# Declarations

decl_type: formula
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 40 2 41 63
body:
    bv_caret_negate: LEMMA FORALL (bv1: bvec[N], m: below[N]): 
                                      (-bv1)^(m,0) = -(bv1^(m,0))


decl_type: formula
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 44 2 46 70
body:
    bv2int_in_rng_i    : LEMMA FORALL (bv: bvec[N], n: {np: posnat | np < N}):
                             in_rng_2s_comp[n](bv2int(bv)) => 
                                (bv = fill[N-n](bv^(n-1)) o bv^(n-1, 0))


decl_type: formula
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 48 2 50 66
body:
    bv2int_in_rng_i_top: LEMMA FORALL (bv: bvec[N], n: {np: posnat | np < N}):
                              in_rng_2s_comp[n](bv2int(bv)) => 
                                 (bv^(N-1, n) = fill[N-n](bv^(n-1)))


decl_type: formula
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 55 2 57 59
body:
    bv2int_of_sign_extension: LEMMA FORALL (bv: bvec[N], n: {np: posnat | np < N}):
                          in_rng_2s_comp[n](bv2int(bv)) =>
                             bv2int(bv^(n-1, 0)) = bv2int(bv)


decl_type: tcc
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 65 0 69 999
body:
  % Subtype TCC generated (at line 12, column 63) for  N - 1
      % expected type  below(N)
  bv_sign_of_frag_neg_TCC1: OBLIGATION
    FORALL (N: posnat, bvn: bvec[N], i: below[N]):
      bv2int(bvn) < 0 IMPLIES N - 1 >= 0 AND N - 1 < N;


decl_type: tcc
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 71 0 75 999
body:
  % Subtype TCC generated (at line 12, column 68) for  i
      % expected type  upto(N - 1)
  bv_sign_of_frag_neg_TCC2: OBLIGATION
    FORALL (N: posnat, bvn: bvec[N], i: below[N]):
      bv2int(bvn) < 0 IMPLIES i <= N - 1;


decl_type: tcc
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 77 0 81 999
body:
  % Subtype TCC generated (at line 12, column 63) for  N - i
      % expected type  posnat
  bv_sign_of_frag_neg_TCC3: OBLIGATION
    FORALL (N: posnat, bvn: bvec[N], i: below[N]):
      bv2int(bvn) < 0 IMPLIES N - i >= 0 AND N - i > 0;


decl_type: tcc
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 83 0 87 999
body:
  % Subtype TCC generated (at line 15, column 64) for  N - 1
      % expected type  below(N)
  bv_sign_of_frag_pos_TCC1: OBLIGATION
    FORALL (N: posnat, bvn: bvec[N], i: below[N]):
      bv2int(bvn) >= 0 IMPLIES N - 1 >= 0 AND N - 1 < N;


decl_type: tcc
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 89 0 93 999
body:
  % Subtype TCC generated (at line 15, column 69) for  i
      % expected type  upto(N - 1)
  bv_sign_of_frag_pos_TCC2: OBLIGATION
    FORALL (N: posnat, bvn: bvec[N], i: below[N]):
      bv2int(bvn) >= 0 IMPLIES i <= N - 1;


decl_type: tcc
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 95 0 99 999
body:
  % Subtype TCC generated (at line 15, column 64) for  N - i
      % expected type  posnat
  bv_sign_of_frag_pos_TCC3: OBLIGATION
    FORALL (N: posnat, bvn: bvec[N], i: below[N]):
      bv2int(bvn) >= 0 IMPLIES N - i >= 0 AND N - i > 0;


decl_type: tcc
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 101 0 104 999
body:
  % Subtype TCC generated (at line 19, column 42) for  N - 1
      % expected type  below(N)
  bv2int_top_TCC1: OBLIGATION
    FORALL (N: posnat, i: below[N]): N - 1 >= 0 AND N - 1 < N;


decl_type: tcc
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 106 0 108 999
body:
  % Subtype TCC generated (at line 19, column 46) for  i
      % expected type  upto(N - 1)
  bv2int_top_TCC2: OBLIGATION FORALL (N: posnat, i: below[N]): i <= N - 1;


decl_type: tcc
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 110 0 113 999
body:
  % Subtype TCC generated (at line 19, column 42) for  N - i
      % expected type  posnat
  bv2int_top_TCC3: OBLIGATION
    FORALL (N: posnat, i: below[N]): N - i >= 0 AND N - i > 0;


decl_type: tcc
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 115 0 117 999
body:
  % Subtype TCC generated (at line 22, column 70) for  m + n
      % expected type  posnat
  bv2int_concat_TCC1: OBLIGATION FORALL (n, m: posnat): m + n > 0;


decl_type: tcc
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 119 0 122 999
body:
  % Subtype TCC generated (at line 25, column 44) for  (m - 1)
      % expected type  below[m]
  bv2int_concat_TCC2: OBLIGATION
    FORALL (n, m: posnat): (m - 1) >= 0 AND (m - 1) < m;


decl_type: tcc
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 124 0 126 999
body:
  % Subtype TCC generated (at line 28, column 41) for  0
      % expected type  upto(i)
  bv2int_bottom_TCC1: OBLIGATION FORALL (N: posnat, i: below[N]): 0 <= i;


decl_type: tcc
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 128 0 132 999
body:
  % Subtype TCC generated (at line 33, column 41) for  N - i
      % expected type  nat
  in_small_rng_TCC1: OBLIGATION
    FORALL (N: posnat, bv: bvec[N], i: below[N]):
      i > 0 AND in_rng_2s_comp[i](bv2int(bv)) IMPLIES N - i >= 0;


decl_type: tcc
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 134 0 139 999
body:
  % Subtype TCC generated (at line 33, column 62) for  i - 1
      % expected type  below(N)
  in_small_rng_TCC2: OBLIGATION
    FORALL (N: posnat, bv: bvec[N], i: below[N]):
      i > 0 AND in_rng_2s_comp[i](bv2int(bv)) IMPLIES
       i - 1 >= 0 AND i - 1 < N;


decl_type: tcc
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 141 0 145 999
body:
  % Subtype TCC generated (at line 33, column 66) for  0
      % expected type  upto(i - 1)
  in_small_rng_TCC3: OBLIGATION
    FORALL (N: posnat, bv: bvec[N], i: below[N]):
      i > 0 AND in_rng_2s_comp[i](bv2int(bv)) IMPLIES 0 <= i - 1;


decl_type: tcc
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 147 0 151 999
body:
  % Subtype TCC generated (at line 46, column 50) for  (n - 1)
      % expected type  below[N]
  bv2int_in_rng_i_TCC1: OBLIGATION
    FORALL (N: posnat, bv: bvec[N], n: {np: posnat | np < N}):
      in_rng_2s_comp[n](bv2int(bv)) IMPLIES (n - 1) >= 0 AND (n - 1) < N;


decl_type: tcc
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 153 0 157 999
body:
  % Subtype TCC generated (at line 46, column 41) for  N - n
      % expected type  nat
  bv2int_in_rng_i_TCC2: OBLIGATION
    FORALL (N: posnat, bv: bvec[N], n: {np: posnat | np < N}):
      in_rng_2s_comp[n](bv2int(bv)) IMPLIES N - n >= 0;


decl_type: tcc
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 159 0 163 999
body:
  % Subtype TCC generated (at line 46, column 67) for  0
      % expected type  upto(n - 1)
  bv2int_in_rng_i_TCC3: OBLIGATION
    FORALL (N: posnat, bv: bvec[N], n: {np: posnat | np < N}):
      in_rng_2s_comp[n](bv2int(bv)) IMPLIES 0 <= n - 1;


decl_type: tcc
theory: bv_arith_int_caret
library: bitvectors
signature: nil
location: 165 0 169 999
body:
  % Subtype TCC generated (at line 50, column 41) for  n
      % expected type  upto(N - 1)
  bv2int_in_rng_i_top_TCC1: OBLIGATION
    FORALL (N: posnat, bv: bvec[N], n: {np: posnat | np < N}):
      in_rng_2s_comp[n](bv2int(bv)) IMPLIES n <= N - 1;


decl_type: formula
theory: bv_adder
library: bitvectors
signature: nil
location: 78 3 80 52
body:
     adder_correct_rec: LEMMA 
         exp2(n+1)*n_cout_rec(n,x,y,a_cin)+bv2nat_rec(n+1,bv_adder(x,y,a_cin)) =
         bv2nat_rec(n+1,x) + bv2nat_rec(n+1,y) + a_cin


decl_type: formula
theory: bv_adder
library: bitvectors
signature: nil
location: 82 3 84 36
body:
     adder_correct: THEOREM 
         exp2(N)*n_cout_rec(N-1,x,y,a_cin) + bv2nat(bv_adder(x,y,a_cin)) =  
         bv2nat(x) + bv2nat(y) + a_cin


decl_type: function
theory: bv_adder
library: bitvectors
signature: [[below[N], bvec[N], bvec[N], bit] -> bit]
location: 66 3 70 14
body:
     n_cout_rec (n,x,y,a_cin): RECURSIVE bit =
       IF n =0 THEN oba_cout(x^(0),y^(0),a_cin)
       ELSE oba_cout(x^(n),y^(n),n_cout_rec(n-1,x,y,a_cin))
       ENDIF
       MEASURE n


decl_type: function
theory: bv_adder
library: bitvectors
signature: [[bvec[N], bvec[N], bit] -> bvec[N]]
location: 72 3 76 12
body:
     bv_adder(x,y,a_cin): bvec[N] =
       (LAMBDA (i:below(N)): 
        IF i=0 THEN oba_sum(x^(0),y^(0),a_cin)
        ELSE oba_sum(x^(i),y^(i),n_cout_rec(i-1,x,y,a_cin))
        ENDIF)


decl_type: tcc
theory: bv_adder
library: bitvectors
signature: nil
location: 104 0 106 999
body:
  % Subtype TCC generated (at line 67, column 30) for  (0)
      % expected type  below[N]
  n_cout_rec_TCC1: OBLIGATION FORALL (n: below[N]): n = 0 IMPLIES (0) < N;


decl_type: tcc
theory: bv_adder
library: bitvectors
signature: nil
location: 108 0 111 999
body:
  % Subtype TCC generated (at line 68, column 42) for  n - 1
      % expected type  below[N]
  n_cout_rec_TCC2: OBLIGATION
    FORALL (n: below[N]): NOT n = 0 IMPLIES n - 1 >= 0 AND n - 1 < N;


decl_type: tcc
theory: bv_adder
library: bitvectors
signature: nil
location: 113 0 116 999
body:
  % Termination TCC generated (at line 68, column 31) for
      % n_cout_rec(n - 1, x, y, a_cin)
  n_cout_rec_TCC3: OBLIGATION
    FORALL (n: below[N]): NOT n = 0 IMPLIES n - 1 < n;


decl_type: tcc
theory: bv_adder
library: bitvectors
signature: nil
location: 118 0 120 999
body:
  % Subtype TCC generated (at line 79, column 52) for  n + 1
      % expected type  upto(N)
  adder_correct_rec_TCC1: OBLIGATION FORALL (n: below[N]): n + 1 <= N;


decl_type: tcc
theory: bv_adder
library: bitvectors
signature: nil
location: 122 0 124 999
body:
  % Subtype TCC generated (at line 83, column 26) for  N - 1
      % expected type  below[N]
  adder_correct_TCC1: OBLIGATION N - 1 >= 0 AND N - 1 < N;


decl_type: formula
theory: bv_rotate
library: bitvectors
signature: nil
location: 33 2 34 75
body:
    rotate_right_lem : LEMMA rotate_right(k,bv)^i =
                               IF i+k < N THEN bv^(i+k) ELSE bv^(i+k-N) ENDIF


decl_type: formula
theory: bv_rotate
library: bitvectors
signature: nil
location: 38 2 39 76
body:
    rotate_left_lem  : LEMMA rotate_left(k,bv)^i = 
                               IF i-k >= 0 THEN bv^(i-k) ELSE bv^(N+i-k) ENDIF


decl_type: function
theory: bv_rotate
library: bitvectors
signature: [[upto(N), bvec[N]] -> bvec[N]]
location: 15 2 17 40
body:
    rotate_right(k: upto(N), bv: bvec[N]): bvec[N] = 
       IF (k = 0) OR (k = N) THEN bv 
       ELSE bv^(k-1,0) o bv^(N-1, k) ENDIF


decl_type: function
theory: bv_rotate
library: bitvectors
signature: [[upto(N), bvec[N]] -> bvec[N]]
location: 19 2 21 44
body:
    rotate_left(k: upto(N), bv: bvec[N]): bvec[N] =
       IF (k=0) OR (k = N) THEN bv 
       ELSE bv^(N-k-1, 0) o bv^(N-1,N-k) ENDIF


decl_type: tcc
theory: bv_rotate
library: bitvectors
signature: nil
location: 50 0 54 999
body:
  % Subtype TCC generated (at line 17, column 14) for  k - 1
      % expected type  below(N)
  rotate_right_TCC1: OBLIGATION
    FORALL (k: upto(N)):
      NOT (k = 0) AND NOT (k = N) IMPLIES k - 1 >= 0 AND k - 1 < N;


decl_type: tcc
theory: bv_rotate
library: bitvectors
signature: nil
location: 56 0 59 999
body:
  % Subtype TCC generated (at line 17, column 18) for  0
      % expected type  upto(k - 1)
  rotate_right_TCC2: OBLIGATION
    FORALL (k: upto(N)): NOT (k = 0) AND NOT (k = N) IMPLIES 0 <= k - 1;


decl_type: tcc
theory: bv_rotate
library: bitvectors
signature: nil
location: 61 0 65 999
body:
  % Subtype TCC generated (at line 17, column 27) for  N - 1
      % expected type  below(N)
  rotate_right_TCC3: OBLIGATION
    FORALL (k: upto(N)):
      NOT (k = 0) AND NOT (k = N) IMPLIES N - 1 >= 0 AND N - 1 < N;


decl_type: tcc
theory: bv_rotate
library: bitvectors
signature: nil
location: 67 0 70 999
body:
  % Subtype TCC generated (at line 17, column 32) for  k
      % expected type  upto(N - 1)
  rotate_right_TCC4: OBLIGATION
    FORALL (k: upto(N)): NOT (k = 0) AND NOT (k = N) IMPLIES k <= N - 1;


decl_type: tcc
theory: bv_rotate
library: bitvectors
signature: nil
location: 72 0 75 999
body:
  % Subtype TCC generated (at line 17, column 27) for  N - k
      % expected type  nat
  rotate_right_TCC5: OBLIGATION
    FORALL (k: upto(N)): NOT (k = 0) AND NOT (k = N) IMPLIES N - k >= 0;


decl_type: tcc
theory: bv_rotate
library: bitvectors
signature: nil
location: 77 0 81 999
body:
  % Subtype TCC generated (at line 21, column 14) for  N - k - 1
      % expected type  below(N)
  rotate_left_TCC1: OBLIGATION
    FORALL (k: upto(N)):
      NOT (k = 0) AND NOT (k = N) IMPLIES N - k - 1 >= 0 AND N - k - 1 < N;


decl_type: tcc
theory: bv_rotate
library: bitvectors
signature: nil
location: 83 0 86 999
body:
  % Subtype TCC generated (at line 21, column 21) for  0
      % expected type  upto(N - 1 - k)
  rotate_left_TCC2: OBLIGATION
    FORALL (k: upto(N)): NOT (k = 0) AND NOT (k = N) IMPLIES 0 <= N - 1 - k;


decl_type: tcc
theory: bv_rotate
library: bitvectors
signature: nil
location: 88 0 92 999
body:
  % Subtype TCC generated (at line 21, column 34) for  N - k
      % expected type  upto(N - 1)
  rotate_left_TCC3: OBLIGATION
    FORALL (k: upto(N)):
      NOT (k = 0) AND NOT (k = N) IMPLIES N - k >= 0 AND N - k <= N - 1;


decl_type: tcc
theory: bv_rotate
library: bitvectors
signature: nil
location: 94 0 96 999
body:
  % Subtype TCC generated (at line 23, column 46) for  1
      % expected type  upto(N)
  rot_r1_TCC1: OBLIGATION 1 <= N;


decl_type: tcc
theory: bv_rotate
library: bitvectors
signature: nil
location: 98 0 100 999
body:
  % Subtype TCC generated (at line 31, column 40) for  0
      % expected type  upto(N)
  rotate_right_0_TCC1: OBLIGATION 0 <= N;


decl_type: tcc
theory: bv_rotate
library: bitvectors
signature: nil
location: 102 0 106 999
body:
  % Subtype TCC generated (at line 34, column 63) for  (i + k - N)
      % expected type  below[N]
  rotate_right_lem_TCC1: OBLIGATION
    FORALL (i: below(N), k: upto(N)):
      NOT i + k < N IMPLIES (i + k - N) >= 0 AND (i + k - N) < N;


decl_type: tcc
theory: bv_rotate
library: bitvectors
signature: nil
location: 108 0 111 999
body:
  % Subtype TCC generated (at line 39, column 50) for  (i - k)
      % expected type  below[N]
  rotate_left_lem_TCC1: OBLIGATION
    FORALL (i: below(N), k: upto(N)): i - k >= 0 IMPLIES (i - k) < N;


decl_type: tcc
theory: bv_rotate
library: bitvectors
signature: nil
location: 113 0 117 999
body:
  % Subtype TCC generated (at line 39, column 64) for  (N + i - k)
      % expected type  below[N]
  rotate_left_lem_TCC2: OBLIGATION
    FORALL (i: below(N), k: upto(N)):
      NOT i - k >= 0 IMPLIES (N + i - k) >= 0 AND (N + i - k) < N;


decl_type: function
theory: bv_shift
library: bitvectors
signature: [[nat, bvec[N]] -> bvec[N]]
location: 20 2 23 29
body:
    right_shift(i: nat, bv: bvec[N]): bvec[N] =
      IF i = 0 THEN bv
      ELSIF i < N THEN fill[i](FALSE) o bv^(N-1, i) 
      ELSE fill[N](FALSE) ENDIF


decl_type: function
theory: bv_shift
library: bitvectors
signature: [[nat, bvec[N]] -> bvec[N]]
location: 26 2 29 29
body:
    left_shift(i: nat, bv: bvec[N]): bvec[N] =
      IF i = 0 THEN bv
      ELSIF i < N THEN bv^(N-i-1, 0) o fill[i](FALSE) 
      ELSE fill[N](FALSE) ENDIF


decl_type: function
theory: bv_shift
library: bitvectors
signature: [[k: upto(N), bvec[k], bvec[N]] -> bvec[N]]
location: 37 2 39 35
body:
    left_shift_with(k: upto(N), bvk: bvec[k], bv: bvec[N]): bvec[N] =
       IF k = N THEN bvk
       ELSE bv^(N-k-1, 0) o bvk ENDIF


decl_type: function
theory: bv_shift
library: bitvectors
signature: [[k: upto(N), bvec[k], bvec[N]] -> bvec[N]]
location: 41 2 43 33
body:
    right_shift_with(k: upto(N), bvk: bvec[k], bv: bvec[N]): bvec[N] =
       IF k = N THEN bvk
       ELSE bvk o bv^(N-1, k) ENDIF


decl_type: tcc
theory: bv_shift
library: bitvectors
signature: nil
location: 50 0 53 999
body:
  % Subtype TCC generated (at line 22, column 42) for  N - 1
      % expected type  below(N)
  right_shift_TCC1: OBLIGATION
    FORALL (i: nat): i < N AND NOT i = 0 IMPLIES N - 1 >= 0 AND N - 1 < N;


decl_type: tcc
theory: bv_shift
library: bitvectors
signature: nil
location: 55 0 58 999
body:
  % Subtype TCC generated (at line 22, column 47) for  i
      % expected type  upto(N - 1)
  right_shift_TCC2: OBLIGATION
    FORALL (i: nat): i < N AND NOT i = 0 IMPLIES i <= N - 1;


decl_type: tcc
theory: bv_shift
library: bitvectors
signature: nil
location: 60 0 63 999
body:
  % Subtype TCC generated (at line 22, column 42) for  N - i
      % expected type  nat
  right_shift_TCC3: OBLIGATION
    FORALL (i: nat): i < N AND NOT i = 0 IMPLIES N - i >= 0;


decl_type: tcc
theory: bv_shift
library: bitvectors
signature: nil
location: 65 0 69 999
body:
  % Subtype TCC generated (at line 28, column 25) for  N - i - 1
      % expected type  below(N)
  left_shift_TCC1: OBLIGATION
    FORALL (i: nat):
      i < N AND NOT i = 0 IMPLIES N - i - 1 >= 0 AND N - i - 1 < N;


decl_type: tcc
theory: bv_shift
library: bitvectors
signature: nil
location: 71 0 74 999
body:
  % Subtype TCC generated (at line 28, column 32) for  0
      % expected type  upto(N - 1 - i)
  left_shift_TCC2: OBLIGATION
    FORALL (i: nat): i < N AND NOT i = 0 IMPLIES 0 <= N - 1 - i;


decl_type: tcc
theory: bv_shift
library: bitvectors
signature: nil
location: 76 0 80 999
body:
  % Subtype TCC generated (at line 38, column 19) for  bvk
      % expected type  bvec[N]
  left_shift_with_TCC1: OBLIGATION
    FORALL (k: upto(N), bvk: bvec[k]):
      k = N IMPLIES (FORALL (x: nat): bvk(x) IMPLIES (x < k IFF x < N));


decl_type: tcc
theory: bv_shift
library: bitvectors
signature: nil
location: 82 0 85 999
body:
  % Subtype TCC generated (at line 39, column 14) for  N - k - 1
      % expected type  below(N)
  left_shift_with_TCC2: OBLIGATION
    FORALL (k: upto(N)): NOT k = N IMPLIES N - k - 1 >= 0 AND N - k - 1 < N;


decl_type: tcc
theory: bv_shift
library: bitvectors
signature: nil
location: 87 0 90 999
body:
  % Subtype TCC generated (at line 39, column 21) for  0
      % expected type  upto(N - 1 - k)
  left_shift_with_TCC3: OBLIGATION
    FORALL (k: upto(N)): NOT k = N IMPLIES 0 <= N - 1 - k;


decl_type: tcc
theory: bv_shift
library: bitvectors
signature: nil
location: 92 0 95 999
body:
  % Subtype TCC generated (at line 39, column 14) for  N - k
      % expected type  nat
  left_shift_with_TCC4: OBLIGATION
    FORALL (k: upto(N)): NOT k = N IMPLIES N - k >= 0;


decl_type: tcc
theory: bv_shift
library: bitvectors
signature: nil
location: 97 0 100 999
body:
  % Subtype TCC generated (at line 43, column 20) for  N - 1
      % expected type  below(N)
  right_shift_with_TCC1: OBLIGATION
    FORALL (k: upto(N)): NOT k = N IMPLIES N - 1 >= 0 AND N - 1 < N;


decl_type: tcc
theory: bv_shift
library: bitvectors
signature: nil
location: 102 0 105 999
body:
  % Subtype TCC generated (at line 43, column 25) for  k
      % expected type  upto(N - 1)
  right_shift_with_TCC2: OBLIGATION
    FORALL (k: upto(N)): NOT k = N IMPLIES k <= N - 1;


decl_type: tcc
theory: bv_fract
library: bitvectors
signature: nil
location: 49 0 51 999
body:
  % Subtype TCC generated (at line 19, column 52) for  N - 1
      % expected type  nat
  fract_numerator_range_TCC1: OBLIGATION N - 1 >= 0;


decl_type: tcc
theory: bv_fract
library: bitvectors
signature: nil
location: 53 0 55 999
body:
  % Subtype TCC generated (at line 24, column 53) for  0
      % expected type  bv2fract_range
  bv2fract_range_TCC1: OBLIGATION bv2fract_range(0);


decl_type: tcc
theory: bv_fract
library: bitvectors
signature: nil
location: 57 0 59 999
body:
  % Subtype TCC generated (at line 33, column 34) for  1 / exp2(N - 1)
      % expected type  bv2fract_range
  min_pos_fract_TCC1: OBLIGATION bv2fract_range(1 / exp2(N - 1));


decl_type: tcc
theory: bv_fract
library: bitvectors
signature: nil
location: 61 0 63 999
body:
  % Subtype TCC generated (at line 34, column 34) for  1 - 1 / exp2(N - 1)
      % expected type  bv2fract_range
  max_pos_fract_TCC1: OBLIGATION bv2fract_range(1 - 1 / exp2(N - 1));


decl_type: tcc
theory: bv_fract
library: bitvectors
signature: nil
location: 65 0 67 999
body:
  % Subtype TCC generated (at line 36, column 34) for  -1 / exp2(N - 1)
      % expected type  bv2fract_range
  min_neg_fract_TCC1: OBLIGATION bv2fract_range(-1 / exp2(N - 1));


decl_type: tcc
theory: bv_fract
library: bitvectors
signature: nil
location: 69 0 71 999
body:
  % Subtype TCC generated (at line 37, column 34) for  -1 + 1 / exp2(N - 1)
      % expected type  bv2fract_range
  max_neg_fract_TCC1: OBLIGATION bv2fract_range(-1 + 1 / exp2(N - 1));


decl_type: formula
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 32 2 38 32
body:
    bvec_induction : LEMMA % :-)
      FORALL(p:PRED[bvec[N]]) :
        p(fill[N](FALSE))
          AND
        (FORALL(bv:bvec[N]) : p(bv) IMPLIES p(bv+1))
          IMPLIES
        FORALL(bv:bvec[N]) : p(bv)


decl_type: formula
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 49 2 53 33
body:
    sum_upper_n : LEMMA % :-)
      FORALL(F : [nat -> nat], high,low,n : nat) :
        low <= n AND n <= high
          IMPLIES
        sigma(low, high, F) >= F(n)


decl_type: formula
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 59 2 63 51
body:
    bv2nat_upperbound : LEMMA % :-)
      FORALL(n:below(N)) :
        bv2nat(bv) < exp2(n) 
          IFF
        FORALL(k:below(N)) : k >= n IMPLIES NOT bv(k)


decl_type: formula
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 65 2 72 27
body:
    bv2nat_upperbound_caret : LEMMA % :-)
      FORALL(n:below(N)) :
        bv2nat[N](bv) < exp2(n) 
          IMPLIES
        bv2nat[N](bv) = IF n = 0
                        THEN 0
                        ELSE bv2nat[n](bv^(n-1,0))
                        ENDIF


decl_type: formula
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 106 2 107 74
body:
    bv2int_plus_widens : LEMMA % :-)
      bv2int[2*N](widen(bv1) + widen(bv2)) = bv2int[N](bv1) + bv2int[N](bv2)


decl_type: formula
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 112 2 116 29
body:
    bv2nat_widen : LEMMA % :-)
      bv2nat(widen(bv)) = IF bv2nat(bv) < exp2(N-1)
                          THEN bv2nat(bv)
                          ELSE bv2nat(bv) + exp2(2*N)-exp2(N)
                          ENDIF


decl_type: formula
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 123 2 126 43
body:
    bv2int_narrow : LEMMA % :-)
      -exp2(N-1) <= bv2int(BV) AND bv2int(BV) < exp2(N-1)
        IMPLIES
      bv2int[N](narrow(BV)) = bv2int[2*N](BV)


decl_type: formula
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 128 2 131 41
body:
    narrow_int2bv : LEMMA % :-)
      -exp2(N-1) <= k AND k < exp2(N-1)
        IMPLIES
      narrow(int2bv[2*N](k)) = int2bv[N](k)


decl_type: formula
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 161 2 165 60
body:
    leftshift_inc : LEMMA % :-)
      FORALL(n:below(N-1)) : 
        n > 0  % Condition needed to prevent circular rewriting
          IMPLIES
        left_shift(n+1, bv) = left_shift(1, left_shift(n, bv))


decl_type: formula
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 167 2 171 54
body:
    bv2nat_leftshift : LEMMA % :-)
      FORALL(n:below(N)) :
        bv2nat(bv) < exp2(N-n) 
          IMPLIES 
        bv2nat(left_shift(n, bv)) = exp2(n) * bv2nat(bv)


decl_type: formula
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 173 2 175 56
body:
    bv2nat_rightshift_upperbound : LEMMA % :-)
      FORALL(n:below(N)) :
        exp2(n) * bv2nat(right_shift(n, bv)) <= bv2nat(bv)


decl_type: formula
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 177 2 181 56
body:
    bv2int_rightshift_upperbound : LEMMA % :-)
      FORALL(n:below(N)) : 
        bv2int(bv) >= 0
          IMPLIES
        exp2(n) * bv2int(right_shift(n, bv)) <= bv2int(bv)


decl_type: formula
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 186 2 190 63
body:
    rightshift_inc : LEMMA % :-)
      FORALL(n:below(N-1)) :
        n > 0  % Condition needed to prevent circular rewriting
          IMPLIES
        right_shift(n+1, bv) = right_shift(1, right_shift(n, bv))


decl_type: formula
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 196 2 200 39
body:
    leftshift1_add_aux : LEMMA % :-)
      FORALL(n:below(N-1)) : 
        n_cout_rec[N](n+1, left_shift(1, bv1), left_shift(1, bv2), FALSE)
        =
        n_cout_rec[N](n, bv1, bv2, FALSE)


decl_type: formula
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 202 2 204 44
body:
    leftshift1_add : LEMMA % :-)
     left_shift(1, bv1 + bv2) = 
       left_shift(1, bv1) + left_shift(1, bv2)


decl_type: formula
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 206 2 210 61
body:
    narrow_rightshift : LEMMA % :-)
      FORALL(n:nat) :
      0 <= bv2int(BV) AND bv2int(BV) < exp2(N)
          IMPLIES
        narrow(right_shift(n, BV)) = right_shift(n, narrow(BV))


decl_type: function
theory: BitvectorUtil
library: bitvectors
signature: [bvec[N] -> bvec[2 * N]]
location: 94 2 98 32
body:
    widen(bv) : bvec[2*N] = 
      LAMBDA(k:below(2*N)) : IF k < N-1
                             THEN bv(k) 
                             ELSE bv(N-1) % negative byte
                             ENDIF


decl_type: tcc
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 217 0 219 999
body:
  % Subtype TCC generated (at line 22, column 26) for  N
      % expected type  posnat
  plus_min_zero_TCC1: OBLIGATION N > 0;


decl_type: tcc
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 221 0 223 999
body:
  % Subtype TCC generated (at line 47, column 11) for  0
      % expected type  below(N)
  inc_zero_TCC1: OBLIGATION 0 < N;


decl_type: tcc
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 225 0 229 999
body:
  % Subtype TCC generated (at line 71, column 41) for  n - 1
      % expected type  below(N)
  bv2nat_upperbound_caret_TCC1: OBLIGATION
    FORALL (bv: bvec[N], n: below(N)):
      NOT n = 0 AND bv2nat[N](bv) < exp2(n) IMPLIES n - 1 >= 0 AND n - 1 < N;


decl_type: tcc
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 231 0 235 999
body:
  % Subtype TCC generated (at line 71, column 45) for  0
      % expected type  upto(n - 1)
  bv2nat_upperbound_caret_TCC2: OBLIGATION
    FORALL (bv: bvec[N], n: below(N)):
      NOT n = 0 AND bv2nat[N](bv) < exp2(n) IMPLIES 0 <= n - 1;


decl_type: tcc
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 237 0 239 999
body:
  % Subtype TCC generated (at line 96, column 35) for  k
      % expected type  below(N)
  widen_TCC1: OBLIGATION FORALL (k: below(2 * N)): k < N - 1 IMPLIES k < N;


decl_type: tcc
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 241 0 244 999
body:
  % Subtype TCC generated (at line 97, column 35) for  N - 1
      % expected type  below(N)
  widen_TCC2: OBLIGATION
    FORALL (k: below(2 * N)): NOT k < N - 1 IMPLIES N - 1 >= 0 AND N - 1 < N;


decl_type: tcc
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 246 0 248 999
body:
  % Subtype TCC generated (at line 101, column 11) for  2 * N
      % expected type  posnat
  bv2int_widen_TCC1: OBLIGATION 2 * N > 0;


decl_type: tcc
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 250 0 252 999
body:
  % Subtype TCC generated (at line 113, column 45) for  N - 1
      % expected type  nat
  bv2nat_widen_TCC1: OBLIGATION N - 1 >= 0;


decl_type: tcc
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 254 0 256 999
body:
  % Subtype TCC generated (at line 121, column 29) for  N - 1
      % expected type  below(2 * N)
  narrow_TCC1: OBLIGATION N - 1 >= 0 AND N - 1 < 2 * N;


decl_type: tcc
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 258 0 260 999
body:
  % Subtype TCC generated (at line 121, column 33) for  0
      % expected type  upto(N - 1)
  narrow_TCC2: OBLIGATION 0 <= N - 1;


decl_type: tcc
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 262 0 267 999
body:
  % Subtype TCC generated (at line 131, column 23) for  k
      % expected type  iv: rng_2s_comp[2 * N]
  narrow_int2bv_TCC1: OBLIGATION
    FORALL (k: int):
      k < exp2(N - 1) AND -exp2(N - 1) <= k IMPLIES
       minint[2 * N] <= k AND k <= maxint[2 * N];


decl_type: tcc
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 269 0 274 999
body:
  % Subtype TCC generated (at line 131, column 39) for  k
      % expected type  iv: rng_2s_comp[N]
  narrow_int2bv_TCC2: OBLIGATION
    FORALL (k: int):
      k < exp2(N - 1) AND -exp2(N - 1) <= k IMPLIES
       minint[N] <= k AND k <= maxint[N];


decl_type: tcc
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 276 0 278 999
body:
  % Subtype TCC generated (at line 169, column 24) for  N - n
      % expected type  nat
  bv2nat_leftshift_TCC1: OBLIGATION FORALL (n: below(N)): N - n >= 0;


decl_type: tcc
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 280 0 282 999
body:
  % Subtype TCC generated (at line 198, column 20) for  n + 1
      % expected type  below[N]
  leftshift1_add_aux_TCC1: OBLIGATION FORALL (n: below(N - 1)): n + 1 < N;


decl_type: tcc
theory: BitvectorUtil
library: bitvectors
signature: nil
location: 284 0 286 999
body:
  % Subtype TCC generated (at line 200, column 20) for  n
      % expected type  below[N]
  leftshift1_add_aux_TCC2: OBLIGATION FORALL (n: below(N - 1)): n < N;


decl_type: formula
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 41 2 43 55
body:
    times_rec_zero_right : LEMMA % :-)
      FORALL(n:nat) : 
        times_rec(bv, fill[N](FALSE), n) = fill[N](FALSE)


decl_type: formula
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 45 2 47 55
body:
    times_rec_zero_left : LEMMA % :-)
      FORALL(n:nat) : 
        times_rec(fill[N](FALSE), bv, n) = fill[N](FALSE)


decl_type: formula
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 49 2 53 55
body:
    times_rec_repeat : LEMMA % :-)
      FORALL(n,m:nat) : 
        bv2nat(bv1) < exp2(n)
          IMPLIES
        times_rec(bv1, bv2, n+m) = times_rec(bv1, bv2, n)


decl_type: formula
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 65 2 71 40
body:
    times_rec_inc_right : LEMMA % :-)
      FORALL(n:below(N+1)) : 
        times_rec(bv1, bv2+1, n) = 
          times_rec(bv1, bv2, n) + (IF n = 0
                                    THEN fill[N](FALSE)
                                    ELSE (fill[N-n](FALSE) o bv1 ^ (n-1, 0))
                                    ENDIF)


decl_type: formula
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 73 2 75 34
body:
    times_rec_max_inc_right : LEMMA % :-)
      times_rec(bv1, bv2+1, N) = 
        times_rec(bv1, bv2, N) + bv1


decl_type: formula
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 77 2 81 48
body:
    times_rec_max_inc_n_right : LEMMA % :-)
      FORALL(n:nat) : 
        times_rec(bv1, bv2+n, N) =
          iterate[bvec[N]](LAMBDA(b:bvec[N]) : b + bv1, n)
                          (times_rec(bv1, bv2, N))


decl_type: formula
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 83 2 86 38
body:
    times_rec_iterate : LEMMA % :-)
      times_rec(bv1, bv2, N) =
        iterate[bvec[N]](LAMBDA(b:bvec[N]) : b + bv1, bv2nat(bv2))
                        (fill[N](FALSE))


decl_type: formula
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 91 2 96 25
body:
    bv2nat_iterate : LEMMA % :-)
      FORALL(n:nat) :
        n * bv2nat(bv1) < exp2(N) 
          IMPLIES
        bv2nat(iterate[bvec[N]](LAMBDA(b:bvec[N]) : b + bv1, n)(fill[N](FALSE)))
          = n * bv2nat(bv1)


decl_type: formula
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 98 2 103 25
body:
    bv2int_iterate : LEMMA % :-)
      FORALL(n:nat) :
        -exp2(N-1) <= n * bv2int(bv1) AND n * bv2int(bv1) < exp2(N-1) 
          IMPLIES
        bv2int(iterate[bvec[N]](LAMBDA(b:bvec[N]) : b + bv1, n)(fill[N](FALSE)))
          = n * bv2int(bv1)


decl_type: formula
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 107 2 113 40
body:
    iterate_inc : LEMMA % :-)
      FORALL(n:nat) :
        iterate[bvec[N]](LAMBDA (b:bvec[N]): b + (bv1 + 1), n)
                        (fill[N](FALSE))
        =
        iterate[bvec[N]](LAMBDA (b:bvec[N]): b + bv1, n)
                      (fill[N](FALSE)) + n


decl_type: formula
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 115 2 121 46
body:
    iterate_inc_m : LEMMA % :-)
      FORALL(n,m:nat) :
        iterate[bvec[N]](LAMBDA (b:bvec[N]): b + (bv1 + m), n)
                        (fill[N](FALSE))
        =
        iterate[bvec[N]](LAMBDA (b:bvec[N]): b + bv1, n)
                      (fill[N](FALSE)) + (n * m)


decl_type: formula
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 123 2 128 20
body:
    iterate_modulo : LEMMA % :-)
      FORALL(i:nat) : 
        iterate[bvec[N]](LAMBDA(b:bvec[N]) : b + bv2, i * exp2(N))
                        (fill[N](FALSE))    
        = 
        fill[N](FALSE)


decl_type: formula
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 130 2 135 36
body:
    iterate_comm : LEMMA % :-)
      iterate[bvec[N]](LAMBDA(b:bvec[N]) : b + bv1, bv2nat(bv2))
                      (fill[N](FALSE))    
      =
      iterate[bvec[N]](LAMBDA(b:bvec[N]) : b + bv2, bv2nat(bv1))
                      (fill[N](FALSE))    


decl_type: formula
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 145 2 151 38
body:
    iterate_min_second : LEMMA % :-)
      FORALL(n:nat) : 
        iterate[bvec[N]](LAMBDA(b:bvec[N]) : b + (-bv), n)
                        (fill[N](FALSE))    
        =
        -iterate[bvec[N]](LAMBDA(b:bvec[N]) : b + bv, n)
                        (fill[N](FALSE))    


decl_type: formula
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 183 2 189 44
body:
    iterate_zero_add : LEMMA % :-)
      FORALL(n:nat) : 
        iterate[bvec[N]](LAMBDA(b:bvec[N]) : b + bv1, n)
                        (bv2)    
        =
        iterate[bvec[N]](LAMBDA(b:bvec[N]) : b + bv1, n)
                        (fill[N](FALSE)) + bv2


decl_type: formula
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 191 2 194 51
body:
    times_rec_distr : LEMMA % :-)
      times_rec(bv1, bv2 + bv3, N)
      =
      times_rec(bv1, bv2, N) + times_rec(bv1, bv3, N)


decl_type: formula
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 202 2 206 78
body:
    times_distr_iterate : LEMMA % :-)
      FORALL(n:nat) :
        bv2 * iterate[bvec[N]](LAMBDA(b:bvec[N]) : b + bv1, n)(fill[N](FALSE))
        =
        iterate[bvec[N]](LAMBDA(b:bvec[N]) : b + (bv2 * bv1), n)(fill[N](FALSE))


decl_type: function
theory: BitvectorMultiplication
library: bitvectors
signature: [[bvec[N], bvec[N], nat] -> bvec[N]]
location: 24 2 31 14
body:
    times_rec(bv1:bvec[N], bv2:bvec[N], n:nat) : RECURSIVE bvec[N] =
      IF n = 0
      THEN fill[N](FALSE)
      ELSIF bv1(0)
      THEN bv2 + left_shift(1, times_rec(right_shift(1, bv1), bv2, n-1))
      ELSE left_shift(1, times_rec(right_shift(1, bv1), bv2, n-1))
      ENDIF
      MEASURE n;


decl_type: tcc
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 225 0 227 999
body:
  % Assuming TCC generated (at line 20, column 12) for  BitvectorUtil[N]
      % generated from assumption BitvectorUtil.N_size
  IMP_BitvectorUtil_TCC1: OBLIGATION N >= 2;


decl_type: tcc
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 229 0 231 999
body:
  % Subtype TCC generated (at line 27, column 14) for  0
      % expected type  below(N)
  times_rec_TCC1: OBLIGATION FORALL (n: nat): NOT n = 0 IMPLIES 0 < N;


decl_type: tcc
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 233 0 236 999
body:
  % Subtype TCC generated (at line 28, column 65) for  n - 1
      % expected type  nat
  times_rec_TCC2: OBLIGATION
    FORALL (bv1: bvec[N], n: nat): bv1(0) AND NOT n = 0 IMPLIES n - 1 >= 0;


decl_type: tcc
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 238 0 241 999
body:
  % Termination TCC generated (at line 28, column 29) for
      % times_rec(right_shift(1, bv1), bv2, n - 1)
  times_rec_TCC3: OBLIGATION
    FORALL (bv1: bvec[N], n: nat): bv1(0) AND NOT n = 0 IMPLIES n - 1 < n;


decl_type: tcc
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 243 0 247 999
body:
  % Subtype TCC generated (at line 29, column 59) for  n - 1
      % expected type  nat
  times_rec_TCC4: OBLIGATION
    FORALL (bv1: bvec[N], n: nat):
      NOT bv1(0) AND NOT n = 0 IMPLIES n - 1 >= 0;


decl_type: tcc
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 249 0 252 999
body:
  % Termination TCC generated (at line 29, column 23) for
      % times_rec(right_shift(1, bv1), bv2, n - 1)
  times_rec_TCC5: OBLIGATION
    FORALL (bv1: bvec[N], n: nat): NOT bv1(0) AND NOT n = 0 IMPLIES n - 1 < n;


decl_type: tcc
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 254 0 257 999
body:
  % Subtype TCC generated (at line 70, column 45) for  N - n
      % expected type  nat
  times_rec_inc_right_TCC1: OBLIGATION
    FORALL (n: below(N + 1)): NOT n = 0 IMPLIES N - n >= 0;


decl_type: tcc
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 259 0 262 999
body:
  % Subtype TCC generated (at line 70, column 66) for  n - 1
      % expected type  below(N)
  times_rec_inc_right_TCC2: OBLIGATION
    FORALL (n: below(N + 1)): NOT n = 0 IMPLIES n - 1 >= 0 AND n - 1 < N;


decl_type: tcc
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 264 0 267 999
body:
  % Subtype TCC generated (at line 70, column 71) for  0
      % expected type  upto(n - 1)
  times_rec_inc_right_TCC3: OBLIGATION
    FORALL (n: below(N + 1)): NOT n = 0 IMPLIES 0 <= n - 1;


decl_type: tcc
theory: BitvectorMultiplication
library: bitvectors
signature: nil
location: 269 0 271 999
body:
  % Subtype TCC generated (at line 100, column 12) for  N - 1
      % expected type  nat
  bv2int_iterate_TCC1: OBLIGATION N - 1 >= 0;


decl_type: formula
theory: BitvectorMultiplicationWidenNarrow
library: bitvectors
signature: nil
location: 28 2 31 69
body:
    bv2nat_times_rec : LEMMA % :-)
      bv2nat(BV1) < exp2(N) AND bv2nat(BV2) < exp2(N)
        IMPLIES
      bv2nat(times_rec[2*N](BV1, BV2, 2*N)) = bv2nat(BV1) * bv2nat(BV2)


decl_type: formula
theory: BitvectorMultiplicationWidenNarrow
library: bitvectors
signature: nil
location: 33 2 36 49
body:
    bv2nat_times : LEMMA % :-)
      bv2nat(BV1) * bv2nat(BV2) < exp2(2*N)
        IMPLIES
      bv2nat(BV1 * BV2) = bv2nat(BV1) * bv2nat(BV2)


decl_type: formula
theory: BitvectorMultiplicationWidenNarrow
library: bitvectors
signature: nil
location: 38 2 43 49
body:
    bv2int_times : LEMMA % :-)
     -exp2(2*N-1) < bv2int(BV1) * bv2int(BV2) 
       AND 
     bv2int(BV1) * bv2int(BV2) < exp2(2*N-1)
        IMPLIES
      bv2int(BV1 * BV2) = bv2int(BV1) * bv2int(BV2)


decl_type: formula
theory: BitvectorMultiplicationWidenNarrow
library: bitvectors
signature: nil
location: 50 2 56 54
body:
    bv2int_times_int2bv_first : LEMMA % :-)
      FORALL(k:int) :
       -exp2(2*N-1) < k * bv2int(BV) AND k * bv2int(BV) < exp2(2*N-1)      
         AND
       -exp2(2*N-1) <= k AND k < exp2(2*N-1)      
         IMPLIES
       bv2int[2*N](int2bv[2*N](k) * BV) = k * bv2int(BV)


decl_type: formula
theory: BitvectorMultiplicationWidenNarrow
library: bitvectors
signature: nil
location: 58 2 64 54
body:
    bv2int_times_int2bv_second : LEMMA % :-)
      FORALL(k:int) :
       -exp2(2*N-1) < k * bv2int(BV) AND k * bv2int(BV) < exp2(2*N-1)      
         AND
       -exp2(2*N-1) <= k AND k < exp2(2*N-1)      
         IMPLIES
       bv2int[2*N](BV * int2bv[2*N](k)) = k * bv2int(BV)


decl_type: formula
theory: BitvectorMultiplicationWidenNarrow
library: bitvectors
signature: nil
location: 68 2 73 78
body:
    narrow_iterate : LEMMA % :-)
      FORALL(n:nat) :
        narrow(iterate[bvec[2*N]](LAMBDA(b:bvec[2*N]) : b + BV1, n)
                                 (fill[2*N](FALSE)))
        =
        iterate[bvec[N]](LAMBDA(b:bvec[N]) : b + narrow(BV1), n)(fill[N](FALSE))


decl_type: tcc
theory: BitvectorMultiplicationWidenNarrow
library: bitvectors
signature: nil
location: 105 0 108 999
body:
  % Assuming TCC generated (at line 19, column 12) for
      % BitvectorMultiplication[N]
      % generated from assumption BitvectorMultiplication.N_size
  IMP_BitvectorMultiplication_TCC1: OBLIGATION N >= 2;


decl_type: tcc
theory: BitvectorMultiplicationWidenNarrow
library: bitvectors
signature: nil
location: 110 0 113 999
body:
  % Assuming TCC generated (at line 20, column 12) for
      % BitvectorMultiplication[2 * N]
      % generated from assumption BitvectorMultiplication.N_size
  IMP_BitvectorMultiplication_TCC2: OBLIGATION 2 * N >= 2;


decl_type: tcc
theory: BitvectorMultiplicationWidenNarrow
library: bitvectors
signature: nil
location: 115 0 117 999
body:
  % Subtype TCC generated (at line 39, column 9) for  2 * N - 1
      % expected type  nat
  bv2int_times_TCC1: OBLIGATION 2 * N - 1 >= 0;


decl_type: tcc
theory: BitvectorMultiplicationWidenNarrow
library: bitvectors
signature: nil
location: 119 0 126 999
body:
  % Subtype TCC generated (at line 56, column 29) for  k
      % expected type  iv: rng_2s_comp[2 * N]
  bv2int_times_int2bv_first_TCC1: OBLIGATION
    FORALL (BV: bvec[2 * N], k: int):
      -exp2(2 * N - 1) < k * bv2int(BV) AND
       k * bv2int(BV) < exp2(2 * N - 1) AND
        -exp2(2 * N - 1) <= k AND k < exp2(2 * N - 1)
       IMPLIES minint[2 * N] <= k AND k <= maxint[2 * N];


decl_type: tcc
theory: BitvectorMultiplicationWidenNarrow
library: bitvectors
signature: nil
location: 128 0 130 999
body:
  % Subtype TCC generated (at line 76, column 38) for  2 * N - 1
      % expected type  below(2 * N)
  bv2nat_split_TCC1: OBLIGATION 2 * N - 1 >= 0 AND 2 * N - 1 < 2 * N;


decl_type: tcc
theory: BitvectorMultiplicationWidenNarrow
library: bitvectors
signature: nil
location: 132 0 134 999
body:
  % Subtype TCC generated (at line 76, column 44) for  N
      % expected type  upto(2 * N - 1)
  bv2nat_split_TCC2: OBLIGATION N <= 2 * N - 1;


decl_type: tcc
theory: BitvectorMultiplicationWidenNarrow
library: bitvectors
signature: nil
location: 136 0 138 999
body:
  % Subtype TCC generated (at line 76, column 61) for  N - 1
      % expected type  below(2 * N)
  bv2nat_split_TCC3: OBLIGATION N - 1 >= 0 AND N - 1 < 2 * N;


decl_type: tcc
theory: BitvectorMultiplicationWidenNarrow
library: bitvectors
signature: nil
location: 140 0 142 999
body:
  % Subtype TCC generated (at line 76, column 65) for  0
      % expected type  upto(N - 1)
  bv2nat_split_TCC4: OBLIGATION 0 <= N - 1;


decl_type: formula
theory: DivisionUtil
library: bitvectors
signature: nil
location: 18 2 22 79
body:
    leftshift_with : LEMMA % :-)
      FORALL(n:nat, bv:bvec[n], b:bool) : 
        n > 1 AND bv2nat[n](bv) < exp2(n-1)
          IMPLIES
        bv2nat[n](left_shift(1, bv) WITH [(0) := b]) = 2 * bv2nat[n](bv) + b2n(b)


decl_type: formula
theory: DivisionUtil
library: bitvectors
signature: nil
location: 24 2 28 61
body:
    bv2nat_minus3 : LEMMA % :-)
      FORALL(n:posnat, bv1, bv2:bvec[n]) :
        bv2nat[n](bv1) <= bv2nat[n](bv2)
          IMPLIES
        bv2nat[n](bv2 - bv1) = bv2nat[n](bv2) - bv2nat[n](bv1);


decl_type: tcc
theory: DivisionUtil
library: bitvectors
signature: nil
location: 35 0 37 999
body:
  % Subtype TCC generated (at line 20, column 37) for  n - 1
      % expected type  nat
  leftshift_with_TCC1: OBLIGATION FORALL (n: nat): n > 1 IMPLIES n - 1 >= 0;


decl_type: tcc
theory: DivisionUtil
library: bitvectors
signature: nil
location: 39 0 43 999
body:
  % Subtype TCC generated (at line 22, column 41) for  0
      % expected type  below(n)
  leftshift_with_TCC2: OBLIGATION
    FORALL (n: nat, bv: bvec[n]):
      n > 1 AND bv2nat[n](bv) < exp2(n - 1) IMPLIES 0 < n;


decl_type: formula
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 71 2 73 46
body:
    divrem_dvd : LEMMA % :-)
      FORALL(n:below(N+1), k:below(N-n)) :
        divrem(dvd, dvs, rem, n)`1(k+n) = dvd(k)


decl_type: formula
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 75 2 86 38
body:
    divrem_dvs0 : LEMMA % :-)
      FORALL(n:below(N+1)) :
        divrem(dvd, fill[N](FALSE), rem, n) = 
          ((LAMBDA(i:below(N)) : IF i < n
                                 THEN TRUE
                                 ELSE dvd(i-n)
                                 ENDIF),

           (LAMBDA(i:below(N)) : IF i < n
                                 THEN dvd(N-n+i)
                                 ELSE rem(i-n)
                                 ENDIF))


decl_type: formula
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 91 2 103 47
body:
    bv2nat_left_false_inc : LEMMA % :-)
      FORALL(n:below(N)) :
        bv2nat[N](LAMBDA(i:below(N)) :
                    IF i < n+1
                    THEN bv(i)
                    ELSE FALSE
                    ENDIF)
        =
        bv2nat[N](LAMBDA(i:below(N)) :
                    IF i < n
                    THEN bv(i)
                    ELSE FALSE
                    ENDIF) + exp2(n) * b2n(bv(n))


decl_type: formula
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 105 2 117 47
body:
    bv2nat_right_false_inc : LEMMA % :-)
      FORALL(n:below(N)) :
        bv2nat[N](LAMBDA(i:below(N)) :
                    IF i < n
                    THEN FALSE
                    ELSE bv(i)
                    ENDIF) 
        =
        bv2nat[N](LAMBDA(i:below(N)) :
                    IF i < n+1
                    THEN FALSE
                    ELSE bv(i)
                    ENDIF) + exp2(n) * b2n(bv(n))


decl_type: formula
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 119 2 131 53
body:
    bv2nat_left_false_dec : LEMMA % :-)
      FORALL(n:below(N)) :
        bv2nat[N](LAMBDA(i:below(N)) :
                    IF i < N-n
                    THEN bv(i+n)
                    ELSE FALSE
                    ENDIF)
        =
        bv2nat[N](LAMBDA(i:below(N)) :
                    IF i < N-n-1
                    THEN bv(i+n)
                    ELSE FALSE
                    ENDIF) + exp2(N-n-1) * b2n(bv(N-1))


decl_type: formula
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 133 2 150 36
body:
    bv2nat_split : LEMMA % :-)
      FORALL(m:below(N+1)) :
        bv2nat[N](LAMBDA(i:below(N)) :
                    IF i < m
                    THEN bv1(i+N-m)
                    ELSE bv2(i-m)
                    ENDIF)
        =
        bv2nat[N](LAMBDA(i:below(N)) :
                    IF i < m
                    THEN bv1(i+N-m)
                    ELSE FALSE
                    ENDIF)
        + exp2(m) * bv2nat[N](LAMBDA(i:below(N)) :
                                IF i < N-m
                                THEN bv2(i)
                                ELSE FALSE
                                ENDIF)


decl_type: formula
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 152 2 165 18
body:
    bv2nat_left_false_minus : LEMMA % :-)
      FORALL(n:below(N)) :
        bv2nat[N](LAMBDA (i: below(N)):
                    IF i < N - n
                    THEN bv(i + n)
                    ELSE FALSE
                    ENDIF)
        =
        2 * bv2nat[N](LAMBDA (i: below(N)):
                    IF i < N - n - 1
                    THEN bv(1 + i + n)
                    ELSE FALSE
                    ENDIF)
        + b2n(bv(n))


decl_type: formula
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 167 2 168 71
body:
    bv2nat_leftshift_exp : LEMMA % :-)
      bv2nat(bv) = bv2nat(left_shift(1, bv))/2 + exp2(N-1) * b2n(bv(N-1))


decl_type: formula
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 207 2 223 22
body:
    divrem_mem_first_second_third : LEMMA % :-)
      FORALL(n:below(N+1)) :
        LET
            drm = divrem_mem(aux, dvs, quot, rem, n),
            dr  = divrem(quot, dvs, (LAMBDA(i:below(N)) : IF i < N-n
                                                          THEN rem(i)
                                                          ELSE FALSE
                                                          ENDIF), n)
        IN 
            drm`1 = (LAMBDA(i:below(N)) : IF i < n
                                          THEN quot(N-n+i)
                                          ELSE aux(i-n)
                                          ENDIF)
              AND
            drm`2 = dr`1
              AND
            drm`3 = dr`2


decl_type: formula
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 225 2 232 47
body:
    divrem_mem_rem : LEMMA % :-)
      FORALL(n:below(N+1)) :
        (LAMBDA(i:below(N)) : IF i < N-n
                              THEN rem(i)
                              ELSE FALSE
                              ENDIF) < dvs 
          IMPLIES 
        divrem_mem(aux, dvs, dvd, rem, n)`3 < dvs


decl_type: formula
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 234 2 235 77
body:
    div_divrem_mem : LEMMA % :-)
      div(dvd, dvs) = divrem_mem(fill[N](FALSE), dvs, dvd, fill[N](FALSE), N)`2


decl_type: formula
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 237 2 238 77
body:
    rem_divrem_mem : LEMMA % :-)
      rem(dvd, dvs) = divrem_mem(fill[N](FALSE), dvs, dvd, fill[N](FALSE), N)`3


decl_type: formula
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 248 2 269 64
body:
    divrem_mem_invariant : LEMMA % :-)
      FORALL(n:below(N+1)) : 
        LET 
            start_n = (LAMBDA(i:below(N)) : IF i < n
                                            THEN quot(N-n+i)
                                            ELSE aux(i-n)
                                            ENDIF),
            quot_n =  (LAMBDA(i:below(N)) : IF i < N-n
                                            THEN quot(i)
                                            ELSE FALSE
                                            ENDIF),
            rem_n =   (LAMBDA(i:below(N)) : IF i < n
                                            THEN quot(N-n+i)
                                            ELSE rem(i-n)
                                            ENDIF),
            drm = divrem_mem(aux, dvs, quot, rem, n)
        IN
            bv2nat[N](start_n) = 
              exp2(n) * bv2nat[N](dvs) * bv2nat[N](quot_n) + bv2nat[N](rem_n)
              IMPLIES
            bv2nat[N](drm`1) = 
              bv2nat[N](dvs) * bv2nat[N](drm`2) + bv2nat[N](drm`3)


decl_type: formula
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 275 2 276 77
body:
    divrem1_eq : LEMMA % :-)
      bv2nat(div(dvd, dvs)) * bv2nat(dvs) + bv2nat(rem(dvd, dvs)) = bv2nat(dvd)


decl_type: formula
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 290 2 294 62
body:
    divrem1_uniqueness : LEMMA % :-)
      FORALL(q,r:nat) : 
        r < bv2nat(dvs) AND q * bv2nat(dvs) + r = bv2nat(dvd)
          IMPLIES
        q = bv2nat(div(dvd, dvs)) AND r = bv2nat(rem(dvd, dvs));


decl_type: function
theory: BitvectorOneComplementDivision
library: bitvectors
signature: [[bvec[N], bvec[N], bvec[N], nat] -> [bvec[N], bvec[N]]]
location: 47 2 59 14
body:
    divrem(dvd, dvs, rem : bvec[N], n : nat) : RECURSIVE [bvec[N], bvec[N]] =
      IF n = 0
      THEN (dvd, rem)
      ELSE LET 
               rem1 = left_shift(1, rem) WITH [(0) := dvd(N-1)],
               dvd1 = left_shift(1, dvd)
           IN
               IF bv2nat[N](dvs) <= bv2nat[N](rem1)
               THEN divrem(dvd1 WITH [(0) := TRUE], dvs, rem1-dvs, n-1)
               ELSE divrem(dvd1, dvs, rem1, n-1)
               ENDIF
      ENDIF
      MEASURE n;


decl_type: function
theory: BitvectorOneComplementDivision
library: bitvectors
signature:
  [[bvec[N], bvec[N], bvec[N], bvec[N], below(1 + N)] ->
  [bvec[N], bvec[N], bvec[N]]]

location: 182 2 203 16
body:
    divrem_mem(aux, dvs, quot, rem : bvec[N], n : below(N+1)) : 
      RECURSIVE [bvec[N], bvec[N], bvec[N]] =
        IF n = 0
        THEN (aux, quot, rem)
        ELSE LET 
                 aux1  = left_shift(1, aux) WITH [(0) := quot(N-1)],
                 rem1  = left_shift(1, rem) WITH [(0) := quot(N-1)],
                 quot1 = left_shift(1, quot)
             IN
                 IF bv2nat[N](dvs) <= bv2nat[N](LAMBDA(i:below(N)) : IF i < N-n+1
                                                                     THEN rem1(i)
                                                                     ELSE FALSE
                                                                     ENDIF)
                 THEN divrem_mem(aux1, dvs, quot1 WITH [(0) := TRUE], 
                                 (LAMBDA(i:below(N)) : IF i < N-n+1
                                                       THEN rem1(i)
                                                       ELSE FALSE
                                                       ENDIF) - dvs, n-1)
                 ELSE divrem_mem(aux1, dvs, quot1, rem1, n-1)
                 ENDIF
        ENDIF
        MEASURE n;


decl_type: tcc
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 307 0 310 999
body:
  % Assuming TCC generated (at line 21, column 12) for
      % BitvectorMultiplication[N]
      % generated from assumption BitvectorMultiplication.N_size
  IMP_BitvectorMultiplication_TCC1: OBLIGATION N >= 2;


decl_type: tcc
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 312 0 321 999
body:
  % Subtype TCC generated (at line 55, column 37) for  0
      % expected type  below(N)
  divrem_TCC1: OBLIGATION
    FORALL (dvd, dvs, rem: bvec[N], n: nat):
      NOT n = 0 IMPLIES
       (FORALL (rem1: bvec[N]):
          rem1 = left_shift(1, rem) WITH [(0) := dvd(N - 1)] IMPLIES
           (FORALL (dvd1: bvec[N]):
              bv2nat[N](dvs) <= bv2nat[N](rem1) AND dvd1 = left_shift(1, dvd)
               IMPLIES 0 < N));


decl_type: tcc
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 323 0 332 999
body:
  % Subtype TCC generated (at line 55, column 65) for  n - 1
      % expected type  nat
  divrem_TCC2: OBLIGATION
    FORALL (dvd, dvs, rem: bvec[N], n: nat):
      NOT n = 0 IMPLIES
       (FORALL (rem1: bvec[N]):
          rem1 = left_shift(1, rem) WITH [(0) := dvd(N - 1)] IMPLIES
           (FORALL (dvd1: bvec[N]):
              bv2nat[N](dvs) <= bv2nat[N](rem1) AND dvd1 = left_shift(1, dvd)
               IMPLIES n - 1 >= 0));


decl_type: tcc
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 334 0 343 999
body:
  % Termination TCC generated (at line 55, column 18) for
      % divrem(dvd1 WITH [(0) := TRUE], dvs, rem1 - dvs, n - 1)
  divrem_TCC3: OBLIGATION
    FORALL (dvd, dvs, rem: bvec[N], n: nat):
      NOT n = 0 IMPLIES
       (FORALL (rem1: bvec[N]):
          rem1 = left_shift(1, rem) WITH [(0) := dvd(N - 1)] IMPLIES
           (FORALL (dvd1: bvec[N]):
              bv2nat[N](dvs) <= bv2nat[N](rem1) AND dvd1 = left_shift(1, dvd)
               IMPLIES n - 1 < n));


decl_type: tcc
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 345 0 355 999
body:
  % Subtype TCC generated (at line 56, column 42) for  n - 1
      % expected type  nat
  divrem_TCC4: OBLIGATION
    FORALL (dvd, dvs, rem: bvec[N], n: nat):
      NOT n = 0 IMPLIES
       (FORALL (rem1: bvec[N]):
          rem1 = left_shift(1, rem) WITH [(0) := dvd(N - 1)] IMPLIES
           (FORALL (dvd1: bvec[N]):
              NOT bv2nat[N](dvs) <= bv2nat[N](rem1) AND
               dvd1 = left_shift(1, dvd)
               IMPLIES n - 1 >= 0));


decl_type: tcc
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 357 0 367 999
body:
  % Termination TCC generated (at line 56, column 18) for
      % divrem(dvd1, dvs, rem1, n - 1)
  divrem_TCC5: OBLIGATION
    FORALL (dvd, dvs, rem: bvec[N], n: nat):
      NOT n = 0 IMPLIES
       (FORALL (rem1: bvec[N]):
          rem1 = left_shift(1, rem) WITH [(0) := dvd(N - 1)] IMPLIES
           (FORALL (dvd1: bvec[N]):
              NOT bv2nat[N](dvs) <= bv2nat[N](rem1) AND
               dvd1 = left_shift(1, dvd)
               IMPLIES n - 1 < n));


decl_type: tcc
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 369 0 371 999
body:
  % Subtype TCC generated (at line 51, column 46) for  0
      % expected type  below(N)
  divrem_TCC6: OBLIGATION FORALL (n: nat): NOT n = 0 IMPLIES 0 < N;


decl_type: tcc
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 373 0 376 999
body:
  % Subtype TCC generated (at line 51, column 56) for  N - 1
      % expected type  below(N)
  divrem_TCC7: OBLIGATION
    FORALL (n: nat): NOT n = 0 IMPLIES N - 1 >= 0 AND N - 1 < N;


decl_type: tcc
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 378 0 381 999
body:
  % Subtype TCC generated (at line 73, column 33) for  k + n
      % expected type  below(N)
  divrem_dvd_TCC1: OBLIGATION
    FORALL (n: below(N + 1), k: below(N - n)): k + n < N;


decl_type: tcc
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 383 0 386 999
body:
  % Subtype TCC generated (at line 73, column 44) for  k
      % expected type  below(N)
  divrem_dvd_TCC2: OBLIGATION
    FORALL (n: below(N + 1), k: below(N - n)): k < N;


decl_type: tcc
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 388 0 392 999
body:
  % Subtype TCC generated (at line 80, column 40) for  i - n
      % expected type  below(N)
  divrem_dvs0_TCC1: OBLIGATION
    FORALL (n: below(N + 1), i: below(N)):
      NOT i < n IMPLIES i - n >= 0 AND i - n < N;


decl_type: tcc
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 394 0 398 999
body:
  % Subtype TCC generated (at line 84, column 40) for  N - n + i
      % expected type  below(N)
  divrem_dvs0_TCC2: OBLIGATION
    FORALL (n: below(N + 1), i: below(N)):
      i < n IMPLIES N - n + i >= 0 AND N - n + i < N;


decl_type: tcc
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 400 0 403 999
body:
  % Subtype TCC generated (at line 123, column 26) for  i + n
      % expected type  below(N)
  bv2nat_left_false_dec_TCC1: OBLIGATION
    FORALL (n: below(N), i: below(N)): i < N - n IMPLIES i + n < N;


decl_type: tcc
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 405 0 408 999
body:
  % Subtype TCC generated (at line 129, column 26) for  i + n
      % expected type  below(N)
  bv2nat_left_false_dec_TCC2: OBLIGATION
    FORALL (n: below(N), i: below(N)): i < N - n - 1 IMPLIES i + n < N;


decl_type: tcc
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 410 0 412 999
body:
  % Subtype TCC generated (at line 131, column 32) for  N - n - 1
      % expected type  nat
  bv2nat_left_false_dec_TCC3: OBLIGATION FORALL (n: below(N)): N - n - 1 >= 0;


decl_type: tcc
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 414 0 417 999
body:
  % Subtype TCC generated (at line 131, column 48) for  N - 1
      % expected type  below(N)
  bv2nat_left_false_dec_TCC4: OBLIGATION
    FORALL (n: below(N)): N - 1 >= 0 AND N - 1 < N;


decl_type: tcc
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 419 0 423 999
body:
  % Subtype TCC generated (at line 137, column 27) for  i + N - m
      % expected type  below(N)
  bv2nat_split_TCC1: OBLIGATION
    FORALL (m: below(N + 1), i: below(N)):
      i < m IMPLIES i + N - m >= 0 AND i + N - m < N;


decl_type: tcc
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 425 0 428 999
body:
  % Subtype TCC generated (at line 162, column 26) for  1 + i + n
      % expected type  below(N)
  bv2nat_left_false_minus_TCC1: OBLIGATION
    FORALL (n: below(N), i: below(N)): i < N - n - 1 IMPLIES 1 + i + n < N;


decl_type: tcc
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 430 0 432 999
body:
  % Subtype TCC generated (at line 168, column 52) for  N - 1
      % expected type  nat
  bv2nat_leftshift_exp_TCC1: OBLIGATION N - 1 >= 0;


decl_type: tcc
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 434 0 449 999
body:
  % Subtype TCC generated (at line 199, column 67) for  n - 1
      % expected type  below(1 + N)
  divrem_mem_TCC1: OBLIGATION
    FORALL (aux, dvs, quot, rem: bvec[N], n: below(N + 1)):
      NOT n = 0 IMPLIES
       (FORALL (aux1: bvec[N]):
          aux1 = left_shift(1, aux) WITH [(0) := quot(N - 1)] IMPLIES
           (FORALL (rem1: bvec[N]):
              rem1 = left_shift(1, rem) WITH [(0) := quot(N - 1)] IMPLIES
               (FORALL (quot1: bvec[N]):
                  bv2nat[N](dvs) <=
                   bv2nat[N]
                       (LAMBDA (i: below(N)):
                          IF i < N - n + 1 THEN rem1(i) ELSE FALSE ENDIF)
                   AND quot1 = left_shift(1, quot)
                   IMPLIES n - 1 >= 0 AND n - 1 < 1 + N)));


decl_type: tcc
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 451 0 470 999
body:
  % Termination TCC generated (at line 195, column 20) for
      % divrem_mem(aux1, dvs, quot1 WITH [(0) := TRUE],
      %            (LAMBDA (i: below(N)):
      %               IF i < N - n + 1 THEN rem1(i) ELSE FALSE ENDIF)
      %             - dvs,
      %            n - 1)
  divrem_mem_TCC2: OBLIGATION
    FORALL (aux, dvs, quot, rem: bvec[N], n: below(N + 1)):
      NOT n = 0 IMPLIES
       (FORALL (aux1: bvec[N]):
          aux1 = left_shift(1, aux) WITH [(0) := quot(N - 1)] IMPLIES
           (FORALL (rem1: bvec[N]):
              rem1 = left_shift(1, rem) WITH [(0) := quot(N - 1)] IMPLIES
               (FORALL (quot1: bvec[N]):
                  bv2nat[N](dvs) <=
                   bv2nat[N]
                       (LAMBDA (i: below(N)):
                          IF i < N - n + 1 THEN rem1(i) ELSE FALSE ENDIF)
                   AND quot1 = left_shift(1, quot)
                   IMPLIES n - 1 < n)));


decl_type: tcc
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 472 0 487 999
body:
  % Subtype TCC generated (at line 200, column 55) for  n - 1
      % expected type  below(1 + N)
  divrem_mem_TCC3: OBLIGATION
    FORALL (aux, dvs, quot, rem: bvec[N], n: below(N + 1)):
      NOT n = 0 IMPLIES
       (FORALL (aux1: bvec[N]):
          aux1 = left_shift(1, aux) WITH [(0) := quot(N - 1)] IMPLIES
           (FORALL (rem1: bvec[N]):
              rem1 = left_shift(1, rem) WITH [(0) := quot(N - 1)] IMPLIES
               (FORALL (quot1: bvec[N]):
                  NOT bv2nat[N](dvs) <=
                       bv2nat[N]
                           (LAMBDA (i: below(N)):
                              IF i < N - n + 1 THEN rem1(i) ELSE FALSE ENDIF)
                   AND quot1 = left_shift(1, quot)
                   IMPLIES n - 1 >= 0 AND n - 1 < 1 + N)));


decl_type: tcc
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 489 0 504 999
body:
  % Termination TCC generated (at line 200, column 20) for
      % divrem_mem(aux1, dvs, quot1, rem1, n - 1)
  divrem_mem_TCC4: OBLIGATION
    FORALL (aux, dvs, quot, rem: bvec[N], n: below(N + 1)):
      NOT n = 0 IMPLIES
       (FORALL (aux1: bvec[N]):
          aux1 = left_shift(1, aux) WITH [(0) := quot(N - 1)] IMPLIES
           (FORALL (rem1: bvec[N]):
              rem1 = left_shift(1, rem) WITH [(0) := quot(N - 1)] IMPLIES
               (FORALL (quot1: bvec[N]):
                  NOT bv2nat[N](dvs) <=
                       bv2nat[N]
                           (LAMBDA (i: below(N)):
                              IF i < N - n + 1 THEN rem1(i) ELSE FALSE ENDIF)
                   AND quot1 = left_shift(1, quot)
                   IMPLIES n - 1 < n)));


decl_type: tcc
theory: BitvectorOneComplementDivision
library: bitvectors
signature: nil
location: 506 0 508 999
body:
  % Subtype TCC generated (at line 235, column 73) for  N
      % expected type  below(1 + N)
  div_divrem_mem_TCC1: OBLIGATION N < 1 + N;


decl_type: formula
theory: BitvectorTwoComplementDivision
library: bitvectors
signature: nil
location: 33 2 43 53
body:
    div1_cancel : LEMMA % :-)
      bv2nat(BV) * bv2nat(DVD) < exp2(2*N)
        AND
      bv2nat(BV) * bv2nat(DVS) < exp2(2*N)
        AND
      bv2nat(BV) /= 0
        IMPLIES
      div(BV * DVD, BV * DVS) = div(DVD, DVS)
        AND
      (bv2nat(DVS) /= 0 IMPLIES 
         rem(BV * DVD, BV * DVS) = BV * rem(DVD, DVS));


decl_type: formula
theory: BitvectorTwoComplementDivision
library: bitvectors
signature: nil
location: 140 2 144 32
body:
    div_dvs0 : LEMMA % :-)
      dvd / fill[N](FALSE) = IF bv2int[N](dvd) >= 0
                             THEN fill[N](TRUE)  % -1
                             ELSE one[N]         % 1
                             ENDIF


decl_type: formula
theory: BitvectorTwoComplementDivision
library: bitvectors
signature: nil
location: 149 2 152 46
body:
    rem_below_dvs : LEMMA % :-)
      bv2int(dvs) /= 0
        IMPLIES
      abs(bv2int(dvd // dvs)) < abs(bv2int(dvs))


decl_type: formula
theory: BitvectorTwoComplementDivision
library: bitvectors
signature: nil
location: 154 2 158 22
body:
    divrem_eq : LEMMA % :-)
      NOT (bv2int(dvd) = -exp2(N-1) AND bv2int(dvs) = -1)
        IMPLIES
      bv2int[N](dvd / dvs) * bv2int[N](dvs) + bv2int[N](dvd // dvs) 
        = bv2int[N](dvd)


decl_type: formula
theory: BitvectorTwoComplementDivision
library: bitvectors
signature: nil
location: 160 2 163 67
body:
    divrem_overflow : LEMMA % :-)
      bv2int(dvd) = -exp2(N-1) AND bv2int(dvs) = -1
        IMPLIES
      bv2int[N](dvd / dvs) = -exp2(N-1) AND bv2int[N](dvd // dvs) = 0


decl_type: formula
theory: BitvectorTwoComplementDivision
library: bitvectors
signature: nil
location: 165 2 181 60
body:
    div_sgn : LEMMA % :-)
      NOT (bv2int(dvd) = -exp2(N-1) AND bv2int(dvs) = -1)
        AND
      bv2int(dvs) /= 0
        IMPLIES
      ((bv2int(dvd / dvs) > 0) = 
          ((bv2int(dvd) >= bv2int(dvs) AND bv2int(dvs) > 0)
           OR
           (bv2int(dvd) <= bv2int(dvs) AND bv2int(dvs) < 0)))
        AND
      ((bv2int(dvd / dvs) = 0) = 
          (abs(bv2int(dvd)) < abs(bv2int(dvs))))
        AND
      ((bv2int(dvd / dvs) < 0) = 
          ((bv2int(dvd) >= -bv2int(dvs) AND bv2int(dvs) < 0)
           OR
           (bv2int(dvd) <= -bv2int(dvs) AND bv2int(dvs) > 0)))


decl_type: formula
theory: BitvectorTwoComplementDivision
library: bitvectors
signature: nil
location: 183 2 186 57
body:
    rem_sgn : LEMMA % :-)
      ((bv2int(dvd) > 0) IMPLIES (bv2int(dvd // dvs) >= 0))
         AND
      ((bv2int(dvd) < 0) IMPLIES (bv2int(dvd // dvs) <= 0))


decl_type: formula
theory: BitvectorTwoComplementDivision
library: bitvectors
signature: nil
location: 188 2 215 54
body:
    divrem_uniqueness : LEMMA % :-)
      FORALL(q,r:int) : 
        (NOT (bv2int(dvd) = -exp2(N-1) AND bv2int(dvs) = -1))
          AND
        bv2int(dvs) /= 0
          AND
        ((q > 0) = 
          ((bv2int(dvd) >= bv2int(dvs) AND bv2int(dvs) > 0)
           OR
           (bv2int(dvd) <= bv2int(dvs) AND bv2int(dvs) < 0)))
          AND
        ((q = 0) = 
           (abs(bv2int(dvd)) < abs(bv2int(dvs))))
          AND
        ((q < 0) = 
           ((bv2int(dvd) >= -bv2int(dvs) AND bv2int(dvs) < 0)
            OR
            (bv2int(dvd) <= -bv2int(dvs) AND bv2int(dvs) > 0)))
          AND
        ((bv2int(dvd) > 0) IMPLIES (r >= 0))
          AND
        ((bv2int(dvd) < 0) IMPLIES (r <= 0))
          AND
        abs(r) < abs(bv2int(dvs)) 
          AND 
        q * bv2int(dvs) + r = bv2int(dvd)
          IMPLIES
        q = bv2int(dvd / dvs) AND r = bv2int(dvd // dvs)


decl_type: formula
theory: BitvectorTwoComplementDivision
library: bitvectors
signature: nil
location: 221 2 227 36
body:
    div_largest : LEMMA % :-)
      FORALL(q:int) : 
        bv2int(dvs) /= 0
          AND
        abs(bv2int(dvs) * q) <= abs(bv2int(dvd)) 
          IMPLIES 
        abs(q) <= abs(bv2int(dvd/dvs))


decl_type: function
theory: BitvectorTwoComplementDivision
library: bitvectors
signature: [[bvec[N], bvec[N]] -> bvec[N]]
location: 51 2 61 10
body:
    /(dvd, dvs) : bvec[N] =
      IF bv2int[N](dvd) >= 0
      THEN IF bv2int[N](dvs) >= 0
           THEN div[N](dvd, dvs)
           ELSE -div[N](dvd, -dvs)
           ENDIF
      ELSE IF bv2int[N](dvs) >= 0
           THEN -div[N](-dvd, dvs)
           ELSE div[N](-dvd, -dvs)
           ENDIF
      ENDIF;


decl_type: function
theory: BitvectorTwoComplementDivision
library: bitvectors
signature: [[bvec[N], bvec[N]] -> bvec[N]]
location: 63 2 73 9
body:
    //(dvd, dvs) : bvec[N] =
      IF bv2int[N](dvd) >= 0
      THEN IF bv2int[N](dvs) >= 0
           THEN rem[N](dvd, dvs)
           ELSE rem[N](dvd, -dvs)
           ENDIF
      ELSE IF bv2int[N](dvs) >= 0
           THEN -rem[N](-dvd, dvs)
           ELSE -rem[N](-dvd, -dvs)
           ENDIF
      ENDIF


decl_type: tcc
theory: BitvectorTwoComplementDivision
library: bitvectors
signature: nil
location: 234 0 237 999
body:
  % Assuming TCC generated (at line 20, column 12) for
      % BitvectorOneComplementDivision[N]
      % generated from assumption BitvectorOneComplementDivision.N_size
  IMP_BitvectorOneComplementDivision_TCC1: OBLIGATION N >= 2;


decl_type: tcc
theory: BitvectorTwoComplementDivision
library: bitvectors
signature: nil
location: 239 0 242 999
body:
  % Assuming TCC generated (at line 21, column 12) for
      % BitvectorOneComplementDivision[2 * N]
      % generated from assumption BitvectorOneComplementDivision.N_size
  IMP_BitvectorOneComplementDivision_TCC2: OBLIGATION 2 * N >= 2;


decl_type: tcc
theory: BitvectorTwoComplementDivision
library: bitvectors
signature: nil
location: 244 0 246 999
body:
  % Subtype TCC generated (at line 155, column 29) for  N - 1
      % expected type  nat
  divrem_eq_TCC1: OBLIGATION N - 1 >= 0;


decl_type: formula
theory: BitvectorTwoComplementDivisionWidenNarrow
library: bitvectors
signature: nil
location: 29 2 34 48
body:
    divrem_widens : LEMMA % :-)
      NOT (bv2int(dvd) = -exp2(N-1) AND bv2int(dvs) = -1)
        IMPLIES
      widen(dvd) / widen(dvs) = widen(dvd / dvs)
        AND
      widen(dvd) // widen(dvs) = widen(dvd // dvs)


decl_type: formula
theory: BitvectorTwoComplementDivisionWidenNarrow
library: bitvectors
signature: nil
location: 36 2 53 48
body:
    div_cancel : LEMMA % :-)
     -exp2(2*N-1) < bv2int(BV) * bv2int(DVD) 
       AND 
      bv2int(BV) * bv2int(DVD) < exp2(2*N-1)
        AND
     -exp2(2*N-1) < bv2int(BV) * bv2int(DVS) 
       AND 
      bv2int(BV) * bv2int(DVS) < exp2(2*N-1)
        AND
      bv2int(BV) /= 0
        AND
      bv2int(DVS) /= 0
        AND
      NOT (bv2int(DVD) = -exp2(2 * N - 1) AND bv2int(DVS) = -1)
        IMPLIES
      (BV * DVD) / (BV * DVS) = DVD / DVS
        AND
      (BV * DVD) // (BV * DVS) = BV * (DVD // DVS)


decl_type: tcc
theory: BitvectorTwoComplementDivisionWidenNarrow
library: bitvectors
signature: nil
location: 60 0 63 999
body:
  % Assuming TCC generated (at line 20, column 12) for
      % BitvectorTwoComplementDivision[N]
      % generated from assumption BitvectorTwoComplementDivision.N_size
  IMP_BitvectorTwoComplementDivision_TCC1: OBLIGATION N >= 2;


decl_type: tcc
theory: BitvectorTwoComplementDivisionWidenNarrow
library: bitvectors
signature: nil
location: 65 0 68 999
body:
  % Assuming TCC generated (at line 21, column 12) for
      % BitvectorTwoComplementDivision[2 * N]
      % generated from assumption BitvectorTwoComplementDivision.N_size
  IMP_BitvectorTwoComplementDivision_TCC2: OBLIGATION 2 * N >= 2;


decl_type: tcc
theory: BitvectorTwoComplementDivisionWidenNarrow
library: bitvectors
signature: nil
location: 70 0 72 999
body:
  % Subtype TCC generated (at line 30, column 29) for  N - 1
      % expected type  nat
  divrem_widens_TCC1: OBLIGATION N - 1 >= 0;


decl_type: tcc
theory: BitvectorTwoComplementDivisionWidenNarrow
library: bitvectors
signature: nil
location: 74 0 76 999
body:
  % Subtype TCC generated (at line 37, column 9) for  2 * N - 1
      % expected type  nat
  div_cancel_TCC1: OBLIGATION 2 * N - 1 >= 0;


decl_type: formula
theory: card_tricks
library: finite_sets
signature: nil
location: 22 2 24 74
body:
    extend_restrict: LEMMA
        empty?(non_subtype_elements(V))
        IMPLIES extend[T, S, boolean, FALSE](restrict[T, S, boolean](V)) = V


decl_type: formula
theory: card_tricks
library: finite_sets
signature: nil
location: 26 2 29 9
body:
    union_extend_restrict: LEMMA
        union(non_subtype_elements(V),
              extend[T, S, boolean, FALSE](restrict[T, S, boolean](V)))
        = V


decl_type: formula
theory: card_tricks
library: finite_sets
signature: nil
location: 31 2 33 73
body:
    disjoint_extend_restrict: LEMMA
        disjoint?(non_subtype_elements(V),
                  extend[T, S, boolean, FALSE](restrict[T, S, boolean](V)))


decl_type: formula
theory: card_tricks
library: finite_sets
signature: nil
location: 35 2 37 56
body:
    card_restrict_subtype: LEMMA
        empty?(non_subtype_elements(B))
        IMPLIES card(restrict[T, S, boolean](B)) = card(B)


decl_type: formula
theory: card_tricks
library: finite_sets
signature: nil
location: 39 2 41 49
body:
    same_card_subset_extend: LEMMA
        subset?(extend[T, S, boolean, FALSE](A), B) AND card(A) = card(B) 
        IMPLIES extend[T, S, boolean, FALSE](A) = B


decl_type: formula
theory: card_tricks
library: finite_sets
signature: nil
location: 43 2 45 15
body:
    card_restrict_plus: LEMMA
        card(non_subtype_elements(B)) + card(restrict[T, S, boolean](B))
        = card(B)


decl_type: formula
theory: card_tricks
library: finite_sets
signature: nil
location: 47 2 49 56
body:
    card_restrict_less: LEMMA
        nonempty?(non_subtype_elements(B))
        IMPLIES card(restrict[T, S, boolean](B)) < card(B)


decl_type: tcc
theory: card_tricks
library: finite_sets
signature: nil
location: 57 0 60 999
body:
  % Subtype TCC generated (at line 44, column 11) for  non_subtype_elements(B)
      % expected type  S: finite_set[T]
  card_restrict_plus_TCC1: OBLIGATION
    FORALL (B: finite_set[T]): is_finite[T](non_subtype_elements(B));


decl_type: formula
theory: finite_sets_subtype_props
library: finite_sets
signature: nil
location: 14 2 15 71
body:
    only_subtype_elements: LEMMA empty?(non_subtype_elements[T1, (A)](A)) AND
                                 empty?(non_subtype_elements[T2, (B)](B))


decl_type: formula
theory: finite_sets_subtype_props
library: finite_sets
signature: nil
location: 17 2 19 63
body:
    same_card_inj_bij: LEMMA
        FORALL (f: [ (A) -> (B) ]):
            card(A) = card(B) AND injective?(f) IMPLIES bijective?(f)


decl_type: formula
theory: finite_sets_inductions
library: finite_sets
signature: nil
location: 14 2 15 78
body:
    cardinal_induction       : LEMMA (FORALL S : P(S)) IFF 
                                        (FORALL n, S : card(S) = n IMPLIES P(S)) 


decl_type: formula
theory: finite_sets_inductions
library: finite_sets
signature: nil
location: 17 2 19 65
body:
    finite_set_induction     : THEOREM P(emptyset[T])
                                        AND (FORALL e,S: P(S) IMPLIES P(add(e,S)))
                                           IMPLIES (FORALL S: P(S))


decl_type: formula
theory: finite_sets_inductions
library: finite_sets
signature: nil
location: 21 2 23 63
body:
    finite_set_ind_modified  : THEOREM  P(emptyset[T]) AND 
                               (FORALL e,S: NOT S(e) AND P(S) IMPLIES P(add(e,S)))
                                         IMPLIES (FORALL S: P(S))


decl_type: formula
theory: finite_sets_inductions
library: finite_sets
signature: nil
location: 25 2 27 70
body:
    finite_set_induction_rest: THEOREM P(emptyset[T])
                                       AND (FORALL SS : P(rest(SS)) IMPLIES P(SS))
                                               IMPLIES (FORALL S : P(S))


decl_type: formula
theory: finite_sets_inductions
library: finite_sets
signature: nil
location: 29 2 32 61
body:
    finite_set_induction_union: THEOREM P(emptyset[T])
                                        AND (FORALL e: P(singleton(e)))
                    AND (FORALL S1,S2: P(S1) AND P(S2) IMPLIES P(union(S1,S2)))
                                       IMPLIES (FORALL S: P(S))


decl_type: formula
theory: finite_sets_inductions
library: finite_sets
signature: nil
location: 35 2 38 58
body:
    finite_set_induction_gen: THEOREM (FORALL S:
                                   (FORALL S2: card(S2) < card(S) IMPLIES P(S2))
                                                  IMPLIES P(S))
                                    IMPLIES (FORALL S: P(S))


decl_type: formula
theory: finite_sets_inductions
library: finite_sets
signature: nil
location: 44 2 45 73
body:
    nonempty_card_induction : LEMMA (FORALL U : Q(U)) IFF 
                                (FORALL S, n : n > 0 AND card(S) = n IMPLIES Q(S))


decl_type: formula
theory: finite_sets_inductions
library: finite_sets
signature: nil
location: 47 2 49 65
body:
    nonempty_finite_set_induct : THEOREM (FORALL e : Q(singleton(e)))
         AND (FORALL e, U : Q(U) AND NOT U(e) IMPLIES Q(add(e, U)))
                                          IMPLIES (FORALL U : Q(U))


decl_type: tcc
theory: finite_sets_inductions
library: finite_sets
signature: nil
location: 57 0 60 999
body:
  % Subtype TCC generated (at line 45, column 70) for  S
      % expected type  non_empty_finite_set[T]
  nonempty_card_induction_TCC1: OBLIGATION
    FORALL (S, n): n > 0 AND card(S) = n IMPLIES NOT empty?[T](S);


decl_type: formula
theory: finite_sets_product
library: finite_sets
signature: nil
location: 39 2 40 78
body:
    product_x         : THEOREM (FORALL (x: (S)): 
                                product(S, f) = f(x) * product(remove(x, S), f))


decl_type: formula
theory: finite_sets_product
library: finite_sets
signature: nil
location: 42 2 43 64
body:
    product_x1_x2     : LEMMA (FORALL (x1,x2: (S)): f(x1) * product(remove(x1,S),f) 
                                = f(x2) * product(remove(x2,S),f))


decl_type: formula
theory: finite_sets_product
library: finite_sets
signature: nil
location: 45 2 46 82
body:
    product_add       : THEOREM product(add(x,S),f) 
                            = product(S,f) * IF member(x,S) THEN one ELSE f(x) ENDIF


decl_type: formula
theory: finite_sets_product
library: finite_sets
signature: nil
location: 48 2 49 82
body:
    product_remove    : THEOREM product(remove(x,S),f) 
                            * IF member(x,S) THEN f(x) ELSE one ENDIF = product(S,f)


decl_type: formula
theory: finite_sets_product
library: finite_sets
signature: nil
location: 51 2 52 76
body:
    product_rest      : THEOREM NOT empty?(S) IMPLIES
                              f(choose(S)) * product(rest(S),f) = product(S,f)


decl_type: formula
theory: finite_sets_product
library: finite_sets
signature: nil
location: 54 2 55 79
body:
    product_disj_union: THEOREM disjoint?(A,B) IMPLIES 
                              product(union(A,B),f) = product(A,f) * product(B,f) 


decl_type: formula
theory: finite_sets_product
library: finite_sets
signature: nil
location: 57 2 58 74
body:
    product_diff_subset: THEOREM subset?(A, B) IMPLIES 
                              product(difference(B, A), f) * product(A, f) = product(B, f) 


decl_type: formula
theory: finite_sets_product
library: finite_sets
signature: nil
location: 60 2 61 62
body:
    product_union      : THEOREM product(union(A,B),f) * product(intersection(A,B),f) 
                                   = product(A,f) * product(B,f) 


decl_type: formula
theory: finite_sets_product
library: finite_sets
signature: nil
location: 63 2 64 85
body:
    product_diff_intersection: THEOREM product(A,f) = 
                              product(difference(A,B),f) * product(intersection(A,B),f) 


decl_type: formula
theory: finite_sets_product
library: finite_sets
signature: nil
location: 66 2 67 68
body:
    product_f_g         : LEMMA (FORALL (x: (S)): f(x) = g(x)) 
                                 IMPLIES product(S, f) = product(S, g)


decl_type: formula
theory: finite_sets_product
library: finite_sets
signature: nil
location: 69 2 70 44
body:
    product_particular  : THEOREM product(S,f) = product(S, f WITH [x := one])
                                 * IF S(x) THEN f(x) ELSE one ENDIF 


decl_type: formula
theory: finite_sets_product
library: finite_sets
signature: nil
location: 72 2 73 66
body:
    product_distributive: THEOREM product(A,f) * product(A,g) = 
                                  product(A,(LAMBDA x: f(x) * g(x))) 


decl_type: function
theory: finite_sets_product
library: finite_sets
signature: [[finite_set[T], [T -> R]] -> R]
location: 30 2 33 39
body:
    product(S,f) : RECURSIVE R = 
      IF (empty?(S)) THEN one
      ELSE f(choose(S)) * product(rest(S),f)
      ENDIF MEASURE (LAMBDA S,f: card(S))


decl_type: tcc
theory: finite_sets_product
library: finite_sets
signature: nil
location: 80 0 84 999
body:
  % Subtype TCC generated (at line 32, column 18) for  S
      % expected type  p: (nonempty?[T])
  product_TCC1: OBLIGATION
    FORALL (S: finite_set[T], f: [T -> R]):
      NOT (empty?(S)) IMPLIES nonempty?[T](S);


decl_type: tcc
theory: finite_sets_product
library: finite_sets
signature: nil
location: 86 0 89 999
body:
  % Termination TCC generated (at line 32, column 24) for  product(rest(S), f)
  product_TCC2: OBLIGATION
    FORALL (S: finite_set[T], f: [T -> R]):
      NOT (empty?(S)) IMPLIES card[T](rest[T](S)) < card[T](S);


decl_type: tcc
theory: finite_sets_product
library: finite_sets
signature: nil
location: 91 0 94 999
body:
  % Subtype TCC generated (at line 52, column 37) for  S
      % expected type  p: (nonempty?[T])
  product_rest_TCC1: OBLIGATION
    FORALL (S: finite_set[T]): NOT empty?(S) IMPLIES nonempty?[T](S);


decl_type: formula
theory: finite_sets_product_real
library: finite_sets
signature: nil
location: 37 2 38 68
body:
    product_eq_0        : THEOREM product(S,f) = 0 IMPLIES  
                                            (EXISTS (t:(S)): f(t) = 0)


decl_type: formula
theory: finite_sets_product_real
library: finite_sets
signature: nil
location: 50 2 52 62
body:
    product_remove_rew   : THEOREM f(t) /= 0 IMPLIES 
                            product(remove(t,S),f) = product(S,f) /
                                  IF S(t) THEN f(t) ELSE 1 ENDIF 


decl_type: formula
theory: finite_sets_product_real
library: finite_sets
signature: nil
location: 54 2 55 80
body:
    product_rest_rew     : THEOREM NOT empty?(S) AND f(choose(S)) /= 0 IMPLIES
                                  product(rest(S),f) = product(S,f) / f(choose(S))


decl_type: formula
theory: finite_sets_product_real
library: finite_sets
signature: nil
location: 57 2 58 63
body:
    product_union_rew    : THEOREM product(union(A,B),f)*product(intersection(A,B),f) 
                                    = product(A,f) * product(B,f)


decl_type: formula
theory: finite_sets_product_real
library: finite_sets
signature: nil
location: 62 2 63 68
body:
    product_eq_funs       : THEOREM (FORALL (t: (S)): f(t) = g(t)) 
                                 IMPLIES product(S, f) = product(S, g)


decl_type: formula
theory: finite_sets_product_real
library: finite_sets
signature: nil
location: 65 2 66 46
body:
    product_particular_gen: THEOREM product(S,f) = product(S, f WITH [t := cnz])
                                 * IF S(t) THEN f(t)/cnz ELSE 1 ENDIF 


decl_type: formula
theory: finite_sets_product_real
library: finite_sets
signature: nil
location: 73 2 74 67
body:
    product_pos      : LEMMA (FORALL (t: (S)): f(t) > 0) IMPLIES product(S,f) > 0 OR
                                                      S = emptyset[T]


decl_type: formula
theory: finite_sets_product_real
library: finite_sets
signature: nil
location: 91 2 92 71
body:
    product_eq_1        : THEOREM product(S,Fnat) = 1 IMPLIES  
                                            (FORALL (t:(S)): Fnat(t) = 1)


decl_type: judgement
theory: finite_sets_product_real
library: finite_sets
signature: posreal
location: 78 2 79 28
body:
    product_posreal: JUDGEMENT product(A: non_empty_finite_set[T], f: [T -> posreal])
              HAS_TYPE posreal


decl_type: tcc
theory: finite_sets_product_real
library: finite_sets
signature: nil
location: 116 0 123 999
body:
  % Assuming TCC generated (at line 20, column 12) for
      % finite_sets_product
      %     [T, real, 1,
      %      restrict[[numfield, numfield], [real, real], numfield](*)]
      % generated from assumption finite_sets_product.one_identity
  IMP_finite_sets_product_TCC1: OBLIGATION
    identity?[real]
        (restrict[[numfield, numfield], [real, real], numfield](*))(1);


decl_type: tcc
theory: finite_sets_product_real
library: finite_sets
signature: nil
location: 125 0 135 999
body:
  % Assuming TCC generated (at line 20, column 12) for
      % finite_sets_product
      %     [T, real, 1,
      %      restrict[[numfield, numfield], [real, real], numfield](*)]
      % generated from assumption finite_sets_product.mult_ac
  IMP_finite_sets_product_TCC2: OBLIGATION
    associative?[real]
        (restrict[[numfield, numfield], [real, real], numfield](*))
     AND
     commutative?[real]
         (restrict[[numfield, numfield], [real, real], numfield](*));


decl_type: tcc
theory: finite_sets_product_real
library: finite_sets
signature: nil
location: 137 0 140 999
body:
  % Subtype TCC generated (at line 30, column 63) for  card(S)
      % expected type  {i: int | c /= 0 OR i >= 0}
  product_const_TCC1: OBLIGATION
    FORALL (S: finite_set[T], c: real): c /= 0 OR card[T](S) >= 0;


decl_type: tcc
theory: finite_sets_product_real
library: finite_sets
signature: nil
location: 142 0 145 999
body:
  % Subtype TCC generated (at line 54, column 60) for  S
      % expected type  p: (nonempty?[T])
  product_rest_rew_TCC1: OBLIGATION
    FORALL (S: finite_set[T]): NOT empty?(S) IMPLIES nonempty?[T](S);


decl_type: tcc
theory: finite_sets_product_real
library: finite_sets
signature: nil
location: 147 0 161 999
body:
  % Judgement subtype TCC generated (at line 78, column 29) for  product(A, f)
      % expected type  posreal
  product_posreal: OBLIGATION
    FORALL (A: non_empty_finite_set[T], f: [T -> posreal]):
      product
          [T, real, 1,
           restrict[[numfield, numfield], [real, real], numfield](*)]
          (A, f)
       >= 0
       AND
       product
           [T, real, 1,
            restrict[[numfield, numfield], [real, real], numfield](*)]
           (A, f)
        > 0;


decl_type: tcc
theory: finite_sets_product_real
library: finite_sets
signature: nil
location: 163 0 179 999
body:
  % Judgement subtype TCC generated (at line 81, column 25) for  product(A, f)
      % expected type  int
  product_int: OBLIGATION
    FORALL (A: finite_set[T], f: [T -> int]):
      rational_pred(product
                        [T, real, 1,
                         restrict
                             [[numfield, numfield], [real, real], numfield]
                             (*)]
                        (A, f))
       AND
       integer_pred(product
                        [T, real, 1,
                         restrict
                             [[numfield, numfield], [real, real], numfield]
                             (*)]
                        (A, f));


decl_type: tcc
theory: finite_sets_product_real
library: finite_sets
signature: nil
location: 181 0 189 999
body:
  % Judgement subtype TCC generated (at line 83, column 25) for  product(A, f)
      % expected type  nat
  product_nat: OBLIGATION
    FORALL (A: finite_set[T], f: [T -> nat]):
      product
          [T, real, 1,
           restrict[[numfield, numfield], [real, real], numfield](*)]
          (A, f)
       >= 0;


decl_type: tcc
theory: finite_sets_product_real
library: finite_sets
signature: nil
location: 191 0 199 999
body:
  % Judgement subtype TCC generated (at line 101, column 12) for  product(A, f)
      % expected type  nonneg_real
  product_TCC1: OBLIGATION
    FORALL (A: finite_set[T], f: [T -> nonneg_real]):
      product
          [T, real, 1,
           restrict[[numfield, numfield], [real, real], numfield](*)]
          (A, f)
       >= 0;


decl_type: tcc
theory: finite_sets_product_real
library: finite_sets
signature: nil
location: 201 0 209 999
body:
  % Judgement subtype TCC generated (at line 104, column 12) for  product(A, f)
      % expected type  posnat
  product_TCC2: OBLIGATION
    FORALL (A: non_empty_finite_set[T], f: [T -> posnat]):
      product
          [T, real, 1,
           restrict[[numfield, numfield], [real, real], numfield](*)]
          (A, f)
       > 0;


decl_type: function
theory: fs_constructors
library: finite_sets
signature: [[T, T, T, T, T] -> non_empty_finite_set[T]]
location: 14 2 15 61
body:
    fs(a1,a2,a3,a4,a5): non_empty_finite_set[T] 
       = {t:T | t = a1 OR t = a2 OR t = a3 OR t = a4 OR t = a5}


decl_type: tcc
theory: fs_constructors
library: finite_sets
signature: nil
location: 23 0 27 999
body:
  % Subtype TCC generated (at line 6, column 36) for  {t: T | t = a1}
      % expected type  non_empty_finite_set[T]
  fs_TCC1: OBLIGATION
    FORALL (a1: T):
      is_finite[T]({t: T | t = a1}) AND NOT empty?[T]({t: T | t = a1});


decl_type: tcc
theory: fs_constructors
library: finite_sets
signature: nil
location: 29 0 35 999
body:
  % Subtype TCC generated (at line 8, column 39) for
      % {t: T | t = a1 OR t = a2}
      % expected type  non_empty_finite_set[T]
  fs_TCC2: OBLIGATION
    FORALL (a1: T, a2: T):
      is_finite[T]({t: T | t = a1 OR t = a2}) AND
       NOT empty?[T]({t: T | t = a1 OR t = a2});


decl_type: tcc
theory: fs_constructors
library: finite_sets
signature: nil
location: 37 0 43 999
body:
  % Subtype TCC generated (at line 10, column 42) for
      % {t: T | t = a1 OR t = a2 OR t = a3}
      % expected type  non_empty_finite_set[T]
  fs_TCC3: OBLIGATION
    FORALL (a1: T, a2: T, a3: T):
      is_finite[T]({t: T | t = a1 OR t = a2 OR t = a3}) AND
       NOT empty?[T]({t: T | t = a1 OR t = a2 OR t = a3});


decl_type: tcc
theory: fs_constructors
library: finite_sets
signature: nil
location: 45 0 51 999
body:
  % Subtype TCC generated (at line 12, column 45) for
      % {t: T | t = a1 OR t = a2 OR t = a3 OR t = a4}
      % expected type  non_empty_finite_set[T]
  fs_TCC4: OBLIGATION
    FORALL (a1: T, a2: T, a3: T, a4: T):
      is_finite[T]({t: T | t = a1 OR t = a2 OR t = a3 OR t = a4}) AND
       NOT empty?[T]({t: T | t = a1 OR t = a2 OR t = a3 OR t = a4});


decl_type: tcc
theory: fs_constructors
library: finite_sets
signature: nil
location: 53 0 62 999
body:
  % Subtype TCC generated (at line 15, column 7) for
      % {t: T |     t = a1 OR t = a2 OR t = a3 OR t = a4 OR t = a5}
      % expected type  non_empty_finite_set[T]
  fs_TCC5: OBLIGATION
    FORALL (a1: T, a2: T, a3: T, a4: T, a5: T):
      is_finite[T]
          ({t: T |     t = a1 OR t = a2 OR t = a3 OR t = a4 OR t = a5})
       AND
       NOT empty?[T]
               ({t: T |     t = a1 OR t = a2 OR t = a3 OR t = a4 OR t = a5});


decl_type: formula
theory: finite_cross
library: finite_sets
signature: nil
location: 12 2 13 59
body:
    is_finite_cross: LEMMA is_finite_type[T1] AND is_finite_type[T2] 
                              IMPLIES is_finite_type[[T1,T2]]


decl_type: formula
theory: finite_sets_minmax
library: finite_sets
signature: nil
location: 41 2 42 50
body:
    min_union: LEMMA min(A) = x AND min(B) = y IMPLIES
                        min(union(A,B)) = fsmin(x,y)


decl_type: formula
theory: finite_sets_minmax
library: finite_sets
signature: nil
location: 44 2 45 50
body:
    max_union: LEMMA max(A) = x AND max(B) = y IMPLIES
                        max(union(A,B)) = fsmax(x,y)


decl_type: function
theory: finite_sets_minmax
library: finite_sets
signature: [non_empty_finite_set[T] -> T]
location: 12 2 16 43
body:
    minrec(SS): RECURSIVE T = 
                  IF empty?(rest(SS)) THEN choose(SS)
                  ELSE fsmin(choose(SS),minrec(rest(SS)))
                  ENDIF
                MEASURE (LAMBDA SS: card(SS))


decl_type: function
theory: finite_sets_minmax
library: finite_sets
signature: [non_empty_finite_set[T] -> T]
location: 18 2 22 43
body:
    maxrec(SS): RECURSIVE T = 
                  IF empty?(rest(SS)) THEN choose(SS)
                  ELSE fsmax(choose(SS),maxrec(rest(SS)))
                  ENDIF
                MEASURE (LAMBDA SS: card(SS))


decl_type: tcc
theory: finite_sets_minmax
library: finite_sets
signature: nil
location: 53 0 56 999
body:
  % Termination TCC generated (at line 14, column 38) for  minrec(rest(SS))
  minrec_TCC1: OBLIGATION
    FORALL (SS: non_empty_finite_set[T]):
      NOT empty?(rest(SS)) IMPLIES card[T](rest[T](SS)) < card[T](SS);


decl_type: tcc
theory: finite_sets_minmax
library: finite_sets
signature: nil
location: 58 0 64 999
body:
  % Existence TCC generated (at line 29, column 2) for
      % min(SS): {a: T | SS(a) AND (FORALL (x: T): SS(x) IMPLIES a <= x)}
  min_TCC1: OBLIGATION
    EXISTS (x1:
              [SS: non_empty_finite_set[T] ->
                 {a: T | SS(a) AND (FORALL (x: T): SS(x) IMPLIES a <= x)}]):
      TRUE;


decl_type: tcc
theory: finite_sets_minmax
library: finite_sets
signature: nil
location: 66 0 72 999
body:
  % Existence TCC generated (at line 30, column 2) for
      % max(SS): {a: T | SS(a) AND (FORALL (x: T): SS(x) IMPLIES x <= a)}
  max_TCC1: OBLIGATION
    EXISTS (x1:
              [SS: non_empty_finite_set[T] ->
                 {a: T | SS(a) AND (FORALL (x: T): SS(x) IMPLIES x <= a)}]):
      TRUE;


decl_type: formula
theory: func_composition
library: finite_sets
signature: nil
location: 13 2 14 62
body:
    composition_injective : LEMMA injective?(f1) AND injective?(f2) 
                                     IMPLIES injective?(f2 o f1)


decl_type: formula
theory: func_composition
library: finite_sets
signature: nil
location: 16 2 17 63
body:
    composition_surjective: LEMMA surjective?(f1) AND surjective?(f2) 
                                     IMPLIES surjective?(f2 o f1)


decl_type: formula
theory: func_composition
library: finite_sets
signature: nil
location: 19 2 20 62
body:
    composition_bijective : LEMMA bijective?(f1) AND bijective?(f2) 
                                     IMPLIES bijective?(f2 o f1)


decl_type: formula
theory: func_composition
library: finite_sets
signature: nil
location: 29 2 30 72
body:
    composition_left_cancel1 : LEMMA injective?(h)  
                                        IMPLIES  (h o f = h o g IFF f = g)


decl_type: formula
theory: func_composition
library: finite_sets
signature: nil
location: 32 2 33 72
body:
    composition_left_cancel2 : LEMMA bijective?(h)  
                                        IMPLIES  (h o f = h o g IFF f = g)


decl_type: formula
theory: func_composition
library: finite_sets
signature: nil
location: 36 2 37 72
body:
    composition_right_cancel1: LEMMA surjective?(f)  
                                        IMPLIES  (h o f = k o f IFF h = k)


decl_type: formula
theory: func_composition
library: finite_sets
signature: nil
location: 39 2 40 72
body:
    composition_right_cancel2: LEMMA bijective?(f) 
                                        IMPLIES  (h o f = k o f IFF h = k)


decl_type: formula
theory: finite_sets_eq
library: finite_sets
signature: nil
location: 23 2 24 68
body:
    injection_to_finite_set    : LEMMA
          (EXISTS (f: [(S)->(F)]): injective?(f)) IMPLIES is_finite(S)


decl_type: formula
theory: finite_sets_eq
library: finite_sets
signature: nil
location: 26 2 27 69
body:
    surjection_from_finite_set : LEMMA
          (EXISTS (f: [(E)->(U)]): surjective?(f)) IMPLIES is_finite(U)


decl_type: formula
theory: finite_sets_eq
library: finite_sets
signature: nil
location: 29 2 30 74
body:
    injection_to_finite_set2   : LEMMA
          (FORALL S, F, (f: [(S)->(F)]): injective?(f) IMPLIES is_finite(S))


decl_type: formula
theory: finite_sets_eq
library: finite_sets
signature: nil
location: 32 2 33 75
body:
    surjection_from_finite_set2: LEMMA
          (FORALL E, U, (f: [(E)->(U)]): surjective?(f) IMPLIES is_finite(U))


decl_type: formula
theory: finite_sets_eq
library: finite_sets
signature: nil
location: 35 2 36 68
body:
    bijection_finite_set1      : LEMMA
          (EXISTS (f: [(S)->(F)]): bijective?(f)) IMPLIES is_finite(S)


decl_type: formula
theory: finite_sets_eq
library: finite_sets
signature: nil
location: 38 2 39 68
body:
    bijection_finite_set2      : LEMMA
          (EXISTS (f: [(E)->(U)]): bijective?(f)) IMPLIES is_finite(U)


decl_type: formula
theory: finite_sets_card_eq
library: finite_sets
signature: nil
location: 21 2 22 57
body:
    card_injection         : LEMMA (EXISTS (f : [(E)->below[N]]) : injective?(f)) 
                                       IMPLIES card(E) <= N


decl_type: formula
theory: finite_sets_card_eq
library: finite_sets
signature: nil
location: 24 2 25 57
body:
    card_surjection        : LEMMA (EXISTS (f : [(E)->below[N]]) : surjective?(f)) 
                                       IMPLIES N <= card(E) 


decl_type: formula
theory: finite_sets_card_eq
library: finite_sets
signature: nil
location: 28 2 29 70
body:
    injection_and_cardinal : LEMMA (EXISTS (f : [(E)->(F)]): injective?(f))
                                              IMPLIES card(E) <= card(F)


decl_type: formula
theory: finite_sets_card_eq
library: finite_sets
signature: nil
location: 31 2 32 70
body:
    surjection_and_cardinal: LEMMA (EXISTS (f: [(E)->(F)]): surjective?(f))
                                              IMPLIES card(F) <= card(E)


decl_type: formula
theory: finite_sets_card_eq
library: finite_sets
signature: nil
location: 34 2 35 79
body:
    card_eq_bij            : LEMMA card(E) = card(F) IFF 
                                            EXISTS (f: [(E)->(F)]): bijective?(f)


decl_type: formula
theory: finite_sets_below
library: finite_sets
signature: nil
location: 22 2 23 60
body:
    pidgeon_hole      : LEMMA card(A) + card(B) >= N + k IMPLIES 
                                  card(intersection(A,B)) >= k


decl_type: tcc
theory: finite_sets_below
library: finite_sets
signature: nil
location: 31 0 33 999
body:
  % Subtype TCC generated (at line 11, column 43) for  fullset[below(N)]
      % expected type  S: finite_set[below(N)]
  card_below_fullset_TCC1: OBLIGATION is_finite[below(N)](fullset[below(N)]);


decl_type: tcc
theory: finite_sets_below
library: finite_sets
signature: nil
location: 35 0 38 999
body:
  % Subtype TCC generated (at line 13, column 43) for  BS
      % expected type  S: finite_set[below(N)]
  card_below_TCC1: OBLIGATION
    FORALL (BS: set[below(N)]): is_finite[below(N)](BS);


decl_type: tcc
theory: finite_sets_below
library: finite_sets
signature: nil
location: 40 0 42 999
body:
  % Subtype TCC generated (at line 17, column 42) for  fullset[upto(N)]
      % expected type  S: finite_set[upto(N)]
  card_upto_fullset_TCC1: OBLIGATION is_finite[upto(N)](fullset[upto(N)]);


decl_type: tcc
theory: finite_sets_below
library: finite_sets
signature: nil
location: 44 0 47 999
body:
  % Subtype TCC generated (at line 19, column 42) for  US
      % expected type  S: finite_set[upto(N)]
  card_upto_TCC1: OBLIGATION
    FORALL (US: set[upto(N)]): is_finite[upto(N)](US);


decl_type: tcc
theory: finite_sets_below
library: finite_sets
signature: nil
location: 49 0 54 999
body:
  % Subtype TCC generated (at line 23, column 37) for  intersection(A, B)
      % expected type  S: finite_set[below(N)]
  pidgeon_hole_TCC1: OBLIGATION
    FORALL (A, B: set[below(N)], k: nat):
      card(A) + card(B) >= N + k IMPLIES
       is_finite[below(N)](intersection[below(N)](A, B));


decl_type: tcc
theory: finite_sets_pred
library: finite_sets
signature: nil
location: 21 0 26 999
body:
  % Subtype TCC generated (at line 14, column 26) for  {x: T | P1(x)}
      % expected type  S: finite_set[T]
  card_implies_TCC1: OBLIGATION
    FORALL (P1, P2: pred[T]):
      (FORALL (x: T): P1(x) IMPLIES P2(x)) AND is_finite(fullset[T]) IMPLIES
       is_finite[T]({x: T | P1(x)});


decl_type: tcc
theory: finite_sets_pred
library: finite_sets
signature: nil
location: 28 0 33 999
body:
  % Subtype TCC generated (at line 14, column 50) for  {x: T | P2(x)}
      % expected type  S: finite_set[T]
  card_implies_TCC2: OBLIGATION
    FORALL (P1, P2: pred[T]):
      (FORALL (x: T): P1(x) IMPLIES P2(x)) AND is_finite(fullset[T]) IMPLIES
       is_finite[T]({x: T | P2(x)});


decl_type: formula
theory: finite_sets_nat
library: finite_sets
signature: nil
location: 31 2 32 74
body:
    finite_nat_subrange: LEMMA
        is_finite[nat](restrict[int, nat, bool]({x: subrange(i, j) | TRUE}))


decl_type: formula
theory: finite_sets_nat
library: finite_sets
signature: nil
location: 34 2 36 68
body:
    card_nat_subrange  : LEMMA
        card[nat](restrict[int, nat, bool]({x: subrange(i, j) | TRUE})) =
                                 IF i <= j THEN j - i + 1 ELSE 0 ENDIF


decl_type: tcc
theory: finite_sets_nat
library: finite_sets
signature: nil
location: 44 0 47 999
body:
  % Subtype TCC generated (at line 11, column 36) for  {j: nat | j < N}
      % expected type  S: finite_set[nat]
  card_bounded_TCC1: OBLIGATION
    FORALL (N: nat): is_finite[nat]({j: nat | j < N});


decl_type: tcc
theory: finite_sets_nat
library: finite_sets
signature: nil
location: 49 0 53 999
body:
  % Subtype TCC generated (at line 15, column 36) for
      % {j: nat | j < N AND p(j)}
      % expected type  S: finite_set[nat]
  card_bounded_subset_TCC1: OBLIGATION
    FORALL (N: nat, p: pred[nat]): is_finite[nat]({j: nat | j < N AND p(j)});


decl_type: tcc
theory: finite_sets_nat
library: finite_sets
signature: nil
location: 55 0 61 999
body:
  % Subtype TCC generated (at line 25, column 39) for
      % extend[nat, below(n), bool, FALSE]({x: below(n) | TRUE})
      % expected type  S: finite_set[nat]
  card_nat_below_TCC1: OBLIGATION
    FORALL (n: nat):
      is_finite[nat]
          (extend[nat, below(n), bool, FALSE]({x: below(n) | TRUE}));


decl_type: tcc
theory: finite_sets_nat
library: finite_sets
signature: nil
location: 63 0 68 999
body:
  % Subtype TCC generated (at line 29, column 39) for
      % extend[nat, upto(n), bool, FALSE]({x: upto(n) | TRUE})
      % expected type  S: finite_set[nat]
  card_nat_upto_TCC1: OBLIGATION
    FORALL (n: nat):
      is_finite[nat](extend[nat, upto(n), bool, FALSE]({x: upto(n) | TRUE}));


decl_type: tcc
theory: finite_sets_nat
library: finite_sets
signature: nil
location: 70 0 80 999
body:
  % Subtype TCC generated (at line 35, column 16) for
      % restrict[int, nat, bool]
      %     (extend[int, subrange(i, j), bool, FALSE]
      %          ({x: subrange(i, j) | TRUE}))
      % expected type  S: finite_set[nat]
  card_nat_subrange_TCC1: OBLIGATION
    FORALL (i, j: nat):
      is_finite[nat]
          (restrict[int, nat, bool]
               (extend[int, subrange(i, j), bool, FALSE]
                    ({x: subrange(i, j) | TRUE})));


decl_type: formula
theory: finite_sets_int
library: finite_sets
signature: nil
location: 15 2 16 72
body:
    card_subrng         : LEMMA card({x | in_subrng(x,i,j)}) =
                                    IF i <= j THEN abs(j-i+1) ELSE 0 ENDIF


decl_type: formula
theory: finite_sets_int
library: finite_sets
signature: nil
location: 29 2 30 74
body:
    card_int_subrange       : LEMMA card[int]({x: subrange(i, j) | TRUE}) =
                                      IF i <= j THEN abs(j-i+1) ELSE 0 ENDIF


decl_type: tcc
theory: finite_sets_int
library: finite_sets
signature: nil
location: 37 0 41 999
body:
  % Subtype TCC generated (at line 15, column 35) for
      % {x | in_subrng(x, i, j)}
      % expected type  S: finite_set[int]
  card_subrng_TCC1: OBLIGATION
    FORALL (i, j: int): is_finite[int]({x | in_subrng(x, i, j)});


decl_type: tcc
theory: finite_sets_int
library: finite_sets
signature: nil
location: 43 0 50 999
body:
  % Subtype TCC generated (at line 29, column 44) for
      % extend[int, subrange(i, j), bool, FALSE]({x: subrange(i, j) | TRUE})
      % expected type  S: finite_set[int]
  card_int_subrange_TCC1: OBLIGATION
    FORALL (i, j: int):
      is_finite[int]
          (extend[int, subrange(i, j), bool, FALSE]
               ({x: subrange(i, j) | TRUE}));


decl_type: formula
theory: prelude_aux
library: finite_sets
signature: nil
location: 7 2 8 58
body:
    rest_emptyset: LEMMA (FORALL (S: set[T], t:T): rest(S) = emptyset[T]
                             AND S(t) IMPLIES choose(S) = t)


decl_type: tcc
theory: prelude_aux
library: finite_sets
signature: nil
location: 16 0 20 999
body:
  % Subtype TCC generated (at line 8, column 51) for  S
      % expected type  p: (nonempty?[T])
  rest_emptyset_TCC1: OBLIGATION
    FORALL (S: set[T], t: T):
      rest(S) = emptyset[T] AND S(t) IMPLIES nonempty?[T](S);


decl_type: formula
theory: finite_sets_sum
library: finite_sets
signature: nil
location: 40 2 41 70
body:
    sum_x         : THEOREM (FORALL (x: (S)): 
                                sum(S, f) = f(x) + sum(remove(x, S), f))


decl_type: formula
theory: finite_sets_sum
library: finite_sets
signature: nil
location: 43 2 44 60
body:
    sum_x1_x2     : LEMMA (FORALL (x1,x2: (S)): f(x1) + sum(remove(x1,S),f) 
                                = f(x2) + sum(remove(x2,S),f))


decl_type: formula
theory: finite_sets_sum
library: finite_sets
signature: nil
location: 46 2 47 79
body:
    sum_add       : THEOREM sum(add(x,S),f) 
                            = sum(S,f) + IF member(x,S) THEN zero ELSE f(x) ENDIF


decl_type: formula
theory: finite_sets_sum
library: finite_sets
signature: nil
location: 49 2 50 79
body:
    sum_remove    : THEOREM sum(remove(x,S),f) 
                            + IF member(x,S) THEN f(x) ELSE zero ENDIF = sum(S,f)


decl_type: formula
theory: finite_sets_sum
library: finite_sets
signature: nil
location: 52 2 53 68
body:
    sum_rest      : THEOREM NOT empty?(S) IMPLIES
                              f(choose(S)) + sum(rest(S),f) = sum(S,f)


decl_type: formula
theory: finite_sets_sum
library: finite_sets
signature: nil
location: 55 2 56 67
body:
    sum_disj_union: THEOREM disjoint?(A,B) IMPLIES 
                              sum(union(A,B),f) = sum(A,f) + sum(B,f) 


decl_type: formula
theory: finite_sets_sum
library: finite_sets
signature: nil
location: 58 2 59 62
body:
    sum_diff_subset: THEOREM subset?(A, B) IMPLIES 
                              sum(difference(B, A), f) + sum(A, f) = sum(B, f) 


decl_type: formula
theory: finite_sets_sum
library: finite_sets
signature: nil
location: 61 2 62 60
body:
    sum_union      : THEOREM sum(union(A,B),f) + sum(intersection(A,B),f) =
                                           sum(A,f) + sum(B,f) 


decl_type: formula
theory: finite_sets_sum
library: finite_sets
signature: nil
location: 64 2 65 77
body:
    sum_diff_intersection: THEOREM sum(A,f) = 
                              sum(difference(A,B),f) + sum(intersection(A,B),f) 


decl_type: formula
theory: finite_sets_sum
library: finite_sets
signature: nil
location: 67 2 68 60
body:
    sum_f_g         : LEMMA (FORALL (x: (S)): f(x) = g(x)) 
                                 IMPLIES sum(S, f) = sum(S, g)


decl_type: formula
theory: finite_sets_sum
library: finite_sets
signature: nil
location: 70 2 71 45
body:
    sum_particular  : THEOREM sum(S,f) = sum(S, f WITH [x := zero])
                                 + IF S(x) THEN f(x) ELSE zero ENDIF 


decl_type: formula
theory: finite_sets_sum
library: finite_sets
signature: nil
location: 73 2 74 62
body:
    sum_distributive: THEOREM sum(A,f) + sum(A,g) = 
                                  sum(A,(LAMBDA x: f(x) + g(x))) 


decl_type: function
theory: finite_sets_sum
library: finite_sets
signature: [[finite_set[T], [T -> R]] -> R]
location: 31 2 34 39
body:
    sum(S,f) : RECURSIVE R = 
      IF (empty?(S)) THEN zero
      ELSE f(choose(S)) + sum(rest(S),f)
      ENDIF MEASURE (LAMBDA S,f: card(S))


decl_type: tcc
theory: finite_sets_sum
library: finite_sets
signature: nil
location: 81 0 85 999
body:
  % Subtype TCC generated (at line 33, column 18) for  S
      % expected type  p: (nonempty?[T])
  sum_TCC1: OBLIGATION
    FORALL (S: finite_set[T], f: [T -> R]):
      NOT (empty?(S)) IMPLIES nonempty?[T](S);


decl_type: tcc
theory: finite_sets_sum
library: finite_sets
signature: nil
location: 87 0 90 999
body:
  % Termination TCC generated (at line 33, column 24) for  sum(rest(S), f)
  sum_TCC2: OBLIGATION
    FORALL (S: finite_set[T], f: [T -> R]):
      NOT (empty?(S)) IMPLIES card[T](rest[T](S)) < card[T](S);


decl_type: tcc
theory: finite_sets_sum
library: finite_sets
signature: nil
location: 92 0 95 999
body:
  % Subtype TCC generated (at line 53, column 37) for  S
      % expected type  p: (nonempty?[T])
  sum_rest_TCC1: OBLIGATION
    FORALL (S: finite_set[T]): NOT empty?(S) IMPLIES nonempty?[T](S);


decl_type: formula
theory: finite_sets_sum_real
library: finite_sets
signature: nil
location: 41 2 42 69
body:
    sum_remove_rew   : THEOREM sum(remove(t,S),f) = sum(S,f) -
                                  IF member(t,S) THEN f(t) ELSE 0 ENDIF 


decl_type: formula
theory: finite_sets_sum_real
library: finite_sets
signature: nil
location: 45 2 46 72
body:
    sum_rest_rew     : THEOREM NOT empty?(S) IMPLIES
                                  sum(rest(S),f) = sum(S,f) - f(choose(S))


decl_type: formula
theory: finite_sets_sum_real
library: finite_sets
signature: nil
location: 48 2 49 59
body:
    sum_union_rew    : THEOREM sum(union(A,B),f) = sum(A,f) + sum(B,f)
                                   - sum(intersection(A,B),f) 


decl_type: formula
theory: finite_sets_sum_real
library: finite_sets
signature: nil
location: 54 2 55 60
body:
    sum_eq_funs       : THEOREM (FORALL (t: (S)): f(t) = g(t)) 
                                 IMPLIES sum(S, f) = sum(S, g)


decl_type: formula
theory: finite_sets_sum_real
library: finite_sets
signature: nil
location: 57 2 58 46
body:
    sum_particular_gen: THEOREM sum(S,f) = sum(S, f WITH [t := c])
                                 + IF S(t) THEN f(t) - c ELSE 0 ENDIF 


decl_type: formula
theory: finite_sets_sum_real
library: finite_sets
signature: nil
location: 63 2 64 58
body:
    sum_bound    : THEOREM (FORALL (t: (S)): f(t) <= N) 
                               IMPLIES sum(S,f) <= N*card(S)


decl_type: formula
theory: finite_sets_sum_real
library: finite_sets
signature: nil
location: 66 2 67 47
body:
    sum_order    : THEOREM (FORALL (t:T): f(t) <= g(t)) IMPLIES
                             sum(S,f) <= sum(S,g)


decl_type: formula
theory: finite_sets_sum_real
library: finite_sets
signature: nil
location: 71 2 72 67
body:
    sum_pos      : LEMMA (FORALL (t: (S)): f(t) > 0) IMPLIES sum(S,f) > 0 OR
                                                      S = emptyset[T]


decl_type: formula
theory: finite_sets_sum_real
library: finite_sets
signature: nil
location: 87 2 88 59
body:
    sum_order_sub: THEOREM subset?(A,B) AND (FORALL (t:T): fnr(t) <= gnr(t))
                             IMPLIES sum(A,fnr) <= sum(B,gnr)


decl_type: formula
theory: finite_sets_sum_real
library: finite_sets
signature: nil
location: 93 2 94 69
body:
    sum_0_nat       : THEOREM sum(S,gn) = 0 IMPLIES  S = emptyset[T] OR
                                            (FORALL (t:(S)): gn(t) = 0)


decl_type: formula
theory: finite_sets_sum_real
library: finite_sets
signature: nil
location: 98 2 99 77
body:
    sum_0_int       : THEOREM sum(S,gi) = 0 IMPLIES S = emptyset[T]
                                                 OR (FORALL (t:(S)): gi(t) = 0)


decl_type: formula
theory: finite_sets_sum_real
library: finite_sets
signature: nil
location: 101 2 103 67
body:
    sum_0_non_neg   : THEOREM sum(S,f) = 0 AND (FORALL (t: (S)): f(t) >= 0) 
                               IMPLIES S = emptyset[T] 
                                        OR (FORALL (t:(S)): f(t) = 0)


decl_type: tcc
theory: finite_sets_sum_real
library: finite_sets
signature: nil
location: 120 0 127 999
body:
  % Assuming TCC generated (at line 20, column 12) for
      % finite_sets_sum
      %     [T, real, 0,
      %      restrict[[numfield, numfield], [real, real], numfield](+)]
      % generated from assumption finite_sets_sum.zero_identity
  IMP_finite_sets_sum_TCC1: OBLIGATION
    identity?[real]
        (restrict[[numfield, numfield], [real, real], numfield](+))(0);


decl_type: tcc
theory: finite_sets_sum_real
library: finite_sets
signature: nil
location: 129 0 139 999
body:
  % Assuming TCC generated (at line 20, column 12) for
      % finite_sets_sum
      %     [T, real, 0,
      %      restrict[[numfield, numfield], [real, real], numfield](+)]
      % generated from assumption finite_sets_sum.plus_ac
  IMP_finite_sets_sum_TCC2: OBLIGATION
    associative?[real]
        (restrict[[numfield, numfield], [real, real], numfield](+))
     AND
     commutative?[real]
         (restrict[[numfield, numfield], [real, real], numfield](+));


decl_type: tcc
theory: finite_sets_sum_real
library: finite_sets
signature: nil
location: 141 0 144 999
body:
  % Subtype TCC generated (at line 46, column 69) for  S
      % expected type  p: (nonempty?[T])
  sum_rest_rew_TCC1: OBLIGATION
    FORALL (S: finite_set[T]): NOT empty?(S) IMPLIES nonempty?[T](S);


decl_type: tcc
theory: finite_sets_sum_real
library: finite_sets
signature: nil
location: 146 0 160 999
body:
  % Judgement subtype TCC generated (at line 74, column 12) for  sum(A, f)
      % expected type  posreal
  sum_TCC1: OBLIGATION
    FORALL (A: non_empty_finite_set[T], f: [T -> posreal]):
      sum
          [T, real, 0,
           restrict[[numfield, numfield], [real, real], numfield](+)]
          (A, f)
       >= 0
       AND
       sum
           [T, real, 0,
            restrict[[numfield, numfield], [real, real], numfield](+)]
           (A, f)
        > 0;


decl_type: tcc
theory: finite_sets_sum_real
library: finite_sets
signature: nil
location: 162 0 178 999
body:
  % Judgement subtype TCC generated (at line 77, column 12) for  sum(A, f)
      % expected type  int
  sum_TCC2: OBLIGATION
    FORALL (A: finite_set[T], f: [T -> int]):
      rational_pred(sum
                        [T, real, 0,
                         restrict
                             [[numfield, numfield], [real, real], numfield]
                             (+)]
                        (A, f))
       AND
       integer_pred(sum
                        [T, real, 0,
                         restrict
                             [[numfield, numfield], [real, real], numfield]
                             (+)]
                        (A, f));


decl_type: tcc
theory: finite_sets_sum_real
library: finite_sets
signature: nil
location: 180 0 188 999
body:
  % Judgement subtype TCC generated (at line 79, column 12) for  sum(A, f)
      % expected type  nat
  sum_TCC3: OBLIGATION
    FORALL (A: finite_set[T], f: [T -> nat]):
      sum
          [T, real, 0,
           restrict[[numfield, numfield], [real, real], numfield](+)]
          (A, f)
       >= 0;


decl_type: tcc
theory: finite_sets_sum_real
library: finite_sets
signature: nil
location: 190 0 198 999
body:
  % Judgement subtype TCC generated (at line 105, column 12) for  sum(A, f)
      % expected type  nonneg_real
  sum_TCC4: OBLIGATION
    FORALL (A: finite_set[T], f: [T -> nonneg_real]):
      sum
          [T, real, 0,
           restrict[[numfield, numfield], [real, real], numfield](+)]
          (A, f)
       >= 0;


decl_type: tcc
theory: finite_sets_sum_real
library: finite_sets
signature: nil
location: 200 0 208 999
body:
  % Judgement subtype TCC generated (at line 108, column 12) for  sum(A, f)
      % expected type  posnat
  sum_TCC5: OBLIGATION
    FORALL (A: non_empty_finite_set[T], f: [T -> posnat]):
      sum
          [T, real, 0,
           restrict[[numfield, numfield], [real, real], numfield](+)]
          (A, f)
       > 0;


decl_type: formula
theory: product
library: ints
signature: nil
location: 46 2 53 40
body:
    high_low_rewrite: LEMMA
     (FORALL (p: pred[[T_high, T_low]]):
       (FORALL (high: T_high), (low: T_low):
        IF high < low THEN p(high, low) 
        ELSE (FORALL (n: subrange(low, high)): p(n, low))
        ENDIF)
      IMPLIES
        (FORALL high, low:  p(high, low)))


decl_type: formula
theory: product
library: ints
signature: nil
location: 65 2 67 84
body:
    product_spl     : THEOREM T_pred(low + nn + rng) IMPLIES 
                             product(low, low+nn+rng, F) = 
                                product(low,low+nn,F) * product(low+nn+1,low+nn+rng,F)


decl_type: formula
theory: product
library: ints
signature: nil
location: 69 2 71 79
body:
    product_split   : THEOREM low - 1 <= z AND z <= high IMPLIES 
                              product(low, high, F) = 
                                       product(low, z, F) * product(z+1, high, F)


decl_type: formula
theory: product
library: ints
signature: nil
location: 74 2 75 86
body:
    product_div     : THEOREM low - 1 <= z AND z <= high AND product(low, z, F) /= 0 IMPLIES
                      product(low, high, F) / product(low, z, F) = product(z+1, high, F)


decl_type: formula
theory: product
library: ints
signature: nil
location: 77 2 80 95
body:
    product_div_neg : THEOREM low - 1 <= z AND z <= high AND 
                              product(low, high, F) /= 0 AND product(z+1, high, F) /= 0 
                         IMPLIES
                             product(low, z, F) / product(low, high, F) = 1/product(z+1, high, F)


decl_type: formula
theory: product
library: ints
signature: nil
location: 85 2 86 83
body:
    product_first   : THEOREM high >= low IMPLIES 
                             product(low, high, F) = F(low) * product(low+1, high, F)


decl_type: formula
theory: product
library: ints
signature: nil
location: 88 2 89 83
body:
    product_last    : THEOREM high >= low IMPLIES 
                            product(low, high, F) = product(low, high-1, F) * F(high)


decl_type: formula
theory: product
library: ints
signature: nil
location: 91 2 93 69
body:
    product_middle : THEOREM high >= i AND i >= low IMPLIES
                            product(low, high, F) = product(low, i-1, F) * F(i) *
                                                  product(i+1, high, F) 


decl_type: formula
theory: product
library: ints
signature: nil
location: 95 2 96 76
body:
    product_const   : THEOREM product(low, high, (LAMBDA i: nzr)) = 
                             IF high >= low THEN nzr^(high-low+1) ELSE 1 ENDIF


decl_type: formula
theory: product
library: ints
signature: nil
location: 101 2 102 69
body:
    product_scal    : THEOREM low <= high AND a /= 0 IMPLIES product(low, high, (LAMBDA i: a * F(i)))
                               = a^(high-low+1) * product(low, high, F)


decl_type: formula
theory: product
library: ints
signature: nil
location: 110 2 111 64
body:
    product_ge_0    : THEOREM (FORALL (n: subrange(low,high)): F(n) >= 0)
                                  IMPLIES product(low,high,F) >= 0


decl_type: formula
theory: product
library: ints
signature: nil
location: 113 2 114 63
body:
    product_gt_0    : THEOREM (FORALL (n: subrange(low,high)): F(n) > 0)
                                  IMPLIES product(low,high,F) > 0


decl_type: formula
theory: product
library: ints
signature: nil
location: 117 2 119 77
body:
    product_shift_T : THEOREM (FORALL (i:T): T_pred(i+z)) IMPLIES 
                                   product(low+z,high+z,F) = 
                                      product(low,high, (LAMBDA (i:T): F(i+z)))


decl_type: formula
theory: product
library: ints
signature: nil
location: 121 2 124 63
body:
    product_shift_T2 : THEOREM T_pred(low+z) AND T_pred(high+z) IMPLIES 
                                   product(low+z,high+z,F) = 
                    product(low,high, (LAMBDA (i:T): IF T_pred(i+z) THEN F(i+z)
                                                   ELSE 1 ENDIF))


decl_type: formula
theory: product
library: ints
signature: nil
location: 129 2 130 74
body:
    product_prod     : THEOREM product(low, high, F) * product(low, high, G)
                               = product(low, high, (LAMBDA i: F(i) * G(i)))


decl_type: formula
theory: product
library: ints
signature: nil
location: 143 2 144 83
body:
    product_restrict   : THEOREM l <= low AND h >= high IMPLIES   
                              product(low,high,F) = product(low,high,restrict(F,l,h))


decl_type: formula
theory: product
library: ints
signature: nil
location: 147 2 148 70
body:
    product_restrict_to: THEOREM product(low,high,F) = 
                                  product(low,high,restrict(F,low,high))


decl_type: formula
theory: product
library: ints
signature: nil
location: 150 2 151 81
body:
    product_restrict_eq: THEOREM restrict(F,low,high) = restrict(G,low,high) 
                                  IMPLIES product(low,high,F) = product(low,high,G) 


decl_type: formula
theory: product
library: ints
signature: nil
location: 154 2 155 81
body:
    product_eq         : THEOREM (FORALL (n: subrange(low,high)): F(n) = G(n))
                                  IMPLIES product(low,high,F) = product(low,high,G) 


decl_type: formula
theory: product
library: ints
signature: nil
location: 166 2 168 77
body:
    product_with         : THEOREM low <= i AND i <= high AND G(i) /= 0 AND
                               F = G WITH [i := a] IMPLIES
                            product(low, high,F) = a*product(low,high,G) / G(i)


decl_type: formula
theory: product
library: ints
signature: nil
location: 172 2 173 67
body:
    product_nonneg     : THEOREM (FORALL i: F(i) >= 0) 
                                   IMPLIES product(low, high, F) >= 0


decl_type: function
theory: product
library: ints
signature: [[T_low, T_high, [T -> int]] -> int]
location: 58 3 62 49
body:
     product(low, high, F): RECURSIVE int
        = IF low > high THEN 1
          ELSE  F(high)*product(low, high-1, F)
          ENDIF                            
     MEASURE (LAMBDA low, high, F: abs(high+1-low))


decl_type: function
theory: product
library: ints
signature: [[[T -> int], T_low, T_high] -> [T -> int]]
location: 140 2 141 63
body:
    restrict(F, low, high): function[T -> int] = 
       (LAMBDA i: IF i < low OR i > high THEN 0 ELSE F(i) ENDIF )


decl_type: tcc
theory: product
library: ints
signature: nil
location: 195 0 201 999
body:
  % Subtype TCC generated (at line 50, column 47) for  n
      % expected type  T_high
  high_low_rewrite_TCC1: OBLIGATION
    FORALL (high: T_high, low: T_low):
      NOT high < low IMPLIES
       (FORALL (n: subrange(low, high)):
          T_pred(n) OR (EXISTS (j: T): n <= j));


decl_type: tcc
theory: product
library: ints
signature: nil
location: 203 0 206 999
body:
  % Subtype TCC generated (at line 60, column 16) for  high
      % expected type  T
  product_TCC1: OBLIGATION
    FORALL (low: T_low, high: T_high): NOT low > high IMPLIES T_pred(high);


decl_type: tcc
theory: product
library: ints
signature: nil
location: 208 0 213 999
body:
  % Subtype TCC generated (at line 60, column 35) for  high - 1
      % expected type  T_high
  product_TCC2: OBLIGATION
    FORALL (low: T_low, high: T_high):
      NOT low > high IMPLIES
       T_pred(high - 1) OR (EXISTS (j: T): high - 1 <= j);


decl_type: tcc
theory: product
library: ints
signature: nil
location: 215 0 219 999
body:
  % Termination TCC generated (at line 60, column 22) for
      % product(low, high - 1, F)
  product_TCC3: OBLIGATION
    FORALL (low: T_low, high: T_high):
      NOT low > high IMPLIES abs(high - 1 + 1 - low) < abs(high + 1 - low);


decl_type: tcc
theory: product
library: ints
signature: nil
location: 221 0 226 999
body:
  % Subtype TCC generated (at line 66, column 40) for  low + nn + rng
      % expected type  T_high
  product_spl_TCC1: OBLIGATION
    FORALL (low: T_low, nn, rng: nat):
      T_pred(low + nn + rng) IMPLIES
       T_pred(low + nn + rng) OR (EXISTS (j: T): low + nn + rng <= j);


decl_type: tcc
theory: product
library: ints
signature: nil
location: 228 0 233 999
body:
  % Subtype TCC generated (at line 67, column 42) for  low + nn
      % expected type  T_high
  product_spl_TCC2: OBLIGATION
    FORALL (low: T_low, nn, rng: nat):
      T_pred(low + nn + rng) IMPLIES
       T_pred(low + nn) OR (EXISTS (j: T): low + nn <= j);


decl_type: tcc
theory: product
library: ints
signature: nil
location: 235 0 240 999
body:
  % Subtype TCC generated (at line 67, column 62) for  low + nn + 1
      % expected type  T_low
  product_spl_TCC3: OBLIGATION
    FORALL (low: T_low, nn, rng: nat):
      T_pred(low + nn + rng) IMPLIES
       T_pred(low + nn + 1) OR (EXISTS (j: T): j <= low + nn + 1);


decl_type: tcc
theory: product
library: ints
signature: nil
location: 242 0 246 999
body:
  % Subtype TCC generated (at line 71, column 50) for  z
      % expected type  T_high
  product_split_TCC1: OBLIGATION
    FORALL (high: T_high, low: T_low, z: int):
      z <= high AND low - 1 <= z IMPLIES T_pred(z) OR (EXISTS (j: T): z <= j);


decl_type: tcc
theory: product
library: ints
signature: nil
location: 248 0 253 999
body:
  % Subtype TCC generated (at line 71, column 66) for  z + 1
      % expected type  T_low
  product_split_TCC2: OBLIGATION
    FORALL (high: T_high, low: T_low, z: int):
      z <= high AND low - 1 <= z IMPLIES
       T_pred(z + 1) OR (EXISTS (j: T): j <= z + 1);


decl_type: tcc
theory: product
library: ints
signature: nil
location: 255 0 258 999
body:
  % Subtype TCC generated (at line 86, column 53) for  low
      % expected type  T
  product_first_TCC1: OBLIGATION
    FORALL (high: T_high, low: T_low): high >= low IMPLIES T_pred(low);


decl_type: tcc
theory: product
library: ints
signature: nil
location: 260 0 264 999
body:
  % Subtype TCC generated (at line 86, column 68) for  low + 1
      % expected type  T_low
  product_first_TCC2: OBLIGATION
    FORALL (high: T_high, low: T_low):
      high >= low IMPLIES T_pred(low + 1) OR (EXISTS (j: T): j <= low + 1);


decl_type: tcc
theory: product
library: ints
signature: nil
location: 266 0 270 999
body:
  % Subtype TCC generated (at line 89, column 63) for  high - 1
      % expected type  T_high
  product_last_TCC1: OBLIGATION
    FORALL (high: T_high, low: T_low):
      high >= low IMPLIES T_pred(high - 1) OR (EXISTS (j: T): high - 1 <= j);


decl_type: tcc
theory: product
library: ints
signature: nil
location: 272 0 275 999
body:
  % Subtype TCC generated (at line 89, column 78) for  high
      % expected type  T
  product_last_TCC2: OBLIGATION
    FORALL (high: T_high, low: T_low): high >= low IMPLIES T_pred(high);


decl_type: tcc
theory: product
library: ints
signature: nil
location: 277 0 282 999
body:
  % Subtype TCC generated (at line 92, column 63) for  i - 1
      % expected type  T_high
  product_middle_TCC1: OBLIGATION
    FORALL (high: T_high, i: T, low: T_low):
      i >= low AND high >= i IMPLIES
       T_pred(i - 1) OR (EXISTS (j: T): i - 1 <= j);


decl_type: tcc
theory: product
library: ints
signature: nil
location: 284 0 289 999
body:
  % Subtype TCC generated (at line 93, column 56) for  i + 1
      % expected type  T_low
  product_middle_TCC2: OBLIGATION
    FORALL (high: T_high, i: T, low: T_low):
      i >= low AND high >= i IMPLIES
       T_pred(i + 1) OR (EXISTS (j: T): j <= i + 1);


decl_type: tcc
theory: product
library: ints
signature: nil
location: 291 0 295 999
body:
  % Subtype TCC generated (at line 96, column 52) for  (high - low + 1)
      % expected type  {i: int | nzr /= 0 OR i >= 0}
  product_const_TCC1: OBLIGATION
    FORALL (high: T_high, low: T_low, nzr: nzint):
      high >= low IMPLIES nzr /= 0 OR (high - low + 1) >= 0;


decl_type: tcc
theory: product
library: ints
signature: nil
location: 297 0 301 999
body:
  % Subtype TCC generated (at line 102, column 34) for  (high - low + 1)
      % expected type  {i: int | a /= 0 OR i >= 0}
  product_scal_TCC1: OBLIGATION
    FORALL (a: int, high: T_high, low: T_low):
      a /= 0 AND low <= high IMPLIES a /= 0 OR (high - low + 1) >= 0;


decl_type: tcc
theory: product
library: ints
signature: nil
location: 303 0 306 999
body:
  % Subtype TCC generated (at line 110, column 63) for  n
      % expected type  T
  product_ge_0_TCC1: OBLIGATION
    FORALL (high: T_high, low: T_low, n: subrange(low, high)): T_pred(n);


decl_type: tcc
theory: product
library: ints
signature: nil
location: 308 0 313 999
body:
  % Subtype TCC generated (at line 118, column 20) for  low + z
      % expected type  T_low
  product_shift_T_TCC1: OBLIGATION
    FORALL (low: T_low, z: int):
      (FORALL (i: T): T_pred(i + z)) IMPLIES
       T_pred(low + z) OR (EXISTS (j: T): j <= low + z);


decl_type: tcc
theory: product
library: ints
signature: nil
location: 315 0 320 999
body:
  % Subtype TCC generated (at line 118, column 26) for  high + z
      % expected type  T_high
  product_shift_T_TCC2: OBLIGATION
    FORALL (high: T_high, z: int):
      (FORALL (i: T): T_pred(i + z)) IMPLIES
       T_pred(high + z) OR (EXISTS (j: T): high + z <= j);


decl_type: tcc
theory: product
library: ints
signature: nil
location: 322 0 326 999
body:
  % Subtype TCC generated (at line 119, column 71) for  i + z
      % expected type  T
  product_shift_T_TCC3: OBLIGATION
    FORALL (z: int):
      (FORALL (i: T): T_pred(i + z)) IMPLIES (FORALL (i1: T): T_pred(i1 + z));


decl_type: tcc
theory: product
library: ints
signature: nil
location: 328 0 333 999
body:
  % Subtype TCC generated (at line 122, column 21) for  low + z
      % expected type  T_low
  product_shift_T2_TCC1: OBLIGATION
    FORALL (high: T_high, low: T_low, z: int):
      T_pred(high + z) AND T_pred(low + z) IMPLIES
       T_pred(low + z) OR (EXISTS (j: T): j <= low + z);


decl_type: tcc
theory: product
library: ints
signature: nil
location: 335 0 340 999
body:
  % Subtype TCC generated (at line 122, column 27) for  high + z
      % expected type  T_high
  product_shift_T2_TCC2: OBLIGATION
    FORALL (high: T_high, low: T_low, z: int):
      T_pred(high + z) AND T_pred(low + z) IMPLIES
       T_pred(high + z) OR (EXISTS (j: T): high + z <= j);


decl_type: tcc
theory: product
library: ints
signature: nil
location: 342 0 346 999
body:
  % Judgement subtype TCC generated (at line 178, column 22) for
      % product(low, high, Fnat)
      % expected type  nat
  prod_nat: OBLIGATION
    FORALL (Fnat, high, low): product(low, high, Fnat) >= 0;


decl_type: tcc
theory: product
library: ints
signature: nil
location: 348 0 352 999
body:
  % Judgement subtype TCC generated (at line 180, column 25) for
      % product(low, high, Fposnat)
      % expected type  posnat
  prod_posnat: OBLIGATION
    FORALL (Fposnat, high, low): product(low, high, Fposnat) > 0;


decl_type: formula
theory: product_upto
library: ints
signature: nil
location: 34 2 35 83
body:
    product_first_ge : THEOREM high >= low IMPLIES
                             product(low, high, F) = F(low) * product(low+1, high, F)


decl_type: formula
theory: product_upto
library: ints
signature: nil
location: 37 2 38 83
body:
    product_last_ge  : THEOREM high >= low IMPLIES 
                            product(low, high, F) = product(low, high-1, F) * F(high)


decl_type: formula
theory: product_upto
library: ints
signature: nil
location: 40 2 42 79
body:
    product_split_ge : THEOREM low-1 <= m AND m <= high IMPLIES 
                              product(low, high, F) = 
                                       product(low, m, F) * product(m+1, high, F)


decl_type: tcc
theory: product_upto
library: ints
signature: nil
location: 59 0 63 999
body:
  % Assuming TCC generated (at line 21, column 12) for  product[upto[N]]
      % generated from assumption product.connected_domain
  IMP_product_TCC1: OBLIGATION
    (FORALL (x, y: upto[N]), (z: integer):
       x <= z AND z <= y IMPLIES z >= 0 AND z <= N);


decl_type: tcc
theory: product_upto
library: ints
signature: nil
location: 65 0 68 999
body:
  % Judgement subtype TCC generated (at line 24, column 29) for  x
      % expected type  T_high[upto[N]]
  int_upto_T_high: OBLIGATION
    FORALL (x: int_upto): x >= 0 AND x <= N OR (EXISTS (j: upto[N]): x <= j);


decl_type: tcc
theory: product_upto
library: ints
signature: nil
location: 70 0 73 999
body:
  % Judgement subtype TCC generated (at line 25, column 26) for  x
      % expected type  T_low[upto[N]]
  nat_is_T_low: OBLIGATION
    FORALL (x: nat): x >= 0 AND x <= N OR (EXISTS (j: upto[N]): j <= x);


decl_type: tcc
theory: product_upto
library: ints
signature: nil
location: 75 0 80 999
body:
  % Subtype TCC generated (at line 35, column 40) for  high
      % expected type  T_high[upto[N]]
  product_first_ge_TCC1: OBLIGATION
    FORALL (high, low: upto[N]):
      high >= low IMPLIES
       high >= 0 AND high <= N OR (EXISTS (j: upto[N]): high <= j);


decl_type: tcc
theory: product_upto
library: ints
signature: nil
location: 82 0 88 999
body:
  % Subtype TCC generated (at line 38, column 63) for  high - 1
      % expected type  T_high[upto[N]]
  product_last_ge_TCC1: OBLIGATION
    FORALL (high, low: upto[N]):
      high >= low IMPLIES
       high - 1 >= 0 AND high - 1 <= N OR
        (EXISTS (j: upto[N]): high - 1 <= j);


decl_type: tcc
theory: product_upto
library: ints
signature: nil
location: 90 0 95 999
body:
  % Subtype TCC generated (at line 41, column 41) for  high
      % expected type  T_high[upto[N]]
  product_split_ge_TCC1: OBLIGATION
    FORALL (high, low, m: upto[N]):
      m <= high AND low - 1 <= m IMPLIES
       high >= 0 AND high <= N OR (EXISTS (j: upto[N]): high <= j);


decl_type: tcc
theory: product_upto
library: ints
signature: nil
location: 97 0 102 999
body:
  % Subtype TCC generated (at line 42, column 50) for  m
      % expected type  T_high[upto[N]]
  product_split_ge_TCC2: OBLIGATION
    FORALL (high, low, m: upto[N]):
      m <= high AND low - 1 <= m IMPLIES
       m >= 0 AND m <= N OR (EXISTS (j: upto[N]): m <= j);


decl_type: tcc
theory: product_upto
library: ints
signature: nil
location: 104 0 108 999
body:
  % Subtype TCC generated (at line 50, column 33) for  ing
      % expected type  T_high[upto[N]]
  product_0_neg_TCC1: OBLIGATION
    FORALL (ing: negint):
      ing >= 0 AND ing <= N OR (EXISTS (j: upto[N]): ing <= j);


decl_type: formula
theory: product_posnat
library: ints
signature: nil
location: 33 2 34 77
body:
    product_shift:  THEOREM product(low+m,high+m,F) = 
                                product(low,high, (LAMBDA (n: posnat): F(n+m)))


decl_type: formula
theory: product_posnat
library: ints
signature: nil
location: 36 2 40 63
body:
    product_shift_neg:  THEOREM low - m > 0 IMPLIES 
                           product(low-m,high-m,F) = 
                               product(low,high, (LAMBDA n: IF n-m <= 0 THEN 0 
                                                          ELSE F(n-m) 
                                                          ENDIF))


decl_type: tcc
theory: product_posnat
library: ints
signature: nil
location: 52 0 56 999
body:
  % Assuming TCC generated (at line 21, column 12) for  product[posnat]
      % generated from assumption product.connected_domain
  IMP_product_TCC1: OBLIGATION
    (FORALL (x, y: posnat), (z: integer):
       x <= z AND z <= y IMPLIES z >= 0 AND z > 0);


decl_type: tcc
theory: product_posnat
library: ints
signature: nil
location: 58 0 61 999
body:
  % Judgement subtype TCC generated (at line 23, column 27) for  x
      % expected type  T_high[posnat]
  int_is_T_high: OBLIGATION
    FORALL (x: int): x >= 0 AND x > 0 OR (EXISTS (j: posnat): x <= j);


decl_type: tcc
theory: product_posnat
library: ints
signature: nil
location: 63 0 66 999
body:
  % Judgement subtype TCC generated (at line 24, column 30) for  x
      % expected type  T_low[posnat]
  posnat_is_T_low: OBLIGATION
    FORALL (x: posnat): x >= 0 AND x > 0 OR (EXISTS (j: posnat): j <= x);


decl_type: tcc
theory: product_posnat
library: ints
signature: nil
location: 68 0 72 999
body:
  % Subtype TCC generated (at line 33, column 40) for  high + m
      % expected type  T_high[posnat]
  product_shift_TCC1: OBLIGATION
    FORALL (high: int, m: posnat):
      high + m >= 0 AND high + m > 0 OR (EXISTS (j: posnat): high + m <= j);


decl_type: tcc
theory: product_posnat
library: ints
signature: nil
location: 74 0 79 999
body:
  % Subtype TCC generated (at line 37, column 33) for  low - m
      % expected type  T_low[posnat]
  product_shift_neg_TCC1: OBLIGATION
    FORALL (low, m: posnat):
      low - m > 0 IMPLIES
       low - m >= 0 AND low - m > 0 OR (EXISTS (j: posnat): j <= low - m);


decl_type: tcc
theory: product_posnat
library: ints
signature: nil
location: 81 0 86 999
body:
  % Subtype TCC generated (at line 37, column 39) for  high - m
      % expected type  T_high[posnat]
  product_shift_neg_TCC2: OBLIGATION
    FORALL (high: int, low, m: posnat):
      low - m > 0 IMPLIES
       high - m >= 0 AND high - m > 0 OR (EXISTS (j: posnat): high - m <= j);


decl_type: tcc
theory: product_posnat
library: ints
signature: nil
location: 88 0 93 999
body:
  % Subtype TCC generated (at line 39, column 63) for  n - m
      % expected type  posnat
  product_shift_neg_TCC3: OBLIGATION
    FORALL (low, m: posnat):
      low - m > 0 IMPLIES
       (FORALL (n): NOT n - m <= 0 IMPLIES n - m >= 0 AND n - m > 0);


decl_type: tcc
theory: product_posnat
library: ints
signature: nil
location: 95 0 100 999
body:
  % Subtype TCC generated (at line 44, column 50) for  m
      % expected type  T_high[posnat]
  product_split_ge_TCC1: OBLIGATION
    FORALL (high: int, low, m: posnat):
      m <= high AND low - 1 <= m IMPLIES
       m >= 0 AND m > 0 OR (EXISTS (j: posnat): m <= j);


decl_type: formula
theory: product_nat
library: ints
signature: nil
location: 34 2 35 74
body:
    product_shift:  THEOREM product(low+m,high+m,F) = 
                                product(low,high, (LAMBDA (n: nat): F(n+m)))


decl_type: formula
theory: product_nat
library: ints
signature: nil
location: 37 2 41 63
body:
    product_shift_neg:  THEOREM low - m >= 0 IMPLIES 
                           product(low-m,high-m,F) = 
                               product(low,high, (LAMBDA n: IF n-m < 0 THEN 0 
                                                          ELSE F(n-m) 
                                                          ENDIF))


decl_type: formula
theory: product_nat
library: ints
signature: nil
location: 43 2 45 66
body:
    product_shift_ng2:  THEOREM low - m >= 0 IMPLIES 
                           product(low-m,high-m,F) = 
                               product(low,high, (LAMBDA n: F(n~m)))


decl_type: formula
theory: product_nat
library: ints
signature: nil
location: 47 2 50 85
body:
    product_shift_i:  THEOREM 0 <= low + i IMPLIES
                                product(low+i,high+i,F) = 
                                product(low,high, (LAMBDA (n: nat): IF n < low THEN 0
                                                                    ELSE F(n+i) ENDIF))


decl_type: formula
theory: product_nat
library: ints
signature: nil
location: 54 2 55 83
body:
    product_first_ge : THEOREM high >= low IMPLIES  % slightly more general
                             product(low, high, F) = F(low) * product(low+1, high, F)


decl_type: formula
theory: product_nat
library: ints
signature: nil
location: 58 2 60 79
body:
    product_split_ge : THEOREM low-1 <= i AND i <= high IMPLIES 
                              product(low, high, F) = 
                                       product(low, i, F) * product(i+1, high, F)


decl_type: tcc
theory: product_nat
library: ints
signature: nil
location: 76 0 79 999
body:
  % Assuming TCC generated (at line 21, column 12) for  product[nat]
      % generated from assumption product.connected_domain
  IMP_product_TCC1: OBLIGATION
    (FORALL (x, y: nat), (z: integer): x <= z AND z <= y IMPLIES z >= 0);


decl_type: tcc
theory: product_nat
library: ints
signature: nil
location: 81 0 84 999
body:
  % Judgement subtype TCC generated (at line 23, column 27) for  x
      % expected type  T_high[nat]
  int_is_T_high: OBLIGATION
    FORALL (x: int): x >= 0 OR (EXISTS (j: nat): x <= j);


decl_type: tcc
theory: product_nat
library: ints
signature: nil
location: 86 0 89 999
body:
  % Judgement subtype TCC generated (at line 24, column 27) for  x
      % expected type  T_low[nat]
  nat_is_T_low: OBLIGATION
    FORALL (x: nat): x >= 0 OR (EXISTS (j: nat): j <= x);


decl_type: tcc
theory: product_nat
library: ints
signature: nil
location: 91 0 95 999
body:
  % Subtype TCC generated (at line 34, column 40) for  high + m
      % expected type  T_high[nat]
  product_shift_TCC1: OBLIGATION
    FORALL (high: int, m: nat):
      high + m >= 0 OR (EXISTS (j: nat): high + m <= j);


decl_type: tcc
theory: product_nat
library: ints
signature: nil
location: 97 0 101 999
body:
  % Subtype TCC generated (at line 38, column 33) for  low - m
      % expected type  T_low[nat]
  product_shift_neg_TCC1: OBLIGATION
    FORALL (low, m: nat):
      low - m >= 0 IMPLIES low - m >= 0 OR (EXISTS (j: nat): j <= low - m);


decl_type: tcc
theory: product_nat
library: ints
signature: nil
location: 103 0 107 999
body:
  % Subtype TCC generated (at line 38, column 39) for  high - m
      % expected type  T_high[nat]
  product_shift_neg_TCC2: OBLIGATION
    FORALL (high: int, low, m: nat):
      low - m >= 0 IMPLIES high - m >= 0 OR (EXISTS (j: nat): high - m <= j);


decl_type: tcc
theory: product_nat
library: ints
signature: nil
location: 109 0 113 999
body:
  % Subtype TCC generated (at line 40, column 63) for  n - m
      % expected type  nat
  product_shift_neg_TCC3: OBLIGATION
    FORALL (low, m: nat):
      low - m >= 0 IMPLIES (FORALL (n): NOT n - m < 0 IMPLIES n - m >= 0);


decl_type: tcc
theory: product_nat
library: ints
signature: nil
location: 115 0 119 999
body:
  % Subtype TCC generated (at line 48, column 38) for  low + i
      % expected type  T_low[nat]
  product_shift_i_TCC1: OBLIGATION
    FORALL (i: int, low: nat):
      0 <= low + i IMPLIES low + i >= 0 OR (EXISTS (j: nat): j <= low + i);


decl_type: tcc
theory: product_nat
library: ints
signature: nil
location: 121 0 125 999
body:
  % Subtype TCC generated (at line 48, column 44) for  high + i
      % expected type  T_high[nat]
  product_shift_i_TCC2: OBLIGATION
    FORALL (high, i: int, low: nat):
      0 <= low + i IMPLIES high + i >= 0 OR (EXISTS (j: nat): high + i <= j);


decl_type: tcc
theory: product_nat
library: ints
signature: nil
location: 127 0 131 999
body:
  % Subtype TCC generated (at line 50, column 73) for  n + i
      % expected type  nat
  product_shift_i_TCC3: OBLIGATION
    FORALL (i: int, low: nat):
      0 <= low + i IMPLIES (FORALL (n: nat): NOT n < low IMPLIES n + i >= 0);


decl_type: tcc
theory: product_nat
library: ints
signature: nil
location: 133 0 137 999
body:
  % Subtype TCC generated (at line 60, column 50) for  i
      % expected type  T_high[nat]
  product_split_ge_TCC1: OBLIGATION
    FORALL (high, i: int, low: nat):
      i <= high AND low - 1 <= i IMPLIES i >= 0 OR (EXISTS (j: nat): i <= j);


decl_type: tcc
theory: product_nat
library: ints
signature: nil
location: 139 0 144 999
body:
  % Subtype TCC generated (at line 60, column 66) for  i + 1
      % expected type  T_low[nat]
  product_split_ge_TCC2: OBLIGATION
    FORALL (high, i: int, low: nat):
      i <= high AND low - 1 <= i IMPLIES
       i + 1 >= 0 OR (EXISTS (j: nat): j <= i + 1);


decl_type: tcc
theory: product_nat
library: ints
signature: nil
location: 146 0 149 999
body:
  % Subtype TCC generated (at line 67, column 33) for  ing
      % expected type  T_high[nat]
  product_0_neg_TCC1: OBLIGATION
    FORALL (ing: negint): ing >= 0 OR (EXISTS (j: nat): ing <= j);


decl_type: formula
theory: product_int
library: ints
signature: nil
location: 32 2 33 74
body:
    product_shift    :  THEOREM product(low+j,high+j,F) = 
                                product(low,high, (LAMBDA (i: int): F(i+j)))


decl_type: formula
theory: product_int
library: ints
signature: nil
location: 44 2 46 69
body:
    product_mid_ge  : THEOREM high >= i AND i >= low IMPLIES 
                            product(low, high, F) = product(low, i-1, F) * F(i) *
                                                  product(i+1, high, F) 


decl_type: tcc
theory: product_int
library: ints
signature: nil
location: 57 0 59 999
body:
  % Assuming TCC generated (at line 21, column 12) for  product[int]
      % generated from assumption product.connected_domain
  IMP_product_TCC1: OBLIGATION (FORALL (x, y: int), (z: integer): TRUE);


decl_type: formula
theory: product_below
library: ints
signature: nil
location: 41 2 43 79
body:
    product_split_ge : THEOREM low - 1 <= m AND m <= high IMPLIES 
                              product(low, high, F) = 
                                       product(low, m, F) * product(m+1, high, F)


decl_type: tcc
theory: product_below
library: ints
signature: nil
location: 59 0 63 999
body:
  % Assuming TCC generated (at line 21, column 12) for  product[below(N)]
      % generated from assumption product.connected_domain
  IMP_product_TCC1: OBLIGATION
    (FORALL (x, y: below(N)), (z: integer):
       x <= z AND z <= y IMPLIES z >= 0 AND z < N);


decl_type: tcc
theory: product_below
library: ints
signature: nil
location: 65 0 68 999
body:
  % Judgement subtype TCC generated (at line 24, column 30) for  x
      % expected type  T_high[below(N)]
  int_below_T_high: OBLIGATION
    FORALL (x: int_below): x >= 0 AND x < N OR (EXISTS (j: below(N)): x <= j);


decl_type: tcc
theory: product_below
library: ints
signature: nil
location: 70 0 73 999
body:
  % Judgement subtype TCC generated (at line 25, column 26) for  x
      % expected type  T_low[below(N)]
  nat_is_T_low: OBLIGATION
    FORALL (x: nat): x >= 0 AND x < N OR (EXISTS (j: below(N)): j <= x);


decl_type: tcc
theory: product_below
library: ints
signature: nil
location: 75 0 78 999
body:
  % Subtype TCC generated (at line 36, column 53) for  low
      % expected type  below[N]
  product_first_ge_TCC1: OBLIGATION
    FORALL (high: int_below, low: nat): high >= low IMPLIES low < N;


decl_type: tcc
theory: product_below
library: ints
signature: nil
location: 80 0 86 999
body:
  % Subtype TCC generated (at line 39, column 63) for  high - 1
      % expected type  T_high[below(N)]
  product_last_ge_TCC1: OBLIGATION
    FORALL (high: int_below, low: nat):
      high >= low IMPLIES
       high - 1 >= 0 AND high - 1 < N OR
        (EXISTS (j: below(N)): high - 1 <= j);


decl_type: tcc
theory: product_below
library: ints
signature: nil
location: 88 0 92 999
body:
  % Subtype TCC generated (at line 39, column 78) for  high
      % expected type  below[N]
  product_last_ge_TCC2: OBLIGATION
    FORALL (high: int_below, low: nat):
      high >= low IMPLIES high >= 0 AND high < N;


decl_type: tcc
theory: product_below
library: ints
signature: nil
location: 94 0 99 999
body:
  % Subtype TCC generated (at line 43, column 50) for  m
      % expected type  T_high[below(N)]
  product_split_ge_TCC1: OBLIGATION
    FORALL (high: int_below, low: nat, m: below[N]):
      m <= high AND low - 1 <= m IMPLIES
       m >= 0 AND m < N OR (EXISTS (j: below(N)): m <= j);


decl_type: tcc
theory: product_below
library: ints
signature: nil
location: 101 0 105 999
body:
  % Subtype TCC generated (at line 49, column 33) for  ing
      % expected type  T_high[below(N)]
  product_0_neg_TCC1: OBLIGATION
    FORALL (ing: negint):
      ing >= 0 AND ing < N OR (EXISTS (j: below(N)): ing <= j);


decl_type: formula
theory: pigeonhole
library: ints
signature: nil
location: 7 2 9 55
body:
    pigeonhole_principle_nat: LEMMA
      FORALL (f:[below(n)->below(n)]):
      bijective?(f) IFF (injective?(f) OR surjective?(f))


decl_type: formula
theory: factorial
library: ints
signature: nil
location: 21 3 22 61
body:
     factorial_def: LEMMA factorial(n) = IF n = 0 THEN 1 ELSE 
                                         n*factorial(n-1) ENDIF


decl_type: formula
theory: factorial
library: ints
signature: nil
location: 35 3 36 67
body:
     factorial_strict_incr: LEMMA k /= 0 AND k < n 
                                  IMPLIES factorial(k) < factorial(n)


decl_type: function
theory: factorial
library: ints
signature: [nat -> posnat]
location: 13 3 14 65
body:
     factorial(n): recursive posnat =
            (if n = 0 then 1 else n*factorial(n-1) endif) MEASURE n


decl_type: tcc
theory: factorial
library: ints
signature: nil
location: 51 0 53 999
body:
  % Subtype TCC generated (at line 14, column 44) for  n - 1
      % expected type  nat
  factorial_TCC1: OBLIGATION FORALL (n: nat): NOT n = 0 IMPLIES n - 1 >= 0;


decl_type: tcc
theory: factorial
library: ints
signature: nil
location: 55 0 56 999
body:
  % Termination TCC generated (at line 14, column 34) for  factorial(n - 1)
  factorial_TCC2: OBLIGATION FORALL (n: nat): NOT n = 0 IMPLIES n - 1 < n;


decl_type: tcc
theory: factorial
library: ints
signature: nil
location: 58 0 62 999
body:
  % Subtype TCC generated (at line 14, column 32) for  n * factorial(n - 1)
      % expected type  posnat
  factorial_TCC3: OBLIGATION
    FORALL (n: nat, v: [{z: nat | z < n} -> posnat]):
      NOT n = 0 IMPLIES n * v(n - 1) > 0;


decl_type: tcc
theory: factorial
library: ints
signature: nil
location: 64 0 66 999
body:
  % Subtype TCC generated (at line 25, column 53) for  n - 1
      % expected type  nat
  factorial_n_TCC1: OBLIGATION FORALL (n: nat): n > 0 IMPLIES n - 1 >= 0;


decl_type: tcc
theory: factorial
library: ints
signature: nil
location: 68 0 71 999
body:
  % Subtype TCC generated (at line 29, column 55) for  (n - k)
      % expected type  {i: int | k /= 0 OR i >= 0}
  factorial_gt_TCC1: OBLIGATION
    FORALL (k, n: nat): n > k IMPLIES k /= 0 OR (n - k) >= 0;


decl_type: tcc
theory: factorial
library: ints
signature: nil
location: 73 0 76 999
body:
  % Subtype TCC generated (at line 31, column 57) for  (n - k)
      % expected type  {i: int | k /= 0 OR i >= 0}
  factorial_ge_TCC1: OBLIGATION
    FORALL (k, n: nat): n >= k IMPLIES k /= 0 OR (n - k) >= 0;


decl_type: tcc
theory: factorial
library: ints
signature: nil
location: 78 0 80 999
body:
  % Subtype TCC generated (at line 39, column 45) for  n
      % expected type  {i: int | n /= 0 OR i >= 0}
  factorial_lt_n2n_TCC1: OBLIGATION FORALL (n: nat): n /= 0 OR n >= 0;


decl_type: formula
theory: max_bounded_posnat
library: ints
signature: nil
location: 20 2 21 43
body:
    max_rec_bnd: LEMMA n >= x AND n >= choose(S) AND S(x) AND m >= n - x 
                   IMPLIES x <= max_rec(S, n)


decl_type: function
theory: max_bounded_posnat
library: ints
location: 8 2 8 41
body: bnd(S): { a | FORALL (x: (S)): x <= a}
signature:
  [S:
          {A: (nonempty?[posnat]) |
                   EXISTS UB: FORALL (y: (A)): y <= UB} ->
          {a | FORALL (x: (S)): x <= a}]


decl_type: function
theory: max_bounded_posnat
library: ints
location: 10 2 14 51
signature:
  [[S:
           {A: (nonempty?[posnat]) |
                    EXISTS UB: FORALL (y: (A)): y <= UB},
         {j: posnat | j >= choose(S)}] ->
          posnat]

body:
    max_rec(S,(i:{j: posnat | j >= choose(S)})): RECURSIVE posnat =
                                IF S(i) THEN i
                                ELSE max_rec(S,i-1)
                                ENDIF
                                MEASURE i - choose(S)


decl_type: function
theory: max_bounded_posnat
library: ints
location: 23 2 23 64
body: max(S): {a: posnat | S(a) AND (FORALL x: S(x) IMPLIES x <= a)}
signature:
  [S:
          {A: (nonempty?[posnat]) |
                   EXISTS UB: FORALL (y: (A)): y <= UB} ->
          {a: posnat | S(a) AND (FORALL x: S(x) IMPLIES x <= a)}]


decl_type: function
theory: max_bounded_posnat
library: ints
location: 25 2 25 66
body: maximum?(a, S) : bool = S(a) AND (FORALL x: S(x) IMPLIES x <= a)
signature:
  [[posnat,
         {A: (nonempty?[posnat]) |
                  EXISTS UB: FORALL (y: (A)): y <= UB}] ->
          bool]


decl_type: tcc
theory: max_bounded_posnat
library: ints
signature: nil
location: 39 0 47 999
body:
  % Existence TCC generated (at line 8, column 2) for
      % bnd(S): {a | FORALL (x: (S)): x <= a}
  bnd_TCC1: OBLIGATION
    EXISTS (x1:
              [S:
                 {A: (nonempty?[posnat]) |
                          EXISTS UB: FORALL (y: (A)): y <= UB} ->
                 {a | FORALL (x: (S)): x <= a}]):
      TRUE;


decl_type: tcc
theory: max_bounded_posnat
library: ints
signature: nil
location: 49 0 55 999
body:
  % Subtype TCC generated (at line 14, column 38) for  i - choose(S)
      % expected type  naturalnumber
  max_rec_TCC1: OBLIGATION
    FORALL (S:
              {A: (nonempty?[posnat]) | EXISTS UB: FORALL (y: (A)): y <= UB},
            (i: {j: posnat | j >= choose[posnat](S)})):
      i - choose[posnat](S) >= 0;


decl_type: tcc
theory: max_bounded_posnat
library: ints
signature: nil
location: 57 0 64 999
body:
  % Subtype TCC generated (at line 12, column 45) for  i - 1
      % expected type  {j: posnat | j >= choose(S)}
  max_rec_TCC2: OBLIGATION
    FORALL (S:
              {A: (nonempty?[posnat]) | EXISTS UB: FORALL (y: (A)): y <= UB},
            (i: {j: posnat | j >= choose[posnat](S)})):
      NOT S(i) IMPLIES
       i - 1 >= 0 AND i - 1 > 0 AND i - 1 >= choose[posnat](S);


decl_type: tcc
theory: max_bounded_posnat
library: ints
signature: nil
location: 66 0 71 999
body:
  % Termination TCC generated (at line 12, column 35) for  max_rec(S, i - 1)
  max_rec_TCC3: OBLIGATION
    FORALL (S:
              {A: (nonempty?[posnat]) | EXISTS UB: FORALL (y: (A)): y <= UB},
            (i: {j: posnat | j >= choose[posnat](S)})):
      NOT S(i) IMPLIES i - 1 - choose[posnat](S) < i - choose[posnat](S);


decl_type: tcc
theory: max_bounded_posnat
library: ints
signature: nil
location: 73 0 81 999
body:
  % Existence TCC generated (at line 23, column 2) for
      % max(S): {a: posnat | S(a) AND (FORALL x: S(x) IMPLIES x <= a)}
  max_TCC1: OBLIGATION
    EXISTS (x1:
              [S:
                 {A: (nonempty?[posnat]) |
                          EXISTS UB: FORALL (y: (A)): y <= UB} ->
                 {a: posnat | S(a) AND (FORALL x: S(x) IMPLIES x <= a)}]):
      TRUE;


decl_type: tcc
theory: min_posnat
library: ints
signature: nil
location: 21 0 27 999
body:
  % Existence TCC generated (at line 7, column 2) for
      % min(S): {a: posnat | S(a) AND (FORALL x: S(x) IMPLIES a <= x)}
  min_TCC1: OBLIGATION
    EXISTS (x1:
              [S: (nonempty?[posnat]) ->
                 {a: posnat | S(a) AND (FORALL x: S(x) IMPLIES a <= x)}]):
      TRUE;


decl_type: formula
theory: divides_lems
library: ints
signature: nil
location: 34 3 35 70
body:
     divides_plus_1: LEMMA mm > 1 IMPLIES 
                             divides(mm,ii) IMPLIES NOT divides(mm,ii+1)


decl_type: formula
theory: divides_lems
library: ints
signature: nil
location: 45 3 49 17
body:
     gcd_prep: LEMMA  
        FORALL (i: int, j: {jj: int | i = 0 => jj /= 0}):
          EXISTS (UB: posnat):
          FORALL (y: ({k: posnat | divides(k, i) AND divides(k, j)})):
            y <= UB


decl_type: tcc
theory: divides_lems
library: ints
signature: nil
location: 57 0 62 999
body:
  % Subtype TCC generated (at line 39, column 25) for
      % {k: posnat | divides(m1, k) AND divides(m2, k)}
      % expected type  S: (nonempty?[posnat])
  lcm_TCC1: OBLIGATION
    FORALL (m1: posnat, m2: posnat):
      nonempty?[posnat]({k: posnat | divides(m1, k) AND divides(m2, k)});


decl_type: formula
theory: primes
library: ints
signature: nil
location: 22 3 23 65
body:
     prime_rew  : LEMMA prime?(n) = ((FORALL (j: posnat): j > 1 AND j < n IMPLIES
                                       NOT divides(j,n)) AND n > 1)


decl_type: formula
theory: primes
library: ints
signature: nil
location: 30 3 31 58
body:
     prime_divides_prod: LEMMA prime?(n) IMPLIES FORALL (i,j:int):
       divides(n,i*j) IMPLIES (divides(n,i) OR divides(n,j))


decl_type: formula
theory: primes
library: ints
signature: nil
location: 33 3 36 11
body:
     prime_divides_factorial: LEMMA prime?(n) IMPLIES 
       (divides(n,factorial(N))
        IFF
        N>=n)


decl_type: formula
theory: primes
library: ints
signature: nil
location: 38 3 42 19
body:
     prod_primes_divides: LEMMA FORALL (m,n:nat,j:int):
       prime?(n) AND prime?(m) AND divides(m,j) AND divides(n,j)
       AND n/=m
       IMPLIES
       divides(m*n,j)


decl_type: function
theory: primes
library: ints
signature: [int -> bool]
location: 18 3 20 37
body:
     prime?(i: int): bool = (FORALL (j: posnat): j /= 1 AND j /= i IMPLIES
                                NOT divides(j,i)) 
                              AND i > 1               %% 1 is not a prime number by def


decl_type: function
theory: max_finite_set_nat
library: ints
signature: [non_empty_finite_set[nat] -> nat]
location: 12 2 16 41
body:
    maxrec(S): RECURSIVE nat = 
                  IF empty?(sets.rest(S)) THEN choose(S)
                  ELSE fsmax(choose(S),maxrec(sets.rest(S)))
                  ENDIF
                MEASURE (LAMBDA S: card(S))


decl_type: tcc
theory: max_finite_set_nat
library: ints
signature: nil
location: 34 0 39 999
body:
  % Termination TCC generated (at line 14, column 37) for
      % maxrec(sets.rest(S))
  maxrec_TCC1: OBLIGATION
    FORALL (S: non_empty_finite_set[nat]):
      NOT empty?(sets.rest(S)) IMPLIES
       card[nat](sets[nat].rest(S)) < card[nat](S);


decl_type: tcc
theory: max_finite_set_nat
library: ints
signature: nil
location: 41 0 47 999
body:
  % Existence TCC generated (at line 18, column 2) for
      % max(S): {a: nat | S(a) AND (FORALL x: S(x) IMPLIES x <= a)}
  max_TCC1: OBLIGATION
    EXISTS (x1:
              [S: non_empty_finite_set[nat] ->
                 {a: nat | S(a) AND (FORALL x: S(x) IMPLIES x <= a)}]):
      TRUE;


decl_type: tcc
theory: max_below
library: ints
signature: nil
location: 25 0 31 999
body:
  % Existence TCC generated (at line 12, column 2) for
      % max(S): {a: below[N] | S(a) AND (FORALL x: S(x) IMPLIES a >= x)}
  max_TCC1: OBLIGATION
    EXISTS (x1:
              [S: (nonempty?[below[N]]) ->
                 {a: below[N] | S(a) AND (FORALL x: S(x) IMPLIES a >= x)}]):
      TRUE;


decl_type: tcc
theory: max_upto
library: ints
signature: nil
location: 25 0 31 999
body:
  % Existence TCC generated (at line 12, column 2) for
      % max(S): {a: upto[N] | S(a) AND (FORALL x: S(x) IMPLIES a >= x)}
  max_TCC1: OBLIGATION
    EXISTS (x1:
              [S: (nonempty?[upto[N]]) ->
                 {a: upto[N] | S(a) AND (FORALL x: S(x) IMPLIES a >= x)}]):
      TRUE;


decl_type: function
theory: abstract_max
library: ints
signature: [T -> bool]
location: 27 3 28 68
body:
     maximal?(S): bool = P(S) AND 
                         (FORALL (SS: T): P(SS) IMPLIES f(S) >= f(SS))


decl_type: tcc
theory: abstract_max
library: ints
signature: nil
location: 45 0 48 999
body:
  % Subtype TCC generated (at line 23, column 24) for
      % {n: upto[N] | is_one(n)}
      % expected type  S: (nonempty?[upto[N]])
  max_f_TCC1: OBLIGATION nonempty?[upto[N]]({n: upto[N] | is_one(n)});


decl_type: tcc
theory: abstract_max
library: ints
signature: nil
location: 50 0 52 999
body:
  % Existence TCC generated (at line 30, column 3) for
      % max: {S: T | maximal?(S)}
  max_TCC1: OBLIGATION EXISTS (x: {S: T | maximal?(S)}): TRUE;


decl_type: function
theory: abstract_min
library: ints
signature: [T -> bool]
location: 27 3 28 68
body:
     minimal?(S): bool = P(S) AND 
                         (FORALL (SS: T): P(SS) IMPLIES f(S) <= f(SS))


decl_type: tcc
theory: abstract_min
library: ints
signature: nil
location: 45 0 47 999
body:
  % Subtype TCC generated (at line 23, column 20) for  {n: nat | is_one(n)}
      % expected type  S: (nonempty?[nat])
  min_f_TCC1: OBLIGATION nonempty?[nat]({n: nat | is_one(n)});


decl_type: tcc
theory: abstract_min
library: ints
signature: nil
location: 49 0 51 999
body:
  % Existence TCC generated (at line 30, column 3) for
      % min: {S: T | minimal?(S)}
  min_TCC1: OBLIGATION EXISTS (x: {S: T | minimal?(S)}): TRUE;


decl_type: tcc
theory: div_nat
library: ints
signature: nil
location: 60 0 62 999
body:
  % Subtype TCC generated (at line 19, column 22) for  floor(n / m)
      % expected type  upto(n)
  div_TCC1: OBLIGATION FORALL (n: nat, m: posnat): floor(n / m) <= n;


decl_type: tcc
theory: div_nat
library: ints
signature: nil
location: 64 0 67 999
body:
  % Subtype TCC generated (at line 21, column 63) for  n - m
      % expected type  nat
  div_nat_TCC1: OBLIGATION
    FORALL (m: posnat, n: nat): NOT n < m IMPLIES n - m >= 0;


decl_type: formula
theory: mod_nat
library: ints
signature: nil
location: 24 2 27 46
body:
    nmod_sum_nat : LEMMA n1 < m AND n2 < m IMPLIES
                            nmod(n1+n2,m) = IF n1 + n2 < m THEN n1+n2
                                           ELSE n1 + n2 - m
                                           ENDIF


decl_type: formula
theory: mod_nat
library: ints
signature: nil
location: 33 2 35 39
body:
    nmod_one     : LEMMA nmod(1,m) = IF m = 1 THEN 0
                                    ELSE 1
                                    ENDIF


decl_type: tcc
theory: mod_nat
library: ints
signature: nil
location: 46 0 50 999
body:
  % Subtype TCC generated (at line 16, column 24) for  n - m * div(n, m)
      % expected type  below(m)
  nmod_TCC1: OBLIGATION
    FORALL (n: nat, m: posnat):
      n - m * div(n, m) >= 0 AND n - m * div(n, m) < m;


decl_type: formula
theory: tdiv
library: ints
signature: nil
location: 49 2 53 13
body:
    tdiv_neg_d:     LEMMA tdiv(i,-j) = IF integer_pred(i/j) THEN
                                        -tdiv(i,j)
                                      ELSE
                                        -tdiv(i,j)-1
                                      ENDIF 


decl_type: formula
theory: tdiv
library: ints
signature: nil
location: 55 2 59 13
body:
    tdiv_neg:       LEMMA tdiv(-i,j) = IF integer_pred(i/j) THEN
                                        -tdiv(i,j)
                                      ELSE
                                        -tdiv(i,j)-1
                                      ENDIF


decl_type: formula
theory: tdiv
library: ints
signature: nil
location: 62 2 68 32
body:
    tdiv_def:      THEOREM tdiv(i,m) =
                             IF i >= m THEN 1 + tdiv(i-m, m) 
                             ELSIF i >= 0 THEN 0
                             ELSIF integer_pred(i/m) THEN -tdiv(-i,m) 
                             ELSE
                               -1 - tdiv(-i,m)           
                             ENDIF   


decl_type: formula
theory: tdiv
library: ints
signature: nil
location: 80 2 81 57
body:
    tdiv_one:       LEMMA abs(j) > 1 IMPLIES tdiv(1,j) = 
                             IF j >= 0 THEN 0 ELSE -1 ENDIF


decl_type: formula
theory: tdiv
library: ints
signature: nil
location: 87 2 88 57
body:
    tdiv_eq_0:      LEMMA tdiv(i,j) = 0 IMPLIES i = 0 OR
                      (sgn(i) = sgn(j) AND abs(i) < abs(j))


decl_type: formula
theory: tdiv
library: ints
signature: nil
location: 90 2 93 42
body:
    tdiv_lt:        LEMMA abs(i) < abs(j) IMPLIES 
                            tdiv(i,j) = IF i = 0 OR sgn(i) = sgn(j) THEN 0 
                                       ELSE -1
                                       ENDIF


decl_type: formula
theory: tdiv
library: ints
signature: nil
location: 101 2 105 31
body:
    tdiv_abs:        LEMMA abs(tdiv(i,j)) =
                            IF integer_pred(i/j) OR sgn(i) = sgn(j) THEN
                               tdiv(abs(i),abs(j))
                            ELSE tdiv(abs(i),abs(j)) + 1
                            ENDIF


decl_type: tcc
theory: tdiv
library: ints
signature: nil
location: 122 0 124 999
body:
  % Judgement subtype TCC generated (at line 42, column 12) for  tdiv(n, m)
      % expected type  nat
  tdiv_TCC1: OBLIGATION FORALL (m, n): tdiv(n, m) >= 0;


decl_type: tcc
theory: tdiv
library: ints
signature: nil
location: 126 0 129 999
body:
  % Judgement subtype TCC generated (at line 43, column 12) for  tdiv(negi, m)
      % expected type  negint
  tdiv_TCC2: OBLIGATION
    FORALL (m, negi): tdiv(negi, m) <= 0 AND tdiv(negi, m) < 0;


decl_type: tcc
theory: tdiv
library: ints
signature: nil
location: 131 0 134 999
body:
  % Judgement subtype TCC generated (at line 44, column 12) for
      % tdiv(negi, ngi2)
      % expected type  nonneg_int
  tdiv_TCC3: OBLIGATION FORALL (negi, ngi2): tdiv(negi, ngi2) >= 0;


decl_type: tcc
theory: tdiv
library: ints
signature: nil
location: 136 0 139 999
body:
  % Judgement subtype TCC generated (at line 45, column 12) for  tdiv(m, negi)
      % expected type  negint
  tdiv_TCC4: OBLIGATION
    FORALL (m, negi): tdiv(m, negi) <= 0 AND tdiv(m, negi) < 0;


decl_type: formula
theory: tmod
library: ints
signature: nil
location: 37 2 39 41
body:
    mod_neg:        LEMMA mod(-i,j) = IF integer?(i/j) THEN 0
                                      ELSE j - mod(i,j)
                                      ENDIF


decl_type: formula
theory: tmod
library: ints
signature: nil
location: 41 2 43 41
body:
    mod_neg_d:      LEMMA mod(i,-j) = IF integer?(i/j) THEN 0
                                      ELSE mod(i,j) - j 
                                      ENDIF


decl_type: formula
theory: tmod
library: ints
signature: nil
location: 47 2 50 39
body:
    mod_lt:         LEMMA abs(i) < abs(j) IMPLIES mod(i,j) = 
                                    IF sgn(i) = sgn(j) OR i = 0 THEN i
                                    ELSE i + j
                                    ENDIF


decl_type: formula
theory: tmod
library: ints
signature: nil
location: 64 2 67 41
body:
    mod_one:        LEMMA mod(1,j) = IF abs(j) = 1 THEN 0
                                      ELSIF j > 0 THEN 1
                                      ELSE j + 1
                                      ENDIF


decl_type: tcc
theory: tmod
library: ints
signature: nil
location: 94 0 97 999
body:
  % Subtype TCC generated (at line 33, column 35) for  i - j * tdiv(i, j)
      % expected type  {k | abs(k) < abs(j)}
  mod_TCC1: OBLIGATION
    FORALL (i: int, j: nonzero_integer): abs(i - j * tdiv(i, j)) < abs(j);


decl_type: tcc
theory: tmod
library: ints
signature: nil
location: 99 0 101 999
body:
  % Judgement subtype TCC generated (at line 73, column 12) for  mod(i, m)
      % expected type  below(m)
  mod_TCC2: OBLIGATION FORALL (i, m): mod(i, m) >= 0 AND mod(i, m) < m;


decl_type: formula
theory: div
library: ints
signature: nil
location: 43 2 45 9
body:
    div_def:     LEMMA div(i,j) = IF i/j >= 0 THEN floor(i/j)
                                  ELSE ceiling(i/j)
                                  ENDIF    


decl_type: formula
theory: div
library: ints
signature: nil
location: 48 2 52 27
body:
    div_value:    LEMMA IF sgn(i) = sgn(j) THEN
                           i >= k*j AND i < (k+1)*j IMPLIES div(i,j) = k 
                        ELSE
                           i > (k-1)*j AND i <= k*j IMPLIES div(i,j) = k
                        ENDIF 


decl_type: formula
theory: div
library: ints
signature: nil
location: 79 2 80 17
body:
    div_parity:     LEMMA (sgn(i) = sgn(j) AND abs(i) >= abs(j)) IMPLIES
                            div(i,j) > 0


decl_type: formula
theory: div
library: ints
signature: nil
location: 82 2 83 38
body:
    div_parity_neg: LEMMA (sgn(i) /= sgn(j) AND abs(i) >= abs(j)) IMPLIES
                            div(i,j) < 0


decl_type: formula
theory: div
library: ints
signature: nil
location: 85 2 87 64
body:
    div_ge_0:       LEMMA (sgn(i) = sgn(j) IMPLIES div(i,j) >= 0) AND
                            (div(i,j) >= 0 IMPLIES 
                               abs(i) < abs(j) OR sgn(i) = sgn(j))


decl_type: formula
theory: div
library: ints
signature: nil
location: 89 2 91 65
body:
    div_le_0:       LEMMA (sgn(i) /= sgn(j) IMPLIES div(i,j) <= 0) AND
                            (div(i,j) <= 0 IMPLIES 
                               abs(i) < abs(j) OR sgn(i) /= sgn(j))


decl_type: formula
theory: div
library: ints
signature: nil
location: 105 2 109 8
body:
    div_sum:        LEMMA IF integer_pred(i/j) OR sgn(i+k*j) = sgn(i) THEN
                             div(i+k*j,j) = div(i,j) + k
                          ELSE 
                             div(i+k*j,j) = div(i,j) + k + sgn(i)*sgn(j)
                          ENDIF


decl_type: tcc
theory: div
library: ints
signature: nil
location: 141 0 143 999
body:
  % Judgement subtype TCC generated (at line 120, column 12) for  div(n, m)
      % expected type  nat
  div_TCC1: OBLIGATION FORALL (m, n): div(n, m) >= 0;


decl_type: tcc
theory: div
library: ints
signature: nil
location: 145 0 147 999
body:
  % Judgement subtype TCC generated (at line 121, column 12) for  div(npi, m)
      % expected type  nonposint
  div_TCC2: OBLIGATION FORALL (m, npi): div(npi, m) <= 0;


decl_type: tcc
theory: div
library: ints
signature: nil
location: 149 0 151 999
body:
  % Subtype TCC generated (at line 122, column 20) for  negi
      % expected type  nonzero_integer
  div_TCC3: OBLIGATION FORALL (negi): negi /= 0;


decl_type: tcc
theory: div
library: ints
signature: nil
location: 153 0 156 999
body:
  % Judgement subtype TCC generated (at line 122, column 12) for
      % div(npi, negi)
      % expected type  nat
  div_TCC4: OBLIGATION FORALL (negi, npi): div(npi, negi) >= 0;


decl_type: tcc
theory: div
library: ints
signature: nil
location: 158 0 160 999
body:
  % Judgement subtype TCC generated (at line 123, column 12) for  div(m, negi)
      % expected type  nonposint
  div_TCC5: OBLIGATION FORALL (m, negi): div(m, negi) <= 0;


decl_type: formula
theory: mod_lems
library: ints
signature: nil
location: 37 2 38 53
body:
    mod_wrap_around : LEMMA n < m & (c <= m & c >= m-n) =>
                                mod(n+c, m) = n - (m-c)


decl_type: formula
theory: mod_lems
library: ints
signature: nil
location: 44 2 45 66
body:
    mod_inj1        : LEMMA x < m AND n < m AND c < m AND
                         mod(x + n, m) = mod(x + c, m) IMPLIES n = c


decl_type: formula
theory: mod_lems
library: ints
signature: nil
location: 47 2 48 67
body:
    mod_inj2        : LEMMA x < m AND n < m AND c < m AND
                          mod(x - n, m) = mod(x - c, m) IMPLIES n = c


decl_type: formula
theory: mod_lems
library: ints
signature: nil
location: 50 2 52 61
body:
    mod_wrap_inj    : LEMMA
        x < m AND a < m AND b < m AND a > 0
          IMPLIES (mod(x + a, m) = mod(x - b, m)) = (a + b = m)


decl_type: formula
theory: mod_lems
library: ints
signature: nil
location: 55 2 56 70
body:
    mod_neg_limited : LEMMA 0 <= kk AND  kk < m AND vv < m AND
                        vv - kk < 0 IMPLIES mod(vv - kk,m) = m + vv - kk


decl_type: formula
theory: mod_lems
library: ints
signature: nil
location: 58 2 59 65
body:
    mod_int_quot: LEMMA FORALL (k:nat, n:posnat): 
                 integer_pred((k-mod(k,n))/n) AND (k-mod(k,n))/n>=0


decl_type: formula
theory: mod_lems
library: ints
signature: nil
location: 61 2 62 43
body:
    floor_div_prod: LEMMA FORALL (n,m:posnat,i:nat):
          floor(i / (n*m)) = floor(floor(i / m) / n)


decl_type: formula
theory: mod_lems
library: ints
signature: nil
location: 64 2 65 63
body:
    mod_mult_quot: LEMMA FORALL (n,m:posnat,i:nat): 
      mod(i, n * m) = mod(i, m) + m * mod((i - mod(i, m)) / m, n)


decl_type: tcc
theory: mod_lems
library: ints
signature: nil
location: 79 0 81 999
body:
  % Subtype TCC generated (at line 29, column 46) for  j
      % expected type  nonzero_integer
  mod_1_TCC1: OBLIGATION FORALL (j: int): j > 1 IMPLIES j /= 0;


decl_type: tcc
theory: mod_lems
library: ints
signature: nil
location: 83 0 86 999
body:
  % Subtype TCC generated (at line 65, column 40) for  (i - mod(i, m)) / m
      % expected type  int
  mod_mult_quot_TCC1: OBLIGATION
    FORALL (m: posnat, i: nat): integer_pred((i - mod(i, m)) / m);


decl_type: formula
theory: gcd
library: ints
signature: nil
location: 27 3 28 65
body:
     gcd_divides: LEMMA (i /= 0 OR j /= 0) IMPLIES
                        divides(gcd(i,j),i) AND divides(gcd(i,j),j)


decl_type: formula
theory: gcd
library: ints
signature: nil
location: 30 3 31 45
body:
     gcd_is_max: LEMMA (i /= 0 OR j /= 0) AND divides(kk,i) AND divides(kk,j) 
                         IMPLIES kk <= gcd(i,j) 


decl_type: formula
theory: gcd
library: ints
signature: nil
location: 33 3 37 61
body:
     gcd_def    : LEMMA (i /= 0 OR j /= 0) IMPLIES
                        (gcd(i,j) = nn IFF
                             ( (divides(nn,i) AND divides(nn,j)) AND 
                               (FORALL mm: divides(mm,i) AND divides(mm,j) 
                                            IMPLIES mm <= nn))) 


decl_type: formula
theory: gcd
library: ints
signature: nil
location: 50 3 51 58
body:
     gcd_lt     : LEMMA (i /= 0 AND j /= 0) IMPLIES
                              gcd(i,j) <= min(abs(i),abs(j))


decl_type: formula
theory: gcd
library: ints
signature: nil
location: 65 3 66 59
body:
     gcd_factors_nat: LEMMA (n /= 0 OR m /= 0) IMPLIES
                         EXISTS ip,jp: gcd(n,m) = ip*n + jp*m


decl_type: formula
theory: gcd
library: ints
signature: nil
location: 68 3 69 62
body:
     gcd_factors: LEMMA (i /= 0 OR j /= 0) IMPLIES
                            EXISTS ip,jp: gcd(i,j) = ip*i + jp*j


decl_type: formula
theory: gcd
library: ints
signature: nil
location: 71 3 72 50
body:
     divides_gcd: LEMMA (i /= 0 OR j /= 0) AND divides(kk,i) AND divides(kk,j) 
                        IMPLIES divides(kk,gcd(i,j))


decl_type: formula
theory: gcd
library: ints
signature: nil
location: 87 3 89 68
body:
     rel_prime_lem: LEMMA (i /= 0 OR j /= 0) IMPLIES
                            ( rel_prime(i,j) 
                              IFF (EXISTS (n,m: int): 1 = m*i + n*j) )


decl_type: formula
theory: gcd
library: ints
signature: nil
location: 94 2 95 58
body:
    rel_prime_div_prod: LEMMA (i/=0 OR j/=0) IMPLIES
      rel_prime(i,j) AND divides(i,j*k) IMPLIES divides(i,k)


decl_type: formula
theory: gcd
library: ints
signature: nil
location: 99 2 100 66
body:
    rel_prime_mult_right: LEMMA (i/=0 OR j/=0) AND (i/=0 OR k/=0)
      AND rel_prime(i,j) AND rel_prime(i,k) IMPLIES rel_prime(i,j*k)


decl_type: formula
theory: gcd
library: ints
signature: nil
location: 102 2 103 66
body:
    rel_prime_mult_left: LEMMA (i/=0 OR j/=0) AND (j/=0 OR k/=0)
      AND rel_prime(i,j) AND rel_prime(k,j) IMPLIES rel_prime(i*k,j)


decl_type: formula
theory: gcd
library: ints
signature: nil
location: 130 3 132 61
body:
     rel_prime_inverse: LEMMA 
       m>1 AND rel_prime(n,m) IMPLIES 
       FORALL (q:below(m)): EXISTS (k:below(m)): mod(n*k,m) = q


decl_type: function
theory: gcd
library: ints
location: 22 3 24 62
signature:
  [d: [i: int, {jj: int | i = 0 => jj /= 0}] ->
          {k: posnat | divides(k, d`1) AND divides(k, d`2)}]

body:
     gcd(i:int,j: {jj:int| i=0 => jj /= 0}): 
           {k: posnat | divides(k,i) AND divides(k,j)}  
              = max({k: posnat | divides(k,i) AND divides(k,j)})


decl_type: function
theory: gcd
library: ints
signature:
  [d: [i: int, {jj: int | i = 0 => jj /= 0}] ->
  {kj: posnat | kj = gcd(d`1, d`2)}]

location: 110 3 124 17
body:
     compute_gcd(i:int,j:{jj:int| i=0 => jj /= 0}): RECURSIVE {kj: posnat | kj = gcd(i,j)} =
       IF    i<0 THEN compute_gcd(-i,j)
       ELSIF j<0 THEN compute_gcd(i,-j)
       ELSIF i=0 THEN j
       ELSIF j=0 THEN i
       ELSIF i<j THEN compute_gcd(j,i)
       ELSE
         (LET rem = mod(i,j) IN
           IF rem = 0 THEN j ELSE compute_gcd(j,rem) ENDIF)
       ENDIF
         MEASURE (IF i<0 AND j<0 THEN -i-j+3
                  ELSIF i<0 THEN -i+j+2
                  ELSIF j<0 THEN i-j+2
                  ELSIF i<j THEN i+j+1
                  ELSE i+j ENDIF)


decl_type: tcc
theory: gcd
library: ints
signature: nil
location: 144 0 154 999
body:
  % Subtype TCC generated (at line 24, column 18) for
      % {k: posnat | divides(k, i) AND divides(k, j)}
      % expected type  S:
                     %   {A: (nonempty?[posnat]) |
                     %            EXISTS UB: FORALL (y: (A)): y <= UB}
  gcd_TCC1: OBLIGATION
    FORALL (i: int, j: {jj: int | i = 0 => jj /= 0}):
      nonempty?[posnat]({k: posnat | divides(k, i) AND divides(k, j)}) AND
       (EXISTS UB:
          FORALL (y: ({k: posnat | divides(k, i) AND divides(k, j)})):
            y <= UB);


decl_type: tcc
theory: gcd
library: ints
signature: nil
location: 156 0 159 999
body:
  % Subtype TCC generated (at line 28, column 36) for  j
      % expected type  {jj: int | i = 0 => jj /= 0}
  gcd_divides_TCC1: OBLIGATION
    FORALL (i, j: int): (i /= 0 OR j /= 0) IMPLIES i = 0 => j /= 0;


decl_type: tcc
theory: gcd
library: ints
signature: nil
location: 161 0 164 999
body:
  % Subtype TCC generated (at line 41, column 71) for  abs(j)
      % expected type  {jj: int | abs(i) = 0 => jj /= 0}
  gcd_abs_TCC1: OBLIGATION
    FORALL (i, j: int): (i /= 0 OR j /= 0) IMPLIES abs(i) = 0 => abs(j) /= 0;


decl_type: tcc
theory: gcd
library: ints
signature: nil
location: 166 0 169 999
body:
  % Subtype TCC generated (at line 48, column 34) for  m
      % expected type  {jj: int | n = 0 => jj /= 0}
  gcd_lt_nat_TCC1: OBLIGATION
    FORALL (m, n: nat): (n /= 0) IMPLIES n = 0 => m /= 0;


decl_type: tcc
theory: gcd
library: ints
signature: nil
location: 171 0 174 999
body:
  % Subtype TCC generated (at line 51, column 34) for  j
      % expected type  {jj: int | i = 0 => jj /= 0}
  gcd_lt_TCC1: OBLIGATION
    FORALL (i, j: int): j /= 0 AND i /= 0 IMPLIES i = 0 => j /= 0;


decl_type: tcc
theory: gcd
library: ints
signature: nil
location: 176 0 179 999
body:
  % Subtype TCC generated (at line 59, column 52) for  i
      % expected type  {jj: int | mod(j, i) = 0 => jj /= 0}
  gcd_mod_TCC1: OBLIGATION
    FORALL (i, j: int): (i /= 0) IMPLIES mod(j, i) = 0 => i /= 0;


decl_type: tcc
theory: gcd
library: ints
signature: nil
location: 181 0 184 999
body:
  % Subtype TCC generated (at line 59, column 63) for  j
      % expected type  {jj: int | i = 0 => jj /= 0}
  gcd_mod_TCC2: OBLIGATION
    FORALL (i, j: int): (i /= 0) IMPLIES i = 0 => j /= 0;


decl_type: tcc
theory: gcd
library: ints
signature: nil
location: 186 0 189 999
body:
  % Subtype TCC generated (at line 66, column 43) for  m
      % expected type  {jj: int | n = 0 => jj /= 0}
  gcd_factors_nat_TCC1: OBLIGATION
    FORALL (m, n: nat): (n /= 0 OR m /= 0) IMPLIES n = 0 => m /= 0;


decl_type: tcc
theory: gcd
library: ints
signature: nil
location: 191 0 193 999
body:
  % Subtype TCC generated (at line 75, column 27) for  p
      % expected type  {jj: int | p = 0 => jj /= 0}
  gcd_same_TCC1: OBLIGATION FORALL (p: posint): p = 0 => p /= 0;


decl_type: tcc
theory: gcd
library: ints
signature: nil
location: 195 0 198 999
body:
  % Subtype TCC generated (at line 79, column 31) for  q * l
      % expected type  {jj: int | p * l = 0 => jj /= 0}
  gcd_times_TCC1: OBLIGATION
    FORALL (l, p, q: posint): p * l = 0 => q * l /= 0;


decl_type: tcc
theory: gcd
library: ints
signature: nil
location: 200 0 205 999
body:
  % Subtype TCC generated (at line 100, column 39) for  k
      % expected type  {jj: int | i = 0 => jj /= 0}
  rel_prime_mult_right_TCC1: OBLIGATION
    FORALL (i, j, k: int):
      (i /= 0 OR j /= 0) AND (i /= 0 OR k /= 0) AND rel_prime(i, j) IMPLIES
       i = 0 => k /= 0;


decl_type: tcc
theory: gcd
library: ints
signature: nil
location: 207 0 213 999
body:
  % Subtype TCC generated (at line 100, column 62) for  j * k
      % expected type  {jj: int | i = 0 => jj /= 0}
  rel_prime_mult_right_TCC2: OBLIGATION
    FORALL (i, j, k: int):
      rel_prime(i, k) AND
       rel_prime(i, j) AND (i /= 0 OR k /= 0) AND (i /= 0 OR j /= 0)
       IMPLIES i = 0 => j * k /= 0;


decl_type: tcc
theory: gcd
library: ints
signature: nil
location: 215 0 220 999
body:
  % Subtype TCC generated (at line 103, column 39) for  j
      % expected type  {jj: int | k = 0 => jj /= 0}
  rel_prime_mult_left_TCC1: OBLIGATION
    FORALL (i, j, k: int):
      (i /= 0 OR j /= 0) AND (j /= 0 OR k /= 0) AND rel_prime(i, j) IMPLIES
       k = 0 => j /= 0;


decl_type: tcc
theory: gcd
library: ints
signature: nil
location: 222 0 228 999
body:
  % Subtype TCC generated (at line 103, column 64) for  j
      % expected type  {jj: int | i * k = 0 => jj /= 0}
  rel_prime_mult_left_TCC2: OBLIGATION
    FORALL (i, j, k: int):
      rel_prime(k, j) AND
       rel_prime(i, j) AND (j /= 0 OR k /= 0) AND (i /= 0 OR j /= 0)
       IMPLIES i * k = 0 => j /= 0;


decl_type: tcc
theory: gcd
library: ints
signature: nil
location: 230 0 234 999
body:
  % Subtype TCC generated (at line 120, column 36) for  -i - j + 3
      % expected type  naturalnumber
  compute_gcd_TCC1: OBLIGATION
    FORALL (i: int, j: {jj: int | i = 0 => jj /= 0}):
      i < 0 AND j < 0 IMPLIES -i - j + 3 >= 0;


decl_type: tcc
theory: gcd
library: ints
signature: nil
location: 236 0 240 999
body:
  % Subtype TCC generated (at line 121, column 31) for  -i + j + 2
      % expected type  naturalnumber
  compute_gcd_TCC2: OBLIGATION
    FORALL (i: int, j: {jj: int | i = 0 => jj /= 0}):
      i < 0 AND NOT (i < 0 AND j < 0) IMPLIES -i + j + 2 >= 0;


decl_type: tcc
theory: gcd
library: ints
signature: nil
location: 242 0 246 999
body:
  % Subtype TCC generated (at line 122, column 17) for  i - j + 2
      % expected type  naturalnumber
  compute_gcd_TCC3: OBLIGATION
    FORALL (i: int, j: {jj: int | i = 0 => jj /= 0}):
      j < 0 AND NOT i < 0 AND NOT (i < 0 AND j < 0) IMPLIES i - j + 2 >= 0;


decl_type: tcc
theory: gcd
library: ints
signature: nil
location: 248 0 253 999
body:
  % Subtype TCC generated (at line 123, column 17) for  i + j + 1
      % expected type  naturalnumber
  compute_gcd_TCC4: OBLIGATION
    FORALL (i: int, j: {jj: int | i = 0 => jj /= 0}):
      i < j AND NOT j < 0 AND NOT i < 0 AND NOT (i < 0 AND j < 0) IMPLIES
       i + j + 1 >= 0;


decl_type: tcc
theory: gcd
library: ints
signature: nil
location: 255 0 260 999
body:
  % Subtype TCC generated (at line 124, column 7) for  i + j
      % expected type  naturalnumber
  compute_gcd_TCC5: OBLIGATION
    FORALL (i: int, j: {jj: int | i = 0 => jj /= 0}):
      NOT i < j AND NOT j < 0 AND NOT i < 0 AND NOT (i < 0 AND j < 0) IMPLIES
       i + j >= 0;


decl_type: tcc
theory: gcd
library: ints
signature: nil
location: 262 0 266 999
body:
  % Subtype TCC generated (at line 111, column 35) for  j
      % expected type  {jj: int | -i = 0 => jj /= 0}
  compute_gcd_TCC6: OBLIGATION
    FORALL (i: int, j: {jj: int | i = 0 => jj /= 0}):
      i < 0 IMPLIES -i = 0 => j /= 0;


decl_type: tcc
theory: gcd
library: ints
signature: nil
location: 268 0 284 999
body:
  % Termination TCC generated (at line 111, column 20) for  compute_gcd(-i, j)
  compute_gcd_TCC7: OBLIGATION
    FORALL (i: int, j: {jj: int | i = 0 => jj /= 0}):
      i < 0 IMPLIES
       (IF -i < 0 AND j < 0 THEN --i - j + 3
        ELSIF -i < 0 THEN --i + j + 2
        ELSIF j < 0 THEN -i - j + 2
        ELSIF -i < j THEN -i + j + 1
        ELSE -i + j
        ENDIF)
        <
        (IF i < 0 AND j < 0 THEN -i - j + 3
         ELSIF i < 0 THEN -i + j + 2
         ELSIF j < 0 THEN i - j + 2
         ELSIF i < j THEN i + j + 1
         ELSE i + j
         ENDIF);


decl_type: tcc
theory: gcd
library: ints
signature: nil
location: 286 0 307 999
body:
  % Subtype TCC generated (at line 111, column 20) for  compute_gcd(-i, j)
      % expected type  {kj: posnat | kj = gcd(i, j)}
  compute_gcd_TCC8: OBLIGATION
    FORALL (i: int, j: {jj: int | i = 0 => jj /= 0},
            v:
              [d1:
                 {z: [i: int, {jj: int | i = 0 => jj /= 0}] |
                          (IF z`1 < 0 AND z`2 < 0 THEN -z`1 - z`2 + 3
                           ELSIF z`1 < 0 THEN -z`1 + z`2 + 2
                           ELSIF z`2 < 0 THEN z`1 - z`2 + 2
                           ELSIF z`1 < z`2 THEN z`1 + z`2 + 1
                           ELSE z`1 + z`2
                           ENDIF)
                           <
                           (IF i < 0 AND j < 0 THEN -i - j + 3
                            ELSIF i < 0 THEN -i + j + 2
                            ELSIF j < 0 THEN i - j + 2
                            ELSIF i < j THEN i + j + 1
                            ELSE i + j
                            ENDIF)} ->
                 {kj: posnat | kj = gcd(d1`1, d1`2)}]):
      i < 0 IMPLIES v(-i, j) = gcd(i, j);


decl_type: tcc
theory: gcd
library: ints
signature: nil
location: 309 0 313 999
body:
  % Subtype TCC generated (at line 112, column 34) for  -j
      % expected type  {jj: int | i = 0 => jj /= 0}
  compute_gcd_TCC9: OBLIGATION
    FORALL (i: int, j: {jj: int | i = 0 => jj /= 0}):
      j < 0 AND NOT i < 0 IMPLIES i = 0 => -j /= 0;


decl_type: tcc
theory: gcd
library: ints
signature: nil
location: 315 0 331 999
body:
  % Termination TCC generated (at line 112, column 20) for  compute_gcd(i, -j)
  compute_gcd_TCC10: OBLIGATION
    FORALL (i: int, j: {jj: int | i = 0 => jj /= 0}):
      j < 0 AND NOT i < 0 IMPLIES
       (IF i < 0 AND -j < 0 THEN -i - -j + 3
        ELSIF i < 0 THEN -i + -j + 2
        ELSIF -j < 0 THEN i - -j + 2
        ELSIF i < -j THEN i + -j + 1
        ELSE i + -j
        ENDIF)
        <
        (IF i < 0 AND j < 0 THEN -i - j + 3
         ELSIF i < 0 THEN -i + j + 2
         ELSIF j < 0 THEN i - j + 2
         ELSIF i < j THEN i + j + 1
         ELSE i + j
         ENDIF);


decl_type: tcc
theory: gcd
library: ints
signature: nil
location: 333 0 354 999
body:
  % Subtype TCC generated (at line 112, column 20) for  compute_gcd(i, -j)
      % expected type  {kj: posnat | kj = gcd(i, j)}
  compute_gcd_TCC11: OBLIGATION
    FORALL (i: int, j: {jj: int | i = 0 => jj /= 0},
            v:
              [d1:
                 {z: [i: int, {jj: int | i = 0 => jj /= 0}] |
                          (IF z`1 < 0 AND z`2 < 0 THEN -z`1 - z`2 + 3
                           ELSIF z`1 < 0 THEN -z`1 + z`2 + 2
                           ELSIF z`2 < 0 THEN z`1 - z`2 + 2
                           ELSIF z`1 < z`2 THEN z`1 + z`2 + 1
                           ELSE z`1 + z`2
                           ENDIF)
                           <
                           (IF i < 0 AND j < 0 THEN -i - j + 3
                            ELSIF i < 0 THEN -i + j + 2
                            ELSIF j < 0 THEN i - j + 2
                            ELSIF i < j THEN i + j + 1
                            ELSE i + j
                            ENDIF)} ->
                 {kj: posnat | kj = gcd(d1`1, d1`2)}]):
      j < 0 AND NOT i < 0 IMPLIES v(i, -j) = gcd(i, j);


decl_type: tcc
theory: gcd
library: ints
signature: nil
location: 356 0 361 999
body:
  % Subtype TCC generated (at line 113, column 20) for  j
      % expected type  {kj: posnat | kj = gcd(i, j)}
  compute_gcd_TCC12: OBLIGATION
    FORALL (i: int, j: {jj: int | i = 0 => jj /= 0}):
      i = 0 AND NOT j < 0 AND NOT i < 0 IMPLIES
       j >= 0 AND j > 0 AND j = gcd(i, j);


decl_type: tcc
theory: gcd
library: ints
signature: nil
location: 363 0 368 999
body:
  % Subtype TCC generated (at line 114, column 20) for  i
      % expected type  {kj: posnat | kj = gcd(i, j)}
  compute_gcd_TCC13: OBLIGATION
    FORALL (i: int, j: {jj: int | i = 0 => jj /= 0}):
      j = 0 AND NOT i = 0 AND NOT j < 0 AND NOT i < 0 IMPLIES
       i >= 0 AND i > 0 AND i = gcd(i, j);


decl_type: tcc
theory: gcd
library: ints
signature: nil
location: 370 0 387 999
body:
  % Termination TCC generated (at line 115, column 20) for  compute_gcd(j, i)
  compute_gcd_TCC14: OBLIGATION
    FORALL (i: int, j: {jj: int | i = 0 => jj /= 0}):
           i < j AND NOT j = 0 AND NOT i = 0 AND NOT j < 0 AND NOT i < 0
       IMPLIES
       (IF j < 0 AND i < 0 THEN -j - i + 3
        ELSIF j < 0 THEN -j + i + 2
        ELSIF i < 0 THEN j - i + 2
        ELSIF j < i THEN j + i + 1
        ELSE j + i
        ENDIF)
        <
        (IF i < 0 AND j < 0 THEN -i - j + 3
         ELSIF i < 0 THEN -i + j + 2
         ELSIF j < 0 THEN i - j + 2
         ELSIF i < j THEN i + j + 1
         ELSE i + j
         ENDIF);


decl_type: tcc
theory: gcd
library: ints
signature: nil
location: 389 0 411 999
body:
  % Subtype TCC generated (at line 115, column 20) for  compute_gcd(j, i)
      % expected type  {kj: posnat | kj = gcd(i, j)}
  compute_gcd_TCC15: OBLIGATION
    FORALL (i: int, j: {jj: int | i = 0 => jj /= 0},
            v:
              [d1:
                 {z: [i: int, {jj: int | i = 0 => jj /= 0}] |
                          (IF z`1 < 0 AND z`2 < 0 THEN -z`1 - z`2 + 3
                           ELSIF z`1 < 0 THEN -z`1 + z`2 + 2
                           ELSIF z`2 < 0 THEN z`1 - z`2 + 2
                           ELSIF z`1 < z`2 THEN z`1 + z`2 + 1
                           ELSE z`1 + z`2
                           ENDIF)
                           <
                           (IF i < 0 AND j < 0 THEN -i - j + 3
                            ELSIF i < 0 THEN -i + j + 2
                            ELSIF j < 0 THEN i - j + 2
                            ELSIF i < j THEN i + j + 1
                            ELSE i + j
                            ENDIF)} ->
                 {kj: posnat | kj = gcd(d1`1, d1`2)}]):
           i < j AND NOT j = 0 AND NOT i = 0 AND NOT j < 0 AND NOT i < 0
       IMPLIES v(j, i) = gcd(i, j);


decl_type: tcc
theory: gcd
library: ints
signature: nil
location: 413 0 421 999
body:
  % Subtype TCC generated (at line 118, column 25) for  j
      % expected type  {kj: posnat | kj = gcd(i, j)}
  compute_gcd_TCC16: OBLIGATION
    FORALL (i: int, j: {jj: int | i = 0 => jj /= 0}):
           NOT i < j AND NOT j = 0 AND NOT i = 0 AND NOT j < 0 AND NOT i < 0
       IMPLIES
       (FORALL (rem: {k | abs(k) < abs(j)}):
          rem = 0 AND rem = mod(i, j) IMPLIES
           j >= 0 AND j > 0 AND j = gcd(i, j));


decl_type: tcc
theory: gcd
library: ints
signature: nil
location: 423 0 430 999
body:
  % Subtype TCC generated (at line 118, column 46) for  rem
      % expected type  {jj: int | j = 0 => jj /= 0}
  compute_gcd_TCC17: OBLIGATION
    FORALL (i: int, j: {jj: int | i = 0 => jj /= 0}):
           NOT i < j AND NOT j = 0 AND NOT i = 0 AND NOT j < 0 AND NOT i < 0
       IMPLIES
       (FORALL (rem: {k | abs(k) < abs(j)}):
          NOT rem = 0 AND rem = mod(i, j) IMPLIES j = 0 => rem /= 0);


decl_type: tcc
theory: gcd
library: ints
signature: nil
location: 432 0 452 999
body:
  % Termination TCC generated (at line 118, column 32) for
      % compute_gcd(j, rem)
  compute_gcd_TCC18: OBLIGATION
    FORALL (i: int, j: {jj: int | i = 0 => jj /= 0}):
           NOT i < j AND NOT j = 0 AND NOT i = 0 AND NOT j < 0 AND NOT i < 0
       IMPLIES
       (FORALL (rem: {k | abs(k) < abs(j)}):
          NOT rem = 0 AND rem = mod(i, j) IMPLIES
           (IF j < 0 AND rem < 0 THEN -j - rem + 3
            ELSIF j < 0 THEN -j + rem + 2
            ELSIF rem < 0 THEN j - rem + 2
            ELSIF j < rem THEN j + rem + 1
            ELSE j + rem
            ENDIF)
            <
            (IF i < 0 AND j < 0 THEN -i - j + 3
             ELSIF i < 0 THEN -i + j + 2
             ELSIF j < 0 THEN i - j + 2
             ELSIF i < j THEN i + j + 1
             ELSE i + j
             ENDIF));


decl_type: tcc
theory: gcd
library: ints
signature: nil
location: 454 0 478 999
body:
  % Subtype TCC generated (at line 118, column 32) for  compute_gcd(j, rem)
      % expected type  {kj: posnat | kj = gcd(i, j)}
  compute_gcd_TCC19: OBLIGATION
    FORALL (i: int, j: {jj: int | i = 0 => jj /= 0},
            v:
              [d1:
                 {z: [i: int, {jj: int | i = 0 => jj /= 0}] |
                          (IF z`1 < 0 AND z`2 < 0 THEN -z`1 - z`2 + 3
                           ELSIF z`1 < 0 THEN -z`1 + z`2 + 2
                           ELSIF z`2 < 0 THEN z`1 - z`2 + 2
                           ELSIF z`1 < z`2 THEN z`1 + z`2 + 1
                           ELSE z`1 + z`2
                           ENDIF)
                           <
                           (IF i < 0 AND j < 0 THEN -i - j + 3
                            ELSIF i < 0 THEN -i + j + 2
                            ELSIF j < 0 THEN i - j + 2
                            ELSIF i < j THEN i + j + 1
                            ELSE i + j
                            ENDIF)} ->
                 {kj: posnat | kj = gcd(d1`1, d1`2)}]):
           NOT i < j AND NOT j = 0 AND NOT i = 0 AND NOT j < 0 AND NOT i < 0
       IMPLIES
       (FORALL (rem: {k | abs(k) < abs(j)}):
          NOT rem = 0 AND rem = mod(i, j) IMPLIES v(j, rem) = gcd(i, j));


decl_type: tcc
theory: gcd
library: ints
signature: nil
location: 480 0 485 999
body:
  % Subtype TCC generated (at line 117, column 24) for  j
      % expected type  nonzero_integer
  compute_gcd_TCC20: OBLIGATION
    FORALL (i: int, j: {jj: int | i = 0 => jj /= 0}):
           NOT i < j AND NOT j = 0 AND NOT i = 0 AND NOT j < 0 AND NOT i < 0
       IMPLIES j /= 0;


decl_type: tcc
theory: gcd
library: ints
signature: nil
location: 487 0 490 999
body:
  % Subtype TCC generated (at line 131, column 25) for  m
      % expected type  {jj: int | n = 0 => jj /= 0}
  rel_prime_inverse_TCC1: OBLIGATION
    FORALL (m, n: nat): m > 1 IMPLIES n = 0 => m /= 0;


decl_type: tcc
theory: gcd
library: ints
signature: nil
location: 492 0 497 999
body:
  % Subtype TCC generated (at line 132, column 55) for  m
      % expected type  nonzero_integer
  rel_prime_inverse_TCC2: OBLIGATION
    FORALL (m, n: nat):
      rel_prime(n, m) AND m > 1 IMPLIES
       (FORALL (q: below(m), k: below(m)): m /= 0);


decl_type: formula
theory: gcd_fractions
library: ints
signature: nil
location: 13 2 14 77
body:
    div_by_gcd_prep: LEMMA FORALL (p: posint, q: posint):
      integer_pred(p / gcd(p, q)) AND p / gcd(p, q) >= 0 AND p / gcd(p, q) > 0;


decl_type: tcc
theory: gcd_fractions
library: ints
signature: nil
location: 29 0 32 999
body:
  % Subtype TCC generated (at line 14, column 28) for  q
      % expected type  {jj: int | p = 0 => jj /= 0}
  div_by_gcd_prep_TCC1: OBLIGATION
    FORALL (p: posint, q: posint): p = 0 => q /= 0;


decl_type: tcc
theory: gcd_fractions
library: ints
signature: nil
location: 34 0 39 999
body:
  % Subtype TCC generated (at line 17, column 29) for  p / gcd(p, q)
      % expected type  posint
  div_by_gcd_TCC1: OBLIGATION
    FORALL (p: posint, q: posint):
      integer_pred(p / gcd(p, q)) AND
       p / gcd(p, q) >= 0 AND p / gcd(p, q) > 0;


decl_type: tcc
theory: gcd_fractions
library: ints
signature: nil
location: 41 0 44 999
body:
  % Subtype TCC generated (at line 19, column 46) for  div_by_gcd(q, p)
      % expected type  {jj: int | div_by_gcd(p, q) = 0 => jj /= 0}
  gcd_div_by_gcd_TCC1: OBLIGATION
    FORALL (p, q: posint): div_by_gcd(p, q) = 0 => div_by_gcd(q, p) /= 0;


decl_type: formula
theory: rem
library: ints
signature: nil
location: 56 2 58 40
body:
    rem_one:        LEMMA rem(1,j) = IF abs(j) = 1 THEN 0
                                     ELSE 1
                                     ENDIF


decl_type: tcc
theory: rem
library: ints
signature: nil
location: 67 0 70 999
body:
  % Subtype TCC generated (at line 36, column 36) for  i - j * div(i, j)
      % expected type  {k | abs(k) < abs(j)}
  rem_TCC1: OBLIGATION
    FORALL (i: int, j: nonzero_integer): abs(i - j * div(i, j)) < abs(j);


decl_type: tcc
theory: rem
library: ints
signature: nil
location: 72 0 74 999
body:
  % Judgement subtype TCC generated (at line 60, column 12) for  rem(n, m)
      % expected type  below(m)
  rem_TCC2: OBLIGATION FORALL (m, n): rem(n, m) >= 0 AND rem(n, m) < m;


decl_type: formula
theory: mod_div_lems
library: ints
signature: nil
location: 21 2 24 32
body:
    mod_rem: LEMMA mod(i,j)= IF sgn(i) = sgn(j) OR integer_pred(i/j) THEN
                                rem(i,j)
                             ELSE j + rem(i,j)
                             ENDIF


decl_type: formula
theory: Maybe
library: structures
signature: nil
location: 38 0 39 999
body:
  Maybe_None_extensionality: AXIOM
    FORALL (none?_var: (none?), none?_var2: (none?)): none?_var = none?_var2;


decl_type: formula
theory: Maybe
library: structures
signature: nil
location: 41 0 43 999
body:
  Maybe_Some_extensionality: AXIOM
    FORALL (some?_var: (some?), some?_var2: (some?)):
      val(some?_var) = val(some?_var2) IMPLIES some?_var = some?_var2;


decl_type: formula
theory: Maybe
library: structures
signature: nil
location: 54 0 57 999
body:
  Maybe_induction: AXIOM
    FORALL (p: [Maybe -> boolean]):
      (p(None) AND (FORALL (Some1_var: T): p(Some(Some1_var)))) IMPLIES
       (FORALL (Maybe_var: Maybe): p(Maybe_var));


decl_type: function
theory: Maybe
library: structures
signature: [[nat, [T -> nat]] -> [Maybe -> nat]]
location: 78 0 83 999
body:
  reduce_nat(none?_fun: nat, some?_fun: [T -> nat]):  [Maybe -> nat] =
      LAMBDA (Maybe_adtvar: Maybe):
        LET red: [Maybe -> nat] = reduce_nat(none?_fun, some?_fun) IN
          CASES Maybe_adtvar
            OF None: none?_fun, Some(Some1_var): some?_fun(Some1_var)
            ENDCASES;


decl_type: function
theory: Maybe
library: structures
signature: [[[Maybe -> nat], [[T, Maybe] -> nat]] -> [Maybe -> nat]]
location: 85 0 92 999
body:
  REDUCE_nat(none?_fun: [Maybe -> nat], some?_fun: [[T, Maybe] -> nat]):
        [Maybe -> nat] =
      LAMBDA (Maybe_adtvar: Maybe):
        LET red: [Maybe -> nat] = REDUCE_nat(none?_fun, some?_fun) IN
          CASES Maybe_adtvar
            OF None: none?_fun(Maybe_adtvar),
               Some(Some1_var): some?_fun(Some1_var, Maybe_adtvar)
            ENDCASES;


decl_type: function
theory: Maybe
library: structures
signature: [[ordinal, [T -> ordinal]] -> [Maybe -> ordinal]]
location: 94 0 100 999
body:
  reduce_ordinal(none?_fun: ordinal, some?_fun: [T -> ordinal]):
        [Maybe -> ordinal] =
      LAMBDA (Maybe_adtvar: Maybe):
        LET red: [Maybe -> ordinal] = reduce_ordinal(none?_fun, some?_fun) IN
          CASES Maybe_adtvar
            OF None: none?_fun, Some(Some1_var): some?_fun(Some1_var)
            ENDCASES;


decl_type: function
theory: Maybe
library: structures
signature:
  [[[Maybe -> ordinal], [[T, Maybe] -> ordinal]] ->
  [Maybe -> ordinal]]

location: 102 0 110 999
body:
  REDUCE_ordinal(none?_fun: [Maybe -> ordinal],
                 some?_fun: [[T, Maybe] -> ordinal]):
        [Maybe -> ordinal] =
      LAMBDA (Maybe_adtvar: Maybe):
        LET red: [Maybe -> ordinal] = REDUCE_ordinal(none?_fun, some?_fun) IN
          CASES Maybe_adtvar
            OF None: none?_fun(Maybe_adtvar),
               Some(Some1_var): some?_fun(Some1_var, Maybe_adtvar)
            ENDCASES;


decl_type: tcc
theory: Maybe
library: structures
signature: nil
location: 116 0 119 999
body:
  % Subtype TCC generated (at line 28, column 35) for  a
      % expected type  (some?)
  Maybe_either_TCC1: OBLIGATION
    FORALL (a: Maybe): NOT a = None IMPLIES (FORALL (t: T): some?(a));


decl_type: tcc
theory: stack
library: structures
signature: nil
location: 19 0 21 999
body:
  % Subtype TCC generated (at line 8, column 54) for  s
      % expected type  (cons?[T])
  pop_TCC1: OBLIGATION FORALL (s: stack): NOT null?(s) IMPLIES cons?[T](s);


decl_type: formula
theory: branch_and_bound_X
library: structures
signature: nil
location: 207 2 220 35
body:
    branch_and_bound_sound : THEOREM 
      FORALL(sound,evaluate,branch,subdivide,denorm,combine,prune,le,ge,select,accumulate,maxdepth):
          presound_evaluate?(sound,evaluate) AND
          sound_evaluate?(sound,evaluate,subdivide) AND
          sound_subdivide?(evaluate,subdivide) AND
          sound_branch?(evaluate,branch) AND
          presound_combine?(sound,subdivide,branch,denorm,combine) AND
          sound_combine?(sound,subdivide,branch,denorm,combine) IMPLIES
        FORALL (obj,dom,acc,dirvars):
          length(dirvars) <= maxdepth IMPLIES
          LET bandb = branch_and_bound(evaluate,branch,subdivide,denorm,combine,
                                       prune,le,ge,select,accumulate,maxdepth)
                                      (obj,dom,acc,dirvars)
          IN sound(dom,obj,bandb`ans)


decl_type: formula
theory: branch_and_bound_X
library: structures
signature: nil
location: 226 2 234 80
body:
    b_and_b_sound : THEOREM 
      presound_evaluate?(sound,evaluate) AND
      sound_evaluate?(sound,evaluate,subdivide) AND
      sound_subdivide?(evaluate,subdivide) AND
      sound_branch?(evaluate,branch) AND
      presound_combine?(sound,subdivide,branch,denorm,combine) AND
      sound_combine?(sound,subdivide,branch,denorm,combine) IMPLIES
        sound(dom,obj,b_and_b(evaluate,branch,subdivide,denorm,combine,
                              prune,le,ge,select,accumulate,maxdepth,obj,dom)`ans)


decl_type: type
theory: branch_and_bound_X
library: structures
signature: nil
location: 20 2 25 4
body:
    Output : TYPE = [#
      ans    : AnsType,
      exit   : bool,
      depth  : nat,
      splits : nat
    #]


decl_type: type
theory: branch_and_bound_X
library: structures
signature: nil
location: 38 2 40 28
body:
    DirVarStack    : TYPE = [# length : nat,
                               stack  : {s:stack[DirVar] | length(s) = length}
                            #]


decl_type: type
theory: branch_and_bound_X
library: structures
signature: nil
location: 50 2 50 63
body:
    Evaluator      : TYPE = [DomainType,ObjType -> [AnsType,ObjType]] % E.g. computation of a minmax that is sound


decl_type: type
theory: branch_and_bound_X
library: structures
signature: nil
location: 56 2 56 54
body:
    Accumulator    : TYPE = [AnsType,AnsType -> AnsType] % Accumulate information from one branch into the other.


decl_type: function
theory: branch_and_bound_X
library: structures
signature: [[AnsType, bool, nat, nat] -> Output]
location: 27 2 32 4
body:
    mk_out(ans:AnsType,exit:bool,depth,splits:nat): MACRO Output = (#
      ans     := ans,
      exit    := exit,
      depth   := depth,
      splits  := splits
    #)


decl_type: function
theory: branch_and_bound_X
library: structures
signature: [[DirVar, DirVarStack] -> (nonempty?)]
location: 102 2 105 4
body:
    pushDirVar(dirvar,dirvars) : (nonempty?) = (#
      length := dirvars`length+1,
      stack  := push(dirvar,stack(dirvars))
    #)


decl_type: function
theory: branch_and_bound_X
library: structures
signature: [DirVarStack -> DirVarStack]
location: 107 2 113 8
body:
    popDirVar(dirvars) : DirVarStack = 
      IF length(dirvars) = 0 THEN dirvars
      ELSE 
        (# length := dirvars`length - 1,
           stack  := pop(stack(dirvars))
        #)
     ENDIF


decl_type: function
theory: branch_and_bound_X
library: structures
signature: [[SoundPred, Evaluator, SubdivDomain] -> bool]
location: 117 2 119 40
body:
    sound_evaluate?(sound,evaluate,subdivide): bool =
      FORALL (dom,obj): 
        sound(dom,obj,evaluate(dom,obj)`1)


decl_type: function
theory: branch_and_bound_X
library: structures
signature: [[SubdivDomain, VarType] -> [[DomainType, DomainType] -> bool]]
location: 121 2 123 30
body:
    le_subdivide?(subdivide,v)(dom1,dom2:DomainType): bool = 
      dom1 = subdivide(v,dom2)`1 OR    
      dom1 = subdivide(v,dom2)`2 


decl_type: function
theory: branch_and_bound_X
library: structures
signature: [[Evaluator, SubdivDomain] -> bool]
location: 125 2 129 51
body:
    sound_subdivide?(evaluate,subdivide): bool =
      FORALL (dom1,dom2:DomainType,obj,v):
       LET nobj = evaluate(dom2,obj)`2 IN
         le_subdivide?(subdivide,v)(dom1,dom2) IMPLIES 
         evaluate(dom1,obj)`1 = evaluate(dom1,nobj)`1


decl_type: function
theory: branch_and_bound_X
library: structures
signature: [[Evaluator, Brancher] -> bool]
location: 131 2 135 77
body:
    sound_branch?(evaluate,branch) : bool =
      FORALL(dom,obj1,obj2,v):
        evaluate(dom, obj1)`1 = evaluate(dom, obj2)`1  IMPLIES
          evaluate(dom, branch(v, obj1)`1)`1 = evaluate(dom,branch(v,obj2)`1)`1 AND
          evaluate(dom, branch(v, obj1)`2)`1 = evaluate(dom,branch(v,obj2)`2)`1  


decl_type: function
theory: branch_and_bound_X
library: structures
signature: [[SoundPred, Evaluator] -> bool]
location: 137 2 142 25
body:
    presound_evaluate?(sound,evaluate) : bool =
      FORALL(dom,obj1,obj2,ans): 
        evaluate(dom, obj1)`1 = evaluate(dom, obj2)`1 AND
        sound(dom,obj1,ans) 
        IMPLIES
        sound(dom,obj2,ans)


decl_type: function
theory: branch_and_bound_X
library: structures
signature: [[SoundPred, Evaluator, Brancher] -> bool]
location: 144 2 149 39
body:
    inv_branch?(sound,evaluate,branch) : bool =
      FORALL(dom,obj1,obj2,ans,v): 
      evaluate(dom, obj1)`1 = evaluate(dom, obj2)`1 AND
      sound(dom, branch(v, obj1)`1,ans) 
        IMPLIES
        sound(dom, branch(v, obj2)`1,ans)


decl_type: function
theory: branch_and_bound_X
library: structures
signature:
  [[[DomainType, DomainType], [ObjType, ObjType], bool, SoundPred,
  AnsType] ->
  bool]

location: 151 2 152 80
body:
    sound_dir(sddom:[DomainType,DomainType],sdobj:[ObjType,ObjType],dir,sound,ans) : bool =
      IF dir THEN sound(sddom`1,sdobj`1,ans) ELSE sound(sddom`2,sdobj`2,ans) ENDIF 


decl_type: function
theory: branch_and_bound_X
library: structures
signature:
  [[SoundPred, SubdivDomain, Brancher, DenormAns, Combiner] ->
  bool]

location: 154 2 158 56
body:
    presound_combine?(sound,subdivide,branch,denorm,combine): bool = 
      FORALL (v,dom,obj,dir,ans,ans1):
        LET sddom = subdivide(v,dom), sdobj = branch(v,obj) IN
        sound(dom,obj,ans) AND sound_dir(sddom,sdobj,dir,sound,ans1) IMPLIES
        sound(dom,obj,combine(v,denorm((dir,v),ans1),ans))


decl_type: function
theory: branch_and_bound_X
library: structures
signature:
  [[SoundPred, SubdivDomain, Brancher, DenormAns, Combiner] ->
  bool]

location: 160 2 164 77
body:
    sound_combine?(sound,subdivide,branch,denorm,combine): bool = 
      FORALL (v,dom,obj,ans1,ans2):
      LET sddom = subdivide(v,dom), sdobj = branch(v,obj) IN
          sound(sddom`1,sdobj`1,ans1) AND sound(sddom`2,sdobj`2,ans2) 
          IMPLIES sound(dom,obj,combine(v,denorm(left(v),ans1),denorm(right(v),ans2)))


decl_type: function
theory: branch_and_bound_X
library: structures
location: 168 2 205 36
signature:
  [d:
          [Evaluator, Brancher, SubdivDomain, DenormAns, Combiner,
           ExitPred, LocalExitPred, ExitPred, DirVarSelector,
           Accumulator, nat] ->
          [[ObjType, DomainType, AccType,
            {dirvars | length(dirvars) <= d`11}] ->
             Output]]

body:
    branch_and_bound(evaluate,branch,subdivide,denorm,combine,prune,le,ge,select,accumulate,maxdepth)
                    (obj,dom,acc,(dirvars|length(dirvars) <= maxdepth)) : 
      RECURSIVE Output = 
      LET  (thisans,nobj) = evaluate(dom,obj),
           newacc1 = IF none?(acc) THEN thisans ELSE accumulate(val(acc),thisans) ENDIF,
           thisout = mk_out(thisans,ge(dirvars,newacc1,thisans),length(dirvars),0)
       IN
        IF length(dirvars)=maxdepth OR le(thisans) OR thisout`exit OR prune(dirvars,newacc1,thisans) THEN
           thisout
        ELSE
           LET
             (dir,v)     = select(dirvars,newacc1,dom,nobj),
             funsplit    = branch(v,nobj),
             domsplit    = subdivide(v,dom),
             (sp1,sp2)   = IF dir THEN (funsplit`1,funsplit`2) ELSE (funsplit`2,funsplit`1) ENDIF,
             (dom1,dom2) = IF dir THEN (domsplit`1,domsplit`2) ELSE (domsplit`2,domsplit`1) ENDIF,
             firstout    = branch_and_bound(evaluate,branch,subdivide,denorm,combine,
                                            prune,le,ge,select,accumulate,maxdepth)
                                           (sp1,dom1,newacc1,pushDirVar((dir,v),dirvars))
           IN
             IF firstout`exit THEN
               mk_out(combine(v,denorm((dir,v),firstout`ans),thisans),
                      TRUE,firstout`depth,firstout`splits+1)
             ELSE
               LET
                 newacc2    = accumulate(newacc1,firstout`ans),
                 secondout  = branch_and_bound(evaluate,branch,subdivide,denorm,combine,
                                               prune,le,ge,select,accumulate,maxdepth)
                                              (sp2,dom2,newacc2,pushDirVar((NOT dir,v),dirvars)),
                 (real1,real2) = IF dir THEN (firstout,secondout) ELSE (secondout,firstout) ENDIF
               IN
                 mk_out(combine(v,denorm(left(v),real1`ans),denorm(right(v),real2`ans)),
                        secondout`exit,
                        max(firstout`depth,secondout`depth),
                        firstout`splits+secondout`splits+1)
             ENDIF
        ENDIF
      MEASURE maxdepth-length(dirvars)


decl_type: function
theory: branch_and_bound_X
library: structures
location: 222 2 224 47
signature:
  [[Evaluator, Brancher, SubdivDomain, DenormAns, Combiner,
         ExitPred, LocalExitPred, ExitPred, DirVarSelector, Accumulator,
         nat, ObjType, DomainType] ->
          Output]

body:
    b_and_b(evaluate,branch,subdivide,denorm,combine,prune,le,ge,select,accumulate,maxdepth,obj,dom) : Output =
      branch_and_bound(evaluate,branch,subdivide,denorm,combine,prune,le,ge,select,accumulate,maxdepth)
                      (obj,dom,None,emptyDirVars)


decl_type: tcc
theory: branch_and_bound_X
library: structures
signature: nil
location: 241 0 243 999
body:
  % Subtype TCC generated (at line 89, column 13) for  null
      % expected type  {s: stack[DirVar] | length(s) = 0}
  emptyDirVars_TCC1: OBLIGATION length[DirVar](null[DirVar]) = 0;


decl_type: tcc
theory: branch_and_bound_X
library: structures
signature: nil
location: 245 0 248 999
body:
  % Subtype TCC generated (at line 100, column 48) for  top(stack(dirvars))
      % expected type  (some?[DirVar])
  topDirVar_TCC1: OBLIGATION
    FORALL (dirvars: (nonempty?)): some?[DirVar](top[DirVar](stack(dirvars)));


decl_type: tcc
theory: branch_and_bound_X
library: structures
signature: nil
location: 250 0 256 999
body:
  % Subtype TCC generated (at line 104, column 14) for
      % push(dirvar, stack(dirvars))
      % expected type  {s: stack[DirVar] | length(s) = 1 + dirvars`length}
  pushDirVar_TCC1: OBLIGATION
    FORALL (dirvar: DirVar, dirvars: DirVarStack):
      length[DirVar](push[DirVar](dirvar, stack(dirvars))) =
       1 + dirvars`length;


decl_type: tcc
theory: branch_and_bound_X
library: structures
signature: nil
location: 258 0 265 999
body:
  % Subtype TCC generated (at line 102, column 45) for
      % (# length := dirvars`length + 1,
      %    stack := push(dirvar, stack(dirvars)) #)
      % expected type  (nonempty?)
  pushDirVar_TCC2: OBLIGATION
    FORALL (dirvar: DirVar, dirvars: DirVarStack):
      nonempty?((# length := dirvars`length + 1,
                   stack := push[DirVar](dirvar, stack(dirvars)) #));


decl_type: tcc
theory: branch_and_bound_X
library: structures
signature: nil
location: 267 0 271 999
body:
  % Subtype TCC generated (at line 110, column 19) for  dirvars`length - 1
      % expected type  nat
  popDirVar_TCC1: OBLIGATION
    FORALL (dirvars: DirVarStack):
      NOT length(dirvars) = 0 IMPLIES dirvars`length - 1 >= 0;


decl_type: tcc
theory: branch_and_bound_X
library: structures
signature: nil
location: 273 0 278 999
body:
  % Subtype TCC generated (at line 111, column 19) for  pop(stack(dirvars))
      % expected type  {s: stack[DirVar] | length(s) = dirvars`length - 1}
  popDirVar_TCC2: OBLIGATION
    FORALL (dirvars: DirVarStack):
      NOT length(dirvars) = 0 IMPLIES
       length[DirVar](pop[DirVar](stack(dirvars))) = dirvars`length - 1;


decl_type: tcc
theory: branch_and_bound_X
library: structures
signature: nil
location: 280 0 289 999
body:
  % Subtype TCC generated (at line 205, column 12) for
      % maxdepth - length(dirvars)
      % expected type  naturalnumber
  branch_and_bound_TCC1: OBLIGATION
    FORALL (evaluate: Evaluator, branch: Brancher, subdivide: SubdivDomain,
            denorm: DenormAns, combine: Combiner, select: DirVarSelector,
            accumulate: Accumulator, maxdepth: nat, obj: ObjType,
            dom: DomainType,
            (dirvars: DirVarStack | length(dirvars) <= maxdepth)):
      maxdepth - length(dirvars) >= 0;


decl_type: tcc
theory: branch_and_bound_X
library: structures
signature: nil
location: 291 0 302 999
body:
  % Subtype TCC generated (at line 172, column 59) for  acc
      % expected type  (some?[AnsType])
  branch_and_bound_TCC2: OBLIGATION
    FORALL (evaluate: Evaluator, branch: Brancher, subdivide: SubdivDomain,
            denorm: DenormAns, combine: Combiner, select: DirVarSelector,
            accumulate: Accumulator, maxdepth: nat, obj: ObjType,
            dom: DomainType, acc: AccType,
            (dirvars: DirVarStack | length(dirvars) <= maxdepth),
            thisans: AnsType, nobj: ObjType):
      NOT none?(acc) AND
       nobj = evaluate(dom, obj)`2 AND thisans = evaluate(dom, obj)`1
       IMPLIES some?[AnsType](acc);


decl_type: tcc
theory: branch_and_bound_X
library: structures
signature: nil
location: 304 0 362 999
body:
  % Subtype TCC generated (at line 186, column 31) for
      % pushDirVar((dir, v), dirvars)
      % expected type  {dirvars | length(dirvars) <= maxdepth}
  branch_and_bound_TCC3: OBLIGATION
    FORALL (evaluate: Evaluator, branch: Brancher, subdivide: SubdivDomain,
            denorm: DenormAns, combine: Combiner, prune: ExitPred,
            le: LocalExitPred, ge: ExitPred, select: DirVarSelector,
            accumulate: Accumulator, maxdepth: nat, obj: ObjType,
            dom: DomainType, acc: AccType,
            (dirvars: DirVarStack | length(dirvars) <= maxdepth),
            thisans: AnsType, nobj: ObjType):
      nobj = evaluate(dom, obj)`2 AND thisans = evaluate(dom, obj)`1 IMPLIES
       (FORALL (newacc1: AnsType):
          newacc1 =
           IF none?(acc) THEN thisans
           ELSE accumulate(val(acc), thisans)
           ENDIF
           IMPLIES
           (FORALL (thisout: Output):
                   NOT length(dirvars) = maxdepth AND NOT le(thisans)
               AND NOT thisout`exit AND NOT prune(dirvars, newacc1, thisans)
               AND thisout =
                    (# ans := thisans,
                       exit := ge(dirvars, newacc1, thisans),
                       depth := length(dirvars),
                       splits := 0 #)
               IMPLIES
               (FORALL (dir: bool, v: VarType):
                  v = select(dirvars, newacc1, dom, nobj)`2 AND
                   dir = select(dirvars, newacc1, dom, nobj)`1
                   IMPLIES
                   (FORALL (funsplit: [ObjType, ObjType]):
                      funsplit = branch(v, nobj) IMPLIES
                       (FORALL (domsplit: [DomainType, DomainType]):
                          domsplit = subdivide(v, dom) IMPLIES
                           (FORALL (sp1: ObjType, sp2: ObjType):
                              sp2 =
                               IF dir THEN (funsplit`1, funsplit`2)
                               ELSE (funsplit`2, funsplit`1)
                               ENDIF`2
                               AND
                               sp1 =
                                IF dir THEN (funsplit`1, funsplit`2)
                                ELSE (funsplit`2, funsplit`1)
                                ENDIF`1
                               IMPLIES
                               (FORALL (dom1: DomainType, dom2: DomainType):
                                  dom2 =
                                   IF dir THEN (domsplit`1, domsplit`2)
                                   ELSE (domsplit`2, domsplit`1)
                                   ENDIF`2
                                   AND
                                   dom1 =
                                    IF dir THEN (domsplit`1, domsplit`2)
                                    ELSE (domsplit`2, domsplit`1)
                                    ENDIF`1
                                   IMPLIES
                                   length(pushDirVar((dir, v), dirvars)) <=
                                    maxdepth)))))));


decl_type: tcc
theory: branch_and_bound_X
library: structures
signature: nil
location: 364 0 425 999
body:
  % Termination TCC generated (at line 184, column 18) for
      % branch_and_bound(evaluate, branch, subdivide, denorm, combine, prune,
      %                  le, ge, select, accumulate, maxdepth)
      %                 (sp1, dom1, Some(newacc1),
      %                  pushDirVar((dir, v), dirvars))
  branch_and_bound_TCC4: OBLIGATION
    FORALL (evaluate: Evaluator, branch: Brancher, subdivide: SubdivDomain,
            denorm: DenormAns, combine: Combiner, prune: ExitPred,
            le: LocalExitPred, ge: ExitPred, select: DirVarSelector,
            accumulate: Accumulator, maxdepth: nat, obj: ObjType,
            dom: DomainType, acc: AccType,
            (dirvars: DirVarStack | length(dirvars) <= maxdepth),
            thisans: AnsType, nobj: ObjType):
      nobj = evaluate(dom, obj)`2 AND thisans = evaluate(dom, obj)`1 IMPLIES
       (FORALL (newacc1: AnsType):
          newacc1 =
           IF none?(acc) THEN thisans
           ELSE accumulate(val(acc), thisans)
           ENDIF
           IMPLIES
           (FORALL (thisout: Output):
                   NOT length(dirvars) = maxdepth AND NOT le(thisans)
               AND NOT thisout`exit AND NOT prune(dirvars, newacc1, thisans)
               AND thisout =
                    (# ans := thisans,
                       exit := ge(dirvars, newacc1, thisans),
                       depth := length(dirvars),
                       splits := 0 #)
               IMPLIES
               (FORALL (dir: bool, v: VarType):
                  v = select(dirvars, newacc1, dom, nobj)`2 AND
                   dir = select(dirvars, newacc1, dom, nobj)`1
                   IMPLIES
                   (FORALL (funsplit: [ObjType, ObjType]):
                      funsplit = branch(v, nobj) IMPLIES
                       (FORALL (domsplit: [DomainType, DomainType]):
                          domsplit = subdivide(v, dom) IMPLIES
                           (FORALL (sp1: ObjType, sp2: ObjType):
                              sp2 =
                               IF dir THEN (funsplit`1, funsplit`2)
                               ELSE (funsplit`2, funsplit`1)
                               ENDIF`2
                               AND
                               sp1 =
                                IF dir THEN (funsplit`1, funsplit`2)
                                ELSE (funsplit`2, funsplit`1)
                                ENDIF`1
                               IMPLIES
                               (FORALL (dom1: DomainType, dom2: DomainType):
                                  dom2 =
                                   IF dir THEN (domsplit`1, domsplit`2)
                                   ELSE (domsplit`2, domsplit`1)
                                   ENDIF`2
                                   AND
                                   dom1 =
                                    IF dir THEN (domsplit`1, domsplit`2)
                                    ELSE (domsplit`2, domsplit`1)
                                    ENDIF`1
                                   IMPLIES
                                   maxdepth -
                                    length(pushDirVar((dir, v), dirvars))
                                    < maxdepth - length(dirvars))))))));


decl_type: tcc
theory: branch_and_bound_X
library: structures
signature: nil
location: 427 0 526 999
body:
  % Subtype TCC generated (at line 196, column 41) for
      % pushDirVar((NOT dir, v), dirvars)
      % expected type  {dirvars | length(dirvars) <= maxdepth}
  branch_and_bound_TCC5: OBLIGATION
    FORALL (evaluate: Evaluator, branch: Brancher, subdivide: SubdivDomain,
            denorm: DenormAns, combine: Combiner, prune: ExitPred,
            le: LocalExitPred, ge: ExitPred, select: DirVarSelector,
            accumulate: Accumulator, maxdepth: nat, obj: ObjType,
            dom: DomainType, acc: AccType,
            (dirvars: DirVarStack | length(dirvars) <= maxdepth),
            v1:
              [d1:
                 [Evaluator, Brancher, SubdivDomain, DenormAns, Combiner,
                  ExitPred, LocalExitPred, ExitPred, DirVarSelector,
                  Accumulator, nat] ->
                 [{z:
                     [ObjType, DomainType, AccType,
                      {dirvars | length(dirvars) <= d1`11}] |
                           d1`11 - length(z`4) <
                            maxdepth - length(dirvars)} ->
                    Output]],
            thisans: AnsType, nobj: ObjType):
      nobj = evaluate(dom, obj)`2 AND thisans = evaluate(dom, obj)`1 IMPLIES
       (FORALL (newacc1: AnsType):
          newacc1 =
           IF none?(acc) THEN thisans
           ELSE accumulate(val(acc), thisans)
           ENDIF
           IMPLIES
           (FORALL (thisout: Output):
                   NOT length(dirvars) = maxdepth AND NOT le(thisans)
               AND NOT thisout`exit AND NOT prune(dirvars, newacc1, thisans)
               AND thisout =
                    (# ans := thisans,
                       exit := ge(dirvars, newacc1, thisans),
                       depth := length(dirvars),
                       splits := 0 #)
               IMPLIES
               (FORALL (dir: bool, v: VarType):
                  v = select(dirvars, newacc1, dom, nobj)`2 AND
                   dir = select(dirvars, newacc1, dom, nobj)`1
                   IMPLIES
                   (FORALL (funsplit: [ObjType, ObjType]):
                      funsplit = branch(v, nobj) IMPLIES
                       (FORALL (domsplit: [DomainType, DomainType]):
                          domsplit = subdivide(v, dom) IMPLIES
                           (FORALL (sp1: ObjType, sp2: ObjType):
                              sp2 =
                               IF dir THEN (funsplit`1, funsplit`2)
                               ELSE (funsplit`2, funsplit`1)
                               ENDIF`2
                               AND
                               sp1 =
                                IF dir THEN (funsplit`1, funsplit`2)
                                ELSE (funsplit`2, funsplit`1)
                                ENDIF`1
                               IMPLIES
                               (FORALL (dom1: DomainType, dom2: DomainType):
                                  dom2 =
                                   IF dir THEN (domsplit`1, domsplit`2)
                                   ELSE (domsplit`2, domsplit`1)
                                   ENDIF`2
                                   AND
                                   dom1 =
                                    IF dir THEN (domsplit`1, domsplit`2)
                                    ELSE (domsplit`2, domsplit`1)
                                    ENDIF`1
                                   IMPLIES
                                   (FORALL (firstout: Output):
                                      NOT firstout`exit
                                      AND
                                      firstout
                                      =
                                      v1
                                      (evaluate,
                                       branch,
                                       subdivide,
                                       denorm,
                                       combine,
                                       prune,
                                       le,
                                       ge,
                                       select,
                                       accumulate,
                                       maxdepth)
                                      (sp1,
                                       dom1,
                                       Some(newacc1),
                                       pushDirVar((dir, v), dirvars))
                                      IMPLIES
                                      (FORALL
                                       (newacc2: AnsType):
                                       newacc2
                                       =
                                       accumulate(newacc1, firstout`ans)
                                       IMPLIES
                                       length
                                       (pushDirVar((NOT dir, v), dirvars))
                                       <=
                                       maxdepth)))))))));


decl_type: tcc
theory: branch_and_bound_X
library: structures
signature: nil
location: 528 0 631 999
body:
  % Termination TCC generated (at line 194, column 21) for
      % branch_and_bound(evaluate, branch, subdivide, denorm, combine, prune,
      %                  le, ge, select, accumulate, maxdepth)
      %                 (sp2, dom2, Some(newacc2),
      %                  pushDirVar((NOT dir, v), dirvars))
  branch_and_bound_TCC6: OBLIGATION
    FORALL (evaluate: Evaluator, branch: Brancher, subdivide: SubdivDomain,
            denorm: DenormAns, combine: Combiner, prune: ExitPred,
            le: LocalExitPred, ge: ExitPred, select: DirVarSelector,
            accumulate: Accumulator, maxdepth: nat, obj: ObjType,
            dom: DomainType, acc: AccType,
            (dirvars: DirVarStack | length(dirvars) <= maxdepth),
            v1:
              [d1:
                 [Evaluator, Brancher, SubdivDomain, DenormAns, Combiner,
                  ExitPred, LocalExitPred, ExitPred, DirVarSelector,
                  Accumulator, nat] ->
                 [{z:
                     [ObjType, DomainType, AccType,
                      {dirvars | length(dirvars) <= d1`11}] |
                           d1`11 - length(z`4) <
                            maxdepth - length(dirvars)} ->
                    Output]],
            thisans: AnsType, nobj: ObjType):
      nobj = evaluate(dom, obj)`2 AND thisans = evaluate(dom, obj)`1 IMPLIES
       (FORALL (newacc1: AnsType):
          newacc1 =
           IF none?(acc) THEN thisans
           ELSE accumulate(val(acc), thisans)
           ENDIF
           IMPLIES
           (FORALL (thisout: Output):
                   NOT length(dirvars) = maxdepth AND NOT le(thisans)
               AND NOT thisout`exit AND NOT prune(dirvars, newacc1, thisans)
               AND thisout =
                    (# ans := thisans,
                       exit := ge(dirvars, newacc1, thisans),
                       depth := length(dirvars),
                       splits := 0 #)
               IMPLIES
               (FORALL (dir: bool, v: VarType):
                  v = select(dirvars, newacc1, dom, nobj)`2 AND
                   dir = select(dirvars, newacc1, dom, nobj)`1
                   IMPLIES
                   (FORALL (funsplit: [ObjType, ObjType]):
                      funsplit = branch(v, nobj) IMPLIES
                       (FORALL (domsplit: [DomainType, DomainType]):
                          domsplit = subdivide(v, dom) IMPLIES
                           (FORALL (sp1: ObjType, sp2: ObjType):
                              sp2 =
                               IF dir THEN (funsplit`1, funsplit`2)
                               ELSE (funsplit`2, funsplit`1)
                               ENDIF`2
                               AND
                               sp1 =
                                IF dir THEN (funsplit`1, funsplit`2)
                                ELSE (funsplit`2, funsplit`1)
                                ENDIF`1
                               IMPLIES
                               (FORALL (dom1: DomainType, dom2: DomainType):
                                  dom2 =
                                   IF dir THEN (domsplit`1, domsplit`2)
                                   ELSE (domsplit`2, domsplit`1)
                                   ENDIF`2
                                   AND
                                   dom1 =
                                    IF dir THEN (domsplit`1, domsplit`2)
                                    ELSE (domsplit`2, domsplit`1)
                                    ENDIF`1
                                   IMPLIES
                                   (FORALL (firstout: Output):
                                      NOT firstout`exit
                                      AND
                                      firstout
                                      =
                                      v1
                                      (evaluate,
                                       branch,
                                       subdivide,
                                       denorm,
                                       combine,
                                       prune,
                                       le,
                                       ge,
                                       select,
                                       accumulate,
                                       maxdepth)
                                      (sp1,
                                       dom1,
                                       Some(newacc1),
                                       pushDirVar((dir, v), dirvars))
                                      IMPLIES
                                      (FORALL
                                       (newacc2: AnsType):
                                       newacc2
                                       =
                                       accumulate(newacc1, firstout`ans)
                                       IMPLIES
                                       maxdepth
                                       -
                                       length
                                       (pushDirVar((NOT dir, v), dirvars))
                                       <
                                       maxdepth - length(dirvars))))))))));


decl_type: tcc
theory: branch_and_bound_X
library: structures
signature: nil
location: 633 0 640 999
body:
  % Subtype TCC generated (at line 224, column 34) for  emptyDirVars
      % expected type  {dirvars | length(dirvars) <= maxdepth}
  b_and_b_TCC1: OBLIGATION
    FORALL (evaluate: Evaluator, branch: Brancher, subdivide: SubdivDomain,
            denorm: DenormAns, combine: Combiner, select: DirVarSelector,
            accumulate: Accumulator, maxdepth: nat, obj: ObjType,
            dom: DomainType):
      length(emptyDirVars) <= maxdepth;


decl_type: formula
theory: branch_and_bound
library: structures
signature: nil
location: 187 2 200 35
body:
    branch_and_bound_sound : THEOREM 
      FORALL(sound,simplify,evaluate,branch,subdivide,denorm,combine,prune,le,ge,select,accumulate,maxdepth):
          accomodates?(sound,evaluate) AND
          simplify_invariant?(sound,simplify) AND
          evaluate_simplify?(evaluate,simplify) AND
          subdiv_presound?(sound,subdivide,branch,denorm,combine) AND
          subdiv_sound?(sound,subdivide,branch,denorm,combine) AND
          branch_simplify?(branch,simplify) IMPLIES
        FORALL (obj,dom,acc,dirvars):
          length(dirvars) <= maxdepth IMPLIES
          LET bandb = branch_and_bound(simplify,evaluate,branch,subdivide,denorm,combine,
                                       prune,le,ge,select,accumulate,maxdepth)
                                      (obj,dom,acc,dirvars)
          IN sound(dom,obj,bandb`ans)


decl_type: formula
theory: branch_and_bound
library: structures
signature: nil
location: 206 2 214 80
body:
    b_and_b_sound : THEOREM 
      accomodates?(sound,evaluate) AND
      simplify_invariant?(sound,simplify) AND
      evaluate_simplify?(evaluate,simplify) AND
      subdiv_presound?(sound,subdivide,branch,denorm,combine) AND
      subdiv_sound?(sound,subdivide,branch,denorm,combine) AND
      branch_simplify?(branch,simplify) IMPLIES
        sound(dom,obj,b_and_b(simplify,evaluate,branch,subdivide,denorm,combine,
                              prune,le,ge,select,accumulate,maxdepth,obj,dom)`ans)


decl_type: formula
theory: branch_and_bound
library: structures
signature: nil
location: 219 2 224 83
body:
    b_and_b_id_sound : THEOREM 
      accomodates?(sound,evaluate) AND
      subdiv_presound?(sound,subdivide,branch,denorm,combine) AND
      subdiv_sound?(sound,subdivide,branch,denorm,combine) IMPLIES
        sound(dom,obj,b_and_b_id(evaluate,branch,subdivide,denorm,combine,
                                 prune,le,ge,select,accumulate,maxdepth,obj,dom)`ans)


decl_type: type
theory: branch_and_bound
library: structures
signature: nil
location: 51 2 51 53
body:
    Evaluator      : TYPE = [DomainType,ObjType -> AnsType]       % E.g. computation of a minmax that is sound


decl_type: function
theory: branch_and_bound
library: structures
signature: [[Brancher, Simplifier] -> bool]
location: 118 2 119 99
body:
    branch_simplify?(branch,simplify): bool =
      FORALL (v,obj): branch(v,simplify(obj)) = (simplify(branch(v,obj)`1),simplify(branch(v,obj)`2))


decl_type: function
theory: branch_and_bound
library: structures
signature: [[SoundPred, Simplifier] -> bool]
location: 121 2 122 77
body:
    simplify_invariant?(sound,simplify): bool =
      FORALL (dom,obj,ans): sound(dom,obj,ans) IFF sound(dom,simplify(obj),ans)


decl_type: function
theory: branch_and_bound
library: structures
signature: [[Evaluator, Simplifier] -> bool]
location: 124 2 125 69
body:
    evaluate_simplify?(evaluate,simplify): bool =
      FORALL (dom,obj): evaluate(dom,obj) = evaluate(dom,simplify(obj))


decl_type: function
theory: branch_and_bound
library: structures
signature:
  [[SoundPred, SubdivDomain, Brancher, DenormAns, Combiner] ->
  bool]

location: 133 2 137 56
body:
    subdiv_presound?(sound,subdivide,branch,denorm,combine): bool = 
      FORALL (v,dom,obj,dir,ans,ans1):
        LET sddom = subdivide(v,dom), sdobj = branch(v,obj) IN
        sound(dom,obj,ans) AND sound_dir(sddom,sdobj,dir,sound,ans1) IMPLIES
        sound(dom,obj,combine(v,denorm((dir,v),ans1),ans))


decl_type: function
theory: branch_and_bound
library: structures
signature:
  [[SoundPred, SubdivDomain, Brancher, DenormAns, Combiner] ->
  bool]

location: 139 2 143 77
body:
    subdiv_sound?(sound,subdivide,branch,denorm,combine): bool = 
      FORALL (v,dom,obj,ans1,ans2):
      LET sddom = subdivide(v,dom), sdobj = branch(v,obj) IN
          sound(sddom`1,sdobj`1,ans1) AND sound(sddom`2,sdobj`2,ans2) 
          IMPLIES sound(dom,obj,combine(v,denorm(left(v),ans1),denorm(right(v),ans2)))


decl_type: function
theory: branch_and_bound
library: structures
location: 147 2 185 36
signature:
  [d:
          [Simplifier, Evaluator, Brancher, SubdivDomain, DenormAns,
           Combiner, ExitPred, LocalExitPred, ExitPred, DirVarSelector,
           Accumulator, nat] ->
          [[ObjType, DomainType, AccType,
            {dirvars | length(dirvars) <= d`12}] ->
             Output]]

body:
    branch_and_bound(simplify,evaluate,branch,subdivide,denorm,combine,prune,le,ge,select,accumulate,maxdepth)
                    (obj,dom,acc,(dirvars|length(dirvars) <= maxdepth)) : 
      RECURSIVE Output = 
      LET  nobj    = simplify(obj),
           thisans = evaluate(dom,nobj),
           newacc1 = IF none?(acc) THEN thisans ELSE accumulate(val(acc),thisans) ENDIF,
           thisout = mk_out(thisans,ge(dirvars,newacc1,thisans),length(dirvars),0)
       IN
        IF length(dirvars)=maxdepth OR le(thisans) OR thisout`exit OR prune(dirvars,newacc1,thisans) THEN
           thisout
        ELSE
           LET
             (dir,v)     = select(dirvars,newacc1,dom,nobj),
             funsplit    = branch(v,nobj),
             domsplit    = subdivide(v,dom),
             (sp1,sp2)   = IF dir THEN (funsplit`1,funsplit`2) ELSE (funsplit`2,funsplit`1) ENDIF,
             (dom1,dom2) = IF dir THEN (domsplit`1,domsplit`2) ELSE (domsplit`2,domsplit`1) ENDIF,
             firstout    = branch_and_bound(simplify,evaluate,branch,subdivide,denorm,combine,
                                            prune,le,ge,select,accumulate,maxdepth)
                                           (sp1,dom1,newacc1,pushDirVar((dir,v),dirvars))
           IN
             IF firstout`exit THEN
               mk_out(combine(v,denorm((dir,v),firstout`ans),thisans),
                      TRUE,firstout`depth,firstout`splits+1)
             ELSE
               LET
                 newacc2    = accumulate(newacc1,firstout`ans),
                 secondout  = branch_and_bound(simplify,evaluate,branch,subdivide,denorm,combine,
                                               prune,le,ge,select,accumulate,maxdepth)
                                              (sp2,dom2,newacc2,pushDirVar((NOT dir,v),dirvars)),
                 (real1,real2) = IF dir THEN (firstout,secondout) ELSE (secondout,firstout) ENDIF
               IN
                 mk_out(combine(v,denorm(left(v),real1`ans),denorm(right(v),real2`ans)),
                        secondout`exit,
                        max(firstout`depth,secondout`depth),
                        firstout`splits+secondout`splits+1)
             ENDIF
        ENDIF
      MEASURE maxdepth-length(dirvars)


decl_type: function
theory: branch_and_bound
library: structures
location: 202 2 204 47
signature:
  [[Simplifier, Evaluator, Brancher, SubdivDomain, DenormAns,
         Combiner, ExitPred, LocalExitPred, ExitPred, DirVarSelector,
         Accumulator, nat, ObjType, DomainType] ->
          Output]

body:
    b_and_b(simplify,evaluate,branch,subdivide,denorm,combine,prune,le,ge,select,accumulate,maxdepth,obj,dom) : Output =
      branch_and_bound(simplify,evaluate,branch,subdivide,denorm,combine,prune,le,ge,select,accumulate,maxdepth)
                      (obj,dom,None,emptyDirVars)


decl_type: function
theory: branch_and_bound
library: structures
location: 216 2 217 117
signature:
  [[Evaluator, Brancher, SubdivDomain, DenormAns, Combiner,
         ExitPred, LocalExitPred, ExitPred, DirVarSelector, Accumulator,
         nat, ObjType, DomainType] ->
          Output]

body:
    b_and_b_id(evaluate,branch,subdivide,denorm,combine,prune,le,ge,select,accumulate,maxdepth,obj,dom) : Output =
      b_and_b(LAMBDA (obj):obj,evaluate,branch,subdivide,denorm,combine,prune,le,ge,select,accumulate,maxdepth,obj,dom)


decl_type: tcc
theory: branch_and_bound
library: structures
signature: nil
location: 231 0 233 999
body:
  % Subtype TCC generated (at line 90, column 13) for  null
      % expected type  {s: stack[DirVar] | length(s) = 0}
  emptyDirVars_TCC1: OBLIGATION length[DirVar](null[DirVar]) = 0;


decl_type: tcc
theory: branch_and_bound
library: structures
signature: nil
location: 235 0 238 999
body:
  % Subtype TCC generated (at line 101, column 48) for  top(stack(dirvars))
      % expected type  (some?[DirVar])
  topDirVar_TCC1: OBLIGATION
    FORALL (dirvars: (nonempty?)): some?[DirVar](top[DirVar](stack(dirvars)));


decl_type: tcc
theory: branch_and_bound
library: structures
signature: nil
location: 240 0 246 999
body:
  % Subtype TCC generated (at line 105, column 14) for
      % push(dirvar, stack(dirvars))
      % expected type  {s: stack[DirVar] | length(s) = 1 + dirvars`length}
  pushDirVar_TCC1: OBLIGATION
    FORALL (dirvar: DirVar, dirvars: DirVarStack):
      length[DirVar](push[DirVar](dirvar, stack(dirvars))) =
       1 + dirvars`length;


decl_type: tcc
theory: branch_and_bound
library: structures
signature: nil
location: 248 0 255 999
body:
  % Subtype TCC generated (at line 103, column 45) for
      % (# length := dirvars`length + 1,
      %    stack := push(dirvar, stack(dirvars)) #)
      % expected type  (nonempty?)
  pushDirVar_TCC2: OBLIGATION
    FORALL (dirvar: DirVar, dirvars: DirVarStack):
      nonempty?((# length := dirvars`length + 1,
                   stack := push[DirVar](dirvar, stack(dirvars)) #));


decl_type: tcc
theory: branch_and_bound
library: structures
signature: nil
location: 257 0 261 999
body:
  % Subtype TCC generated (at line 111, column 19) for  dirvars`length - 1
      % expected type  nat
  popDirVar_TCC1: OBLIGATION
    FORALL (dirvars: DirVarStack):
      NOT length(dirvars) = 0 IMPLIES dirvars`length - 1 >= 0;


decl_type: tcc
theory: branch_and_bound
library: structures
signature: nil
location: 263 0 268 999
body:
  % Subtype TCC generated (at line 112, column 19) for  pop(stack(dirvars))
      % expected type  {s: stack[DirVar] | length(s) = dirvars`length - 1}
  popDirVar_TCC2: OBLIGATION
    FORALL (dirvars: DirVarStack):
      NOT length(dirvars) = 0 IMPLIES
       length[DirVar](pop[DirVar](stack(dirvars))) = dirvars`length - 1;


decl_type: tcc
theory: branch_and_bound
library: structures
signature: nil
location: 270 0 279 999
body:
  % Subtype TCC generated (at line 185, column 12) for
      % maxdepth - length(dirvars)
      % expected type  naturalnumber
  branch_and_bound_TCC1: OBLIGATION
    FORALL (simplify: Simplifier, evaluate: Evaluator, branch: Brancher,
            subdivide: SubdivDomain, denorm: DenormAns, combine: Combiner,
            select: DirVarSelector, accumulate: Accumulator, maxdepth: nat,
            obj: ObjType, dom: DomainType,
            (dirvars: DirVarStack | length(dirvars) <= maxdepth)):
      maxdepth - length(dirvars) >= 0;


decl_type: tcc
theory: branch_and_bound
library: structures
signature: nil
location: 281 0 293 999
body:
  % Subtype TCC generated (at line 152, column 59) for  acc
      % expected type  (some?[AnsType])
  branch_and_bound_TCC2: OBLIGATION
    FORALL (simplify: Simplifier, evaluate: Evaluator, branch: Brancher,
            subdivide: SubdivDomain, denorm: DenormAns, combine: Combiner,
            select: DirVarSelector, accumulate: Accumulator, maxdepth: nat,
            obj: ObjType, dom: DomainType, acc: AccType,
            (dirvars: DirVarStack | length(dirvars) <= maxdepth),
            nobj: ObjType):
      nobj = simplify(obj) IMPLIES
       (FORALL (thisans: AnsType):
          NOT none?(acc) AND thisans = evaluate(dom, nobj) IMPLIES
           some?[AnsType](acc));


decl_type: tcc
theory: branch_and_bound
library: structures
signature: nil
location: 295 0 362 999
body:
  % Subtype TCC generated (at line 166, column 31) for
      % pushDirVar((dir, v), dirvars)
      % expected type  {dirvars | length(dirvars) <= maxdepth}
  branch_and_bound_TCC3: OBLIGATION
    FORALL (simplify: Simplifier, evaluate: Evaluator, branch: Brancher,
            subdivide: SubdivDomain, denorm: DenormAns, combine: Combiner,
            prune: ExitPred, le: LocalExitPred, ge: ExitPred,
            select: DirVarSelector, accumulate: Accumulator, maxdepth: nat,
            obj: ObjType, dom: DomainType, acc: AccType,
            (dirvars: DirVarStack | length(dirvars) <= maxdepth),
            nobj: ObjType):
      nobj = simplify(obj) IMPLIES
       (FORALL (thisans: AnsType):
          thisans = evaluate(dom, nobj) IMPLIES
           (FORALL (newacc1: AnsType):
              newacc1 =
               IF none?(acc) THEN thisans
               ELSE accumulate(val(acc), thisans)
               ENDIF
               IMPLIES
               (FORALL (thisout: Output):
                       NOT length(dirvars) = maxdepth AND NOT le(thisans)
                   AND NOT thisout`exit
                   AND NOT prune(dirvars, newacc1, thisans)
                   AND thisout =
                        (# ans := thisans,
                           exit := ge(dirvars, newacc1, thisans),
                           depth := length(dirvars),
                           splits := 0 #)
                   IMPLIES
                   (FORALL (dir: bool, v: VarType):
                      v = select(dirvars, newacc1, dom, nobj)`2 AND
                       dir = select(dirvars, newacc1, dom, nobj)`1
                       IMPLIES
                       (FORALL (funsplit: [ObjType, ObjType]):
                          funsplit = branch(v, nobj) IMPLIES
                           (FORALL (domsplit: [DomainType, DomainType]):
                              domsplit = subdivide(v, dom) IMPLIES
                               (FORALL (sp1: ObjType, sp2: ObjType):
                                  sp2 =
                                   IF dir THEN (funsplit`1, funsplit`2)
                                   ELSE (funsplit`2, funsplit`1)
                                   ENDIF`2
                                   AND
                                   sp1 =
                                    IF dir THEN (funsplit`1, funsplit`2)
                                    ELSE (funsplit`2, funsplit`1)
                                    ENDIF`1
                                   IMPLIES
                                   (FORALL (dom1: DomainType,
                                            dom2: DomainType):
                                      dom2
                                      =
                                      IF dir
                                      THEN (domsplit`1, domsplit`2)
                                      ELSE (domsplit`2, domsplit`1)
                                      ENDIF`2
                                      AND
                                      dom1
                                      =
                                      IF dir
                                      THEN (domsplit`1, domsplit`2)
                                      ELSE (domsplit`2, domsplit`1)
                                      ENDIF`1
                                      IMPLIES
                                      length(pushDirVar((dir, v), dirvars))
                                      <=
                                      maxdepth))))))));


decl_type: tcc
theory: branch_and_bound
library: structures
signature: nil
location: 364 0 435 999
body:
  % Termination TCC generated (at line 164, column 18) for
      % branch_and_bound(simplify, evaluate, branch, subdivide, denorm,
      %                  combine, prune, le, ge, select, accumulate, maxdepth)
      %                 (sp1, dom1, Some(newacc1),
      %                  pushDirVar((dir, v), dirvars))
  branch_and_bound_TCC4: OBLIGATION
    FORALL (simplify: Simplifier, evaluate: Evaluator, branch: Brancher,
            subdivide: SubdivDomain, denorm: DenormAns, combine: Combiner,
            prune: ExitPred, le: LocalExitPred, ge: ExitPred,
            select: DirVarSelector, accumulate: Accumulator, maxdepth: nat,
            obj: ObjType, dom: DomainType, acc: AccType,
            (dirvars: DirVarStack | length(dirvars) <= maxdepth),
            nobj: ObjType):
      nobj = simplify(obj) IMPLIES
       (FORALL (thisans: AnsType):
          thisans = evaluate(dom, nobj) IMPLIES
           (FORALL (newacc1: AnsType):
              newacc1 =
               IF none?(acc) THEN thisans
               ELSE accumulate(val(acc), thisans)
               ENDIF
               IMPLIES
               (FORALL (thisout: Output):
                       NOT length(dirvars) = maxdepth AND NOT le(thisans)
                   AND NOT thisout`exit
                   AND NOT prune(dirvars, newacc1, thisans)
                   AND thisout =
                        (# ans := thisans,
                           exit := ge(dirvars, newacc1, thisans),
                           depth := length(dirvars),
                           splits := 0 #)
                   IMPLIES
                   (FORALL (dir: bool, v: VarType):
                      v = select(dirvars, newacc1, dom, nobj)`2 AND
                       dir = select(dirvars, newacc1, dom, nobj)`1
                       IMPLIES
                       (FORALL (funsplit: [ObjType, ObjType]):
                          funsplit = branch(v, nobj) IMPLIES
                           (FORALL (domsplit: [DomainType, DomainType]):
                              domsplit = subdivide(v, dom) IMPLIES
                               (FORALL (sp1: ObjType, sp2: ObjType):
                                  sp2 =
                                   IF dir THEN (funsplit`1, funsplit`2)
                                   ELSE (funsplit`2, funsplit`1)
                                   ENDIF`2
                                   AND
                                   sp1 =
                                    IF dir THEN (funsplit`1, funsplit`2)
                                    ELSE (funsplit`2, funsplit`1)
                                    ENDIF`1
                                   IMPLIES
                                   (FORALL (dom1: DomainType,
                                            dom2: DomainType):
                                      dom2
                                      =
                                      IF dir
                                      THEN (domsplit`1, domsplit`2)
                                      ELSE (domsplit`2, domsplit`1)
                                      ENDIF`2
                                      AND
                                      dom1
                                      =
                                      IF dir
                                      THEN (domsplit`1, domsplit`2)
                                      ELSE (domsplit`2, domsplit`1)
                                      ENDIF`1
                                      IMPLIES
                                      maxdepth
                                      -
                                      length(pushDirVar((dir, v), dirvars))
                                      <
                                      maxdepth - length(dirvars)))))))));


decl_type: tcc
theory: branch_and_bound
library: structures
signature: nil
location: 437 0 546 999
body:
  % Subtype TCC generated (at line 176, column 41) for
      % pushDirVar((NOT dir, v), dirvars)
      % expected type  {dirvars | length(dirvars) <= maxdepth}
  branch_and_bound_TCC5: OBLIGATION
    FORALL (simplify: Simplifier, evaluate: Evaluator, branch: Brancher,
            subdivide: SubdivDomain, denorm: DenormAns, combine: Combiner,
            prune: ExitPred, le: LocalExitPred, ge: ExitPred,
            select: DirVarSelector, accumulate: Accumulator, maxdepth: nat,
            obj: ObjType, dom: DomainType, acc: AccType,
            (dirvars: DirVarStack | length(dirvars) <= maxdepth),
            v1:
              [d1:
                 [Simplifier, Evaluator, Brancher, SubdivDomain, DenormAns,
                  Combiner, ExitPred, LocalExitPred, ExitPred,
                  DirVarSelector, Accumulator, nat] ->
                 [{z:
                     [ObjType, DomainType, AccType,
                      {dirvars | length(dirvars) <= d1`12}] |
                           d1`12 - length(z`4) <
                            maxdepth - length(dirvars)} ->
                    Output]],
            nobj: ObjType):
      nobj = simplify(obj) IMPLIES
       (FORALL (thisans: AnsType):
          thisans = evaluate(dom, nobj) IMPLIES
           (FORALL (newacc1: AnsType):
              newacc1 =
               IF none?(acc) THEN thisans
               ELSE accumulate(val(acc), thisans)
               ENDIF
               IMPLIES
               (FORALL (thisout: Output):
                       NOT length(dirvars) = maxdepth AND NOT le(thisans)
                   AND NOT thisout`exit
                   AND NOT prune(dirvars, newacc1, thisans)
                   AND thisout =
                        (# ans := thisans,
                           exit := ge(dirvars, newacc1, thisans),
                           depth := length(dirvars),
                           splits := 0 #)
                   IMPLIES
                   (FORALL (dir: bool, v: VarType):
                      v = select(dirvars, newacc1, dom, nobj)`2 AND
                       dir = select(dirvars, newacc1, dom, nobj)`1
                       IMPLIES
                       (FORALL (funsplit: [ObjType, ObjType]):
                          funsplit = branch(v, nobj) IMPLIES
                           (FORALL (domsplit: [DomainType, DomainType]):
                              domsplit = subdivide(v, dom) IMPLIES
                               (FORALL (sp1: ObjType, sp2: ObjType):
                                  sp2 =
                                   IF dir THEN (funsplit`1, funsplit`2)
                                   ELSE (funsplit`2, funsplit`1)
                                   ENDIF`2
                                   AND
                                   sp1 =
                                    IF dir THEN (funsplit`1, funsplit`2)
                                    ELSE (funsplit`2, funsplit`1)
                                    ENDIF`1
                                   IMPLIES
                                   (FORALL (dom1: DomainType,
                                            dom2: DomainType):
                                      dom2
                                      =
                                      IF dir
                                      THEN (domsplit`1, domsplit`2)
                                      ELSE (domsplit`2, domsplit`1)
                                      ENDIF`2
                                      AND
                                      dom1
                                      =
                                      IF dir
                                      THEN (domsplit`1, domsplit`2)
                                      ELSE (domsplit`2, domsplit`1)
                                      ENDIF`1
                                      IMPLIES
                                      (FORALL
                                       (firstout: Output):
                                       NOT firstout`exit
                                       AND
                                       firstout
                                       =
                                       v1
                                       (simplify,
                                        evaluate,
                                        branch,
                                        subdivide,
                                        denorm,
                                        combine,
                                        prune,
                                        le,
                                        ge,
                                        select,
                                        accumulate,
                                        maxdepth)
                                       (sp1,
                                        dom1,
                                        Some(newacc1),
                                        pushDirVar((dir, v), dirvars))
                                       IMPLIES
                                       (FORALL
                                        (newacc2: AnsType):
                                        newacc2
                                        =
                                        accumulate(newacc1, firstout`ans)
                                        IMPLIES
                                        length
                                        (pushDirVar((NOT dir, v), dirvars))
                                        <=
                                        maxdepth))))))))));


decl_type: tcc
theory: branch_and_bound
library: structures
signature: nil
location: 548 0 661 999
body:
  % Termination TCC generated (at line 174, column 21) for
      % branch_and_bound(simplify, evaluate, branch, subdivide, denorm,
      %                  combine, prune, le, ge, select, accumulate, maxdepth)
      %                 (sp2, dom2, Some(newacc2),
      %                  pushDirVar((NOT dir, v), dirvars))
  branch_and_bound_TCC6: OBLIGATION
    FORALL (simplify: Simplifier, evaluate: Evaluator, branch: Brancher,
            subdivide: SubdivDomain, denorm: DenormAns, combine: Combiner,
            prune: ExitPred, le: LocalExitPred, ge: ExitPred,
            select: DirVarSelector, accumulate: Accumulator, maxdepth: nat,
            obj: ObjType, dom: DomainType, acc: AccType,
            (dirvars: DirVarStack | length(dirvars) <= maxdepth),
            v1:
              [d1:
                 [Simplifier, Evaluator, Brancher, SubdivDomain, DenormAns,
                  Combiner, ExitPred, LocalExitPred, ExitPred,
                  DirVarSelector, Accumulator, nat] ->
                 [{z:
                     [ObjType, DomainType, AccType,
                      {dirvars | length(dirvars) <= d1`12}] |
                           d1`12 - length(z`4) <
                            maxdepth - length(dirvars)} ->
                    Output]],
            nobj: ObjType):
      nobj = simplify(obj) IMPLIES
       (FORALL (thisans: AnsType):
          thisans = evaluate(dom, nobj) IMPLIES
           (FORALL (newacc1: AnsType):
              newacc1 =
               IF none?(acc) THEN thisans
               ELSE accumulate(val(acc), thisans)
               ENDIF
               IMPLIES
               (FORALL (thisout: Output):
                       NOT length(dirvars) = maxdepth AND NOT le(thisans)
                   AND NOT thisout`exit
                   AND NOT prune(dirvars, newacc1, thisans)
                   AND thisout =
                        (# ans := thisans,
                           exit := ge(dirvars, newacc1, thisans),
                           depth := length(dirvars),
                           splits := 0 #)
                   IMPLIES
                   (FORALL (dir: bool, v: VarType):
                      v = select(dirvars, newacc1, dom, nobj)`2 AND
                       dir = select(dirvars, newacc1, dom, nobj)`1
                       IMPLIES
                       (FORALL (funsplit: [ObjType, ObjType]):
                          funsplit = branch(v, nobj) IMPLIES
                           (FORALL (domsplit: [DomainType, DomainType]):
                              domsplit = subdivide(v, dom) IMPLIES
                               (FORALL (sp1: ObjType, sp2: ObjType):
                                  sp2 =
                                   IF dir THEN (funsplit`1, funsplit`2)
                                   ELSE (funsplit`2, funsplit`1)
                                   ENDIF`2
                                   AND
                                   sp1 =
                                    IF dir THEN (funsplit`1, funsplit`2)
                                    ELSE (funsplit`2, funsplit`1)
                                    ENDIF`1
                                   IMPLIES
                                   (FORALL (dom1: DomainType,
                                            dom2: DomainType):
                                      dom2
                                      =
                                      IF dir
                                      THEN (domsplit`1, domsplit`2)
                                      ELSE (domsplit`2, domsplit`1)
                                      ENDIF`2
                                      AND
                                      dom1
                                      =
                                      IF dir
                                      THEN (domsplit`1, domsplit`2)
                                      ELSE (domsplit`2, domsplit`1)
                                      ENDIF`1
                                      IMPLIES
                                      (FORALL
                                       (firstout: Output):
                                       NOT firstout`exit
                                       AND
                                       firstout
                                       =
                                       v1
                                       (simplify,
                                        evaluate,
                                        branch,
                                        subdivide,
                                        denorm,
                                        combine,
                                        prune,
                                        le,
                                        ge,
                                        select,
                                        accumulate,
                                        maxdepth)
                                       (sp1,
                                        dom1,
                                        Some(newacc1),
                                        pushDirVar((dir, v), dirvars))
                                       IMPLIES
                                       (FORALL
                                        (newacc2: AnsType):
                                        newacc2
                                        =
                                        accumulate(newacc1, firstout`ans)
                                        IMPLIES
                                        maxdepth
                                        -
                                        length
                                        (pushDirVar((NOT dir, v), dirvars))
                                        <
                                        maxdepth - length(dirvars)))))))))));


decl_type: tcc
theory: branch_and_bound
library: structures
signature: nil
location: 663 0 670 999
body:
  % Subtype TCC generated (at line 204, column 34) for  emptyDirVars
      % expected type  {dirvars | length(dirvars) <= maxdepth}
  b_and_b_TCC1: OBLIGATION
    FORALL (simplify: Simplifier, evaluate: Evaluator, branch: Brancher,
            subdivide: SubdivDomain, denorm: DenormAns, combine: Combiner,
            select: DirVarSelector, accumulate: Accumulator, maxdepth: nat,
            obj: ObjType, dom: DomainType):
      length(emptyDirVars) <= maxdepth;


decl_type: formula
theory: max_array_def
library: structures
signature: nil
location: 28 2 29 57
body:
    imax_rec_lem: LEMMA  ii <= j AND j <= jj IMPLIES 
                               A(j) <= A(imax_rec(A,ii,jj))


decl_type: formula
theory: max_array_def
library: structures
signature: nil
location: 31 2 32 64
body:
    imax_rec_rng: LEMMA  ii <= jj IMPLIES ii <= imax_rec(A,ii,jj) AND
                                           imax_rec(A,ii,jj) <= jj


decl_type: function
theory: max_array_def
library: structures
signature: [[[below(N) -> T], below(N), below(N)] -> below(N)]
location: 23 2 26 42
body:
    imax_rec(A,ii,jj): RECURSIVE below(N) = 
          IF jj <= ii THEN ii
          ELSE amax(A,jj,imax_rec(A,ii,jj-1)) 
          ENDIF MEASURE (LAMBDA A,ii,jj: jj)


decl_type: function
theory: max_array_def
library: structures
location: 39 2 41 66
signature:
  [d: [[below(N) -> T], ii: below(N), abv(ii)] ->
          {i: subrange(d`2, d`3) |
                   FORALL j:
                     d`2 <= j AND j <= d`3 IMPLIES d`1(j) <= d`1(i)}]

body:
    Imax(A,ii,(jj: abv(ii))): {i: subrange(ii,jj) | 
                                 (FORALL j: ii <= j AND j <= jj 
                                              IMPLIES A(j) <= A(i))}


decl_type: tcc
theory: max_array_def
library: structures
signature: nil
location: 50 0 54 999
body:
  % Subtype TCC generated (at line 25, column 37) for  jj - 1
      % expected type  below(N)
  imax_rec_TCC1: OBLIGATION
    FORALL (A: [below(N) -> T], ii: below(N), jj: below(N)):
      NOT jj <= ii IMPLIES jj - 1 >= 0 AND jj - 1 < N;


decl_type: tcc
theory: max_array_def
library: structures
signature: nil
location: 56 0 60 999
body:
  % Termination TCC generated (at line 25, column 23) for
      % imax_rec(A, ii, jj - 1)
  imax_rec_TCC2: OBLIGATION
    FORALL (A: [below(N) -> T], ii: below(N), jj: below(N)):
      NOT jj <= ii IMPLIES jj - 1 < jj;


decl_type: tcc
theory: max_array_def
library: structures
signature: nil
location: 62 0 65 999
body:
  % Subtype TCC generated (at line 37, column 32) for  jj
      % expected type  below(N)
  Imax_rec_TCC1: OBLIGATION
    FORALL (A: [below(N) -> T], ii: below(N), (jj: abv(ii))): jj < N;


decl_type: tcc
theory: max_array_def
library: structures
signature: nil
location: 67 0 71 999
body:
  % Subtype TCC generated (at line 37, column 18) for  imax_rec(A, ii, jj)
      % expected type  subrange(ii, jj)
  Imax_rec_TCC2: OBLIGATION
    FORALL (A: [below(N) -> T], ii: below(N), (jj: abv(ii))):
      ii <= imax_rec(A, ii, jj) AND imax_rec(A, ii, jj) <= jj;


decl_type: tcc
theory: max_array_def
library: structures
signature: nil
location: 73 0 77 999
body:
  % Subtype TCC generated (at line 41, column 62) for  i
      % expected type  below(N)
  Imax_TCC1: OBLIGATION
    FORALL (ii, (jj: abv(ii)), i: subrange(ii, jj), j):
      ii <= j AND j <= jj IMPLIES i < N;


decl_type: tcc
theory: max_array_def
library: structures
signature: nil
location: 79 0 90 999
body:
  % Existence TCC generated (at line 39, column 2) for
      % Imax(A, ii, (jj: abv(ii))):
      %       {i: subrange(ii, jj) |
      %                (FORALL j: ii <= j AND j <= jj IMPLIES A(j) <= A(i))}
  Imax_TCC2: OBLIGATION
    EXISTS (x:
              [d: [[below(N) -> T], ii: below(N), abv(ii)] ->
                 {i: subrange(d`2, d`3) |
                          FORALL j:
                            d`2 <= j AND j <= d`3 IMPLIES
                             d`1(j) <= d`1(i)}]):
      TRUE;


decl_type: tcc
theory: max_array_def
library: structures
signature: nil
location: 92 0 94 999
body:
  % Subtype TCC generated (at line 43, column 28) for  ii
      % expected type  abv(ii)
  Imax_1_TCC1: OBLIGATION FORALL (ii: below(N)): ii <= ii AND ii < N;


decl_type: function
theory: fsq
library: structures
signature: [[nat, T] -> fsq]
location: 31 2 32 64
body:
    const_fsq(n: nat,c:T): fsq = (# length := n,
                                    seq := (LAMBDA (n: nat): c) #)


decl_type: formula
theory: fseqs
library: structures
signature: nil
location: 91 2 92 76
body:
    fseqs_eq: LEMMA fs1 = fs2 IFF fs1`length = fs2`length AND
              (FORALL (n:nat): n < fs1`length IMPLIES fs1`seq(n) = fs2`seq(n)) 


decl_type: function
theory: fseqs
library: structures
signature: [T -> ne_fseq]
location: 65 2 66 83
body:
    singleton(x:T): ne_fseq = 
      (# length := 1, seq := (LAMBDA (n: nat): IF n = 0 THEN x ELSE default ENDIF) #)


decl_type: function
theory: fseqs
library: structures
signature: [[[nat -> T], nat] -> [nat -> T]]
location: 71 2 72 66
body:
    tofs(f:[nat->T], len: nat): MACRO [nat -> T] = 
         (LAMBDA (i:nat): IF i < len THEN f(i) ELSE default ENDIF) ;


decl_type: function
theory: fseqs
library: structures
signature: [fsq[T] -> fseq]
location: 81 2 83 30
body:
    tofseq(f: fsq[T]): fseq = (# length := l(f),
                                 seq := tofs(f`seq,l(f))
                              #)


decl_type: function
theory: fseqs
library: structures
signature: [[fseq, fseq] -> fseq]
location: 99 2 106 32
body:
    o(fs1, fs2): fseq =
       LET l1 = fs1`length, l2 = fs2`length IN
          (# length := l1+l2,
              seq := (LAMBDA (n: nat):
                        IF n < l1 THEN fs1`seq(n)
                        ELSIF n < l1+l2 THEN fs2`seq(n-l1)
                        ELSE default
                        ENDIF) #);


decl_type: function
theory: fseqs
library: structures
signature: [[fseq, [nat, nat]] -> fseq]
location: 131 2 139 13
body:
    ^(fs: fseq, p:[nat, nat]): fseq =
      LET (m, n) = p
       IN IF m > n OR m >= fs`length
          THEN empty_seq
          ELSE LET len = mmin(n - m + 1, fs`length - m) IN
               (# length := len,
                  seq := (LAMBDA (x: nat): IF x < len THEN fs`seq(x + m)
                                               ELSE default ENDIF) #)
          ENDIF


decl_type: function
theory: fseqs
library: structures
signature: [T -> fseq]
location: 159 2 160 87
body:
    fseq1(t:T): fseq = (# length := 1,
                          seq := (LAMBDA (n: nat): IF n < 1 THEN t ELSE default ENDIF) #)


decl_type: function
theory: fseqs
library: structures
signature: [[T, T] -> fseq]
location: 162 2 165 74
body:
    fseq2(u,v: T): fseq = (# length := 2,
                             seq := (LAMBDA (i: nat): IF i = 0 THEN u 
                                                      ELSIF i= 1 THEN v 
                                                      ELSE default ENDIF) #)


decl_type: function
theory: fseqs
library: structures
signature: [[nat, T] -> fseq]
location: 169 2 171 34
body:
    const_seq(n: nat,c:T): fseq = (# length := n,
                                     seq := (LAMBDA (i: nat): IF i < n THEN c ELSE default ENDIF)
                                  #)


decl_type: function
theory: fseqs
library: structures
signature: [fseq -> fseq]
location: 174 2 178 27
body:
    rev(fs:fseq): fseq = (# length := l(fs),
                             seq := (LAMBDA (i: nat): 
                                          IF i < l(fs) THEN seq(fs)(l(fs)-1-i)
                                          ELSE default ENDIF)
                           #)


decl_type: tcc
theory: fseqs
library: structures
signature: nil
location: 188 0 190 999
body:
  % Subtype TCC generated (at line 41, column 22) for  {t: T | TRUE}
      % expected type  p: (nonempty?[T])
  default_TCC1: OBLIGATION nonempty?[T]({t: T | TRUE});


decl_type: tcc
theory: fseqs
library: structures
signature: nil
location: 192 0 195 999
body:
  % Judgement subtype TCC generated (at line 57, column 28) for  empty_seq
      % expected type  fseq
  empty_seq_fseq: OBLIGATION
    FORALL (i: nat): i >= empty_seq`length IMPLIES empty_seq`seq(i) = default;


decl_type: tcc
theory: fseqs
library: structures
signature: nil
location: 197 0 200 999
body:
  % Judgement subtype TCC generated (at line 58, column 28) for  emptyseq
      % expected type  fseq
  emptyseq_fseq: OBLIGATION
    FORALL (i: nat): i >= empty_seq`length IMPLIES empty_seq`seq(i) = default;


decl_type: tcc
theory: fseqs
library: structures
signature: nil
location: 202 0 208 999
body:
  % Subtype TCC generated (at line 66, column 28) for
      % (LAMBDA (n: nat): IF n = 0 THEN x ELSE default ENDIF)
      % expected type  barray(1)
  singleton_TCC1: OBLIGATION
    FORALL (x: T):
      FORALL (i: nat):
        i >= 1 IMPLIES IF i = 0 THEN x ELSE default ENDIF = default;


decl_type: tcc
theory: fseqs
library: structures
signature: nil
location: 210 0 217 999
body:
  % Subtype TCC generated (at line 72, column 8) for
      % LAMBDA (i: nat): IF i < f`length THEN f`seq(i) ELSE default ENDIF
      % expected type  barray(f`length)
  tofseq_TCC1: OBLIGATION
    FORALL (f: fsq[T]):
      FORALL (i_1: nat):
        i_1 >= f`length IMPLIES
         IF i_1 < f`length THEN f`seq(i_1) ELSE default ENDIF = default;


decl_type: tcc
theory: fseqs
library: structures
signature: nil
location: 219 0 226 999
body:
  % Subtype TCC generated (at line 104, column 51) for  n - l1
      % expected type  nat
  oh_TCC1: OBLIGATION
    FORALL (fs1: fseq, fs2: fseq, l1: nat):
      l1 = fs1`length IMPLIES
       (FORALL (l2: nat):
          l2 = fs2`length IMPLIES
           (FORALL (n: nat): n < l1 + l2 AND NOT n < l1 IMPLIES n - l1 >= 0));


decl_type: tcc
theory: fseqs
library: structures
signature: nil
location: 228 0 246 999
body:
  % Subtype TCC generated (at line 102, column 20) for
      % (LAMBDA (n: nat):
      %    IF n < l1 THEN fs1`seq(n)
      %    ELSIF n < l1 + l2 THEN fs2`seq(n - l1)
      %    ELSE default
      %    ENDIF)
      % expected type  barray(l1 + l2)
  oh_TCC2: OBLIGATION
    FORALL (fs1: fseq, fs2: fseq, l1: nat):
      l1 = fs1`length IMPLIES
       (FORALL (l2: nat):
          l2 = fs2`length IMPLIES
           (FORALL (i: nat):
              i >= l1 + l2 IMPLIES
               IF i < l1 THEN fs1`seq(i)
               ELSIF i < l1 + l2 THEN fs2`seq(i - l1)
               ELSE default
               ENDIF
                = default));


decl_type: tcc
theory: fseqs
library: structures
signature: nil
location: 248 0 254 999
body:
  % Subtype TCC generated (at line 135, column 39) for  fs`length - m
      % expected type  nat
  caret_TCC1: OBLIGATION
    FORALL (fs: fseq, p: [nat, nat], m: nat, n: nat):
           n - m + 1 > fs`length - m AND NOT m > n AND NOT m >= fs`length
       AND n = p`2 AND m = p`1
       IMPLIES fs`length - m >= 0;


decl_type: tcc
theory: fseqs
library: structures
signature: nil
location: 256 0 262 999
body:
  % Subtype TCC generated (at line 135, column 28) for  n - m + 1
      % expected type  nat
  caret_TCC2: OBLIGATION
    FORALL (fs: fseq, p: [nat, nat], m: nat, n: nat):
           NOT n - m + 1 > fs`length - m AND NOT m > n AND NOT m >= fs`length
       AND n = p`2 AND m = p`1
       IMPLIES n - m + 1 >= 0;


decl_type: tcc
theory: fseqs
library: structures
signature: nil
location: 264 0 278 999
body:
  % Subtype TCC generated (at line 137, column 24) for
      % (LAMBDA (x: nat): IF x < len THEN fs`seq(x + m) ELSE default ENDIF)
      % expected type  barray(len)
  caret_TCC3: OBLIGATION
    FORALL (fs: fseq, p: [nat, nat], m: nat, n: nat):
      NOT m > n AND NOT m >= fs`length AND n = p`2 AND m = p`1 IMPLIES
       (FORALL (len: nat):
          len =
           IF n - m + 1 > fs`length - m THEN fs`length - m
           ELSE n - m + 1
           ENDIF
           IMPLIES
           (FORALL (i: nat):
              i >= len IMPLIES
               IF i < len THEN fs`seq(i + m) ELSE default ENDIF = default));


decl_type: tcc
theory: fseqs
library: structures
signature: nil
location: 280 0 286 999
body:
  % Subtype TCC generated (at line 160, column 32) for
      % (LAMBDA (n: nat): IF n < 1 THEN t ELSE default ENDIF)
      % expected type  barray(1)
  fseq1_TCC1: OBLIGATION
    FORALL (t: T):
      FORALL (i: nat):
        i >= 1 IMPLIES IF i < 1 THEN t ELSE default ENDIF = default;


decl_type: tcc
theory: fseqs
library: structures
signature: nil
location: 288 0 296 999
body:
  % Subtype TCC generated (at line 163, column 35) for
      % (LAMBDA (i: nat):
      %    IF i = 0 THEN u ELSIF i = 1 THEN v ELSE default ENDIF)
      % expected type  barray(2)
  fseq2_TCC1: OBLIGATION
    FORALL (u, v: T):
      FORALL (i_1: nat):
        i_1 >= 2 IMPLIES
         IF i_1 = 0 THEN u ELSIF i_1 = 1 THEN v ELSE default ENDIF = default;


decl_type: tcc
theory: fseqs
library: structures
signature: nil
location: 298 0 304 999
body:
  % Subtype TCC generated (at line 170, column 43) for
      % (LAMBDA (i: nat): IF i < n THEN c ELSE default ENDIF)
      % expected type  barray(n)
  const_seq_TCC1: OBLIGATION
    FORALL (n: nat, c: T):
      FORALL (i_1: nat):
        i_1 >= n IMPLIES IF i_1 < n THEN c ELSE default ENDIF = default;


decl_type: tcc
theory: fseqs
library: structures
signature: nil
location: 306 0 309 999
body:
  % Subtype TCC generated (at line 176, column 66) for  fs`length - 1 - i
      % expected type  nat
  rev_TCC1: OBLIGATION
    FORALL (fs: fseq, i: nat): i < fs`length IMPLIES fs`length - 1 - i >= 0;


decl_type: tcc
theory: fseqs
library: structures
signature: nil
location: 311 0 324 999
body:
  % Subtype TCC generated (at line 175, column 35) for
      % (LAMBDA (i: nat):
      %    IF i < fs`length THEN seq(fs)(fs`length - 1 - i)
      %    ELSE default
      %    ENDIF)
      % expected type  barray(fs`length)
  rev_TCC2: OBLIGATION
    FORALL (fs: fseq):
      FORALL (i_1: nat):
        i_1 >= fs`length IMPLIES
         IF i_1 < fs`length THEN seq(fs)(fs`length - 1 - i_1)
         ELSE default
         ENDIF
          = default;


decl_type: formula
theory: max_fseq
library: structures
signature: nil
location: 70 2 71 41
body:
    max_seq_def   : LEMMA FORALL (ii: dom(s)): seq(s)(ii) <= max(s) 
                          AND in?(max(s),s)


decl_type: formula
theory: max_fseq
library: structures
signature: nil
location: 73 2 74 42
body:
    max_seq_it_is : LEMMA (FORALL (ii: dom(s)): seq(s)(ii) <= x) AND in?(x,s)
                          IMPLIES max(s) = x


decl_type: formula
theory: max_fseq
library: structures
signature: nil
location: 79 2 81 46
body:
    max_seq_2     : LEMMA length(s) = 2 IMPLIES max(s) = 
                            IF seq(s)(0) <= seq(s)(1) THEN seq(s)(1)
                            ELSE seq(s)(0) ENDIF


decl_type: function
theory: max_fseq
library: structures
location: 50 2 52 69
signature:
  [d: [s: ne_fseq[T], ii: dom(s), abv(ii, s)] ->
          {i: subrange(d`2, d`3) |
                   FORALL j:
                     d`2 <= j AND j <= d`3 IMPLIES
                      seq(d`1)(j) <= seq(d`1)(i)}]

body:
    Imax(s, (ii: dom(s)),(jj: abv(ii,s))): 
         {i: subrange(ii,jj) | (FORALL j: ii <= j AND j <= jj 
                                       IMPLIES seq(s)(j) <= seq(s)(i))}


decl_type: function
theory: max_fseq
library: structures
location: 58 2 59 58
signature:
  [s: ne_fseq[T] ->
          {t: T |
                   (FORALL (ii: dom(s)): seq(s)(ii) <= t) AND
                    (EXISTS (jj: dom(s)): seq(s)(jj) = t)}]

body:
    max(s): { t: T | (FORALL (ii: dom(s)): seq(s)(ii) <= t) AND
                      (EXISTS (jj: dom(s)): seq(s)(jj) = t)} 


decl_type: tcc
theory: max_fseq
library: structures
signature: nil
location: 89 0 101 999
body:
  % Existence TCC generated (at line 50, column 2) for
      % Imax(s, (ii: dom(s)), (jj: abv(ii, s))):
      %       {i: subrange(ii, jj) |
      %                (FORALL j:
      %                   ii <= j AND j <= jj IMPLIES seq(s)(j) <= seq(s)(i))}
  Imax_TCC1: OBLIGATION
    EXISTS (x:
              [d: [s: ne_fseq[T], ii: dom(s), abv(ii, s)] ->
                 {i: subrange(d`2, d`3) |
                          FORALL j:
                            d`2 <= j AND j <= d`3 IMPLIES
                             seq(d`1)(j) <= seq(d`1)(i)}]):
      TRUE;


decl_type: tcc
theory: max_fseq
library: structures
signature: nil
location: 103 0 106 999
body:
  % Subtype TCC generated (at line 54, column 59) for  ii
      % expected type  abv(ii, s)
  Imax_1_TCC1: OBLIGATION
    FORALL (s: ne_fseq[T], ii: dom(s)): ii <= ii AND ii < length(s);


decl_type: tcc
theory: max_fseq
library: structures
signature: nil
location: 108 0 115 999
body:
  % Existence TCC generated (at line 56, column 2) for
      % imax(s): {i: dom(s) | (FORALL (ii: dom(s)): seq(s)(ii) <= seq(s)(i))}
  imax_TCC1: OBLIGATION
    EXISTS (x:
              [s: ne_fseq[T] ->
                 {i: dom(s) |
                          FORALL (ii: dom(s)): seq(s)(ii) <= seq(s)(i)}]):
      TRUE;


decl_type: tcc
theory: max_fseq
library: structures
signature: nil
location: 117 0 128 999
body:
  % Existence TCC generated (at line 58, column 2) for
      % max(s):
      %       {t: T |
      %                (FORALL (ii: dom(s)): seq(s)(ii) <= t) AND
      %                 (EXISTS (jj: dom(s)): seq(s)(jj) = t)}
  max_TCC1: OBLIGATION
    EXISTS (x:
              [s: ne_fseq[T] ->
                 {t: T |
                          (FORALL (ii: dom(s)): seq(s)(ii) <= t) AND
                           (EXISTS (jj: dom(s)): seq(s)(jj) = t)}]):
      TRUE;


decl_type: function
theory: min_array_def
library: structures
location: 35 2 37 59
signature:
  [d: [[below(N) -> T], ii: below(N), abv(ii)] ->
          {i: subrange(d`2, d`3) |
                   FORALL j:
                     d`2 <= j AND j <= d`3 IMPLIES d`1(i) <= d`1(j)}]

body:
    Imin(A,ii,(jj: abv(ii))): {i: subrange(ii,jj) |
                                   (FORALL j: ii <= j AND j <= jj 
                                       IMPLIES A(i) <= A(j))}


decl_type: tcc
theory: min_array_def
library: structures
signature: nil
location: 46 0 48 999
body:
  % Subtype TCC generated (at line 31, column 30) for  >=
      % expected type  (total_order?[T])
  IMP_max_array_def_TCC1: OBLIGATION total_order?[T](>=);


decl_type: tcc
theory: min_array_def
library: structures
signature: nil
location: 50 0 54 999
body:
  % Subtype TCC generated (at line 37, column 47) for  i
      % expected type  below(N)
  Imin_TCC1: OBLIGATION
    FORALL (ii, (jj: abv(ii)), i: subrange(ii, jj), j):
      ii <= j AND j <= jj IMPLIES i < N;


decl_type: tcc
theory: min_array_def
library: structures
signature: nil
location: 56 0 67 999
body:
  % Existence TCC generated (at line 35, column 2) for
      % Imin(A, ii, (jj: abv(ii))):
      %       {i: subrange(ii, jj) |
      %                (FORALL j: ii <= j AND j <= jj IMPLIES A(i) <= A(j))}
  Imin_TCC2: OBLIGATION
    EXISTS (x:
              [d: [[below(N) -> T], ii: below(N), abv(ii)] ->
                 {i: subrange(d`2, d`3) |
                          FORALL j:
                            d`2 <= j AND j <= d`3 IMPLIES
                             d`1(i) <= d`1(j)}]):
      TRUE;


decl_type: tcc
theory: min_array_def
library: structures
signature: nil
location: 69 0 71 999
body:
  % Subtype TCC generated (at line 39, column 26) for  ii
      % expected type  abv(ii)
  Imin_1_TCC1: OBLIGATION FORALL (ii: below(N)): ii <= ii AND ii < N;


decl_type: formula
theory: min_fseq
library: structures
signature: nil
location: 64 2 65 41
body:
    min_seq_def   : LEMMA FORALL (ii: dom(s)): min(s) <= seq(s)(ii) 
                          AND in?(min(s),s)


decl_type: formula
theory: min_fseq
library: structures
signature: nil
location: 67 2 68 42
body:
    min_seq_it_is : LEMMA (FORALL (ii: dom(s)): x <= seq(s)(ii)) AND in?(x,s)
                          IMPLIES min(s) = x


decl_type: formula
theory: min_fseq
library: structures
signature: nil
location: 76 2 78 40
body:
    min_seq_2     : LEMMA length(s) = 2 IMPLIES min(s) = 
                      IF seq(s)(0) <= seq(s)(1) THEN seq(s)(0)
                      ELSE seq(s)(1) ENDIF


decl_type: function
theory: min_fseq
library: structures
location: 46 2 48 69
signature:
  [d: [s: ne_fseq[T], ii: dom(s), abv(ii, s)] ->
          {i: subrange(d`2, d`3) |
                   FORALL j:
                     d`2 <= j AND j <= d`3 IMPLIES
                      seq(d`1)(i) <= seq(d`1)(j)}]

body:
    Imin(s, (ii: dom(s)),(jj: abv(ii,s))): 
         {i: subrange(ii,jj) | (FORALL j: ii <= j AND j <= jj 
                                       IMPLIES seq(s)(i) <= seq(s)(j))}


decl_type: function
theory: min_fseq
library: structures
location: 54 2 55 58
signature:
  [s: ne_fseq[T] ->
          {t: T |
                   (FORALL (ii: dom(s)): t <= seq(s)(ii)) AND
                    (EXISTS (jj: dom(s)): seq(s)(jj) = t)}]

body:
    min(s): { t: T | (FORALL (ii: dom(s)): t <= seq(s)(ii)) AND
                      (EXISTS (jj: dom(s)): seq(s)(jj) = t)} 


decl_type: tcc
theory: min_fseq
library: structures
signature: nil
location: 86 0 98 999
body:
  % Existence TCC generated (at line 46, column 2) for
      % Imin(s, (ii: dom(s)), (jj: abv(ii, s))):
      %       {i: subrange(ii, jj) |
      %                (FORALL j:
      %                   ii <= j AND j <= jj IMPLIES seq(s)(i) <= seq(s)(j))}
  Imin_TCC1: OBLIGATION
    EXISTS (x:
              [d: [s: ne_fseq[T], ii: dom(s), abv(ii, s)] ->
                 {i: subrange(d`2, d`3) |
                          FORALL j:
                            d`2 <= j AND j <= d`3 IMPLIES
                             seq(d`1)(i) <= seq(d`1)(j)}]):
      TRUE;


decl_type: tcc
theory: min_fseq
library: structures
signature: nil
location: 100 0 103 999
body:
  % Subtype TCC generated (at line 50, column 63) for  ii
      % expected type  abv(ii, s)
  Imin_seq_1_TCC1: OBLIGATION
    FORALL (s: ne_fseq[T], ii: dom(s)): ii <= ii AND ii < length(s);


decl_type: tcc
theory: min_fseq
library: structures
signature: nil
location: 105 0 112 999
body:
  % Existence TCC generated (at line 52, column 2) for
      % imin(s): {i: dom(s) | (FORALL (ii: dom(s)): seq(s)(i) <= seq(s)(ii))}
  imin_TCC1: OBLIGATION
    EXISTS (x:
              [s: ne_fseq[T] ->
                 {i: dom(s) |
                          FORALL (ii: dom(s)): seq(s)(i) <= seq(s)(ii)}]):
      TRUE;


decl_type: tcc
theory: min_fseq
library: structures
signature: nil
location: 114 0 125 999
body:
  % Existence TCC generated (at line 54, column 2) for
      % min(s):
      %       {t: T |
      %                (FORALL (ii: dom(s)): t <= seq(s)(ii)) AND
      %                 (EXISTS (jj: dom(s)): seq(s)(jj) = t)}
  min_TCC1: OBLIGATION
    EXISTS (x:
              [s: ne_fseq[T] ->
                 {t: T |
                          (FORALL (ii: dom(s)): t <= seq(s)(ii)) AND
                           (EXISTS (jj: dom(s)): seq(s)(jj) = t)}]):
      TRUE;


decl_type: formula
theory: permutations_fseq
library: structures
signature: nil
location: 37 2 38 55
body:
    perm_tran     : LEMMA permutation?(A1,A2) AND permutation?(A2,A3) 
                              IMPLIES permutation?(A1,A3)


decl_type: formula
theory: permutations_fseq
library: structures
signature: nil
location: 40 2 41 52
body:
    perm_in?      : LEMMA permutation?(A1,A2) IMPLIES 
                               (in?(x,A1) = in?(x,A2))


decl_type: function
theory: permutations_fseq
library: structures
signature: [[fsq[T], fsq[T]] -> bool]
location: 25 2 27 81
body:
    permutation?(A,B): bool = (EXISTS (f: [below(length(A)) -> below(length(B))]): 
                       bijective?(f) AND 
                       (FORALL (ii: below(length(A))): seq(A)(ii) = seq(B)(f(ii))))


decl_type: formula
theory: permutations
library: structures
signature: nil
location: 24 2 25 58
body:
    perm_tran     : LEMMA permutation_of?(A1,A2) AND permutation_of?(A2,A3) 
                              IMPLIES permutation_of?(A1,A3)


decl_type: formula
theory: permutations
library: structures
signature: nil
location: 27 2 28 52
body:
    perm_in?      : LEMMA permutation_of?(A1,A2) IMPLIES 
                               (in?(x,A1) = in?(x,A2))


decl_type: function
theory: permutations
library: structures
signature: [[[below(N) -> T], [below(N) -> T]] -> bool]
location: 17 2 18 72
body:
    permutation_of?(A1,A2): bool = (EXISTS (f: [below(N) -> below(N)]): 
                        bijective?(f) AND (FORALL ii: A1(ii) = A2(f(ii))))


decl_type: formula
theory: sort_array_def
library: structures
signature: nil
location: 41 2 42 74
body:
    swap_P_and_Q : LEMMA P(A,j) AND Q(A,j) AND j < N-1 
                           IMPLIES P(swap(A,j+1),j+1) AND Q(swap(A,j+1),j+1)


decl_type: function
theory: sort_array_def
library: structures
signature: [[below_array[N, T], below[N]] -> bool]
location: 23 2 24 36
body:
    P(A,jj): bool = (FORALL i,j: 0 <= i AND i < j AND j <= jj IMPLIES
                         A(i) <= A(j))


decl_type: function
theory: sort_array_def
library: structures
signature: [[below_array[N, T], below[N]] -> bool]
location: 26 2 27 44
body:
    Q(A,jj): bool = (FORALL i,j: 0 <= i AND i <= jj AND jj < j AND j < N
                         IMPLIES A(i) <= A(j))


decl_type: function
theory: sort_array_def
library: structures
signature: [[below_array[N, T], below[N]] -> below_array[N, T]]
location: 29 2 30 49
body:
    swap(A,jj): below_array =  A WITH [jj := A(Imin(A,jj,N-1)),
                         (Imin(A,jj,N-1)) := A(jj)]


decl_type: function
theory: sort_array_def
library: structures
signature: [[below_array[N, T], below[N]] -> below_array[N, T]]
location: 32 2 35 34
body:
    asort(A,jj): RECURSIVE below_array = 
                     (IF jj = 0 THEN swap(A,jj)
                      ELSE swap(asort(A,jj-1),jj) ENDIF)
                          MEASURE jj


decl_type: tcc
theory: sort_array_def
library: structures
signature: nil
location: 52 0 56 999
body:
  % Subtype TCC generated (at line 29, column 55) for  N - 1
      % expected type  abv[N, T, <=](jj)
  swap_TCC1: OBLIGATION
    FORALL (A: below_array[N, T], jj: below[N]):
      N - 1 >= 0 AND jj <= N - 1 AND N - 1 < N;


decl_type: tcc
theory: sort_array_def
library: structures
signature: nil
location: 58 0 62 999
body:
  % Subtype TCC generated (at line 29, column 45) for  Imin(A, jj, N - 1)
      % expected type  below(N)
  swap_TCC2: OBLIGATION
    FORALL (A: below_array[N, T], jj: below[N]):
      Imin[N, T, <=](A, jj, N - 1) >= 0 AND Imin[N, T, <=](A, jj, N - 1) < N;


decl_type: tcc
theory: sort_array_def
library: structures
signature: nil
location: 64 0 67 999
body:
  % Subtype TCC generated (at line 34, column 38) for  jj - 1
      % expected type  below[N]
  asort_TCC1: OBLIGATION
    FORALL (jj: below[N]): NOT jj = 0 IMPLIES jj - 1 >= 0 AND jj - 1 < N;


decl_type: tcc
theory: sort_array_def
library: structures
signature: nil
location: 69 0 71 999
body:
  % Termination TCC generated (at line 34, column 30) for  asort(A, jj - 1)
  asort_TCC2: OBLIGATION
    FORALL (jj: below[N]): NOT jj = 0 IMPLIES jj - 1 < jj;


decl_type: tcc
theory: sort_array_def
library: structures
signature: nil
location: 73 0 77 999
body:
  % Subtype TCC generated (at line 42, column 42) for  j + 1
      % expected type  below[N]
  swap_P_and_Q_TCC1: OBLIGATION
    FORALL (A: below_array[N, T], j: below[N]):
      j < N - 1 AND Q(A, j) AND P(A, j) IMPLIES j + 1 < N;


decl_type: function
theory: sort_array
library: structures
signature: [[below(N) -> T] -> bool]
location: 45 2 46 41
body:
    sorted?(A): bool = (FORALL i,j: 0 <= i AND i < j AND j < N IMPLIES
                              A(i) <= A(j))


decl_type: function
theory: sort_array
library: structures
location: 56 2 57 55
signature:
  [A: [below(N) -> T] ->
          {map: [below(N) -> below(N)] |
                   bijective?(map) AND
                    (FORALL i: A(i) = sort(A)(map(i)))}]

body:
    sort_map(A): { map: [below(N) -> below(N)] | bijective?(map) AND
                      (FORALL i: A(i) = sort(A)(map(i)))}


decl_type: function
theory: sort_array
library: structures
location: 64 2 65 55
signature:
  [A: [below(N) -> T] ->
          {map: [below(N) -> below(N)] |
                   bijective?(map) AND
                    (FORALL i: A(map(i)) = sort(A)(i))}]

body:
    isort_map(A): { map: [below(N) -> below(N)] | bijective?(map) AND
                      (FORALL i: A(map(i)) = sort(A)(i))}


decl_type: tcc
theory: sort_array
library: structures
signature: nil
location: 78 0 84 999
body:
  % Existence TCC generated (at line 48, column 2) for
      % sort(A): {a | permutation_of?(A, a) AND sorted?(a)}
  sort_TCC1: OBLIGATION
    EXISTS (x:
              [A: [below(N) -> T] ->
                 {a | permutation_of?[N, T](A, a) AND sorted?(a)}]):
      TRUE;


decl_type: tcc
theory: sort_array
library: structures
signature: nil
location: 86 0 96 999
body:
  % Existence TCC generated (at line 56, column 2) for
      % sort_map(A):
      %       {map: [below(N) -> below(N)] |
      %                bijective?(map) AND (FORALL i: A(i) = sort(A)(map(i)))}
  sort_map_TCC1: OBLIGATION
    EXISTS (x:
              [A: [below(N) -> T] ->
                 {map: [below(N) -> below(N)] |
                          bijective?[below(N), below(N)](map) AND
                           (FORALL i: A(i) = sort(A)(map(i)))}]):
      TRUE;


decl_type: tcc
theory: sort_array
library: structures
signature: nil
location: 98 0 108 999
body:
  % Existence TCC generated (at line 64, column 2) for
      % isort_map(A):
      %       {map: [below(N) -> below(N)] |
      %                bijective?(map) AND (FORALL i: A(map(i)) = sort(A)(i))}
  isort_map_TCC1: OBLIGATION
    EXISTS (x:
              [A: [below(N) -> T] ->
                 {map: [below(N) -> below(N)] |
                          bijective?[below(N), below(N)](map) AND
                           (FORALL i: A(map(i)) = sort(A)(i))}]):
      TRUE;


decl_type: formula
theory: sort_fseq
library: structures
signature: nil
location: 66 2 67 60
body:
    sort_fseq_in   : LEMMA FORALL (ii: below(length(s))): 
                                       in?(seq(sort(s))(ii),s)


decl_type: formula
theory: sort_fseq
library: structures
signature: nil
location: 71 2 72 92
body:
    sort_fseq_lt   : LEMMA FORALL (i,j: below(length(s))): 
                           sort(s)(i) <= sort(s)(j) AND sort(s)(i) /= sort(s)(j) IMPLIES i < j


decl_type: formula
theory: sort_fseq
library: structures
signature: nil
location: 85 2 86 92
body:
    strictly_sort_subint_eq: LEMMA LET sss = strictly_sort(s) IN increasing?(s) IMPLIES FORALL (ii:below(sss`length-1)):
                             EXISTS (jj:below(s`length-1)): sss`seq(ii+1)=s`seq(jj+1) AND sss`seq(ii) = s`seq(jj)


decl_type: formula
theory: sort_fseq
library: structures
signature: nil
location: 94 2 97 52
body:
    strictly_sort_map_between: LEMMA LET sss = strictly_sort(s) IN
                                     FORALL (ii:below(sss`length-1)): FORALL (jj:below(s`length)):
                                     increasing?(s) AND strictly_sort_map(s)(ii)<jj AND jj<=strictly_sort_map(s)(ii+1) IMPLIES
                                     s`seq(strictly_sort_map(s)(ii+1)) = s`seq(jj)


decl_type: formula
theory: sort_fseq
library: structures
signature: nil
location: 99 2 100 66
body:
    strictly_sort_map_increasing: LEMMA increasing?(s) IMPLIES FORALL (ii,jj:below(strictly_sort(s)`length)):
                                  LET sq = strictly_sort_map(s) IN ii<jj IMPLIES sq(ii)<sq(jj)


decl_type: formula
theory: sort_fseq
library: structures
signature: nil
location: 109 2 110 68
body:
    sort_map_def: LEMMA FORALL (i: below(length(s))):
                              seq(s)(i) = seq(sort(s))(sort_map(s)(i))


decl_type: formula
theory: sort_fseq
library: structures
signature: nil
location: 122 2 123 70
body:
    isort_map_def: LEMMA FORALL (i: below(length(s))):
                               seq(s)(isort_map(s)(i)) = seq(sort(s))(i)


decl_type: formula
theory: sort_fseq
library: structures
signature: nil
location: 125 2 126 52
body:
    isort_map_bij: LEMMA FORALL (s: {ss: fseq  | length(ss) > 0}):
                              bijective?(isort_map(s))


decl_type: function
theory: sort_fseq
library: structures
signature: [s: fseq[T] -> below_array[length(s), T]]
location: 47 2 48 54
body:
    seq_to_array(s): below_array[length(s),T] =
               (LAMBDA (i: below(length(s))): seq(s)(i))


decl_type: function
theory: sort_fseq
library: structures
signature: [fseq[T] -> bool]
location: 50 2 51 59
body:
    increasing?(s): bool = (FORALL i,j: 0 <= i AND i < j AND j < length(s)
                              IMPLIES seq(s)(i) <= seq(s)(j))


decl_type: function
theory: sort_fseq
library: structures
signature: [fseq[T] -> bool]
location: 53 2 54 88
body:
    strictly_increasing?(s): bool = (FORALL i,j: 0 <= i AND i < j AND j < length(s)
                              IMPLIES (seq(s)(i) <= seq(s)(j) AND seq(s)(i) /= seq(s)(j)))


decl_type: function
theory: sort_fseq
library: structures
location: 81 2 81 106
signature:
  [s: fseq[T] ->
          {ss: fseq |
                   strictly_increasing?(ss) AND
                    (FORALL (x: T): member(x, s) IFF member(x, ss))}]

body:
    strictly_sort(s): {ss: fseq | strictly_increasing?(ss) AND (FORALL (x:T): member(x,s) IFF member(x,ss))}


decl_type: function
theory: sort_fseq
library: structures
location: 88 2 92 87
signature:
  [s: fseq[T] ->
          {sq: [below(strictly_sort(s)`length) -> below(s`length)] |
                   (increasing?(s) AND strictly_sort(s)`length >= 1
                     IMPLIES
                     sq(strictly_sort(s)`length - 1) = s`length - 1)
                    AND
                    (FORALL (ii: below(strictly_sort(s)`length)):
                       (strictly_sort(s)`seq(ii) = s`seq(sq(ii)) AND
                         (increasing?(s) AND
                           ii < strictly_sort(s)`length - 1
                           IMPLIES
                           strictly_sort(s)`seq(1 + ii) =
                            s`seq(1 + sq(ii)))))}]

body:
    strictly_sort_map(s): {sq: [below(strictly_sort(s)`length)->below(s`length)] |
                               LET sss = strictly_sort(s) IN
                               (increasing?(s) AND sss`length >= 1 IMPLIES sq(sss`length-1) = s`length-1) AND
                               (FORALL (ii:below(sss`length)): (sss`seq(ii) = s`seq(sq(ii)) AND
                               (increasing?(s) AND ii<sss`length-1 IMPLIES sss`seq(ii+1) = s`seq(sq(ii)+1))))}


decl_type: function
theory: sort_fseq
library: structures
location: 105 2 107 79
signature:
  [s: fseq[T] ->
          {map: [below(length(s)) -> below(length(s))] |
                   bijective?(map) AND
                    (FORALL (i: below(length(s))):
                       seq(s)(i) = seq(sort(s))(map(i)))}]

body:
    sort_map(s): { map: [below(length(s)) -> below(length(s))] | 
              bijective?(map) AND
                (FORALL (i: below(length(s))): seq(s)(i) = seq(sort(s))(map(i)))}


decl_type: function
theory: sort_fseq
library: structures
location: 117 2 120 79
signature:
  [s: {ss: fseq | length(ss) > 0} ->
          {map: [below(length(s)) -> below(length(s))] |
                   bijective?(map) AND
                    (FORALL (i: below(length(s))):
                       seq(s)(map(i)) = seq(sort(s))(i))}]

body:
    isort_map(s: {ss: fseq | length(ss) > 0}):
         { map: [below(length(s)) -> below(length(s))] | 
               bijective?(map) AND
                 (FORALL (i:below(length(s))): seq(s)(map(i)) = seq(sort(s))(i))}


decl_type: tcc
theory: sort_fseq
library: structures
signature: nil
location: 137 0 144 999
body:
  % Existence TCC generated (at line 56, column 2) for
      % sort(s): {ss: fseq | permutation?[T, <=](s, ss) AND increasing?(ss)}
  sort_TCC1: OBLIGATION
    EXISTS (x:
              [s: fseq[T] ->
                 {ss: fseq[T] |
                          permutation?[T, <=](s, ss) AND increasing?(ss)}]):
      TRUE;


decl_type: tcc
theory: sort_fseq
library: structures
signature: nil
location: 146 0 158 999
body:
  % Existence TCC generated (at line 81, column 2) for
      % strictly_sort(s):
      %       {ss: fseq |
      %                strictly_increasing?(ss) AND
      %                 (FORALL (x: T): member(x, s) IFF member(x, ss))}
  strictly_sort_TCC1: OBLIGATION
    EXISTS (x1:
              [s: fseq[T] ->
                 {ss: fseq[T] |
                          strictly_increasing?(ss) AND
                           (FORALL (x: T):
                              member[T](x, s) IFF member[T](x, ss))}]):
      TRUE;


decl_type: tcc
theory: sort_fseq
library: structures
signature: nil
location: 160 0 170 999
body:
  % Subtype TCC generated (at line 90, column 55) for  sss`length - 1
      % expected type  below(strictly_sort(s)`length)
  strictly_sort_map_TCC1: OBLIGATION
    FORALL (s, sq: [below(strictly_sort(s)`length) -> below(s`length)],
            sss:
              {ss: fseq[T] |
                       strictly_increasing?(ss) AND
                        (FORALL (x: T):
                           member[T](x, s) IFF member[T](x, ss))}):
      increasing?(s) AND sss`length >= 1 AND sss = strictly_sort(s) IMPLIES
       sss`length - 1 >= 0 AND sss`length - 1 < strictly_sort(s)`length;


decl_type: tcc
theory: sort_fseq
library: structures
signature: nil
location: 172 0 184 999
body:
  % Subtype TCC generated (at line 91, column 64) for  ii
      % expected type  below(strictly_sort(s)`length)
  strictly_sort_map_TCC2: OBLIGATION
    FORALL (s, sq: [below(strictly_sort(s)`length) -> below(s`length)],
            sss:
              {ss: fseq[T] |
                       strictly_increasing?(ss) AND
                        (FORALL (x: T):
                           member[T](x, s) IFF member[T](x, ss))}):
      (increasing?(s) AND sss`length >= 1 IMPLIES
        sq(sss`length - 1) = s`length - 1)
       AND sss = strictly_sort(s)
       IMPLIES (FORALL (ii: below(sss`length)): ii < strictly_sort(s)`length);


decl_type: tcc
theory: sort_fseq
library: structures
signature: nil
location: 186 0 213 999
body:
  % Existence TCC generated (at line 88, column 2) for
      % strictly_sort_map(s):
      %       {sq: [below(strictly_sort(s)`length) -> below(s`length)] |
      %                LET sss = strictly_sort(s) IN
      %                  (increasing?(s) AND sss`length >= 1 IMPLIES
      %                    sq(sss`length - 1) = s`length - 1)
      %                   AND
      %                   (FORALL (ii: below(sss`length)):
      %                      (sss`seq(ii) = s`seq(sq(ii)) AND
      %                        (increasing?(s) AND ii < sss`length - 1
      %                          IMPLIES
      %                          sss`seq(ii + 1) = s`seq(sq(ii) + 1))))}
  strictly_sort_map_TCC3: OBLIGATION
    EXISTS (x:
              [s: fseq[T] ->
                 {sq: [below(strictly_sort(s)`length) -> below(s`length)] |
                          (increasing?(s) AND strictly_sort(s)`length >= 1
                            IMPLIES
                            sq(strictly_sort(s)`length - 1) = s`length - 1)
                           AND
                           (FORALL (ii: below(strictly_sort(s)`length)):
                              (strictly_sort(s)`seq(ii) = s`seq(sq(ii)) AND
                                (increasing?(s) AND
                                  ii < strictly_sort(s)`length - 1
                                  IMPLIES
                                  strictly_sort(s)`seq(1 + ii) =
                                   s`seq(1 + sq(ii)))))}]):
      TRUE;


decl_type: tcc
theory: sort_fseq
library: structures
signature: nil
location: 215 0 226 999
body:
  % Subtype TCC generated (at line 96, column 47) for  ii
      % expected type  below(strictly_sort(s)`length)
  strictly_sort_map_between_TCC1: OBLIGATION
    FORALL (s: fseq[T],
            sss:
              {ss: fseq[T] |
                       strictly_increasing?(ss) AND
                        (FORALL (x: T):
                           member[T](x, s) IFF member[T](x, ss))}):
      sss = strictly_sort(s) IMPLIES
       (FORALL (ii: below(sss`length - 1), jj: below(s`length)):
          increasing?(s) IMPLIES ii < strictly_sort(s)`length);


decl_type: tcc
theory: sort_fseq
library: structures
signature: nil
location: 228 0 240 999
body:
  % Subtype TCC generated (at line 96, column 83) for  ii + 1
      % expected type  below(strictly_sort(s)`length)
  strictly_sort_map_between_TCC2: OBLIGATION
    FORALL (s: fseq[T],
            sss:
              {ss: fseq[T] |
                       strictly_increasing?(ss) AND
                        (FORALL (x: T):
                           member[T](x, s) IFF member[T](x, ss))}):
      sss = strictly_sort(s) IMPLIES
       (FORALL (ii: below(sss`length - 1), jj: below(s`length)):
          strictly_sort_map(s)(ii) < jj AND increasing?(s) IMPLIES
           ii + 1 < strictly_sort(s)`length);


decl_type: tcc
theory: sort_fseq
library: structures
signature: nil
location: 242 0 256 999
body:
  % Existence TCC generated (at line 105, column 2) for
      % sort_map(s):
      %       {map: [below(length(s)) -> below(length(s))] |
      %                bijective?(map) AND
      %                 (FORALL (i: below(length(s))):
      %                    seq(s)(i) = seq(sort(s))(map(i)))}
  sort_map_TCC1: OBLIGATION
    EXISTS (x:
              [s: fseq[T] ->
                 {map: [below(length(s)) -> below(length(s))] |
                          bijective?[below(length(s)), below(length(s))](map)
                           AND
                           (FORALL (i: below(length(s))):
                              seq(s)(i) = seq(sort(s))(map(i)))}]):
      TRUE;


decl_type: tcc
theory: sort_fseq
library: structures
signature: nil
location: 258 0 272 999
body:
  % Existence TCC generated (at line 117, column 2) for
      % isort_map(s: {ss: fseq | length(ss) > 0}):
      %       {map: [below(length(s)) -> below(length(s))] |
      %                bijective?(map) AND
      %                 (FORALL (i: below(length(s))):
      %                    seq(s)(map(i)) = seq(sort(s))(i))}
  isort_map_TCC1: OBLIGATION
    EXISTS (x:
              [s: {ss: fseq[T] | length(ss) > 0} ->
                 {map: [below(length(s)) -> below(length(s))] |
                          bijective?[below(length(s)), below(length(s))](map)
                           AND
                           (FORALL (i: below(length(s))):
                              seq(s)(map(i)) = seq(sort(s))(i))}]):
      TRUE;


decl_type: tcc
theory: sort_fseq
library: structures
signature: nil
location: 274 0 277 999
body:
  % Subtype TCC generated (at line 123, column 46) for  s
      % expected type  s: {ss: fseq | length(ss) > 0}
  isort_map_def_TCC1: OBLIGATION
    FORALL (s: fseq[T], i: below(length(s))): length(s) > 0;


decl_type: tcc
theory: sort_fseq_lems
library: structures
signature: nil
location: 21 0 23 999
body:
  % Subtype TCC generated (at line 13, column 36) for  length(s) - 1
      % expected type  nat
  sort_seq_max_TCC1: OBLIGATION FORALL (s: ne_fseq[T]): length(s) - 1 >= 0;


decl_type: formula
theory: fseq2set
library: structures
signature: nil
location: 28 3 29 63
body:
     minmax_seq2set: LEMMA min[T,<=](seq2set(ne_fs)) = min(ne_fs) AND
                           max[T,<=](seq2set(ne_fs)) = max(ne_fs)


decl_type: formula
theory: fseq2set
library: structures
signature: nil
location: 53 3 54 71
body:
     set2seq_lem: LEMMA LET fs = set2seq(S) IN
                            FORALL (ii: below(length(fs))): S(fs`seq(ii))


decl_type: formula
theory: fseq2set
library: structures
signature: nil
location: 56 3 58 74
body:
     set2seq_exists: LEMMA LET fs = set2seq(S) IN
                          S(x) IMPLIES
                              EXISTS (ii: below(length(fs))): fs`seq(ii) = x


decl_type: formula
theory: fseq2set
library: structures
signature: nil
location: 62 3 64 58
body:
     minmax_set2seq: LEMMA card(S) > 0 IMPLIES
                             min(set2seq(S)) =  min[T,<=](S) AND
                             max(set2seq(S)) =  max[T,<=](S)


decl_type: formula
theory: fseq2set
library: structures
signature: nil
location: 66 3 68 72
body:
     set2seq_neq   : LEMMA LET fs = set2seq(S) IN
                       FORALL (ii,jj: below(length(fs))): 
                                 ii /= jj IMPLIES fs`seq(ii) /= fs`seq(jj)


decl_type: formula
theory: fseq2set
library: structures
signature: nil
location: 70 3 75 37
body:
     set2seq_all   : LEMMA LET fs = sort(set2seq(S)) IN
                            FORALL (ii: below(length(fs)-1)): 
                               fs`seq(ii) <= x AND x <= fs`seq(ii+1)  AND
                               fs`seq(ii) /= x AND x /= fs`seq(ii+1) 
                           IMPLIES
                               NOT S(x)


decl_type: function
theory: fseq2set
library: structures
signature: [fseq[T] -> finite_set[T]]
location: 20 3 21 62
body:
     seq2set(fs): finite_set[T] 
            = {s: T | (EXISTS (kk: below(length(fs))): fs`seq(kk) = s)}


decl_type: function
theory: fseq2set
library: structures
location: 41 2 46 75
signature:
  [S: finite_set[T] ->
          {fs: fseq |
                   length(fs) = card(S) AND
                    (FORALL (ii: below(length(fs))): S(fs`seq(ii))) AND
                     (FORALL (x: T):
                        S(x) IMPLIES
                         (EXISTS (ii: below(length(fs))):
                            fs`seq(ii) = x))
                      AND
                      (FORALL (ii, jj: below(length(fs))):
                         ii /= jj IMPLIES fs`seq(ii) /= fs`seq(jj))}]

body:
    set2seq(S: finite_set[T]):  {fs: fseq |
         length(fs) = card(S) AND    
         (FORALL (ii: below(length(fs))): S(fs`seq(ii))) AND
         (FORALL (x:T): S(x) IMPLIES EXISTS (ii: below(length(fs))): fs`seq(ii) = x) AND
         (FORALL (ii,jj: below(length(fs))): 
                                 ii /= jj IMPLIES fs`seq(ii) /= fs`seq(jj)) }


decl_type: tcc
theory: fseq2set
library: structures
signature: nil
location: 83 0 88 999
body:
  % Subtype TCC generated (at line 21, column 5) for
      % {s: T | (EXISTS (kk: below(length(fs))): fs`seq(kk) = s)}
      % expected type  finite_set[T]
  seq2set_TCC1: OBLIGATION
    FORALL (fs: fseq[T]):
      is_finite[T]({s: T | EXISTS (kk: below(length(fs))): fs`seq(kk) = s});


decl_type: tcc
theory: fseq2set
library: structures
signature: nil
location: 90 0 93 999
body:
  % Subtype TCC generated (at line 28, column 35) for  seq2set(ne_fs)
      % expected type  SS: non_empty_finite_set[T]
  minmax_seq2set_TCC1: OBLIGATION
    FORALL (ne_fs: ne_fseq[T]): NOT empty?[T](seq2set(ne_fs));


decl_type: tcc
theory: fseq2set
library: structures
signature: nil
location: 95 0 97 999
body:
  % Judgement subtype TCC generated (at line 32, column 13) for  seq2set(ss)
      % expected type  (nonempty?[T])
  seq2set_TCC2: OBLIGATION FORALL (ss): nonempty?[T](seq2set(ss));


decl_type: tcc
theory: fseq2set
library: structures
signature: nil
location: 99 0 126 999
body:
  % Existence TCC generated (at line 41, column 2) for
      % set2seq(S: finite_set[T]):
      %       {fs: fseq |
      %                length(fs) = card(S) AND
      %                 (FORALL (ii: below(length(fs))): S(fs`seq(ii))) AND
      %                  (FORALL (x: T):
      %                     S(x) IMPLIES
      %                      (EXISTS (ii: below(length(fs))):
      %                         fs`seq(ii) = x))
      %                   AND
      %                   (FORALL (ii, jj: below(length(fs))):
      %                      ii /= jj IMPLIES fs`seq(ii) /= fs`seq(jj))}
  set2seq_TCC1: OBLIGATION
    EXISTS (x1:
              [S: finite_set[T] ->
                 {fs: fseq[T] |
                          length(fs) = card[T](S) AND
                           (FORALL (ii: below(length(fs))): S(fs`seq(ii)))
                            AND
                            (FORALL (x: T):
                               S(x) IMPLIES
                                (EXISTS (ii: below(length(fs))):
                                   fs`seq(ii) = x))
                             AND
                             (FORALL (ii, jj: below(length(fs))):
                                ii /= jj IMPLIES
                                 fs`seq(ii) /= fs`seq(jj))}]):
      TRUE;


decl_type: tcc
theory: fseq2set
library: structures
signature: nil
location: 128 0 131 999
body:
  % Subtype TCC generated (at line 63, column 31) for  set2seq(S)
      % expected type  s: ne_fseq[T]
  minmax_set2seq_TCC1: OBLIGATION
    FORALL (S: finite_set[T]): card(S) > 0 IMPLIES length(set2seq(S)) > 0;


decl_type: tcc
theory: fseq2set
library: structures
signature: nil
location: 133 0 136 999
body:
  % Subtype TCC generated (at line 63, column 56) for  S
      % expected type  SS: non_empty_finite_set[T]
  minmax_set2seq_TCC2: OBLIGATION
    FORALL (S: finite_set[T]): card(S) > 0 IMPLIES NOT empty?[T](S);


decl_type: formula
theory: majority_fseq
library: structures
signature: nil
location: 56 2 57 45
body:
    is_majority_unique: LEMMA is_majority(mv1,fs) AND is_majority(mv2,fs)
                              IMPLIES mv1 = mv2


decl_type: formula
theory: majority_fseq
library: structures
signature: nil
location: 59 2 60 59
body:
    maj_lem:            LEMMA is_majority(mv,fs) IFF 
                              maj_exists(fs) AND maj(fs) = mv


decl_type: formula
theory: majority_fseq
library: structures
signature: nil
location: 62 2 66 54
body:
    maj_subset:         LEMMA   (EXISTS (A: finite_set[below(length(fs))]):
                                 2*card(A) > length(fs)
                                 AND (FORALL (i: below(length(fs))): A(i) 
                                                IMPLIES seq(fs)(i) = mv))
                              IMPLIES is_majority(mv,fs)


decl_type: formula
theory: majority_fseq
library: structures
signature: nil
location: 85 2 86 53
body:
    maj_const:         LEMMA maj_exists(constant_seq(n,c)) AND
                             maj(constant_seq(n,c)) = c


decl_type: function
theory: majority_fseq
library: structures
signature: [[T, fsq[T]] -> bool]
location: 47 2 48 68
body:
    is_majority(mv: T, fs): bool = 
         2*card({i: below(length(fs)) | seq(fs)(i) = mv}) > length(fs) 


decl_type: function
theory: majority_fseq
library: structures
signature: [[posnat, T] -> fsq[T]]
location: 80 2 81 64
body:
    constant_seq(n,c): fsq[T] = (# length := n,
                                    seq := (LAMBDA (i: nat): c) #)


decl_type: tcc
theory: majority_fseq
library: structures
signature: nil
location: 93 0 98 999
body:
  % Subtype TCC generated (at line 48, column 14) for
      % {i: below(length(fs)) | seq(fs)(i) = mv}
      % expected type  S: finite_set[below(length(fs))]
  is_majority_TCC1: OBLIGATION
    FORALL (mv: T, fs: fsq[T]):
      is_finite[below(length(fs))]({i: below(length(fs)) | seq(fs)(i) = mv});


decl_type: tcc
theory: majority_fseq
library: structures
signature: nil
location: 100 0 104 999
body:
  % Existence TCC generated (at line 52, column 2) for
      % maj(fs): {mv | maj_exists(fs) => is_majority(mv, fs)}
  maj_TCC1: OBLIGATION
    EXISTS (x: [fs: fsq[T] -> {mv | maj_exists(fs) => is_majority(mv, fs)}]):
      TRUE;


decl_type: formula
theory: fseqs_ops
library: structures
signature: nil
location: 53 2 54 72
body:
    insert_delete: LEMMA n < l(nefs) IMPLIES
                            insert(nefs`seq(n), n, delete(n, nefs)) = nefs


decl_type: function
theory: fseqs_ops
library: structures
signature: [[nat, ne_fseq[T]] -> fseq[T]]
location: 22 2 28 34
body:
    delete(n, nefs): fseq = IF n < l(nefs) THEN
                                   (# length := l(nefs) - 1,
                                      seq := (LAMBDA i: (IF i < n THEN nefs(i) 
                                                      ELSE nefs(i + 1) ENDIF))
                                    #)
                               ELSE nefs
                               ENDIF


decl_type: function
theory: fseqs_ops
library: structures
signature: [[T, nat, fseq[T]] -> fseq[T]]
location: 31 2 39 35
body:
    insert(x, n, fs): fseq = IF n <= l(fs) THEN 
                                  (# length := l(fs) + 1,
                                     seq := (LAMBDA i: IF i < n THEN fs(i)
                                                      ELSIF i = n THEN x
                                                      ELSE fs(i - 1) ENDIF)
                                   #)
                                ELSE
                                   fs
                                ENDIF


decl_type: function
theory: fseqs_ops
library: structures
signature: [[T, fseq[T]] -> fseq[T]]
location: 44 2 49 38
body:
    addend(x:T,fs:fseq): fseq = (# length := l(fs) + 1,
                                       seq := (LAMBDA (ii: nat):
                                         IF ii < l(fs) THEN seq(fs)(ii) 
                                         ELSIF ii < l(fs) + 1 THEN  x 
                                         ELSE default ENDIF)
                                      #)


decl_type: function
theory: fseqs_ops
library: structures
signature: [[[T -> T], fseq[T]] -> fseq[T]]
location: 76 2 82 28
body:
    map(F,fs): fseq = (# length := length(fs),
                              seq := (LAMBDA i: IF i < length(fs) THEN
                                                   F(fs`seq(i))
                                                ELSE
                                                   default
                                                ENDIF)
                            #)


decl_type: tcc
theory: fseqs_ops
library: structures
signature: nil
location: 89 0 93 999
body:
  % Subtype TCC generated (at line 23, column 46) for  nefs`length - 1
      % expected type  nat
  delete_TCC1: OBLIGATION
    FORALL (n: nat, nefs: ne_fseq[T]):
      n < nefs`length IMPLIES nefs`length - 1 >= 0;


decl_type: tcc
theory: fseqs_ops
library: structures
signature: nil
location: 95 0 104 999
body:
  % Subtype TCC generated (at line 24, column 44) for
      % (LAMBDA i: (IF i < n THEN nefs`seq(i) ELSE nefs`seq(i + 1) ENDIF))
      % expected type  barray[T](nefs`length - 1)
  delete_TCC2: OBLIGATION
    FORALL (n: nat, nefs: ne_fseq[T]):
      n < nefs`length IMPLIES
       (FORALL (i_1: nat):
          i_1 >= nefs`length - 1 IMPLIES
           (IF i_1 < n THEN nefs`seq(i_1) ELSE nefs`seq(i_1 + 1) ENDIF) =
            default[T]);


decl_type: tcc
theory: fseqs_ops
library: structures
signature: nil
location: 106 0 111 999
body:
  % Subtype TCC generated (at line 35, column 43) for  i - 1
      % expected type  nat
  insert_TCC1: OBLIGATION
    FORALL (n: nat, fs: fseq[T]):
      n <= fs`length IMPLIES
       (FORALL (i): NOT i = n AND NOT i < n IMPLIES i - 1 >= 0);


decl_type: tcc
theory: fseqs_ops
library: structures
signature: nil
location: 113 0 129 999
body:
  % Subtype TCC generated (at line 33, column 26) for
      % (LAMBDA i:
      %    IF i < n THEN fs`seq(i)
      %    ELSIF i = n THEN x
      %    ELSE fs`seq(i - 1)
      %    ENDIF)
      % expected type  barray[T](1 + fs`length)
  insert_TCC2: OBLIGATION
    FORALL (x: T, n: nat, fs: fseq[T]):
      n <= fs`length IMPLIES
       (FORALL (i_1: nat):
          i_1 >= 1 + fs`length IMPLIES
           IF i_1 < n THEN fs`seq(i_1)
           ELSIF i_1 = n THEN x
           ELSE fs`seq(i_1 - 1)
           ENDIF
            = default[T]);


decl_type: tcc
theory: fseqs_ops
library: structures
signature: nil
location: 131 0 146 999
body:
  % Subtype TCC generated (at line 45, column 45) for
      % (LAMBDA (ii: nat):
      %    IF ii < fs`length THEN seq(fs)(ii)
      %    ELSIF ii < fs`length + 1 THEN x
      %    ELSE default
      %    ENDIF)
      % expected type  barray[T](1 + fs`length)
  addend_TCC1: OBLIGATION
    FORALL (x: T, fs: fseq[T]):
      FORALL (i: nat):
        i >= 1 + fs`length IMPLIES
         IF i < fs`length THEN seq(fs)(i)
         ELSIF i < fs`length + 1 THEN x
         ELSE default[T]
         ENDIF
          = default[T];


decl_type: tcc
theory: fseqs_ops
library: structures
signature: nil
location: 148 0 156 999
body:
  % Subtype TCC generated (at line 77, column 36) for
      % (LAMBDA i: IF i < length(fs) THEN F(fs`seq(i)) ELSE default ENDIF)
      % expected type  barray[T](length(fs))
  map_TCC1: OBLIGATION
    FORALL (F: [T -> T], fs: fseq[T]):
      FORALL (i_1: nat):
        i_1 >= length(fs) IMPLIES
         IF i_1 < length(fs) THEN F(fs`seq(i_1)) ELSE default[T] ENDIF =
          default[T];


decl_type: function
theory: fseqs_ops_real
library: structures
signature: [[fseq[real], fseq[real]] -> fseq[real]]
location: 27 2 32 24
body:
    +(fs,gs): fseq = LET len = mmin(l(fs),l(gs)) IN
                      (# length := len,
                        seq := (LAMBDA n: IF n < len THEN fs(n) + gs(n) 
                                          ELSE default
                                          ENDIF)
                      #) ;


decl_type: function
theory: fseqs_ops_real
library: structures
signature: [[fseq[real], fseq[real]] -> fseq[real]]
location: 35 2 40 24
body:
    -(fs,gs): fseq = LET len = mmin(l(fs),l(gs)) IN
                      (# length := len,
                        seq := (LAMBDA n: IF n < len THEN fs(n) - gs(n) 
                                          ELSE default
                                          ENDIF)
                      #) ;


decl_type: function
theory: fseqs_ops_real
library: structures
signature: [[fseq[real], fseq[real]] -> fseq[real]]
location: 43 2 48 24
body:
    *(fs,gs): fseq = LET len = mmin(l(fs),l(gs)) IN
                      (# length := len,
                        seq := (LAMBDA n: IF n < len THEN fs(n) * gs(n) 
                                          ELSE default
                                          ENDIF)
                      #) ;


decl_type: function
theory: fseqs_ops_real
library: structures
signature: [[fseq[real], nz_fseq] -> fseq[real]]
location: 52 2 57 24
body:
    /(fs,nzgs): fseq = LET len = mmin(l(fs),l(nzgs)) IN
                      (# length := len,
                        seq := (LAMBDA n: IF n < len THEN fs(n) / nzgs(n) 
                                          ELSE default
                                          ENDIF)
                      #) ;


decl_type: tcc
theory: fseqs_ops_real
library: structures
signature: nil
location: 65 0 75 999
body:
  % Subtype TCC generated (at line 29, column 30) for
      % (LAMBDA n: IF n < len THEN fs`seq(n) + gs`seq(n) ELSE default ENDIF)
      % expected type  barray[real](len)
  plus_TCC1: OBLIGATION
    FORALL (fs: fseq[real], gs: fseq[real], len: nat):
      len = IF fs`length > gs`length THEN gs`length ELSE fs`length ENDIF
       IMPLIES
       (FORALL (i: nat):
          i >= len IMPLIES
           IF i < len THEN fs`seq(i) + gs`seq(i) ELSE default[real] ENDIF =
            default[real]);


decl_type: tcc
theory: fseqs_ops_real
library: structures
signature: nil
location: 77 0 87 999
body:
  % Subtype TCC generated (at line 37, column 30) for
      % (LAMBDA n: IF n < len THEN fs`seq(n) - gs`seq(n) ELSE default ENDIF)
      % expected type  barray[real](len)
  difference_TCC1: OBLIGATION
    FORALL (fs: fseq[real], gs: fseq[real], len: nat):
      len = IF fs`length > gs`length THEN gs`length ELSE fs`length ENDIF
       IMPLIES
       (FORALL (i: nat):
          i >= len IMPLIES
           IF i < len THEN fs`seq(i) - gs`seq(i) ELSE default[real] ENDIF =
            default[real]);


decl_type: tcc
theory: fseqs_ops_real
library: structures
signature: nil
location: 89 0 99 999
body:
  % Subtype TCC generated (at line 45, column 30) for
      % (LAMBDA n: IF n < len THEN fs`seq(n) * gs`seq(n) ELSE default ENDIF)
      % expected type  barray[real](len)
  times_TCC1: OBLIGATION
    FORALL (fs: fseq[real], gs: fseq[real], len: nat):
      len = IF fs`length > gs`length THEN gs`length ELSE fs`length ENDIF
       IMPLIES
       (FORALL (i: nat):
          i >= len IMPLIES
           IF i < len THEN fs`seq(i) * gs`seq(i) ELSE default[real] ENDIF =
            default[real]);


decl_type: tcc
theory: fseqs_ops_real
library: structures
signature: nil
location: 101 0 106 999
body:
  % Subtype TCC generated (at line 54, column 64) for  nzgs`seq(n)
      % expected type  nznum
  divide_TCC1: OBLIGATION
    FORALL (fs: fseq[real], nzgs: nz_fseq, len: nat):
      len = IF fs`length > nzgs`length THEN nzgs`length ELSE fs`length ENDIF
       IMPLIES (FORALL (n): n < len IMPLIES nzgs`seq(n) /= 0);


decl_type: tcc
theory: fseqs_ops_real
library: structures
signature: nil
location: 108 0 118 999
body:
  % Subtype TCC generated (at line 54, column 30) for
      % (LAMBDA n: IF n < len THEN fs`seq(n) / nzgs`seq(n) ELSE default ENDIF)
      % expected type  barray[real](len)
  divide_TCC2: OBLIGATION
    FORALL (fs: fseq[real], nzgs: nz_fseq, len: nat):
      len = IF fs`length > nzgs`length THEN nzgs`length ELSE fs`length ENDIF
       IMPLIES
       (FORALL (i: nat):
          i >= len IMPLIES
           IF i < len THEN fs`seq(i) / nzgs`seq(i) ELSE default[real] ENDIF =
            default[real]);


decl_type: tcc
theory: fseqs_def
library: structures
signature: nil
location: 179 0 182 999
body:
  % Judgement subtype TCC generated (at line 55, column 28) for  empty_seq
      % expected type  fseq
  empty_seq_fseq: OBLIGATION
    FORALL (i: nat): i >= empty_seq`length IMPLIES empty_seq`seq(i) = default;


decl_type: tcc
theory: fseqs_def
library: structures
signature: nil
location: 184 0 187 999
body:
  % Judgement subtype TCC generated (at line 56, column 28) for  emptyseq
      % expected type  fseq
  emptyseq_fseq: OBLIGATION
    FORALL (i: nat): i >= empty_seq`length IMPLIES empty_seq`seq(i) = default;


decl_type: tcc
theory: fseqs_def
library: structures
signature: nil
location: 189 0 195 999
body:
  % Subtype TCC generated (at line 64, column 28) for
      % (LAMBDA (n: nat): IF n = 0 THEN x ELSE default ENDIF)
      % expected type  barray(1)
  singleton_TCC1: OBLIGATION
    FORALL (x: T):
      FORALL (i: nat):
        i >= 1 IMPLIES IF i = 0 THEN x ELSE default ENDIF = default;


decl_type: tcc
theory: fseqs_def
library: structures
signature: nil
location: 197 0 204 999
body:
  % Subtype TCC generated (at line 70, column 8) for
      % LAMBDA (i: nat): IF i < f`length THEN f`seq(i) ELSE default ENDIF
      % expected type  barray(f`length)
  tofseq_TCC1: OBLIGATION
    FORALL (f: fsq[T]):
      FORALL (i_1: nat):
        i_1 >= f`length IMPLIES
         IF i_1 < f`length THEN f`seq(i_1) ELSE default ENDIF = default;


decl_type: tcc
theory: fseqs_def
library: structures
signature: nil
location: 206 0 213 999
body:
  % Subtype TCC generated (at line 95, column 51) for  n - l1
      % expected type  nat
  oh_TCC1: OBLIGATION
    FORALL (fs1: fseq, fs2: fseq, l1: nat):
      l1 = fs1`length IMPLIES
       (FORALL (l2: nat):
          l2 = fs2`length IMPLIES
           (FORALL (n: nat): n < l1 + l2 AND NOT n < l1 IMPLIES n - l1 >= 0));


decl_type: tcc
theory: fseqs_def
library: structures
signature: nil
location: 215 0 233 999
body:
  % Subtype TCC generated (at line 93, column 20) for
      % (LAMBDA (n: nat):
      %    IF n < l1 THEN fs1`seq(n)
      %    ELSIF n < l1 + l2 THEN fs2`seq(n - l1)
      %    ELSE default
      %    ENDIF)
      % expected type  barray(l1 + l2)
  oh_TCC2: OBLIGATION
    FORALL (fs1: fseq, fs2: fseq, l1: nat):
      l1 = fs1`length IMPLIES
       (FORALL (l2: nat):
          l2 = fs2`length IMPLIES
           (FORALL (i: nat):
              i >= l1 + l2 IMPLIES
               IF i < l1 THEN fs1`seq(i)
               ELSIF i < l1 + l2 THEN fs2`seq(i - l1)
               ELSE default
               ENDIF
                = default));


decl_type: tcc
theory: fseqs_def
library: structures
signature: nil
location: 235 0 241 999
body:
  % Subtype TCC generated (at line 126, column 39) for  fs`length - m
      % expected type  nat
  caret_TCC1: OBLIGATION
    FORALL (fs: fseq, p: [nat, nat], m: nat, n: nat):
           n - m + 1 > fs`length - m AND NOT m > n AND NOT m >= fs`length
       AND n = p`2 AND m = p`1
       IMPLIES fs`length - m >= 0;


decl_type: tcc
theory: fseqs_def
library: structures
signature: nil
location: 243 0 249 999
body:
  % Subtype TCC generated (at line 126, column 28) for  n - m + 1
      % expected type  nat
  caret_TCC2: OBLIGATION
    FORALL (fs: fseq, p: [nat, nat], m: nat, n: nat):
           NOT n - m + 1 > fs`length - m AND NOT m > n AND NOT m >= fs`length
       AND n = p`2 AND m = p`1
       IMPLIES n - m + 1 >= 0;


decl_type: tcc
theory: fseqs_def
library: structures
signature: nil
location: 251 0 265 999
body:
  % Subtype TCC generated (at line 128, column 24) for
      % (LAMBDA (x: nat): IF x < len THEN fs`seq(x + m) ELSE default ENDIF)
      % expected type  barray(len)
  caret_TCC3: OBLIGATION
    FORALL (fs: fseq, p: [nat, nat], m: nat, n: nat):
      NOT m > n AND NOT m >= fs`length AND n = p`2 AND m = p`1 IMPLIES
       (FORALL (len: nat):
          len =
           IF n - m + 1 > fs`length - m THEN fs`length - m
           ELSE n - m + 1
           ENDIF
           IMPLIES
           (FORALL (i: nat):
              i >= len IMPLIES
               IF i < len THEN fs`seq(i + m) ELSE default ENDIF = default));


decl_type: tcc
theory: fseqs_def
library: structures
signature: nil
location: 267 0 273 999
body:
  % Subtype TCC generated (at line 151, column 32) for
      % (LAMBDA (n: nat): IF n < 1 THEN t ELSE default ENDIF)
      % expected type  barray(1)
  fseq1_TCC1: OBLIGATION
    FORALL (t: T):
      FORALL (i: nat):
        i >= 1 IMPLIES IF i < 1 THEN t ELSE default ENDIF = default;


decl_type: tcc
theory: fseqs_def
library: structures
signature: nil
location: 275 0 283 999
body:
  % Subtype TCC generated (at line 154, column 35) for
      % (LAMBDA (i: nat):
      %    IF i = 0 THEN u ELSIF i = 1 THEN v ELSE default ENDIF)
      % expected type  barray(2)
  fseq2_TCC1: OBLIGATION
    FORALL (u, v: T):
      FORALL (i_1: nat):
        i_1 >= 2 IMPLIES
         IF i_1 = 0 THEN u ELSIF i_1 = 1 THEN v ELSE default ENDIF = default;


decl_type: tcc
theory: fseqs_def
library: structures
signature: nil
location: 285 0 291 999
body:
  % Subtype TCC generated (at line 161, column 43) for
      % (LAMBDA (i: nat): IF i < n THEN c ELSE default ENDIF)
      % expected type  barray(n)
  const_seq_TCC1: OBLIGATION
    FORALL (n: nat, c: T):
      FORALL (i_1: nat):
        i_1 >= n IMPLIES IF i_1 < n THEN c ELSE default ENDIF = default;


decl_type: tcc
theory: fseqs_def
library: structures
signature: nil
location: 293 0 296 999
body:
  % Subtype TCC generated (at line 167, column 66) for  fs`length - 1 - i
      % expected type  nat
  rev_TCC1: OBLIGATION
    FORALL (fs: fseq, i: nat): i < fs`length IMPLIES fs`length - 1 - i >= 0;


decl_type: tcc
theory: fseqs_def
library: structures
signature: nil
location: 298 0 311 999
body:
  % Subtype TCC generated (at line 166, column 35) for
      % (LAMBDA (i: nat):
      %    IF i < fs`length THEN seq(fs)(fs`length - 1 - i)
      %    ELSE default
      %    ENDIF)
      % expected type  barray(fs`length)
  rev_TCC2: OBLIGATION
    FORALL (fs: fseq):
      FORALL (i_1: nat):
        i_1 >= fs`length IMPLIES
         IF i_1 < fs`length THEN seq(fs)(fs`length - 1 - i_1)
         ELSE default
         ENDIF
          = default;


decl_type: tcc
theory: fseqs_ops_def
library: structures
signature: nil
location: 89 0 93 999
body:
  % Subtype TCC generated (at line 23, column 46) for  nefs`length - 1
      % expected type  nat
  delete_TCC1: OBLIGATION
    FORALL (n: nat, nefs: ne_fseq[T, default]):
      n < nefs`length IMPLIES nefs`length - 1 >= 0;


decl_type: tcc
theory: fseqs_ops_def
library: structures
signature: nil
location: 95 0 104 999
body:
  % Subtype TCC generated (at line 24, column 44) for
      % (LAMBDA i: (IF i < n THEN nefs`seq(i) ELSE nefs`seq(i + 1) ENDIF))
      % expected type  barray[T, default](nefs`length - 1)
  delete_TCC2: OBLIGATION
    FORALL (n: nat, nefs: ne_fseq[T, default]):
      n < nefs`length IMPLIES
       (FORALL (i_1: nat):
          i_1 >= nefs`length - 1 IMPLIES
           (IF i_1 < n THEN nefs`seq(i_1) ELSE nefs`seq(i_1 + 1) ENDIF) =
            default);


decl_type: tcc
theory: fseqs_ops_def
library: structures
signature: nil
location: 106 0 111 999
body:
  % Subtype TCC generated (at line 35, column 43) for  i - 1
      % expected type  nat
  insert_TCC1: OBLIGATION
    FORALL (x: T, n: nat, fs: fseq[T, default]):
      n <= fs`length IMPLIES
       (FORALL (i): NOT i = n AND NOT i < n IMPLIES i - 1 >= 0);


decl_type: tcc
theory: fseqs_ops_def
library: structures
signature: nil
location: 113 0 129 999
body:
  % Subtype TCC generated (at line 33, column 26) for
      % (LAMBDA i:
      %    IF i < n THEN fs`seq(i)
      %    ELSIF i = n THEN x
      %    ELSE fs`seq(i - 1)
      %    ENDIF)
      % expected type  barray[T, default](1 + fs`length)
  insert_TCC2: OBLIGATION
    FORALL (x: T, n: nat, fs: fseq[T, default]):
      n <= fs`length IMPLIES
       (FORALL (i_1: nat):
          i_1 >= 1 + fs`length IMPLIES
           IF i_1 < n THEN fs`seq(i_1)
           ELSIF i_1 = n THEN x
           ELSE fs`seq(i_1 - 1)
           ENDIF
            = default);


decl_type: tcc
theory: fseqs_ops_def
library: structures
signature: nil
location: 131 0 146 999
body:
  % Subtype TCC generated (at line 45, column 45) for
      % (LAMBDA (ii: nat):
      %    IF ii < fs`length THEN seq(fs)(ii)
      %    ELSIF ii < fs`length + 1 THEN x
      %    ELSE default
      %    ENDIF)
      % expected type  barray[T, default](1 + fs`length)
  addend_TCC1: OBLIGATION
    FORALL (x: T, fs: fseq[T, default]):
      FORALL (i: nat):
        i >= 1 + fs`length IMPLIES
         IF i < fs`length THEN seq(fs)(i)
         ELSIF i < fs`length + 1 THEN x
         ELSE default
         ENDIF
          = default;


decl_type: tcc
theory: fseqs_ops_def
library: structures
signature: nil
location: 148 0 155 999
body:
  % Subtype TCC generated (at line 77, column 36) for
      % (LAMBDA i: IF i < length(fs) THEN F(fs`seq(i)) ELSE default ENDIF)
      % expected type  barray[T, default](length(fs))
  map_TCC1: OBLIGATION
    FORALL (F: [T -> T], fs: fseq[T, default]):
      FORALL (i_1: nat):
        i_1 >= length(fs) IMPLIES
         IF i_1 < length(fs) THEN F(fs`seq(i_1)) ELSE default ENDIF = default;


decl_type: formula
theory: runs
library: structures
signature: nil
location: 23 2 26 25
body:
    invariant_rule : THEOREM
      (FORALL (r : (run)) : p(r(0)) AND 
        FORALL (n : nat) : p(r(n)) IMPLIES p(r(n+1)))
       IMPLIES invariant(p)


decl_type: function
theory: runs
library: structures
signature: pred[sequence[State]]
location: 11 2 12 69
body:
    run_fragment: pred[sequence[State]] =  
      {r : sequence[State] | FORALL (n : nat): transition(r(n),r(n+1))}


decl_type: tcc
theory: arrays
library: structures
signature: nil
location: 47 0 52 999
body:
  % Subtype TCC generated (at line 28, column 22) for  init_with(0)
      % expected type  Nats
  init_TCC1: OBLIGATION
    FORALL (x1: Index):
      rational_pred(init_with(0)(x1)) AND
       integer_pred(init_with(0)(x1)) AND init_with(0)(x1) >= 0;


decl_type: function
theory: arrays_examples
library: structures
signature: ArrayOf[10][[nat, string]]
location: 16 2 16 71
body:
    NS0 : ArrayOf[10][[nat,string]] = init_with[10][[nat,string]]((0,""))  % Initializes an array of 10 pairs [nat,string] with (0,"")


decl_type: function
theory: arrays_examples
library: structures
signature: ArrayOf[10][[nat, string]]
location: 17 2 17 59
body:
    NS1 : ArrayOf[10][[nat,string]] = NS0 WITH [`1 := (1,"")] % Same as NS0 except that it has (1,"") in 1st position


decl_type: function
theory: arrays_examples
library: structures
signature: ArrayOf[10][GridPoint]
location: 21 2 21 65
body:
    RR0 : ArrayOf[10][GridPoint] = init_with[10][GridPoint](origin) % Initializes an array of 10 grid points with origin


decl_type: function
theory: arrays_examples
library: structures
signature: ArrayOf[10][GridPoint]
location: 22 2 22 69
body:
    RR1 : ArrayOf[10][GridPoint] = RR0 WITH [`1 := (# x := 1, y:= 0 #)] % Same as RR0 except that it has the point (1,0) in 1st position


decl_type: formula
theory: for_iterate
library: structures
signature: nil
location: 11 2 13 52
body:
    for_def_inv : LEMMA
      FORALL(i:int,n:nat,a:T,f:[[int,T]->T]):
        for_def(i,n+i,a,f) = for_def(1+i,n+i,f(i,a),f)


decl_type: formula
theory: for_iterate
library: structures
signature: nil
location: 15 2 17 84
body:
    for_shift : LEMMA
      FORALL(i,j:int,shift:int,a:T,f:[[int,T]->T]):
        for_def(i,j,a,f) = for_def(i+shift,j+shift,a,LAMBDA (k:int,t:T): f(k-shift,t))


decl_type: formula
theory: for_iterate
library: structures
signature: nil
location: 19 2 23 41
body:
    for_def_ext : LEMMA
      FORALL(i,j:int,a:T,f,g:[[int,T]->T]) :
        (FORALL (x:subrange(i,j),t:T) : f(x,t) = g(x,t)) 
        IMPLIES
        for_def(i,j,a,f) = for_def(i,j,a,g)


decl_type: formula
theory: for_iterate
library: structures
signature: nil
location: 27 2 32 40
body:
    for_def_induction : LEMMA
      FORALL(i,j:int,a:T,f:[[int,T]->T],inv:PRED[[nat,T]]):
        (inv(0,a) AND
         FORALL (k:subrange(0,j-i),ak:T) : inv(k,ak) IMPLIES inv(k+1,f(i+k,ak)))
        IMPLIES
        inv(max(0,j-i+1),for_def(i,j,a,f))


decl_type: formula
theory: for_iterate
library: structures
signature: nil
location: 57 2 59 50
body:
    for_eq : LEMMA
      FORALL(i,j:int,a:T,f:ForBody(i,j)) :
        for(i,j,a,f) = for_def(i,j,a,ext2int(i,j,f))


decl_type: formula
theory: for_iterate
library: structures
signature: nil
location: 61 2 66 32
body:
    for_induction : THEOREM
      FORALL(m:int,(n:int| n >= m-1),init:T,f:ForBody(m,n),inv:PRED[[upto(n-m+1),T]]):
        (inv(0,init) AND
         FORALL (k:subrange(0,n-m),ak:T) : inv(k,ak) IMPLIES inv(k+1,f(m+k,ak)))
        IMPLIES
        inv(n-m+1,for(m,n,init,f))


decl_type: formula
theory: for_iterate
library: structures
signature: nil
location: 75 2 79 51
body:
    for_down_def_ext : LEMMA
      FORALL(i,j:int,a:T,f,g:[[int,T]->T]) :
        (FORALL (x:subrange(j,i),t:T) : f(x,t) = g(x,t)) 
        IMPLIES
        for_down_def(i,j,a,f) = for_down_def(i,j,a,g)


decl_type: formula
theory: for_iterate
library: structures
signature: nil
location: 81 2 83 73
body:
    for_down_up : LEMMA
      FORALL(i,j:int,a:T,f:[[int,T]->T]):
        for_down_def(i,j,a,f) = for_def(j,i,a,LAMBDA(k:int,t:T):f(i-k+j,t))


decl_type: formula
theory: for_iterate
library: structures
signature: nil
location: 85 2 90 45
body:
    for_down_def_induction : LEMMA
      FORALL(i,j:int,a:T,f:[[int,T]->T],inv:PRED[[nat,T]]):
        (inv(0,a) AND
         FORALL (k:subrange(0,i-j),ak:T) : inv(k,ak) IMPLIES inv(k+1,f(i-k,ak)))
        IMPLIES
        inv(max(0,i-j+1),for_down_def(i,j,a,f))


decl_type: formula
theory: for_iterate
library: structures
signature: nil
location: 100 2 105 37
body:
    for_down_induction : THEOREM
      FORALL(n:int,(m:int| m <= n+1),init:T,f:ForBody(m,n),inv:PRED[[upto(n-m+1),T]]):
        (inv(0,init) AND
         FORALL (k:subrange(0,n-m),ak:T) : inv(k,ak) IMPLIES inv(k+1,f(n-k,ak)))
        IMPLIES
        inv(n-m+1,for_down(n,m,init,f))


decl_type: formula
theory: for_iterate
library: structures
signature: nil
location: 107 2 109 60
body:
    for_down_eq : LEMMA
      FORALL(i,j:int,a:T,f:ForBody(j,i)):
        for_down(i,j,a,f) = for_down_def(i,j,a,ext2int(j,i,f)) 


decl_type: formula
theory: for_iterate
library: structures
signature: nil
location: 118 2 122 59
body:
    iterate_left_def_ext : LEMMA
      FORALL(i:int,j:upfrom(i),f,g:[int->T],o:[[T,T]->T]) :
        (FORALL (x:subrange(i,j)) : f(x) = g(x)) 
        IMPLIES
        iterate_left_def(i,j,f,o) = iterate_left_def(i,j,g,o)


decl_type: formula
theory: for_iterate
library: structures
signature: nil
location: 143 2 145 73
body:
    iterate_left_eq : LEMMA
      FORALL(i:int,j:upfrom(i),f:IterateBody(i,j),o:[[T,T]->T]) :
        iterate_left(i,j,f,o) = iterate_left_def(i,j,ext2int(i,j,f(i),f),o)


decl_type: formula
theory: for_iterate
library: structures
signature: nil
location: 147 2 152 36
body:
    iterate_left_induction : THEOREM
      FORALL(m:int,n:upfrom(m),f:IterateBody(m,n),o:[[T,T]->T],inv:PRED[[upto(n-m),T]]):
        (inv(0,f(m)) AND
         FORALL (k:below(n-m),ak:T) : inv(k,ak) IMPLIES inv(k+1,ak o f(m+k+1)))
        IMPLIES
        inv(n-m,iterate_left(m,n,f,o))


decl_type: formula
theory: for_iterate
library: structures
signature: nil
location: 161 2 165 61
body:
    iterate_right_def_ext : LEMMA
      FORALL(i:int,j:upfrom(i),f,g:[int->T],o:[[T,T]->T]) :
        (FORALL (x:subrange(i,j)) : f(x) = g(x)) 
        IMPLIES
        iterate_right_def(i,j,f,o) = iterate_right_def(i,j,g,o)


decl_type: formula
theory: for_iterate
library: structures
signature: nil
location: 179 2 181 75
body:
    iterate_right_eq : LEMMA
      FORALL(i:int,j:upfrom(i),f:IterateBody(i,j),o:[[T,T]->T]) :
        iterate_right(i,j,f,o) = iterate_right_def(i,j,ext2int(i,j,f(j),f),o)


decl_type: formula
theory: for_iterate
library: structures
signature: nil
location: 183 2 188 37
body:
    iterate_right_induction : THEOREM
      FORALL(m:int,n:upfrom(m),f:IterateBody(m,n),o:[[T,T]->T],inv:PRED[[upto(n-m),T]]):
        (inv(0,f(n)) AND
         FORALL (k:below(n-m),ak:T) : inv(k,ak) IMPLIES inv(k+1,f(n-k-1) o ak))
        IMPLIES
        inv(n-m,iterate_right(m,n,f,o))


decl_type: function
theory: for_iterate
library: structures
signature: [[int, int, T, [[int, T] -> T]] -> T]
location: 5 2 9 22
body:
    for_def(i,j:int,a:T,f:[[int,T]->T]) : RECURSIVE T =
      IF i > j THEN a
      ELSE f(j,for_def(i,j-1,a,f))
      ENDIF
    MEASURE max(j-i+1,0)


decl_type: function
theory: for_iterate
library: structures
signature:
  [[upfrom: int, upto: int, ForBody(upfrom, upto)] ->
  [[int, T] -> T]]

location: 36 2 39 9
body:
    ext2int(upfrom,upto:int,f:ForBody(upfrom,upto))(i:int,a:T) : T =
      IF upfrom <= i AND i <= upto THEN f(i,a)
      ELSE a
      ENDIF


decl_type: function
theory: for_iterate
library: structures
location: 41 2 46 25
signature:
  [d:
          [upfrom: int, upfrom(upfrom), upto: int, T,
           ForBody(upfrom, upto)] ->
          {t: T | t = for_def(d`2, d`3, d`4, ext2int(d`1, d`3, d`5))}]

body:
    for_it(upfrom:int,i:upfrom(upfrom),upto:int,a:T,f:ForBody(upfrom,upto)) : RECURSIVE 
      {t : T | t = for_def(i,upto,a,ext2int(upfrom,upto,f))} =
      IF i > upto THEN a
      ELSE for_it(upfrom,i+1,upto,f(i,a),f)
      ENDIF
    MEASURE max(upto-i+1,0)


decl_type: function
theory: for_iterate
library: structures
signature: [[int, int, T, [[int, T] -> T]] -> T]
location: 69 2 73 22
body:
    for_down_def(i,j:int,a:T,f:[[int,T]->T]) : RECURSIVE T =
      IF i < j THEN a
      ELSE f(j,for_down_def(i,j+1,a,f))
      ENDIF
    MEASURE max(i-j+1,0)


decl_type: function
theory: for_iterate
library: structures
signature: [[n: int, m: int, T, ForBody(m, n)] -> T]
location: 97 2 98 57
body:
    for_down(n,m:int,init:T,f:ForBody(m,n)) : T =
      for(m,n,init,LAMBDA(k:subrange(m,n),a:T): f(n+m-k,a))


decl_type: function
theory: for_iterate
library: structures
signature: [[i: int, upfrom(i), [int -> T], [[T, T] -> T]] -> T]
location: 112 2 116 13
body:
    iterate_left_def(i:int,j:upfrom(i),f:[int->T],o:[[T,T]->T]) : RECURSIVE T =
      IF i = j THEN f(i) 
      ELSE iterate_left_def(i,j-1,f,o) o f(j)
      ENDIF
    MEASURE j-i


decl_type: function
theory: for_iterate
library: structures
signature:
  [[upfrom: int, upto: int, T, IterateBody(upfrom, upto)] ->
  [int -> T]]

location: 126 2 129 9
body:
    ext2int(upfrom,upto:int,a:T,f:IterateBody(upfrom,upto))(i:int) : T =
      IF upfrom <= i AND i <= upto THEN f(i)
      ELSE a
      ENDIF


decl_type: function
theory: for_iterate
library: structures
signature: [[i: int, j: int, IterateBody(i, j), [[T, T] -> T], T] -> T]
location: 131 2 132 52
body:
    iterate_left_id(i:int,j:int,f:IterateBody(i,j),o:[[T,T]->T],id:T) : MACRO T =
      for(i,j,id,LAMBDA(k:subrange(i,j),t:T):t o f(k))


decl_type: function
theory: for_iterate
library: structures
signature: [[m: int, n: upfrom(m), IterateBody(m, n), [[T, T] -> T]] -> T]
location: 140 2 141 64
body:
    iterate_left(m:int,n:upfrom(m),f:IterateBody(m,n),o:[[T,T]->T]) : T =
      iterate_left_id(m+1,n,LAMBDA(k:subrange(m+1,n)):f(k),o,f(m))


decl_type: function
theory: for_iterate
library: structures
signature: [[i: int, upfrom(i), [int -> T], [[T, T] -> T]] -> T]
location: 155 2 159 13
body:
    iterate_right_def(i:int,j:upfrom(i),f:[int->T],o:[[T,T]->T]) : RECURSIVE T =
      IF i = j THEN f(j) 
      ELSE f(i) o iterate_right_def(i+1,j,f,o) 
      ENDIF
    MEASURE j-i


decl_type: function
theory: for_iterate
library: structures
signature: [[i: int, j: int, IterateBody(i, j), [[T, T] -> T], T] -> T]
location: 167 2 168 57
body:
    iterate_right_id(i,j:int,f:IterateBody(i,j),o:[[T,T]->T],id:T) : MACRO T =
      for_down(j,i,id,LAMBDA(k:subrange(i,j),t:T):f(k) o t)    


decl_type: function
theory: for_iterate
library: structures
signature: [[m: int, n: upfrom(m), IterateBody(m, n), [[T, T] -> T]] -> T]
location: 176 2 177 65
body:
    iterate_right(m:int,n:upfrom(m),f:IterateBody(m,n),o:[[T,T]->T]) : T =
      iterate_right_id(m,n-1,LAMBDA(k:subrange(m,n-1)):f(k),o,f(n))


decl_type: tcc
theory: for_iterate
library: structures
signature: nil
location: 196 0 199 999
body:
  % Subtype TCC generated (at line 9, column 10) for  max(j - i + 1, 0)
      % expected type  naturalnumber
  for_def_TCC1: OBLIGATION
    FORALL (i, j: int, a: T, f: [[int, T] -> T]): max(j - i + 1, 0) >= 0;


decl_type: tcc
theory: for_iterate
library: structures
signature: nil
location: 201 0 205 999
body:
  % Termination TCC generated (at line 7, column 13) for
      % for_def(i, j - 1, a, f)
  for_def_TCC2: OBLIGATION
    FORALL (i, j: int, a: T, f: [[int, T] -> T]):
      NOT i > j IMPLIES max(j - 1 - i + 1, 0) < max(j - i + 1, 0);


decl_type: tcc
theory: for_iterate
library: structures
signature: nil
location: 207 0 211 999
body:
  % Subtype TCC generated (at line 30, column 45) for  k
      % expected type  nat
  for_def_induction_TCC1: OBLIGATION
    FORALL (i, j: int, a: T, f: [[int, T] -> T], inv: PRED[[nat, T]]):
      inv(0, a) IMPLIES (FORALL (k: subrange(0, j - i), ak: T): k >= 0);


decl_type: tcc
theory: for_iterate
library: structures
signature: nil
location: 213 0 218 999
body:
  % Subtype TCC generated (at line 30, column 63) for  k + 1
      % expected type  nat
  for_def_induction_TCC2: OBLIGATION
    FORALL (i, j: int, a: T, f: [[int, T] -> T], inv: PRED[[nat, T]]):
      inv(0, a) IMPLIES
       (FORALL (k: subrange(0, j - i), ak: T): inv(k, ak) IMPLIES k + 1 >= 0);


decl_type: tcc
theory: for_iterate
library: structures
signature: nil
location: 220 0 227 999
body:
  % Subtype TCC generated (at line 32, column 10) for  max(0, j - i + 1)
      % expected type  nat
  for_def_induction_TCC3: OBLIGATION
    FORALL (i, j: int, a: T, f: [[int, T] -> T], inv: PRED[[nat, T]]):
      (inv(0, a) AND
        (FORALL (k: subrange(0, j - i), ak: T):
           inv(k, ak) IMPLIES inv(k + 1, f(i + k, ak))))
       IMPLIES max(0, j - i + 1) >= 0;


decl_type: tcc
theory: for_iterate
library: structures
signature: nil
location: 229 0 233 999
body:
  % Subtype TCC generated (at line 37, column 40) for  i
      % expected type  subrange(upfrom, upto)
  ext2int_TCC1: OBLIGATION
    FORALL (upfrom, upto: int, f: ForBody(upfrom, upto), i: int, a: T):
      upfrom <= i AND i <= upto IMPLIES upfrom <= i AND i <= upto;


decl_type: tcc
theory: for_iterate
library: structures
signature: nil
location: 235 0 240 999
body:
  % Subtype TCC generated (at line 46, column 10) for  max(upto - i + 1, 0)
      % expected type  naturalnumber
  for_it_TCC1: OBLIGATION
    FORALL (upfrom: int, i: upfrom(upfrom), upto: int, a: T,
            f: ForBody(upfrom, upto)):
      max(upto - i + 1, 0) >= 0;


decl_type: tcc
theory: for_iterate
library: structures
signature: nil
location: 242 0 252 999
body:
  % Subtype TCC generated (at line 43, column 21) for  a
      % expected type  {t: T |
                     %          t =
                     %           for_def(i,
                     %                   upto,
                     %                   a,
                     %                   ext2int(upfrom, upto, f))}
  for_it_TCC2: OBLIGATION
    FORALL (upfrom: int, i: upfrom(upfrom), upto: int, a: T,
            f: ForBody(upfrom, upto)):
      i > upto IMPLIES a = for_def(i, upto, a, ext2int(upfrom, upto, f));


decl_type: tcc
theory: for_iterate
library: structures
signature: nil
location: 254 0 259 999
body:
  % Subtype TCC generated (at line 44, column 23) for  i + 1
      % expected type  upfrom(upfrom)
  for_it_TCC3: OBLIGATION
    FORALL (upfrom: int, i: upfrom(upfrom), upto: int, a: T,
            f: ForBody(upfrom, upto)):
      NOT i > upto IMPLIES i + 1 >= upfrom;


decl_type: tcc
theory: for_iterate
library: structures
signature: nil
location: 261 0 266 999
body:
  % Subtype TCC generated (at line 44, column 34) for  i
      % expected type  subrange(upfrom, upto)
  for_it_TCC4: OBLIGATION
    FORALL (upfrom: int, i: upfrom(upfrom), upto: int, a: T,
            f: ForBody(upfrom, upto)):
      NOT i > upto IMPLIES upfrom <= i AND i <= upto;


decl_type: tcc
theory: for_iterate
library: structures
signature: nil
location: 268 0 273 999
body:
  % Termination TCC generated (at line 44, column 9) for
      % for_it(upfrom, i + 1, upto, f(i, a), f)
  for_it_TCC5: OBLIGATION
    FORALL (upfrom: int, i: upfrom(upfrom), upto: int, a: T,
            f: ForBody(upfrom, upto)):
      NOT i > upto IMPLIES max(upto - (i + 1) + 1, 0) < max(upto - i + 1, 0);


decl_type: tcc
theory: for_iterate
library: structures
signature: nil
location: 275 0 298 999
body:
  % Subtype TCC generated (at line 44, column 9) for
      % for_it(upfrom, i + 1, upto, f(i, a), f)
      % expected type  {t: T |
                     %          t =
                     %           for_def(i,
                     %                   upto,
                     %                   a,
                     %                   ext2int(upfrom, upto, f))}
  for_it_TCC6: OBLIGATION
    FORALL (upfrom: int, i: upfrom(upfrom), upto: int,
            v:
              [d1:
                 {z:
                    [upfrom: int, upfrom(upfrom), upto: int, T,
                     ForBody(upfrom, upto)] |
                          max(z`3 - z`2 + 1, 0) < max(upto - i + 1, 0)} ->
                 {t: T |
                          t =
                           for_def(d1`2, d1`3, d1`4,
                                   ext2int(d1`1, d1`3, d1`5))}],
            a: T, f: ForBody(upfrom, upto)):
      NOT i > upto IMPLIES
       v(upfrom, i + 1, upto, f(i, a), f) =
        for_def(i, upto, a, ext2int(upfrom, upto, f));


decl_type: tcc
theory: for_iterate
library: structures
signature: nil
location: 300 0 302 999
body:
  % Subtype TCC generated (at line 55, column 13) for  m
      % expected type  upfrom(m)
  for_TCC1: OBLIGATION FORALL (m, n: int, init: T, f: ForBody(m, n)): m >= m;


decl_type: tcc
theory: for_iterate
library: structures
signature: nil
location: 304 0 308 999
body:
  % Subtype TCC generated (at line 63, column 11) for  0
      % expected type  upto(1 + n - m)
  for_induction_TCC1: OBLIGATION
    FORALL (m: int, (n: int | n >= m - 1), init: T, f: ForBody(m, n)):
      0 <= 1 + n - m;


decl_type: tcc
theory: for_iterate
library: structures
signature: nil
location: 310 0 316 999
body:
  % Subtype TCC generated (at line 64, column 45) for  k
      % expected type  upto(1 + n - m)
  for_induction_TCC2: OBLIGATION
    FORALL (m: int, (n: int | n >= m - 1), init: T, f: ForBody(m, n),
            inv: PRED[[upto(n - m + 1), T]]):
      inv(0, init) IMPLIES
       (FORALL (k: subrange(0, n - m), ak: T): k >= 0 AND k <= 1 + n - m);


decl_type: tcc
theory: for_iterate
library: structures
signature: nil
location: 318 0 325 999
body:
  % Subtype TCC generated (at line 64, column 63) for  k + 1
      % expected type  upto(1 + n - m)
  for_induction_TCC3: OBLIGATION
    FORALL (m: int, (n: int | n >= m - 1), init: T, f: ForBody(m, n),
            inv: PRED[[upto(n - m + 1), T]]):
      inv(0, init) IMPLIES
       (FORALL (k: subrange(0, n - m), ak: T):
          inv(k, ak) IMPLIES k + 1 >= 0 AND k + 1 <= 1 + n - m);


decl_type: tcc
theory: for_iterate
library: structures
signature: nil
location: 327 0 334 999
body:
  % Subtype TCC generated (at line 64, column 69) for  m + k
      % expected type  subrange(m, n)
  for_induction_TCC4: OBLIGATION
    FORALL (m: int, (n: int | n >= m - 1), init: T, f: ForBody(m, n),
            inv: PRED[[upto(n - m + 1), T]]):
      inv(0, init) IMPLIES
       (FORALL (k: subrange(0, n - m), ak: T):
          inv(k, ak) IMPLIES m <= m + k AND m + k <= n);


decl_type: tcc
theory: for_iterate
library: structures
signature: nil
location: 336 0 344 999
body:
  % Subtype TCC generated (at line 66, column 10) for  n - m + 1
      % expected type  upto(1 + n - m)
  for_induction_TCC5: OBLIGATION
    FORALL (m: int, (n: int | n >= m - 1), init: T, f: ForBody(m, n),
            inv: PRED[[upto(n - m + 1), T]]):
      (inv(0, init) AND
        (FORALL (k: subrange(0, n - m), ak: T):
           inv(k, ak) IMPLIES inv(k + 1, f(m + k, ak))))
       IMPLIES n - m + 1 >= 0 AND n - m + 1 <= 1 + n - m;


decl_type: tcc
theory: for_iterate
library: structures
signature: nil
location: 346 0 349 999
body:
  % Subtype TCC generated (at line 73, column 10) for  max(i - j + 1, 0)
      % expected type  naturalnumber
  for_down_def_TCC1: OBLIGATION
    FORALL (i, j: int, a: T, f: [[int, T] -> T]): max(i - j + 1, 0) >= 0;


decl_type: tcc
theory: for_iterate
library: structures
signature: nil
location: 351 0 355 999
body:
  % Termination TCC generated (at line 71, column 13) for
      % for_down_def(i, j + 1, a, f)
  for_down_def_TCC2: OBLIGATION
    FORALL (i, j: int, a: T, f: [[int, T] -> T]):
      NOT i < j IMPLIES max(i - (j + 1) + 1, 0) < max(i - j + 1, 0);


decl_type: tcc
theory: for_iterate
library: structures
signature: nil
location: 357 0 361 999
body:
  % Subtype TCC generated (at line 88, column 45) for  k
      % expected type  nat
  for_down_def_induction_TCC1: OBLIGATION
    FORALL (i, j: int, a: T, f: [[int, T] -> T], inv: PRED[[nat, T]]):
      inv(0, a) IMPLIES (FORALL (k: subrange(0, i - j), ak: T): k >= 0);


decl_type: tcc
theory: for_iterate
library: structures
signature: nil
location: 363 0 368 999
body:
  % Subtype TCC generated (at line 88, column 63) for  k + 1
      % expected type  nat
  for_down_def_induction_TCC2: OBLIGATION
    FORALL (i, j: int, a: T, f: [[int, T] -> T], inv: PRED[[nat, T]]):
      inv(0, a) IMPLIES
       (FORALL (k: subrange(0, i - j), ak: T): inv(k, ak) IMPLIES k + 1 >= 0);


decl_type: tcc
theory: for_iterate
library: structures
signature: nil
location: 370 0 377 999
body:
  % Subtype TCC generated (at line 90, column 10) for  max(0, i - j + 1)
      % expected type  nat
  for_down_def_induction_TCC3: OBLIGATION
    FORALL (i, j: int, a: T, f: [[int, T] -> T], inv: PRED[[nat, T]]):
      (inv(0, a) AND
        (FORALL (k: subrange(0, i - j), ak: T):
           inv(k, ak) IMPLIES inv(k + 1, f(i - k, ak))))
       IMPLIES max(0, i - j + 1) >= 0;


decl_type: tcc
theory: for_iterate
library: structures
signature: nil
location: 379 0 383 999
body:
  % Subtype TCC generated (at line 98, column 48) for  n + m - k
      % expected type  subrange(m, n)
  for_down_TCC1: OBLIGATION
    FORALL (n, m: int, init: T, f: ForBody(m, n), k: subrange(m, n), a: T):
      m <= n + m - k AND n + m - k <= n;


decl_type: tcc
theory: for_iterate
library: structures
signature: nil
location: 385 0 389 999
body:
  % Subtype TCC generated (at line 102, column 11) for  0
      % expected type  upto(1 + n - m)
  for_down_induction_TCC1: OBLIGATION
    FORALL (n: int, (m: int | m <= n + 1), init: T, f: ForBody(m, n)):
      0 <= 1 + n - m;


decl_type: tcc
theory: for_iterate
library: structures
signature: nil
location: 391 0 397 999
body:
  % Subtype TCC generated (at line 103, column 45) for  k
      % expected type  upto(1 + n - m)
  for_down_induction_TCC2: OBLIGATION
    FORALL (n: int, (m: int | m <= n + 1), init: T, f: ForBody(m, n),
            inv: PRED[[upto(n - m + 1), T]]):
      inv(0, init) IMPLIES
       (FORALL (k: subrange(0, n - m), ak: T): k >= 0 AND k <= 1 + n - m);


decl_type: tcc
theory: for_iterate
library: structures
signature: nil
location: 399 0 406 999
body:
  % Subtype TCC generated (at line 103, column 63) for  k + 1
      % expected type  upto(1 + n - m)
  for_down_induction_TCC3: OBLIGATION
    FORALL (n: int, (m: int | m <= n + 1), init: T, f: ForBody(m, n),
            inv: PRED[[upto(n - m + 1), T]]):
      inv(0, init) IMPLIES
       (FORALL (k: subrange(0, n - m), ak: T):
          inv(k, ak) IMPLIES k + 1 >= 0 AND k + 1 <= 1 + n - m);


decl_type: tcc
theory: for_iterate
library: structures
signature: nil
location: 408 0 415 999
body:
  % Subtype TCC generated (at line 103, column 69) for  n - k
      % expected type  subrange(m, n)
  for_down_induction_TCC4: OBLIGATION
    FORALL (n: int, (m: int | m <= n + 1), init: T, f: ForBody(m, n),
            inv: PRED[[upto(n - m + 1), T]]):
      inv(0, init) IMPLIES
       (FORALL (k: subrange(0, n - m), ak: T):
          inv(k, ak) IMPLIES m <= n - k AND n - k <= n);


decl_type: tcc
theory: for_iterate
library: structures
signature: nil
location: 417 0 425 999
body:
  % Subtype TCC generated (at line 105, column 10) for  n - m + 1
      % expected type  upto(1 + n - m)
  for_down_induction_TCC5: OBLIGATION
    FORALL (n: int, (m: int | m <= n + 1), init: T, f: ForBody(m, n),
            inv: PRED[[upto(n - m + 1), T]]):
      (inv(0, init) AND
        (FORALL (k: subrange(0, n - m), ak: T):
           inv(k, ak) IMPLIES inv(k + 1, f(n - k, ak))))
       IMPLIES n - m + 1 >= 0 AND n - m + 1 <= 1 + n - m;


decl_type: tcc
theory: for_iterate
library: structures
signature: nil
location: 427 0 431 999
body:
  % Subtype TCC generated (at line 116, column 10) for  j - i
      % expected type  naturalnumber
  iterate_left_def_TCC1: OBLIGATION
    FORALL (i: int, j: upfrom(i), f: [int -> T], O: [[T, T] -> T]):
      j - i >= 0;


decl_type: tcc
theory: for_iterate
library: structures
signature: nil
location: 433 0 437 999
body:
  % Subtype TCC generated (at line 114, column 28) for  j - 1
      % expected type  upfrom(i)
  iterate_left_def_TCC2: OBLIGATION
    FORALL (i: int, j: upfrom(i), f: [int -> T], O: [[T, T] -> T]):
      NOT i = j IMPLIES j - 1 >= i;


decl_type: tcc
theory: for_iterate
library: structures
signature: nil
location: 439 0 443 999
body:
  % Termination TCC generated (at line 114, column 9) for
      % iterate_left_def(i, j - 1, f, o)
  iterate_left_def_TCC3: OBLIGATION
    FORALL (i: int, j: upfrom(i), f: [int -> T], O: [[T, T] -> T]):
      NOT i = j IMPLIES j - 1 - i < j - i;


decl_type: tcc
theory: for_iterate
library: structures
signature: nil
location: 445 0 449 999
body:
  % Subtype TCC generated (at line 127, column 40) for  i
      % expected type  subrange(upfrom, upto)
  ext2int_TCC2: OBLIGATION
    FORALL (upfrom, upto: int, a: T, f: IterateBody(upfrom, upto), i: int):
      upfrom <= i AND i <= upto IMPLIES upfrom <= i AND i <= upto;


decl_type: tcc
theory: for_iterate
library: structures
signature: nil
location: 451 0 456 999
body:
  % Subtype TCC generated (at line 141, column 54) for  k
      % expected type  subrange(m, n)
  iterate_left_TCC1: OBLIGATION
    FORALL (m: int, n: upfrom(m), f: IterateBody(m, n), O: [[T, T] -> T],
            k: subrange(m + 1, n)):
      m <= k AND k <= n;


decl_type: tcc
theory: for_iterate
library: structures
signature: nil
location: 458 0 462 999
body:
  % Subtype TCC generated (at line 141, column 61) for  m
      % expected type  subrange(m, n)
  iterate_left_TCC2: OBLIGATION
    FORALL (m: int, n: upfrom(m), f: IterateBody(m, n), O: [[T, T] -> T]):
      m <= m AND m <= n;


decl_type: tcc
theory: for_iterate
library: structures
signature: nil
location: 464 0 468 999
body:
  % Subtype TCC generated (at line 149, column 11) for  0
      % expected type  upto(n - m)
  iterate_left_induction_TCC1: OBLIGATION
    FORALL (m: int, n: upfrom(m), f: IterateBody(m, n), O: [[T, T] -> T]):
      0 <= n - m;


decl_type: tcc
theory: for_iterate
library: structures
signature: nil
location: 470 0 475 999
body:
  % Subtype TCC generated (at line 150, column 40) for  k
      % expected type  upto(n - m)
  iterate_left_induction_TCC2: OBLIGATION
    FORALL (m: int, n: upfrom(m), f: IterateBody(m, n), O: [[T, T] -> T],
            inv: PRED[[upto(n - m), T]]):
      inv(0, f(m)) IMPLIES (FORALL (k: below(n - m), ak: T): k <= n - m);


decl_type: tcc
theory: for_iterate
library: structures
signature: nil
location: 477 0 483 999
body:
  % Subtype TCC generated (at line 150, column 58) for  k + 1
      % expected type  upto(n - m)
  iterate_left_induction_TCC3: OBLIGATION
    FORALL (m: int, n: upfrom(m), f: IterateBody(m, n), O: [[T, T] -> T],
            inv: PRED[[upto(n - m), T]]):
      inv(0, f(m)) IMPLIES
       (FORALL (k: below(n - m), ak: T): inv(k, ak) IMPLIES k + 1 <= n - m);


decl_type: tcc
theory: for_iterate
library: structures
signature: nil
location: 485 0 492 999
body:
  % Subtype TCC generated (at line 150, column 69) for  m + k + 1
      % expected type  subrange(m, n)
  iterate_left_induction_TCC4: OBLIGATION
    FORALL (m: int, n: upfrom(m), f: IterateBody(m, n), O: [[T, T] -> T],
            inv: PRED[[upto(n - m), T]]):
      inv(0, f(m)) IMPLIES
       (FORALL (k: below(n - m), ak: T):
          inv(k, ak) IMPLIES m <= m + k + 1 AND m + k + 1 <= n);


decl_type: tcc
theory: for_iterate
library: structures
signature: nil
location: 494 0 502 999
body:
  % Subtype TCC generated (at line 152, column 10) for  n - m
      % expected type  upto(n - m)
  iterate_left_induction_TCC5: OBLIGATION
    FORALL (m: int, n: upfrom(m), f: IterateBody(m, n), O: [[T, T] -> T],
            inv: PRED[[upto(n - m), T]]):
      (inv(0, f(m)) AND
        (FORALL (k: below(n - m), ak: T):
           inv(k, ak) IMPLIES inv(k + 1, ak o f(m + k + 1))))
       IMPLIES n - m >= 0 AND n - m <= n - m;


decl_type: tcc
theory: for_iterate
library: structures
signature: nil
location: 504 0 508 999
body:
  % Subtype TCC generated (at line 157, column 38) for  j
      % expected type  upfrom(1 + i)
  iterate_right_def_TCC1: OBLIGATION
    FORALL (i: int, j: upfrom(i), f: [int -> T], O: [[T, T] -> T]):
      NOT i = j IMPLIES j >= 1 + i;


decl_type: tcc
theory: for_iterate
library: structures
signature: nil
location: 510 0 514 999
body:
  % Termination TCC generated (at line 157, column 16) for
      % iterate_right_def(i + 1, j, f, o)
  iterate_right_def_TCC2: OBLIGATION
    FORALL (i: int, j: upfrom(i), f: [int -> T], O: [[T, T] -> T]):
      NOT i = j IMPLIES j - (i + 1) < j - i;


decl_type: tcc
theory: for_iterate
library: structures
signature: nil
location: 516 0 521 999
body:
  % Subtype TCC generated (at line 177, column 55) for  k
      % expected type  subrange(m, n)
  iterate_right_TCC1: OBLIGATION
    FORALL (m: int, n: upfrom(m), f: IterateBody(m, n), O: [[T, T] -> T],
            k: subrange(m, n - 1)):
      m <= k AND k <= n;


decl_type: tcc
theory: for_iterate
library: structures
signature: nil
location: 523 0 527 999
body:
  % Subtype TCC generated (at line 177, column 62) for  n
      % expected type  subrange(m, n)
  iterate_right_TCC2: OBLIGATION
    FORALL (m: int, n: upfrom(m), f: IterateBody(m, n), O: [[T, T] -> T]):
      m <= n AND n <= n;


decl_type: tcc
theory: for_iterate
library: structures
signature: nil
location: 529 0 534 999
body:
  % Subtype TCC generated (at line 186, column 40) for  k
      % expected type  upto(n - m)
  iterate_right_induction_TCC1: OBLIGATION
    FORALL (m: int, n: upfrom(m), f: IterateBody(m, n), O: [[T, T] -> T],
            inv: PRED[[upto(n - m), T]]):
      inv(0, f(n)) IMPLIES (FORALL (k: below(n - m), ak: T): k <= n - m);


decl_type: tcc
theory: for_iterate
library: structures
signature: nil
location: 536 0 542 999
body:
  % Subtype TCC generated (at line 186, column 58) for  k + 1
      % expected type  upto(n - m)
  iterate_right_induction_TCC2: OBLIGATION
    FORALL (m: int, n: upfrom(m), f: IterateBody(m, n), O: [[T, T] -> T],
            inv: PRED[[upto(n - m), T]]):
      inv(0, f(n)) IMPLIES
       (FORALL (k: below(n - m), ak: T): inv(k, ak) IMPLIES k + 1 <= n - m);


decl_type: tcc
theory: for_iterate
library: structures
signature: nil
location: 544 0 551 999
body:
  % Subtype TCC generated (at line 186, column 64) for  n - k - 1
      % expected type  subrange(m, n)
  iterate_right_induction_TCC3: OBLIGATION
    FORALL (m: int, n: upfrom(m), f: IterateBody(m, n), O: [[T, T] -> T],
            inv: PRED[[upto(n - m), T]]):
      inv(0, f(n)) IMPLIES
       (FORALL (k: below(n - m), ak: T):
          inv(k, ak) IMPLIES m <= n - k - 1 AND n - k - 1 <= n);


decl_type: tcc
theory: for_iterate
library: structures
signature: nil
location: 553 0 561 999
body:
  % Subtype TCC generated (at line 188, column 10) for  n - m
      % expected type  upto(n - m)
  iterate_right_induction_TCC4: OBLIGATION
    FORALL (m: int, n: upfrom(m), f: IterateBody(m, n), O: [[T, T] -> T],
            inv: PRED[[upto(n - m), T]]):
      (inv(0, f(n)) AND
        (FORALL (k: below(n - m), ak: T):
           inv(k, ak) IMPLIES inv(k + 1, f(n - k - 1) o ak)))
       IMPLIES n - m >= 0 AND n - m <= n - m;


decl_type: formula
theory: big_ops_nat
library: structures
signature: nil
location: 18 2 19 51
body:
    big_ops_nat_eq: LEMMA (FORALL (k:nat): i<=k AND k<=j IMPLIES F(k)=G(k))
      IMPLIES big_ops_nat(i,j,F) = big_ops_nat(i,j,G)


decl_type: formula
theory: big_ops_nat
library: structures
signature: nil
location: 21 2 22 83
body:
    big_ops_nat_expand_right: LEMMA
      big_ops_nat(i,j,F) = (IF i <= j THEN big_ops_nat(i,j-1,F) o F(j) ELSE id ENDIF)


decl_type: formula
theory: big_ops_nat
library: structures
signature: nil
location: 24 2 25 83
body:
    big_ops_nat_expand_left: LEMMA
      big_ops_nat(i,j,F) = (IF i <= j THEN F(i) o big_ops_nat(i+1,j,F) ELSE id ENDIF)


decl_type: formula
theory: big_ops_nat
library: structures
signature: nil
location: 27 2 29 66
body:
    big_ops_nat_split: LEMMA
      i-1<=z AND z<=j IMPLIES
      big_ops_nat(i,j,F) = big_ops_nat(i,z,F) o big_ops_nat(z+1,j,F)


decl_type: formula
theory: big_ops_nat
library: structures
signature: nil
location: 31 2 33 97
body:
    big_ops_nat_shift: LEMMA
      i+p>=0 IMPLIES 
      big_ops_nat(i+p,j+p,F) = big_ops_nat(i,j,LAMBDA (k:nat): IF k+p>=0 THEN F(k+p) ELSE id ENDIF)


decl_type: formula
theory: big_ops_nat
library: structures
signature: nil
location: 35 2 37 97
body:
    big_ops_nat_reverse: LEMMA
      commutative?[T](o) IMPLIES
      big_ops_nat(i,j,F) = big_ops_nat(i,j,LAMBDA (k:nat): IF i+j-k>=0 THEN F(i+j-k) ELSE id ENDIF)


decl_type: formula
theory: big_ops_nat
library: structures
signature: nil
location: 39 2 40 83
body:
    big_ops_nat_id : LEMMA
      (FORALL (k:nat): i<=k AND k<=j IMPLIES F(k) = id) IMPLIES big_ops_nat(i,j,F)=id


decl_type: formula
theory: big_ops_nat
library: structures
signature: nil
location: 42 2 46 3
body:
    big_ops_nat_comp: LEMMA
      commutative?[T](o) IMPLIES
      big_ops_nat(i,j,F) o big_ops_nat(i,j,G) = big_ops_nat(i,j,LAMBDA (k:nat): F(k) o G(k))

    ; * : VAR [[T,T]->T]


decl_type: formula
theory: big_ops_nat
library: structures
signature: nil
location: 48 2 51 70
body:
    big_ops_nat_distrib: LEMMA
      i<=j AND
      (FORALL (t1,t2,t3:T): t1 * (t2 o t3) = (t1 * t2) o (t1 * t3)) IMPLIES
      c * big_ops_nat(i,j,F) = big_ops_nat(i,j,LAMBDA (k:nat): c * F(k))


decl_type: tcc
theory: big_ops_nat
library: structures
signature: nil
location: 58 0 61 999
body:
  % Subtype TCC generated (at line 16, column 49) for  k
      % expected type  nat
  big_ops_nat_TCC1: OBLIGATION
    FORALL (i: nat, j: int, F: [nat -> T], k: subrange(i, j), t: T): k >= 0;


decl_type: tcc
theory: big_ops_nat
library: structures
signature: nil
location: 63 0 66 999
body:
  % Subtype TCC generated (at line 22, column 66) for  j
      % expected type  nat
  big_ops_nat_expand_right_TCC1: OBLIGATION
    FORALL (i: nat, j: int): i <= j IMPLIES j >= 0;


decl_type: formula
theory: for_examples
library: structures
signature: nil
location: 70 2 72 27
body:
    minit_sound : LEMMA
      FORALL (l:(cons?[real]),i:below(length(l))) :
         minit(l) <= nth(l,i) 


decl_type: function
theory: for_examples
library: structures
signature: [(cons?[real]) -> real]
location: 44 2 45 71
body:
    maxit(l:(cons?[real])) : real =
      iterate_left(0,length(l)-1,LAMBDA(i:below(length(l))):nth(l,i),max)


decl_type: function
theory: for_examples
library: structures
signature: [(cons?[real]) -> real]
location: 61 2 62 72
body:
    minit(l:(cons?[real])) : real =
      iterate_right(0,length(l)-1,LAMBDA(i:below(length(l))):nth(l,i),min)


decl_type: tcc
theory: for_examples
library: structures
signature: nil
location: 79 0 81 999
body:
  % Subtype TCC generated (at line 21, column 41) for  n
      % expected type  {i: int | x /= 0 OR i >= 0}
  expit_sound_TCC1: OBLIGATION FORALL (x: real, n: nat): x /= 0 OR n >= 0;


decl_type: tcc
theory: for_examples
library: structures
signature: nil
location: 83 0 85 999
body:
  % Subtype TCC generated (at line 45, column 19) for  length(l) - 1
      % expected type  upfrom(0)
  maxit_TCC1: OBLIGATION FORALL (l: (cons?[real])): length[real](l) - 1 >= 0;


decl_type: tcc
theory: for_examples
library: structures
signature: nil
location: 87 0 94 999
body:
  % Subtype TCC generated (at line 45, column 31) for
      % LAMBDA (i: below(length(l))): nth(l, i)
      % expected type  IterateBody[real](0, length(l) - 1)
  maxit_TCC2: OBLIGATION
    FORALL (l: (cons?[real])):
      FORALL (x: int):
        x >= 0 AND x < length[real](l) IFF
         0 <= x AND x <= length[real](l) - 1;


decl_type: function
theory: set_as_list
library: structures
location: 20 2 25 18
signature:
  [d: [list[T], list[T]] ->
          {b: bool |
                   b IFF
                    (FORALL x: member(x, d`1) => member(x, d`2))}]

body:
    subset_sl?(l1, l2): RECURSIVE {b : bool | b IFF FORALL x: member(x, l1) => member(x, l2) } =
    CASES l1 OF
          null : true,
          cons(a,q) : member(a,l2) AND subset_sl?(q,l2)
    ENDCASES
    MEASURE l1 BY <<


decl_type: function
theory: set_as_list
library: structures
location: 27 2 32 17
signature:
  [d: [T, list[T]] ->
          {ll: (nonempty_sl?) |
                   FORALL y:
                     member(y, ll) IFF (d`1 = y OR member(y, d`2))}]

body:
    add_sl(x, l): RECURSIVE { ll : (nonempty_sl?) | FORALL y: member(y,ll) IFF (x = y OR member(y, l))} =
    CASES l OF
          null : (:x:),
          cons(a,q) : IF x = a THEN l ELSE cons(a,add_sl(x,q)) ENDIF
    ENDCASES
    MEASURE l BY <<


decl_type: function
theory: set_as_list
library: structures
location: 34 2 39 17
signature:
  [d: [T, list[T]] ->
          {ll: list[T] |
                   FORALL y:
                     member(y, ll) IFF (d`1 /= y AND member(y, d`2))}]

body:
    remove_sl(x,l) : RECURSIVE { ll : list[T] | FORALL y: member(y, ll) IFF (x /= y AND member(y, l))} =
    CASES l OF
          null : null,
          cons(a,q) : IF x = a THEN remove_sl(x,q) ELSE cons(a,remove_sl(x,q)) ENDIF
    ENDCASES
    MEASURE l BY <<


decl_type: function
theory: set_as_list
library: structures
location: 41 2 42 42
signature:
  [d: [list[T], list[T]] ->
          {b: bool |
                   b IFF
                    (FORALL x: member(x, d`1) IFF member(x, d`2))}]

body:
    equal_sl(l1,l2): {b : bool | b IFF FORALL x: member(x, l1) IFF member(x, l2)} =
          subset_sl?(l1,l2) AND subset_sl?(l2,l1)


decl_type: function
theory: set_as_list
library: structures
location: 44 2 44 135
signature:
  [d: [list[T], list[T]] ->
          {b: bool |
                   b IFF
                    subset_sl?(d`1, d`2) & NOT equal_sl(d`2, d`1)}]

body:
    strict_subset_sl?(l1, l2): { b : bool | b IFF subset_sl?(l1, l2) & NOT equal_sl(l2,l1) } = subset_sl?(l1, l2) & NOT subset_sl?(l2,l1) 


decl_type: function
theory: set_as_list
library: structures
location: 46 2 51 18
signature:
  [d: [list[T], list[T]] ->
          {ll: list[T] |
                   FORALL x:
                     member(x, ll) IFF
                      (member(x, d`1) OR member(x, d`2))}]

body:
    union_sl(l1, l2): RECURSIVE {ll : list[T] | FORALL x: member(x,ll) IFF (member(x, l1) OR member(x, l2))} =
    CASES l1 OF
          null : l2,
          cons(a,q) : add_sl(a,union_sl(q,l2))
    ENDCASES
    MEASURE l1 BY <<


decl_type: function
theory: set_as_list
library: structures
location: 53 2 58 18
signature:
  [d: [list[T], list[T]] ->
          {ll: list[T] |
                   FORALL x:
                     member(x, ll) IFF
                      (member(x, d`1) AND member(x, d`2))}]

body:
    intersection_sl(l1, l2): RECURSIVE {ll : list[T] | FORALL x: member(x,ll) IFF (member(x,l1) AND member(x,l2))} =
    CASES l1 OF
          null : null,
          cons(a,q) : IF member(a,l2) THEN cons(a,intersection_sl(q,l2)) ELSE intersection_sl(q,l2) ENDIF
    ENDCASES
    MEASURE l1 BY <<


decl_type: function
theory: set_as_list
library: structures
location: 62 2 67 18
signature:
  [d: [list[T], list[T]] ->
          {ll: list[T] |
                   FORALL x:
                     member(x, ll) IFF
                      (member(x, d`1) AND NOT member(x, d`2))}]

body:
    difference_sl(l1, l2): RECURSIVE {ll : list[T] | FORALL x: member(x,ll) IFF (member(x, l1) AND NOT member(x, l2))} =
    CASES l1 OF
          null : null,
          cons(a,q) : IF member(a,l2) THEN difference_sl(q,l2) ELSE cons(a,difference_sl(q,l2)) ENDIF
    ENDCASES
    MEASURE l1 BY <<


decl_type: function
theory: set_as_list
library: structures
signature: [[list[T], list[T]] -> list[T]]
location: 69 2 70 58
body:
    symmetric_difference_sl(l1, l2): list[T] =
      union_sl(difference_sl(l1, l2), difference_sl(l2, l1))


decl_type: function
theory: set_as_list
library: structures
signature: [l: list[T] -> {s: finite_set[T] | s = ({x | member(x, l)})}]
location: 72 2 77 17
body:
    list2set(l) : RECURSIVE { s: finite_set[T] | s = { x | member(x,l)}} =
    CASES l OF 
          null : emptyset,
          cons(a,q) : add(a,list2set(q))
    ENDCASES
    MEASURE l BY <<


decl_type: function
theory: set_as_list
library: structures
signature: [l: list[T] -> {n: nat | n = Card(list2set(l))}]
location: 79 2 84 17
body:
    card_sl(l) : RECURSIVE {n : nat | n = Card(list2set(l)) } =
    CASES l OF
          null : 0,
          cons(a,q) : IF member(a,q) THEN card_sl(q) ELSE 1 + card_sl(q) ENDIF
    ENDCASES
    MEASURE l BY <<


decl_type: function
theory: set_as_list
library: structures
location: 86 2 91 17
signature:
  [l: list[T] ->
          {ll: list[T] |
                   equal_sl[T](l, ll) & card_sl(ll) = length(ll)}]

body:
    reduce_sl(l) : RECURSIVE {ll : list[T] | equal_sl[T](l,ll) & card_sl(ll) = length(ll)} =
    CASES l OF
          null : null,
          cons(a,q) : IF member(a,q) THEN reduce_sl(q) ELSE cons(a,reduce_sl(q)) ENDIF
    ENDCASES
    MEASURE l BY <<


decl_type: tcc
theory: set_as_list
library: structures
signature: nil
location: 100 0 107 999
body:
  % Subtype TCC generated (at line 22, column 10) for  TRUE
      % expected type  {b: bool |
                     %          b IFF
                     %           (FORALL x: member(x, l1) => member(x, l2))}
  subset_sl?_TCC1: OBLIGATION
    FORALL (l1: list[T], l2: list[T]):
      l1 = null IMPLIES
       (TRUE IFF (FORALL x: member[T](x, l1) => member[T](x, l2)));


decl_type: tcc
theory: set_as_list
library: structures
signature: nil
location: 109 0 112 999
body:
  % Termination TCC generated (at line 23, column 30) for  subset_sl?(q, l2)
  subset_sl?_TCC2: OBLIGATION
    FORALL (l1: list[T], l2: list[T], a: T, q: list[T]):
      member(a, l2) AND l1 = cons(a, q) IMPLIES <<[T](q, l1);


decl_type: tcc
theory: set_as_list
library: structures
signature: nil
location: 114 0 129 999
body:
  % Subtype TCC generated (at line 23, column 13) for
      % member(a, l2) AND subset_sl?(q, l2)
      % expected type  {b: bool |
                     %          b IFF
                     %           (FORALL x: member(x, l1) => member(x, l2))}
  subset_sl?_TCC3: OBLIGATION
    FORALL (l1: list[T],
            v:
              [d1: {z: [list[T], list[T]] | z`1 << l1} ->
                 {b: bool |
                          b IFF
                           (FORALL x: member(x, d1`1) => member(x, d1`2))}],
            l2: list[T], a: T, q: list[T]):
      l1 = cons(a, q) IMPLIES
       (member[T](a, l2) AND v(q, l2) IFF
         (FORALL x: member[T](x, l1) => member[T](x, l2)));


decl_type: tcc
theory: set_as_list
library: structures
signature: nil
location: 131 0 139 999
body:
  % Subtype TCC generated (at line 29, column 10) for  (: x :)
      % expected type  {ll: (nonempty_sl?) |
                     %          FORALL y:
                     %            member(y, ll) IFF (x = y OR member(y, l))}
  add_sl_TCC1: OBLIGATION
    FORALL (x: T, l: list[T]):
      l = null IMPLIES
       nonempty_sl?((: x :)) AND
        (FORALL y: member[T](y, (: x :)) IFF (x = y OR member[T](y, l)));


decl_type: tcc
theory: set_as_list
library: structures
signature: nil
location: 141 0 149 999
body:
  % Subtype TCC generated (at line 30, column 27) for  l
      % expected type  {ll: (nonempty_sl?) |
                     %          FORALL y:
                     %            member(y, ll) IFF (x = y OR member(y, l))}
  add_sl_TCC2: OBLIGATION
    FORALL (x: T, l: list[T], a: T, q: list[T]):
      x = a AND l = cons(a, q) IMPLIES
       nonempty_sl?(l) AND
        (FORALL y: member[T](y, l) IFF (x = y OR member[T](y, l)));


decl_type: tcc
theory: set_as_list
library: structures
signature: nil
location: 151 0 154 999
body:
  % Termination TCC generated (at line 30, column 41) for  add_sl(x, q)
  add_sl_TCC3: OBLIGATION
    FORALL (x: T, l: list[T], a: T, q: list[T]):
      NOT x = a AND l = cons(a, q) IMPLIES <<[T](q, l);


decl_type: tcc
theory: set_as_list
library: structures
signature: nil
location: 156 0 172 999
body:
  % Subtype TCC generated (at line 30, column 34) for  cons(a, add_sl(x, q))
      % expected type  {ll: (nonempty_sl?) |
                     %          FORALL y:
                     %            member(y, ll) IFF (x = y OR member(y, l))}
  add_sl_TCC4: OBLIGATION
    FORALL (x: T, l: list[T],
            v:
              [d1: {z: [T, list[T]] | z`2 << l} ->
                 {ll: (nonempty_sl?) |
                          FORALL y:
                            member(y, ll) IFF
                             (d1`1 = y OR member(y, d1`2))}],
            a: T, q: list[T]):
      NOT x = a AND l = cons(a, q) IMPLIES
       nonempty_sl?(cons[T](a, v(x, q))) AND
        (FORALL y:
           member[T](y, cons[T](a, v(x, q))) IFF (x = y OR member[T](y, l)));


decl_type: tcc
theory: set_as_list
library: structures
signature: nil
location: 174 0 181 999
body:
  % Subtype TCC generated (at line 36, column 10) for  null
      % expected type  {ll: list[T] |
                     %          FORALL y:
                     %            member(y, ll) IFF (x /= y AND member(y, l))}
  remove_sl_TCC1: OBLIGATION
    FORALL (x: T, l: list[T]):
      l = null IMPLIES
       (FORALL y: member[T](y, null[T]) IFF (x /= y AND member[T](y, l)));


decl_type: tcc
theory: set_as_list
library: structures
signature: nil
location: 183 0 186 999
body:
  % Termination TCC generated (at line 37, column 27) for  remove_sl(x, q)
  remove_sl_TCC2: OBLIGATION
    FORALL (x: T, l: list[T], a: T, q: list[T]):
      x = a AND l = cons(a, q) IMPLIES <<[T](q, l);


decl_type: tcc
theory: set_as_list
library: structures
signature: nil
location: 188 0 202 999
body:
  % Subtype TCC generated (at line 37, column 27) for  remove_sl(x, q)
      % expected type  {ll: list[T] |
                     %          FORALL y:
                     %            member(y, ll) IFF (x /= y AND member(y, l))}
  remove_sl_TCC3: OBLIGATION
    FORALL (x: T, l: list[T], a: T, q: list[T]):
      x = a AND l = cons(a, q) IMPLIES
       (FORALL y,
               (v:
                  [d1: {z: [T, list[T]] | <<[T](z`2, l)} ->
                     {ll: list[T] |
                              FORALL (y_1: T):
                                member[T](y_1, ll) IFF
                                 (d1`1 /= y_1 AND member[T](y_1, d1`2))}]):
          member[T](y, v(x, q)) IFF (x /= y AND member[T](y, l)));


decl_type: tcc
theory: set_as_list
library: structures
signature: nil
location: 204 0 219 999
body:
  % Subtype TCC generated (at line 37, column 47) for
      % cons(a, remove_sl(x, q))
      % expected type  {ll: list[T] |
                     %          FORALL y:
                     %            member(y, ll) IFF (x /= y AND member(y, l))}
  remove_sl_TCC4: OBLIGATION
    FORALL (x: T, l: list[T], a: T, q: list[T]):
      NOT x = a AND l = cons(a, q) IMPLIES
       (FORALL y,
               (v:
                  [d1: {z: [T, list[T]] | <<[T](z`2, l)} ->
                     {ll: list[T] |
                              FORALL (y_1: T):
                                member[T](y_1, ll) IFF
                                 (d1`1 /= y_1 AND member[T](y_1, d1`2))}]):
          member[T](y, cons[T](a, v(x, q))) IFF (x /= y AND member[T](y, l)));


decl_type: tcc
theory: set_as_list
library: structures
signature: nil
location: 221 0 229 999
body:
  % Subtype TCC generated (at line 42, column 3) for
      % subset_sl?(l1, l2) AND subset_sl?(l2, l1)
      % expected type  {b: bool |
                     %          b IFF
                     %           (FORALL x: member(x, l1) IFF member(x, l2))}
  equal_sl_TCC1: OBLIGATION
    FORALL (l1: list[T], l2: list[T]):
      subset_sl?(l1, l2) AND subset_sl?(l2, l1) IFF
       (FORALL x: member[T](x, l1) IFF member[T](x, l2));


decl_type: tcc
theory: set_as_list
library: structures
signature: nil
location: 231 0 239 999
body:
  % Subtype TCC generated (at line 44, column 93) for
      % subset_sl?(l1, l2) & NOT subset_sl?(l2, l1)
      % expected type  {b: bool |
                     %          b IFF
                     %           subset_sl?(l1, l2) & NOT equal_sl(l2, l1)}
  strict_subset_sl?_TCC1: OBLIGATION
    FORALL (l1: list[T], l2: list[T]):
      subset_sl?(l1, l2) & NOT subset_sl?(l2, l1) IFF
       subset_sl?(l1, l2) & NOT equal_sl(l2, l1);


decl_type: tcc
theory: set_as_list
library: structures
signature: nil
location: 241 0 250 999
body:
  % Subtype TCC generated (at line 48, column 10) for  l2
      % expected type  {ll: list[T] |
                     %          FORALL x:
                     %            member(x, ll) IFF
                     %             (member(x, l1) OR member(x, l2))}
  union_sl_TCC1: OBLIGATION
    FORALL (l1: list[T], l2: list[T]):
      l1 = null IMPLIES
       (FORALL x:
          member[T](x, l2) IFF (member[T](x, l1) OR member[T](x, l2)));


decl_type: tcc
theory: set_as_list
library: structures
signature: nil
location: 252 0 255 999
body:
  % Termination TCC generated (at line 49, column 22) for  union_sl(q, l2)
  union_sl_TCC2: OBLIGATION
    FORALL (l1: list[T], a: T, q: list[T]):
      l1 = cons(a, q) IMPLIES <<[T](q, l1);


decl_type: tcc
theory: set_as_list
library: structures
signature: nil
location: 257 0 275 999
body:
  % Subtype TCC generated (at line 49, column 13) for
      % add_sl(a, union_sl(q, l2))
      % expected type  {ll: list[T] |
                     %          FORALL x:
                     %            member(x, ll) IFF
                     %             (member(x, l1) OR member(x, l2))}
  union_sl_TCC3: OBLIGATION
    FORALL (l1: list[T], l2: list[T], a: T, q: list[T]):
      l1 = cons(a, q) IMPLIES
       (FORALL x,
               (v:
                  [d1: {z: [list[T], list[T]] | <<[T](z`1, l1)} ->
                     {ll: list[T] |
                              FORALL (x_1: T):
                                member[T](x_1, ll) IFF
                                 (member[T](x_1, d1`1) OR
                                   member[T](x_1, d1`2))}]):
          member[T](x, add_sl(a, v(q, l2))) IFF
           (member[T](x, l1) OR member[T](x, l2)));


decl_type: tcc
theory: set_as_list
library: structures
signature: nil
location: 277 0 286 999
body:
  % Subtype TCC generated (at line 55, column 10) for  null
      % expected type  {ll: list[T] |
                     %          FORALL x:
                     %            member(x, ll) IFF
                     %             (member(x, l1) AND member(x, l2))}
  intersection_sl_TCC1: OBLIGATION
    FORALL (l1: list[T], l2: list[T]):
      l1 = null IMPLIES
       (FORALL x:
          member[T](x, null[T]) IFF (member[T](x, l1) AND member[T](x, l2)));


decl_type: tcc
theory: set_as_list
library: structures
signature: nil
location: 288 0 306 999
body:
  % Subtype TCC generated (at line 56, column 34) for
      % cons(a, intersection_sl(q, l2))
      % expected type  {ll: list[T] |
                     %          FORALL x:
                     %            member(x, ll) IFF
                     %             (member(x, l1) AND member(x, l2))}
  intersection_sl_TCC2: OBLIGATION
    FORALL (l1: list[T], l2: list[T], a: T, q: list[T]):
      member(a, l2) AND l1 = cons(a, q) IMPLIES
       (FORALL x,
               (v:
                  [d1: {z: [list[T], list[T]] | <<[T](z`1, l1)} ->
                     {ll: list[T] |
                              FORALL (x_1: T):
                                member[T](x_1, ll) IFF
                                 (member[T](x_1, d1`1) AND
                                   member[T](x_1, d1`2))}]):
          member[T](x, cons[T](a, v(q, l2))) IFF
           (member[T](x, l1) AND member[T](x, l2)));


decl_type: tcc
theory: set_as_list
library: structures
signature: nil
location: 308 0 324 999
body:
  % Subtype TCC generated (at line 56, column 69) for  intersection_sl(q, l2)
      % expected type  {ll: list[T] |
                     %          FORALL x:
                     %            member(x, ll) IFF
                     %             (member(x, l1) AND member(x, l2))}
  intersection_sl_TCC3: OBLIGATION
    FORALL (l1: list[T], l2: list[T], a: T, q: list[T]):
      NOT member(a, l2) AND l1 = cons(a, q) IMPLIES
       (FORALL x,
               (v:
                  [d1: {z: [list[T], list[T]] | <<[T](z`1, l1)} ->
                     {ll: list[T] |
                              FORALL (x_1: T):
                                member[T](x_1, ll) IFF
                                 (member[T](x_1, d1`1) AND
                                   member[T](x_1, d1`2))}]):
          member[T](x, v(q, l2)) IFF (member[T](x, l1) AND member[T](x, l2)));


decl_type: tcc
theory: set_as_list
library: structures
signature: nil
location: 326 0 336 999
body:
  % Subtype TCC generated (at line 64, column 10) for  null
      % expected type  {ll: list[T] |
                     %          FORALL x:
                     %            member(x, ll) IFF
                     %             (member(x, l1) AND NOT member(x, l2))}
  difference_sl_TCC1: OBLIGATION
    FORALL (l1: list[T], l2: list[T]):
      l1 = null IMPLIES
       (FORALL x:
          member[T](x, null[T]) IFF
           (member[T](x, l1) AND NOT member[T](x, l2)));


decl_type: tcc
theory: set_as_list
library: structures
signature: nil
location: 338 0 355 999
body:
  % Subtype TCC generated (at line 65, column 34) for  difference_sl(q, l2)
      % expected type  {ll: list[T] |
                     %          FORALL x:
                     %            member(x, ll) IFF
                     %             (member(x, l1) AND NOT member(x, l2))}
  difference_sl_TCC2: OBLIGATION
    FORALL (l1: list[T], l2: list[T], a: T, q: list[T]):
      member(a, l2) AND l1 = cons(a, q) IMPLIES
       (FORALL x,
               (v:
                  [d1: {z: [list[T], list[T]] | <<[T](z`1, l1)} ->
                     {ll: list[T] |
                              FORALL (x_1: T):
                                member[T](x_1, ll) IFF
                                 (member[T](x_1, d1`1) AND
                                   NOT member[T](x_1, d1`2))}]):
          member[T](x, v(q, l2)) IFF
           (member[T](x, l1) AND NOT member[T](x, l2)));


decl_type: tcc
theory: set_as_list
library: structures
signature: nil
location: 357 0 375 999
body:
  % Subtype TCC generated (at line 65, column 59) for
      % cons(a, difference_sl(q, l2))
      % expected type  {ll: list[T] |
                     %          FORALL x:
                     %            member(x, ll) IFF
                     %             (member(x, l1) AND NOT member(x, l2))}
  difference_sl_TCC3: OBLIGATION
    FORALL (l1: list[T], l2: list[T], a: T, q: list[T]):
      NOT member(a, l2) AND l1 = cons(a, q) IMPLIES
       (FORALL x,
               (v:
                  [d1: {z: [list[T], list[T]] | <<[T](z`1, l1)} ->
                     {ll: list[T] |
                              FORALL (x_1: T):
                                member[T](x_1, ll) IFF
                                 (member[T](x_1, d1`1) AND
                                   NOT member[T](x_1, d1`2))}]):
          member[T](x, cons[T](a, v(q, l2))) IFF
           (member[T](x, l1) AND NOT member[T](x, l2)));


decl_type: tcc
theory: set_as_list
library: structures
signature: nil
location: 377 0 381 999
body:
  % Subtype TCC generated (at line 74, column 10) for  emptyset
      % expected type  {s: finite_set[T] | s = ({x | member(x, l)})}
  list2set_TCC1: OBLIGATION
    FORALL (l: list[T]):
      l = null IMPLIES emptyset[T] = ({x | member[T](x, l)});


decl_type: tcc
theory: set_as_list
library: structures
signature: nil
location: 383 0 391 999
body:
  % Subtype TCC generated (at line 75, column 13) for  add(a, list2set(q))
      % expected type  {s: finite_set[T] | s = ({x | member(x, l)})}
  list2set_TCC2: OBLIGATION
    FORALL (l: list[T],
            v:
              [l1: {z: list[T] | z << l} ->
                 {s: finite_set[T] | s = ({x | member(x, l1)})}],
            a: T, q: list[T]):
      l = cons(a, q) IMPLIES add[T](a, v(q)) = ({x | member[T](x, l)});


decl_type: tcc
theory: set_as_list
library: structures
signature: nil
location: 393 0 396 999
body:
  % Subtype TCC generated (at line 81, column 10) for  0
      % expected type  {n: nat | n = Card(list2set(l))}
  card_sl_TCC1: OBLIGATION
    FORALL (l: list[T]): l = null IMPLIES 0 = Card[T](list2set(l));


decl_type: tcc
theory: set_as_list
library: structures
signature: nil
location: 398 0 406 999
body:
  % Subtype TCC generated (at line 82, column 33) for  card_sl(q)
      % expected type  {n: nat | n = Card(list2set(l))}
  card_sl_TCC2: OBLIGATION
    FORALL (l: list[T],
            v:
              [l1: {z: list[T] | z << l} ->
                 {n: nat | n = Card(list2set(l1))}],
            a: T, q: list[T]):
      member(a, q) AND l = cons(a, q) IMPLIES v(q) = Card[T](list2set(l));


decl_type: tcc
theory: set_as_list
library: structures
signature: nil
location: 408 0 417 999
body:
  % Subtype TCC generated (at line 82, column 49) for  1 + card_sl(q)
      % expected type  {n: nat | n = Card(list2set(l))}
  card_sl_TCC3: OBLIGATION
    FORALL (l: list[T],
            v:
              [l1: {z: list[T] | z << l} ->
                 {n: nat | n = Card(list2set(l1))}],
            a: T, q: list[T]):
      NOT member(a, q) AND l = cons(a, q) IMPLIES
       1 + v(q) = Card[T](list2set(l));


decl_type: tcc
theory: set_as_list
library: structures
signature: nil
location: 419 0 425 999
body:
  % Subtype TCC generated (at line 88, column 10) for  null
      % expected type  {ll: list[T] |
                     %          equal_sl[T](l, ll) & card_sl(ll) = length(ll)}
  reduce_sl_TCC1: OBLIGATION
    FORALL (l: list[T]):
      l = null IMPLIES
       equal_sl[T](l, null[T]) & card_sl(null[T]) = length[T](null[T]);


decl_type: tcc
theory: set_as_list
library: structures
signature: nil
location: 427 0 438 999
body:
  % Subtype TCC generated (at line 89, column 33) for  reduce_sl(q)
      % expected type  {ll: list[T] |
                     %          equal_sl[T](l, ll) & card_sl(ll) = length(ll)}
  reduce_sl_TCC2: OBLIGATION
    FORALL (l: list[T],
            v:
              [l1: {z: list[T] | z << l} ->
                 {ll: list[T] |
                          equal_sl[T](l1, ll) & card_sl(ll) = length(ll)}],
            a: T, q: list[T]):
      member(a, q) AND l = cons(a, q) IMPLIES
       equal_sl[T](l, v(q)) & card_sl(v(q)) = length[T](v(q));


decl_type: tcc
theory: set_as_list
library: structures
signature: nil
location: 440 0 452 999
body:
  % Subtype TCC generated (at line 89, column 51) for  cons(a, reduce_sl(q))
      % expected type  {ll: list[T] |
                     %          equal_sl[T](l, ll) & card_sl(ll) = length(ll)}
  reduce_sl_TCC3: OBLIGATION
    FORALL (l: list[T],
            v:
              [l1: {z: list[T] | z << l} ->
                 {ll: list[T] |
                          equal_sl[T](l1, ll) & card_sl(ll) = length(ll)}],
            a: T, q: list[T]):
      NOT member(a, q) AND l = cons(a, q) IMPLIES
       equal_sl[T](l, cons[T](a, v(q))) &
        card_sl(cons[T](a, v(q))) = length[T](cons[T](a, v(q)));


decl_type: formula
theory: set_as_list_props
library: structures
signature: nil
location: 8 2 8 111
body:
    strict_subset_card_lt : LEMMA FORALL (s1,s2 : finite_set) : strict_subset?(s1,s2) IMPLIES card(s1) < card(s2)


decl_type: formula
theory: set_as_list_props
library: structures
signature: nil
location: 30 2 30 101
body:
    intersection_l2s : LEMMA list2set(intersection_sl(l1,l2)) = intersection(list2set(l1),list2set(l2))


decl_type: formula
theory: set_as_list_props
library: structures
signature: nil
location: 36 2 37 94
body:
    symmetric_difference_l2s : LEMMA 
                  list2set(symmetric_difference_sl(l1,l2)) = symmetric_difference(list2set(l1),list2set(l2))


decl_type: formula
theory: set_as_list_props
library: structures
signature: nil
location: 59 2 61 30
body:
    strict_subset_sl_transitive: LEMMA
      strict_subset_sl?(l1, l) AND strict_subset_sl?(l, l2) IMPLIES
       strict_subset_sl?(l1, l2)


decl_type: judgement
theory: set_as_list_props
library: structures
signature: (strict_order?[list[T]])
location: 65 2 66 58
body:
    strict_subset_sl_is_strict_order: JUDGEMENT
      strict_subset_sl?[T] HAS_TYPE (strict_order?[list[T]])


decl_type: tcc
theory: set_as_list_props
library: structures
signature: nil
location: 81 0 83 999
body:
  % Judgement subtype TCC generated (at line 49, column 4) for  subset_sl?[T]
      % expected type  (preorder?[list[T]])
  subset_sl_is_preorder: OBLIGATION preorder?[list[T]](subset_sl?[T]);


decl_type: tcc
theory: set_as_list_props
library: structures
signature: nil
location: 85 0 89 999
body:
  % Judgement subtype TCC generated (at line 66, column 4) for
      % strict_subset_sl?[T]
      % expected type  (strict_order?[list[T]])
  strict_subset_sl_is_strict_order: OBLIGATION
    strict_order?[list[T]](strict_subset_sl?[T]);


decl_type: tcc
theory: set_as_list_props
library: structures
signature: nil
location: 91 0 95 999
body:
  % Judgement subtype TCC generated (at line 71, column 4) for
      % strict_subset_sl?[T]
      % expected type  (well_founded?[list[T]])
  strict_subset_sl_is_wf: OBLIGATION
    well_founded?[list[T]](strict_subset_sl?[T]);


decl_type: formula
theory: more_list_props
library: structures
signature: nil
location: 108 2 109 92
body:
    list_extensionality : LEMMA
      l1=l2 IFF length(l1) = length(l2) AND FORALL(n:below(length(l1))): nth(l1,n) = nth(l2,n)


decl_type: formula
theory: more_list_props
library: structures
signature: nil
location: 115 2 121 34
body:
    list_pigeonhole: THEOREM
        every(A)(B) AND 
        length(B) > card(A)
      IMPLIES
        EXISTS (n:below[length(B)], m:below[length(B)]):
           n /= m 
           AND nth(B, n) = nth(B, m)  


decl_type: formula
theory: more_list_props
library: structures
signature: nil
location: 123 3 127 35
body:
     nth_append : LEMMA
       FORALL(i:nat): i < length(l1)+length(l2) IMPLIES
         nth(append(l1,l2),i) = IF i < length(l1) THEN nth(l1,i)
                                ELSE nth(l2,i-length(l1))
                                ENDIF


decl_type: formula
theory: more_list_props
library: structures
signature: nil
location: 141 2 142 64
body:
    reverse_def: LEMMA FORALL (j:nat): 
      j<length(L) IMPLIES nth(reverse(L),j) = nth(L,length(L)-1-j)


decl_type: function
theory: more_list_props
library: structures
signature: [[list[T], list[T]] -> bool]
location: 31 2 47 21
body:
    prefix?(x: list[T], 
            y: list[T]): RECURSIVE bool = 
      IF length(y) < length(x) THEN FALSE 
      ELSE 
        CASES x OF
          null: TRUE,
          cons(sigma_x, x1):
            CASES y OF
              null: FALSE,
              cons(sigma_y, y1): 
                IF sigma_x = sigma_y AND prefix?(x1, y1) THEN TRUE
                ELSE FALSE
                ENDIF
            ENDCASES
        ENDCASES
      ENDIF
      MEASURE length(x)


decl_type: function
theory: more_list_props
library: structures
signature: [[list[T], list[T]] -> bool]
location: 50 2 70 1
body:
    suffix?(x: list[T], 
            y: list[T]): RECURSIVE bool = 
      IF length(y) < length(x) THEN FALSE 
      ELSE 
        CASES reverse(x) OF
          null: TRUE,
          cons(sigma_x, x1):
            CASES reverse(y) OF
              null: FALSE,
              cons(sigma_y, y1): 
                IF sigma_x = sigma_y AND suffix?(x1, y1) THEN TRUE
                ELSE FALSE
                ENDIF
            ENDCASES
        ENDCASES
      ENDIF
      MEASURE length(x)


  %Multiple concatenation of a list: w^3 means (: w  w  w :).
  ;


decl_type: function
theory: more_list_props
library: structures
signature: [[list[T], nat] -> list[T]]
location: 71 2 81 1
body:
    ^(l1, n): RECURSIVE list[T] = 
      IF n = 0 THEN (null)
      ELSE append( l1, ^(l1, n-1) )
      ENDIF
      MEASURE n


  % Just like for sequences, a sub-list can be extracted with the operator '^'.
  % Note that ^ allows any natural numbers m and n to define the range; 
  % if m > n then the empty sequence is returned.
  ;


decl_type: function
theory: more_list_props
library: structures
signature: [[list[T], [nat, nat]] -> list[T]]
location: 82 2 89 62
body:
    ^(l1, pair): RECURSIVE list[T] =
      LET (m, n) = pair
       IN IF m > n OR m >= length(l1) OR m < 0
          THEN null
          ELSIF m = n THEN cons( nth(l1, m), null)
          ELSE cons( nth(l1, m), ^(l1, (m+1, n)))
          ENDIF
    MEASURE IF pair`2 > pair`1 THEN pair`2 - pair`1 ELSE 0 ENDIF


decl_type: tcc
theory: more_list_props
library: structures
signature: nil
location: 158 0 166 999
body:
  % Termination TCC generated (at line 41, column 39) for  prefix?(x1, y1)
  prefix?_TCC1: OBLIGATION
    FORALL (x, y: list[T]):
      NOT length(y) < length(x) IMPLIES
       (FORALL (sigma_x: T, x1: list[T]):
          x = cons(sigma_x, x1) IMPLIES
           (FORALL (sigma_y: T, y1: list[T]):
              sigma_x = sigma_y AND y = cons(sigma_y, y1) IMPLIES
               length[T](x1) < length[T](x)));


decl_type: tcc
theory: more_list_props
library: structures
signature: nil
location: 168 0 176 999
body:
  % Termination TCC generated (at line 60, column 39) for  suffix?(x1, y1)
  suffix?_TCC1: OBLIGATION
    FORALL (x, y: list[T]):
      NOT length(y) < length(x) IMPLIES
       (FORALL (sigma_x: T, x1: list[T]):
          reverse(x) = cons(sigma_x, x1) IMPLIES
           (FORALL (sigma_y: T, y1: list[T]):
              sigma_x = sigma_y AND reverse(y) = cons(sigma_y, y1) IMPLIES
               length[T](x1) < length[T](x)));


decl_type: tcc
theory: more_list_props
library: structures
signature: nil
location: 178 0 180 999
body:
  % Subtype TCC generated (at line 73, column 27) for  n - 1
      % expected type  nat
  caret_TCC1: OBLIGATION FORALL (n: nat): NOT n = 0 IMPLIES n - 1 >= 0;


