                   cons?_fun: [[T, ordinal] -> ordinal]):
          [list -> ordinal] =
        LAMBDA (list_adtvar: list):
          LET red: [list -> ordinal] = reduce_ordinal(null?_fun, cons?_fun)
            IN
            CASES list_adtvar
              OF null: null?_fun,
                 cons(cons1_var, cons2_var):
                   cons?_fun(cons1_var, red(cons2_var))
              ENDCASES;


decl_type: function
theory: list_adt
library: prelude
signature:
  [[[list -> ordinal], [[T, ordinal, list] -> ordinal]] ->
  [list -> ordinal]]

location: 130 2 140 21
body:
    REDUCE_ordinal(null?_fun: [list -> ordinal],
                   cons?_fun: [[T, ordinal, list] -> ordinal]):
          [list -> ordinal] =
        LAMBDA (list_adtvar: list):
          LET red: [list -> ordinal] = REDUCE_ordinal(null?_fun, cons?_fun)
            IN
            CASES list_adtvar
              OF null: null?_fun(list_adtvar),
                 cons(cons1_var, cons2_var):
                   cons?_fun(cons1_var, red(cons2_var), list_adtvar)
              ENDCASES;


decl_type: constant
theory: list_adt
library: prelude
signature: (strict_well_founded?[list])
location: 88 2 93 19
body:
    <<:  (strict_well_founded?[list]) =
        LAMBDA (x, y: list):
          CASES y
            OF null: FALSE,
               cons(cons1_var, cons2_var): x = cons2_var OR x << cons2_var
            ENDCASES;


decl_type: function
theory: list_adt_map
library: prelude
signature: [[T -> T1] -> [list[T] -> list[T1]]]
location: 6 2 11 17
body:
    map(f: [T -> T1])(a: list[T]):  list[T1] =
        CASES a
          OF null: null,
             cons(cons1_var, cons2_var):
               cons(f(cons1_var), map(f)(cons2_var))
          ENDCASES;


decl_type: function
theory: list_adt_map
library: prelude
signature: [[[T -> T1], list[T]] -> list[T1]]
location: 13 2 18 17
body:
    map(f: [T -> T1], a: list[T]):  list[T1] =
        CASES a
          OF null: null,
             cons(cons1_var, cons2_var):
               cons(f(cons1_var), map(f, cons2_var))
          ENDCASES;


decl_type: function
theory: list_adt_map
library: prelude
signature: [[[T, T1] -> boolean] -> [[list[T], list[T1]] -> boolean]]
location: 20 2 23 68
body:
    every(R: [[T, T1] -> boolean])(x: list[T], y: list[T1]):  boolean =
        null?(x) AND null?(y) OR
         cons?(x) AND
          cons?(y) AND R(car(x), car(y)) AND every(R)(cdr(x), cdr(y));


decl_type: function
theory: list_adt_reduce
library: prelude
signature: [[range, [[T, range] -> range]] -> [list[T] -> range]]
location: 6 2 14 21
body:
    reduce(null?_fun: range, cons?_fun: [[T, range] -> range]):
          [list[T] -> range] =
        LAMBDA (list_adtvar: list[T]):
          LET red: [list[T] -> range] = reduce(null?_fun, cons?_fun) IN
            CASES list_adtvar
              OF null: null?_fun,
                 cons(cons1_var, cons2_var):
                   cons?_fun(cons1_var, red(cons2_var))
              ENDCASES;


decl_type: function
theory: list_adt_reduce
library: prelude
signature:
  [[[list[T] -> range], [[T, range, list[T]] -> range]] ->
  [list[T] -> range]]

location: 16 2 25 21
body:
    REDUCE(null?_fun: [list[T] -> range],
           cons?_fun: [[T, range, list[T]] -> range]):
          [list[T] -> range] =
        LAMBDA (list_adtvar: list[T]):
          LET red: [list[T] -> range] = REDUCE(null?_fun, cons?_fun) IN
            CASES list_adtvar
              OF null: null?_fun(list_adtvar),
                 cons(cons1_var, cons2_var):
                   cons?_fun(cons1_var, red(cons2_var), list_adtvar)
              ENDCASES;


decl_type: formula
theory: character_adt
library: prelude
signature: nil
location: 22 2 24 72
body:
    character_char_extensionality: AXIOM
      FORALL (char?_var: (char?), char?_var2: (char?)):
        code(char?_var) = code(char?_var2) IMPLIES char?_var = char?_var2;


decl_type: formula
theory: character_adt
library: prelude
signature: nil
location: 35 2 38 61
body:
    character_induction: AXIOM
      FORALL (p: [character -> boolean]):
        (FORALL (char1_var: below[256]): p(char(char1_var))) IMPLIES
         (FORALL (character_var: character): p(character_var));


decl_type: function
theory: character_adt
library: prelude
signature: [[below[256] -> nat] -> [character -> nat]]
location: 46 2 50 21
body:
    reduce_nat(char?_fun: [below[256] -> nat]):  [character -> nat] =
        LAMBDA (character_adtvar: character):
          LET red: [character -> nat] = reduce_nat(char?_fun) IN
            CASES character_adtvar OF char(char1_var): char?_fun(char1_var)
              ENDCASES;


decl_type: function
theory: character_adt
library: prelude
signature: [[[below[256], character] -> nat] -> [character -> nat]]
location: 52 2 58 21
body:
    REDUCE_nat(char?_fun: [[below[256], character] -> nat]):
          [character -> nat] =
        LAMBDA (character_adtvar: character):
          LET red: [character -> nat] = REDUCE_nat(char?_fun) IN
            CASES character_adtvar
              OF char(char1_var): char?_fun(char1_var, character_adtvar)
              ENDCASES;


decl_type: function
theory: character_adt
library: prelude
signature: [[below[256] -> ordinal] -> [character -> ordinal]]
location: 60 2 65 21
body:
    reduce_ordinal(char?_fun: [below[256] -> ordinal]):
          [character -> ordinal] =
        LAMBDA (character_adtvar: character):
          LET red: [character -> ordinal] = reduce_ordinal(char?_fun) IN
            CASES character_adtvar OF char(char1_var): char?_fun(char1_var)
              ENDCASES;


decl_type: function
theory: character_adt
library: prelude
signature:
  [[[below[256], character] -> ordinal] ->
  [character -> ordinal]]

location: 67 2 73 21
body:
    REDUCE_ordinal(char?_fun: [[below[256], character] -> ordinal]):
          [character -> ordinal] =
        LAMBDA (character_adtvar: character):
          LET red: [character -> ordinal] = REDUCE_ordinal(char?_fun) IN
            CASES character_adtvar
              OF char(char1_var): char?_fun(char1_var, character_adtvar)
              ENDCASES;


decl_type: function
theory: character_adt_reduce
library: prelude
signature: [[below[256] -> range] -> [character -> range]]
location: 6 2 10 21
body:
    reduce(char?_fun: [below[256] -> range]):  [character -> range] =
        LAMBDA (character_adtvar: character):
          LET red: [character -> range] = reduce(char?_fun) IN
            CASES character_adtvar OF char(char1_var): char?_fun(char1_var)
              ENDCASES;


decl_type: function
theory: character_adt_reduce
library: prelude
signature: [[[below[256], character] -> range] -> [character -> range]]
location: 12 2 18 21
body:
    REDUCE(char?_fun: [[below[256], character] -> range]):
          [character -> range] =
        LAMBDA (character_adtvar: character):
          LET red: [character -> range] = REDUCE(char?_fun) IN
            CASES character_adtvar
              OF char(char1_var): char?_fun(char1_var, character_adtvar)
              ENDCASES;


decl_type: formula
theory: ordstruct_adt
library: prelude
signature: nil
location: 22 2 25 49
body:
    ordstruct_ord_defaxiom: AXIOM
      ordstruct_ord(zero) = 0 AND
       (FORALL (coef: posnat, exp: ordstruct, rest: ordstruct):
          ordstruct_ord(add(coef, exp, rest)) = 1);


decl_type: formula
theory: ordstruct_adt
library: prelude
signature: nil
location: 30 2 32 29
body:
    ordstruct_zero_extensionality: AXIOM
      FORALL (zero?_var: (zero?), zero?_var2: (zero?)):
        zero?_var = zero?_var2;


decl_type: formula
theory: ordstruct_adt
library: prelude
signature: nil
location: 34 2 39 44
body:
    ordstruct_add_extensionality: AXIOM
      FORALL (nonzero?_var: (nonzero?), nonzero?_var2: (nonzero?)):
        coef(nonzero?_var) = coef(nonzero?_var2) AND
         exp(nonzero?_var) = exp(nonzero?_var2) AND
          rest(nonzero?_var) = rest(nonzero?_var2)
         IMPLIES nonzero?_var = nonzero?_var2;


decl_type: formula
theory: ordstruct_adt
library: prelude
signature: nil
location: 41 2 44 20
body:
    ordstruct_add_eta: AXIOM
      FORALL (nonzero?_var: (nonzero?)):
        add(coef(nonzero?_var), exp(nonzero?_var), rest(nonzero?_var)) =
         nonzero?_var;


decl_type: formula
theory: ordstruct_adt
library: prelude
signature: nil
location: 46 2 48 57
body:
    ordstruct_coef_add: AXIOM
      FORALL (add1_var: posnat, add2_var: ordstruct, add3_var: ordstruct):
        coef(add(add1_var, add2_var, add3_var)) = add1_var;


decl_type: formula
theory: ordstruct_adt
library: prelude
signature: nil
location: 50 2 52 56
body:
    ordstruct_exp_add: AXIOM
      FORALL (add1_var: posnat, add2_var: ordstruct, add3_var: ordstruct):
        exp(add(add1_var, add2_var, add3_var)) = add2_var;


decl_type: formula
theory: ordstruct_adt
library: prelude
signature: nil
location: 54 2 56 57
body:
    ordstruct_rest_add: AXIOM
      FORALL (add1_var: posnat, add2_var: ordstruct, add3_var: ordstruct):
        rest(add(add1_var, add2_var, add3_var)) = add3_var;


decl_type: formula
theory: ordstruct_adt
library: prelude
signature: nil
location: 58 2 60 54
body:
    ordstruct_inclusive: AXIOM
      FORALL (ordstruct_var: ordstruct):
        zero?(ordstruct_var) OR nonzero?(ordstruct_var);


decl_type: formula
theory: ordstruct_adt
library: prelude
signature: nil
location: 62 2 69 69
body:
    ordstruct_induction: AXIOM
      FORALL (p: [ordstruct -> boolean]):
        (p(zero) AND
          (FORALL (add1_var: posnat, add2_var: ordstruct,
                   add3_var: ordstruct):
             p(add2_var) AND p(add3_var) IMPLIES
              p(add(add1_var, add2_var, add3_var))))
         IMPLIES (FORALL (ordstruct_var: ordstruct): p(ordstruct_var));


decl_type: function
theory: ordstruct_adt
library: prelude
signature: [ordstruct -> upto(1)]
location: 27 2 28 71
body:
    ord(x: ordstruct): [ordstruct -> upto(1)] =
        CASES x OF zero: 0, add(add1_var, add2_var, add3_var): 1 ENDCASES


decl_type: function
theory: ordstruct_adt
library: prelude
signature: [[ordstruct, ordstruct] -> boolean]
location: 71 2 77 18
body:
    subterm(x: ordstruct, y: ordstruct):  boolean =
        x = y OR
         CASES y
           OF zero: FALSE,
              add(add1_var, add2_var, add3_var):
                subterm(x, add2_var) OR subterm(x, add3_var)
           ENDCASES;


decl_type: function
theory: ordstruct_adt
library: prelude
signature: [[nat, [[posnat, nat, nat] -> nat]] -> [ordstruct -> nat]]
location: 90 2 99 21
body:
    reduce_nat(zero?_fun: nat, nonzero?_fun: [[posnat, nat, nat] -> nat]):
          [ordstruct -> nat] =
        LAMBDA (ordstruct_adtvar: ordstruct):
          LET red: [ordstruct -> nat] = reduce_nat(zero?_fun, nonzero?_fun)
            IN
            CASES ordstruct_adtvar
              OF zero: zero?_fun,
                 add(add1_var, add2_var, add3_var):
                   nonzero?_fun(add1_var, red(add2_var), red(add3_var))
              ENDCASES;


decl_type: function
theory: ordstruct_adt
library: prelude
signature:
  [[[ordstruct -> nat], [[posnat, nat, nat, ordstruct] -> nat]] ->
  [ordstruct -> nat]]

location: 101 2 112 21
body:
    REDUCE_nat(zero?_fun: [ordstruct -> nat],
               nonzero?_fun: [[posnat, nat, nat, ordstruct] -> nat]):
          [ordstruct -> nat] =
        LAMBDA (ordstruct_adtvar: ordstruct):
          LET red: [ordstruct -> nat] = REDUCE_nat(zero?_fun, nonzero?_fun)
            IN
            CASES ordstruct_adtvar
              OF zero: zero?_fun(ordstruct_adtvar),
                 add(add1_var, add2_var, add3_var):
                   nonzero?_fun(add1_var, red(add2_var), red(add3_var),
                                ordstruct_adtvar)
              ENDCASES;


decl_type: constant
theory: ordstruct_adt
library: prelude
signature: (strict_well_founded?[ordstruct])
location: 79 2 86 19
body:
    <<:  (strict_well_founded?[ordstruct]) =
        LAMBDA (x, y: ordstruct):
          CASES y
            OF zero: FALSE,
               add(add1_var, add2_var, add3_var):
                 (x = add2_var OR x << add2_var) OR
                  x = add3_var OR x << add3_var
            ENDCASES;


decl_type: function
theory: ordstruct_adt_reduce
library: prelude
signature:
  [[range, [[posnat, range, range] -> range]] ->
  [ordstruct -> range]]

location: 6 2 15 21
body:
    reduce(zero?_fun: range,
           nonzero?_fun: [[posnat, range, range] -> range]):
          [ordstruct -> range] =
        LAMBDA (ordstruct_adtvar: ordstruct):
          LET red: [ordstruct -> range] = reduce(zero?_fun, nonzero?_fun) IN
            CASES ordstruct_adtvar
              OF zero: zero?_fun,
                 add(add1_var, add2_var, add3_var):
                   nonzero?_fun(add1_var, red(add2_var), red(add3_var))
              ENDCASES;


decl_type: function
theory: ordstruct_adt_reduce
library: prelude
location: 17 2 27 21
signature:
  [[[ordstruct -> range],
         [[posnat, range, range, ordstruct] -> range]] ->
          [ordstruct -> range]]

body:
    REDUCE(zero?_fun: [ordstruct -> range],
           nonzero?_fun: [[posnat, range, range, ordstruct] -> range]):
          [ordstruct -> range] =
        LAMBDA (ordstruct_adtvar: ordstruct):
          LET red: [ordstruct -> range] = REDUCE(zero?_fun, nonzero?_fun) IN
            CASES ordstruct_adtvar
              OF zero: zero?_fun(ordstruct_adtvar),
                 add(add1_var, add2_var, add3_var):
                   nonzero?_fun(add1_var, red(add2_var), red(add3_var),
                                ordstruct_adtvar)
              ENDCASES;


decl_type: formula
theory: lift_adt
library: prelude
signature: nil
location: 24 2 26 33
body:
    lift_bottom_extensionality: AXIOM
      FORALL (bottom?_var: (bottom?), bottom?_var2: (bottom?)):
        bottom?_var = bottom?_var2;


decl_type: formula
theory: lift_adt
library: prelude
signature: nil
location: 28 2 30 64
body:
    lift_up_extensionality: AXIOM
      FORALL (up?_var: (up?), up?_var2: (up?)):
        down(up?_var) = down(up?_var2) IMPLIES up?_var = up?_var2;


decl_type: formula
theory: lift_adt
library: prelude
signature: nil
location: 39 2 42 46
body:
    lift_induction: AXIOM
      FORALL (p: [lift -> boolean]):
        (p(bottom) AND (FORALL (up1_var: T): p(up(up1_var)))) IMPLIES
         (FORALL (lift_var: lift): p(lift_var));


decl_type: function
theory: lift_adt
library: prelude
signature: [PRED[T] -> [lift -> boolean]]
location: 44 2 45 64
body:
    every(p: PRED[T])(a: lift):  boolean =
        CASES a OF bottom: TRUE, up(up1_var): p(up1_var) ENDCASES;


decl_type: function
theory: lift_adt
library: prelude
signature: [[PRED[T], lift] -> boolean]
location: 47 2 48 64
body:
    every(p: PRED[T], a: lift):  boolean =
        CASES a OF bottom: TRUE, up(up1_var): p(up1_var) ENDCASES;


decl_type: function
theory: lift_adt
library: prelude
signature: [PRED[T] -> [lift -> boolean]]
location: 50 2 51 65
body:
    some(p: PRED[T])(a: lift):  boolean =
        CASES a OF bottom: FALSE, up(up1_var): p(up1_var) ENDCASES;


decl_type: function
theory: lift_adt
library: prelude
signature: [[PRED[T], lift] -> boolean]
location: 53 2 54 65
body:
    some(p: PRED[T], a: lift):  boolean =
        CASES a OF bottom: FALSE, up(up1_var): p(up1_var) ENDCASES;


decl_type: function
theory: lift_adt
library: prelude
signature: [[nat, [T -> nat]] -> [lift -> nat]]
location: 62 2 67 21
body:
    reduce_nat(bottom?_fun: nat, up?_fun: [T -> nat]):  [lift -> nat] =
        LAMBDA (lift_adtvar: lift):
          LET red: [lift -> nat] = reduce_nat(bottom?_fun, up?_fun) IN
            CASES lift_adtvar
              OF bottom: bottom?_fun, up(up1_var): up?_fun(up1_var)
              ENDCASES;


decl_type: function
theory: lift_adt
library: prelude
signature: [[[lift -> nat], [[T, lift] -> nat]] -> [lift -> nat]]
location: 69 2 76 21
body:
    REDUCE_nat(bottom?_fun: [lift -> nat], up?_fun: [[T, lift] -> nat]):
          [lift -> nat] =
        LAMBDA (lift_adtvar: lift):
          LET red: [lift -> nat] = REDUCE_nat(bottom?_fun, up?_fun) IN
            CASES lift_adtvar
              OF bottom: bottom?_fun(lift_adtvar),
                 up(up1_var): up?_fun(up1_var, lift_adtvar)
              ENDCASES;


decl_type: function
theory: lift_adt
library: prelude
signature: [[ordinal, [T -> ordinal]] -> [lift -> ordinal]]
location: 78 2 85 21
body:
    reduce_ordinal(bottom?_fun: ordinal, up?_fun: [T -> ordinal]):
          [lift -> ordinal] =
        LAMBDA (lift_adtvar: lift):
          LET red: [lift -> ordinal] = reduce_ordinal(bottom?_fun, up?_fun)
            IN
            CASES lift_adtvar
              OF bottom: bottom?_fun, up(up1_var): up?_fun(up1_var)
              ENDCASES;


decl_type: function
theory: lift_adt
library: prelude
signature:
  [[[lift -> ordinal], [[T, lift] -> ordinal]] ->
  [lift -> ordinal]]

location: 87 2 96 21
body:
    REDUCE_ordinal(bottom?_fun: [lift -> ordinal],
                   up?_fun: [[T, lift] -> ordinal]):
          [lift -> ordinal] =
        LAMBDA (lift_adtvar: lift):
          LET red: [lift -> ordinal] = REDUCE_ordinal(bottom?_fun, up?_fun)
            IN
            CASES lift_adtvar
              OF bottom: bottom?_fun(lift_adtvar),
                 up(up1_var): up?_fun(up1_var, lift_adtvar)
              ENDCASES;


decl_type: function
theory: lift_adt_map
library: prelude
signature: [[T -> T1] -> [lift[T] -> lift[T1]]]
location: 6 2 7 70
body:
    map(f: [T -> T1])(a: lift[T]):  lift[T1] =
        CASES a OF bottom: bottom, up(up1_var): up(f(up1_var)) ENDCASES;


decl_type: function
theory: lift_adt_map
library: prelude
signature: [[[T -> T1], lift[T]] -> lift[T1]]
location: 9 2 10 70
body:
    map(f: [T -> T1], a: lift[T]):  lift[T1] =
        CASES a OF bottom: bottom, up(up1_var): up(f(up1_var)) ENDCASES;


decl_type: function
theory: lift_adt_map
library: prelude
signature: [[[T, T1] -> boolean] -> [[lift[T], lift[T1]] -> boolean]]
location: 12 2 14 49
body:
    every(R: [[T, T1] -> boolean])(x: lift[T], y: lift[T1]):  boolean =
        bottom?(x) AND bottom?(y) OR
         up?(x) AND up?(y) AND R(down(x), down(y));


decl_type: function
theory: lift_adt_reduce
library: prelude
signature: [[range, [T -> range]] -> [lift[T] -> range]]
location: 6 2 11 21
body:
    reduce(bottom?_fun: range, up?_fun: [T -> range]):  [lift[T] -> range] =
        LAMBDA (lift_adtvar: lift[T]):
          LET red: [lift[T] -> range] = reduce(bottom?_fun, up?_fun) IN
            CASES lift_adtvar
              OF bottom: bottom?_fun, up(up1_var): up?_fun(up1_var)
              ENDCASES;


decl_type: function
theory: lift_adt_reduce
library: prelude
signature:
  [[[lift[T] -> range], [[T, lift[T]] -> range]] ->
  [lift[T] -> range]]

location: 13 2 21 21
body:
    REDUCE(bottom?_fun: [lift[T] -> range],
           up?_fun: [[T, lift[T]] -> range]):
          [lift[T] -> range] =
        LAMBDA (lift_adtvar: lift[T]):
          LET red: [lift[T] -> range] = REDUCE(bottom?_fun, up?_fun) IN
            CASES lift_adtvar
              OF bottom: bottom?_fun(lift_adtvar),
                 up(up1_var): up?_fun(up1_var, lift_adtvar)
              ENDCASES;


decl_type: formula
theory: union_adt
library: prelude
signature: nil
location: 20 2 22 53
body:
    union_ord_defaxiom: AXIOM
      (FORALL (left: T1): union_ord(inl(left)) = 0) AND
       (FORALL (right: T2): union_ord(inr(right)) = 1);


decl_type: formula
theory: union_adt
library: prelude
signature: nil
location: 27 2 29 68
body:
    union_inl_extensionality: AXIOM
      FORALL (inl?_var: (inl?), inl?_var2: (inl?)):
        left(inl?_var) = left(inl?_var2) IMPLIES inl?_var = inl?_var2;


decl_type: formula
theory: union_adt
library: prelude
signature: nil
location: 34 2 36 70
body:
    union_inr_extensionality: AXIOM
      FORALL (inr?_var: (inr?), inr?_var2: (inr?)):
        right(inr?_var) = right(inr?_var2) IMPLIES inr?_var = inr?_var2;


decl_type: formula
theory: union_adt
library: prelude
signature: nil
location: 50 2 54 57
body:
    union_induction: AXIOM
      FORALL (p: [union -> boolean]):
        ((FORALL (inl1_var: T1): p(inl(inl1_var))) AND
          (FORALL (inr1_var: T2): p(inr(inr1_var))))
         IMPLIES (FORALL (union_var: union): p(union_var));


decl_type: function
theory: union_adt
library: prelude
signature: [[PRED[T1], PRED[T2]] -> [union -> boolean]]
location: 56 2 58 17
body:
    every(p1: PRED[T1], p2: PRED[T2])(a: union):  boolean =
        CASES a OF inl(inl1_var): p1(inl1_var), inr(inr1_var): p2(inr1_var)
          ENDCASES;


decl_type: function
theory: union_adt
library: prelude
signature: [[PRED[T1], PRED[T2], union] -> boolean]
location: 60 2 62 17
body:
    every(p1: PRED[T1], p2: PRED[T2], a: union):  boolean =
        CASES a OF inl(inl1_var): p1(inl1_var), inr(inr1_var): p2(inr1_var)
          ENDCASES;


decl_type: function
theory: union_adt
library: prelude
signature: [[PRED[T1], PRED[T2]] -> [union -> boolean]]
location: 64 2 66 17
body:
    some(p1: PRED[T1], p2: PRED[T2])(a: union):  boolean =
        CASES a OF inl(inl1_var): p1(inl1_var), inr(inr1_var): p2(inr1_var)
          ENDCASES;


decl_type: function
theory: union_adt
library: prelude
signature: [[PRED[T1], PRED[T2], union] -> boolean]
location: 68 2 70 17
body:
    some(p1: PRED[T1], p2: PRED[T2], a: union):  boolean =
        CASES a OF inl(inl1_var): p1(inl1_var), inr(inr1_var): p2(inr1_var)
          ENDCASES;


decl_type: function
theory: union_adt
library: prelude
signature: [[[T1 -> nat], [T2 -> nat]] -> [union -> nat]]
location: 78 2 85 21
body:
    reduce_nat(inl?_fun: [T1 -> nat], inr?_fun: [T2 -> nat]):
          [union -> nat] =
        LAMBDA (union_adtvar: union):
          LET red: [union -> nat] = reduce_nat(inl?_fun, inr?_fun) IN
            CASES union_adtvar
              OF inl(inl1_var): inl?_fun(inl1_var),
                 inr(inr1_var): inr?_fun(inr1_var)
              ENDCASES;


decl_type: function
theory: union_adt
library: prelude
signature:
  [[[[T1, union] -> nat], [[T2, union] -> nat]] ->
  [union -> nat]]

location: 87 2 95 21
body:
    REDUCE_nat(inl?_fun: [[T1, union] -> nat],
               inr?_fun: [[T2, union] -> nat]):
          [union -> nat] =
        LAMBDA (union_adtvar: union):
          LET red: [union -> nat] = REDUCE_nat(inl?_fun, inr?_fun) IN
            CASES union_adtvar
              OF inl(inl1_var): inl?_fun(inl1_var, union_adtvar),
                 inr(inr1_var): inr?_fun(inr1_var, union_adtvar)
              ENDCASES;


decl_type: function
theory: union_adt
library: prelude
signature: [[[T1 -> ordinal], [T2 -> ordinal]] -> [union -> ordinal]]
location: 97 2 104 21
body:
    reduce_ordinal(inl?_fun: [T1 -> ordinal], inr?_fun: [T2 -> ordinal]):
          [union -> ordinal] =
        LAMBDA (union_adtvar: union):
          LET red: [union -> ordinal] = reduce_ordinal(inl?_fun, inr?_fun) IN
            CASES union_adtvar
              OF inl(inl1_var): inl?_fun(inl1_var),
                 inr(inr1_var): inr?_fun(inr1_var)
              ENDCASES;


decl_type: function
theory: union_adt
library: prelude
signature:
  [[[[T1, union] -> ordinal], [[T2, union] -> ordinal]] ->
  [union -> ordinal]]

location: 106 2 114 21
body:
    REDUCE_ordinal(inl?_fun: [[T1, union] -> ordinal],
                   inr?_fun: [[T2, union] -> ordinal]):
          [union -> ordinal] =
        LAMBDA (union_adtvar: union):
          LET red: [union -> ordinal] = REDUCE_ordinal(inl?_fun, inr?_fun) IN
            CASES union_adtvar
              OF inl(inl1_var): inl?_fun(inl1_var, union_adtvar),
                 inr(inr1_var): inr?_fun(inr1_var, union_adtvar)
              ENDCASES;


decl_type: function
theory: union_adt_map
library: prelude
signature:
  [[[T1 -> T11], [T2 -> T21]] ->
  [union[T1, T2] -> union[T11, T21]]]

location: 6 2 11 17
body:
    map(f1: [T1 -> T11], f2: [T2 -> T21])(a: union[T1, T2]):
          union[T11, T21] =
        CASES a
          OF inl(inl1_var): inl(f1(inl1_var)),
             inr(inr1_var): inr(f2(inr1_var))
          ENDCASES;


decl_type: function
theory: union_adt_map
library: prelude
signature: [[[T1 -> T11], [T2 -> T21], union[T1, T2]] -> union[T11, T21]]
location: 13 2 18 17
body:
    map(f1: [T1 -> T11], f2: [T2 -> T21], a: union[T1, T2]):
          union[T11, T21] =
        CASES a
          OF inl(inl1_var): inl(f1(inl1_var)),
             inr(inr1_var): inr(f2(inr1_var))
          ENDCASES;


decl_type: function
theory: union_adt_map
library: prelude
location: 20 2 24 54
signature:
  [[[[T1, T11] -> boolean], [[T2, T21] -> boolean]] ->
          [[union[T1, T2], union[T11, T21]] -> boolean]]

body:
    every(R1: [[T1, T11] -> boolean], R2: [[T2, T21] -> boolean])
         (x: union[T1, T2], y: union[T11, T21]):
          boolean =
        inl?(x) AND inl?(y) AND R1(left(x), left(y)) OR
         inr?(x) AND inr?(y) AND R2(right(x), right(y));


decl_type: function
theory: union_adt_reduce
library: prelude
signature: [[[T1 -> range], [T2 -> range]] -> [union[T1, T2] -> range]]
location: 6 2 13 21
body:
    reduce(inl?_fun: [T1 -> range], inr?_fun: [T2 -> range]):
          [union[T1, T2] -> range] =
        LAMBDA (union_adtvar: union[T1, T2]):
          LET red: [union[T1, T2] -> range] = reduce(inl?_fun, inr?_fun) IN
            CASES union_adtvar
              OF inl(inl1_var): inl?_fun(inl1_var),
                 inr(inr1_var): inr?_fun(inr1_var)
              ENDCASES;


decl_type: function
theory: union_adt_reduce
library: prelude
location: 15 2 23 21
signature:
  [[[[T1, union[T1, T2]] -> range],
         [[T2, union[T1, T2]] -> range]] ->
          [union[T1, T2] -> range]]

body:
    REDUCE(inl?_fun: [[T1, union[T1, T2]] -> range],
           inr?_fun: [[T2, union[T1, T2]] -> range]):
          [union[T1, T2] -> range] =
        LAMBDA (union_adtvar: union[T1, T2]):
          LET red: [union[T1, T2] -> range] = REDUCE(inl?_fun, inr?_fun) IN
            CASES union_adtvar
              OF inl(inl1_var): inl?_fun(inl1_var, union_adtvar),
                 inr(inr1_var): inr?_fun(inr1_var, union_adtvar)
              ENDCASES;


decl_type: formula
theory: sums
library: bitvectors
signature: nil
location: 40 2 41 50
body:
    sigma_mult:  THEOREM sigma(low, high, (LAMBDA n: x * F(n)))
                           = x * sigma(low, high, F)


decl_type: formula
theory: sums
library: bitvectors
signature: nil
location: 43 2 44 78
body:
    sigma_split: THEOREM m >= low AND high > m 
            IMPLIES sigma(low, high, F) = sigma(low, m, F) + sigma(m+1, high, F)


decl_type: formula
theory: sums
library: bitvectors
signature: nil
location: 51 2 52 69
body:
    sigma_restrict_eq: THEOREM restrict(F,low,high) = restrict(G,low,high) 
                          IMPLIES sigma(low,high,F) = sigma(low,high,G) 


decl_type: function
theory: sums
library: bitvectors
signature: [[nat, nat, [nat -> nat]] -> nat]
location: 22 2 27 15
body:
    sigma(low, high, F): RECURSIVE nat
        = IF low > high THEN 0
          ELSIF high = low THEN F(low) 
          ELSE  F(high) + sigma(low, high-1, F)
          ENDIF
     MEASURE high


decl_type: function
theory: sums
library: bitvectors
signature: [[[nat -> nat], nat, nat] -> [nat -> nat]]
location: 48 2 49 63
body:
    restrict(F, low, high): function[nat -> nat] = 
       (LAMBDA n: IF n < low OR n > high THEN 0 ELSE F(n) ENDIF )


decl_type: tcc
theory: sums
library: bitvectors
signature: nil
location: 59 0 63 999
body:
  % Subtype TCC generated (at line 25, column 35) for  high - 1
      % expected type  nat
  sigma_TCC1: OBLIGATION
    FORALL (low: nat, high: nat):
      NOT high = low AND NOT low > high IMPLIES high - 1 >= 0;


decl_type: tcc
theory: sums
library: bitvectors
signature: nil
location: 65 0 69 999
body:
  % Termination TCC generated (at line 25, column 24) for
      % sigma(low, high - 1, F)
  sigma_TCC2: OBLIGATION
    FORALL (low: nat, high: nat):
      NOT high = low AND NOT low > high IMPLIES high - 1 < high;


decl_type: formula
theory: bv_sum
library: bitvectors
signature: nil
location: 26 2 27 55
body:
    bv2nat_rec_as_sum: LEMMA bv2nat_rec(n+1,bv) = 
       sigma(0,n, extend((LAMBDA ii: exp2(ii) * bv(ii))))


decl_type: formula
theory: bv_sum
library: bitvectors
signature: nil
location: 29 2 30 72
body:
    bv2nat_as_sum: THEOREM bv2nat(bv) = IF N = 0 THEN 0
           ELSE sigma(0,N-1, extend((LAMBDA ii: exp2(ii) * bv(ii)))) ENDIF


decl_type: tcc
theory: bv_sum
library: bitvectors
signature: nil
location: 37 0 39 999
body:
  % Subtype TCC generated (at line 26, column 38) for  n + 1
      % expected type  upto(N)
  bv2nat_rec_as_sum_TCC1: OBLIGATION FORALL (n: below(N)): n + 1 <= N;


decl_type: tcc
theory: bv_sum
library: bitvectors
signature: nil
location: 41 0 43 999
body:
  % Subtype TCC generated (at line 30, column 22) for  N - 1
      % expected type  nat
  bv2nat_as_sum_TCC1: OBLIGATION NOT N = 0 IMPLIES N - 1 >= 0;


decl_type: formula
theory: bv_concat
library: bitvectors
signature: nil
location: 21 2 22 60
body:
    bvconcat_bot0: THEOREM FORALL (bvm:bvec[m], bvn:bvec[n]):
                                 m = 0 IMPLIES bvn o bvm = bvn 


decl_type: formula
theory: bv_concat
library: bitvectors
signature: nil
location: 24 2 25 60
body:
    bvconcat_top0: THEOREM FORALL (bvm:bvec[m], bvn:bvec[n]):
                                 n = 0 IMPLIES bvn o bvm = bvm


decl_type: formula
theory: bv_concat
library: bitvectors
signature: nil
location: 27 2 28 49
body:
    bv_concat_bot: THEOREM FORALL (bvm:bvec[m], bvn:bvec[n], i: below(m)): 
                              (bvn o bvm)^i = bvm^i


decl_type: formula
theory: bv_concat
library: bitvectors
signature: nil
location: 30 2 31 80
body:
    bv_concat_top: THEOREM FORALL (bvm:bvec[m], bvn:bvec[n]): 
                             j >= m AND j < n+m IMPLIES  (bvn o bvm)^j = bvn^(j-m)


decl_type: formula
theory: bv_concat
library: bitvectors
signature: nil
location: 34 2 35 66
body:
    bv_concat_assoc   : LEMMA FORALL (bvm:bvec[m], bvn:bvec[n], bvp:bvec[p]):
                               (bvm o bvn) o bvp = bvm o (bvn o bvp)


decl_type: formula
theory: bv_concat
library: bitvectors
signature: nil
location: 37 2 38 68
body:
    bv_concat_top_bit : LEMMA FORALL (N: posnat, bvn: bvec[N], bvm: bvec[m]):
                                       (bvn o bvm)^(N+m-1) = bvn^(N-1)


decl_type: tcc
theory: bv_concat
library: bitvectors
signature: nil
location: 48 0 52 999
body:
  % Subtype TCC generated (at line 22, column 57) for  bvn
      % expected type  bvec[m + n]
  bvconcat_bot0_TCC1: OBLIGATION
    FORALL (m, n: nat, bvn: bvec[n]):
      m = 0 IMPLIES (FORALL (x: nat): bvn(x) IMPLIES (x < n IFF x < m + n));


decl_type: tcc
theory: bv_concat
library: bitvectors
signature: nil
location: 54 0 58 999
body:
  % Subtype TCC generated (at line 25, column 57) for  bvm
      % expected type  bvec[m + n]
  bvconcat_top0_TCC1: OBLIGATION
    FORALL (m, n: nat, bvm: bvec[m]):
      n = 0 IMPLIES (FORALL (x: nat): bvm(x) IMPLIES (x < m IFF x < m + n));


decl_type: tcc
theory: bv_concat
library: bitvectors
signature: nil
location: 60 0 62 999
body:
  % Subtype TCC generated (at line 28, column 40) for  i
      % expected type  below[m + n]
  bv_concat_bot_TCC1: OBLIGATION FORALL (m, n: nat, i: below(m)): i < m + n;


decl_type: tcc
theory: bv_concat
library: bitvectors
signature: nil
location: 64 0 67 999
body:
  % Subtype TCC generated (at line 31, column 67) for  j
      % expected type  below[m + n]
  bv_concat_top_TCC1: OBLIGATION
    FORALL (j, m, n: nat): j >= m AND j < n + m IMPLIES j < m + n;


decl_type: tcc
theory: bv_concat
library: bitvectors
signature: nil
location: 69 0 73 999
body:
  % Subtype TCC generated (at line 31, column 76) for  (j - m)
      % expected type  below[n]
  bv_concat_top_TCC2: OBLIGATION
    FORALL (j, m, n: nat):
      j >= m AND j < n + m IMPLIES (j - m) >= 0 AND (j - m) < n;


decl_type: tcc
theory: bv_concat
library: bitvectors
signature: nil
location: 75 0 78 999
body:
  % Subtype TCC generated (at line 38, column 50) for  (N + m - 1)
      % expected type  below[N + m]
  bv_concat_top_bit_TCC1: OBLIGATION
    FORALL (m: nat, N: posnat): (N + m - 1) >= 0 AND (N + m - 1) < N + m;


decl_type: tcc
theory: bv_concat
library: bitvectors
signature: nil
location: 80 0 83 999
body:
  % Subtype TCC generated (at line 38, column 64) for  (N - 1)
      % expected type  below[N]
  bv_concat_top_bit_TCC2: OBLIGATION
    FORALL (N: posnat): (N - 1) >= 0 AND (N - 1) < N;


decl_type: formula
theory: bv_arith_concat
library: bitvectors
signature: nil
location: 14 2 15 66
body:
    not_over_concat    : LEMMA FORALL (a: bvec[m], b: bvec[n]):
                                   (NOT (a o b)) = (NOT a) o (NOT b)


decl_type: formula
theory: bv_arith_concat
library: bitvectors
signature: nil
location: 20 2 22 74
body:
    bv2nat_concat: THEOREM FORALL (bvn: bvec[n], bvm: bvec[m]):
                      bv2nat[n+m](bvn o bvm) 
                                 = bv2nat[n](bvn) * exp2(m) + bv2nat[m](bvm)


decl_type: tcc
theory: div
library: bitvectors
signature: nil
location: 36 0 38 999
body:
  % Judgement subtype TCC generated (at line 15, column 12) for  div(n, m)
      % expected type  nat
  div_TCC1: OBLIGATION FORALL (m, n): div(n, m) >= 0;


decl_type: formula
theory: bv_arith_nat
library: bitvectors
signature: nil
location: 75 2 79 74
body:
    bv_add     : LEMMA (FORALL (bv1,bv2: bvec[N]):
                          bv2nat(bv1 + bv2) =
                             IF bv2nat(bv1) + bv2nat(bv2) < exp2(N)
                             THEN bv2nat(bv1) + bv2nat(bv2)
                             ELSE bv2nat(bv1) + bv2nat(bv2) - exp2(N) ENDIF)


decl_type: formula
theory: bv_arith_nat
library: bitvectors
signature: nil
location: 96 2 97 64
body:
    bv_minus_mod : LEMMA (FORALL (bv: bvec[N], i: int):
                                     bv - i = bv - mod(i,exp2(N)))


decl_type: formula
theory: bv_arith_nat
library: bitvectors
signature: nil
location: 99 2 100 76
body:
    bv_minus_plus : LEMMA (FORALL (bv: bvec[N], i: int):
                                    bv - i = bv + mod(exp2(N) - i, exp2(N))) ;


decl_type: formula
theory: bv_arith_nat
library: bitvectors
signature: nil
location: 107 2 108 65
body:
    bv_plus1     : LEMMA bv2nat(bv + 1) = IF bv2nat(bv) = (exp2(N)-1) THEN 0
                                          ELSE bv2nat(bv) + 1 ENDIF 


decl_type: formula
theory: bv_arith_nat
library: bitvectors
signature: nil
location: 110 2 111 65
body:
    bv_minus1    : LEMMA bv2nat(bv - 1) = IF bv2nat(bv) = 0 THEN exp2(N)-1
                                          ELSE bv2nat(bv) - 1 ENDIF


decl_type: formula
theory: bv_arith_caret
library: bitvectors
signature: nil
location: 13 2 14 71
body:
    bv_shift    : THEOREM (FORALL (bv:bvec[N], ss: below(N)):
                         bv2nat(bv^(N-1,ss)) = div(bv2nat(bv), exp2(ss)))


decl_type: formula
theory: bv_arith_caret
library: bitvectors
signature: nil
location: 16 2 17 74
body:
    bv_bottom   : THEOREM (FORALL (bv:bvec[N], ss: below(N)):
                            bv2nat(bv^(ss,0)) = mod(bv2nat(bv),exp2(ss+1)) )


decl_type: formula
theory: bv_arith_caret
library: bitvectors
signature: nil
location: 19 2 20 79
body:
    bv_top      : THEOREM (FORALL (bv:bvec[N], ss: below(N)):
                           bv^(N-1,ss) = nat2bv[N-ss](div(bv2nat(bv), exp2(ss))))


decl_type: formula
theory: bv_arith_caret
library: bitvectors
signature: nil
location: 22 2 23 79
body:
    bv_bot      : THEOREM (FORALL (bv:bvec[N], nn: below(N)):
                            bv^(nn,0) = nat2bv[nn+1](mod(bv2nat(bv),exp2(nn+1))))


decl_type: formula
theory: bv_arith_caret
library: bitvectors
signature: nil
location: 25 2 26 76
body:
    bv_add_subrange : THEOREM (FORALL (bv1,bv2:bvec[N], nn: below(N)):
                                 (bv1 + bv2)^(nn,0) = bv1^(nn,0) + bv2^(nn,0))


decl_type: formula
theory: bv_arith_caret
library: bitvectors
signature: nil
location: 28 2 29 65
body:
    bv_plus_caret: LEMMA (FORALL (bv1: bvec[N], nn: below(N)):
                                 (bv1 + i)^(nn,0) = bv1^(nn,0) + i)


decl_type: formula
theory: bv_arith_caret
library: bitvectors
signature: nil
location: 31 2 33 81
body:
    bv_middle      : THEOREM (FORALL (n: posnat, i,j: below(n), bv: bvec[n]): 
                        i >= j IMPLIES
                      bv2nat(bv^(i,j)) = mod(div(bv2nat(bv), exp2(j)),exp2(i-j+1)))


decl_type: formula
theory: bv_arith_caret
library: bitvectors
signature: nil
location: 36 2 37 58
body:
    bv2nat_caret_00: THEOREM FORALL (n: posnat, bv: bvec[n]):
                                bv2nat(bv^(0,0)) = b2n(bv^0)


decl_type: formula
theory: bv_arith_caret
library: bitvectors
signature: nil
location: 39 2 40 80
body:
    bv2nat_lem     : THEOREM FORALL (n: above(1), bv: bvec[n]):
                                bv2nat(bv)  = 2 * bv2nat(bv ^ (n - 1, 1)) + bv ^ 0


decl_type: tcc
theory: bv_arith_caret
library: bitvectors
signature: nil
location: 47 0 50 999
body:
  % Subtype TCC generated (at line 14, column 34) for  N - 1
      % expected type  below(N)
  bv_shift_TCC1: OBLIGATION
    FORALL (N: posnat, ss: below(N)): N - 1 >= 0 AND N - 1 < N;


decl_type: tcc
theory: bv_arith_caret
library: bitvectors
signature: nil
location: 52 0 54 999
body:
  % Subtype TCC generated (at line 14, column 38) for  ss
      % expected type  upto(N - 1)
  bv_shift_TCC2: OBLIGATION FORALL (N: posnat, ss: below(N)): ss <= N - 1;


decl_type: tcc
theory: bv_arith_caret
library: bitvectors
signature: nil
location: 56 0 58 999
body:
  % Subtype TCC generated (at line 14, column 34) for  N - ss
      % expected type  nat
  bv_shift_TCC3: OBLIGATION FORALL (N: posnat, ss: below(N)): N - ss >= 0;


decl_type: tcc
theory: bv_arith_caret
library: bitvectors
signature: nil
location: 60 0 62 999
body:
  % Subtype TCC generated (at line 17, column 40) for  0
      % expected type  upto(ss)
  bv_bottom_TCC1: OBLIGATION FORALL (N: posnat, ss: below(N)): 0 <= ss;


decl_type: tcc
theory: bv_arith_caret
library: bitvectors
signature: nil
location: 64 0 69 999
body:
  % Subtype TCC generated (at line 20, column 52) for
      % div(bv2nat(bv), exp2(ss))
      % expected type  val: below(exp2(N - ss))
  bv_top_TCC1: OBLIGATION
    FORALL (N: posnat, bv: bvec[N], ss: below(N)):
      div(bv2nat[N](bv), exp2(ss)) < exp2(N - ss);


decl_type: tcc
theory: bv_arith_caret
library: bitvectors
signature: nil
location: 71 0 74 999
body:
  % Subtype TCC generated (at line 33, column 33) for  j
      % expected type  upto(i)
  bv_middle_TCC1: OBLIGATION
    FORALL (n: posnat, i, j: below(n)): i >= j IMPLIES j <= i;


decl_type: tcc
theory: bv_arith_caret
library: bitvectors
signature: nil
location: 76 0 79 999
body:
  % Subtype TCC generated (at line 89, column 18) for  1 + i - j
      % expected type  nat
  bv_middle_TCC2: OBLIGATION
    FORALL (n: posnat, i, j: below(n)): i >= j IMPLIES 1 + i - j >= 0;


decl_type: tcc
theory: bv_arith_caret
library: bitvectors
signature: nil
location: 81 0 84 999
body:
  % Subtype TCC generated (at line 33, column 73) for  i - j + 1
      % expected type  nat
  bv_middle_TCC3: OBLIGATION
    FORALL (n: posnat, i, j: below(n)): i >= j IMPLIES i - j + 1 >= 0;


decl_type: tcc
theory: bv_arith_caret
library: bitvectors
signature: nil
location: 86 0 88 999
body:
  % Subtype TCC generated (at line 37, column 41) for  0
      % expected type  below(n)
  bv2nat_caret_00_TCC1: OBLIGATION FORALL (n: posnat): 0 < n;


decl_type: tcc
theory: bv_arith_caret
library: bitvectors
signature: nil
location: 90 0 92 999
body:
  % Subtype TCC generated (at line 40, column 61) for  n - 1
      % expected type  below(n)
  bv2nat_lem_TCC1: OBLIGATION FORALL (n: above(1)): n - 1 >= 0 AND n - 1 < n;


decl_type: tcc
theory: bv_arith_caret
library: bitvectors
signature: nil
location: 94 0 96 999
body:
  % Subtype TCC generated (at line 40, column 68) for  1
      % expected type  upto(n - 1)
  bv2nat_lem_TCC2: OBLIGATION FORALL (n: above(1)): 1 <= n - 1;


decl_type: tcc
theory: bv_arith_caret
library: bitvectors
signature: nil
location: 98 0 100 999
body:
  % Subtype TCC generated (at line 40, column 61) for  n - 1
      % expected type  nat
  bv2nat_lem_TCC3: OBLIGATION FORALL (n: above(1)): n - 1 >= 0;


decl_type: tcc
theory: bv_arith_caret
library: bitvectors
signature: nil
location: 102 0 104 999
body:
  % Subtype TCC generated (at line 40, column 79) for  0
      % expected type  below[n]
  bv2nat_lem_TCC4: OBLIGATION FORALL (n: above(1)): 0 < n;


decl_type: formula
theory: bv_arith_nat_caret_rules
library: bitvectors
signature: nil
location: 8 2 9 70
body:
    bv_shift_rule  : THEOREM FORALL (bv:bvec[N], ss: below(N)):
                         bv2nat(bv^(N-1,ss)) = div(bv2nat(bv), exp2(ss))


decl_type: formula
theory: bv_arith_nat_caret_rules
library: bitvectors
signature: nil
location: 11 2 12 69
body:
    bv_bottom_rule : THEOREM FORALL (bv:bvec[N], ss: below(N)):
                         bv2nat(bv^(ss,0)) = mod(bv2nat(bv),exp2(ss+1))


decl_type: formula
theory: bv_arith_nat_caret_rules
library: bitvectors
signature: nil
location: 15 2 17 69
body:
    bv_middle_rule : THEOREM (FORALL (i,j: below(N), bv: bvec[N]): i >= j IMPLIES
                         bv2nat(bv^(i,j)) = 
                             mod(div(bv2nat(bv), exp2(j)),exp2(i-j+1)))


decl_type: formula
theory: bv_arith_nat_caret_rules
library: bitvectors
signature: nil
location: 20 2 21 58
body:
    bv_caret_00_rule : THEOREM FORALL (n: posnat, bv: bvec[n]):
                                bv2nat(bv^(0,0)) = b2n(bv^0)


decl_type: formula
theory: bv_arith_nat_caret_rules
library: bitvectors
signature: nil
location: 23 2 25 45
body:
    bv2nat_lem_rule  : THEOREM FORALL (n: above(1), bv: bvec[n]):
                                2 * bv2nat(bv ^ (n - 1, 1)) + b2n(bv ^ 0) 
                                   = bv2nat(bv)


decl_type: tcc
theory: bv_arith_nat_caret_rules
library: bitvectors
signature: nil
location: 32 0 35 999
body:
  % Subtype TCC generated (at line 9, column 34) for  N - 1
      % expected type  below(N)
  bv_shift_rule_TCC1: OBLIGATION
    FORALL (N: posnat, ss: below(N)): N - 1 >= 0 AND N - 1 < N;


decl_type: tcc
theory: bv_arith_nat_caret_rules
library: bitvectors
signature: nil
location: 37 0 40 999
body:
  % Subtype TCC generated (at line 9, column 38) for  ss
      % expected type  upto(N - 1)
  bv_shift_rule_TCC2: OBLIGATION
    FORALL (N: posnat, ss: below(N)): ss <= N - 1;


decl_type: tcc
theory: bv_arith_nat_caret_rules
library: bitvectors
signature: nil
location: 42 0 45 999
body:
  % Subtype TCC generated (at line 9, column 34) for  N - ss
      % expected type  nat
  bv_shift_rule_TCC3: OBLIGATION
    FORALL (N: posnat, ss: below(N)): N - ss >= 0;


decl_type: tcc
theory: bv_arith_nat_caret_rules
library: bitvectors
signature: nil
location: 47 0 49 999
body:
  % Subtype TCC generated (at line 12, column 37) for  0
      % expected type  upto(ss)
  bv_bottom_rule_TCC1: OBLIGATION FORALL (N: posnat, ss: below(N)): 0 <= ss;


decl_type: tcc
theory: bv_arith_nat_caret_rules
library: bitvectors
signature: nil
location: 51 0 54 999
body:
  % Subtype TCC generated (at line 16, column 36) for  j
      % expected type  upto(i)
  bv_middle_rule_TCC1: OBLIGATION
    FORALL (N: posnat, i, j: below(N)): i >= j IMPLIES j <= i;


decl_type: tcc
theory: bv_arith_nat_caret_rules
library: bitvectors
signature: nil
location: 56 0 59 999
body:
  % Subtype TCC generated (at line 89, column 18) for  1 + i - j
      % expected type  nat
  bv_middle_rule_TCC2: OBLIGATION
    FORALL (N: posnat, i, j: below(N)): i >= j IMPLIES 1 + i - j >= 0;


decl_type: tcc
theory: bv_arith_nat_caret_rules
library: bitvectors
signature: nil
location: 61 0 64 999
body:
  % Subtype TCC generated (at line 17, column 61) for  i - j + 1
      % expected type  nat
  bv_middle_rule_TCC3: OBLIGATION
    FORALL (N: posnat, i, j: below(N)): i >= j IMPLIES i - j + 1 >= 0;


decl_type: tcc
theory: bv_arith_nat_caret_rules
library: bitvectors
signature: nil
location: 66 0 68 999
body:
  % Subtype TCC generated (at line 21, column 41) for  0
      % expected type  below(n)
  bv_caret_00_rule_TCC1: OBLIGATION FORALL (n: posnat): 0 < n;


decl_type: tcc
theory: bv_arith_nat_caret_rules
library: bitvectors
signature: nil
location: 70 0 73 999
body:
  % Subtype TCC generated (at line 24, column 47) for  n - 1
      % expected type  below(n)
  bv2nat_lem_rule_TCC1: OBLIGATION
    FORALL (n: above(1)): n - 1 >= 0 AND n - 1 < n;


decl_type: tcc
theory: bv_arith_nat_caret_rules
library: bitvectors
signature: nil
location: 75 0 77 999
body:
  % Subtype TCC generated (at line 24, column 54) for  1
      % expected type  upto(n - 1)
  bv2nat_lem_rule_TCC2: OBLIGATION FORALL (n: above(1)): 1 <= n - 1;


decl_type: tcc
theory: bv_arith_nat_caret_rules
library: bitvectors
signature: nil
location: 79 0 81 999
body:
  % Subtype TCC generated (at line 24, column 47) for  n - 1
      % expected type  nat
  bv2nat_lem_rule_TCC3: OBLIGATION FORALL (n: above(1)): n - 1 >= 0;


decl_type: tcc
theory: bv_arith_nat_caret_rules
library: bitvectors
signature: nil
location: 83 0 85 999
body:
  % Subtype TCC generated (at line 24, column 69) for  0
      % expected type  below[n]
  bv2nat_lem_rule_TCC4: OBLIGATION FORALL (n: above(1)): 0 < n;


decl_type: formula
theory: bv_arith_caret_rules
library: bitvectors
signature: nil
location: 10 2 11 80
body:
    bv_add_caret       : THEOREM FORALL (bv1, bv2:bvec[N]): nn < N => 
                                      (bv1 + bv2)^(nn,0) = bv1^(nn,0) + bv2^(nn,0)


decl_type: formula
theory: bv_arith_caret_rules
library: bitvectors
signature: nil
location: 14 2 15 69
body:
    bv_caret_over_plus : THEOREM FORALL (bvn:bvec[N]): nn < N => 
                                      (bvn + i)^(nn,0) = bvn^(nn,0) + i


decl_type: formula
theory: bv_arith_caret_rules
library: bitvectors
signature: nil
location: 17 2 18 69
body:
    bv_odd_even_pc     : THEOREM FORALL (bv: bvec[N]):
                                      (bv + nn)^0 = NOT (bv + (nn-1))^0


decl_type: formula
theory: bv_arith_caret_rules
library: bitvectors
signature: nil
location: 20 2 21 73
body:
    bv_even_odd_pc     : THEOREM FORALL (bv: bvec[N]):
                                      (bv + (-n))^0 = NOT ((bv + (-n+1))^0)


decl_type: formula
theory: bv_arith_caret_rules
library: bitvectors
signature: nil
location: 28 2 30 81
body:
    bv_plus_caret_rule : LEMMA FORALL (bv1, bv2 : bvec[N]):
                               m <= nn AND nn + 1 < N => 
                           (bv1 + bv2) ^ (nn, m) = (bv1^(nn,0) + bv2^(nn,0))^(nn,m)


decl_type: tcc
theory: bv_arith_caret_rules
library: bitvectors
signature: nil
location: 38 0 41 999
body:
  % Subtype TCC generated (at line 11, column 52) for  0
      % expected type  upto(nn)
  bv_add_caret_TCC1: OBLIGATION
    FORALL (N: posnat, nn: nat): nn < N IMPLIES 0 <= nn;


decl_type: tcc
theory: bv_arith_caret_rules
library: bitvectors
signature: nil
location: 43 0 45 999
body:
  % Subtype TCC generated (at line 18, column 46) for  0
      % expected type  below[N]
  bv_odd_even_pc_TCC1: OBLIGATION FORALL (N: posnat): 0 < N;


decl_type: tcc
theory: bv_arith_caret_rules
library: bitvectors
signature: nil
location: 47 0 50 999
body:
  % Subtype TCC generated (at line 30, column 40) for  nn
      % expected type  below(N)
  bv_plus_caret_rule_TCC1: OBLIGATION
    FORALL (N: posnat, m, nn: nat): m <= nn AND nn + 1 < N IMPLIES nn < N;


decl_type: tcc
theory: bv_arith_caret_rules
library: bitvectors
signature: nil
location: 52 0 55 999
body:
  % Subtype TCC generated (at line 30, column 58) for  0
      % expected type  upto(nn)
  bv_plus_caret_rule_TCC2: OBLIGATION
    FORALL (N: posnat, m, nn: nat): m <= nn AND nn + 1 < N IMPLIES 0 <= nn;


decl_type: tcc
theory: bv_arith_caret_rules
library: bitvectors
signature: nil
location: 57 0 61 999
body:
  % Subtype TCC generated (at line 30, column 76) for  nn
      % expected type  below(1 + nn)
  bv_plus_caret_rule_TCC3: OBLIGATION
    FORALL (N: posnat, m, nn: nat):
      m <= nn AND nn + 1 < N IMPLIES nn < 1 + nn;


decl_type: formula
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 10 2 11 44
body:
    caret_fill       : THEOREM FORALL (i: below(n), j: upto(i)): 
                                  fill[n](b)^(i,j) = fill[i-j+1](b)


decl_type: formula
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 13 2 15 55
body:
    caret_concat_bot : THEOREM FORALL (i: below(n+m), j: upto(i),
                                       bvn: bvec[n], bvm: bvec[m]):
                                   i < m IMPLIES (bvn o bvm)^(i,j) = bvm^(i,j)


decl_type: formula
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 17 2 20 48
body:
    caret_concat_top : THEOREM FORALL (i: below(n+m), j: upto(i),
                                       bvn: bvec[n], bvm: bvec[m]):
                                  j >= m 
                                    IMPLIES (bvn o bvm)^(i,j) = bvn^(i-m, j-m)


decl_type: formula
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 22 2 26 63
body:
    caret_concat_all : THEOREM FORALL (i: below(n+m), j: upto(i), 
                                       bvn: bvec[n], bvm: bvec[m]):
                                  i >= m AND j < m 
                                     IMPLIES (bvn o bvm)^(i,j) = 
                                        bvn^(i-m,0) o bvm^(m-1,j) 


decl_type: formula
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 28 2 29 63
body:
    bv_decomposition : THEOREM FORALL (N: above(1), k: below(N-1), bvn: bvec[N]):
                                  bvn^(N-1,k+1) o bvn^(k,0) = bvn


decl_type: formula
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 31 2 34 78
body:
    caret_concat_join: THEOREM FORALL (bvn: bvec[n], i1,i2: below[n],
                                           j1: upto[i1], j2: upto[i2]):
                                 (j1=i2+1) =>
                                     (bvn^(i1,j1) o bvn^(i2,j2) =  bvn^(i1,j2));


decl_type: formula
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 36 2 37 57
body:
    concat_bottom    : THEOREM FORALL (bvn: bvec[n], bvm: bvec[m]):
                                  (bvn o bvm)^(m-1,0) = bvm


decl_type: formula
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 39 2 40 62
body:
    concat_top       : THEOREM FORALL (bvn: bvec[n], bvm: bvec[m]):
                                   (bvn o bvm)^((n+m-1),m) = bvn


decl_type: tcc
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 47 0 50 999
body:
  % Subtype TCC generated (at line 11, column 39) for  1 + i - j
      % expected type  nat
  caret_fill_TCC1: OBLIGATION
    FORALL (n: posnat, i: below(n), j: upto(i)): 1 + i - j >= 0;


decl_type: tcc
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 52 0 56 999
body:
  % Subtype TCC generated (at line 20, column 39) for  i - m
      % expected type  below(n)
  caret_concat_top_TCC1: OBLIGATION
    FORALL (m, n: posnat, i: below(m + n), j: upto(i)):
      j >= m IMPLIES i - m >= 0 AND i - m < n;


decl_type: tcc
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 58 0 62 999
body:
  % Subtype TCC generated (at line 20, column 44) for  j - m
      % expected type  upto(i - m)
  caret_concat_top_TCC2: OBLIGATION
    FORALL (m, n: posnat, i: below(m + n), j: upto(i)):
      j >= m IMPLIES j - m >= 0 AND j - m <= i - m;


decl_type: tcc
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 64 0 68 999
body:
  % Subtype TCC generated (at line 26, column 43) for  i - m
      % expected type  below(n)
  caret_concat_all_TCC1: OBLIGATION
    FORALL (m, n: posnat, i: below(m + n), j: upto(i)):
      i >= m AND j < m IMPLIES i - m >= 0 AND i - m < n;


decl_type: tcc
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 70 0 74 999
body:
  % Subtype TCC generated (at line 26, column 47) for  0
      % expected type  upto(i - m)
  caret_concat_all_TCC2: OBLIGATION
    FORALL (m, n: posnat, i: below(m + n), j: upto(i)):
      i >= m AND j < m IMPLIES 0 <= i - m;


decl_type: tcc
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 76 0 80 999
body:
  % Subtype TCC generated (at line 26, column 57) for  m - 1
      % expected type  below(m)
  caret_concat_all_TCC3: OBLIGATION
    FORALL (m, n: posnat, i: below(m + n), j: upto(i)):
      i >= m AND j < m IMPLIES m - 1 >= 0 AND m - 1 < m;


decl_type: tcc
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 82 0 86 999
body:
  % Subtype TCC generated (at line 26, column 61) for  j
      % expected type  upto(m - 1)
  caret_concat_all_TCC4: OBLIGATION
    FORALL (m, n: posnat, i: below(m + n), j: upto(i)):
      i >= m AND j < m IMPLIES j <= m - 1;


decl_type: tcc
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 88 0 92 999
body:
  % Subtype TCC generated (at line 89, column 18) for  1 + i - m
      % expected type  nat
  caret_concat_all_TCC5: OBLIGATION
    FORALL (m, n: posnat, i: below(m + n), j: upto(i)):
      i >= m AND j < m IMPLIES 1 + i - m >= 0;


decl_type: tcc
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 94 0 98 999
body:
  % Subtype TCC generated (at line 26, column 57) for  m - j
      % expected type  nat
  caret_concat_all_TCC6: OBLIGATION
    FORALL (m, n: posnat, i: below(m + n), j: upto(i)):
      i >= m AND j < m IMPLIES m - j >= 0;


decl_type: tcc
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 100 0 103 999
body:
  % Subtype TCC generated (at line 29, column 37) for  N - 1
      % expected type  below(N)
  bv_decomposition_TCC1: OBLIGATION
    FORALL (N: above(1), k: below(N - 1)): N - 1 >= 0 AND N - 1 < N;


decl_type: tcc
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 105 0 108 999
body:
  % Subtype TCC generated (at line 29, column 41) for  k + 1
      % expected type  upto(N - 1)
  bv_decomposition_TCC2: OBLIGATION
    FORALL (N: above(1), k: below(N - 1)): k + 1 <= N - 1;


decl_type: tcc
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 110 0 113 999
body:
  % Subtype TCC generated (at line 29, column 53) for  k
      % expected type  below(N)
  bv_decomposition_TCC3: OBLIGATION
    FORALL (N: above(1), k: below(N - 1)): k < N;


decl_type: tcc
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 115 0 118 999
body:
  % Subtype TCC generated (at line 29, column 55) for  0
      % expected type  upto(k)
  bv_decomposition_TCC4: OBLIGATION
    FORALL (N: above(1), k: below(N - 1)): 0 <= k;


decl_type: tcc
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 120 0 123 999
body:
  % Subtype TCC generated (at line 29, column 37) for  N - 1 - k
      % expected type  nat
  bv_decomposition_TCC5: OBLIGATION
    FORALL (N: above(1), k: below(N - 1)): N - 1 - k >= 0;


decl_type: tcc
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 125 0 129 999
body:
  % Subtype TCC generated (at line 89, column 18) for  1 + i2 - j2
      % expected type  nat
  caret_concat_join_TCC1: OBLIGATION
    FORALL (n: posnat, i1, i2: below[n], j1: upto[i1], j2: upto[i2]):
      (j1 = i2 + 1) IMPLIES 1 + i2 - j2 >= 0;


decl_type: tcc
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 131 0 135 999
body:
  % Subtype TCC generated (at line 34, column 73) for  j2
      % expected type  upto(i1)
  caret_concat_join_TCC2: OBLIGATION
    FORALL (n: posnat, i1, i2: below[n], j1: upto[i1], j2: upto[i2]):
      (j1 = i2 + 1) IMPLIES j2 <= i1;


decl_type: tcc
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 137 0 145 999
body:
  % Subtype TCC generated (at line 34, column 65) for  bvn ^ (i1, j2)
      % expected type  bvec[2 + i1 + i2 - j1 - j2]
  caret_concat_join_TCC3: OBLIGATION
    FORALL (n: posnat, bvn: bvec[n], i1, i2: below[n], j1: upto[i1],
            j2: upto[i2]):
      (j1 = i2 + 1) IMPLIES
       (FORALL (x: nat):
          (^[n](bvn, (i1, j2)))(x) IMPLIES
           (x < 1 + i1 - j2 IFF x < 2 + i1 + i2 - j1 - j2));


decl_type: tcc
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 147 0 150 999
body:
  % Subtype TCC generated (at line 37, column 45) for  m - 1
      % expected type  below(m + n)
  concat_bottom_TCC1: OBLIGATION
    FORALL (m, n: posnat): m - 1 >= 0 AND m - 1 < m + n;


decl_type: tcc
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 152 0 154 999
body:
  % Subtype TCC generated (at line 37, column 49) for  0
      % expected type  upto(m - 1)
  concat_bottom_TCC2: OBLIGATION FORALL (m: posnat): 0 <= m - 1;


decl_type: tcc
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 156 0 159 999
body:
  % Subtype TCC generated (at line 40, column 47) for  (n + m - 1)
      % expected type  below(m + n)
  concat_top_TCC1: OBLIGATION
    FORALL (m, n: posnat): (n + m - 1) >= 0 AND (n + m - 1) < m + n;


decl_type: tcc
theory: bv_caret_concat
library: bitvectors
signature: nil
location: 161 0 163 999
body:
  % Subtype TCC generated (at line 40, column 54) for  m
      % expected type  upto((m + n - 1))
  concat_top_TCC2: OBLIGATION FORALL (m, n: posnat): m <= (m + n - 1);


decl_type: formula
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 10 2 11 60
body:
    bv_concat_bottom     : LEMMA FORALL (bvn: bvec[n], bvm: bvec[m]):
                                  (bvn o bvm)^((m-1), 0) = bvm


decl_type: formula
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 13 2 14 63
body:
    bv_concat_top        : LEMMA FORALL (bvn: bvec[n], bvm: bvec[m]):
                                   (bvn o bvm)^((n+m-1), m) = bvn


decl_type: formula
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 16 2 18 66
body:
    bv_caret_concat_low  : LEMMA FORALL (bvn: bvec[n], bvm: bvec[m]):
                                   (i < m) AND (j <= i) =>  
                                     (bvn o bvm)^(i, j) = bvm^(i, j) 


decl_type: formula
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 20 2 22 50
body:
    bv_caret_concat_high : LEMMA FORALL (bvn: bvec[n], bvm: bvec[m]):
                                    i < n+m AND m <= j AND j <= i 
                                      IMPLIES (bvn o bvm)^(i,j) = bvn^(i-m, j-m)


decl_type: formula
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 25 2 28 75
body:
    bv_caret_concat_split: LEMMA FORALL (bvn: bvec[n], bvm: bvec[m]):
                                   (i < n+m) AND (i >= m) AND
                                    (j < m) AND (j <= i) =>
                               (bvn o bvm)^(i,j) = bvn^(i-m, 0) o bvm^(m-1,j)


decl_type: formula
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 31 2 34 75
body:
    bv_caret_recomp      : LEMMA FORALL (n: posnat, bvn: bvec[n], 
                                        i1,j1,i2,j2: below[n]):
                               (i1 >= j1) AND (i2 >= j2) AND (j1=i2+1) =>
                                  (bvn^(i1,j1) o bvn^(i2,j2) =  bvn^(i1,j2));


decl_type: formula
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 36 2 37 64
body:
    bv_ucaret_concat_1   : LEMMA FORALL (bvn: bvec[n], bvm: bvec[m]):
                                    i < m => (bvn o bvm)^i = bvm^i


decl_type: formula
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 39 2 41 61
body:
    bv_ucaret_concat_2   : LEMMA FORALL (bvn: bvec[n], bvm: bvec[m]): 
                                   (i < n+m) AND (i >= m) => 
                                      (bvn o bvm)^i = bvn^(i-m)  


decl_type: formula
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 43 2 44 42
body:
    bv_caret_fill        : LEMMA FORALL (i: below(n), j: upto(i)): 
                                fill[n](b)^(i,j) = fill[i-j+1](b)


decl_type: tcc
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 52 0 55 999
body:
  % Subtype TCC generated (at line 11, column 46) for  (m - 1)
      % expected type  below(m + n)
  bv_concat_bottom_TCC1: OBLIGATION
    FORALL (m, n: posnat): (m - 1) >= 0 AND (m - 1) < m + n;


decl_type: tcc
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 57 0 59 999
body:
  % Subtype TCC generated (at line 11, column 52) for  0
      % expected type  upto((m - 1))
  bv_concat_bottom_TCC2: OBLIGATION FORALL (m: posnat): 0 <= (m - 1);


decl_type: tcc
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 61 0 64 999
body:
  % Subtype TCC generated (at line 14, column 47) for  (n + m - 1)
      % expected type  below(m + n)
  bv_concat_top_TCC1: OBLIGATION
    FORALL (m, n: posnat): (n + m - 1) >= 0 AND (n + m - 1) < m + n;


decl_type: tcc
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 66 0 68 999
body:
  % Subtype TCC generated (at line 14, column 55) for  m
      % expected type  upto((m + n - 1))
  bv_concat_top_TCC2: OBLIGATION FORALL (m, n: posnat): m <= (m + n - 1);


decl_type: tcc
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 70 0 73 999
body:
  % Subtype TCC generated (at line 18, column 48) for  i
      % expected type  below(m + n)
  bv_caret_concat_low_TCC1: OBLIGATION
    FORALL (i, j: nat, m, n: posnat): (i < m) AND (j <= i) IMPLIES i < m + n;


decl_type: tcc
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 75 0 79 999
body:
  % Subtype TCC generated (at line 22, column 29) for  i
      % expected type  below(m + n)
  bv_caret_concat_high_TCC1: OBLIGATION
    FORALL (i, j: nat, m, n: posnat):
      i < n + m AND m <= j AND j <= i IMPLIES i < m + n;


decl_type: tcc
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 81 0 85 999
body:
  % Subtype TCC generated (at line 22, column 41) for  i - m
      % expected type  below(n)
  bv_caret_concat_high_TCC2: OBLIGATION
    FORALL (i, j: nat, m, n: posnat):
      i < n + m AND m <= j AND j <= i IMPLIES i - m >= 0 AND i - m < n;


decl_type: tcc
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 87 0 91 999
body:
  % Subtype TCC generated (at line 22, column 46) for  j - m
      % expected type  upto(i - m)
  bv_caret_concat_high_TCC3: OBLIGATION
    FORALL (i, j: nat, m, n: posnat):
      i < n + m AND m <= j AND j <= i IMPLIES j - m >= 0 AND j - m <= i - m;


decl_type: tcc
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 93 0 97 999
body:
  % Subtype TCC generated (at line 28, column 42) for  i
      % expected type  below(m + n)
  bv_caret_concat_split_TCC1: OBLIGATION
    FORALL (i, j: nat, m, n: posnat):
      (i < n + m) AND (i >= m) AND (j < m) AND (j <= i) IMPLIES i < m + n;


decl_type: tcc
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 99 0 104 999
body:
  % Subtype TCC generated (at line 28, column 54) for  i - m
      % expected type  below(n)
  bv_caret_concat_split_TCC2: OBLIGATION
    FORALL (i, j: nat, m, n: posnat):
      (i < n + m) AND (i >= m) AND (j < m) AND (j <= i) IMPLIES
       i - m >= 0 AND i - m < n;


decl_type: tcc
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 106 0 110 999
body:
  % Subtype TCC generated (at line 28, column 59) for  0
      % expected type  upto(i - m)
  bv_caret_concat_split_TCC3: OBLIGATION
    FORALL (i, j: nat, m, n: posnat):
      (i < n + m) AND (i >= m) AND (j < m) AND (j <= i) IMPLIES 0 <= i - m;


decl_type: tcc
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 112 0 117 999
body:
  % Subtype TCC generated (at line 28, column 69) for  m - 1
      % expected type  below(m)
  bv_caret_concat_split_TCC4: OBLIGATION
    FORALL (i, j: nat, m, n: posnat):
      (i < n + m) AND (i >= m) AND (j < m) AND (j <= i) IMPLIES
       m - 1 >= 0 AND m - 1 < m;


decl_type: tcc
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 119 0 123 999
body:
  % Subtype TCC generated (at line 28, column 73) for  j
      % expected type  upto(m - 1)
  bv_caret_concat_split_TCC5: OBLIGATION
    FORALL (i, j: nat, m, n: posnat):
      (i < n + m) AND (i >= m) AND (j < m) AND (j <= i) IMPLIES j <= m - 1;


decl_type: tcc
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 125 0 130 999
body:
  % Subtype TCC generated (at line 89, column 18) for  1 + i - m
      % expected type  nat
  bv_caret_concat_split_TCC6: OBLIGATION
    FORALL (i, j: nat, m, n: posnat):
      (i < n + m) AND (i >= m) AND (j < m) AND (j <= i) IMPLIES
       1 + i - m >= 0;


decl_type: tcc
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 132 0 136 999
body:
  % Subtype TCC generated (at line 28, column 69) for  m - j
      % expected type  nat
  bv_caret_concat_split_TCC7: OBLIGATION
    FORALL (i, j: nat, m, n: posnat):
      (i < n + m) AND (i >= m) AND (j < m) AND (j <= i) IMPLIES m - j >= 0;


decl_type: tcc
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 138 0 142 999
body:
  % Subtype TCC generated (at line 34, column 41) for  j1
      % expected type  upto(i1)
  bv_caret_recomp_TCC1: OBLIGATION
    FORALL (n: posnat, i1, j1, i2, j2: below[n]):
      (i1 >= j1) AND (i2 >= j2) AND (j1 = i2 + 1) IMPLIES j1 <= i1;


decl_type: tcc
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 144 0 148 999
body:
  % Subtype TCC generated (at line 34, column 55) for  j2
      % expected type  upto(i2)
  bv_caret_recomp_TCC2: OBLIGATION
    FORALL (n: posnat, i1, j1, i2, j2: below[n]):
      (i1 >= j1) AND (i2 >= j2) AND (j1 = i2 + 1) IMPLIES j2 <= i2;


decl_type: tcc
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 150 0 154 999
body:
  % Subtype TCC generated (at line 89, column 18) for  1 + i1 - j1
      % expected type  nat
  bv_caret_recomp_TCC3: OBLIGATION
    FORALL (n: posnat, i1, j1, i2, j2: below[n]):
      (i1 >= j1) AND (i2 >= j2) AND (j1 = i2 + 1) IMPLIES 1 + i1 - j1 >= 0;


decl_type: tcc
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 156 0 160 999
body:
  % Subtype TCC generated (at line 89, column 18) for  1 + i2 - j2
      % expected type  nat
  bv_caret_recomp_TCC4: OBLIGATION
    FORALL (n: posnat, i1, j1, i2, j2: below[n]):
      (i1 >= j1) AND (i2 >= j2) AND (j1 = i2 + 1) IMPLIES 1 + i2 - j2 >= 0;


decl_type: tcc
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 162 0 166 999
body:
  % Subtype TCC generated (at line 34, column 70) for  j2
      % expected type  upto(i1)
  bv_caret_recomp_TCC5: OBLIGATION
    FORALL (n: posnat, i1, j1, i2, j2: below[n]):
      (i1 >= j1) AND (i2 >= j2) AND (j1 = i2 + 1) IMPLIES j2 <= i1;


decl_type: tcc
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 168 0 175 999
body:
  % Subtype TCC generated (at line 34, column 62) for  bvn ^ (i1, j2)
      % expected type  bvec[2 + i1 + i2 - j1 - j2]
  bv_caret_recomp_TCC6: OBLIGATION
    FORALL (n: posnat, bvn: bvec[n], i1, j1, i2, j2: below[n]):
      (i1 >= j1) AND (i2 >= j2) AND (j1 = i2 + 1) IMPLIES
       (FORALL (x: nat):
          (^[n](bvn, (i1, j2)))(x) IMPLIES
           (x < 1 + i1 - j2 IFF x < 2 + i1 + i2 - j1 - j2));


decl_type: tcc
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 177 0 180 999
body:
  % Subtype TCC generated (at line 37, column 55) for  i
      % expected type  below[m + n]
  bv_ucaret_concat_1_TCC1: OBLIGATION
    FORALL (i: nat, m, n: posnat): i < m IMPLIES i < m + n;


decl_type: tcc
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 182 0 185 999
body:
  % Subtype TCC generated (at line 41, column 48) for  i
      % expected type  below[m + n]
  bv_ucaret_concat_2_TCC1: OBLIGATION
    FORALL (i: nat, m, n: posnat): (i < n + m) AND (i >= m) IMPLIES i < m + n;


decl_type: tcc
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 187 0 191 999
body:
  % Subtype TCC generated (at line 41, column 57) for  (i - m)
      % expected type  below[n]
  bv_ucaret_concat_2_TCC2: OBLIGATION
    FORALL (i: nat, m, n: posnat):
      (i < n + m) AND (i >= m) IMPLIES (i - m) >= 0 AND (i - m) < n;


decl_type: tcc
theory: bv_caret_concat_rules
library: bitvectors
signature: nil
location: 193 0 196 999
body:
  % Subtype TCC generated (at line 44, column 37) for  1 + i - j
      % expected type  nat
  bv_caret_fill_TCC1: OBLIGATION
    FORALL (n: posnat, i: below(n), j: upto(i)): 1 + i - j >= 0;


decl_type: formula
theory: bv_int
library: bitvectors
signature: nil
location: 48 2 49 76
body:
    bv2int_inj    : THEOREM % injective?(bv2int)
                                 bv2int(bv1) = bv2int(bv2) IMPLIES (bv1 = bv2)


decl_type: formula
theory: bv_int
library: bitvectors
signature: nil
location: 51 2 52 69
body:
    bv2int_surj   : THEOREM % surjective?(bv2int)
                                (EXISTS (bv: bvec[N]): bv2int(bv) = iv)


decl_type: formula
theory: bv_int
library: bitvectors
signature: nil
location: 62 2 63 52
body:
    bv2int_top_bit: THEOREM IF bv2int(bv) >= 0 THEN bv^(N-1) = FALSE 
                            ELSE bv^(N-1) = TRUE ENDIF


decl_type: formula
theory: bv_int
library: bitvectors
signature: nil
location: 80 2 81 67
body:
    int2bv_2nat: THEOREM  int2bv(ii) = IF ii >= 0 THEN nat2bv[N](ii)
                                     ELSE nat2bv[N](ii+exp2(N)) ENDIF


decl_type: tcc
theory: bv_int
library: bitvectors
signature: nil
location: 96 0 98 999
body:
  % Subtype TCC generated (at line 56, column 66) for  (N - 1)
      % expected type  below[N]
  bv2int_lem_TCC1: OBLIGATION (N - 1) >= 0 AND (N - 1) < N;


decl_type: tcc
theory: bv_int
library: bitvectors
signature: nil
location: 100 0 103 999
body:
  % Subtype TCC generated (at line 80, column 63) for  ii
      % expected type  val: below(exp2(N))
  int2bv_2nat_TCC1: OBLIGATION
    FORALL (ii: rng_2s_comp[N]): ii >= 0 IMPLIES ii < exp2(N);


decl_type: tcc
theory: bv_int
library: bitvectors
signature: nil
location: 105 0 109 999
body:
  % Subtype TCC generated (at line 81, column 50) for  ii + exp2(N)
      % expected type  val: below(exp2(N))
  int2bv_2nat_TCC2: OBLIGATION
    FORALL (ii: rng_2s_comp[N]):
      NOT ii >= 0 IMPLIES ii + exp2(N) >= 0 AND ii + exp2(N) < exp2(N);


decl_type: formula
theory: bv_arith_int_concat
library: bitvectors
signature: nil
location: 10 2 13 78
body:
    bv2int_concat      : LEMMA FORALL (n, m: posnat, bvn: bvec[n], bvm: bvec[m]):
                                  bv2int(bvn o bvm) = bv2int(bvn) * exp2(m) 
                                                      + bv2int(bvm) 
                                                      + b2n(bvm^(m-1)) * exp2(m)


decl_type: tcc
theory: bv_arith_int_concat
library: bitvectors
signature: nil
location: 20 0 22 999
body:
  % Subtype TCC generated (at line 10, column 75) for  m + n
      % expected type  posnat
  bv2int_concat_TCC1: OBLIGATION FORALL (n, m: posnat): m + n > 0;


decl_type: tcc
theory: bv_arith_int_concat
library: bitvectors
signature: nil
location: 24 0 27 999
body:
  % Subtype TCC generated (at line 13, column 63) for  (m - 1)
      % expected type  below[m]
  bv2int_concat_TCC2: OBLIGATION
    FORALL (n, m: posnat): (m - 1) >= 0 AND (m - 1) < m;


decl_type: formula
theory: bv_arithmetic
library: bitvectors
signature: nil
location: 49 2 50 78
body:
    bv2int_add  : THEOREM in_rng_2s_comp(bv2int(bv1) + bv2int(bv2))
                           IMPLIES bv2int(bv1 + bv2) = bv2int(bv1) + bv2int(bv2)  


decl_type: formula
theory: bv_arithmetic
library: bitvectors
signature: nil
location: 52 2 53 59
body:
    bv2int_neg : LEMMA bv2int(-bv) = IF bv2int(bv) = minint THEN bv2int(bv)
                                     ELSE -(bv2int(bv)) ENDIF 


decl_type: formula
theory: bv_arithmetic
library: bitvectors
signature: nil
location: 55 2 56 65
body:
    bv2int_minus_1  : LEMMA bv2int(bv1) > minint AND bv2int(bv) = 1 
                         IMPLIES bv2int(bv1 - bv) = bv2int(bv1) - 1


decl_type: formula
theory: bv_arithmetic
library: bitvectors
signature: nil
location: 58 2 59 64
body:
    bv2int_plus_1: LEMMA bv2int(bv + 1) = IF bv2int(bv) = maxint[N] THEN minint[N]
                                         ELSE bv2int(bv) + 1 ENDIF 


decl_type: formula
theory: bv_arithmetic
library: bitvectors
signature: nil
location: 64 2 66 58
body:
    bv2int_plus_i: LEMMA bv2int(bv+i) =
                         mod(bv2int(bv) + exp2(N) * b2n(bv^(N - 1)) + i, exp2(N))
                           - exp2(N) * b2n((bv + i)^(N - 1))


decl_type: formula
theory: bv_arithmetic
library: bitvectors
signature: nil
location: 76 2 77 39
body:
    bv2nat_compl_max  : THEOREM bv2nat_rec(n, bv) + bv2nat_rec(n, NOT bv) 
                            = exp2(n) - 1


decl_type: formula
theory: bv_arithmetic
library: bitvectors
signature: nil
location: 92 2 93 74
body:
    bv2nat_minus_bv: COROLLARY bv2nat(-bv) = IF bv2nat(bv) = 0 THEN 0
                                             ELSE exp2(N) - bv2nat(bv) ENDIF


decl_type: formula
theory: bv_arithmetic
library: bitvectors
signature: nil
location: 95 2 96 76
body:
    bv_is_minint   : COROLLARY bv2int(-bv) = bv2int(bv) 
                                 IMPLIES bv2int(bv) = minint OR bv2int(bv) = 0


decl_type: tcc
theory: bv_arithmetic
library: bitvectors
signature: nil
location: 109 0 111 999
body:
  % Subtype TCC generated (at line 47, column 27) for  (N - 1)
      % expected type  below[N]
  bv_top_bit_0_TCC1: OBLIGATION (N - 1) >= 0 AND (N - 1) < N;


decl_type: tcc
theory: bv_arithmetic
library: bitvectors
signature: nil
location: 113 0 115 999
body:
  % Subtype TCC generated (at line 47, column 62) for  N - 1
      % expected type  nat
  bv_top_bit_0_TCC2: OBLIGATION N - 1 >= 0;


decl_type: tcc
theory: bv_extend
library: bitvectors
signature: nil
location: 68 0 70 999
body:
  % Subtype TCC generated (at line 55, column 59) for  k - N
      % expected type  nat
  zero_extend_def_TCC1: OBLIGATION FORALL (k: above(N)): k - N >= 0;


decl_type: tcc
theory: bv_extend
library: bitvectors
signature: nil
location: 72 0 74 999
body:
  % Subtype TCC generated (at line 57, column 68) for  (N - 1)
      % expected type  below[N]
  sign_extend_def_TCC1: OBLIGATION (N - 1) >= 0 AND (N - 1) < N;


decl_type: tcc
theory: bv_extend
library: bitvectors
signature: nil
location: 76 0 78 999
body:
  % Subtype TCC generated (at line 61, column 77) for  0
      % expected type  below[N]
  lsb_extend__def_TCC1: OBLIGATION 0 < N;


decl_type: formula
theory: bv_arith_extend
library: bitvectors
signature: nil
location: 9 2 10 70
body:
    zero_extend_lem  : THEOREM (FORALL (bv: bvec[n], k: above(n)):
                          bv2nat[k](zero_extend[n](k)(bv)) = bv2nat(bv))


decl_type: formula
theory: bv_arith_extend
library: bitvectors
signature: nil
location: 12 2 17 18
body:
    sign_to_zero     : THEOREM (FORALL (bv: bvec[n], k: above(n)):
                                sign_extend[n](k)(bv) =
                                   IF bv(n-1) THEN 
                                      NOT(zero_extend[n](k)(NOT(bv)))
                                   ELSE zero_extend[n](k)(bv)
                                   ENDIF)


decl_type: formula
theory: bv_arith_extend
library: bitvectors
signature: nil
location: 19 2 20 77
body:
    sign_extend_lem  : THEOREM (FORALL (bv: bvec[n], k: above(n)):
                                 bv2int[k](sign_extend[n](k)(bv)) = bv2int(bv))


decl_type: formula
theory: bv_arith_extend
library: bitvectors
signature: nil
location: 22 2 24 60
body:
    zero_extend_lsend: THEOREM (FORALL (bv: bvec[n], k: above(n)):
                                  bv2nat(zero_extend_lsend[n](k)(bv)) 
                                     = bv2nat(bv) * exp2(k-n))


decl_type: formula
theory: bv_arith_extend
library: bitvectors
signature: nil
location: 27 2 29 76
body:
    bv2int_elim_gen  : LEMMA (FORALL (m: pos_nat_below(n),
                                      bv1: bvec[n],bv2: bvec[m]):
                          bv1 + sign_extend[m](n)(bv2) = bv1 + bv2int[m](bv2))


decl_type: tcc
theory: bv_arith_extend
library: bitvectors
signature: nil
location: 38 0 40 999
body:
  % Subtype TCC generated (at line 14, column 18) for  n - 1
      % expected type  below(n)
  sign_to_zero_TCC1: OBLIGATION FORALL (n: posnat): n - 1 >= 0 AND n - 1 < n;


decl_type: tcc
theory: bv_arith_extend
library: bitvectors
signature: nil
location: 42 0 45 999
body:
  % Subtype TCC generated (at line 24, column 55) for  k - n
      % expected type  nat
  zero_extend_lsend_TCC1: OBLIGATION
    FORALL (n: posnat, k: above(n)): k - n >= 0;


decl_type: tcc
theory: bv_arith_extend
library: bitvectors
signature: nil
location: 47 0 50 999
body:
  % Subtype TCC generated (at line 29, column 45) for  n
      % expected type  k: above(m)
  bv2int_elim_gen_TCC1: OBLIGATION
    FORALL (n: posnat, m: pos_nat_below(n)): n > m;


decl_type: formula
theory: bv_overflow
library: bitvectors
signature: nil
location: 11 2 12 59
body:
    overflow_then_eq: LEMMA overflow(bv1,bv2) IMPLIES 
                                bv1 ^ (N - 1) = bv2 ^ (N - 1)


decl_type: formula
theory: bv_overflow
library: bitvectors
signature: nil
location: 16 2 18 73
body:
    bv2int_overflow_nat : LEMMA NOT in_rng_2s_comp(bv2int(bv1) + bv2int(bv2))
                                      IMPLIES bv2int(bv1 + bv2) = 
                                        bv2nat(bv1) + bv2nat(bv2) - exp2(N)


decl_type: formula
theory: bv_overflow
library: bitvectors
signature: nil
location: 20 2 25 55
body:
    bv_not_in_rng_int   : LEMMA NOT in_rng_2s_comp(bv2int(bv1) + bv2int(bv2))
                                      IMPLIES bv2int(bv1 + bv2) =
                                          bv2int(bv1) + bv2int(bv2) 
                                                + exp2(N) * b2n(bv1(N - 1))
                                                + exp2(N) * b2n(bv2(N - 1))
                                                - exp2(N)


decl_type: formula
theory: bv_overflow
library: bitvectors
signature: nil
location: 27 2 32 36
body:
    bv2int_add_overflow : THEOREM NOT in_rng_2s_comp(bv2int(bv1) + bv2int(bv2))
                             IMPLIES bv2int(bv1 + bv2) =
                                 IF bv2int(bv1) >= 0 AND bv2int(bv2) >= 0
                                    THEN bv2int(bv1) + bv2int(bv2) - exp2(N)
                                 ELSE bv2int(bv1) + bv2int(bv2) + exp2(N) 
                                 ENDIF


decl_type: formula
theory: bv_overflow
library: bitvectors
signature: nil
location: 35 2 36 69
body:
    bv_sum_limits       : LEMMA bv2int(bv1) + bv2int(bv2) <= 2 * maxint AND
                                bv2int(bv1) + bv2int(bv2) >= 2 * minint  


decl_type: formula
theory: bv_overflow
library: bitvectors
signature: nil
location: 38 2 40 60
body:
    bv_bits_for_overflow: LEMMA (bv1 ^ (N - 1) = bv2 ^ (N - 1)
                                AND bv1 ^ (N - 1) /= (bv1 + bv2) ^ (N - 1))
                                    IMPLIES overflow(bv1, bv2)


decl_type: formula
theory: bv_overflow
library: bitvectors
signature: nil
location: 42 2 43 78
body:
    bv_overflow_bits_ne : LEMMA overflow(bv1,bv2) IMPLIES 
                                        (bv1 ^ (N - 1) /= (bv1 + bv2) ^ (N - 1))


decl_type: formula
theory: bv_overflow
library: bitvectors
signature: nil
location: 45 2 47 80
body:
    bv_overflow_def     : THEOREM overflow(bv1, bv2) =
                                     ((bv1 ^ (N - 1) = bv2 ^ (N - 1))
                                     AND (bv1 ^ (N - 1) /= (bv1 + bv2) ^ (N - 1)))


decl_type: tcc
theory: bv_overflow
library: bitvectors
signature: nil
location: 54 0 58 999
body:
  % Subtype TCC generated (at line 12, column 37) for  (N - 1)
      % expected type  below[N]
  overflow_then_eq_TCC1: OBLIGATION
    FORALL (bv1, bv2: bvec[N]):
      overflow(bv1, bv2) IMPLIES (N - 1) >= 0 AND (N - 1) < N;


decl_type: tcc
theory: bv_overflow
library: bitvectors
signature: nil
location: 60 0 65 999
body:
  % Subtype TCC generated (at line 23, column 66) for  N - 1
      % expected type  below(N)
  bv_not_in_rng_int_TCC1: OBLIGATION
    FORALL (bv1, bv2: bvec[N]):
      NOT in_rng_2s_comp(bv2int(bv1) + bv2int(bv2)) IMPLIES
       N - 1 >= 0 AND N - 1 < N;


decl_type: tcc
theory: bv_overflow
library: bitvectors
signature: nil
location: 67 0 69 999
body:
  % Subtype TCC generated (at line 38, column 38) for  (N - 1)
      % expected type  below[N]
  bv_bits_for_overflow_TCC1: OBLIGATION (N - 1) >= 0 AND (N - 1) < N;


decl_type: formula
theory: bv_arith_int_rules
library: bitvectors
signature: nil
location: 8 2 9 61
body:
    singleton_int: LEMMA FORALL (bv: bvec[n], i: below[n]):
                              bv2int[1](bv^(i,i)) = - b2n(bv^i)


decl_type: formula
theory: bv_arith_int_rules
library: bitvectors
signature: nil
location: 11 2 19 14
body:
    bv2int_add_combined_rule: LEMMA FORALL (bv1, bv2: bvec[n]):
         bv2int(bv1 + bv2) =
           IF in_rng_2s_comp[n](bv2int(bv1) + bv2int(bv2)) THEN 
                bv2int(bv1) + bv2int(bv2)
           ELSIF bv2int(bv1) >= 0 AND bv2int(bv2) >= 0 THEN 
                bv2int(bv1) + bv2int(bv2) - exp2(n)
           ELSE 
               bv2int(bv1) + bv2int(bv2) + exp2(n) 
           ENDIF


decl_type: formula
theory: bv_arith_int_rules
library: bitvectors
signature: nil
location: 21 3 23 70
body:
     bv2int_add_no_overflow: LEMMA FORALL (bv1, bv2: bvec[n]):
                        in_rng_2s_comp[n](bv2int(bv1) + bv2int(bv2)) =>
                           bv2int(bv1 + bv2) = bv2int(bv1) + bv2int(bv2)


decl_type: formula
theory: bv_arith_int_rules
library: bitvectors
signature: nil
location: 25 3 30 63
body:
     bv2int_add_overflow: LEMMA FORALL (bv1, bv2: bvec[n]):
                       (NOT in_rng_2s_comp[n](bv2int(bv1) + bv2int(bv2))) =>
                             bv2int(bv1 + bv2) =
                               IF bv2int(bv1) >= 0 & bv2int(bv2) >= 0
                                  THEN bv2int(bv1) + bv2int(bv2) - exp2(n)
                               ELSE bv2int(bv1) + bv2int(bv2) + exp2(n) ENDIF


decl_type: formula
theory: bv_arith_int_rules
library: bitvectors
signature: nil
location: 33 3 38 43
body:
     sign_bit_of_unary_minus: LEMMA FORALL (bv: bvec[n]):
               (-bv)^(n-1) = IF bv2int(bv) = minint[n] THEN TRUE
                             ELSIF NOT bv^(n-1) THEN 
                                 IF bv2int(bv) = 0 THEN FALSE 
                                 ELSE TRUE ENDIF
                             ELSE FALSE ENDIF


decl_type: tcc
theory: bv_arith_int_rules
library: bitvectors
signature: nil
location: 48 0 50 999
body:
  % Subtype TCC generated (at line 9, column 44) for  i
      % expected type  upto(i)
  singleton_int_TCC1: OBLIGATION FORALL (n: posnat, i: below[n]): i <= i;


decl_type: tcc
theory: bv_arith_int_rules
library: bitvectors
signature: nil
location: 52 0 55 999
body:
  % Subtype TCC generated (at line 34, column 20) for  (n - 1)
      % expected type  below[n]
  sign_bit_of_unary_minus_TCC1: OBLIGATION
    FORALL (n: posnat): (n - 1) >= 0 AND (n - 1) < n;


decl_type: formula
theory: bv_arith_nat_rules
library: bitvectors
signature: nil
location: 26 2 28 79
body:
    bv_add_rule              : LEMMA FORALL (bv1,bv2: bvec[N]):
                                 bv2nat(bv1) + bv2nat(bv2) < exp2(N) IMPLIES
                                    bv2nat(bv1 + bv2) = bv2nat(bv1) + bv2nat(bv2)


decl_type: formula
theory: bv_arith_nat_rules
library: bitvectors
signature: nil
location: 30 2 32 79
body:
    bv_add_overflow     : LEMMA FORALL (bv1,bv2: bvec[N]):
                                 bv2nat(bv1) + bv2nat(bv2) >= exp2(N) IMPLIES
                          bv2nat(bv1 + bv2) = bv2nat(bv1) + bv2nat(bv2) - exp2(N)


decl_type: formula
theory: bv_arith_nat_rules
library: bitvectors
signature: nil
location: 39 2 40 80
body:
    bv_plus_fill_T   : LEMMA FORALL (bv: bvec[N]): bv2nat(bv) /= 0 IMPLIES
                                       bv2nat(bv + fill[N](TRUE)) = bv2nat(bv) - 1


decl_type: formula
theory: bv_arith_nat_rules
library: bitvectors
signature: nil
location: 42 2 43 68
body:
    bv2nat_elim_rule : LEMMA FORALL (bv1,bv2: bvec[N]): 
                                         bv1 + bv2nat(bv2) = bv1 + bv2


decl_type: formula
theory: bv_arith_nat_rules
library: bitvectors
signature: nil
location: 45 2 46 76
body:
    bv2nat_plus: LEMMA FORALL (bv: bvec[N]): n < (exp2(N) - bv2nat(bv)) =>
                                               bv2nat(bv + n) = bv2nat(bv) + n


decl_type: formula
theory: bv_arith_nat_rules
library: bitvectors
signature: nil
location: 48 2 50 69
body:
    bv2nat_plus2: LEMMA FORALL (bv: bvec[N]): n < exp2(N) AND 
                                              bv2nat(bv) + n >= exp2(N) =>
                           bv2nat(bv +  n) = bv2nat(bv) - (exp2(N) - n)


decl_type: formula
theory: bv_arith_nat_rules
library: bitvectors
signature: nil
location: 53 2 54 78
body:
    bv2nat_minus : LEMMA FORALL (bv: bvec[N]):  n <= bv2nat(bv) =>
                                                 bv2nat(bv - n) = bv2nat(bv) - n


decl_type: formula
theory: bv_arith_nat_rules
library: bitvectors
signature: nil
location: 56 2 57 74
body:
    bv2nat_minus2 : LEMMA FORALL (bv: bvec[N]):  n > bv2nat(bv) AND n < exp2(N) =>
                                   bv2nat(bv - n) = bv2nat(bv) - n + exp2(N)


decl_type: formula
theory: bv_arith_nat_rules
library: bitvectors
signature: nil
location: 60 2 61 78
body:
    bv2nat_neg : LEMMA FORALL (bv: bvec[N]):  i < 0 AND (-i) <= bv2nat(bv) =>
                                                 bv2nat(bv + i) = bv2nat(bv) + i


decl_type: formula
theory: bv_arith_nat_rules
library: bitvectors
signature: nil
location: 63 2 65 73
body:
    bv2nat_neg2: LEMMA FORALL (bv: bvec[N]): i < 0 AND (-i) > bv2nat(bv) AND
                                               (-i) < exp2(N) =>
                                  bv2nat(bv + i) = bv2nat(bv) + i + exp2(N)


decl_type: formula
theory: bv_arith_nat_rules
library: bitvectors
signature: nil
location: 69 2 70 77
body:
    bv2nat_neg_modulo: LEMMA FORALL (bv: bvec[N]): i <= -exp2(N) =>
                              bv2nat(bv + i) = bv2nat(bv + (-mod(-i, exp2(N))))


decl_type: formula
theory: bv_arith_nat_rules
library: bitvectors
signature: nil
location: 75 2 76 66
body:
    singleton_nat_alt   : LEMMA FORALL (bv: bvec[N]):
                                  N = 1 => bv2nat[N](bv) = b2n(bv^0)


decl_type: tcc
theory: bv_arith_nat_rules
library: bitvectors
signature: nil
location: 86 0 88 999
body:
  % Subtype TCC generated (at line 76, column 64) for  0
      % expected type  below[N]
  singleton_nat_alt_TCC1: OBLIGATION FORALL (N: posnat): N = 1 IMPLIES 0 < N;


decl_type: formula
theory: bv_arith_minus_rules
library: bitvectors
signature: nil
location: 8 2 9 58
body:
    bv_assoc_obliviation : LEMMA FORALL (bv1,bv2: bvec[N]):
                                  bv1 + (-(bv1) + bv2) = bv2


decl_type: formula
theory: bv_arith_minus_rules
library: bitvectors
signature: nil
location: 13 2 14 59
body:
    bv_sub_normalization : LEMMA FORALL (bv1,bv2: bvec[N]):
                                   (bv1 - bv2) = bv1 + (-bv2)


decl_type: formula
theory: bv_arith_minus_rules
library: bitvectors
signature: nil
location: 16 2 17 59
body:
    bv_neg_distribution  : LEMMA FORALL (bv1,bv2: bvec[N]):
                                   -(bv1 + bv2) = -bv1 + -bv2


decl_type: formula
theory: bv_arith_minus_rules
library: bitvectors
signature: nil
location: 20 2 21 58
body:
    bv_plus_neg_distrib  : LEMMA FORALL (i: int, bv: bvec[N]):
                                      -(bv + i) = -bv + (-i)


decl_type: formula
theory: bv_arith_minus_rules
library: bitvectors
signature: nil
location: 23 2 24 61
body:
    bv_sub_identity_R    : LEMMA FORALL (bv1: bvec[N]):
                                  bv1 + -(fill[N](FALSE)) = bv1


decl_type: formula
theory: bv_arith_minus_rules
library: bitvectors
signature: nil
location: 26 2 27 61
body:
    bv_sub_identity_L    : LEMMA FORALL (bv1: bvec[N]):
                                  -(fill[N](FALSE)) + bv1 = bv1


decl_type: formula
theory: bv_arith_minus_rules
library: bitvectors
signature: nil
location: 29 2 30 66
body:
    bv_fill_increment_R  : LEMMA FORALL (bv1: bvec[N]):
                                  (bv1 + -(fill[N](TRUE))) = bv1 + 1


decl_type: formula
theory: bv_arith_minus_rules
library: bitvectors
signature: nil
location: 32 2 33 66
body:
    bv_fill_increment_L  : LEMMA FORALL (bv1: bvec[N]):
                                  (-(fill[N](TRUE)) + bv1) = bv1 + 1


decl_type: formula
theory: bv_arith_minus_rules
library: bitvectors
signature: nil
location: 35 2 36 59
body:
    bv_not_normalization : LEMMA FORALL (bv1,bv2: bvec[N]):
                                  (NOT (bv1)) = -(bv1) + (-1)


decl_type: formula
theory: bv_arith_rules
library: bitvectors
signature: nil
location: 13 2 14 78
body:
    bv_add_normalization     : LEMMA FORALL (bv1,bv2,bv3: bvec[N]): 
                                           bv1 + (bv2 + bv3) = (bv1 + bv2) + bv3


decl_type: formula
theory: bv_arith_rules
library: bitvectors
signature: nil
location: 16 2 17 74
body:
    bv_add_both_sides        : LEMMA FORALL (bv1,bv2,bv3: bvec[N]):
                                       (bv1 + bv3 = bv2 + bv3) IFF bv1 = bv2


decl_type: formula
theory: bv_arith_rules
library: bitvectors
signature: nil
location: 19 2 20 75
body:
    bv_add_associative       : LEMMA FORALL (bv1,bv2,bv3: bvec[N]):
                                        bv1 + (bv2 + bv3) = (bv1 + bv2) + bv3 


decl_type: formula
theory: bv_arith_rules
library: bitvectors
signature: nil
location: 22 2 23 67
body:
    bv_add_identity_R        : LEMMA FORALL (bv1: bvec[N]): 
                                           bv1 + fill[N](FALSE) = bv1


decl_type: formula
theory: bv_arith_rules
library: bitvectors
signature: nil
location: 25 2 26 67
body:
    bv_add_identity_L        : LEMMA FORALL (bv1: bvec[N]): 
                                           fill[N](FALSE) + bv1 = bv1


decl_type: formula
theory: bv_arith_rules
library: bitvectors
signature: nil
location: 37 2 38 69
body:
    bv_plus_inj_rule  : LEMMA FORALL (bv: bvec[N]),(n1,n2: below(exp2(N))):
                                        (bv + n1 = bv + n2) = (n1 = n2)


decl_type: formula
theory: bv_arith_rules
library: bitvectors
signature: nil
location: 45 2 46 66
body:
    bv_plus_assoc1           : LEMMA FORALL (bv1,bv2: bvec[N]):
                                   bv1 + (bv2 + i) = (bv1 + bv2) + i


decl_type: formula
theory: bv_arith_rules
library: bitvectors
signature: nil
location: 48 2 49 66
body:
    bv_plus_assoc2           : LEMMA FORALL (bv1,bv2: bvec[N]):
                                  (bv1 + i) + bv2  = (bv1 + bv2) + i


decl_type: formula
theory: bv_arith_rules
library: bitvectors
signature: nil
location: 51 2 52 66
body:
    bv_plus_2int_assoc       : LEMMA FORALL (bv1: bvec[N]):
                                  (bv1 + i1) + i2  = bv1 + (i1 + i2) 


decl_type: formula
theory: bv_arith_rules
library: bitvectors
signature: nil
location: 55 2 56 67
body:
    bv_add_2_consts_1   : LEMMA FORALL (bv: bvec[N]),(k1,k2: int):
                                        (bv + k1) + k2 = bv + (k1+k2)


decl_type: formula
theory: bv_arith_rules
library: bitvectors
signature: nil
location: 58 2 59 80
body:
    bv_add_2_consts_2   : LEMMA FORALL (bv1,bv2: bvec[N]),(k1,k2: int):
                                 (bv1 + k1) + (bv2 + k2) = (bv1 + bv2) + (k1 + k2) 


decl_type: formula
theory: bv_concat_rules
library: bitvectors
signature: nil
location: 14 3 15 52
body:
     bv_concat_null_r      : LEMMA FORALL (bvn:bvec[n], bv0: bvec[0]):
                                     (bvn o bv0 = bvn)


decl_type: formula
theory: bv_concat_rules
library: bitvectors
signature: nil
location: 17 3 18 52
body:
     bv_concat_null_l      : LEMMA FORALL (bvn:bvec[n], bv0: bvec[0]):
                                     (bv0 o bvn = bvn)


decl_type: formula
theory: bv_concat_rules
library: bitvectors
signature: nil
location: 20 3 21 76
body:
     bv_concat_associative : LEMMA FORALL (bvm:bvec[m], bvn:bvec[n], bvp:bvec[p]):
                                     (bvm o (bvn o bvp)) = ((bvm o bvn) o bvp) 


decl_type: formula
theory: bv_concat_rules
library: bitvectors
signature: nil
location: 29 3 31 65
body:
     bv_concat_2fill     : LEMMA FORALL (bv: bvec[n]): 
                                       (fill[n1](b) o (fill[n2](b)) o bv) 
                                           = (fill[n1+n2](b) o bv);


decl_type: formula
theory: bv_concat_rules
library: bitvectors
signature: nil
location: 35 2 36 72
body:
    bv_concat_top_rule  : LEMMA FORALL (N: posnat, bvn: bvec[N], bvm: bvec[m]):
                                           (bvn o bvm)^(N+m-1) = bvn^(N-1)


decl_type: formula
theory: bv_concat_rules
library: bitvectors
signature: nil
location: 38 2 39 79
body:
    bv_not_over_concat  : LEMMA FORALL (bvm: bvec[m], bvn: bvec[n]):
                                        (NOT (bvm o bvn)) = (NOT bvm) o (NOT bvn)


decl_type: tcc
theory: bv_concat_rules
library: bitvectors
signature: nil
location: 46 0 49 999
body:
  % Subtype TCC generated (at line 36, column 54) for  (N + m - 1)
      % expected type  below[N + m]
  bv_concat_top_rule_TCC1: OBLIGATION
    FORALL (m: nat, N: posnat): (N + m - 1) >= 0 AND (N + m - 1) < N + m;


decl_type: tcc
theory: bv_concat_rules
library: bitvectors
signature: nil
location: 51 0 54 999
body:
  % Subtype TCC generated (at line 36, column 68) for  (N - 1)
      % expected type  below[N]
  bv_concat_top_rule_TCC2: OBLIGATION
    FORALL (N: posnat): (N - 1) >= 0 AND (N - 1) < N;


decl_type: formula
theory: bv_caret_bitwise
library: bitvectors
signature: nil
location: 8 2 9 69
body:
    bv_OR_caret : LEMMA (FORALL (bv1,bv2: bvec[n], i: below(n), j: upto(i)):
                         (bv1 OR bv2)^(i,j) = (bv1^(i,j) OR bv2^(i,j)))


decl_type: formula
theory: bv_caret_bitwise
library: bitvectors
signature: nil
location: 11 2 12 71
body:
    bv_AND_caret: LEMMA (FORALL (bv1,bv2: bvec[n], i: below(n), j: upto(i)):
                         (bv1 AND bv2)^(i,j) = (bv1^(i,j) AND bv2^(i,j)))


decl_type: formula
theory: bv_caret_bitwise
library: bitvectors
signature: nil
location: 14 2 15 71
body:
    bv_IFF_caret: LEMMA (FORALL (bv1,bv2: bvec[n], i: below(n), j: upto(i)):
                         (bv1 IFF bv2)^(i,j) = (bv1^(i,j) IFF bv2^(i,j)))


decl_type: formula
theory: bv_caret_bitwise
library: bitvectors
signature: nil
location: 17 2 18 71
body:
    bv_XOR_caret: LEMMA (FORALL (bv1,bv2: bvec[n], i: below(n), j: upto(i)):
                         XOR(bv1,bv2)^(i,j) = (bv1^(i,j) XOR bv2^(i,j)) )


decl_type: formula
theory: bv_caret_bitwise
library: bitvectors
signature: nil
location: 20 2 21 54
body:
    bv_NOT_caret: LEMMA (FORALL (bv: bvec[n], i: below(n), j: upto(i)):
                         (NOT bv)^(i,j) = NOT bv^(i,j) )


decl_type: tcc
theory: bv_caret_bitwise
library: bitvectors
signature: nil
location: 28 0 31 999
body:
  % Subtype TCC generated (at line 89, column 18) for  1 + i - j
      % expected type  nat
  bv_OR_caret_TCC1: OBLIGATION
    FORALL (n: nat, i: below(n), j: upto(i)): 1 + i - j >= 0;


decl_type: formula
theory: bv_caret_bitwise_rules
library: bitvectors
signature: nil
location: 13 2 14 70
body:
    bv_caret_OR       : LEMMA (FORALL (bv1,bv2: bvec[N], i: below[N], j: upto(i)):
                          (bv1 OR bv2)^(i,j) = (bv1^(i,j) OR bv2^(i,j)))


decl_type: formula
theory: bv_caret_bitwise_rules
library: bitvectors
signature: nil
location: 16 2 17 72
body:
    bv_caret_AND      : LEMMA (FORALL (bv1,bv2: bvec[N], i: below[N], j: upto(i)):
                          (bv1 AND bv2)^(i,j) = (bv1^(i,j) AND bv2^(i,j)))


decl_type: formula
theory: bv_caret_bitwise_rules
library: bitvectors
signature: nil
location: 19 2 20 72
body:
    bv_caret_XOR      : LEMMA (FORALL (bv1,bv2: bvec[N], i: below[N], j: upto(i)):
                          XOR(bv1,bv2)^(i,j) = (bv1^(i,j) XOR bv2^(i,j)) )


decl_type: formula
theory: bv_caret_bitwise_rules
library: bitvectors
signature: nil
location: 22 2 23 72
body:
    bv_caret_IFF      : LEMMA (FORALL (bv1,bv2: bvec[N], i: below(N), j: upto(i)):
                          (bv1 IFF bv2)^(i,j) = (bv1^(i,j) IFF bv2^(i,j)))


decl_type: formula
theory: bv_caret_bitwise_rules
library: bitvectors
signature: nil
location: 25 2 26 55
body:
    bv_caret_NOT      : LEMMA (FORALL (bv: bvec[N], i: below(N), j: upto(i)):
                          (NOT bv)^(i,j) = NOT bv^(i,j) )


decl_type: formula
theory: bv_caret_bitwise_rules
library: bitvectors
signature: nil
location: 30 2 31 58
body:
    bv_caret_OR_unary : LEMMA (FORALL (bv1, bv2: bvec[N], i: below[N]):
                          (bv1 OR bv2)^i = (bv1^i OR bv2^i))


decl_type: formula
theory: bv_caret_bitwise_rules
library: bitvectors
signature: nil
location: 33 2 34 60
body:
    bv_caret_AND_unary: LEMMA (FORALL (bv1,bv2: bvec[N], i: below[N]):
                          (bv1 AND bv2)^i = (bv1^i AND bv2^i))


decl_type: formula
theory: bv_caret_bitwise_rules
library: bitvectors
signature: nil
location: 36 2 37 60
body:
    bv_caret_XOR_unary: LEMMA (FORALL (bv1,bv2: bvec[N], i: below[N]):
                          XOR(bv1,bv2)^i = (bv1^i XOR bv2^i) )


decl_type: formula
theory: bv_caret_bitwise_rules
library: bitvectors
signature: nil
location: 39 2 40 62
body:
    bv_caret_IFF_unary: LEMMA (FORALL (bv1,bv2: bvec[N], i: below[N]):
                            IFF(bv1,bv2)^i = (bv1^i IFF bv2^i) )


decl_type: formula
theory: bv_caret_bitwise_rules
library: bitvectors
signature: nil
location: 42 2 43 47
body:
    bv_caret_NOT_unary: LEMMA (FORALL (bv: bvec[N], i: below[N]):
                          (NOT bv)^i = NOT bv^i )


decl_type: tcc
theory: bv_caret_bitwise_rules
library: bitvectors
signature: nil
location: 51 0 54 999
body:
  % Subtype TCC generated (at line 89, column 18) for  1 + i - j
      % expected type  nat
  bv_caret_OR_TCC1: OBLIGATION
    FORALL (N: nat, i: below[N], j: upto(i)): 1 + i - j >= 0;


decl_type: formula
theory: bv_caret_rules
library: bitvectors
signature: nil
location: 13 2 14 62
body:
    bv_caret_remove     : LEMMA FORALL (bv: bvec[N]): 
                                  i=N-1 AND j=0 => bv^(i,j) = bv


decl_type: formula
theory: bv_caret_rules
library: bitvectors
signature: nil
location: 16 2 17 58
body:
    bv_caret_ii_0_rule  : LEMMA FORALL (bv: bvec[N]): 
                                  i < N => bv^(i,i)^0 = bv^i


decl_type: formula
theory: bv_caret_rules
library: bitvectors
signature: nil
location: 19 2 21 62
body:
    bv_caret_elim_rule  : LEMMA FORALL (bv: bvec[N]): 
                                  i < N AND j <= i AND k < i-j+1 => 
                                      bv ^ (i, j) ^ k = bv^(j+k)


decl_type: formula
theory: bv_caret_rules
library: bitvectors
signature: nil
location: 23 2 27 79
body:
    bv_caret_denormalize: LEMMA FORALL (n: posnat, bvn: bvec[n]):
                                  i1 < n         AND   j1 <= i1 AND 
                                  i2 < i1-j1+1   AND   j2 <= i2 AND 
                                  i2-j2+1 <= i1-j1+1 =>
                                     (bvn^(i1, j1))^(i2, j2) = bvn^(i2+j1, j2+j1)


decl_type: formula
theory: bv_caret_rules
library: bitvectors
signature: nil
location: 30 2 31 71
body:
    bv_fill_caret       : LEMMA n < m AND k < m AND k <= n =>
                                     (fill[m](b))^(n, k) = fill[n-k+1](b)


decl_type: tcc
theory: bv_caret_rules
library: bitvectors
signature: nil
location: 41 0 44 999
body:
  % Subtype TCC generated (at line 14, column 53) for  i
      % expected type  below(N)
  bv_caret_remove_TCC1: OBLIGATION
    FORALL (N, i, j: nat): i = N - 1 AND j = 0 IMPLIES i < N;


decl_type: tcc
theory: bv_caret_rules
library: bitvectors
signature: nil
location: 46 0 49 999
body:
  % Subtype TCC generated (at line 14, column 55) for  j
      % expected type  upto(i)
  bv_caret_remove_TCC2: OBLIGATION
    FORALL (N, i, j: nat): i = N - 1 AND j = 0 IMPLIES j <= i;


decl_type: tcc
theory: bv_caret_rules
library: bitvectors
signature: nil
location: 51 0 56 999
body:
  % Subtype TCC generated (at line 14, column 60) for  bv
      % expected type  bvec[1 + i - j]
  bv_caret_remove_TCC3: OBLIGATION
    FORALL (N, i, j: nat, bv: bvec[N]):
      i = N - 1 AND j = 0 IMPLIES
       (FORALL (x: nat): bv(x) IMPLIES (x < N IFF x < 1 + i - j));


decl_type: tcc
theory: bv_caret_rules
library: bitvectors
signature: nil
location: 58 0 61 999
body:
  % Subtype TCC generated (at line 17, column 47) for  i
      % expected type  upto(i)
  bv_caret_ii_0_rule_TCC1: OBLIGATION
    FORALL (N, i: nat): i < N IMPLIES i <= i;


decl_type: tcc
theory: bv_caret_rules
library: bitvectors
signature: nil
location: 63 0 67 999
body:
  % Subtype TCC generated (at line 21, column 50) for  k
      % expected type  below[1 + i - j]
  bv_caret_elim_rule_TCC1: OBLIGATION
    FORALL (N, i, j, k: nat):
      i < N AND j <= i AND k < i - j + 1 IMPLIES k < 1 + i - j;


decl_type: tcc
theory: bv_caret_rules
library: bitvectors
signature: nil
location: 69 0 73 999
body:
  % Subtype TCC generated (at line 89, column 18) for  1 + i - j
      % expected type  nat
  bv_caret_elim_rule_TCC2: OBLIGATION
    FORALL (N, i, j, k: nat):
      i < N AND j <= i AND k < i - j + 1 IMPLIES 1 + i - j >= 0;


decl_type: tcc
theory: bv_caret_rules
library: bitvectors
signature: nil
location: 75 0 79 999
body:
  % Subtype TCC generated (at line 21, column 58) for  (j + k)
      % expected type  below[N]
  bv_caret_elim_rule_TCC3: OBLIGATION
    FORALL (N, i, j, k: nat):
      i < N AND j <= i AND k < i - j + 1 IMPLIES (j + k) < N;


decl_type: tcc
theory: bv_caret_rules
library: bitvectors
signature: nil
location: 81 0 87 999
body:
  % Subtype TCC generated (at line 27, column 51) for  i2
      % expected type  below(1 + i1 - j1)
  bv_caret_denormalize_TCC1: OBLIGATION
    FORALL (i1, i2, j1, j2: nat, n: posnat):
           i1 < n AND j1 <= i1 AND i2 < i1 - j1 + 1 AND j2 <= i2
       AND i2 - j2 + 1 <= i1 - j1 + 1
       IMPLIES i2 < 1 + i1 - j1;


decl_type: tcc
theory: bv_caret_rules
library: bitvectors
signature: nil
location: 89 0 95 999
body:
  % Subtype TCC generated (at line 89, column 18) for  1 + i1 - j1
      % expected type  nat
  bv_caret_denormalize_TCC2: OBLIGATION
    FORALL (i1, i2, j1, j2: nat, n: posnat):
           i1 < n AND j1 <= i1 AND i2 < i1 - j1 + 1 AND j2 <= i2
       AND i2 - j2 + 1 <= i1 - j1 + 1
       IMPLIES 1 + i1 - j1 >= 0;


decl_type: tcc
theory: bv_caret_rules
library: bitvectors
signature: nil
location: 97 0 103 999
body:
  % Subtype TCC generated (at line 27, column 66) for  i2 + j1
      % expected type  below(n)
  bv_caret_denormalize_TCC3: OBLIGATION
    FORALL (i1, i2, j1, j2: nat, n: posnat):
           i1 < n AND j1 <= i1 AND i2 < i1 - j1 + 1 AND j2 <= i2
       AND i2 - j2 + 1 <= i1 - j1 + 1
       IMPLIES i2 + j1 < n;


decl_type: tcc
theory: bv_caret_rules
library: bitvectors
signature: nil
location: 105 0 111 999
body:
  % Subtype TCC generated (at line 27, column 73) for  j2 + j1
      % expected type  upto(i2 + j1)
  bv_caret_denormalize_TCC4: OBLIGATION
    FORALL (i1, i2, j1, j2: nat, n: posnat):
           i1 < n AND j1 <= i1 AND i2 < i1 - j1 + 1 AND j2 <= i2
       AND i2 - j2 + 1 <= i1 - j1 + 1
       IMPLIES j2 + j1 <= i2 + j1;


decl_type: tcc
theory: bv_caret_rules
library: bitvectors
signature: nil
location: 113 0 116 999
body:
  % Subtype TCC generated (at line 31, column 66) for  1 + n - k
      % expected type  nat
  bv_fill_caret_TCC1: OBLIGATION
    FORALL (k, m, n: nat): k <= n AND k < m AND n < m IMPLIES 1 + n - k >= 0;


decl_type: formula
theory: bv_bitwise_rules
library: bitvectors
signature: nil
location: 20 2 21 62
body:
    bv_NOT_caret         : LEMMA FORALL (bv:bvec[N]) (i: below(N)): 
                                        (NOT(bv))^i = NOT (bv^i)


decl_type: formula
theory: bv_bitwise_rules
library: bitvectors
signature: nil
location: 25 2 26 76
body:
    bv_AND_fill_normalize: LEMMA FORALL (bv1 : bvec[N]):
                                   (fill[N](b) AND bv1) = (bv1 AND fill[N](b))


decl_type: formula
theory: bv_bitwise_rules
library: bitvectors
signature: nil
location: 28 2 29 73
body:
    bv_AND_fill_F        : LEMMA FORALL (bv1: bvec[N]): 
                                  (bv1 AND fill[N](FALSE)) = fill[N](FALSE)


decl_type: formula
theory: bv_bitwise_rules
library: bitvectors
signature: nil
location: 31 2 32 77
body:
    bv_AND_fill_T        : LEMMA FORALL 
                                  (bv1: bvec[N]): (bv1 AND fill[N](TRUE)) = bv1


decl_type: formula
theory: bv_bitwise_rules
library: bitvectors
signature: nil
location: 34 2 35 68
body:
    bv_AND_same          : LEMMA FORALL (bv1, bv2: bvec[N]):
                                    (bv1 = bv2) => (bv1 AND bv2) = bv1


decl_type: formula
theory: bv_bitwise_rules
library: bitvectors
signature: nil
location: 37 2 38 80
body:
    bv_AND_associative   : LEMMA FORALL (bv1, bv2, bv3: bvec[N]):
                                 (bv1 AND (bv2 AND bv3)) = ((bv1 AND bv2) AND bv3)


decl_type: formula
theory: bv_bitwise_rules
library: bitvectors
signature: nil
location: 40 2 41 80
body:
    bv_AND_bv_2eq        : LEMMA FORALL (bv1, bv2, bv3: bvec[N]):
                              bv1 = bv2 => (bv1 AND (bv2 AND bv3)) = (bv2 AND bv3)


decl_type: formula
theory: bv_bitwise_rules
library: bitvectors
signature: nil
location: 43 2 44 75
body:
    bv_OR_fill_normalize : LEMMA FORALL (bv1: bvec[N]): 
                                    (fill[N](b) OR bv1) = (bv1 OR fill[N](b))


decl_type: formula
theory: bv_bitwise_rules
library: bitvectors
signature: nil
location: 46 2 47 62
body:
    bv_OR_fill_F          : LEMMA FORALL (bv1: bvec[N]): 
                                   (bv1 OR fill[N](FALSE)) = bv1


decl_type: formula
theory: bv_bitwise_rules
library: bitvectors
signature: nil
location: 49 2 50 72
body:
    bv_OR_fill_T          : LEMMA FORALL (bv1: bvec[N]): 
                                    (bv1 OR fill[N](TRUE)) = fill[N](TRUE)


decl_type: formula
theory: bv_bitwise_rules
library: bitvectors
signature: nil
location: 52 2 53 67
body:
    bv_OR_bv_eq          : LEMMA FORALL (bv1, bv2: bvec[N]):
                                    (bv1 = bv2) => (bv1 OR bv2) = bv1


decl_type: formula
theory: bv_bitwise_rules
library: bitvectors
signature: nil
location: 55 2 56 79
body:
    bv_OR_associative    : LEMMA FORALL (bv1, bv2, bv3: bvec[N]):
                                    (bv1 OR (bv2 OR bv3)) = ((bv1 OR bv2) OR bv3)


decl_type: formula
theory: bv_bitwise_rules
library: bitvectors
signature: nil
location: 58 2 59 78
body:
    bv_OR_bv_bv_2eq      : LEMMA FORALL (bv1, bv2, bv3: bvec[N]):
                             (bv1 = bv2) => (bv1 OR (bv2 OR bv3)) = (bv2 OR bv3)


decl_type: formula
theory: bv_bitwise_rules
library: bitvectors
signature: nil
location: 61 2 62 70
body:
    bv_XOR_fill_normalize: LEMMA FORALL (bv1 : bvec[N]):
                             (fill[N](b) XOR bv1) = (bv1 XOR fill[N](b))


decl_type: formula
theory: bv_bitwise_rules
library: bitvectors
signature: nil
location: 64 2 65 57
body:
    bv_XOR_fill_F        : LEMMA FORALL (bv1: bvec[N]): 
                             (bv1 XOR fill[N](FALSE)) = bv1


decl_type: formula
theory: bv_bitwise_rules
library: bitvectors
signature: nil
location: 67 2 68 62
body:
    bv_XOR_fill_T        : LEMMA FORALL (bv1: bvec[N]): 
                             (bv1 XOR fill[N](TRUE)) = (NOT bv1)


decl_type: formula
theory: bv_bitwise_rules
library: bitvectors
signature: nil
location: 70 2 71 72
body:
    bv_XOR_bv_2eq        : LEMMA FORALL (bv1, bv2: bvec[N]):
                             (bv1 = bv2) => (bv1 XOR bv2) = fill[N](FALSE)


decl_type: formula
theory: bv_bitwise_rules
library: bitvectors
signature: nil
location: 73 2 74 76
body:
    bv_XOR_associative   : LEMMA FORALL (bv1, bv2, bv3: bvec[N]):
                             (bv1 XOR (bv2 XOR bv3)) = ((bv1 XOR bv2) XOR bv3)


decl_type: formula
theory: bv_bitwise_rules
library: bitvectors
signature: nil
location: 76 2 77 70
body:
    bv_XOR_bv_bv_2eq     : LEMMA FORALL (bv1, bv2, bv3: bvec[N]):
                              bv1 = bv2 => (bv1 XOR (bv2 XOR bv3)) = bv3


decl_type: formula
theory: bv_nat_rules
library: bitvectors
signature: nil
location: 12 2 14 59
body:
    bv2nat_top_bit_F: LEMMA FORALL (bvn: bvec[n]):
                               n > 0 AND bv2nat(bvn) < exp2(n-1) 
                                    IMPLIES bvn^(n-1) = FALSE


decl_type: formula
theory: bv_nat_rules
library: bitvectors
signature: nil
location: 16 2 18 58
body:
    bv2nat_top_bit_T: LEMMA FORALL (bvn: bvec[n]): 
                               n > 0 AND bv2nat(bvn) >= exp2(n-1) 
                                    IMPLIES bvn^(n-1) = TRUE 


decl_type: formula
theory: bv_nat_rules
library: bitvectors
signature: nil
location: 20 2 21 73
body:
    bv2nat_inj_rule : LEMMA FORALL (bv1, bv2: bvec[n]): bv2nat(bv1) = bv2nat(bv2) 
                                                          IMPLIES bv1 = bv2


decl_type: tcc
theory: bv_nat_rules
library: bitvectors
signature: nil
location: 31 0 33 999
body:
  % Subtype TCC generated (at line 13, column 58) for  n - 1
      % expected type  nat
  bv2nat_top_bit_F_TCC1: OBLIGATION FORALL (n: nat): n > 0 IMPLIES n - 1 >= 0;


decl_type: tcc
theory: bv_nat_rules
library: bitvectors
signature: nil
location: 35 0 40 999
body:
  % Subtype TCC generated (at line 14, column 47) for  (n - 1)
      % expected type  below[n]
  bv2nat_top_bit_F_TCC2: OBLIGATION
    FORALL (n: nat, bvn: bvec[n]):
      n > 0 AND bv2nat(bvn) < exp2(n - 1) IMPLIES
       (n - 1) >= 0 AND (n - 1) < n;


decl_type: tcc
theory: bv_nat_rules
library: bitvectors
signature: nil
location: 42 0 47 999
body:
  % Subtype TCC generated (at line 18, column 47) for  (n - 1)
      % expected type  below[n]
  bv2nat_top_bit_T_TCC1: OBLIGATION
    FORALL (n: nat, bvn: bvec[n]):
      n > 0 AND bv2nat(bvn) >= exp2(n - 1) IMPLIES
       (n - 1) >= 0 AND (n - 1) < n;


decl_type: formula
theory: mod_rules
library: bitvectors
signature: nil
location: 22 2 23 57
body:
    mod_wrap_rule1: LEMMA n < m AND k <= m AND k >= m-n
                            IMPLIES mod(n+k, m) = n - (m-k)


decl_type: formula
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 11 2 12 75
body:
    bv_sign_of_frag_neg: LEMMA FORALL (bvn: bvec[N], i: below[N]):
                                  bv2int(bvn) < 0 => bv2int(bvn^(N-1, i)) < 0


decl_type: formula
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 14 2 15 77
body:
    bv_sign_of_frag_pos: LEMMA FORALL (bvn: bvec[N], i: below[N]):
                                  bv2int(bvn) >= 0 => bv2int(bvn^(N-1, i)) >= 0


decl_type: formula
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 18 2 19 78
body:
    bv2int_top   : THEOREM FORALL (bv: bvec[N], i: below[N]):
                                 bv2int(bv^(N-1,i)) = floor(bv2int(bv)/ exp2(i))


decl_type: formula
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 22 2 25 60
body:
    bv2int_concat : LEMMA FORALL (n, m: posnat, bvn: bvec[n], bvm: bvec[m]):
                           bv2int(bvn o bvm) = 
                               bv2int(bvn) * exp2(m) + bv2int(bvm) 
                                  + (b2n(bvm^(m-1)) * exp2(m))


decl_type: formula
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 27 2 29 80
body:
    bv2int_bottom : THEOREM FORALL (bv: bvec[N], i: below[N]):
                              bv2int(bv^(i,0)) 
                               = mod(bv2int(bv),exp2(i+1)) - exp2(i+1)*b2n(bv^(i)) 


decl_type: formula
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 31 2 33 70
body:
    in_small_rng   : LEMMA (FORALL (bv: bvec[N], i: below[N]):
                             i > 0 AND in_rng_2s_comp[i](bv2int(bv)) IMPLIES
                                       (bv = fill[N-i](bv^(N-1)) o bv^(i-1,0)))


decl_type: formula
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 36 2 38 70
body:
    in_rng_i_bv2int: LEMMA FORALL (bv: bvec[N], i: below[N]): i > 0 
                               AND in_rng_2s_comp[i](bv2int(bv)) IMPLIES
                                   bv2int[N](bv) = bv2int[i](bv^(i-1,0))


