# Declarations

decl_type: tcc
theory: function_image_nonempty
library: fault_tolerance
signature: nil
location: 29 0 33 999
body:
  % Judgement subtype TCC generated (at line 14, column 4) for  image(f, S)
      % expected type  non_empty_finite_set[R]
  nonempty_finite_image: OBLIGATION
    FORALL ((S: non_empty_finite_set[D]), f):
      NOT empty?[R](image[D, R](f, S));


decl_type: tcc
theory: clock_minmax
library: fault_tolerance
signature: nil
location: 46 0 54 999
body:
  % Judgement subtype TCC generated (at line 32, column 29) for
      % clock_min(participant)
      % expected type  good_clock[rho]
  clock_min_clock: OBLIGATION
    FORALL (participant, T):
      1 / rate[rho] <=
       clock_min(participant)(1 + T) - clock_min(participant)(T)
       AND
       clock_min(participant)(1 + T) - clock_min(participant)(T) <= rate[rho];


decl_type: tcc
theory: clock_minmax
library: fault_tolerance
signature: nil
location: 56 0 64 999
body:
  % Judgement subtype TCC generated (at line 33, column 29) for
      % clock_max(participant)
      % expected type  good_clock[rho]
  clock_max_clock: OBLIGATION
    FORALL (participant, T):
      1 / rate[rho] <=
       clock_max(participant)(1 + T) - clock_max(participant)(T)
       AND
       clock_max(participant)(1 + T) - clock_max(participant)(T) <= rate[rho];


decl_type: function
theory: synch_parameter_constraints
library: fault_tolerance
signature:
  [[posnat, nonneg_real, nonneg_real, nonneg_real, nonneg_real] ->
  bool]

location: 12 2 13 83
body:
    P_bound?(P, rho, alpha_l, alpha_u, pi): bool =
      (1 + rho) * (pi + max(alpha_l, alpha_u) + P * ((1 + rho) - 1 / (1 + rho)))  < P


decl_type: tcc
theory: synch_constant_definitions
library: fault_tolerance
signature: nil
location: 73 0 75 999
body:
  % Subtype TCC generated (at line 50, column 18) for  P - ADJ
      % expected type  posnat
  P_min_TCC1: OBLIGATION P - ADJ >= 0 AND P - ADJ > 0;


decl_type: tcc
theory: synch_constant_definitions
library: fault_tolerance
signature: nil
location: 77 0 80 999
body:
  % Subtype TCC generated (at line 55, column 21) for  P / rate - alpha_l
      % expected type  posreal
  p_lower_TCC1: OBLIGATION
    P / rate[rho] - alpha_l >= 0 AND P / rate[rho] - alpha_l > 0;


decl_type: tcc
theory: synch_constant_definitions
library: fault_tolerance
signature: nil
location: 82 0 87 999
body:
  % Subtype TCC generated (at line 58, column 19) for
      % P / rate - alpha_l - pi_0
      % expected type  posreal
  p_min_TCC1: OBLIGATION
    P / rate[rho] - alpha_l - pi_0 >= 0 AND
     P / rate[rho] - alpha_l - pi_0 > 0;


decl_type: tcc
theory: synch_constant_definitions
library: fault_tolerance
signature: nil
location: 89 0 95 999
body:
  % Subtype TCC generated (at line 66, column 15) for
      % ceiling(rate * (max(alpha_l, alpha_u) + pi_0 + drift * (P_max + 1)))
      % expected type  posnat
  Pi_TCC1: OBLIGATION
    ceiling(rate[rho] *
             (max(alpha_l, alpha_u) + pi_0 + drift[rho] * (P_max + 1)))
     > 0;


decl_type: formula
theory: synch_protocol_invariants
library: fault_tolerance
signature: nil
location: 58 2 60 49
body:
    all_periodic_precision_iff_peer_precision: LEMMA
      all_periodic_precision?(hst, pi) IFF
      peer_precision?(ic_min(hst), ic_max(hst), pi)


decl_type: formula
theory: synch_protocol_invariants
library: fault_tolerance
signature: nil
location: 62 2 66 38
body:
    all_periodic_precision: LEMMA
        initial_precision?(hst, pi) AND
        periodic_precision_enhancement?(hst, pi)
      IMPLIES
        all_periodic_precision?(hst, pi)


decl_type: formula
theory: synch_protocol_invariants
library: fault_tolerance
signature: nil
location: 68 2 72 64
body:
    minmax_adjustment_lower_bound: LEMMA
        all_periodic_precision?(hst, pi) AND
        lower_accuracy_preservation?(hst, pl)
      IMPLIES
        adjustment_lower_bound?(ic_max(hst), ic_min(hst), pl - pi)


decl_type: formula
theory: synch_protocol_invariants
library: fault_tolerance
signature: nil
location: 74 2 78 64
body:
    minmax_adjustment_upper_bound: LEMMA
        all_periodic_precision?(hst, pi) AND
        upper_accuracy_preservation?(hst, pu)
      IMPLIES
        adjustment_upper_bound?(ic_min(hst), ic_max(hst), pu + pi)


decl_type: formula
theory: synch_protocol_invariants
library: fault_tolerance
signature: nil
location: 87 2 90 33
body:
    min_le_trace: LEMMA
      trace?(ic, hst) IMPLIES
  %    ic_min(hst)(j)(T) <= ic(j)(T) 
      t(ic_min(hst))(j) <= t(ic)(j) 


decl_type: formula
theory: synch_protocol_invariants
library: fault_tolerance
signature: nil
location: 92 2 95 33
body:
    trace_le_max: LEMMA
      trace?(ic, hst) IMPLIES
  %    ic(j)(T) <= ic_max(hst)(j)(T)
      t(ic)(j) <= t(ic_max(hst))(j)


decl_type: formula
theory: synch_protocol_invariants
library: fault_tolerance
signature: nil
location: 97 2 102 74
body:
    trace_diff: LEMMA
        trace?(ic1, hst1) AND
        trace?(ic2, hst2)
      IMPLIES
  %      ic1(j1)(T1) - ic2(j2)(T2) <= ic_max(hst1)(j1)(T1) - ic_min(hst2)(j2)(T2)
        t(ic1)(j1) - t(ic2)(j2) <= t(ic_max(hst1))(j1) - t(ic_min(hst2))(j2)


decl_type: formula
theory: synch_protocol_invariants
library: fault_tolerance
signature: nil
location: 104 2 110 35
body:
    traces_peer_precision: LEMMA
        trace?(ic1, hst) AND
        trace?(ic2, hst) AND
        initial_precision?(hst, pi) AND
        periodic_precision_enhancement?(hst, pi)
      IMPLIES
        peer_precision?(ic1, ic2, pi)


decl_type: formula
theory: synch_protocol_invariants
library: fault_tolerance
signature: nil
location: 112 2 119 48
body:
    traces_lower: LEMMA
        trace?(ic1, hst) AND
        trace?(ic2, hst) AND
        initial_precision?(hst, pi) AND
        periodic_precision_enhancement?(hst, pi) AND
        lower_accuracy_preservation?(hst, pl)
      IMPLIES
        adjustment_lower_bound?(ic1, ic2, pl - pi)


decl_type: formula
theory: synch_protocol_invariants
library: fault_tolerance
signature: nil
location: 121 2 128 48
body:
    traces_upper: LEMMA
        trace?(ic1, hst) AND
        trace?(ic2, hst) AND
        initial_precision?(hst, pi) AND
        periodic_precision_enhancement?(hst, pi) AND
        upper_accuracy_preservation?(hst, pu)
      IMPLIES
        adjustment_upper_bound?(ic1, ic2, pu + pi)


decl_type: formula
theory: synch_protocol_invariants
library: fault_tolerance
signature: nil
location: 132 2 138 45
body:
    traces_compatible: LEMMA
        trace?(ic1, hst) AND
        trace?(ic2, hst) AND
        initial_precision?(hst, pi) AND
        synch_protocol_invariants?(hst, pi, P / rate - al, P * rate + au)
      IMPLIES
        compatible?(ic1, ic2, pi + max(al, au))


decl_type: formula
theory: synch_protocol_invariants
library: fault_tolerance
signature: nil
location: 140 2 145 39
body:
    trace_lower_accuracy: LEMMA
        trace?(ic, hst) AND
        initial_precision?(hst, pi) AND
        synch_protocol_invariants?(hst, pi, P / rate - al, pu)
      IMPLIES
        lower_accuracy_bound?(ic, al, pi)


decl_type: formula
theory: synch_protocol_invariants
library: fault_tolerance
signature: nil
location: 147 2 152 39
body:
    trace_upper_accuracy: LEMMA
        trace?(ic, hst) AND
        initial_precision?(hst, pi) AND
        synch_protocol_invariants?(hst, pi, pl, P * rate + au)
      IMPLIES
        upper_accuracy_bound?(ic, au, pi)


decl_type: formula
theory: synch_protocol_invariants
library: fault_tolerance
signature: nil
location: 156 2 161 40
body:
    trace_weakly_accurate: LEMMA
        trace?(ic, hst) AND
        initial_precision?(hst, pi_0) AND
        synch_protocol_invariants?(hst, pi_0, p_lower, p_upper)
      IMPLIES
        weakly_accurate?(ic, p_min, p_max)


decl_type: function
theory: synch_protocol_invariants
library: fault_tolerance
signature:
  [[[nat -> non_empty_finite_set[good_clock[rho]]], nat, nnreal] ->
  bool]

location: 30 2 32 47
body:
    periodic_precision?(hst, j, pi): bool =
  %    ic_max(hst)(j)(T(j)) - ic_min(hst)(j)(T(j)) <= pi
      t(ic_max(hst))(j) - t(ic_min(hst))(j) <= pi


decl_type: function
theory: synch_protocol_invariants
library: fault_tolerance
signature:
  [[[nat -> non_empty_finite_set[good_clock[rho]]], nnreal] ->
  bool]

location: 36 2 40 41
body:
    periodic_precision_enhancement?(hst, pi): bool =
      FORALL j:
        periodic_precision?(hst, j, pi)
      IMPLIES
        periodic_precision?(hst, j + 1, pi)


decl_type: function
theory: synch_protocol_invariants
library: fault_tolerance
signature:
  [[[nat -> non_empty_finite_set[good_clock[rho]]], real] ->
  bool]

location: 42 2 43 57
body:
    lower_accuracy_preservation?(hst, pl): bool =
      adjustment_lower_bound?(ic_min(hst), ic_min(hst), pl)


decl_type: function
theory: synch_protocol_invariants
library: fault_tolerance
signature:
  [[[nat -> non_empty_finite_set[good_clock[rho]]], real] ->
  bool]

location: 45 2 46 57
body:
    upper_accuracy_preservation?(hst, pu): bool =
      adjustment_upper_bound?(ic_max(hst), ic_max(hst), pu)


decl_type: function
theory: synch_protocol_invariants
library: fault_tolerance
signature:
  [[[nat -> non_empty_finite_set[good_clock[rho]]], nnreal, real,
  real] ->
  bool]

location: 48 2 51 41
body:
    synch_protocol_invariants?(hst, pi, pl, pu): bool =
      periodic_precision_enhancement?(hst, pi) AND
      lower_accuracy_preservation?(hst, pl) AND
      upper_accuracy_preservation?(hst, pu)


decl_type: function
theory: synch_protocol_invariants
library: fault_tolerance
location: 85 2 85 49
body: trace?(ic, hst): bool = FORALL j: hst(j)(ic(j))
signature:
  [[interval_clock[P, T0, rho],
         [nat -> non_empty_finite_set[good_clock[rho]]]] ->
          bool]


decl_type: formula
theory: virtual_clock_2
library: fault_tolerance
signature: nil
location: 40 2 43 33
body:
    t_nonoverlap: LEMMA
        compatible?(ac1, ac2, pi_0 + max(alpha_l, alpha_u))
      IMPLIES
        nonoverlap?(t(ac1), t(ac2))


decl_type: formula
theory: virtual_clock_2
library: fault_tolerance
signature: nil
location: 47 2 50 45
body:
    t_cross: LEMMA
        compatible?(ac1, ac2, pi_0 + max(alpha_l, alpha_u))
      IMPLIES
        cross_adjustment?(ac1, ADJ + 1)(t(ac2))


decl_type: formula
theory: virtual_clock_2
library: fault_tolerance
signature: nil
location: 58 2 65 44
body:
    VC2_precision: THEOREM
        trace?(ic1, hst) AND
        trace?(ic2, hst) AND
        initial_precision?(hst, pi_0) AND
        synch_protocol_invariants?(hst, pi_0, p_lower, p_upper) AND
        max(t(ic1)(0),t(ic2)(0)) <= t1
      IMPLIES
        abs(VC2(ic1)(t1) - VC2(ic2)(t1)) <= Pi


decl_type: formula
theory: virtual_clock_2
library: fault_tolerance
signature: nil
location: 67 2 75 34
body:
    VC2_accuracy_lower: THEOREM
        trace?(ic, hst) AND
        initial_precision?(hst, pi_0) AND
        synch_protocol_invariants?(hst, pi_0, p_lower, p_upper) AND
        t(ic)(0) <= t1
      IMPLIES 
        ((t1 - t(ic)(0)) * (1 - alpha_u / p_lower) 
          - pi_0 * (1 + alpha_u / p_lower)) / rate 
            < 1 + VC2(ic)(t1) - T(0)


decl_type: formula
theory: virtual_clock_2
library: fault_tolerance
signature: nil
location: 77 2 85 34
body:
    VC2_optimal_accuracy_lower: COROLLARY
        alpha_u = 0 AND
        trace?(ic, hst) AND
        initial_precision?(hst, pi_0) AND
        synch_protocol_invariants?(hst, pi_0, p_lower, p_upper) AND
        t(ic)(0) <= t1
      IMPLIES 
        ((t1 - t(ic)(0)) - pi_0) / rate 
            < 1 + VC2(ic)(t1) - T(0)


decl_type: formula
theory: virtual_clock_2
library: fault_tolerance
signature: nil
location: 87 2 95 54
body:
    VC2_accuracy_upper: THEOREM
        trace?(ic, hst) AND
        initial_precision?(hst, pi_0) AND
        synch_protocol_invariants?(hst, pi_0, p_lower, p_upper) AND
        t(ic)(0) <= t1
      IMPLIES 
        VC2(ic)(t1) - T(0) 
           <= ((t1 - t(ic)(0)) * (1 + alpha_l / p_lower)
                + pi_0 * (1 + alpha_l / p_lower)) * rate


decl_type: formula
theory: virtual_clock_2
library: fault_tolerance
signature: nil
location: 97 2 105 43
body:
    VC2_optimal_accuracy_upper: COROLLARY
        alpha_l = 0 AND
        trace?(ic, hst) AND
        initial_precision?(hst, pi_0) AND
        synch_protocol_invariants?(hst, pi_0, p_lower, p_upper) AND
        t(ic)(0) <= t1
      IMPLIES 
        VC2(ic)(t1) - T(0) 
           <= ((t1 - t(ic)(0)) + pi_0) * rate


decl_type: tcc
theory: virtual_clock_2
library: fault_tolerance
signature: nil
location: 112 0 116 999
body:
  % Judgement subtype TCC generated (at line 38, column 30) for  t(ac)
      % expected type  event_sequence
  t_event_sequence: OBLIGATION
    FORALL (ac):
      increasing?(t[P, T0, rho](ac)) AND unbounded?(t[P, T0, rho](ac));


decl_type: tcc
theory: virtual_clock_2
library: fault_tolerance
signature: nil
location: 118 0 131 999
body:
  % Subtype TCC generated (at line 65, column 14) for  ic1
      % expected type  weakly_accurate_clock
                     %     [P, T0, rho, alpha_l, alpha_u, pi_0]
  VC2_precision_TCC1: OBLIGATION
    FORALL (hst: [nat -> non_empty_finite_set[good_clock[rho]]],
            ic1, ic2: interval_clock[P, T0, rho], t1: real):
           max(t(ic1)(0), t(ic2)(0)) <= t1
       AND synch_protocol_invariants?(hst, pi_0, p_lower, p_upper)
       AND initial_precision?(hst, pi_0) AND trace?(ic2, hst)
       AND trace?(ic1, hst)
       IMPLIES
       weakly_accurate?[P, T0, rho]
           (ic1, p_min[P, T0, rho, alpha_l, alpha_u, pi_0],
            p_max[P, T0, rho, alpha_l, alpha_u, pi_0]);


decl_type: tcc
theory: virtual_clock_2
library: fault_tolerance
signature: nil
location: 133 0 146 999
body:
  % Subtype TCC generated (at line 65, column 29) for  ic2
      % expected type  weakly_accurate_clock
                     %     [P, T0, rho, alpha_l, alpha_u, pi_0]
  VC2_precision_TCC2: OBLIGATION
    FORALL (hst: [nat -> non_empty_finite_set[good_clock[rho]]],
            ic1, ic2: interval_clock[P, T0, rho], t1: real):
           max(t(ic1)(0), t(ic2)(0)) <= t1
       AND synch_protocol_invariants?(hst, pi_0, p_lower, p_upper)
       AND initial_precision?(hst, pi_0) AND trace?(ic2, hst)
       AND trace?(ic1, hst)
       IMPLIES
       weakly_accurate?[P, T0, rho]
           (ic2, p_min[P, T0, rho, alpha_l, alpha_u, pi_0],
            p_max[P, T0, rho, alpha_l, alpha_u, pi_0]);


decl_type: tcc
theory: virtual_clock_2
library: fault_tolerance
signature: nil
location: 148 0 160 999
body:
  % Subtype TCC generated (at line 75, column 20) for  ic
      % expected type  weakly_accurate_clock
                     %     [P, T0, rho, alpha_l, alpha_u, pi_0]
  VC2_accuracy_lower_TCC1: OBLIGATION
    FORALL (hst: [nat -> non_empty_finite_set[good_clock[rho]]],
            ic: interval_clock[P, T0, rho], t1: real):
      t(ic)(0) <= t1 AND
       synch_protocol_invariants?(hst, pi_0, p_lower, p_upper) AND
        initial_precision?(hst, pi_0) AND trace?(ic, hst)
       IMPLIES
       weakly_accurate?[P, T0, rho]
           (ic, p_min[P, T0, rho, alpha_l, alpha_u, pi_0],
            p_max[P, T0, rho, alpha_l, alpha_u, pi_0]);


decl_type: formula
theory: virtual_clock_1
library: fault_tolerance
signature: nil
location: 45 2 49 41
body:
    turns_nonoverlap: LEMMA
        compatible?(ac1, ac2, pi_0 + max(alpha_l, alpha_u)) AND
        compatible?(ac2, ac1, pi_0 + max(alpha_l, alpha_u))
      IMPLIES
        nonoverlap?(turns(ac1), turns(ac2))


decl_type: formula
theory: virtual_clock_1
library: fault_tolerance
signature: nil
location: 53 2 57 49
body:
    turns_cross: LEMMA
         compatible?(ac1, ac2, pi_0 + max(alpha_l, alpha_u)) AND
         compatible?(ac2, ac1, pi_0 + max(alpha_l, alpha_u))
      IMPLIES
        cross_adjustment?(ac1, ADJ + 1)(turns(ac2))


decl_type: formula
theory: virtual_clock_1
library: fault_tolerance
signature: nil
location: 65 2 72 44
body:
    VC1_precision: THEOREM
        trace?(ic1, hst) AND
        trace?(ic2, hst) AND
        initial_precision?(hst, pi_0) AND
        synch_protocol_invariants?(hst, pi_0, p_lower, p_upper) AND
        max(t(ic1)(0),t(ic2)(0)) <= t1
      IMPLIES
        abs(VC1(ic1)(t1) - VC1(ic2)(t1)) <= Pi


decl_type: formula
theory: virtual_clock_1
library: fault_tolerance
signature: nil
location: 74 2 83 34
body:
    VC1_accuracy_lower: THEOREM
        trace?(ic, hst) AND
        initial_precision?(hst, pi_0) AND
        synch_protocol_invariants?(hst, pi_0, p_lower, p_upper) AND
        t(ic)(0) <= t1
      IMPLIES 
        ((t1 - t(ic)(0)) *  (1 - (alpha_u / p_lower)) 
          - pi_0 * (1 + alpha_u / p_lower)
          - (drift + rate * (alpha_u / p_lower)) * (1 + ADJ)) / rate
            < 1 + VC1(ic)(t1) - T(0)


decl_type: formula
theory: virtual_clock_1
library: fault_tolerance
signature: nil
location: 85 2 94 40
body:
    VC1_optimal_accuracy_lower: COROLLARY
        alpha_u = 0 AND
        trace?(ic, hst) AND
        initial_precision?(hst, pi_0) AND
        synch_protocol_invariants?(hst, pi_0, p_lower, p_upper) AND
        t(ic)(0) <= t1
      IMPLIES 
        ((t1 - t(ic)(0)) - pi_0) / rate 
            - drift * (1 + ADJ) / rate
                  < 1 + VC1(ic)(t1) - T(0)


decl_type: formula
theory: virtual_clock_1
library: fault_tolerance
signature: nil
location: 96 2 105 68
body:
    VC1_accuracy_upper: THEOREM
        trace?(ic, hst) AND
        initial_precision?(hst, pi_0) AND
        synch_protocol_invariants?(hst, pi_0, p_lower, p_upper) AND
        t(ic)(0) <= t1
      IMPLIES 
        VC1(ic)(t1) - T(0) 
           <= ((t1 - t(ic)(0)) * (1 + alpha_l / p_lower) 
               + pi_0 * (1 + alpha_l / p_lower)) * rate
               + (1 + ADJ) * (drift + rate * alpha_l / p_lower) * rate


decl_type: formula
theory: virtual_clock_1
library: fault_tolerance
signature: nil
location: 107 2 116 40
body:
    VC1_optimal_accuracy_upper: COROLLARY
        alpha_l = 0 AND
        trace?(ic, hst) AND
        initial_precision?(hst, pi_0) AND
        synch_protocol_invariants?(hst, pi_0, p_lower, p_upper) AND
        t(ic)(0) <= t1
      IMPLIES 
        VC1(ic)(t1) - T(0) 
           <= ((t1 - t(ic)(0)) + pi_0) * rate
                + (1 + ADJ) * drift * rate


decl_type: tcc
theory: virtual_clock_1
library: fault_tolerance
signature: nil
location: 123 0 128 999
body:
  % Subtype TCC generated (at line 39, column 57) for  k - 1
      % expected type  nat
  turns_TCC1: OBLIGATION
    FORALL (ac: weakly_accurate_clock[P, T0, rho, alpha_l, alpha_u, pi_0],
            k: nat):
      NOT k = 0 IMPLIES k - 1 >= 0;


decl_type: tcc
theory: virtual_clock_1
library: fault_tolerance
signature: nil
location: 130 0 133 999
body:
  % Judgement subtype TCC generated (at line 43, column 34) for  turns(ac)
      % expected type  event_sequence
  turns_event_sequence: OBLIGATION
    FORALL (ac): increasing?(turns(ac)) AND unbounded?(turns(ac));


decl_type: tcc
theory: virtual_clock_1
library: fault_tolerance
signature: nil
location: 135 0 137 999
body:
  % Subtype TCC generated (at line 63, column 51) for  j - 1
      % expected type  nat
  VC1_j_TCC1: OBLIGATION FORALL (j: posint): j - 1 >= 0;


decl_type: tcc
theory: virtual_clock_1
library: fault_tolerance
signature: nil
location: 139 0 152 999
body:
  % Subtype TCC generated (at line 72, column 14) for  ic1
      % expected type  weakly_accurate_clock
                     %     [P, T0, rho, alpha_l, alpha_u, pi_0]
  VC1_precision_TCC1: OBLIGATION
    FORALL (hst: [nat -> non_empty_finite_set[good_clock[rho]]],
            ic1, ic2: interval_clock[P, T0, rho], t1: real):
           max(t(ic1)(0), t(ic2)(0)) <= t1
       AND synch_protocol_invariants?(hst, pi_0, p_lower, p_upper)
       AND initial_precision?(hst, pi_0) AND trace?(ic2, hst)
       AND trace?(ic1, hst)
       IMPLIES
       weakly_accurate?[P, T0, rho]
           (ic1, p_min[P, T0, rho, alpha_l, alpha_u, pi_0],
            p_max[P, T0, rho, alpha_l, alpha_u, pi_0]);


decl_type: tcc
theory: virtual_clock_1
library: fault_tolerance
signature: nil
location: 154 0 167 999
body:
  % Subtype TCC generated (at line 72, column 29) for  ic2
      % expected type  weakly_accurate_clock
                     %     [P, T0, rho, alpha_l, alpha_u, pi_0]
  VC1_precision_TCC2: OBLIGATION
    FORALL (hst: [nat -> non_empty_finite_set[good_clock[rho]]],
            ic1, ic2: interval_clock[P, T0, rho], t1: real):
           max(t(ic1)(0), t(ic2)(0)) <= t1
       AND synch_protocol_invariants?(hst, pi_0, p_lower, p_upper)
       AND initial_precision?(hst, pi_0) AND trace?(ic2, hst)
       AND trace?(ic1, hst)
       IMPLIES
       weakly_accurate?[P, T0, rho]
           (ic2, p_min[P, T0, rho, alpha_l, alpha_u, pi_0],
            p_max[P, T0, rho, alpha_l, alpha_u, pi_0]);


decl_type: tcc
theory: virtual_clock_1
library: fault_tolerance
signature: nil
location: 169 0 181 999
body:
  % Subtype TCC generated (at line 83, column 20) for  ic
      % expected type  weakly_accurate_clock
                     %     [P, T0, rho, alpha_l, alpha_u, pi_0]
  VC1_accuracy_lower_TCC1: OBLIGATION
    FORALL (hst: [nat -> non_empty_finite_set[good_clock[rho]]],
            ic: interval_clock[P, T0, rho], t1: real):
      t(ic)(0) <= t1 AND
       synch_protocol_invariants?(hst, pi_0, p_lower, p_upper) AND
        initial_precision?(hst, pi_0) AND trace?(ic, hst)
       IMPLIES
       weakly_accurate?[P, T0, rho]
           (ic, p_min[P, T0, rho, alpha_l, alpha_u, pi_0],
            p_max[P, T0, rho, alpha_l, alpha_u, pi_0]);


decl_type: formula
theory: relations_extra
library: fault_tolerance
signature: nil
location: 51 2 54 61
body:
    well_founded: LEMMA FORALL (R: (well_founded?)):
      FORALL p:
        (EXISTS y: p(y))
          IMPLIES EXISTS (y: (p)): FORALL (x: (p)): NOT R(x, y)


decl_type: judgement
theory: relations_extra
library: fault_tolerance
signature: (partial_order?)
location: 64 2 65 67
body:
    strict_order_to_partial_order: JUDGEMENT
      reflexive_closure(R: (strict_order?)) HAS_TYPE (partial_order?)


decl_type: judgement
theory: relations_extra
library: fault_tolerance
signature: (total_order?)
location: 70 2 71 71
body:
    strict_total_order_to_total_order: JUDGEMENT
      reflexive_closure(R: (strict_total_order?)) HAS_TYPE (total_order?)


decl_type: judgement
theory: relations_extra
library: fault_tolerance
signature: (strict_order?)
location: 73 2 74 68
body:
    partial_order_to_strict_order: JUDGEMENT
      irreflexive_kernel(R: (partial_order?)) HAS_TYPE (strict_order?)


decl_type: judgement
theory: relations_extra
library: fault_tolerance
signature: (strict_total_order?)
location: 79 2 80 72
body:
    total_order_to_strict_total_order: JUDGEMENT
      irreflexive_kernel(R: (total_order?)) HAS_TYPE (strict_total_order?)


decl_type: tcc
theory: relations_extra
library: fault_tolerance
signature: nil
location: 90 0 93 999
body:
  % Judgement subtype TCC generated (at line 23, column 4) for  x
      % expected type  (asymmetric?)
  strict_order_is_asymmetric: OBLIGATION
    FORALL (x: (strict_order?)): asymmetric?(x);


decl_type: tcc
theory: relations_extra
library: fault_tolerance
signature: nil
location: 95 0 98 999
body:
  % Judgement subtype TCC generated (at line 26, column 4) for  x
      % expected type  (antisymmetric?)
  asymmetric_is_antisymmetric: OBLIGATION
    FORALL (x: (asymmetric?)): antisymmetric?[T](x);


decl_type: tcc
theory: relations_extra
library: fault_tolerance
signature: nil
location: 100 0 103 999
body:
  % Judgement subtype TCC generated (at line 29, column 4) for  x
      % expected type  (irreflexive?)
  asymmetric_is_irreflexive: OBLIGATION
    FORALL (x: (asymmetric?)): irreflexive?[T](x);


decl_type: tcc
theory: relations_extra
library: fault_tolerance
signature: nil
location: 105 0 108 999
body:
  % Judgement subtype TCC generated (at line 49, column 4) for  x
      % expected type  (trichotomous?)
  dichotomous_is_trichotomous: OBLIGATION
    FORALL (x: (dichotomous?)): trichotomous?[T](x);


decl_type: tcc
theory: relations_extra
library: fault_tolerance
signature: nil
location: 110 0 113 999
body:
  % Subtype TCC generated (at line 56, column 39) for  union(R, =)
      % expected type  (reflexive?)
  reflexive_closure_TCC1: OBLIGATION
    FORALL (R: pred[[T, T]]): reflexive?[T](union[[T, T]](R, =));


decl_type: tcc
theory: relations_extra
library: fault_tolerance
signature: nil
location: 115 0 118 999
body:
  % Subtype TCC generated (at line 57, column 42) for  difference(R, =)
      % expected type  (irreflexive?)
  irreflexive_kernel_TCC1: OBLIGATION
    FORALL (R: pred[[T, T]]): irreflexive?[T](difference[[T, T]](R, =));


decl_type: tcc
theory: relations_extra
library: fault_tolerance
signature: nil
location: 120 0 124 999
body:
  % Subtype TCC generated (at line 58, column 39) for  union(R, converse(R))
      % expected type  (symmetric?)
  symmetric_closure_TCC1: OBLIGATION
    FORALL (R: pred[[T, T]]):
      symmetric?[T](union[[T, T]](R, converse[T, T](R)));


decl_type: tcc
theory: relations_extra
library: fault_tolerance
signature: nil
location: 126 0 131 999
body:
  % Subtype TCC generated (at line 59, column 38) for
      % intersection(R, converse(R))
      % expected type  (symmetric?)
  symmetric_kernel_TCC1: OBLIGATION
    FORALL (R: pred[[T, T]]):
      symmetric?[T](intersection[[T, T]](R, converse[T, T](R)));


decl_type: tcc
theory: relations_extra
library: fault_tolerance
signature: nil
location: 133 0 137 999
body:
  % Judgement subtype TCC generated (at line 62, column 4) for
      % reflexive_closure(R)
      % expected type  (preorder?)
  reflexive_closure_preserves_transitive: OBLIGATION
    FORALL (R: (transitive?)): preorder?[T](reflexive_closure(R));


decl_type: tcc
theory: relations_extra
library: fault_tolerance
signature: nil
location: 139 0 143 999
body:
  % Judgement subtype TCC generated (at line 65, column 4) for
      % reflexive_closure(R)
      % expected type  (partial_order?)
  strict_order_to_partial_order: OBLIGATION
    FORALL (R: (strict_order?)): partial_order?[T](reflexive_closure(R));


decl_type: tcc
theory: relations_extra
library: fault_tolerance
signature: nil
location: 145 0 149 999
body:
  % Judgement subtype TCC generated (at line 68, column 4) for
      % reflexive_closure(R)
      % expected type  (dichotomous?)
  reflexive_closure_dichotomous: OBLIGATION
    FORALL (R: (trichotomous?)): dichotomous?[T](reflexive_closure(R));


decl_type: tcc
theory: relations_extra
library: fault_tolerance
signature: nil
location: 151 0 155 999
body:
  % Judgement subtype TCC generated (at line 71, column 4) for
      % reflexive_closure(R)
      % expected type  (total_order?)
  strict_total_order_to_total_order: OBLIGATION
    FORALL (R: (strict_total_order?)): total_order?[T](reflexive_closure(R));


decl_type: tcc
theory: relations_extra
library: fault_tolerance
signature: nil
location: 157 0 161 999
body:
  % Judgement subtype TCC generated (at line 74, column 4) for
      % irreflexive_kernel(R)
      % expected type  (strict_order?)
  partial_order_to_strict_order: OBLIGATION
    FORALL (R: (partial_order?)): strict_order?[T](irreflexive_kernel(R));


decl_type: tcc
theory: relations_extra
library: fault_tolerance
signature: nil
location: 163 0 167 999
body:
  % Judgement subtype TCC generated (at line 77, column 4) for
      % irreflexive_kernel(R)
      % expected type  (trichotomous?)
  irreflexive_kernel_trichotomous: OBLIGATION
    FORALL (R: (dichotomous?)): trichotomous?[T](irreflexive_kernel(R));


decl_type: tcc
theory: relations_extra
library: fault_tolerance
signature: nil
location: 169 0 173 999
body:
  % Judgement subtype TCC generated (at line 80, column 4) for
      % irreflexive_kernel(R)
      % expected type  (strict_total_order?)
  total_order_to_strict_total_order: OBLIGATION
    FORALL (R: (total_order?)): strict_total_order?[T](irreflexive_kernel(R));


decl_type: tcc
theory: relations_extra
library: fault_tolerance
signature: nil
location: 175 0 179 999
body:
  % Judgement subtype TCC generated (at line 83, column 4) for
      % symmetric_kernel(R)
      % expected type  (equivalence?)
  symmetric_kernel_of_preorder: OBLIGATION
    FORALL (R: (preorder?)): equivalence?[T](symmetric_kernel(R));


decl_type: tcc
theory: finite_sets_below_extra
library: fault_tolerance
signature: nil
location: 23 0 26 999
body:
  % Judgement subtype TCC generated (at line 16, column 33) for  x
      % expected type  finite_set[below(N)]
  set_below_is_finite: OBLIGATION
    FORALL (x: set[below(N)]): is_finite[below(N)](x);


decl_type: formula
theory: node
library: fault_tolerance
signature: nil
location: 49 2 52 63
body:
    enabled_symmetric_uniform: LEMMA
        enabled_symmetric?(nodes, v1, v2) 
      IMPLIES
        uniform_nodes(nodes, v1, t) = uniform_nodes(nodes, v2, t)


decl_type: formula
theory: node
library: fault_tolerance
signature: nil
location: 82 2 85 45
body:
    vec2seq_agreement: LEMMA
        enabled_symmetric?(nodes, v1, v2)
      IMPLIES
        vec2seq(v1, nodes) = vec2seq(v2, nodes)


decl_type: function
theory: node
library: fault_tolerance
signature: [[vec, nodeid_set] -> finite_sequence[T]]
location: 76 2 80 6
body:
    vec2seq(v, nodes): finite_sequence[T] =
      (# length := card(nodes),
         seq := LAMBDA (i: below(card(nodes))): 
           IF empty?(nodes) THEN choose({t:T|TRUE}) ELSE v(m(nodes)(i)) ENDIF 
      #)


decl_type: tcc
theory: node
library: fault_tolerance
signature: nil
location: 94 0 100 999
body:
  % Existence TCC generated (at line 71, column 2) for
      % m(enabled): (bijective?[below(card(enabled)), (enabled)])
  m_TCC1: OBLIGATION
    EXISTS (x:
              [enabled: nodeid_nonempty ->
                 (bijective?[below(card[below(N)](enabled)), (enabled)])]):
      TRUE;


decl_type: tcc
theory: node
library: fault_tolerance
signature: nil
location: 102 0 106 999
body:
  % Subtype TCC generated (at line 79, column 38) for  {t: T | TRUE}
      % expected type  p: (nonempty?[T])
  vec2seq_TCC1: OBLIGATION
    FORALL (nodes: nodeid_set, i: below(card[below(N)](nodes))):
      empty?(nodes) IMPLIES nonempty?[T]({t: T | TRUE});


decl_type: tcc
theory: node
library: fault_tolerance
signature: nil
location: 108 0 112 999
body:
  % Judgement subtype TCC generated (at line 87, column 26) for
      % vec2seq(v, enabled)
      % expected type  ne_seqs[T]
  vec2seq_type: OBLIGATION
    FORALL (enabled, v): length(vec2seq(v, enabled)) > 0;


decl_type: formula
theory: select_minmax
library: fault_tolerance
signature: nil
location: 41 2 43 48
body:
    min_le_max_alt: LEMMA
      v_max(v, node_set) = v_min(v, node_set) IFF
        (v_max(v, node_set) <= v_min(v, node_set))


decl_type: formula
theory: select_minmax
library: fault_tolerance
signature: nil
location: 45 2 47 74
body:
    v_minmax_choose: LEMMA
      uniform?(v, t)(node_set) IFF 
        (v_max(v, node_set) = v_min(v, node_set) AND v_min(v, node_set) = t)


decl_type: formula
theory: select_minmax
library: fault_tolerance
signature: nil
location: 49 2 51 59
body:
    v_minmax_choose_alt: LEMMA
      uniform?(v, t)(node_set) IFF 
        (v_max(v, node_set) <= t AND t <= v_min(v, node_set))


decl_type: tcc
theory: select_minmax
library: fault_tolerance
signature: nil
location: 58 0 62 999
body:
  % Subtype TCC generated (at line 22, column 30) for  image(v, node_set)
      % expected type  SS: non_empty_finite_set[T]
  v_min_TCC1: OBLIGATION
    FORALL (v: vec[N, T], node_set: non_empty_finite_set[below(N)]):
      NOT empty?[T](image[below(N), T](v, node_set));


decl_type: function
theory: tau_declaration
library: fault_tolerance
signature: [nat -> tau_type]
location: 19 2 19 103
body:
    weber(n): tau_type = LAMBDA pn: IF  floor(n/2) < pn AND pn <= n THEN pn - 1 - floor(n/2) ELSE 0 ENDIF


decl_type: tcc
theory: tau_declaration
library: fault_tolerance
signature: nil
location: 26 0 28 999
body:
  % Subtype TCC generated (at line 15, column 30) for  0
      % expected type  {t: nat | 2 * t < pn}
  nada_TCC1: OBLIGATION FORALL (pn): 2 * 0 < pn;


decl_type: tcc
theory: tau_declaration
library: fault_tolerance
signature: nil
location: 30 0 33 999
body:
  % Subtype TCC generated (at line 16, column 29) for  floor((pn - 1) / 2)
      % expected type  {t: nat | 2 * t < pn}
  mid_TCC1: OBLIGATION
    FORALL (pn): floor((pn - 1) / 2) >= 0 AND 2 * floor((pn - 1) / 2) < pn;


decl_type: tcc
theory: tau_declaration
library: fault_tolerance
signature: nil
location: 35 0 37 999
body:
  % Subtype TCC generated (at line 17, column 29) for  floor(pn / 3)
      % expected type  {t: nat | 2 * t < pn}
  byz_TCC1: OBLIGATION FORALL (pn): 2 * floor(pn / 3) < pn;


decl_type: tcc
theory: tau_declaration
library: fault_tolerance
signature: nil
location: 39 0 44 999
body:
  % Subtype TCC generated (at line 19, column 71) for  pn - 1 - floor(n / 2)
      % expected type  {t: nat | 2 * t < pn}
  weber_TCC1: OBLIGATION
    FORALL (n: nat, pn):
      floor(n / 2) < pn AND pn <= n IMPLIES
       pn - 1 - floor(n / 2) >= 0 AND 2 * (pn - 1 - floor(n / 2)) < pn;


decl_type: formula
theory: pigeonhole
library: fault_tolerance
signature: nil
location: 15 2 18 29
body:
    pigeonhole: THEOREM
        card(A) + card(B) > card(union(A, B)) 
      IMPLIES
        EXISTS x: A(x) AND B(x)


decl_type: formula
theory: pigeonhole
library: fault_tolerance
signature: nil
location: 20 2 21 75
body:
    card_difference_alt: LEMMA
      card(difference(S, C)) <= n IFF card(intersection(S, C)) >= card(S) - n


decl_type: formula
theory: pigeonhole
library: fault_tolerance
signature: nil
location: 23 2 28 29
body:
    pigeonhole_difference: THEOREM
        subset?(A, S) AND
        card(A) > n AND
        card(difference(S, B)) <= n
      IMPLIES
        EXISTS x: A(x) AND B(x)


decl_type: formula
theory: pigeonhole
library: fault_tolerance
signature: nil
location: 36 2 37 70
body:
    simple_majority_subset: LEMMA
      simple_majority?(A, S) IFF majority_subset?(intersection(A, S), S)


decl_type: formula
theory: pigeonhole
library: fault_tolerance
signature: nil
location: 54 2 60 29
body:
    majority_pigeonhole: THEOREM
        2 * card(A) > card(S) AND 
        subset?(A, S) AND
        2 * card(B) >= card(S) AND 
        subset?(B, S) 
      IMPLIES
        EXISTS x: A(x) AND B(x)


decl_type: formula
theory: pigeonhole
library: fault_tolerance
signature: nil
location: 62 2 66 29
body:
    simple_majority_pigeonhole: THEOREM
        simple_majority?(A, S) AND 
        simple_majority?(B, S)
      IMPLIES
        EXISTS x: A(x) AND B(x)


decl_type: formula
theory: pigeonhole
library: fault_tolerance
signature: nil
location: 68 2 73 29
body:
    median_pigeonhole: LEMMA
        majority_subset?(A, S1) AND
        majority_subset?(B, S2) AND
        card(union(S1, S2)) - card(intersection(S1, S2)) <= 1
      IMPLIES
        EXISTS x: A(x) AND B(x)


decl_type: formula
theory: pigeonhole
library: fault_tolerance
signature: nil
location: 93 2 98 29
body:
    two_thirds_overlap_pigeonhole: LEMMA
        two_thirds_majority_subset?(A, S1) AND
        two_thirds_majority_subset?(B, S2) AND
        intersection_majority?(S1, S2)
      IMPLIES
        EXISTS x: A(x) AND B(x)


decl_type: function
theory: pigeonhole
library: fault_tolerance
signature: [[finite_set[T], finite_set[T], finite_set[T]] -> bool]
location: 88 2 90 52
body:
    byzantine_intersection_majority?(S1, S2, S3): bool =
      2 * card(intersection(S1, intersection(S2, S3))) >
        card(union(S1, S2)) + card(difference(S2, S3))


decl_type: tcc
theory: pigeonhole
library: fault_tolerance
signature: nil
location: 129 0 132 999
body:
  % Subtype TCC generated (at line 108, column 53) for  card(s1)
      % expected type  pn: posnat
  quorum?_TCC1: OBLIGATION
    FORALL (s1: finite_set[T]): NOT empty?(s1) IMPLIES card[T](s1) > 0;


decl_type: tcc
theory: pigeonhole
library: fault_tolerance
signature: nil
location: 134 0 136 999
body:
  % Subtype TCC generated (at line 115, column 36) for  card(e)
      % expected type  pn: posnat
  M_TCC1: OBLIGATION FORALL (e: non_empty_finite_set[T]): card[T](e) > 0;


decl_type: tcc
theory: pigeonhole
library: fault_tolerance
signature: nil
location: 138 0 144 999
body:
  % Subtype TCC generated (at line 115, column 20) for
      % card(e) - 2 * t(card(e))
      % expected type  posnat
  M_TCC2: OBLIGATION
    FORALL (e: non_empty_finite_set[T], t: tau_type):
      card[T](e) - 2 * t(card[T](e)) >= 0 AND
       card[T](e) - 2 * t(card[T](e)) > 0;


decl_type: type
theory: finite_seqs
library: fault_tolerance
signature: nil
location: 26 2 26 101
body:
    majority_function: TYPE = [fs: finite_sequence[T] -> {t: T | maj_exists(fs) => is_majority(t, fs)}]


decl_type: function
theory: finite_seqs
library: fault_tolerance
signature: [finite_sequence[T] -> T]
location: 45 2 48 9
body:
    majority_choose2(fs): T = 
      IF fs`length = 0 THEN choose({t:T | TRUE})
      ELSE majority_choose(fs)
      ENDIF


decl_type: tcc
theory: finite_seqs
library: fault_tolerance
signature: nil
location: 66 0 69 999
body:
  % Subtype TCC generated (at line 15, column 15) for  0
      % expected type  below[s`length]
  choose_TCC1: OBLIGATION
    FORALL (i: nat, s: ne_seqs[T]): NOT i < s`length IMPLIES 0 < s`length;


decl_type: tcc
theory: finite_seqs
library: fault_tolerance
signature: nil
location: 71 0 74 999
body:
  % Judgement subtype TCC generated (at line 20, column 30) for  choose(i)
      % expected type  in_consensus_function
  choose_consensus: OBLIGATION
    FORALL (i, x1: ne_seqs[T]): in?[T](choose(i)(x1), x1);


decl_type: tcc
theory: finite_seqs
library: fault_tolerance
signature: nil
location: 76 0 80 999
body:
  % Judgement subtype TCC generated (at line 43, column 39) for
      % majority_choose
      % expected type  in_consensus_function
  majority_choose_consensus: OBLIGATION
    FORALL (x1: ne_seqs[T]): in?[T](majority_choose(x1), x1);


decl_type: tcc
theory: finite_seqs
library: fault_tolerance
signature: nil
location: 82 0 86 999
body:
  % Subtype TCC generated (at line 46, column 33) for  {t: T | TRUE}
      % expected type  p: (nonempty?[T])
  majority_choose2_TCC1: OBLIGATION
    FORALL (fs: finite_sequence[T]):
      fs`length = 0 IMPLIES nonempty?[T]({t: T | TRUE});


decl_type: tcc
theory: finite_seqs
library: fault_tolerance
signature: nil
location: 88 0 91 999
body:
  % Subtype TCC generated (at line 47, column 25) for  fs
      % expected type  ne_seqs[T]
  majority_choose2_TCC2: OBLIGATION
    FORALL (fs: finite_sequence[T]): NOT fs`length = 0 IMPLIES length(fs) > 0;


decl_type: tcc
theory: finite_seqs
library: fault_tolerance
signature: nil
location: 93 0 98 999
body:
  % Judgement subtype TCC generated (at line 50, column 39) for
      % majority_choose2
      % expected type  majority_function
  majority2_choose_majority: OBLIGATION
    FORALL (x1: finite_sequence[T]):
      maj_exists[T](x1) => is_majority[T](majority_choose2(x1), x1);


decl_type: tcc
theory: finite_seqs
library: fault_tolerance
signature: nil
location: 100 0 104 999
body:
  % Subtype TCC generated (at line 54, column 84) for  i
      % expected type  below[fs`length]
  uniform_TCC1: OBLIGATION
    FORALL (fs: finite_sequence[T], k: nat, i: below(k)):
      fs`length = k IMPLIES i < fs`length;


decl_type: tcc
theory: finite_seqs
library: fault_tolerance
signature: nil
location: 106 0 111 999
body:
  % Subtype TCC generated (at line 54, column 44) for
      % {i: below(k) | fs`length = k & fs`seq(i) = t}
      % expected type  finite_set[below(k)]
  uniform_TCC2: OBLIGATION
    FORALL (fs: finite_sequence[T], t: T, k: nat):
      is_finite[below(k)]({i: below(k) | fs`length = k & fs`seq(i) = t});


decl_type: formula
theory: ordered_finite_sequences
library: fault_tolerance
signature: nil
location: 16 2 18 43
body:
    extract_one: LEMMA 
      i<=j AND i<s`length AND j<s`length AND l<=j-i 
        IMPLIES (s^(i,j))`seq(l) = s`seq(i+l)


decl_type: formula
theory: ordered_finite_sequences
library: fault_tolerance
signature: nil
location: 19 2 21 57
body:
    extract_upper: LEMMA 
      i<=j AND i<s`length AND j<s`length 
        IMPLIES (s^(i,j))`seq(length(s^(i,j))-1) = s`seq(j)


decl_type: formula
theory: ordered_finite_sequences
library: fault_tolerance
signature: nil
location: 25 2 27 49
body:
    max_extract: LEMMA 
      i<=j AND i<s`length AND j<s`length 
        IMPLIES max(sort(s)^(i,j)) = sort(s)`seq(j)


decl_type: formula
theory: ordered_finite_sequences
library: fault_tolerance
signature: nil
location: 61 2 64 67
body:
    map_subset_lower: LEMMA
        i<k AND s`length = k 
      IMPLIES 
        subset?(map_set(s, k, {m:below(k) | m <= i}), lower(s, k, i))


decl_type: formula
theory: ordered_finite_sequences
library: fault_tolerance
signature: nil
location: 66 2 69 67
body:
    map_subset_upper: LEMMA
        i<k AND s`length = k 
      IMPLIES 
        subset?(map_set(s, k, {m:below(k) | i <= m}), upper(s, k, i))


decl_type: formula
theory: ordered_finite_sequences
library: fault_tolerance
signature: nil
location: 74 2 78 38
body:
    map_card_eq: LEMMA
      FORALL (a:finite_set[below(k)]):
        s`length = k 
      IMPLIES 
        card(map_set(s, k, a)) = card(a)


decl_type: formula
theory: ordered_finite_sequences
library: fault_tolerance
signature: nil
location: 86 2 93 40
body:
    sort_overlap: LEMMA
        s1`length = k AND
        s2`length = k
      IMPLIES
        FORALL (i: below(k)): 
          EXISTS (j: below(k)):
            s2`seq(j) <= sort(s2)`seq(i) AND
              sort(s1)`seq(i) <= s1`seq(j)


decl_type: formula
theory: ordered_finite_sequences
library: fault_tolerance
signature: nil
location: 95 2 100 36
body:
    leq_validity: COROLLARY
        s`length = k 
      IMPLIES
        FORALL (i: below(k)): 
          EXISTS (j: below(k)):
            s`seq(j) <= sort(s)`seq(i) 


decl_type: function
theory: ordered_finite_sequences
library: fault_tolerance
signature:
  [d: [ne_seqs[T], k: posnat, below(k)] ->
  finite_set[below(d`2)]]

location: 51 2 52 63
body:
    lower(s, k, (i: below(k))): finite_set[below(k)] = 
      {j: below(k) | s`length = k AND s`seq(j) <= sort(s)`seq(i)}


decl_type: function
theory: ordered_finite_sequences
library: fault_tolerance
signature:
  [d: [ne_seqs[T], k: posnat, below(k)] ->
  finite_set[below(d`2)]]

location: 53 2 54 63
body:
    upper(s, k, (i: below(k))): finite_set[below(k)] = 
      {j: below(k) | s`length = k AND sort(s)`seq(i) <= s`seq(j)}


decl_type: function
theory: ordered_finite_sequences
library: fault_tolerance
signature:
  [d: [ne_seqs[T], k: posnat, finite_set[below(k)]] ->
  finite_set[below(d`2)]]

location: 58 2 59 54
body:
    map_set(s, k, (a: finite_set[below(k)])): finite_set[below(k)] =
      {i: below(k) | s`length = k AND a(sort_map(s)(i))}


decl_type: tcc
theory: ordered_finite_sequences
library: fault_tolerance
signature: nil
location: 107 0 112 999
body:
  % Subtype TCC generated (at line 18, column 28) for  l
      % expected type  below[(s ^ (i, j))`length]
  extract_one_TCC1: OBLIGATION
    FORALL (i, j, l: nat, s: ne_seqs[T]):
      l <= j - i AND j < s`length AND i < s`length AND i <= j IMPLIES
       l < (^[T](s, (i, j)))`length;


decl_type: tcc
theory: ordered_finite_sequences
library: fault_tolerance
signature: nil
location: 114 0 119 999
body:
  % Subtype TCC generated (at line 18, column 39) for  i + l
      % expected type  below[s`length]
  extract_one_TCC2: OBLIGATION
    FORALL (i, j, l: nat, s: ne_seqs[T]):
      l <= j - i AND j < s`length AND i < s`length AND i <= j IMPLIES
       i + l < s`length;


decl_type: tcc
theory: ordered_finite_sequences
library: fault_tolerance
signature: nil
location: 121 0 127 999
body:
  % Subtype TCC generated (at line 21, column 28) for  length(s ^ (i, j)) - 1
      % expected type  below[(s ^ (i, j))`length]
  extract_upper_TCC1: OBLIGATION
    FORALL (i, j: nat, s: ne_seqs[T]):
      j < s`length AND i < s`length AND i <= j IMPLIES
       length(^[T](s, (i, j))) - 1 >= 0 AND
        length(^[T](s, (i, j))) - 1 < (^[T](s, (i, j)))`length;


decl_type: tcc
theory: ordered_finite_sequences
library: fault_tolerance
signature: nil
location: 129 0 134 999
body:
  % Subtype TCC generated (at line 24, column 36) for  sort(s) ^ (i, j)
      % expected type  s: ne_seqs[T]
  min_extract_TCC1: OBLIGATION
    FORALL (i, j: nat, s: ne_seqs[T]):
      i < s`length AND i <= j IMPLIES
       length(^[T](sort[T, <=](s), (i, j))) > 0;


decl_type: tcc
theory: ordered_finite_sequences
library: fault_tolerance
signature: nil
location: 136 0 140 999
body:
  % Subtype TCC generated (at line 24, column 65) for  i
      % expected type  below[sort(s)`length]
  min_extract_TCC2: OBLIGATION
    FORALL (i, j: nat, s: ne_seqs[T]):
      i < s`length AND i <= j IMPLIES i < sort[T, <=](s)`length;


decl_type: tcc
theory: ordered_finite_sequences
library: fault_tolerance
signature: nil
location: 142 0 147 999
body:
  % Subtype TCC generated (at line 27, column 47) for  j
      % expected type  below[sort(s)`length]
  max_extract_TCC1: OBLIGATION
    FORALL (i, j: nat, s: ne_seqs[T]):
      j < s`length AND i < s`length AND i <= j IMPLIES
       j < sort[T, <=](s)`length;


decl_type: tcc
theory: ordered_finite_sequences
library: fault_tolerance
signature: nil
location: 149 0 154 999
body:
  % Subtype TCC generated (at line 29, column 23) for
      % list2finseq[T]((: min(s), max(s) :))
      % expected type  ne_seqs[T]
  minmax_TCC1: OBLIGATION
    FORALL (s: ne_seqs[T]):
      length(list2finseq[T]((: min[T, <=](s), max[T, <=](s) :))) > 0;


decl_type: tcc
theory: ordered_finite_sequences
library: fault_tolerance
signature: nil
location: 156 0 159 999
body:
  % Judgement subtype TCC generated (at line 36, column 31) for  min
      % expected type  in_consensus_function[T]
  min_in_consensus: OBLIGATION
    FORALL (x1: ne_seqs[T]): in?[T](min[T, <=](x1), x1);


decl_type: tcc
theory: ordered_finite_sequences
library: fault_tolerance
signature: nil
location: 161 0 164 999
body:
  % Judgement subtype TCC generated (at line 37, column 31) for  max
      % expected type  in_consensus_function[T]
  max_in_consensus: OBLIGATION
    FORALL (x1: ne_seqs[T]): in?[T](max[T, <=](x1), x1);


decl_type: tcc
theory: ordered_finite_sequences
library: fault_tolerance
signature: nil
location: 166 0 170 999
body:
  % Judgement subtype TCC generated (at line 38, column 31) for  x
      % expected type  consensus_function
  in_consensus: OBLIGATION
    FORALL (x: in_consensus_function, x1: ne_seqs[T]):
      min[T, <=](x1) <= x(x1) AND x(x1) <= max[T, <=](x1);


decl_type: tcc
theory: ordered_finite_sequences
library: fault_tolerance
signature: nil
location: 172 0 176 999
body:
  % Subtype TCC generated (at line 52, column 42) for  j
      % expected type  below[s`length]
  lower_TCC1: OBLIGATION
    FORALL (s: ne_seqs[T], k: posnat, (i: below(k)), j: below(k)):
      s`length = k IMPLIES j < s`length;


decl_type: tcc
theory: ordered_finite_sequences
library: fault_tolerance
signature: nil
location: 178 0 182 999
body:
  % Subtype TCC generated (at line 52, column 60) for  i
      % expected type  below[sort(s)`length]
  lower_TCC2: OBLIGATION
    FORALL (s: ne_seqs[T], k: posnat, (i: below(k)), j: below(k)):
      s`length = k IMPLIES i < sort[T, <=](s)`length;


decl_type: tcc
theory: ordered_finite_sequences
library: fault_tolerance
signature: nil
location: 184 0 191 999
body:
  % Subtype TCC generated (at line 52, column 4) for
      % {j: below(k) | s`length = k AND s`seq(j) <= sort(s)`seq(i)}
      % expected type  finite_set[below(k)]
  lower_TCC3: OBLIGATION
    FORALL (s: ne_seqs[T], k: posnat, (i: below(k))):
      is_finite[below(k)]
          ({j: below(k) |
              s`length = k AND s`seq(j) <= sort[T, <=](s)`seq(i)});


decl_type: tcc
theory: ordered_finite_sequences
library: fault_tolerance
signature: nil
location: 193 0 200 999
body:
  % Subtype TCC generated (at line 54, column 4) for
      % {j: below(k) | s`length = k AND sort(s)`seq(i) <= s`seq(j)}
      % expected type  finite_set[below(k)]
  upper_TCC1: OBLIGATION
    FORALL (s: ne_seqs[T], k: posnat, (i: below(k))):
      is_finite[below(k)]
          ({j: below(k) |
              s`length = k AND sort[T, <=](s)`seq(i) <= s`seq(j)});


decl_type: tcc
theory: ordered_finite_sequences
library: fault_tolerance
signature: nil
location: 202 0 206 999
body:
  % Subtype TCC generated (at line 59, column 50) for  i
      % expected type  below(length(s))
  map_set_TCC1: OBLIGATION
    FORALL (s: ne_seqs[T], k: posnat, i: below(k)):
      s`length = k IMPLIES i < length(s);


decl_type: tcc
theory: ordered_finite_sequences
library: fault_tolerance
signature: nil
location: 208 0 212 999
body:
  % Subtype TCC generated (at line 59, column 38) for  sort_map(s)(i)
      % expected type  below(k)
  map_set_TCC2: OBLIGATION
    FORALL (s: ne_seqs[T], k: posnat, i: below(k)):
      s`length = k IMPLIES sort_map[T, <=](s)(i) < k;


decl_type: tcc
theory: ordered_finite_sequences
library: fault_tolerance
signature: nil
location: 214 0 220 999
body:
  % Subtype TCC generated (at line 59, column 4) for
      % {i: below(k) | s`length = k AND a(sort_map(s)(i))}
      % expected type  finite_set[below(k)]
  map_set_TCC3: OBLIGATION
    FORALL (s: ne_seqs[T], k: posnat, (a: finite_set[below(k)])):
      is_finite[below(k)]
          ({i: below(k) | s`length = k AND a(sort_map[T, <=](s)(i))});


decl_type: tcc
theory: ordered_finite_sequences
library: fault_tolerance
signature: nil
location: 222 0 227 999
body:
  % Subtype TCC generated (at line 64, column 28) for  {m: below(k) | m <= i}
      % expected type  finite_set[below(k)]
  map_subset_lower_TCC1: OBLIGATION
    FORALL (i: nat, k: posnat, s: ne_seqs[T]):
      s`length = k AND i < k IMPLIES
       is_finite[below(k)]({m: below(k) | m <= i});


decl_type: tcc
theory: ordered_finite_sequences
library: fault_tolerance
signature: nil
location: 229 0 234 999
body:
  % Subtype TCC generated (at line 69, column 28) for  {m: below(k) | i <= m}
      % expected type  finite_set[below(k)]
  map_subset_upper_TCC1: OBLIGATION
    FORALL (i: nat, k: posnat, s: ne_seqs[T]):
      s`length = k AND i < k IMPLIES
       is_finite[below(k)]({m: below(k) | i <= m});


decl_type: tcc
theory: ordered_finite_sequences
library: fault_tolerance
signature: nil
location: 236 0 241 999
body:
  % Subtype TCC generated (at line 72, column 81) for  i
      % expected type  below(length(s))
  mapper_TCC1: OBLIGATION
    FORALL (s: ne_seqs[T], k: posnat, (a: finite_set[below(k)]),
            i: (map_set(s, k, a))):
      i < length(s);


decl_type: tcc
theory: ordered_finite_sequences
library: fault_tolerance
signature: nil
location: 243 0 248 999
body:
  % Subtype TCC generated (at line 72, column 69) for  sort_map(s)(i)
      % expected type  (a)
  mapper_TCC2: OBLIGATION
    FORALL (s: ne_seqs[T], k: posnat, (a: finite_set[below(k)]),
            i: (map_set(s, k, a))):
      sort_map[T, <=](s)(i) < k AND a(sort_map[T, <=](s)(i));


decl_type: tcc
theory: ordered_finite_sequences
library: fault_tolerance
signature: nil
location: 250 0 254 999
body:
  % Subtype TCC generated (at line 80, column 50) for  {m: below(k) | m <= i}
      % expected type  S: finite_set[below(k)]
  card_below_set_TCC1: OBLIGATION
    FORALL (i: nat, k: posnat):
      i < k IMPLIES is_finite[below(k)]({m: below(k) | m <= i});


decl_type: tcc
theory: ordered_finite_sequences
library: fault_tolerance
signature: nil
location: 256 0 260 999
body:
  % Subtype TCC generated (at line 81, column 50) for  {m: below(k) | i <= m}
      % expected type  S: finite_set[below(k)]
  card_above_set_TCC1: OBLIGATION
    FORALL (i: nat, k: posnat):
      i < k IMPLIES is_finite[below(k)]({m: below(k) | i <= m});


decl_type: tcc
theory: ordered_finite_sequences
library: fault_tolerance
signature: nil
location: 262 0 267 999
body:
  % Subtype TCC generated (at line 92, column 17) for  j
      % expected type  below[s2`length]
  sort_overlap_TCC1: OBLIGATION
    FORALL (k: posnat, s1, s2: ne_seqs[T]):
      s2`length = k AND s1`length = k IMPLIES
       (FORALL (i: below(k), j: below(k)): j < s2`length);


decl_type: tcc
theory: ordered_finite_sequences
library: fault_tolerance
signature: nil
location: 269 0 274 999
body:
  % Subtype TCC generated (at line 92, column 36) for  i
      % expected type  below[sort(s2)`length]
  sort_overlap_TCC2: OBLIGATION
    FORALL (k: posnat, s1, s2: ne_seqs[T]):
      s2`length = k AND s1`length = k IMPLIES
       (FORALL (i: below(k), j: below(k)): i < sort[T, <=](s2)`length);


decl_type: formula
theory: real_finite_sequences
library: fault_tolerance
signature: nil
location: 62 2 68 54
body:
    mean_convergence: THEOREM
        s1`length <= k AND
        s2`length <= k AND
        max(s1) - min(s2) <= delta + eps AND
        min(s1) - max(s2) <= eps
      IMPLIES
        mean(s1) - mean(s2) <= delta * (k - 1) / k + eps


decl_type: formula
theory: real_finite_sequences
library: fault_tolerance
signature: nil
location: 70 2 74 52
body:
    midpoint_convergence: COROLLARY
        max(s1) - min(s2) <= delta + eps AND
        min(s1) - max(s2) <= eps
      IMPLIES
        midpoint(s1) - midpoint(s2) <= delta / 2 + eps


decl_type: function
theory: real_finite_sequences
library: fault_tolerance
signature: [[ne_seqs[real], ne_seqs[real], nnreal] -> bool]
location: 21 2 24 34
body:
    similar?(s1, s2, eps): bool = 
      (s1`length = s2`length) AND 
      FORALL (i: below(s1`length)):
        s1`seq(i) - s2`seq(i) <= eps


decl_type: function
theory: real_finite_sequences
library: fault_tolerance
signature: [consensus_function[real, <=] -> bool]
location: 33 2 34 76
body:
    inexact_consensus?(cf): bool = 
      FORALL s1, s2, eps: similar?(s1, s2, eps) IMPLIES cf(s1) - cf(s2) <= eps


decl_type: function
theory: real_finite_sequences
library: fault_tolerance
signature: [[consensus_function[real, <=], nat, posnat] -> bool]
location: 76 2 83 50
body:
    convergent?(cf, i, k): bool =
      FORALL s1, s2, delta, eps: 
        s1`length <= i AND
        s2`length <= i AND
        max(s1) - min(s2) <= delta + eps AND
        min(s1) - max(s2) <= eps
      IMPLIES
        cf(s1) - cf(s2) <= delta * (k - 1) / k + eps


decl_type: tcc
theory: real_finite_sequences
library: fault_tolerance
signature: nil
location: 94 0 97 999
body:
  % Subtype TCC generated (at line 14, column 25) for  max(s) - min(s)
      % expected type  nnreal
  diameter?_TCC1: OBLIGATION
    FORALL (s: ne_seqs[real]): max[real, <=](s) - min[real, <=](s) >= 0;


decl_type: tcc
theory: real_finite_sequences
library: fault_tolerance
signature: nil
location: 99 0 104 999
body:
  % Subtype TCC generated (at line 24, column 25) for  i
      % expected type  below[s2`length]
  similar?_TCC1: OBLIGATION
    FORALL (s1: ne_seqs[real], s2: ne_seqs[real]):
      (s1`length = s2`length) IMPLIES
       (FORALL (i: below(s1`length)): i < s2`length);


decl_type: tcc
theory: real_finite_sequences
library: fault_tolerance
signature: nil
location: 106 0 110 999
body:
  % Subtype TCC generated (at line 27, column 43) for  sort(s1)
      % expected type  ne_seqs[real]
  similar_sort_TCC1: OBLIGATION
    FORALL (eps: nnreal, s1, s2: ne_seqs[real]):
      similar?(s1, s2, eps) IMPLIES length(sort[real, <=](s1)) > 0;


decl_type: tcc
theory: real_finite_sequences
library: fault_tolerance
signature: nil
location: 112 0 116 999
body:
  % Subtype TCC generated (at line 27, column 53) for  sort(s2)
      % expected type  ne_seqs[real]
  similar_sort_TCC2: OBLIGATION
    FORALL (eps: nnreal, s1, s2: ne_seqs[real]):
      similar?(s1, s2, eps) IMPLIES length(sort[real, <=](s2)) > 0;


decl_type: tcc
theory: real_finite_sequences
library: fault_tolerance
signature: nil
location: 118 0 122 999
body:
  % Subtype TCC generated (at line 36, column 40) for  0
      % expected type  T_low[below(s`length)]
  sum_TCC1: OBLIGATION
    FORALL (s: ne_seqs[real]):
      0 >= 0 AND 0 < s`length OR (EXISTS (j: below(s`length)): j <= 0);


decl_type: tcc
theory: real_finite_sequences
library: fault_tolerance
signature: nil
location: 124 0 129 999
body:
  % Subtype TCC generated (at line 36, column 43) for  s`length - 1
      % expected type  T_high[below(s`length)]
  sum_TCC2: OBLIGATION
    FORALL (s: ne_seqs[real]):
      s`length - 1 >= 0 AND s`length - 1 < s`length OR
       (EXISTS (j: below(s`length)): s`length - 1 <= j);


decl_type: tcc
theory: real_finite_sequences
library: fault_tolerance
signature: nil
location: 131 0 137 999
body:
  % Assuming TCC generated (at line 41, column 5) for
      % reals@sigma[below(s`length)]
      % generated from assumption sigma.connected_domain
  sum_TCC3: OBLIGATION
    FORALL (s: ne_seqs[real]):
      FORALL (x, y: below(s`length)), (z: integer):
        x <= z AND z <= y IMPLIES z >= 0 AND z < s`length;


decl_type: tcc
theory: real_finite_sequences
library: fault_tolerance
signature: nil
location: 139 0 141 999
body:
  % Subtype TCC generated (at line 41, column 27) for  s`length
      % expected type  nznum
  mean_TCC1: OBLIGATION FORALL (s: ne_seqs[real]): s`length /= 0;


decl_type: tcc
theory: real_finite_sequences
library: fault_tolerance
signature: nil
location: 143 0 147 999
body:
  % Judgement subtype TCC generated (at line 53, column 32) for  mean
      % expected type  consensus_function[real, <=]
  mean_consensus: OBLIGATION
    FORALL (x1: ne_seqs[real]):
      min[real, <=](x1) <= mean(x1) AND mean(x1) <= max[real, <=](x1);


decl_type: tcc
theory: real_finite_sequences
library: fault_tolerance
signature: nil
location: 149 0 153 999
body:
  % Judgement subtype TCC generated (at line 54, column 32) for  midpoint
      % expected type  consensus_function[real, <=]
  midpoint_consensus: OBLIGATION
    FORALL (x1: ne_seqs[real]):
      min[real, <=](x1) <= midpoint(x1) AND midpoint(x1) <= max[real, <=](x1);


decl_type: tcc
theory: node_functions_stage
library: fault_tolerance
signature: nil
location: 39 0 48 999
body:
  % Subtype TCC generated (at line 32, column 41) for
      % restrict
      %     [[vec[S, T], nodeid_set[S, T]],
      %      [vec[S, T], nodeid_nonempty[S, T]], finite_sequence[T]]
      %     (vec2seq[S, T])
      % expected type  filter_local[S, T]
  nominal_filter_TCC1: OBLIGATION
    FORALL (d: below(D)):
      FORALL (x1: [vec[S, T], nodeid_nonempty[S, T]]):
        length(vec2seq[S, T](x1)) > 0;


decl_type: formula
theory: fault_assumptions_stage
library: fault_tolerance
signature: nil
location: 59 2 61 37
body:
    quorum_implies_majority: LEMMA
      quorum?(rcvd, check, tau)(src_set) IMPLIES
        majority?(rcvd, check)(src_set)


decl_type: formula
theory: fault_assumptions_stage
library: fault_tolerance
signature: nil
location: 66 2 70 38
body:
    enabled_within_quorum: LEMMA
      enabled_within?(rcvd, check)(src_set) AND
      enabled_nonempty?(rcvd, check)
     IMPLIES
      quorum?(rcvd, check, tau)(src_set)


decl_type: formula
theory: fault_assumptions_stage
library: fault_tolerance
signature: nil
location: 72 2 74 63
body:
    enabled_within_quorum_nada: LEMMA
      enabled_nonempty?(rcvd, check) IMPLIES
        enabled_within?(rcvd, check) = quorum?(rcvd, check, nada)


decl_type: formula
theory: fault_assumptions_stage
library: fault_tolerance
signature: nil
location: 76 2 79 36
body:
    quorum_nonempty: LEMMA
        quorum?(rcvd, check, tau)(src_set)
      IMPLIES
        enabled_nonempty?(rcvd, check)


decl_type: formula
theory: fault_assumptions_stage
library: fault_tolerance
signature: nil
location: 100 2 103 36
body:
    intersection_majority_nonempty: LEMMA
        intersection_majority?(rcvd, check)
      IMPLIES 
        enabled_nonempty?(rcvd, check)


decl_type: formula
theory: fault_assumptions_stage
library: fault_tolerance
signature: nil
location: 105 2 108 36
body:
    byzantine_intersection_nonempty: LEMMA
        byzantine_intersection_majority?(rcvd, check)(src_set)
      IMPLIES 
        enabled_nonempty?(rcvd, check)


decl_type: formula
theory: fault_assumptions_stage
library: fault_tolerance
signature: nil
location: 113 2 117 41
body:
    intersection_majority: LEMMA
        enabled_within?(rcvd, check)(src_set) AND
        intersection_majority?(rcvd, check)(src_set)
      IMPLIES
        intersection_majority?(rcvd, check)


decl_type: formula
theory: fault_assumptions_stage
library: fault_tolerance
signature: nil
location: 135 2 139 57
body:
    enabled_agree: LEMMA
        enabled_within?(rcvd, check)(src_set) AND
        uniformly_enabled?(rcvd, check)(src_set)
      IMPLIES
        enabled(rcvd, check)(d1) = enabled(rcvd, check)(d2)


decl_type: function
theory: fault_assumptions_stage
library: fault_tolerance
signature:
  [[rcvd_matrix_stage[S, D, T], check_stage[S, D, T]] ->
  [finite_set[below(S)] -> bool]]

location: 39 2 40 55
body:
    enabled_within?(rcvd, check)(src_set): bool = 
      FORALL d: subset?(enabled(rcvd, check)(d), src_set)


decl_type: function
theory: fault_assumptions_stage
library: fault_tolerance
signature:
  [[rcvd_matrix_stage[S, D, T], check_stage[S, D, T]] ->
  [finite_set[below(S)] -> bool]]

location: 52 2 54 56
body:
    majority?(rcvd, check)(src_set): bool = 
      FORALL d: 
        simple_majority?(src_set, enabled(rcvd, check)(d))


decl_type: function
theory: fault_assumptions_stage
library: fault_tolerance
location: 56 2 57 60
signature:
  [[rcvd_matrix_stage[S, D, T], check_stage[S, D, T], tau_type] ->
          [finite_set[below(S)] -> bool]]

body:
    quorum?(rcvd, check, tau)(src_set): bool = 
      FORALL d: quorum?(enabled(rcvd, check)(d), tau)(src_set)


decl_type: function
theory: fault_assumptions_stage
library: fault_tolerance
signature:
  [[rcvd_matrix_stage[S, D, T], check_stage[S, D, T], tau_type] ->
  [below(D) -> nat]]

location: 81 2 85 9
body:
    max(rcvd, check, tau)(d): nat = 
      IF empty?(enabled(rcvd, check)(d))
        THEN 0 
        ELSE M(enabled(rcvd, check)(d), tau) - 1
      ENDIF


decl_type: function
theory: fault_assumptions_stage
library: fault_tolerance
signature:
  [[rcvd_matrix_stage[S, D, T], check_stage[S, D, T]] ->
  [finite_set[below(S)] -> bool]]

location: 88 2 90 89
body:
    intersection_majority?(rcvd, check)(src_set): bool =
      FORALL d1, d2:
        intersection_majority?(enabled(rcvd, check)(d1), enabled(rcvd, check)(d2), src_set)


decl_type: function
theory: fault_assumptions_stage
library: fault_tolerance
signature: [[rcvd_matrix_stage[S, D, T], check_stage[S, D, T]] -> bool]
location: 92 2 94 80
body:
    intersection_majority?(rcvd, check): bool =
      FORALL d1, d2:
        intersection_majority?(enabled(rcvd, check)(d1), enabled(rcvd, check)(d2))


decl_type: function
theory: fault_assumptions_stage
library: fault_tolerance
signature:
  [[rcvd_matrix_stage[S, D, T], check_stage[S, D, T]] ->
  [finite_set[below(S)] -> bool]]

location: 96 2 98 99
body:
    byzantine_intersection_majority?(rcvd, check)(src_set): bool =
      FORALL d1, d2:
        byzantine_intersection_majority?(enabled(rcvd, check)(d1), enabled(rcvd, check)(d2), src_set)


decl_type: function
theory: fault_assumptions_stage
library: fault_tolerance
signature:
  [[rcvd_matrix_stage[S, D, T], check_stage[S, D, T]] ->
  [finite_set[below(S)] -> bool]]

location: 119 2 124 33
body:
    uniformly_enabled?(rcvd, check)(src_set): bool = 
      FORALL s, d1, d2: 
        src_set(s) AND
        enabled(rcvd, check)(d1)(s)
      IMPLIES
        enabled(rcvd, check)(d2)(s)


decl_type: function
theory: fault_assumptions_stage
library: fault_tolerance
signature:
  [[rcvd_matrix_stage[S, D, T], check_stage[S, D, T]] ->
  [finite_set[below(S)] -> bool]]

location: 126 2 127 70
body:
    enabled_same?(rcvd, check)(src_set): bool =
      FORALL d1, d2: enabled(rcvd, check)(d1) = enabled(rcvd, check)(d2)


decl_type: function
theory: fault_assumptions_stage
library: fault_tolerance
signature: [check_stage[S, D, T] -> [finite_set[below(S)] -> bool]]
location: 129 2 133 33
body:
    uniform?(check)(src_set): bool =
      FORALL s, d1, d2:
        src_set(s)
      IMPLIES
        check(d1)(s) = check(d2)(s)


decl_type: tcc
theory: fault_assumptions_stage
library: fault_tolerance
signature: nil
location: 146 0 152 999
body:
  % Subtype TCC generated (at line 34, column 4) for
      % {s | check(d)(s)(rcvd(d)(s))}
      % expected type  finite_set[below(S)]
  enabled_TCC1: OBLIGATION
    FORALL (rcvd: rcvd_matrix_stage[S, D, T], check: check_stage[S, D, T],
            d: below(D)):
      is_finite[below(S)]({s | check(d)(s)(rcvd(d)(s))});


decl_type: tcc
theory: fault_assumptions_stage
library: fault_tolerance
signature: nil
location: 154 0 159 999
body:
  % Subtype TCC generated (at line 43, column 4) for
      % {s | EXISTS d: enabled(rcvd, check)(d)(s)}
      % expected type  finite_set[below(S)]
  enabled?_TCC1: OBLIGATION
    FORALL (rcvd: rcvd_matrix_stage[S, D, T], check: check_stage[S, D, T]):
      is_finite[below(S)]({s | EXISTS d: enabled(rcvd, check)(d)(s)});


decl_type: tcc
theory: fault_assumptions_stage
library: fault_tolerance
signature: nil
location: 161 0 168 999
body:
  % Subtype TCC generated (at line 84, column 11) for
      % M(enabled(rcvd, check)(d), tau) - 1
      % expected type  nat
  max_TCC1: OBLIGATION
    FORALL (rcvd: rcvd_matrix_stage[S, D, T], check: check_stage[S, D, T],
            tau: tau_type, d: below(D)):
      NOT empty?(enabled(rcvd, check)(d)) IMPLIES
       M[below(S)](enabled(rcvd, check)(d), tau) - 1 >= 0;


decl_type: formula
theory: inexact_comm_stage
library: fault_tolerance
signature: nil
location: 54 2 56 51
body:
    majority_lower_rw: LEMMA
       majority_lower?(sent, rcvd, check, epsilon) = 
       quorum_lower?(sent, rcvd, check, mid, epsilon)


decl_type: formula
theory: inexact_comm_stage
library: fault_tolerance
signature: nil
location: 77 2 79 51
body:
    majority_upper_rw: LEMMA
       majority_upper?(sent, rcvd, check, epsilon) = 
       quorum_upper?(sent, rcvd, check, mid, epsilon)


decl_type: formula
theory: inexact_comm_stage
library: fault_tolerance
signature: nil
location: 95 2 99 51
body:
    quorum_accuracy: LEMMA
         quorum_accuracy?(sent, rcvd, check, tau, eps_l, eps_u) 
      IMPLIES
         quorum_lower?(sent, rcvd, check, tau, eps_l) AND
         quorum_upper?(sent, rcvd, check, tau, eps_u)


decl_type: formula
theory: inexact_comm_stage
library: fault_tolerance
signature: nil
location: 101 2 105 48
body:
    majority_accuracy: LEMMA
         majority_accuracy?(sent, rcvd, check, eps_l, eps_u) 
      IMPLIES
         majority_lower?(sent, rcvd, check, eps_l) AND
         majority_upper?(sent, rcvd, check, eps_u)


decl_type: formula
theory: inexact_comm_stage
library: fault_tolerance
signature: nil
location: 107 2 109 59
body:
    majority_accuracy_rw: LEMMA
       majority_accuracy?(sent, rcvd, check, eps_l, eps_u) = 
       quorum_accuracy?(sent, rcvd, check, mid, eps_l, eps_u)


decl_type: formula
theory: inexact_comm_stage
library: fault_tolerance
signature: nil
location: 125 2 128 36
body:
    quorum_imprecision_nonempty: LEMMA
        quorum_imprecision?(sent, rcvd, check, tau, epsilon)
      IMPLIES
        enabled_nonempty?(rcvd, check)


decl_type: formula
theory: inexact_comm_stage
library: fault_tolerance
signature: nil
location: 135 2 137 57
body:
    majority_imprecision_rw: LEMMA
       majority_imprecision?(sent, rcvd, check, epsilon) = 
       quorum_imprecision?(sent, rcvd, check, mid, epsilon)


decl_type: formula
theory: inexact_comm_stage
library: fault_tolerance
signature: nil
location: 139 2 143 69
body:
    correct_imprecision: LEMMA
        correct_lower_inaccuracy?(sent, rcvd, check, eps_l)(src_set) AND
        correct_upper_inaccuracy?(sent, rcvd, check, eps_u)(src_set)
      IMPLIES
        correct_imprecision?(sent, rcvd, check, eps_l + eps_u)(src_set)


decl_type: formula
theory: inexact_comm_stage
library: fault_tolerance
signature: nil
location: 184 2 189 63
body:
    rcvd_diameter: LEMMA 
        correct_imprecision?(sent, rcvd, check, epsilon)(correct_set) AND
        diameter?(sent, delta)(src_set) AND
        enabled_within?(rcvd, check)(src_set)
      IMPLIES
        rcvd_diameter?(rcvd, check, delta + epsilon)(correct_set)


decl_type: function
theory: inexact_comm_stage
library: fault_tolerance
location: 37 2 42 39
signature:
  [[sent_vec_stage[S, D, real], rcvd_matrix_stage[S, D, real],
         check_stage[S, D, real], nonneg_real] ->
          [finite_set[below(S)] -> bool]]

body:
    correct_lower_inaccuracy?(sent, rcvd, check, epsilon)(src_set): bool =
      FORALL d, s: 
          src_set(s) AND 
          enabled(rcvd, check)(d)(s) 
        IMPLIES
          sent(s) - epsilon <= rcvd(d)(s)


decl_type: function
theory: inexact_comm_stage
library: fault_tolerance
location: 44 2 47 40
signature:
  [[sent_vec_stage[S, D, real], rcvd_matrix_stage[S, D, real],
         check_stage[S, D, real], tau_type, nonneg_real] ->
          bool]

body:
    quorum_lower?(sent, rcvd, check, tau, epsilon): bool =
      EXISTS src_set:
        correct_lower_inaccuracy?(sent, rcvd, check, epsilon)(src_set) AND
        quorum?(rcvd, check, tau)(src_set)


decl_type: function
theory: inexact_comm_stage
library: fault_tolerance
location: 49 2 52 37
signature:
  [[sent_vec_stage[S, D, real], rcvd_matrix_stage[S, D, real],
         check_stage[S, D, real], nonneg_real] ->
          bool]

body:
    majority_lower?(sent, rcvd, check, epsilon): bool = 
      EXISTS src_set:
        correct_lower_inaccuracy?(sent, rcvd, check, epsilon)(src_set) AND
        majority?(rcvd, check)(src_set)


decl_type: function
theory: inexact_comm_stage
library: fault_tolerance
location: 60 2 65 39
signature:
  [[sent_vec_stage[S, D, real], rcvd_matrix_stage[S, D, real],
         check_stage[S, D, real], nonneg_real] ->
          [finite_set[below(S)] -> bool]]

body:
    correct_upper_inaccuracy?(sent, rcvd, check, epsilon)(src_set): bool =
      FORALL d, s: 
          src_set(s) AND 
          enabled(rcvd, check)(d)(s) 
        IMPLIES
          rcvd(d)(s) <= sent(s) + epsilon


decl_type: function
theory: inexact_comm_stage
library: fault_tolerance
location: 67 2 70 40
signature:
  [[sent_vec_stage[S, D, real], rcvd_matrix_stage[S, D, real],
         check_stage[S, D, real], tau_type, nonneg_real] ->
          bool]

body:
    quorum_upper?(sent, rcvd, check, tau, epsilon): bool =
      EXISTS src_set:
        correct_upper_inaccuracy?(sent, rcvd, check, epsilon)(src_set) AND
        quorum?(rcvd, check, tau)(src_set)


decl_type: function
theory: inexact_comm_stage
library: fault_tolerance
location: 72 2 75 37
signature:
  [[sent_vec_stage[S, D, real], rcvd_matrix_stage[S, D, real],
         check_stage[S, D, real], nonneg_real] ->
          bool]

body:
    majority_upper?(sent, rcvd, check, epsilon): bool = 
      EXISTS src_set:
        correct_upper_inaccuracy?(sent, rcvd, check, epsilon)(src_set) AND
        majority?(rcvd, check)(src_set)


decl_type: function
theory: inexact_comm_stage
library: fault_tolerance
location: 83 2 87 40
signature:
  [[sent_vec_stage[S, D, real], rcvd_matrix_stage[S, D, real],
         check_stage[S, D, real], tau_type, nonneg_real, nonneg_real] ->
          bool]

body:
    quorum_accuracy?(sent, rcvd, check, tau, eps_l, eps_u):bool = 
      EXISTS src_set:
        correct_lower_inaccuracy?(sent, rcvd, check, eps_l)(src_set) AND
        correct_upper_inaccuracy?(sent, rcvd, check, eps_u)(src_set) AND
        quorum?(rcvd, check, tau)(src_set)


decl_type: function
theory: inexact_comm_stage
library: fault_tolerance
location: 89 2 93 37
signature:
  [[sent_vec_stage[S, D, real], rcvd_matrix_stage[S, D, real],
         check_stage[S, D, real], nonneg_real, nonneg_real] ->
          bool]

body:
    majority_accuracy?(sent, rcvd, check, eps_l, eps_u):bool = 
      EXISTS src_set:
        correct_lower_inaccuracy?(sent, rcvd, check, eps_l)(src_set) AND
        correct_upper_inaccuracy?(sent, rcvd, check, eps_u)(src_set) AND
        majority?(rcvd, check)(src_set)


decl_type: function
theory: inexact_comm_stage
library: fault_tolerance
location: 113 2 118 77
signature:
  [[sent_vec_stage[S, D, real], rcvd_matrix_stage[S, D, real],
         check_stage[S, D, real], nonneg_real] ->
          [finite_set[below(S)] -> bool]]

body:
    correct_imprecision?(sent, rcvd, check, epsilon)(src_set): bool =
      FORALL d1, d2, s1, s2:
          src_set(s1) AND enabled(rcvd, check)(d1)(s1) AND
          src_set(s2) AND enabled(rcvd, check)(d2)(s2) 
        IMPLIES
          abs((rcvd(d1)(s1) - rcvd(d2)(s2)) - (sent(s1) - sent(s2))) <= epsilon


decl_type: function
theory: inexact_comm_stage
library: fault_tolerance
location: 120 2 123 40
signature:
  [[sent_vec_stage[S, D, real], rcvd_matrix_stage[S, D, real],
         check_stage[S, D, real], tau_type, nonneg_real] ->
          bool]

body:
    quorum_imprecision?(sent, rcvd, check, tau, epsilon): bool =
      EXISTS src_set:
        correct_imprecision?(sent, rcvd, check, epsilon)(src_set) AND
        quorum?(rcvd, check, tau)(src_set)


decl_type: function
theory: inexact_comm_stage
library: fault_tolerance
location: 130 2 133 37
signature:
  [[sent_vec_stage[S, D, real], rcvd_matrix_stage[S, D, real],
         check_stage[S, D, real], nonneg_real] ->
          bool]

body:
    majority_imprecision?(sent, rcvd, check, epsilon): bool = 
      EXISTS src_set:
        correct_imprecision?(sent, rcvd, check, epsilon)(src_set) AND
        majority?(rcvd, check)(src_set)


decl_type: function
theory: inexact_comm_stage
library: fault_tolerance
location: 147 2 153 47
signature:
  [[rcvd_matrix_stage[S, D, real], check_stage[S, D, real],
         nonneg_real] ->
          [finite_set[below(S)] -> bool]]

body:
    single_imprecision?(rcvd, check, epsilon)(src_set):bool =
      FORALL d1, d2, s:
        src_set(s) AND
        enabled(rcvd, check)(d1)(s) AND
        enabled(rcvd, check)(d2)(s) 
      IMPLIES
        abs(rcvd(d1)(s) - rcvd(d2)(s)) <= epsilon


decl_type: function
theory: inexact_comm_stage
library: fault_tolerance
signature:
  [[rcvd_matrix_stage[S, D, real], check_stage[S, D, real],
  nonneg_real] ->
  bool]

location: 155 2 159 43
body:
    all_symmetric?(rcvd, check, epsilon): bool = 
      EXISTS src_set:
        single_imprecision?(rcvd, check, epsilon)(src_set) AND
        uniformly_enabled?(rcvd, check)(src_set) AND
        enabled_within?(rcvd, check)(src_set) 


decl_type: function
theory: inexact_comm_stage
library: fault_tolerance
signature:
  [[rcvd_matrix_stage[S, D, real], check_stage[S, D, real],
  nonneg_real] ->
  bool]

location: 161 2 162 68
body:
    all_single_imprecision?(rcvd, check, epsilon): bool = 
      single_imprecision?(rcvd, check, epsilon)(enabled?(rcvd, check))


decl_type: function
theory: inexact_comm_stage
library: fault_tolerance
signature:
  [[sent_vec_stage[S, D, real], nonneg_real] ->
  [finite_set[below(S)] -> bool]]

location: 170 2 175 41
body:
    diameter?(sent, delta)(src_set): bool =
      FORALL s1, s2: 
          src_set(s1) AND 
          src_set(s2) 
        IMPLIES
          abs(sent(s1) - sent(s2)) <= delta


decl_type: function
theory: inexact_comm_stage
library: fault_tolerance
location: 177 2 182 51
signature:
  [[rcvd_matrix_stage[S, D, real], check_stage[S, D, real],
         nonneg_real] ->
          [finite_set[below(S)] -> bool]]

body:
    rcvd_diameter?(rcvd, check, delta)(src_set): bool =
      FORALL d1, d2, s1, s2:
          src_set(s1) AND enabled(rcvd, check)(d1)(s1) AND
          src_set(s2) AND enabled(rcvd, check)(d2)(s2) 
        IMPLIES
          abs((rcvd(d1)(s1) - rcvd(d2)(s2))) <= delta


decl_type: formula
theory: reduce_properties
library: fault_tolerance
signature: nil
location: 34 2 37 43
body:
    card_lower_leq_lowset: LEMMA
      FORALL (i: below(card(enabled))):
      card[below(card(enabled))](lower(vec2seq(v, enabled), card(enabled), i)) <=
        card[below(N)](lowset(v, enabled, i))


decl_type: formula
theory: reduce_properties
library: fault_tolerance
signature: nil
location: 39 2 41 40
body:
    card_lowset: LEMMA
      FORALL (i: below(card(enabled))):
        i+1 <= card(lowset(v, enabled, i)) 


decl_type: formula
theory: reduce_properties
library: fault_tolerance
signature: nil
location: 46 2 49 44
body:
    card_upper_leq_highset: LEMMA
      FORALL (i: below(card(enabled))):
      card[below(card(enabled))](upper(vec2seq(v, enabled), card(enabled), i)) <=
        card[below(N)](highset(v, enabled, i))


decl_type: formula
theory: reduce_properties
library: fault_tolerance
signature: nil
location: 51 2 53 55
body:
    card_highset: LEMMA
      FORALL (i: below(card(enabled))):
        card(enabled) - i <= card(highset(v, enabled, i)) 


decl_type: formula
theory: reduce_properties
library: fault_tolerance
signature: nil
location: 63 2 63 100
body:
    min_reduce: LEMMA min(reduce(tau)(v, enabled)) = sort(vec2seq(v, enabled))`seq(tau(card(enabled)))


decl_type: formula
theory: reduce_properties
library: fault_tolerance
signature: nil
location: 65 2 66 91
body:
    max_reduce: LEMMA max(reduce(tau)(v, enabled)) = 
                        sort(vec2seq(v, enabled))`seq(card(enabled) - 1 - tau(card(enabled)))


decl_type: formula
theory: reduce_properties
library: fault_tolerance
signature: nil
location: 70 2 73 92
body:
    reduce_rewrite: LEMMA
        i < M(enabled, tau)
      IMPLIES
        reduce(tau)(v, enabled)`seq(i) = sort(vec2seq(v, enabled))`seq(tau(card(enabled)) + i)


decl_type: formula
theory: reduce_properties
library: fault_tolerance
signature: nil
location: 75 2 81 48
body:
    reduce_overlap: LEMMA
         i < M(enabled, tau) 
      IMPLIES
        EXISTS n:
          enabled(n) AND
          v1(n) <= reduce(tau)(v1, enabled)`seq(i) AND
          reduce(tau)(v2, enabled)`seq(i) <= v2(n)


decl_type: formula
theory: reduce_properties
library: fault_tolerance
signature: nil
location: 83 2 86 57
body:
    reduce_agreement: LEMMA
        enabled_symmetric?(enabled, v1, v2)
      IMPLIES
        reduce(tau)(v1, enabled) = reduce(tau)(v2, enabled)


decl_type: formula
theory: reduce_properties
library: fault_tolerance
signature: nil
location: 89 2 92 80
body:
    min_validity: LEMMA
        quorum?(enabled, tau)(nodes)
      IMPLIES
        EXISTS n: nodes(n) AND enabled(n) AND v(n) <= min(reduce(tau)(v, enabled))


decl_type: formula
theory: reduce_properties
library: fault_tolerance
signature: nil
location: 94 2 97 80
body:
    max_validity: LEMMA
        quorum?(enabled, tau)(nodes)
      IMPLIES
        EXISTS n: nodes(n) AND enabled(n) AND max(reduce(tau)(v, enabled)) <= v(n)


decl_type: formula
theory: reduce_properties
library: fault_tolerance
signature: nil
location: 116 2 120 60
body:
    choice_lower_validity: LEMMA
        quorum?(eligible, tau)(nodes)
      IMPLIES
        EXISTS n: nodes(n) AND eligible(n) AND 
          v(n) <= reduce_choice(cf, eligible, v, tau, default)


decl_type: formula
theory: reduce_properties
library: fault_tolerance
signature: nil
location: 122 2 126 60
body:
    choice_upper_validity: LEMMA
        quorum?(eligible, tau)(nodes)
      IMPLIES
        EXISTS n: nodes(n) AND eligible(n) AND 
          reduce_choice(cf, eligible, v, tau, default) <= v(n)


decl_type: formula
theory: reduce_properties
library: fault_tolerance
signature: nil
location: 129 2 133 53
body:
    choice_agreement_generation: LEMMA
        enabled_symmetric?(eligible, v1, v2)
      IMPLIES
        reduce_choice(cf, eligible, v1, tau, default) = 
          reduce_choice(cf, eligible, v2, tau, default)


decl_type: function
theory: reduce_properties
library: fault_tolerance
location: 31 2 32 75
signature:
  [[vec[N, T], enabled: non_empty_finite_set[below(N)],
         below(card(enabled))] ->
          finite_set[below(N)]]

body:
    lowset(v, enabled, (i: below(card(enabled)))): finite_set[below(N)] =
      {j:below(N) | enabled(j) AND v(j) <= sort(vec2seq(v, enabled))`seq(i) }


decl_type: function
theory: reduce_properties
library: fault_tolerance
location: 43 2 44 74
signature:
  [[vec[N, T], enabled: non_empty_finite_set[below(N)],
         below(card(enabled))] ->
          finite_set[below(N)]]

body:
    highset(v, enabled, (i: below(card(enabled)))): finite_set[below(N)] =
      {j:below(N) | enabled(j) AND sort(vec2seq(v, enabled))`seq(i) <= v(j)}


decl_type: function
theory: reduce_properties
library: fault_tolerance
signature:
  [tau_type ->
  [[vec[N, T], non_empty_finite_set[below(N)]] -> ne_seqs[T]]]

location: 58 2 61 45
body:
    reduce(tau)(v, enabled): ne_seqs = 
      LET s = vec2seq(v, enabled) IN
      LET t = tau(s`length) IN 
              sort(s) ^ (t, s`length - (t + 1))


decl_type: function
theory: reduce_properties
library: fault_tolerance
signature:
  [[consensus_function[T, <=], finite_set[below(N)], vec[N, T],
  tau_type, T] ->
  T]

location: 103 2 107 9
body:
    reduce_choice(cf, eligible, v, tau, default): T =
      IF empty?[below(N)](eligible) 
        THEN default
        ELSE cf(reduce(tau)(v, eligible))
      ENDIF


decl_type: function
theory: reduce_properties
library: fault_tolerance
signature:
  [[tau_type, consensus_function[T, <=], T] ->
  [[vec[N, T], finite_set[below(N)]] -> T]]

location: 110 2 114 9
body:
    reduce_choice2(tau, cf, default)(v, eligible): T =
      IF empty?[below(N)](eligible) 
        THEN default
        ELSE cf(reduce(tau)(v, eligible))
      ENDIF


decl_type: tcc
theory: reduce_properties
library: fault_tolerance
signature: nil
location: 141 0 146 999
body:
  % Subtype TCC generated (at line 32, column 71) for  i
      % expected type  below[sort(vec2seq(v, enabled))`length]
  lowset_TCC1: OBLIGATION
    FORALL (v: vec[N, T], enabled: non_empty_finite_set[below(N)],
            (i: below(card[below(N)](enabled))), j: below(N)):
      enabled(j) IMPLIES i < sort[T, <=](vec2seq[N, T](v, enabled))`length;


decl_type: tcc
theory: reduce_properties
library: fault_tolerance
signature: nil
location: 148 0 153 999
body:
  % Subtype TCC generated (at line 36, column 58) for  card(enabled)
      % expected type  posnat
  card_lower_leq_lowset_TCC1: OBLIGATION
    FORALL (enabled: non_empty_finite_set[below(N)],
            i: below(card[below(N)](enabled))):
      card[below(N)](enabled) > 0;


decl_type: tcc
theory: reduce_properties
library: fault_tolerance
signature: nil
location: 155 0 160 999
body:
  % Subtype TCC generated (at line 60, column 16) for  s`length
      % expected type  pn: posnat
  reduce_TCC1: OBLIGATION
    FORALL (v: vec[N, T], enabled: non_empty_finite_set[below(N)],
            s: ne_seqs[T]):
      s = vec2seq(v, enabled) IMPLIES s`length > 0;


decl_type: tcc
theory: reduce_properties
library: fault_tolerance
signature: nil
location: 162 0 169 999
body:
  % Subtype TCC generated (at line 61, column 26) for  s`length - (t + 1)
      % expected type  nat
  reduce_TCC2: OBLIGATION
    FORALL (tau: tau_type, v: vec[N, T],
            enabled: non_empty_finite_set[below(N)], s: ne_seqs[T]):
      s = vec2seq(v, enabled) IMPLIES
       (FORALL (t: {t: nat | 2 * t < s`length}):
          t = tau(s`length) IMPLIES s`length - (t + 1) >= 0);


decl_type: tcc
theory: reduce_properties
library: fault_tolerance
signature: nil
location: 171 0 180 999
body:
  % Subtype TCC generated (at line 61, column 12) for
      % sort(s) ^ (t, s`length - (t + 1))
      % expected type  ne_seqs[T]
  reduce_TCC3: OBLIGATION
    FORALL (tau: tau_type, v: vec[N, T],
            enabled: non_empty_finite_set[below(N)], s: ne_seqs[T]):
      s = vec2seq(v, enabled) IMPLIES
       (FORALL (t: {t: nat | 2 * t < s`length}):
          t = tau(s`length) IMPLIES
           length(^[T](sort[T, <=](s), (t, s`length - (t + 1)))) > 0);


decl_type: tcc
theory: reduce_properties
library: fault_tolerance
signature: nil
location: 182 0 186 999
body:
  % Subtype TCC generated (at line 63, column 85) for  card(enabled)
      % expected type  pn: posnat
  min_reduce_TCC1: OBLIGATION
    FORALL (enabled: non_empty_finite_set[below(N)]):
      card[below(N)](enabled) > 0;


decl_type: tcc
theory: reduce_properties
library: fault_tolerance
signature: nil
location: 188 0 194 999
body:
  % Subtype TCC generated (at line 63, column 81) for  tau(card(enabled))
      % expected type  below[sort(vec2seq(v, enabled))`length]
  min_reduce_TCC2: OBLIGATION
    FORALL (enabled: non_empty_finite_set[below(N)], tau: tau_type,
            v: vec[N, T]):
      tau(card[below(N)](enabled)) <
       sort[T, <=](vec2seq[N, T](v, enabled))`length;


decl_type: tcc
theory: reduce_properties
library: fault_tolerance
signature: nil
location: 196 0 204 999
body:
  % Subtype TCC generated (at line 66, column 52) for
      % card(enabled) - 1 - tau(card(enabled))
      % expected type  below[sort(vec2seq(v, enabled))`length]
  max_reduce_TCC1: OBLIGATION
    FORALL (enabled: non_empty_finite_set[below(N)], tau: tau_type,
            v: vec[N, T]):
      card[below(N)](enabled) - 1 - tau(card[below(N)](enabled)) >= 0 AND
       card[below(N)](enabled) - 1 - tau(card[below(N)](enabled)) <
        sort[T, <=](vec2seq[N, T](v, enabled))`length;


decl_type: tcc
theory: reduce_properties
library: fault_tolerance
signature: nil
location: 206 0 211 999
body:
  % Subtype TCC generated (at line 73, column 34) for  i
      % expected type  below[reduce(tau)(v, enabled)`length]
  reduce_rewrite_TCC1: OBLIGATION
    FORALL (enabled: non_empty_finite_set[below(N)], i: nat, tau: tau_type,
            v: vec[N, T]):
      i < M(enabled, tau) IMPLIES i < reduce(tau)(v, enabled)`length;


decl_type: tcc
theory: reduce_properties
library: fault_tolerance
signature: nil
location: 213 0 220 999
body:
  % Subtype TCC generated (at line 73, column 69) for  tau(card(enabled)) + i
      % expected type  below[sort(vec2seq(v, enabled))`length]
  reduce_rewrite_TCC2: OBLIGATION
    FORALL (enabled: non_empty_finite_set[below(N)], i: nat, tau: tau_type,
            v: vec[N, T]):
      i < M(enabled, tau) IMPLIES
       tau(card[below(N)](enabled)) + i <
        sort[T, <=](vec2seq[N, T](v, enabled))`length;


decl_type: tcc
theory: reduce_properties
library: fault_tolerance
signature: nil
location: 222 0 230 999
body:
  % Subtype TCC generated (at line 81, column 37) for  i
      % expected type  below[reduce(tau)(v2, enabled)`length]
  reduce_overlap_TCC1: OBLIGATION
    FORALL (enabled: non_empty_finite_set[below(N)], i: nat, tau: tau_type,
            v1, v2: vec[N, T]):
      i < M(enabled, tau) IMPLIES
       (FORALL (n):
          v1(n) <= reduce(tau)(v1, enabled)`seq(i) AND enabled(n) IMPLIES
           i < reduce(tau)(v2, enabled)`length);


decl_type: formula
theory: reduce_choice
library: fault_tolerance
signature: nil
location: 41 2 45 60
body:
    in_rcvd: LEMMA
        NOT empty?(enabled(rcvd, check)(d))
      IMPLIES
        EXISTS (s: below(S)):
          reduce_choice(tau, icf)(rcvd, check)(d) = rcvd(d)(s)


decl_type: formula
theory: reduce_choice
library: fault_tolerance
signature: nil
location: 47 2 48 85
body:
    min_reduce_choice: LEMMA
      reduce_choice(tau, min)(rcvd, check)(d) <= reduce_choice(tau, cf)(rcvd, check)(d)


decl_type: formula
theory: reduce_choice
library: fault_tolerance
signature: nil
location: 50 2 51 85
body:
    max_reduce_choice: LEMMA
      reduce_choice(tau, cf)(rcvd, check)(d) <= reduce_choice(tau, max)(rcvd, check)(d)


decl_type: function
theory: reduce_choice
library: fault_tolerance
location: 35 2 36 69
signature:
  [[tau_type, consensus_function[T, <=]] ->
          [[rcvd_matrix_stage[S, D, T], check_stage[S, D, T]] ->
             [below(D) -> T]]]

body:
    reduce_choice(tau, cf)(rcvd, check)(d): T = 
      reduce_choice(cf, enabled(rcvd, check)(d), rcvd(d), tau, default)


decl_type: function
theory: reduce_choice
library: fault_tolerance
location: 53 2 60 75
signature:
  [[rcvd_matrix_stage[S, D, T], check_stage[S, D, T], tau_type] ->
          [finite_set[below(S)] -> bool]]

body:
    reduce_overlap?(rcvd, check, tau)(src_set): bool = 
      FORALL d1, d2: 
        EXISTS s:
          src_set(s) AND
          enabled(rcvd, check)(d1)(s) AND
          enabled(rcvd, check)(d2)(s) AND
          min(reduce(tau)(rcvd(d1), enabled(rcvd, check)(d1))) <= rcvd(d1)(s) AND
          rcvd(d2)(s) <= max(reduce(tau)(rcvd(d2), enabled(rcvd, check)(d2)))


decl_type: function
theory: reduce_choice
library: fault_tolerance
signature:
  [[rcvd_matrix_stage[S, D, T], check_stage[S, D, T], tau_type] ->
  [below(D) -> nat]]

location: 62 2 65 9
body:
    M(rcvd, check, tau)(d): nat =
      IF empty?(enabled(rcvd, check)(d)) THEN 0
      ELSE M(enabled(rcvd, check)(d), tau)
      ENDIF


decl_type: tcc
theory: reduce_choice
library: fault_tolerance
signature: nil
location: 80 0 88 999
body:
  % Subtype TCC generated (at line 59, column 34) for
      % enabled(rcvd, check)(d1)
      % expected type  non_empty_finite_set[below(S)]
  reduce_overlap?_TCC1: OBLIGATION
    FORALL (rcvd: rcvd_matrix_stage[S, D, T], check: check_stage[S, D, T],
            src_set: finite_set[below(S)], d1, d2, s):
      enabled(rcvd, check)(d2)(s) AND
       enabled(rcvd, check)(d1)(s) AND src_set(s)
       IMPLIES NOT empty?[below(S)](enabled[S, D, T](rcvd, check)(d1));


decl_type: tcc
theory: reduce_choice
library: fault_tolerance
signature: nil
location: 90 0 99 999
body:
  % Subtype TCC generated (at line 60, column 49) for
      % enabled(rcvd, check)(d2)
      % expected type  non_empty_finite_set[below(S)]
  reduce_overlap?_TCC2: OBLIGATION
    FORALL (rcvd: rcvd_matrix_stage[S, D, T], check: check_stage[S, D, T],
            tau: tau_type, src_set: finite_set[below(S)], d1, d2, s):
      min(reduce(tau)(rcvd(d1), enabled(rcvd, check)(d1))) <= rcvd(d1)(s) AND
       enabled(rcvd, check)(d2)(s) AND
        enabled(rcvd, check)(d1)(s) AND src_set(s)
       IMPLIES NOT empty?[below(S)](enabled[S, D, T](rcvd, check)(d2));


decl_type: tcc
theory: reduce_choice
library: fault_tolerance
signature: nil
location: 101 0 111 999
body:
  % Subtype TCC generated (at line 70, column 8) for
      % image(M(rcvd, check, tau), fullset[below(D)])
      % expected type  SS: non_empty_finite_set[nat]
  max_length_TCC1: OBLIGATION
    FORALL (rcvd: rcvd_matrix_stage[S, D, T], check: check_stage[S, D, T],
            tau: tau_type):
      is_finite[nat]
          (image[below(D), nat](M(rcvd, check, tau), fullset[below(D)]))
       AND
       NOT empty?[nat]
               (image[below(D), nat](M(rcvd, check, tau), fullset[below(D)]));


decl_type: formula
theory: inexact_reduce_stage
library: fault_tolerance
signature: nil
location: 42 2 46 65
body:
    reduce_lower_validity: LEMMA
        quorum_lower?(sent, rcvd, check, tau, eps_l)
      IMPLIES
        EXISTS s: enabled(rcvd, check)(d)(s) AND 
          sent(s) - eps_l <= reduce_choice(tau, cf)(rcvd, check)(d)


decl_type: formula
theory: inexact_reduce_stage
library: fault_tolerance
signature: nil
location: 48 2 52 65
body:
    reduce_upper_validity: LEMMA
        quorum_upper?(sent, rcvd, check, tau, eps_u)
      IMPLIES
        EXISTS s: enabled(rcvd, check)(d)(s) AND
          reduce_choice(tau, cf)(rcvd, check)(d) <= sent(s) + eps_u


decl_type: formula
theory: inexact_reduce_stage
library: fault_tolerance
signature: nil
location: 54 2 60 88
body:
    reduce_master_slave: COROLLARY
        quorum_accuracy?(sent, rcvd, check, tau, eps_l, eps_u) AND
        enabled_within?(rcvd, check)(src_set) AND
        diameter?(sent, delta)(src_set) AND
        src_set(s)
      IMPLIES
        abs(sent(s) - reduce_choice(tau, cf)(rcvd, check)(d)) <= delta + max(eps_l, eps_u)


decl_type: formula
theory: inexact_reduce_stage
library: fault_tolerance
signature: nil
location: 62 2 67 108
body:
    reduce_agreement_propagation: THEOREM
        quorum_imprecision?(sent, rcvd, check, tau, epsilon) AND
        diameter?(sent, delta)(src_set) AND
        enabled_within?(rcvd, check)(src_set)
      IMPLIES
        reduce_choice(tau, cf1)(rcvd, check)(d1) - reduce_choice(tau, cf2)(rcvd, check)(d2) <= delta + epsilon


decl_type: formula
theory: inexact_reduce_stage
library: fault_tolerance
signature: nil
location: 78 2 81 41
body:
    convergence_overlap: LEMMA
        overlap_imprecision?(rcvd, check, tau, epsilon)
      IMPLIES
        overlap?(rcvd, check, tau, epsilon)


decl_type: formula
theory: inexact_reduce_stage
library: fault_tolerance
signature: nil
location: 83 2 92 44
body:
    reduce_convergence: THEOREM
        quorum_imprecision?(sent, rcvd, check, tau, epsilon) AND
        diameter?(sent, delta)(src_set) AND
        enabled_within?(rcvd, check)(src_set) AND
        overlap_imprecision?(rcvd, check, tau, epsilon) AND
        convergent?(cf, max_length(rcvd, check, tau), k)
      IMPLIES
        reduce_choice(tau, cf)(rcvd, check)(d1) 
          - reduce_choice(tau, cf)(rcvd, check)(d2) 
            <= delta * ((k - 1) / k) + epsilon


decl_type: formula
theory: inexact_reduce_stage
library: fault_tolerance
signature: nil
location: 94 2 98 98
body:
    reduce_agreement_generation: LEMMA
        all_symmetric?(rcvd, check, epsilon) AND
        inexact_consensus?(cf)
      IMPLIES
        reduce_choice(tau, cf)(rcvd, check)(d1) - reduce_choice(tau, cf)(rcvd, check)(d2) <= epsilon


decl_type: formula
theory: inexact_reduce_stage
library: fault_tolerance
signature: nil
location: 103 2 107 89
body:
    reduce_min_validity: LEMMA
        quorum_lower?(sent, rcvd, check, tau, eps_l) AND
        enabled_within?(rcvd, check)(src_set)
      IMPLIES
        v_min(sent, src_set) - eps_l <= v_min(reduce_choice(tau, cf)(rcvd, check), dst_set)


decl_type: formula
theory: inexact_reduce_stage
library: fault_tolerance
signature: nil
location: 109 2 114 39
body:
    reduce_max_validity: LEMMA
        quorum_upper?(sent, rcvd, check, tau, eps_u) AND
        enabled_within?(rcvd, check)(src_set)
      IMPLIES
        v_max(reduce_choice(tau, cf)(rcvd, check), dst_set) 
          <= v_max(sent, src_set) + eps_u


decl_type: formula
theory: inexact_reduce_stage
library: fault_tolerance
signature: nil
location: 116 2 119 37
body:
    minmax_diameter: LEMMA
        v_max(sent, src_set) - v_min(sent, src_set) <= delta
      IMPLIES
        diameter?(sent, delta)(src_set)


decl_type: formula
theory: inexact_reduce_stage
library: fault_tolerance
signature: nil
location: 121 2 127 77
body:
    agreement_propagation: LEMMA
        quorum_imprecision?(sent, rcvd, check, tau, epsilon) AND
        enabled_within?(rcvd, check)(src_set) AND
        v_max(sent, src_set) - v_min(sent, src_set) <= delta
      IMPLIES
        v_max(reduce_choice(tau, cf1)(rcvd, check), dst_set) -
        v_min(reduce_choice(tau, cf2)(rcvd, check), dst_set) <= delta + epsilon


decl_type: formula
theory: inexact_reduce_stage
library: fault_tolerance
signature: nil
location: 129 2 134 68
body:
    agreement_generation: LEMMA
        all_symmetric?(rcvd, check, epsilon) AND
        inexact_consensus?(cf)
      IMPLIES
        v_max(reduce_choice(tau, cf)(rcvd, check), dst_set) -
        v_min(reduce_choice(tau, cf)(rcvd, check), dst_set) <= epsilon


decl_type: formula
theory: inexact_reduce_stage
library: fault_tolerance
signature: nil
location: 136 2 145 44
body:
    convergence: LEMMA
        quorum_imprecision?(sent, rcvd, check, tau, epsilon) AND
        overlap_imprecision?(rcvd, check, tau, epsilon) AND
        convergent?(cf, max_length(rcvd, check, tau), k) AND
        enabled_within?(rcvd, check)(src_set) AND
        v_max(sent, src_set) - v_min(sent, src_set) <= delta
      IMPLIES
        v_max(reduce_choice(tau, cf)(rcvd, check), dst_set) -
          v_min(reduce_choice(tau, cf)(rcvd, check), dst_set) 
            <= delta * ((k - 1) / k) + epsilon


decl_type: function
theory: inexact_reduce_stage
library: fault_tolerance
location: 69 2 72 56
signature:
  [[rcvd_matrix_stage[S, D, real], check_stage[S, D, real],
         tau_type, nonneg_real] ->
          bool]

body:
    overlap_imprecision?(rcvd, check, tau, epsilon): bool =
      EXISTS (src_set: finite_set[below(S)]):
        reduce_overlap?(rcvd, check, tau)(src_set) AND
        single_imprecision?(rcvd, check, epsilon)(src_set)


decl_type: function
theory: inexact_reduce_stage
library: fault_tolerance
location: 74 2 76 100
signature:
  [[rcvd_matrix_stage[S, D, real], check_stage[S, D, real],
         tau_type, nonneg_real] ->
          bool]

body:
    overlap?(rcvd, check, tau, epsilon): bool =
      FORALL d1, d2:  
        reduce_choice(tau, min)(rcvd, check)(d1) - reduce_choice(tau, max)(rcvd, check)(d2) <= epsilon


decl_type: formula
theory: weber_overlap
library: fault_tolerance
signature: nil
location: 18 2 28 50
body:
    weber_overlap: LEMMA
        subset?(e1, src_set) AND
        subset?(e2, src_set) AND
        intersection_majority?(e1, e2, src_set)
      IMPLIES
        EXISTS k:
          src_set(k) AND
          e1(k) AND
          e2(k) AND
          min(reduce(tau(src_set))(v1, e1)) <= v1(k) AND
          v2(k) <= max(reduce(tau(src_set))(v2, e2))


decl_type: formula
theory: weber_stage
library: fault_tolerance
signature: nil
location: 27 2 32 62
body:
    overlap_imprecision: LEMMA
        enabled_within?(rcvd, check)(src_set) AND
        intersection_majority?(rcvd, check)(src_set) AND 
        single_imprecision?(rcvd, check, epsilon)(src_set)
      IMPLIES
        overlap_imprecision?(rcvd, check, tau(src_set), epsilon)


decl_type: formula
theory: weber_stage
library: fault_tolerance
signature: nil
location: 34 2 44 44
body:
    weber_convergence: THEOREM
        quorum_imprecision?(sent, rcvd, check, tau(src_set), epsilon) AND
        intersection_majority?(rcvd, check)(src_set) AND 
        single_imprecision?(rcvd, check, epsilon)(src_set) AND
        convergent?(cf, max_length(rcvd, check, tau(src_set)), X) AND
        enabled_within?(rcvd, check)(src_set) AND
        v_max(sent, src_set) - v_min(sent, src_set) <= delta
      IMPLIES
        v_max(reduce_choice(tau(src_set), cf)(rcvd, check), dst_set) -
          v_min(reduce_choice(tau(src_set), cf)(rcvd, check), dst_set) 
            <= delta * ((X - 1) / X) + epsilon


decl_type: formula
theory: weber_stage
library: fault_tolerance
signature: nil
location: 46 2 56 44
body:
    weber_mean_convergence: COROLLARY
        X = max_length(rcvd, check, tau(src_set)) AND
        quorum_imprecision?(sent, rcvd, check, tau(src_set), epsilon) AND
        intersection_majority?(rcvd, check)(src_set) AND 
        single_imprecision?(rcvd, check, epsilon)(src_set) AND
        enabled_within?(rcvd, check)(src_set) AND
        v_max(sent, src_set) - v_min(sent, src_set) <= delta
      IMPLIES
        v_max(reduce_choice(tau(src_set), mean)(rcvd, check), dst_set) -
          v_min(reduce_choice(tau(src_set), mean)(rcvd, check), dst_set) 
            <= delta * ((X - 1) / X) + epsilon


decl_type: formula
theory: weber_stage
library: fault_tolerance
signature: nil
location: 58 2 67 32
body:
    weber_midpoint_convergence: COROLLARY
        quorum_imprecision?(sent, rcvd, check, tau(src_set), epsilon) AND
        intersection_majority?(rcvd, check)(src_set) AND 
        single_imprecision?(rcvd, check, epsilon)(src_set) AND
        enabled_within?(rcvd, check)(src_set) AND
        v_max(sent, src_set) - v_min(sent, src_set) <= delta
      IMPLIES
        v_max(reduce_choice(tau(src_set), midpoint)(rcvd, check), dst_set) -
          v_min(reduce_choice(tau(src_set), midpoint)(rcvd, check), dst_set) 
            <= delta / 2 + epsilon


decl_type: formula
theory: pigeonhole_int
library: fault_tolerance
signature: nil
location: 57 2 60 59
body:
    two_thirds_split: LEMMA
        two_thirds_majority_subset?(A, S)
      IMPLIES
        two_thirds_majority_subset?(split(A, C), split(S, C))   


decl_type: formula
theory: pigeonhole_int
library: fault_tolerance
signature: nil
location: 62 2 67 38
body:
    two_thirds_overlap_lem: LEMMA
        two_thirds_majority_subset?(A, S1) AND
        two_thirds_majority_subset?(split(B, C), split(S2, C)) AND
        intersection_majority?(S1, split(S2, C))
      IMPLIES
        EXISTS x: A(x) AND B(x) AND C(x)


decl_type: formula
theory: pigeonhole_int
library: fault_tolerance
signature: nil
location: 70 2 75 38
body:
    fta_overlap_pigeonhole: LEMMA
        two_thirds_majority_subset?(A, S1) AND
        two_thirds_majority_subset?(B, S2) AND
        byzantine_intersection_majority?(S1, S2, C)
      IMPLIES
        EXISTS x: A(x) AND B(x) AND C(x)


decl_type: tcc
theory: pigeonhole_int
library: fault_tolerance
signature: nil
location: 82 0 86 999
body:
  % Subtype TCC generated (at line 30, column 31) for  image(complement)(X)
      % expected type  finite_set[int]
  mirror_TCC1: OBLIGATION
    FORALL (X: finite_set[int]):
      is_finite[int](image[int, int](complement)(X));


decl_type: tcc
theory: pigeonhole_int
library: fault_tolerance
signature: nil
location: 88 0 90 999
body:
  % Judgement subtype TCC generated (at line 43, column 24) for  mirror(A)
      % expected type  negint_set
  mirror_nat: OBLIGATION FORALL (A, x: int): mirror(A)(x) => x < 0;


decl_type: tcc
theory: pigeonhole_int
library: fault_tolerance
signature: nil
location: 92 0 95 999
body:
  % Judgement subtype TCC generated (at line 44, column 27) for  mirror(A_bar)
      % expected type  nat_set
  mirror_negint: OBLIGATION
    FORALL (A_bar, x: int): mirror(A_bar)(x) => x >= 0;


decl_type: formula
theory: middle_third_pigeonhole
library: fault_tolerance
signature: nil
location: 11 2 16 38
body:
    middle_third_pigeonhole: LEMMA
        two_thirds_majority_subset?(A, S1) AND
        two_thirds_majority_subset?(B, S2) AND
        byzantine_intersection_majority?(S1, S2, C)
      IMPLIES
        EXISTS x: A(x) AND B(x) AND C(x)


decl_type: formula
theory: middle_third_overlap
library: fault_tolerance
signature: nil
location: 19 2 27 41
body:
    middle_third_overlap: LEMMA
         byzantine_intersection_majority?(e1, e2, src_set)
      IMPLIES
        EXISTS k: 
          src_set(k) AND
          e1(k) AND 
          e2(k) AND 
          min(reduce(byz)(v1, e1)) <= v1(k) AND 
          v2(k) <= max(reduce(byz)(v2, e2))


decl_type: formula
theory: middle_third_stage
library: fault_tolerance
signature: nil
location: 31 2 34 53
body:
    byzantine_overlap: LEMMA
        byz_overlap_imprecision?(rcvd, check, epsilon)
      IMPLIES
        overlap_imprecision?(rcvd, check, byz, epsilon)


decl_type: formula
theory: middle_third_stage
library: fault_tolerance
signature: nil
location: 36 2 45 44
body:
    middle_third_convergence: LEMMA
        quorum_imprecision?(sent, rcvd, check, byz, epsilon) AND
        byz_overlap_imprecision?(rcvd, check, epsilon) AND
        convergent?(cf, max_length(rcvd, check, byz), X) AND
        enabled_within?(rcvd, check)(src_set) AND
        v_max(sent, src_set) - v_min(sent, src_set) <= delta
      IMPLIES
        v_max(reduce_choice(byz, cf)(rcvd, check), dst_set) -
          v_min(reduce_choice(byz, cf)(rcvd, check), dst_set) 
            <= delta * ((X - 1) / X) + epsilon


decl_type: formula
theory: middle_third_stage
library: fault_tolerance
signature: nil
location: 47 2 56 44
body:
    mean_convergence: COROLLARY
        X = max_length(rcvd, check, byz) AND
        quorum_imprecision?(sent, rcvd, check, byz, epsilon) AND
        byz_overlap_imprecision?(rcvd, check, epsilon) AND
        enabled_within?(rcvd, check)(src_set) AND
        v_max(sent, src_set) - v_min(sent, src_set) <= delta
      IMPLIES
        v_max(reduce_choice(byz, mean)(rcvd, check), dst_set) -
          v_min(reduce_choice(byz, mean)(rcvd, check), dst_set) 
            <= delta * ((X - 1) / X) + epsilon


decl_type: formula
theory: middle_third_stage
library: fault_tolerance
signature: nil
location: 58 2 66 32
body:
    midpoint_convergence: COROLLARY
        quorum_imprecision?(sent, rcvd, check, byz, epsilon) AND
        byz_overlap_imprecision?(rcvd, check, epsilon) AND
        enabled_within?(rcvd, check)(src_set) AND
        v_max(sent, src_set) - v_min(sent, src_set) <= delta
      IMPLIES
        v_max(reduce_choice(byz, midpoint)(rcvd, check), dst_set) -
          v_min(reduce_choice(byz, midpoint)(rcvd, check), dst_set) 
            <= delta / 2 + epsilon


decl_type: function
theory: middle_third_stage
library: fault_tolerance
signature:
  [[rcvd_matrix_stage[S, D, real], check_stage[S, D, real],
  nonneg_real] ->
  bool]

location: 26 2 29 56
body:
    byz_overlap_imprecision?(rcvd, check, epsilon): bool = 
      EXISTS (src_set: finite_set[below(S)]):
        byzantine_intersection_majority?(rcvd, check)(src_set) AND 
        single_imprecision?(rcvd, check, epsilon)(src_set)


decl_type: formula
theory: median_overlap
library: fault_tolerance
signature: nil
location: 13 2 20 41
body:
    median_overlap: LEMMA 
        card(union(e1, e2)) - card(intersection(e1, e2)) <= 1
      IMPLIES
        EXISTS k: 
          e1(k) AND 
          e2(k) AND 
          min(reduce(mid)(v1, e1)) <= v1(k) AND 
          v2(k) <= max(reduce(mid)(v2, e2))


decl_type: formula
theory: median_stage
library: fault_tolerance
signature: nil
location: 31 2 36 53
body:
    one_asymmetric_overlap: LEMMA
        enabled_nonempty?(rcvd, check) AND
        one_asymmetric_ommission?(rcvd, check) AND
        all_single_imprecision?(rcvd, check, epsilon)
      IMPLIES
        overlap_imprecision?(rcvd, check, mid, epsilon)


decl_type: formula
theory: median_stage
library: fault_tolerance
signature: nil
location: 38 2 45 104
body:
    median_convergence: THEOREM 
        quorum_imprecision?(sent, rcvd, check, mid, epsilon) AND
        one_asymmetric_ommission?(rcvd, check) AND
        all_single_imprecision?(rcvd, check, epsilon) AND
        enabled_within?(rcvd, check)(src_set) AND
        v_max(sent, src_set) - v_min(sent, src_set) <= delta
      IMPLIES
        v_max(median(rcvd, check), dst_set) - v_min(median(rcvd, check), dst_set) <= (delta / 2) + epsilon


decl_type: function
theory: median_stage
library: fault_tolerance
signature:
  [[rcvd_matrix_stage[S, D, real], check_stage[S, D, real]] ->
  bool]

location: 26 2 29 93
body:
    one_asymmetric_ommission?(rcvd, check): bool = 
      FORALL d1, d2:
        card[below(S)](union(enabled(rcvd, check)(d1), enabled(rcvd, check)(d2))) -
          card[below(S)](intersection(enabled(rcvd, check)(d1), enabled(rcvd, check)(d2))) <= 1


decl_type: function
theory: k_ordered
library: fault_tolerance
signature:
  [[[j: nat -> tau_type], k_consensus_function] ->
  choice_function[N, T]]

location: 37 2 38 73
body:
    reduce_choice(tau, cf): choice_function = 
      LAMBDA j: reduce_choice[N(j), N(j+1), T, <=, error(j)](tau(j), cf(j))


decl_type: formula
theory: protocol
library: fault_tolerance
signature: nil
location: 72 2 74 49
body:
    protocol_rw: LEMMA
      protocol(sent, rcvd, check, choice, k) 
        = protocol(choice, sent, rcvd, check, 0, k) 


decl_type: function
theory: protocol
library: fault_tolerance
location: 32 2 34 48
signature:
  [[choice_function[N, T], sent_vec[N, T], rcvd_matrix[N, T],
         check_function[N, T], nat, nat] ->
          bool]

body:
    protocol(choice, sent, rcvd, check, j, k) : bool = 
      FORALL i : j <= i AND i < k IMPLIES
        sent(i + 1) = choice(i)(rcvd(i), check(i))


decl_type: function
theory: protocol
library: fault_tolerance
location: 40 2 42 62
signature:
  [[compute_function[N, T], choice_function[N, T], sent_vec[N, T],
         rcvd_matrix[N, T], check_function[N, T], nat, nat] ->
          bool]

body:
    protocol(compute, choice, sent, rcvd, check, j, k) : bool = 
      FORALL i : j <= i AND i < k IMPLIES 
        sent(i + 1) = compute(i+1)(choice(i)(rcvd(i), check(i)))


decl_type: function
theory: protocol
library: fault_tolerance
location: 59 2 61 48
signature:
  [[sent_vec[N, T], rcvd_matrix[N, T], check_function[N, T],
         choice_function[N, T], nat] ->
          bool]

body:
    protocol(sent, rcvd, check, choice, k) : bool = 
      FORALL i : i < k IMPLIES
        sent(i + 1) = choice(i)(rcvd(i), check(i))


decl_type: function
theory: inexact_comm
library: fault_tolerance
location: 35 2 37 74
signature:
  [[rcvd_matrix[N, real], check_function[N, real], nat, nat] ->
          [[j: nat -> finite_set[below(N(j))]] -> bool]]

body:
    enabled_within?(rcvd, check, j, k)(sources): bool = 
      FORALL i : j <= i AND i < k IMPLIES
        enabled_within?[N(i), N(i + 1), real](rcvd(i), check(i))(sources(i))


decl_type: function
theory: inexact_comm
library: fault_tolerance
location: 41 2 43 77
signature:
  [[sent_vec[N, real], rcvd_matrix[N, real],
         check_function[N, real], [nat -> nonneg_real], nat, nat] ->
          bool]

body:
    majority_lower?(sent, rcvd, check, epsilon, j, k): bool =
      FORALL i : j <= i AND i < k IMPLIES
        majority_lower?[N(i), N(i + 1)](sent(i), rcvd(i), check(i), epsilon(i))


decl_type: function
theory: inexact_comm
library: fault_tolerance
location: 45 2 47 77
signature:
  [[sent_vec[N, real], rcvd_matrix[N, real],
         check_function[N, real], [nat -> nonneg_real], nat, nat] ->
          bool]

body:
    majority_upper?(sent, rcvd, check, epsilon, j, k): bool =
      FORALL i : j <= i AND i < k IMPLIES
        majority_upper?[N(i), N(i + 1)](sent(i), rcvd(i), check(i), epsilon(i))


decl_type: function
theory: inexact_comm
library: fault_tolerance
location: 49 2 51 83
signature:
  [[sent_vec[N, real], rcvd_matrix[N, real],
         check_function[N, real], [nat -> nonneg_real], nat, nat] ->
          bool]

body:
    majority_imprecision?(sent, rcvd, check, epsilon, j, k): bool =
      FORALL i : j <= i AND i < k IMPLIES
        majority_imprecision?[N(i), N(i + 1)](sent(i), rcvd(i), check(i), epsilon(i))


decl_type: function
theory: inexact_comm
library: fault_tolerance
location: 53 2 57 65
signature:
  [[sent_vec[N, real], rcvd_matrix[N, real],
         check_function[N, real], [nat -> nonneg_real],
         [nat -> consensus_function[real, <=]], nat, nat] ->
          bool]

body:
    exists_all_symmetric?(sent, rcvd, check, epsilon, cf, j, k): bool =
      EXISTS i: j <= i AND i < k AND
        inexact_consensus?(cf(i)) AND
        all_symmetric?(rcvd(i), check(i), epsilon(i)) AND
        majority_imprecision?(sent, rcvd, check, epsilon, i + 1, k)


decl_type: function
theory: inexact_comm
library: fault_tolerance
location: 61 2 63 83
signature:
  [[sent_vec[N, real], rcvd_matrix[N, real],
         check_function[N, real], [i: nat -> tau_type],
         [nat -> nonneg_real], nat, nat] ->
          bool]

body:
    quorum_lower?(sent, rcvd, check, tau, epsilon, j, k): bool =
      FORALL i : j <= i AND i < k IMPLIES
        quorum_lower?[N(i), N(i + 1)](sent(i), rcvd(i), check(i), tau(i), epsilon(i))


decl_type: function
theory: inexact_comm
library: fault_tolerance
location: 65 2 67 83
signature:
  [[sent_vec[N, real], rcvd_matrix[N, real],
         check_function[N, real], [i: nat -> tau_type],
         [nat -> nonneg_real], nat, nat] ->
          bool]

body:
    quorum_upper?(sent, rcvd, check, tau, epsilon, j, k): bool =
      FORALL i : j <= i AND i < k IMPLIES
        quorum_upper?[N(i), N(i + 1)](sent(i), rcvd(i), check(i), tau(i), epsilon(i))


decl_type: function
theory: inexact_comm
library: fault_tolerance
location: 69 2 71 89
signature:
  [[sent_vec[N, real], rcvd_matrix[N, real],
         check_function[N, real], [i: nat -> tau_type],
         [nat -> nonneg_real], nat, nat] ->
          bool]

body:
    quorum_imprecision?(sent, rcvd, check, tau, epsilon, j, k): bool =
      FORALL i : j <= i AND i < k IMPLIES
        quorum_imprecision?[N(i), N(i + 1)](sent(i), rcvd(i), check(i), tau(i), epsilon(i))


decl_type: function
theory: inexact_comm
library: fault_tolerance
location: 73 2 77 68
signature:
  [[sent_vec[N, real], rcvd_matrix[N, real],
         check_function[N, real], [i: nat -> tau_type],
         [nat -> nonneg_real], [nat -> consensus_function[real, <=]],
         nat, nat] ->
          bool]

body:
    exists_all_symmetric?(sent, rcvd, check, tau, epsilon, cf, j, k): bool =
      EXISTS i: j <= i AND i < k AND
        inexact_consensus?(cf(i)) AND
        all_symmetric?(rcvd(i), check(i), epsilon(i)) AND
        quorum_imprecision?(sent, rcvd, check, tau, epsilon, i + 1, k)


decl_type: formula
theory: inexact_reduce
library: fault_tolerance
signature: nil
location: 42 2 47 91
body:
    lower_validity: THEOREM
        protocol(reduce_choice(tau, cf), sent, rcvd, check, j, j + k) AND
        quorum_lower?(sent, rcvd, check, tau, eps_l, j, j + k) AND
        enabled_within?(rcvd, check, j, j + k)(node_set)
      IMPLIES
        v_min(sent, node_set)(j) - sigma(j, j + k - 1, eps_l) <= v_min(sent, node_set)(j + k)


decl_type: formula
theory: inexact_reduce
library: fault_tolerance
signature: nil
location: 49 2 54 91
body:
    upper_validity: THEOREM
        protocol(reduce_choice(tau, cf), sent, rcvd, check, j, j + k) AND
        quorum_upper?(sent, rcvd, check, tau, eps_u, j, j + k) AND
        enabled_within?(rcvd, check, j, j + k)(node_set)
      IMPLIES
        v_max(sent, node_set)(j + k) <= v_max(sent, node_set)(j) + sigma(j, j + k - 1, eps_u)


decl_type: formula
theory: inexact_reduce
library: fault_tolerance
signature: nil
location: 56 2 63 47
body:
    agreement_propagation: THEOREM
        protocol(reduce_choice(tau, cf), sent, rcvd, check, j, j + k) AND
        quorum_imprecision?(sent, rcvd, check, tau, epsilon, j, j + k) AND
        enabled_within?(rcvd, check, j, j + k)(node_set) AND
        v_max(sent, node_set)(j) - v_min(sent, node_set)(j) <= delta
      IMPLIES
        v_max(sent, node_set)(j + k) - v_min(sent, node_set)(j + k) 
          <= delta + sigma(j, j + k - 1, epsilon)


decl_type: formula
theory: inexact_reduce
library: fault_tolerance
signature: nil
location: 72 2 80 63
body:
    convergence: THEOREM
        protocol(reduce_choice(tau, cf), sent, rcvd, check, j, j + k) AND
        quorum_imprecision?(sent, rcvd, check, tau, epsilon, j, j + k) AND
        enabled_within?(rcvd, check, j, j + k)(node_set) AND
        convergent_stage?(rcvd, check, tau, epsilon, cf, X, j, j + k) AND
        v_max(sent, node_set)(j) - v_min(sent, node_set)(j) <= delta
      IMPLIES
        v_max(sent, node_set)(j + k) - v_min(sent, node_set)(j + k) 
          <= delta * ((X - 1) / X) + sigma(j, j + k - 1, epsilon)


decl_type: formula
theory: inexact_reduce
library: fault_tolerance
signature: nil
location: 82 2 87 97
body:
    agreement_generation: THEOREM
        protocol(reduce_choice(tau, cf), sent, rcvd, check, j, j + k) AND
        exists_all_symmetric?(sent, rcvd, check, tau, epsilon, cf, j, j + k) AND
        enabled_within?(rcvd, check, j, j + k)(node_set)
      IMPLIES
        v_max(sent, node_set)(j + k) - v_min(sent, node_set)(j + k) <= sigma(j, j + k - 1, epsilon)


decl_type: function
theory: inexact_reduce
library: fault_tolerance
location: 67 2 70 102
signature:
  [[rcvd_matrix[N, real], check_function[N, real],
         [j: nat -> tau_type], [nat -> nonneg_real],
         k_consensus_function[N, real, <=, error], posnat, nat, nat] ->
          bool]

body:
    convergent_stage?(rcvd, check, tau, epsilon, cf, X, j, k): bool = 
      EXISTS i: j <= i AND i < k AND
        overlap_imprecision?[N(i), N(i + 1), error(i)](rcvd(i), check(i), tau(i), epsilon(i)) AND
        convergent?(cf(i), max_length[N(i), N(i + 1), real, <=, error(i)](rcvd(i), check(i), tau(i)), X)


decl_type: tcc
theory: inexact_reduce
library: fault_tolerance
signature: nil
location: 94 0 106 999
body:
  % Subtype TCC generated (at line 47, column 39) for  j
      % expected type  T_low[nat]
  lower_validity_TCC1: OBLIGATION
    FORALL (cf: k_consensus_function[N, real, <=, error],
            check: check_function[N, real], eps_l: [nat -> nonneg_real],
            j, k: nat,
            node_set: [i: nat -> non_empty_finite_set[below(N(i))]],
            rcvd: rcvd_matrix[N, real], sent: sent_vec[N, real],
            tau: [j: nat -> tau_type]):
      enabled_within?(rcvd, check, j, j + k)(node_set) AND
       quorum_lower?(sent, rcvd, check, tau, eps_l, j, j + k) AND
        protocol(reduce_choice(tau, cf), sent, rcvd, check, j, j + k)
       IMPLIES j >= 0 OR (EXISTS (j_1: nat): j_1 <= j);


decl_type: tcc
theory: inexact_reduce
library: fault_tolerance
signature: nil
location: 108 0 120 999
body:
  % Subtype TCC generated (at line 47, column 42) for  j + k - 1
      % expected type  T_high[nat]
  lower_validity_TCC2: OBLIGATION
    FORALL (cf: k_consensus_function[N, real, <=, error],
            check: check_function[N, real], eps_l: [nat -> nonneg_real],
            j, k: nat,
            node_set: [i: nat -> non_empty_finite_set[below(N(i))]],
            rcvd: rcvd_matrix[N, real], sent: sent_vec[N, real],
            tau: [j: nat -> tau_type]):
      enabled_within?(rcvd, check, j, j + k)(node_set) AND
       quorum_lower?(sent, rcvd, check, tau, eps_l, j, j + k) AND
        protocol(reduce_choice(tau, cf), sent, rcvd, check, j, j + k)
       IMPLIES j + k - 1 >= 0 OR (EXISTS (j_1: nat): j + k - 1 <= j_1);


decl_type: tcc
theory: inexact_reduce
library: fault_tolerance
signature: nil
location: 122 0 134 999
body:
  % Subtype TCC generated (at line 54, column 71) for  j
      % expected type  T_low[nat]
  upper_validity_TCC1: OBLIGATION
    FORALL (cf: k_consensus_function[N, real, <=, error],
            check: check_function[N, real], eps_u: [nat -> nonneg_real],
            j, k: nat,
            node_set: [i: nat -> non_empty_finite_set[below(N(i))]],
            rcvd: rcvd_matrix[N, real], sent: sent_vec[N, real],
            tau: [j: nat -> tau_type]):
      enabled_within?(rcvd, check, j, j + k)(node_set) AND
       quorum_upper?(sent, rcvd, check, tau, eps_u, j, j + k) AND
        protocol(reduce_choice(tau, cf), sent, rcvd, check, j, j + k)
       IMPLIES j >= 0 OR (EXISTS (j_1: nat): j_1 <= j);


decl_type: tcc
theory: inexact_reduce
library: fault_tolerance
signature: nil
location: 136 0 148 999
body:
  % Subtype TCC generated (at line 54, column 74) for  j + k - 1
      % expected type  T_high[nat]
  upper_validity_TCC2: OBLIGATION
    FORALL (cf: k_consensus_function[N, real, <=, error],
            check: check_function[N, real], eps_u: [nat -> nonneg_real],
            j, k: nat,
            node_set: [i: nat -> non_empty_finite_set[below(N(i))]],
            rcvd: rcvd_matrix[N, real], sent: sent_vec[N, real],
            tau: [j: nat -> tau_type]):
      enabled_within?(rcvd, check, j, j + k)(node_set) AND
       quorum_upper?(sent, rcvd, check, tau, eps_u, j, j + k) AND
        protocol(reduce_choice(tau, cf), sent, rcvd, check, j, j + k)
       IMPLIES j + k - 1 >= 0 OR (EXISTS (j_1: nat): j + k - 1 <= j_1);


decl_type: tcc
theory: inexact_reduce
library: fault_tolerance
signature: nil
location: 150 0 163 999
body:
  % Subtype TCC generated (at line 63, column 25) for  j
      % expected type  T_low[nat]
  agreement_propagation_TCC1: OBLIGATION
    FORALL (cf: k_consensus_function[N, real, <=, error],
            check: check_function[N, real], delta: nonneg_real,
            epsilon: [nat -> nonneg_real], j, k: nat,
            node_set: [i: nat -> non_empty_finite_set[below(N(i))]],
            rcvd: rcvd_matrix[N, real], sent: sent_vec[N, real],
            tau: [j: nat -> tau_type]):
      v_max(sent, node_set)(j) - v_min(sent, node_set)(j) <= delta AND
       enabled_within?(rcvd, check, j, j + k)(node_set) AND
        quorum_imprecision?(sent, rcvd, check, tau, epsilon, j, j + k) AND
         protocol(reduce_choice(tau, cf), sent, rcvd, check, j, j + k)
       IMPLIES j >= 0 OR (EXISTS (j_1: nat): j_1 <= j);


decl_type: tcc
theory: inexact_reduce
library: fault_tolerance
signature: nil
location: 165 0 178 999
body:
  % Subtype TCC generated (at line 63, column 28) for  j + k - 1
      % expected type  T_high[nat]
  agreement_propagation_TCC2: OBLIGATION
    FORALL (cf: k_consensus_function[N, real, <=, error],
            check: check_function[N, real], delta: nonneg_real,
            epsilon: [nat -> nonneg_real], j, k: nat,
            node_set: [i: nat -> non_empty_finite_set[below(N(i))]],
            rcvd: rcvd_matrix[N, real], sent: sent_vec[N, real],
            tau: [j: nat -> tau_type]):
      v_max(sent, node_set)(j) - v_min(sent, node_set)(j) <= delta AND
       enabled_within?(rcvd, check, j, j + k)(node_set) AND
        quorum_imprecision?(sent, rcvd, check, tau, epsilon, j, j + k) AND
         protocol(reduce_choice(tau, cf), sent, rcvd, check, j, j + k)
       IMPLIES j + k - 1 >= 0 OR (EXISTS (j_1: nat): j + k - 1 <= j_1);


decl_type: tcc
theory: inexact_reduce
library: fault_tolerance
signature: nil
location: 180 0 192 999
body:
  % Subtype TCC generated (at line 87, column 75) for  j
      % expected type  T_low[nat]
  agreement_generation_TCC1: OBLIGATION
    FORALL (cf: k_consensus_function[N, real, <=, error],
            check: check_function[N, real], epsilon: [nat -> nonneg_real],
            j, k: nat,
            node_set: [i: nat -> non_empty_finite_set[below(N(i))]],
            rcvd: rcvd_matrix[N, real], sent: sent_vec[N, real],
            tau: [j: nat -> tau_type]):
      enabled_within?(rcvd, check, j, j + k)(node_set) AND
       exists_all_symmetric?(sent, rcvd, check, tau, epsilon, cf, j, j + k)
        AND protocol(reduce_choice(tau, cf), sent, rcvd, check, j, j + k)
       IMPLIES j >= 0 OR (EXISTS (j_1: nat): j_1 <= j);


decl_type: tcc
theory: inexact_reduce
library: fault_tolerance
signature: nil
location: 194 0 206 999
body:
  % Subtype TCC generated (at line 87, column 78) for  j + k - 1
      % expected type  T_high[nat]
  agreement_generation_TCC2: OBLIGATION
    FORALL (cf: k_consensus_function[N, real, <=, error],
            check: check_function[N, real], epsilon: [nat -> nonneg_real],
            j, k: nat,
            node_set: [i: nat -> non_empty_finite_set[below(N(i))]],
            rcvd: rcvd_matrix[N, real], sent: sent_vec[N, real],
            tau: [j: nat -> tau_type]):
      enabled_within?(rcvd, check, j, j + k)(node_set) AND
       exists_all_symmetric?(sent, rcvd, check, tau, epsilon, cf, j, j + k)
        AND protocol(reduce_choice(tau, cf), sent, rcvd, check, j, j + k)
       IMPLIES j + k - 1 >= 0 OR (EXISTS (j_1: nat): j + k - 1 <= j_1);


decl_type: formula
theory: integration_fault_model
library: fault_tolerance
signature: nil
location: 70 0 75 999
body:
  fault_class_ord_defaxiom: AXIOM
         fault_class_ord(good) = 0 AND fault_class_ord(omissive_symmetric) = 1
     AND fault_class_ord(omissive_asymmetric) = 2
     AND fault_class_ord(transmissive_symmetric) = 3
     AND fault_class_ord(single_error_asymmetric) = 4
     AND fault_class_ord(transmissive_asymmetric) = 5;


decl_type: formula
theory: integration_fault_model
library: fault_tolerance
signature: nil
location: 77 0 83 999
body:
  fault_class_inclusive: AXIOM
    FORALL (fault_class_var: fault_class):
          good?(fault_class_var) OR omissive_symmetric?(fault_class_var)
       OR omissive_asymmetric?(fault_class_var)
       OR transmissive_symmetric?(fault_class_var)
       OR single_error_asymmetric?(fault_class_var)
       OR transmissive_asymmetric?(fault_class_var);


decl_type: formula
theory: integration_fault_model
library: fault_tolerance
signature: nil
location: 85 0 90 999
body:
  fault_class_induction: AXIOM
    FORALL (p: [fault_class -> boolean]):
           p(good) AND p(omissive_symmetric) AND p(omissive_asymmetric)
       AND p(transmissive_symmetric) AND p(single_error_asymmetric)
       AND p(transmissive_asymmetric)
       IMPLIES (FORALL (fault_class_var: fault_class): p(fault_class_var));


decl_type: formula
theory: integration_fault_model
library: fault_tolerance
signature: nil
location: 61 2 62 68
body:
    symmetric_single_denotation: LEMMA
      subset?(symmetric_denotation(status), single_denotation(status))


decl_type: function
theory: integration_fault_model
library: fault_tolerance
signature: [fault_class -> upto(5)]
location: 110 0 118 999
body:
  ord(x: fault_class): [fault_class -> upto(5)] =
      CASES x
        OF good: 0,
           omissive_symmetric: 1,
           omissive_asymmetric: 2,
           transmissive_symmetric: 3,
           single_error_asymmetric: 4,
           transmissive_asymmetric: 5
        ENDCASES


decl_type: function
theory: integration_fault_model
library: fault_tolerance
signature: [fault_class -> bool]
location: 27 2 28 71
body:
    correct_denotation?(fcl) : bool =
      good?(fcl) OR omissive_symmetric?(fcl) OR omissive_asymmetric?(fcl)


decl_type: function
theory: integration_fault_model
library: fault_tolerance
signature: [fault_class -> bool]
location: 30 2 31 74
body:
    symmetric_denotation?(fcl) : bool = 
      good?(fcl) OR omissive_symmetric?(fcl) OR transmissive_symmetric?(fcl)


decl_type: function
theory: integration_fault_model
library: fault_tolerance
signature: [node_status -> finite_set[below(N)]]
location: 46 2 47 44
body:
    transmissive_symmetric(status)   : finite_set[below(N)] =
      {p | transmissive_symmetric?(status(p))}


decl_type: function
theory: integration_fault_model
library: fault_tolerance
signature: [node_status -> finite_set[below(N)]]
location: 48 2 49 45
body:
    single_error_asymmetric(status)  : finite_set[below(N)] =
      {p | single_error_asymmetric?(status(p))}


decl_type: function
theory: integration_fault_model
library: fault_tolerance
signature: [node_status -> finite_set[below(N)]]
location: 50 2 51 45
body:
    transmissive_asymmetric(status)  : finite_set[below(N)] =
      {p | transmissive_asymmetric?(status(p))}


decl_type: datatype
theory: integration_fault_model
library: fault_tolerance
signature: nil
location: 17 2 23 29
body:
    fault_class: TYPE =
      {good,                     
       omissive_symmetric,       
       omissive_asymmetric,
       transmissive_symmetric, 
       single_error_asymmetric,
       transmissive_asymmetric}


decl_type: formula
theory: timing_imprecision
library: fault_tolerance
signature: nil
location: 87 2 88 69
body:
    event_observation_error: LEMMA
       ev < c(Timestamp(c, ev)) AND c(Timestamp(c, ev)) <= ev + 1 + rho


decl_type: formula
theory: timing_imprecision
library: fault_tolerance
signature: nil
location: 96 2 99 49
body:
    link_lower_range: LEMMA
        good_range(c1(T - W))(ev2)
      IMPLIES
        c1(T) - epsilon_l <= c2(Timestamp(c2, ev2))


decl_type: formula
theory: timing_imprecision
library: fault_tolerance
signature: nil
location: 101 2 104 49
body:
    link_upper_range: LEMMA
        good_range(c1(T - W))(ev2)
      IMPLIES
        c2(Timestamp(c2, ev2)) <= c1(T) + epsilon_u


decl_type: formula
theory: timing_imprecision
library: fault_tolerance
signature: nil
location: 106 2 109 54
body:
    link_abs_bound: LEMMA
        good_range(c1(T - W))(ev2)
      IMPLIES
        abs(c2(Timestamp(c2, ev2)) - c1(T)) <= max_error


decl_type: formula
theory: timing_imprecision
library: fault_tolerance
signature: nil
location: 114 2 118 83
body:
    link_relative_range: LEMMA
        good_range(ev1)(ev1r) AND
        good_range(ev2)(ev2r)
      IMPLIES  
        abs(c1(Timestamp(c1, ev1r)) - c2(Timestamp(c2, ev2r)) - ev1 + ev2) <= epsilon


decl_type: formula
theory: timing_imprecision
library: fault_tolerance
signature: nil
location: 120 2 124 69
body:
    link_relative_symmetry: COROLLARY
        good_range(ev)(ev1) AND
        good_range(ev)(ev2) 
      IMPLIES
        abs(c1(Timestamp(c1, ev1)) - c2(Timestamp(c2, ev2))) <= epsilon


decl_type: formula
theory: timing_imprecision
library: fault_tolerance
signature: nil
location: 129 2 133 35
body:
    good_range_bounded: LEMMA
        good_range(ev)(ev1) AND
        good_range(ev)(ev2) 
      IMPLIES
        abs(ev1 - ev2) <= var_latency


decl_type: formula
theory: timing_imprecision
library: fault_tolerance
signature: nil
location: 135 2 138 69
body:
    link_symmetry: LEMMA
        abs(ev1 - ev2) <= var_latency 
      IMPLIES
        abs(c1(Timestamp(c1, ev1)) - c2(Timestamp(c2, ev2))) <= epsilon


decl_type: function
theory: timing_imprecision
library: fault_tolerance
signature: [real -> set[real]]
location: 91 2 92 75
body:
    good_range(ev): set[real] =
      {t: real | ev + min_latency <= t & t <= ev + min_latency + var_latency}


decl_type: constant
theory: timing_imprecision
library: fault_tolerance
signature: posint
location: 60 2 61 94
body:
    W: posint =
      IF fractional(mid_latency) < 1 / 2 THEN floor(mid_latency) ELSE ceiling(mid_latency) ENDIF


decl_type: tcc
theory: timing_imprecision
library: fault_tolerance
signature: nil
location: 145 0 148 999
body:
  % Subtype TCC generated (at line 61, column 44) for  floor(mid_latency)
      % expected type  posint
  W_TCC1: OBLIGATION
    fractional(mid_latency) < 1 / 2 IMPLIES floor(mid_latency) > 0;


decl_type: tcc
theory: timing_imprecision
library: fault_tolerance
signature: nil
location: 150 0 153 999
body:
  % Subtype TCC generated (at line 61, column 68) for  ceiling(mid_latency)
      % expected type  posint
  W_TCC2: OBLIGATION
    NOT fractional(mid_latency) < 1 / 2 IMPLIES ceiling(mid_latency) > 0;


decl_type: tcc
theory: timing_imprecision
library: fault_tolerance
signature: nil
location: 155 0 158 999
body:
  % Subtype TCC generated (at line 71, column 23) for  W * rate - min_latency
      % expected type  posreal
  epsilon_l_TCC1: OBLIGATION
    W * rate[rho] - min_latency >= 0 AND W * rate[rho] - min_latency > 0;


decl_type: tcc
theory: timing_imprecision
library: fault_tolerance
signature: nil
location: 160 0 162 999
body:
  % Subtype TCC generated (at line 72, column 23) for  max_latency - W / rate
      % expected type  nnreal
  epsilon_u_TCC1: OBLIGATION max_latency - W / rate[rho] >= 0;


decl_type: tcc
theory: timing_imprecision
library: fault_tolerance
signature: nil
location: 164 0 167 999
body:
  % Subtype TCC generated (at line 73, column 23) for
      % max(epsilon_l, epsilon_u)
      % expected type  posreal
  max_error_TCC1: OBLIGATION max(epsilon_l, epsilon_u) > 0;


decl_type: formula
theory: timing_window
library: fault_tolerance
signature: nil
location: 40 2 43 50
body:
    timing_conforms_def: LEMMA
        timing_conforms?(c, T, skew)(c(Timestamp(c, ev)))
      IFF
        abs(Timestamp(c, ev) - T) <= Delta_max(skew)


decl_type: formula
theory: timing_window
library: fault_tolerance
signature: nil
location: 51 2 55 58
body:
    good_range_always_conforms: LEMMA
        good_range(c1(T - W))(ev) AND
        abs(c1(T) - c2(T)) <= skew 
      IMPLIES
        timing_conforms?(c2, T, skew)(c2(Timestamp(c2, ev)))


decl_type: formula
theory: timing_window
library: fault_tolerance
signature: nil
location: 57 2 61 36
body:
    good_range_inner_window: LEMMA
        good_range(c1(T - W))(ev) AND
        abs(c1(T) - c2(T)) <= skew 
      IMPLIES
        inner_window?(c2, T, skew)(ev)


decl_type: function
theory: timing_window
library: fault_tolerance
signature: [[good_clock[rho], integer, nonneg_real] -> [real -> bool]]
location: 35 2 36 63
body:
    timing_conforms?(c, T, skew)(ev): bool = 
      c(T - Delta_max(skew)) <= ev & ev <= c(T + Delta_max(skew))


decl_type: formula
theory: timing_integration_stage
library: fault_tolerance
signature: nil
location: 82 2 86 48
body:
    symmetric_timing_uniform: LEMMA
        symmetric_timing_conforms?(c_dst, T, pi)(f)
      IFF
        (uniformly_inner_window?(c_dst, T, pi)(f) OR
         uniformly_outer_window?(c_dst, T, pi)(f))


decl_type: formula
theory: timing_integration_stage
library: fault_tolerance
signature: nil
location: 88 2 91 48
body:
    uniformly_outer_single_denotation: LEMMA
        uniformly_outer_window?(c_dst, T, pi)(f)
      IMPLIES
        single_denotation_timing?(c_dst, T, pi)(f)


decl_type: formula
theory: timing_integration_stage
library: fault_tolerance
signature: nil
location: 123 2 124 71
body:
    tsym_single_denotation: LEMMA
      single_denotation_timing?(c_dst, T, pi)(tsym_send(c_dst, T, pi, s))


decl_type: formula
theory: timing_integration_stage
library: fault_tolerance
signature: nil
location: 167 2 171 22
body:
    enabled_within_stage: LEMMA
      enabled_within?(
        received(c_dst, c_src, T, status, pi),
        check(c_dst, T, common_check, pi))
          (common_check)


decl_type: formula
theory: timing_integration_stage
library: fault_tolerance
signature: nil
location: 175 2 179 77
body:
    correct_denotation_send: LEMMA
        correct_denotation?(status(s))
      IMPLIES
        good_range(c_src(s)(T-W))(send(c_src, c_dst, T, pi, status)(d)(s)) OR
        outer_window?(c_dst(d), T, pi)(send(c_src, c_dst, T, pi, status)(d)(s))


decl_type: formula
theory: timing_integration_stage
library: fault_tolerance
signature: nil
location: 183 2 189 72
body:
    conforming_correct_denotation_send: LEMMA
        clock_relation?(T, c_src, c_dst, pi) AND
        correct_denotation(status)(s) AND
        enabled(received(c_dst, c_src, T, status, pi), 
                check(c_dst, T, common_check, pi))(d)(s)
      IMPLIES
        good_range(c_src(s)(T-W))(send(c_src, c_dst, T, pi, status)(d)(s))


decl_type: formula
theory: timing_integration_stage
library: fault_tolerance
signature: nil
location: 191 2 195 94
body:
    single_denotation_send: LEMMA
        single_denotation?(status(s)) AND
        clock_relation?(T, c_src, c_dst, pi)
      IMPLIES
        single_denotation_timing?(c_dst, T, pi)(transpose(send(c_src, c_dst, T, pi, status))(s))


decl_type: formula
theory: timing_integration_stage
library: fault_tolerance
signature: nil
location: 197 2 201 94
body:
    symmetric_send: COROLLARY
        symmetric_denotation?(status(s)) AND
        clock_relation?(T, c_src, c_dst, pi)
      IMPLIES
        single_denotation_timing?(c_dst, T, pi)(transpose(send(c_src, c_dst, T, pi, status))(s))


decl_type: formula
theory: timing_integration_stage
library: fault_tolerance
signature: nil
location: 203 2 207 95
body:
    symmetric_timing_conforms: LEMMA
        symmetric_denotation?(status(s)) AND
        clock_relation?(T, c_src, c_dst, pi)
      IMPLIES
        symmetric_timing_conforms?(c_dst, T, pi)(transpose(send(c_src, c_dst, T, pi, status))(s))


decl_type: formula
theory: timing_integration_stage
library: fault_tolerance
signature: nil
location: 213 2 221 38
body:
    correct_lower_timing: LEMMA
        clock_relation?(T, c_src, c_dst, pi)
      IMPLIES
        correct_lower_inaccuracy?(
          nominal(c_src, T),
          received(c_dst, c_src, T, status, pi),
          check(c_dst, T, common_check, pi),
          epsilon_l)
            (correct_denotation(status))


decl_type: formula
theory: timing_integration_stage
library: fault_tolerance
signature: nil
location: 223 2 234 19
body:
    correct_quorum_lower: LEMMA
         clock_relation?(T, c_src, c_dst, pi) AND
         quorum?(received(c_dst, c_src, T, status, pi),
           check(c_dst, T, common_check, pi), tau)
             (correct_denotation(status))
       IMPLIES
         quorum_lower?(        
           nominal(c_src, T),
           received(c_dst, c_src, T, status, pi),
           check(c_dst, T, common_check, pi),
           tau,
           epsilon_l)


decl_type: formula
theory: timing_integration_stage
library: fault_tolerance
signature: nil
location: 236 2 246 19
body:
    correct_majority_lower: LEMMA
         clock_relation?(T, c_src, c_dst, pi) AND
         majority?(received(c_dst, c_src, T, status, pi),
           check(c_dst, T, common_check, pi))
             (correct_denotation(status))
       IMPLIES
         majority_lower?(        
           nominal(c_src, T),
           received(c_dst, c_src, T, status, pi),
           check(c_dst, T, common_check, pi),
           epsilon_l)


decl_type: formula
theory: timing_integration_stage
library: fault_tolerance
signature: nil
location: 249 2 257 38
body:
    correct_upper_timing: LEMMA
        clock_relation?(T, c_src, c_dst, pi)
      IMPLIES
        correct_upper_inaccuracy?(
          nominal(c_src, T),
          received(c_dst, c_src, T, status, pi),
          check(c_dst, T, common_check, pi),
          epsilon_u)
            (correct_denotation(status))


decl_type: formula
theory: timing_integration_stage
library: fault_tolerance
signature: nil
location: 259 2 269 19
body:
    correct_majority_upper: LEMMA
         clock_relation?(T, c_src, c_dst, pi) AND
         majority?(received(c_dst, c_src, T, status, pi),
           check(c_dst, T, common_check, pi))
             (correct_denotation(status))
       IMPLIES
         majority_upper?(        
           nominal(c_src, T),
           received(c_dst, c_src, T, status, pi),
           check(c_dst, T, common_check, pi),
           epsilon_u)


decl_type: formula
theory: timing_integration_stage
library: fault_tolerance
signature: nil
location: 271 2 282 19
body:
    correct_quorum_upper: LEMMA
         clock_relation?(T, c_src, c_dst, pi) AND
         quorum?(received(c_dst, c_src, T, status, pi),
           check(c_dst, T, common_check, pi), tau)
             (correct_denotation(status))
       IMPLIES
         quorum_upper?(        
           nominal(c_src, T),
           received(c_dst, c_src, T, status, pi),
           check(c_dst, T, common_check, pi),
           tau,
           epsilon_u)


decl_type: formula
theory: timing_integration_stage
library: fault_tolerance
signature: nil
location: 284 2 295 19
body:
    correct_accuracy_timing: LEMMA
         clock_relation?(T, c_src, c_dst, pi) AND
         majority?(received(c_dst, c_src, T, status, pi),
           check(c_dst, T, common_check, pi))
             (correct_denotation(status))
       IMPLIES
         majority_accuracy?(        
           nominal(c_src, T),
           received(c_dst, c_src, T, status, pi),
           check(c_dst, T, common_check, pi),
           epsilon_l,
           epsilon_u)


decl_type: formula
theory: timing_integration_stage
library: fault_tolerance
signature: nil
location: 297 2 305 38
body:
    correct_imprecision_timing: LEMMA
        clock_relation?(T, c_src, c_dst, pi) 
      IMPLIES
        correct_imprecision?(
          sent(c_src, T),
          received(c_dst, c_src, T, status, pi),
          check(c_dst, T, common_check, pi), 
          epsilon)
            (correct_denotation(status)) 


decl_type: formula
theory: timing_integration_stage
library: fault_tolerance
signature: nil
location: 307 2 318 17
body:
    quorum_imprecision: LEMMA
         clock_relation?(T, c_src, c_dst, pi) AND
         quorum?(received(c_dst, c_src, T, status, pi),
           check(c_dst, T, common_check, pi), tau)
             (correct_denotation(status))
       IMPLIES
         quorum_imprecision?(        
           sent(c_src, T),
           received(c_dst, c_src, T, status, pi),
           check(c_dst, T, common_check, pi),
           tau,
           epsilon)


decl_type: formula
theory: timing_integration_stage
library: fault_tolerance
signature: nil
location: 320 2 330 17
body:
    majority_imprecision: LEMMA
         clock_relation?(T, c_src, c_dst, pi) AND
         majority?(received(c_dst, c_src, T, status, pi),
           check(c_dst, T, common_check, pi))
             (correct_denotation(status))
       IMPLIES
         majority_imprecision?(        
           sent(c_src, T),
           received(c_dst, c_src, T, status, pi),
           check(c_dst, T, common_check, pi),
           epsilon)


decl_type: formula
theory: timing_integration_stage
library: fault_tolerance
signature: nil
location: 336 2 343 37
body:
    single_imprecision_timing: LEMMA
        clock_relation?(T, c_src, c_dst, pi) 
      IMPLIES
        single_imprecision?(
          received(c_dst, c_src, T, status, pi),
          check(c_dst, T, common_check, pi),
          epsilon)
            (single_denotation(status))


decl_type: formula
theory: timing_integration_stage
library: fault_tolerance
signature: nil
location: 345 2 351 40
body:
    uniformly_enabled: LEMMA
        clock_relation?(T, c_src, c_dst, pi) 
      IMPLIES
        uniformly_enabled?(
          received(c_dst, c_src, T, status, pi),
          check(c_dst, T, common_check, pi))
            (symmetric_denotation(status))


decl_type: formula
theory: timing_integration_stage
library: fault_tolerance
signature: nil
location: 353 2 360 40
body:
    symmetric_imprecision_timing: LEMMA
        clock_relation?(T, c_src, c_dst, pi) 
      IMPLIES
        single_imprecision?(
          received(c_dst, c_src, T, status, pi),
          check(c_dst, T, common_check, pi),
          epsilon)
            (symmetric_denotation(status))


decl_type: formula
theory: timing_integration_stage
library: fault_tolerance
signature: nil
location: 364 2 374 16
body:
    all_symmetric_timing: LEMMA
        clock_relation?(T, c_src, c_dst, pi) AND
        enabled_within?(
          received(c_dst, c_src, T, status, pi),
          check(c_dst, T, common_check, pi))
           (symmetric_denotation(status))
      IMPLIES
        all_symmetric?(
          received(c_dst, c_src, T, status, pi),
          check(c_dst, T, common_check, pi), 
          epsilon)


decl_type: function
theory: timing_integration_stage
library: fault_tolerance
signature:
  [[[below(D) -> good_clock[rho]], integer, nonneg_real] ->
  [[below(D) -> real] -> bool]]

location: 60 2 61 50
body:
    uniformly_inner_window?(c_dst, T, pi)(f): bool =
      FORALL d: inner_window?(c_dst(d), T, pi)(f(d))


decl_type: function
theory: timing_integration_stage
library: fault_tolerance
signature:
  [[[below(D) -> good_clock[rho]], integer, nonneg_real] ->
  [[below(D) -> real] -> bool]]

location: 63 2 64 50
body:
    uniformly_outer_window?(c_dst, T, pi)(f): bool =
      FORALL d: outer_window?(c_dst(d), T, pi)(f(d))


decl_type: function
theory: timing_integration_stage
library: fault_tolerance
signature:
  [[[below(D) -> good_clock[rho]], integer, nonneg_real] ->
  [[below(D) -> real] -> bool]]

location: 69 2 74 41
body:
    single_denotation_timing?(c_dst, T, pi)(f): bool =
      FORALL d1, d2: 
          inner_window?(c_dst(d1), T, pi)(f(d1)) AND
          inner_window?(c_dst(d2), T, pi)(f(d2))
        IMPLIES
          abs(f(d1) - f(d2)) <= var_latency


decl_type: function
theory: timing_integration_stage
library: fault_tolerance
signature:
  [[[below(D) -> good_clock[rho]], integer, nonneg_real] ->
  [[below(D) -> real] -> bool]]

location: 76 2 80 44
body:
    symmetric_timing_conforms?(c_dst, T, pi)(f): bool =
      FORALL d1, d2:
        inner_window?(c_dst(d1), T, pi)(f(d1))
      IMPLIES
        inner_window?(c_dst(d2), T, pi)(f(d2))


decl_type: function
theory: timing_integration_stage
library: fault_tolerance
location: 95 2 95 56
body: good_send(c_src, T, s)(d): (good_range(c_src(s)(T-W)))
signature:
  [d1: [[below(S) -> good_clock[rho]], integer, below(S)] ->
          [below(D) -> (good_range(d1`1(d1`3)(d1`2 - W)))]]


decl_type: function
theory: timing_integration_stage
library: fault_tolerance
location: 100 2 102 50
signature:
  [d:
          [[below(S) -> good_clock[rho]], [below(D) -> good_clock[rho]],
           integer, nonneg_real, below(S)] ->
          (union(uniformly_good_range?(d`1(d`5), d`3),
                 uniformly_outer_window?(d`2, d`3, d`4)))]

body:
    osym_send(c_src, c_dst, T, pi, s):
      (union(uniformly_good_range?(c_src(s), T),
             uniformly_outer_window?(c_dst, T, pi)))


decl_type: function
theory: timing_integration_stage
library: fault_tolerance
location: 106 2 107 70
signature:
  [d1:
          [[below(S) -> good_clock[rho]], [below(D) -> good_clock[rho]],
           integer, nonneg_real, below(S), below(D)] ->
          (union(good_range(d1`1(d1`5)(d1`3 - W)),
                 outer_window?(d1`2(d1`6), d1`3, d1`4)))]

body:
    oasym_send(c_src, c_dst, T, pi, s, d):
      (union(good_range(c_src(s)(T-W)), outer_window?(c_dst(d), T, pi)))


decl_type: function
theory: timing_integration_stage
library: fault_tolerance
location: 116 2 119 50
signature:
  [d:
          [[below(D) -> good_clock[rho]], integer, nonneg_real,
           below(S)] ->
          (union(intersection(uniformly_inner_window?(d`1, d`2, d`3),
                              single_denotation_timing?(d`1, d`2, d`3)),
                 uniformly_outer_window?(d`1, d`2, d`3)))]

body:
    tsym_send(c_dst, T, pi, s) : 
      (union(intersection(uniformly_inner_window?(c_dst, T, pi),
                          single_denotation_timing?(c_dst, T, pi)),
             uniformly_outer_window?(c_dst, T, pi)))


decl_type: function
theory: timing_integration_stage
library: fault_tolerance
location: 121 2 121 70
body: sv_send(c_dst, T, pi, s) : (single_denotation_timing?(c_dst, T, pi))
signature:
  [d:
          [[below(D) -> good_clock[rho]], integer, nonneg_real,
           below(S)] ->
          (single_denotation_timing?(d`1, d`2, d`3))]


decl_type: function
theory: timing_integration_stage
library: fault_tolerance
location: 134 2 142 12
signature:
  [[[below(S) -> good_clock[rho]], [below(D) -> good_clock[rho]],
         integer, nonneg_real, node_status[S]] ->
          [below(D) -> [below(S) -> real]]]

body:
    send(c_src, c_dst, T, pi, status)(d)(s): real =
      CASES status(s) OF 
        good                     : good_send(c_src, T, s)(d),
        omissive_symmetric       : osym_send(c_src, c_dst, T, pi, s)(d),
        omissive_asymmetric      : oasym_send(c_src, c_dst, T, pi, s, d),
        transmissive_symmetric   : tsym_send(c_dst, T, pi, s)(d),
        single_error_asymmetric  : sv_send(c_dst, T, pi, s)(d),
        transmissive_asymmetric  : tasym_send(c_dst, T, pi, s, d) 
      ENDCASES


decl_type: function
theory: timing_integration_stage
library: fault_tolerance
location: 147 2 148 53
signature:
  [[integer, [below(S) -> good_clock[rho]],
         [below(D) -> good_clock[rho]], nonneg_real] ->
          bool]

body:
    clock_relation?(T, c_src, c_dst, pi): bool = 
      FORALL s, d: abs(c_src(s)(T) - c_dst(d)(T)) <= pi


decl_type: function
theory: timing_integration_stage
library: fault_tolerance
location: 153 2 154 61
signature:
  [[[below(D) -> good_clock[rho]], integer, finite_set[below(S)],
         nonneg_real] ->
          [below(D) -> [below(S) -> [real -> bool]]]]

body:
    check(c_dst, T, common_check, pi)(d)(s)(ev): bool =
      timing_conforms?(c_dst(d), T, pi)(ev) AND common_check(s)


decl_type: function
theory: timing_integration_stage
library: fault_tolerance
location: 161 2 162 74
signature:
  [[[below(D) -> good_clock[rho]], [below(S) -> good_clock[rho]],
         integer, node_status[S], nonneg_real] ->
          [below(D) -> [below(S) -> real]]]

body:
    received(c_dst, c_src, T, status, pi)(d)(s): real =
      c_dst(d)(Timestamp(c_dst(d), send(c_src, c_dst, T, pi, status)(d)(s)))


decl_type: function
theory: timing_integration_stage
library: fault_tolerance
location: 378 2 382 36
signature:
  [[node_status[S], [below(S) -> good_clock[rho]],
         [below(D) -> good_clock[rho]], integer, finite_set[below(S)],
         nonneg_real] ->
          bool]

body:
    majority_synch?(status, c_src, c_dst, T, common_check, pi): bool =
      majority?(
        received(c_dst, c_src, T, status, pi),
        check(c_dst, T, common_check, pi)
         )(correct_denotation(status))


decl_type: function
theory: timing_integration_stage
library: fault_tolerance
location: 384 2 389 36
signature:
  [[node_status[S], [below(S) -> good_clock[rho]],
         [below(D) -> good_clock[rho]], integer, finite_set[below(S)],
         tau_type, nonneg_real] ->
          bool]

body:
    quorum_synch?(status, c_src, c_dst, T, common_check, tau, pi): bool =
      quorum?(
        received(c_dst, c_src, T, status, pi),
        check(c_dst, T, common_check, pi),
        tau
         )(correct_denotation(status))


decl_type: function
theory: timing_integration_stage
library: fault_tolerance
location: 391 2 397 40
signature:
  [[node_status[S], [below(S) -> good_clock[rho]],
         [below(D) -> good_clock[rho]], integer, finite_set[below(S)],
         nonneg_real] ->
          bool]

body:
    all_symmetric_synch?(status, c_src, c_dst, T, common_check, pi): bool =
      enabled_within?(
        received(c_dst, c_src, T, status, pi),
        check(c_dst, T, common_check, pi))(symmetric_denotation(status)) AND
      enabled_nonempty?(
        received(c_dst, c_src, T, status, pi),         
        check(c_dst, T, common_check, pi))


decl_type: tcc
theory: timing_integration_stage
library: fault_tolerance
signature: nil
location: 406 0 415 999
body:
  % Subtype TCC generated (at line 51, column 30) for
      % image(t_of(c_dst, T), fullset[below(D)])
      % expected type  SS: non_empty_finite_set[real]
  t_min_TCC1: OBLIGATION
    FORALL (c_dst: [below(D) -> good_clock[rho]], T: integer):
      is_finite[real]
          (image[below(D), real](t_of(c_dst, T), fullset[below(D)]))
       AND
       NOT empty?[real]
               (image[below(D), real](t_of(c_dst, T), fullset[below(D)]));


decl_type: tcc
theory: timing_integration_stage
library: fault_tolerance
signature: nil
location: 417 0 427 999
body:
  % Existence TCC generated (at line 95, column 2) for
      % good_send(c_src, T, s)(d): (good_range(c_src(s)(T - W)))
  good_send_TCC1: OBLIGATION
    EXISTS (x:
              [d1: [[below(S) -> good_clock[rho]], integer, below(S)] ->
                 [below(D) ->
                    (good_range[rho, min_latency, var_latency]
                         (d1`1
                              (d1`3)
                              (d1`2 - W[rho, min_latency, var_latency])))]]):
      TRUE;


decl_type: tcc
theory: timing_integration_stage
library: fault_tolerance
signature: nil
location: 429 0 442 999
body:
  % Existence TCC generated (at line 100, column 2) for
      % osym_send(c_src, c_dst, T, pi, s):
      %       (union(uniformly_good_range?(c_src(s), T),
      %              uniformly_outer_window?(c_dst, T, pi)))
  osym_send_TCC1: OBLIGATION
    EXISTS (x:
              [d:
                 [[below(S) -> good_clock[rho]],
                  [below(D) -> good_clock[rho]], integer, nonneg_real,
                  below(S)] ->
                 (union[[below(D) -> real]]
                      (uniformly_good_range?(d`1(d`5), d`3),
                       uniformly_outer_window?(d`2, d`3, d`4)))]):
      TRUE;


decl_type: tcc
theory: timing_integration_stage
library: fault_tolerance
signature: nil
location: 444 0 461 999
body:
  % Existence TCC generated (at line 106, column 2) for
      % oasym_send(c_src, c_dst, T, pi, s, d):
      %       (union(good_range(c_src(s)(T - W)),
      %              outer_window?(c_dst(d), T, pi)))
  oasym_send_TCC1: OBLIGATION
    EXISTS (x:
              [d1:
                 [[below(S) -> good_clock[rho]],
                  [below(D) -> good_clock[rho]], integer, nonneg_real,
                  below(S), below(D)] ->
                 (union[real]
                      (good_range[rho, min_latency, var_latency]
                           (d1`1
                                (d1`5)
                                (d1`3 - W[rho, min_latency, var_latency])),
                       outer_window?[rho, min_latency, var_latency]
                           (d1`2(d1`6), d1`3, d1`4)))]):
      TRUE;


decl_type: tcc
theory: timing_integration_stage
library: fault_tolerance
signature: nil
location: 463 0 478 999
body:
  % Existence TCC generated (at line 116, column 2) for
      % tsym_send(c_dst, T, pi, s):
      %       (union(intersection(uniformly_inner_window?(c_dst, T, pi),
      %                           single_denotation_timing?(c_dst, T, pi)),
      %              uniformly_outer_window?(c_dst, T, pi)))
  tsym_send_TCC1: OBLIGATION
    EXISTS (x:
              [d:
                 [[below(D) -> good_clock[rho]], integer, nonneg_real,
                  below(S)] ->
                 (union[[below(D) -> real]]
                      (intersection[[below(D) -> real]]
                           (uniformly_inner_window?(d`1, d`2, d`3),
                            single_denotation_timing?(d`1, d`2, d`3)),
                       uniformly_outer_window?(d`1, d`2, d`3)))]):
      TRUE;


decl_type: tcc
theory: timing_integration_stage
library: fault_tolerance
signature: nil
location: 480 0 488 999
body:
  % Existence TCC generated (at line 121, column 2) for
      % sv_send(c_dst, T, pi, s): (single_denotation_timing?(c_dst, T, pi))
  sv_send_TCC1: OBLIGATION
    EXISTS (x:
              [d:
                 [[below(D) -> good_clock[rho]], integer, nonneg_real,
                  below(S)] ->
                 (single_denotation_timing?(d`1, d`2, d`3))]):
      TRUE;


decl_type: formula
theory: clock_shift
library: fault_tolerance
signature: nil
location: 28 2 32 63
body:
    offset_left_edge: LEMMA
        clock_edge?(c(n), local_event(n)) AND
        0 <= T 
      IMPLIES
        T / rate <= offset(c, T)(local_event)(n) - local_event(n)


decl_type: formula
theory: clock_shift
library: fault_tolerance
signature: nil
location: 37 2 41 63
body:
    offset_right_edge: LEMMA
        clock_edge?(c(n), local_event(n)) AND
        0 <= T 
      IMPLIES
        offset(c, T)(local_event)(n) - local_event(n) <= rate * T


decl_type: formula
theory: clock_shift
library: fault_tolerance
signature: nil
location: 46 2 49 45
body:
    offset_zero: LEMMA
        all_clock_edge?(c, local_event)
      IMPLIES
        offset(c, 0)(local_event) = local_event


decl_type: formula
theory: clock_shift
library: fault_tolerance
signature: nil
location: 51 2 53 62
body:
    offset_drift: LEMMA
        offset(c, X)(local_event)(n2) - offset(c, X)(local_event)(n1)
          < local_event(n2) - local_event(n1) + drift * X + rate


decl_type: formula
theory: clock_shift
library: fault_tolerance
signature: nil
location: 55 2 56 73
body:
    offset_nondecreasing: LEMMA
      le1(n) <= le2(n) IMPLIES offset(c, T)(le1)(n) <= offset(c, T)(le2)(n)


decl_type: formula
theory: clock_shift
library: fault_tolerance
signature: nil
location: 58 2 63 40
body:
    offset_drift_edge: LEMMA
        clock_edge?(c(n1), le1(n1)) AND
        clock_edge?(c(n2), le2(n2)) 
      IMPLIES
        offset(c, X)(le2)(n2) - offset(c, X)(le1)(n1)
          <= le2(n2) - le1(n1) + drift * X


decl_type: formula
theory: clock_shift
library: fault_tolerance
signature: nil
location: 65 2 66 79
body:
    double_offset: LEMMA
      offset(c, T1)(offset(c, T2)(local_event)) = offset(c, T1 + T2)(local_event)


decl_type: formula
theory: clock_shift
library: fault_tolerance
signature: nil
location: 68 2 71 105
body:
    offset_same: LEMMA
        same_edges?(c1, c2)
      IMPLIES
        (offset(c1, T1 + T2)(le1) = offset(c2, T1 + T2)(le2) IFF offset(c1, T2)(le1) = offset(c2, T2)(le2))


decl_type: formula
theory: clock_shift
library: fault_tolerance
signature: nil
location: 73 2 78 63
body:
    offset_same2: LEMMA
        same_edges?(c1, c2) AND
        all_clock_edge?(c1, le1) AND
        all_clock_edge?(c2, le2)
      IMPLIES
        (offset(c1, T1)(le1) = offset(c2, T1)(le2) IFF le1 = le2)


decl_type: formula
theory: reduce_synch_stage
library: fault_tolerance
signature: nil
location: 55 2 57 89
body:
    synch_stage_offset: LEMMA
      synch_stage(status, c_src, c_dst, T, N1 + N2, src_set, tau, cf, pi)
        = offset(c_dst, N1)(synch_stage(status, c_src, c_dst, T, N2, src_set, tau, cf, pi))


decl_type: formula
theory: reduce_synch_stage
library: fault_tolerance
signature: nil
location: 60 2 65 86
body:
    lower_synch_validity: LEMMA
        quorum_synch?(status, c_src, c_dst, T, src_set, tau, pi) AND
        clock_relation?(T, c_src, c_dst, pi)
      IMPLIES
        v_min(nominal(c_src, T), src_set) + N/rate - epsilon_l
        <= v_min(synch_stage(status, c_src, c_dst, T, N, src_set, tau, cf, pi), dst_set)


decl_type: formula
theory: reduce_synch_stage
library: fault_tolerance
signature: nil
location: 67 2 72 67
body:
    upper_synch_validity: LEMMA
        quorum_synch?(status, c_src, c_dst, T, src_set, tau, pi) AND
        clock_relation?(T, c_src, c_dst, pi)
      IMPLIES
        v_max(synch_stage(status, c_src, c_dst, T, N, src_set, tau, cf, pi), dst_set)
          <= v_max(nominal(c_src, T), src_set) + epsilon_u + N * rate


decl_type: formula
theory: reduce_synch_stage
library: fault_tolerance
signature: nil
location: 74 2 83 51
body:
    synch_master_slave: COROLLARY
        quorum_synch?(status, c_src, c_dst, T, src_set, tau, pi) AND
        clock_relation?(T, c_src, c_dst, pi) AND
        v_max(nominal(c_src, T), src_set) -
          v_min(nominal(c_src, T), src_set) <= delta AND
        src_set(s) AND
        dst_set(d)
      IMPLIES
        abs(nominal(c_src, T)(s) - synch_stage(status, c_src, c_dst, T, 0, src_set, tau, cf, pi)(d)) 
                 <= delta + max(epsilon_l, epsilon_u)


decl_type: formula
theory: reduce_synch_stage
library: fault_tolerance
signature: nil
location: 85 2 93 37
body:
    synch_agreement_propagation: LEMMA
        quorum_synch?(status, c_src, c_dst, T, src_set, tau, pi) AND
        clock_relation?(T, c_src, c_dst, pi) AND
        v_max(sent(c_src, T), src_set) -
          v_min(sent(c_src, T), src_set) <= delta
      IMPLIES
        v_max(synch_stage(status, c_src, c_dst, T, N, src_set, tau, cf, pi), dst_set)
          - v_min(synch_stage(status, c_src, c_dst, T, N, src_set, tau, cf, pi), dst_set)
         <= delta + epsilon + drift * N


decl_type: formula
theory: reduce_synch_stage
library: fault_tolerance
signature: nil
location: 101 2 108 21
body:
    overlap_imprecision: LEMMA
        clock_relation?(T, c_src, c_dst, pi) AND
        overlap_synch?(status, c_src, c_dst, T, src_set, tau, pi)
      IMPLIES
        overlap_imprecision?(      
          received(c_dst, c_src, T, status, pi),
          check(c_dst, T, src_set, pi), 
          tau, epsilon)


decl_type: formula
theory: reduce_synch_stage
library: fault_tolerance
signature: nil
location: 115 2 125 59
body:
    synch_convergence: LEMMA
        quorum_synch?(status, c_src, c_dst, T, src_set, tau, pi) AND
        clock_relation?(T, c_src, c_dst, pi) AND
        overlap_synch?(status, c_src, c_dst, T, src_set, tau, pi) AND
        convergent?(cf, max_length(status, c_src, c_dst, T, src_set, tau, pi), k) AND
        v_max(sent(c_src, T), src_set) -
          v_min(sent(c_src, T), src_set) <= delta
      IMPLIES
        v_max(synch_stage(status, c_src, c_dst, T, N, src_set, tau, cf, pi), dst_set)
          - v_min(synch_stage(status, c_src, c_dst, T, N, src_set, tau, cf, pi), dst_set)
        <= delta * ((k - 1) / k) + epsilon + drift * N + rate


decl_type: formula
theory: reduce_synch_stage
library: fault_tolerance
signature: nil
location: 127 2 134 36
body:
    synch_agreement_generation: LEMMA
        all_symmetric_synch?(status, c_src, c_dst, T, src_set, pi) AND
        clock_relation?(T, c_src, c_dst, pi) AND
        inexact_consensus?(cf)
      IMPLIES
        v_max(synch_stage(status, c_src, c_dst, T, N, src_set, tau, cf, pi), dst_set)
          - v_min(synch_stage(status, c_src, c_dst, T, N, src_set, tau, cf, pi), dst_set)
         <= epsilon + drift * N + rate


decl_type: formula
theory: reduce_synch_stage
library: fault_tolerance
signature: nil
location: 136 2 143 29
body:
    synch_agreement_generation_edge: LEMMA
        all_symmetric_synch?(status, c_src, c_dst, T, src_set, pi) AND
        clock_relation?(T, c_src, c_dst, pi) AND
        inexact_consensus?(icf)
      IMPLIES
        v_max(synch_stage(status, c_src, c_dst, T, N, src_set, tau, icf, pi), dst_set)
          - v_min(synch_stage(status, c_src, c_dst, T, N, src_set, tau, icf, pi), dst_set)
         <= epsilon + drift * N


decl_type: function
theory: reduce_synch_stage
library: fault_tolerance
location: 50 2 53 55
signature:
  [[node_status[S], [below(S) -> good_clock[rho]],
         [below(D) -> good_clock[rho]], integer, nat,
         non_empty_finite_set[below[S]], tau_type,
         consensus_function[real, <=], nonneg_real] ->
          [below(D) -> real]]

body:
    synch_stage(status, c_src, c_dst, T, N, src_set, tau, cf, pi)(d): real =
      offset(c_dst, N)(reduce_choice(tau, cf)(
                        received(c_dst, c_src, T, status, pi),
                        check(c_dst, T, src_set, pi)))(d)


decl_type: function
theory: reduce_synch_stage
library: fault_tolerance
location: 95 2 99 32
signature:
  [[node_status[S], [below(S) -> good_clock[rho]],
         [below(D) -> good_clock[rho]], integer,
         non_empty_finite_set[below[S]], tau_type, nonneg_real] ->
          bool]

body:
    overlap_synch?(status, c_src, c_dst, T, src_set, tau, pi): bool = 
      reduce_overlap?(
        received(c_dst, c_src, T, status, pi),
        check(c_dst, T, src_set, pi), tau)
       (single_denotation(status))


decl_type: function
theory: reduce_synch_stage
library: fault_tolerance
location: 110 2 111 88
signature:
  [[node_status[S], [below(S) -> good_clock[rho]],
         [below(D) -> good_clock[rho]], integer,
         non_empty_finite_set[below[S]], tau_type, nonneg_real] ->
          nat]

body:
    max_length(status, c_src, c_dst, T, src_set, tau, pi): nat =
      max_length(received(c_dst, c_src, T, status, pi), check(c_dst, T, src_set, pi), tau)


decl_type: formula
theory: timing_integration
library: fault_tolerance
signature: nil
location: 79 2 82 67
body:
    enabled_within_timing: LEMMA
      enabled_within?(
        received(c_dst, c_src, Schedule, status, pi), 
        check(c_dst, Schedule, common_check, pi), j, k)(common_check)


decl_type: function
theory: timing_integration
library: fault_tolerance
location: 49 2 52 59
signature:
  [[[j: nat -> [below(stage(j)) -> good_clock[rho]]],
         [j: nat -> [below(stage(j)) -> good_clock[rho]]],
         [nat -> integer], [j: nat -> node_status[stage(j)]],
         [nat -> nonneg_real]] ->
          [i: nat ->
             [below(stage(1 + i)) -> [below(stage(i)) -> real]]]]

body:
    received(c_dst, c_src, Schedule, status, pi)(i): 
      [below(stage(i+1)) -> [below(stage(i)) -> real]] =
      received[rho, min_latency(i), var_latency(i), stage(i), stage(i+1)]
        (c_dst(i+1), c_src(i), Schedule(i), status(i), pi(i))


decl_type: function
theory: timing_integration
library: fault_tolerance
location: 54 2 57 55
signature:
  [[[j: nat -> [below(stage(j)) -> good_clock[rho]]],
         [nat -> integer],
         [j: nat -> non_empty_finite_set[below(stage(j))]],
         [nat -> nonneg_real]] ->
          [i: nat ->
             [below(stage(1 + i)) ->
                [below(stage(i)) -> [real -> bool]]]]]

body:
    check(c_dst, Schedule, common_check, pi)(i):
      [below(stage(i+1)) -> [below(stage(i)) -> [real -> bool]]] =
      check[rho, min_latency(i), var_latency(i), stage(i), stage(i+1)]
        (c_dst(i+1), Schedule(i), common_check(i), pi(i))


decl_type: function
theory: timing_integration
library: fault_tolerance
location: 63 2 64 90
signature:
  [[[j: nat -> [below(stage(j)) -> good_clock[rho]]],
         [nat -> integer]] ->
          [i: nat -> [below(stage(i)) -> real]]]

body:
    sent(c_src, Schedule)(i): [below(stage(i)) -> real] = 
      sent[rho, min_latency(i), var_latency(i), stage(i), stage(i+1)](c_src(i), Schedule(i))


decl_type: function
theory: timing_integration
library: fault_tolerance
location: 65 2 66 93
signature:
  [[[j: nat -> [below(stage(j)) -> good_clock[rho]]],
         [nat -> integer]] ->
          [i: nat -> [below(stage(i)) -> real]]]

body:
    nominal(c_src, Schedule)(i): [below(stage(i)) -> real] = 
      nominal[rho, min_latency(i), var_latency(i), stage(i), stage(i+1)](c_src(i), Schedule(i))


decl_type: function
theory: timing_integration
library: fault_tolerance
location: 70 2 73 58
signature:
  [[[nat -> integer],
         [j: nat -> [below(stage(j)) -> good_clock[rho]]],
         [j: nat -> [below(stage(j)) -> good_clock[rho]]],
         [nat -> nonneg_real], nat, nat] ->
          bool]

body:
    clock_relation?(Schedule, c_src, c_dst, pi, j, k): bool = 
      FORALL i: j <= i AND i < k IMPLIES
        clock_relation?[rho, min_latency(i), var_latency(i), stage(i), stage(i+1)]
                  (Schedule(i), c_src(i), c_dst(i+1), pi(i))


decl_type: function
theory: timing_integration
library: fault_tolerance
location: 85 2 88 80
signature:
  [[[j: nat -> node_status[stage(j)]],
         [j: nat -> [below(stage(j)) -> good_clock[rho]]],
         [j: nat -> [below(stage(j)) -> good_clock[rho]]],
         [nat -> integer],
         [j: nat -> non_empty_finite_set[below(stage(j))]],
         [nat -> nonneg_real], nat, nat] ->
          bool]

body:
    majority_synch?(status, c_src, c_dst, Schedule, common_check, pi, j, k): bool =
      FORALL i: j <= i AND i < k IMPLIES
        majority_synch?[rho, min_latency(i), var_latency(i), stage(i), stage(i+1)]
          (status(i), c_src(i), c_dst(i + 1), Schedule(i), common_check(i), pi(i))


decl_type: function
theory: timing_integration
library: fault_tolerance
location: 90 2 93 88
signature:
  [[[j: nat -> node_status[stage(j)]],
         [j: nat -> [below(stage(j)) -> good_clock[rho]]],
         [j: nat -> [below(stage(j)) -> good_clock[rho]]],
         [nat -> integer],
         [j: nat -> non_empty_finite_set[below(stage(j))]],
         [nat -> tau_type], [nat -> nonneg_real], nat, nat] ->
          bool]

body:
    quorum_synch?(status, c_src, c_dst, Schedule, common_check, tau, pi, j, k): bool =
      FORALL i: j <= i AND i < k IMPLIES
        quorum_synch?[rho, min_latency(i), var_latency(i), stage(i), stage(i+1)]
          (status(i), c_src(i), c_dst(i + 1), Schedule(i), common_check(i), tau(i), pi(i))


decl_type: function
theory: timing_integration
library: fault_tolerance
location: 95 2 100 81
signature:
  [[[j: nat -> node_status[stage(j)]],
         [j: nat -> [below(stage(j)) -> good_clock[rho]]],
         [j: nat -> [below(stage(j)) -> good_clock[rho]]],
         [nat -> integer],
         [j: nat -> non_empty_finite_set[below(stage(j))]],
         [nat -> nonneg_real], [nat -> consensus_function[real, <=]],
         nat, nat] ->
          bool]

body:
    exists_symmetric_synch_stage?(status, c_src, c_dst, Schedule, common_check, pi, cf, j, k): bool =
      EXISTS i: j <= i AND i < k AND
        all_symmetric_synch?[rho, min_latency(i), var_latency(i), stage(i), stage(i+1)]
          (status(i), c_src(i), c_dst(i + 1), Schedule(i), common_check(i), pi(i)) AND
        inexact_consensus?(cf(i)) AND
        majority_synch?(status, c_src, c_dst, Schedule, common_check, pi, i + 1, k)


decl_type: function
theory: timing_integration
library: fault_tolerance
location: 102 2 107 84
signature:
  [[[j: nat -> node_status[stage(j)]],
         [j: nat -> [below(stage(j)) -> good_clock[rho]]],
         [j: nat -> [below(stage(j)) -> good_clock[rho]]],
         [nat -> integer],
         [j: nat -> non_empty_finite_set[below(stage(j))]],
         [nat -> tau_type], [nat -> nonneg_real],
         [nat -> consensus_function[real, <=]], nat, nat] ->
          bool]

body:
    exists_symmetric_synch_stage?(status, c_src, c_dst, Schedule, common_check, tau, pi, cf, j, k): bool =
      EXISTS i: j <= i AND i < k AND
        all_symmetric_synch?[rho, min_latency(i), var_latency(i), stage(i), stage(i+1)]
          (status(i), c_src(i), c_dst(i + 1), Schedule(i), common_check(i), pi(i)) AND
        inexact_consensus?(cf(i)) AND
        quorum_synch?(status, c_src, c_dst, Schedule, common_check, tau, pi, i + 1, k)


decl_type: formula
theory: reduce_synch
library: fault_tolerance
signature: nil
location: 76 2 77 91
body:
    offset_sent_nominal: LEMMA
      nominal(clk, Schedule)(i) = offset[rho, stage(i)](clk(i), W(i))(sent(clk, Schedule)(i)) 


decl_type: formula
theory: reduce_synch
library: fault_tolerance
signature: nil
location: 90 2 98 110
body:
    synch_protocol_sent: LEMMA
        feasible?(Schedule)AND
        same_clock?(c_src, c_dst, j, k) AND
        synch_protocol(status, c_src, c_dst, Schedule, src_set, tau, cf, pi, j, k)
      IMPLIES
        FORALL i: j <= i AND i < k IMPLIES
          sent(c_src, Schedule)(i+1) = 
            synch_stage[rho, min_latency(i), var_latency(i), stage(i), stage(i+1)]
              (status(i), c_src(i), c_dst(i+1), Schedule(i), Lag(Schedule)(i), src_set(i), tau(i), cf(i), pi(i))


decl_type: formula
theory: reduce_synch
library: fault_tolerance
signature: nil
location: 116 2 118 77
body:
    k_stage_synch: LEMMA 
      protocol_synch(status, c_src, c_dst, Sched, src_set, tau, cf, pi, j, k) IFF 
        synch_protocol(status, c_src, c_dst, Sched, src_set, tau, cf, pi, j, k)


decl_type: formula
theory: reduce_synch
library: fault_tolerance
signature: nil
location: 122 2 130 58
body:
    lower_validity: THEOREM
        feasible?(Schedule) AND
        synch_protocol(status, c_src, c_dst, Schedule, src_set, tau, cf, pi, j, j + k) AND
        quorum_synch?(status, c_src, c_dst, Schedule, src_set, tau, pi, j, j + k) AND
        clock_relation?(Schedule, c_src, c_dst, pi, j, j + k)
      IMPLIES
        v_min(nominal(c_src, Schedule), src_set)(j) 
          - sigma(j, j + k - 1, epsilon_lower - ((1/rate[rho]) * Delay(Schedule)))
          <= v_min(nominal(c_src, Schedule), src_set)(j + k)


decl_type: formula
theory: reduce_synch
library: fault_tolerance
signature: nil
location: 132 2 140 81
body:
    upper_validity: THEOREM
        feasible?(Schedule) AND
        synch_protocol(status, c_src, c_dst, Schedule, src_set, tau, cf, pi, j, j + k) AND
        quorum_synch?(status, c_src, c_dst, Schedule, src_set, tau, pi, j, j + k) AND
        clock_relation?(Schedule, c_src, c_dst, pi, j, j + k)
      IMPLIES
          v_max(nominal(c_src, Schedule), src_set)(j + k) 
            <= v_max(nominal(c_src, Schedule), src_set)(j) 
                 + sigma(j, j + k - 1, epsilon_upper + rate[rho] * Delay(Schedule)) 


decl_type: formula
theory: reduce_synch
library: fault_tolerance
signature: nil
location: 142 2 153 84
body:
    agreement_propagation: LEMMA
        feasible?(Schedule) AND
        synch_protocol(status, c_src, c_dst, Schedule, src_set, tau, cf, pi, j, j + k) AND
        quorum_synch?(status, c_src, c_dst, Schedule, src_set, tau, pi, j, j + k) AND
        clock_relation?(Schedule, c_src, c_dst, pi, j, j + k) AND
        v_max(sent(c_src, Schedule), src_set)(j) 
          - v_min(sent(c_src, Schedule), src_set)(j) <= delta AND
        same_clock?(c_src, c_dst, j, j + k)
      IMPLIES
        v_max(sent(c_src, Schedule), src_set)(j + k) 
          - v_min(sent(c_src, Schedule), src_set)(j + k) 
            <= delta + sigma(j, j + k - 1, epsilon_total + drift[rho] * Lag(Schedule))


decl_type: formula
theory: reduce_synch
library: fault_tolerance
signature: nil
location: 166 2 178 112
body:
    convergence: LEMMA
        feasible?(Schedule)AND
        synch_protocol(status, c_src, c_dst, Schedule, src_set, tau, cf, pi, j, j + k) AND
        quorum_synch?(status, c_src, c_dst, Schedule, src_set, tau, pi, j, j + k) AND
        clock_relation?(Schedule, c_src, c_dst, pi, j, j + k) AND
        convergent_stage?(status, c_src, c_dst, Schedule, src_set, tau, cf, X, pi, j, j + k) AND
        v_max(sent(c_src, Schedule), src_set)(j) 
          - v_min(sent(c_src, Schedule), src_set)(j) <= delta AND
        same_clock?(c_src, c_dst, j, j + k)
      IMPLIES
        v_max(sent(c_src, Schedule), src_set)(j + k) 
          - v_min(sent(c_src, Schedule), src_set)(j + k) 
            <= delta * ((X - 1) / X) + sigma(j, j + k - 1, epsilon_total + drift[rho] * Lag(Schedule)) + rate[rho]


decl_type: formula
theory: reduce_synch
library: fault_tolerance
signature: nil
location: 180 2 189 88
body:
    agreement_generation: THEOREM
        feasible?(Schedule)AND
        synch_protocol(status, c_src, c_dst, Schedule, src_set, tau, cf, pi, j, j + k) AND
        exists_symmetric_synch_stage?(status, c_src, c_dst, Schedule, src_set, tau, pi, cf, j, j + k) AND
        clock_relation?(Schedule, c_src, c_dst, pi, j, j + k) AND
        same_clock?(c_src, c_dst, j, j + k)
      IMPLIES
        v_max(sent(c_src, Schedule), src_set)(j + k) 
          - v_min(sent(c_src, Schedule), src_set)(j + k) 
            <= sigma(j, j + k - 1, epsilon_total + drift[rho] * Lag(Schedule)) + rate[rho]


decl_type: formula
theory: reduce_synch
library: fault_tolerance
signature: nil
location: 191 2 200 76
body:
    agreement_generation_edge: THEOREM
        feasible?(Schedule)AND
        synch_protocol(status, c_src, c_dst, Schedule, src_set, tau, icf, pi, j, j + k) AND
        exists_symmetric_synch_stage?(status, c_src, c_dst, Schedule, src_set, tau, pi, icf, j, j + k) AND
        clock_relation?(Schedule, c_src, c_dst, pi, j, j + k) AND
        same_clock?(c_src, c_dst, j, j + k)
      IMPLIES
        v_max(sent(c_src, Schedule), src_set)(j + k) 
          - v_min(sent(c_src, Schedule), src_set)(j + k) 
            <= sigma(j, j + k - 1, epsilon_total + drift[rho] * Lag(Schedule))


decl_type: function
theory: reduce_synch
library: fault_tolerance
location: 55 2 57 58
signature:
  [[[i: nat -> [below(stage(i)) -> good_clock[rho]]],
         [i: nat -> [below(stage(i)) -> good_clock[rho]]], nat, nat] ->
          bool]

body:
    same_clock?(c_src, c_dst, j, k): bool = 
      FORALL i: j <= i AND i < k IMPLIES
        same_edges?[rho, stage(i+1)](c_src(i+1), c_dst(i+1))


decl_type: function
theory: reduce_synch
library: fault_tolerance
location: 81 2 82 48
signature:
  [[[i: nat -> [below(stage(i)) -> good_clock[rho]]],
         [nat -> integer]] ->
          [i: nat -> compute_stage[stage(i), real]]]

body:
    offset(clk, Schedule)(i): compute_stage[stage(i), real] 
      = offset[rho, stage(i)](clk(i), Schedule(i))


decl_type: function
theory: reduce_synch
library: fault_tolerance
location: 84 2 88 106
signature:
  [[[i: nat -> node_status[stage(i)]],
         [i: nat -> [below(stage(i)) -> good_clock[rho]]],
         [i: nat -> [below(stage(i)) -> good_clock[rho]]], (feasible?),
         [i: nat -> non_empty_finite_set[below(stage(i))]],
         [nat -> tau_type],
         k_consensus_function[stage, real, <=, LAMBDA (i): 0],
         [nat -> nonneg_real], nat, nat] ->
          bool]

body:
    synch_protocol(status, c_src, c_dst, Sched, src_set, tau, cf, pi, j, k): bool = 
        FORALL i: j <= i AND i < k IMPLIES
          nominal(c_src, Sched)(i+1) = 
            synch_stage[rho, min_latency(i), var_latency(i), stage(i), stage(i+1)]
              (status(i), c_src(i), c_dst(i+1), Sched(i), Delay(Sched)(i), src_set(i), tau(i), cf(i), pi(i))


decl_type: function
theory: reduce_synch
library: fault_tolerance
location: 100 2 104 45
signature:
  [[[i: nat -> node_status[stage(i)]],
         [i: nat -> [below(stage(i)) -> good_clock[rho]]],
         [i: nat -> [below(stage(i)) -> good_clock[rho]]], (feasible?),
         [i: nat -> non_empty_finite_set[below(stage(i))]],
         [nat -> tau_type],
         k_consensus_function[stage, real, <=, LAMBDA (i): 0],
         [nat -> nonneg_real], nat, nat] ->
          bool]

body:
    protocol_synch(status, c_src, c_dst, Sched, src_set, tau, cf, pi, j, k): bool = 
      protocol(offset(c_dst, Del(Sched)), reduce_choice(tau, cf), 
        nominal(c_src, Sched), 
        received(c_dst, c_src, Sched, status, pi),
        check(c_dst, Sched, src_set, pi), j, k)


decl_type: function
theory: reduce_synch
library: fault_tolerance
location: 157 2 163 89
signature:
  [[[i: nat -> node_status[stage(i)]],
         [i: nat -> [below(stage(i)) -> good_clock[rho]]],
         [i: nat -> [below(stage(i)) -> good_clock[rho]]],
         [nat -> integer],
         [i: nat -> non_empty_finite_set[below(stage(i))]],
         [nat -> tau_type],
         k_consensus_function[stage, real, <=, LAMBDA (i): 0], posnat,
         [nat -> nonneg_real], nat, nat] ->
          bool]

body:
    convergent_stage?(status, c_src, c_dst, Schedule, src_set, tau, cf, X, pi, j, k): bool =
      EXISTS i: j <= i AND i < k AND
        overlap_synch?[rho, min_latency(i), var_latency(i), stage(i), stage(i + 1)]
           (status(i), c_src(i), c_dst(i + 1), Schedule(i), src_set(i), tau(i), pi(i)) AND
        convergent?(cf(i), 
          max_length[rho, min_latency(i), var_latency(i), stage(i), stage(i + 1)]
            (status(i), c_src(i), c_dst(i + 1), Schedule(i), src_set(i), tau(i), pi(i)), X)


decl_type: tcc
theory: reduce_synch
library: fault_tolerance
signature: nil
location: 207 0 210 999
body:
  % Subtype TCC generated (at line 65, column 25) for  Sched(i + 1) - Sched(i)
      % expected type  nat
  Delay_TCC1: OBLIGATION
    FORALL (Sched: (feasible?), i: nat): Sched(i + 1) - Sched(i) >= 0;


decl_type: tcc
theory: reduce_synch
library: fault_tolerance
signature: nil
location: 212 0 216 999
body:
  % Subtype TCC generated (at line 67, column 23) for
      % Sched(i) - Sched(pred(i))
      % expected type  nat
  Del_TCC1: OBLIGATION
    FORALL (Sched: (feasible?), i: nat): Sched(i) - Sched(pred(i)) >= 0;


decl_type: tcc
theory: reduce_synch
library: fault_tolerance
signature: nil
location: 218 0 222 999
body:
  % Subtype TCC generated (at line 71, column 23) for
      % Delay(Sched)(i) - W(i + 1)
      % expected type  nat
  Lag_TCC1: OBLIGATION
    FORALL (Sched: (feasible?), i: nat): Delay(Sched)(i) - W(i + 1) >= 0;


decl_type: tcc
theory: reduce_synch
library: fault_tolerance
signature: nil
location: 224 0 241 999
body:
  % Subtype TCC generated (at line 129, column 19) for  j + k - 1
      % expected type  T_high[nat]
  lower_validity_TCC1: OBLIGATION
    FORALL (Schedule: [nat -> integer],
            c_dst, c_src: [i: nat -> [below(stage(i)) -> good_clock[rho]]],
            cf: k_consensus_function[stage, real, <=, LAMBDA (i): 0],
            j, k: nat, pi: [nat -> nonneg_real],
            src_set: [i: nat -> non_empty_finite_set[below(stage(i))]],
            status: [i: nat -> node_status[stage(i)]],
            tau: [nat -> tau_type]):
      clock_relation?(Schedule, c_src, c_dst, pi, j, j + k) AND
       quorum_synch?(status, c_src, c_dst, Schedule, src_set, tau, pi, j,
                     j + k)
        AND
        synch_protocol(status, c_src, c_dst, Schedule, src_set, tau, cf, pi,
                       j, j + k)
         AND feasible?(Schedule)
       IMPLIES j + k - 1 >= 0 OR (EXISTS (j_1: nat): j + k - 1 <= j_1);


decl_type: tcc
theory: reduce_synch
library: fault_tolerance
signature: nil
location: 243 0 268 999
body:
  % Subtype TCC generated (at line 189, column 22) for  j + k - 1
      % expected type  T_high[nat]
  agreement_generation_TCC1: OBLIGATION
    FORALL (Schedule: [nat -> integer],
            c_dst, c_src: [i: nat -> [below(stage(i)) -> good_clock[rho]]],
            cf: k_consensus_function[stage, real, <=, LAMBDA (i): 0],
            j, k: nat, pi: [nat -> nonneg_real],
            src_set: [i: nat -> non_empty_finite_set[below(stage(i))]],
            status: [i: nat -> node_status[stage(i)]],
            tau: [nat -> tau_type]):
           same_clock?(c_src, c_dst, j, j + k)
       AND clock_relation?(Schedule, c_src, c_dst, pi, j, j + k)
       AND exists_symmetric_synch_stage?(status,
                                         c_src,
                                         c_dst,
                                         Schedule,
                                         src_set,
                                         tau,
                                         pi,
                                         cf,
                                         j,
                                         j + k)
       AND synch_protocol(status, c_src, c_dst, Schedule, src_set, tau, cf,
                          pi, j, j + k)
       AND feasible?(Schedule)
       IMPLIES j + k - 1 >= 0 OR (EXISTS (j_1: nat): j + k - 1 <= j_1);


decl_type: tcc
theory: reduce_synch
library: fault_tolerance
signature: nil
location: 270 0 295 999
body:
  % Subtype TCC generated (at line 200, column 22) for  j + k - 1
      % expected type  T_high[nat]
  agreement_generation_edge_TCC1: OBLIGATION
    FORALL (Schedule: [nat -> integer],
            c_dst, c_src: [i: nat -> [below(stage(i)) -> good_clock[rho]]],
            icf: [nat -> in_consensus_function[real]], j, k: nat,
            pi: [nat -> nonneg_real],
            src_set: [i: nat -> non_empty_finite_set[below(stage(i))]],
            status: [i: nat -> node_status[stage(i)]],
            tau: [nat -> tau_type]):
           same_clock?(c_src, c_dst, j, j + k)
       AND clock_relation?(Schedule, c_src, c_dst, pi, j, j + k)
       AND exists_symmetric_synch_stage?(status,
                                         c_src,
                                         c_dst,
                                         Schedule,
                                         src_set,
                                         tau,
                                         pi,
                                         icf,
                                         j,
                                         j + k)
       AND synch_protocol(status, c_src, c_dst, Schedule, src_set, tau, icf,
                          pi, j, j + k)
       AND feasible?(Schedule)
       IMPLIES j + k - 1 >= 0 OR (EXISTS (j_1: nat): j + k - 1 <= j_1);


decl_type: formula
theory: exact_comm_stage
library: fault_tolerance
signature: nil
location: 54 2 59 78
body:
    correct_uniform: LEMMA
        enabled_within?(rcvd, check)(src_set) AND
        exact_correct_denotation?(sent, rcvd, check)(correct_set) AND
        uniform?(sent, t)(src_set)
      IMPLIES
        uniform?(rcvd(d), t)(intersection(correct_set, enabled(rcvd, check)(d)))


decl_type: formula
theory: exact_comm_stage
library: fault_tolerance
signature: nil
location: 61 2 66 78
body:
    correct_uniform_alt: LEMMA
        enabled_within?(rcvd, check)(src_set) AND
        exact_correct_denotation?(sent, rcvd, check)(correct_set) AND
        uniform?(sent, t)(enabled?(rcvd, check))
      IMPLIES
        uniform?(rcvd(d), t)(intersection(correct_set, enabled(rcvd, check)(d)))


decl_type: formula
theory: exact_comm_stage
library: fault_tolerance
signature: nil
location: 83 2 84 82
body:
    majority_correct_rw: LEMMA
      majority_correct?(sent, rcvd, check) = quorum_correct?(sent, rcvd, check, mid)


decl_type: function
theory: exact_comm_stage
library: fault_tolerance
location: 33 2 38 28
signature:
  [[sent_vec_stage[S, D, T], rcvd_matrix_stage[S, D, T],
         check_stage[S, D, T]] ->
          [finite_set[below(S)] -> bool]]

body:
    exact_correct_denotation?(sent, rcvd, check)(src_set): bool =
      FORALL d, s: 
          src_set(s) AND 
          enabled(rcvd, check)(d)(s) 
        IMPLIES
          rcvd(d)(s) = sent(s)


decl_type: function
theory: exact_comm_stage
library: fault_tolerance
signature:
  [[rcvd_matrix_stage[S, D, T], check_stage[S, D, T]] ->
  [finite_set[below(S)] -> bool]]

location: 42 2 48 33
body:
    exact_single_denotation?(rcvd, check)(src_set): bool =
      FORALL d1, d2, s:
          src_set(s) AND
          enabled(rcvd, check)(d1)(s) AND
          enabled(rcvd, check)(d2)(s)
        IMPLIES
          rcvd(d1)(s) = rcvd(d2)(s)


decl_type: function
theory: exact_comm_stage
library: fault_tolerance
location: 73 2 76 40
signature:
  [[sent_vec_stage[S, D, T], rcvd_matrix_stage[S, D, T],
         check_stage[S, D, T], tau_type] ->
          bool]

body:
    quorum_correct?(sent, rcvd, check, tau): bool =
      EXISTS src_set:
        exact_correct_denotation?(sent, rcvd, check)(src_set) AND
        quorum?(rcvd, check, tau)(src_set)


decl_type: function
theory: exact_comm_stage
library: fault_tolerance
location: 78 2 81 37
signature:
  [[sent_vec_stage[S, D, T], rcvd_matrix_stage[S, D, T],
         check_stage[S, D, T]] ->
          bool]

body:
    majority_correct?(sent, rcvd, check): bool = 
      EXISTS src_set:
        exact_correct_denotation?(sent, rcvd, check)(src_set) AND
        majority?(rcvd, check)(src_set)


decl_type: function
theory: exact_comm_stage
library: fault_tolerance
signature: [[rcvd_matrix_stage[S, D, T], check_stage[S, D, T]] -> bool]
location: 86 2 90 43
body:
    all_symmetric?(rcvd, check): bool = 
      EXISTS src_set: 
        exact_single_denotation?(rcvd, check)(src_set) AND
        uniformly_enabled?(rcvd, check)(src_set) AND
        enabled_within?(rcvd, check)(src_set) 


decl_type: function
theory: exact_comm_stage
library: fault_tolerance
location: 94 2 98 37
signature:
  [[sent_vec_stage[S, D, T], rcvd_matrix_stage[S, D, T],
         check_stage[S, D, T]] ->
          [below(S) -> bool]]

body:
    majority_correct_element?(sent, rcvd, check)(s): bool = 
      EXISTS src_set:
        src_set(s) AND
        exact_correct_denotation?(sent, rcvd, check)(src_set) AND
        majority?(rcvd, check)(src_set)


decl_type: function
theory: exact_comm_stage
library: fault_tolerance
signature:
  [[rcvd_matrix_stage[S, D, T], check_stage[S, D, T]] ->
  [below(S) -> bool]]

location: 100 2 105 43
body:
    symmetric_source?(rcvd, check)(s): bool = 
      EXISTS src_set:
        src_set(s) AND
        exact_single_denotation?(rcvd, check)(src_set) AND
        uniformly_enabled?(rcvd, check)(src_set) AND
        enabled_within?(rcvd, check)(src_set)


decl_type: formula
theory: exact_reduce_stage
library: fault_tolerance
signature: nil
location: 41 2 45 57
body:
    reduce_lower_validity: LEMMA
        quorum_correct?(sent, rcvd, check, tau) 
      IMPLIES
        EXISTS s: enabled(rcvd, check)(d)(s) AND
          sent(s) <= reduce_choice(tau, cf)(rcvd, check)(d)


decl_type: formula
theory: exact_reduce_stage
library: fault_tolerance
signature: nil
location: 47 2 51 57
body:
    reduce_upper_validity: LEMMA
        quorum_correct?(sent, rcvd, check, tau) 
      IMPLIES
        EXISTS s: enabled(rcvd, check)(d)(s) AND
          reduce_choice(tau, cf)(rcvd, check)(d) <= sent(s)


decl_type: formula
theory: exact_reduce_stage
library: fault_tolerance
signature: nil
location: 53 2 56 87
body:
    reduce_agreement_generation: LEMMA
        all_symmetric?(rcvd, check)
      IMPLIES
        reduce_choice(tau, cf)(rcvd, check)(d1) = reduce_choice(tau, cf)(rcvd, check)(d2)


decl_type: formula
theory: exact_reduce_stage
library: fault_tolerance
signature: nil
location: 61 2 66 63
body:
    reduce_min_validity: LEMMA
        quorum_correct?(sent, rcvd, check, tau) AND
        enabled_within?(rcvd, check)(src_set)
      IMPLIES
        v_min(sent, src_set) 
         <= v_min(reduce_choice(tau, cf)(rcvd, check), dst_check)


decl_type: formula
theory: exact_reduce_stage
library: fault_tolerance
signature: nil
location: 68 2 73 31
body:
    reduce_max_validity: LEMMA
        quorum_correct?(sent, rcvd, check, tau) AND
        enabled_within?(rcvd, check)(src_set)
      IMPLIES
        v_max(reduce_choice(tau, cf)(rcvd, check), dst_check)
          <= v_max(sent, src_set)


decl_type: formula
theory: exact_reduce_stage
library: fault_tolerance
signature: nil
location: 75 2 80 65
body:
    reduce_consensus: LEMMA
        quorum_correct?(sent, rcvd, check, tau) AND
        enabled_within?(rcvd, check)(src_set) AND
        uniform?(sent, v)(src_set)
      IMPLIES
        uniform?(reduce_choice(tau, cf)(rcvd, check), v)(dst_check)


decl_type: formula
theory: exact_reduce_stage
library: fault_tolerance
signature: nil
location: 82 2 86 59
body:
    reduce_min_eq_max: LEMMA
        all_symmetric?(rcvd, check)
      IMPLIES
        v_max(reduce_choice(tau, cf)(rcvd, check), dst_check) =
        v_min(reduce_choice(tau, cf)(rcvd, check), dst_check)


decl_type: formula
theory: exact_comm
library: fault_tolerance
signature: nil
location: 54 2 56 51
body:
    majority_correct_rw: LEMMA
      majority_correct?(sent, rcvd, check, j, k) IFF
        quorum_correct?(sent, rcvd, check, mid, j, k)


decl_type: function
theory: exact_comm
library: fault_tolerance
location: 36 2 38 71
signature:
  [[rcvd_matrix[N, T], check_function[N, T], nat, nat] ->
          [[j: nat -> finite_set[below(N(j))]] -> bool]]

body:
    enabled_within?(rcvd, check, j, k)(sources): bool = 
      FORALL i : j <= i AND i < k IMPLIES
        enabled_within?[N(i), N(i + 1), T](rcvd(i), check(i))(sources(i))


decl_type: function
theory: exact_comm
library: fault_tolerance
location: 42 2 44 74
signature:
  [[sent_vec[N, T], rcvd_matrix[N, T], check_function[N, T],
         [i: nat -> tau_type], nat, nat] ->
          bool]

body:
    quorum_correct?(sent, rcvd, check, tau, j, k): bool =
      FORALL i : j <= i AND i < k IMPLIES
        quorum_correct?[N(i), N(i+1), T](sent(i), rcvd(i), check(i), tau(i))


decl_type: function
theory: exact_comm
library: fault_tolerance
signature:
  [[sent_vec[N, T], rcvd_matrix[N, T], check_function[N, T], nat,
  nat] ->
  bool]

location: 48 2 50 68
body:
    majority_correct?(sent, rcvd, check, j, k): bool =
      FORALL i : j <= i AND i < k IMPLIES
        majority_correct?[N(i), N(i+1), T](sent(i), rcvd(i), check(i))


decl_type: function
theory: exact_comm
library: fault_tolerance
location: 64 2 67 53
signature:
  [[sent_vec[N, T], rcvd_matrix[N, T], check_function[N, T],
         [i: nat -> tau_type], nat, nat] ->
          bool]

body:
    exists_all_symmetric?(sent, rcvd, check, tau, j, k): bool = 
      EXISTS i: j <= i AND i < k AND
        all_symmetric?(rcvd(i), check(i)) AND
        quorum_correct?(sent, rcvd, check, tau, i+1, k)


decl_type: function
theory: exact_comm
library: fault_tolerance
signature:
  [[sent_vec[N, T], rcvd_matrix[N, T], check_function[N, T], nat,
  nat] ->
  bool]

location: 75 2 76 55
body:
    exists_all_symmetric?(sent, rcvd, check, j, k): bool = 
      exists_all_symmetric?(sent, rcvd, check, mid, j, k)


decl_type: formula
theory: exact_reduce
library: fault_tolerance
signature: nil
location: 43 2 48 62
body:
    lower_validity: THEOREM
        protocol(reduce_choice(tau, cf), sent, rcvd, check, j, j + k) AND
        quorum_correct?(sent, rcvd, check, tau, j, j + k) AND
        enabled_within?(rcvd, check, j, j + k)(node_set) 
      IMPLIES
        v_min(sent, node_set)(j) <= v_min(sent, node_set)(j + k)


decl_type: formula
theory: exact_reduce
library: fault_tolerance
signature: nil
location: 50 2 55 62
body:
    upper_validity: THEOREM
        protocol(reduce_choice(tau, cf), sent, rcvd, check, j, j + k) AND
        quorum_correct?(sent, rcvd, check, tau, j, j + k) AND
        enabled_within?(rcvd, check, j, j + k)(node_set) 
      IMPLIES
        v_max(sent, node_set)(j + k) <= v_max(sent, node_set)(j)


decl_type: formula
theory: exact_reduce
library: fault_tolerance
signature: nil
location: 57 2 63 47
body:
    consensus_validity: COROLLARY
        protocol(reduce_choice(tau, cf), sent, rcvd, check, j, j + k) AND
        quorum_correct?(sent, rcvd, check, tau, j, j + k) AND
        enabled_within?(rcvd, check, j, j + k)(node_set) AND
        uniform?(sent(j), v)(node_set(j))
      IMPLIES
        uniform?(sent(j + k), v)(node_set(j + k))


decl_type: formula
theory: exact_reduce
library: fault_tolerance
signature: nil
location: 65 2 71 65
body:
    exact_agreement_propagation: COROLLARY
        protocol(reduce_choice(tau, cf), sent, rcvd, check, j, j + k) AND
        quorum_correct?(sent, rcvd, check, tau, j, j + k) AND
        enabled_within?(rcvd, check, j, j + k)(node_set) AND
        v_max(sent, node_set)(j) = v_min(sent, node_set)(j)
      IMPLIES
        v_max(sent, node_set)(j + k) = v_min(sent, node_set)(j + k)


decl_type: formula
theory: exact_reduce
library: fault_tolerance
signature: nil
location: 73 2 78 65
body:
    agreement_generation: THEOREM
        protocol(reduce_choice(tau, cf), sent, rcvd, check, j, j + k) AND
        exists_all_symmetric?(sent, rcvd, check, tau, j, j + k) AND
        enabled_within?(rcvd, check, j, j + k)(node_set)
      IMPLIES
        v_max(sent, node_set)(j + k) = v_min(sent, node_set)(j + k) 


decl_type: formula
theory: comm_integration_stage
library: fault_tolerance
signature: nil
location: 60 2 64 44
body:
    correct_denotation_send: LEMMA
        correct_denotation?(src_status(s)) AND
        msg_check(d)(s)(rcvd(sent, src_status)(d)(s))
      IMPLIES
        rcvd(sent, src_status)(d)(s) = sent(s)


decl_type: formula
theory: comm_integration_stage
library: fault_tolerance
signature: nil
location: 80 2 81 74
body:
    scheduled_conform: LEMMA
      enabled_within?(rcvd, conforms(msg_check, common_check))(common_check)


decl_type: formula
theory: comm_integration_stage
library: fault_tolerance
signature: nil
location: 86 2 87 102
body:
    exact_correct_denotation: LEMMA
      exact_correct_denotation?(sent, rcvd(sent, src_status), msg_check)(correct_denotation(src_status))


decl_type: formula
theory: comm_integration_stage
library: fault_tolerance
signature: nil
location: 92 2 95 67
body:
    quorum_correct_integration: LEMMA
        quorum_correct?(sent, msg_check, src_status, tau)
      IMPLIES
        quorum_correct?(sent, rcvd(sent, src_status), msg_check, tau)


decl_type: formula
theory: comm_integration_stage
library: fault_tolerance
signature: nil
location: 100 2 102 57
body:
    majority_correct_rw: LEMMA
        majority_correct?(sent, msg_check, src_status) IFF
          quorum_correct?(sent, msg_check, src_status, mid)


decl_type: formula
theory: comm_integration_stage
library: fault_tolerance
signature: nil
location: 106 2 107 94
body:
    exact_single_denotation: LEMMA
      exact_single_denotation?(rcvd(sent, src_status), msg_check)(single_denotation(src_status))


decl_type: formula
theory: comm_integration_stage
library: fault_tolerance
signature: nil
location: 109 2 112 93
body:
    uniformly_enabled: LEMMA
        uniform?(msg_check)(symmetric_denotation(src_status))
      IMPLIES
        uniformly_enabled?(rcvd(sent, src_status), msg_check)(symmetric_denotation(src_status))


decl_type: formula
theory: comm_integration_stage
library: fault_tolerance
signature: nil
location: 114 2 115 97
body:
    exact_symmetric_single: LEMMA
      exact_single_denotation?(rcvd(sent, src_status), msg_check)(symmetric_denotation(src_status))


decl_type: formula
theory: comm_integration_stage
library: fault_tolerance
signature: nil
location: 121 2 124 55
body:
    all_symmetric_integration: LEMMA
        all_symmetric?(sent, msg_check, src_status)
      IMPLIES
        all_symmetric?(rcvd(sent, src_status), msg_check)


decl_type: formula
theory: comm_integration_stage
library: fault_tolerance
signature: nil
location: 128 2 132 54
body:
    good_conforms: LEMMA
        good(src_status)(s) AND
        msg_check(d)(s)(sent(s))
      IMPLIES
        enabled(rcvd(sent, src_status), msg_check)(d)(s)


decl_type: type
theory: comm_integration_stage
library: fault_tolerance
signature: nil
location: 27 2 29 40
body:
    msg_checker: TYPE+ =
      {exp: [message -> bool] | NOT exp(garbled)}
      CONTAINING (LAMBDA msg: valid?(msg))


decl_type: function
theory: comm_integration_stage
library: fault_tolerance
location: 44 2 44 65
body: osym_rcvd(sent, s): { m: message | m = sent(s) OR m = garbled }
signature:
  [d: [sent_vec_stage[S, D, message], below(S)] ->
          {m: message | m = d`1(d`2) OR m = garbled}]


decl_type: function
theory: comm_integration_stage
library: fault_tolerance
location: 45 2 45 69
body: oasym_rcvd(sent, s, d): { m: message | m = sent(s) OR m = garbled }
signature:
  [d1: [sent_vec_stage[S, D, message], below(S), below(D)] ->
          {m: message | m = d1`1(d1`2) OR m = garbled}]


decl_type: function
theory: comm_integration_stage
library: fault_tolerance
location: 47 2 47 77
body: sv_rcvd(sent, s, d): { m: message | m = tsym_rcvd(sent, s) OR m = garbled }
signature:
  [d1: [sent_vec_stage[S, D, message], below(S), below(D)] ->
          {m: message | m = tsym_rcvd(d1`1, d1`2) OR m = garbled}]


decl_type: function
theory: comm_integration_stage
library: fault_tolerance
signature:
  [[sent_vec_stage[S, D, message], node_status[S]] ->
  [below(D) -> [below(S) -> message[T]]]]

location: 50 2 58 12
body:
    rcvd(sent, src_status)(d)(s): message =
      CASES src_status(s) OF
        good                     : sent(s),
        omissive_symmetric       : osym_rcvd(sent, s),
        omissive_asymmetric      : oasym_rcvd(sent, s, d),
        transmissive_symmetric   : tsym_rcvd(sent, s),
        single_error_asymmetric  : sv_rcvd(sent, s, d),
        transmissive_asymmetric  : tasym_rcvd(sent, s, d) 
      ENDCASES


decl_type: function
theory: comm_integration_stage
library: fault_tolerance
location: 68 2 69 42
body:
  conforms(msg_check, common_check)(d)(s)(m): bool =
  msg_check(d)(s)(m) AND common_check(s)

signature:
  [[valid_check_stage, finite_set[below(S)]] ->
          [below(D) -> [below(S) -> [message[T] -> bool]]]]


decl_type: function
theory: comm_integration_stage
library: fault_tolerance
location: 89 2 90 83
signature:
  [[sent_vec_stage[S, D, message], valid_check_stage,
         node_status[S], tau_type] ->
          bool]

body:
    quorum_correct?(sent, msg_check, src_status, tau): bool = 
      quorum?(rcvd(sent, src_status), msg_check, tau)(correct_denotation(src_status))


decl_type: function
theory: comm_integration_stage
library: fault_tolerance
signature:
  [[sent_vec_stage[S, D, message], valid_check_stage,
  node_status[S]] ->
  bool]

location: 97 2 98 80
body:
    majority_correct?(sent, msg_check, src_status): bool = 
      majority?(rcvd(sent, src_status), msg_check)(correct_denotation(src_status))


decl_type: function
theory: comm_integration_stage
library: fault_tolerance
signature:
  [[sent_vec_stage[S, D, message], valid_check_stage,
  node_status[S]] ->
  bool]

location: 117 2 119 88
body:
    all_symmetric?(sent, msg_check, src_status): bool =
      uniform?(msg_check)(symmetric_denotation(src_status)) AND
      enabled_within?(rcvd(sent, src_status), msg_check)(symmetric_denotation(src_status))


decl_type: tcc
theory: comm_integration_stage
library: fault_tolerance
signature: nil
location: 139 0 142 999
body:
  % Subtype TCC generated (at line 29, column 16) for
      % (LAMBDA msg: valid?(msg))
      % expected type  msg_checker
  msg_checker_TCC1: OBLIGATION NOT valid?[T](garbled[T]);


decl_type: tcc
theory: comm_integration_stage
library: fault_tolerance
signature: nil
location: 144 0 150 999
body:
  % Existence TCC generated (at line 44, column 2) for
      % osym_rcvd(sent, s): {m: message | m = sent(s) OR m = garbled}
  osym_rcvd_TCC1: OBLIGATION
    EXISTS (x:
              [d: [sent_vec_stage[S, D, message], below(S)] ->
                 {m: message[T] | m = d`1(d`2) OR m = garbled[T]}]):
      TRUE;


decl_type: tcc
theory: comm_integration_stage
library: fault_tolerance
signature: nil
location: 152 0 158 999
body:
  % Existence TCC generated (at line 45, column 2) for
      % oasym_rcvd(sent, s, d): {m: message | m = sent(s) OR m = garbled}
  oasym_rcvd_TCC1: OBLIGATION
    EXISTS (x:
              [d1: [sent_vec_stage[S, D, message], below(S), below(D)] ->
                 {m: message[T] | m = d1`1(d1`2) OR m = garbled[T]}]):
      TRUE;


decl_type: tcc
theory: comm_integration_stage
library: fault_tolerance
signature: nil
location: 160 0 168 999
body:
  % Existence TCC generated (at line 47, column 2) for
      % sv_rcvd(sent, s, d):
      %       {m: message | m = tsym_rcvd(sent, s) OR m = garbled}
  sv_rcvd_TCC1: OBLIGATION
    EXISTS (x:
              [d1: [sent_vec_stage[S, D, message], below(S), below(D)] ->
                 {m: message[T] |
                          m = tsym_rcvd(d1`1, d1`2) OR m = garbled[T]}]):
      TRUE;


decl_type: tcc
theory: comm_integration_stage
library: fault_tolerance
signature: nil
location: 170 0 175 999
body:
  % Judgement subtype TCC generated (at line 72, column 4) for
      % conforms(msg_check, common_check)
      % expected type  valid_check_stage
  conforms_type: OBLIGATION
    FORALL (common_check, msg_check, x1: below(D), x2: below(S)):
      NOT conforms(msg_check, common_check)(x1)(x2)(garbled[T]);


decl_type: formula
theory: comm_integration
library: fault_tolerance
signature: nil
location: 54 2 57 65
body:
    quorum_correct_integration: LEMMA
        quorum_correct?(sent, check, status, tau, j, k)
      IMPLIES
        quorum_correct?(sent, rcvd(sent, status), check, tau, j, k)


decl_type: formula
theory: comm_integration
library: fault_tolerance
signature: nil
location: 63 2 65 55
body:
    majority_correct_rw: LEMMA
        majority_correct?(sent, check, status, j, k) IFF
          quorum_correct?(sent, check, status, mid, j, k)


decl_type: formula
theory: comm_integration
library: fault_tolerance
signature: nil
location: 78 2 81 71
body:
    all_symmetric_integration: LEMMA
        exists_all_symmetric?(sent, check, status, tau, j, k)
      IMPLIES
        exists_all_symmetric?(sent, rcvd(sent, status), check, tau, j, k)


decl_type: function
theory: comm_integration
library: fault_tolerance
location: 34 2 35 45
signature:
  [[[i: nat -> [below(N(i)) -> UT]],
         [i: nat -> node_status[N(i)]]] ->
          [i: nat -> [below(N(1 + i)) -> [below(N(i)) -> UT]]]]

body:
    rcvd(sent, status)(i): [below(N(i+1)) -> [below(N(i)) -> UT]] =
      rcvd[N(i), N(i+1), T](sent(i), status(i))


decl_type: function
theory: comm_integration
library: fault_tolerance
location: 41 2 42 54
signature:
  [[valid_check_function,
         [i: nat -> non_empty_finite_set[below(N(i))]]] ->
          [i: nat -> check_stage[N(i), N(1 + i), UT]]]

body:
    conforms(check, common_check)(i): check_stage[N(i),N(i+1),UT] =
      conforms[N(i),N(i+1),T](check(i), common_check(i))


decl_type: function
theory: comm_integration
library: fault_tolerance
signature:
  [[valid_check_function, [i: nat -> node_status[N(i)]], nat,
  nat] ->
  bool]

location: 46 2 48 77
body:
    uniform?(check, status, j, k): bool =
      FORALL i: j <= i AND i < k IMPLIES
        uniform?[N(i), N(i + 1), UT](check(i))(symmetric_denotation(status(i)))


decl_type: function
theory: comm_integration
library: fault_tolerance
location: 50 2 52 78
signature:
  [[[i: nat -> [below(N(i)) -> UT]], valid_check_function,
         [i: nat -> node_status[N(i)]], [i: nat -> tau_type], nat,
         nat] ->
          bool]

body:
    quorum_correct?(sent, check, status, tau, j, k): bool =
      FORALL i: j <= i AND i < k IMPLIES
        quorum_correct?[N(i), N(i + 1), T](sent(i), check(i), status(i), tau(i))


decl_type: function
theory: comm_integration
library: fault_tolerance
location: 59 2 61 72
signature:
  [[[i: nat -> [below(N(i)) -> UT]], valid_check_function,
         [i: nat -> node_status[N(i)]], nat, nat] ->
          bool]

body:
    majority_correct?(sent, check, status, j, k): bool =
      FORALL i: j <= i AND i < k IMPLIES
        majority_correct?[N(i), N(i + 1), T](sent(i), check(i), status(i))


decl_type: function
theory: comm_integration
library: fault_tolerance
location: 67 2 70 57
signature:
  [[[i: nat -> [below(N(i)) -> UT]], valid_check_function,
         [i: nat -> node_status[N(i)]], [i: nat -> tau_type], nat,
         nat] ->
          bool]

body:
    exists_all_symmetric?(sent, check, status, tau, j, k): bool =
      EXISTS i: j <= i AND i < k AND 
        all_symmetric?(sent(i), check(i), status(i)) AND
        quorum_correct?(sent, check, status, tau, i + 1, k)


decl_type: function
theory: comm_integration
library: fault_tolerance
location: 74 2 75 57
signature:
  [[[i: nat -> [below(N(i)) -> UT]], valid_check_function,
         [i: nat -> node_status[N(i)]], nat, nat] ->
          bool]

body:
    exists_all_symmetric?(sent, check, status, j, k): bool =
      exists_all_symmetric?(sent, check, status, mid, j, k)


decl_type: function
theory: protocol_integration
library: fault_tolerance
location: 33 2 34 55
signature:
  [[[i: nat -> [below(N(i)) -> message[T]]],
         check_function[N, message[T]], choice_function[N, message[T]],
         [i: nat -> node_status[N(i)]], nat, nat] ->
          bool]

body:
    protocol(sent, check, vf, status, j, k): bool = 
      protocol(vf, sent, rcvd(sent, status), check, j, k)


decl_type: formula
theory: ordered_message
library: fault_tolerance
signature: nil
location: 26 2 28 41
body:
    eq_iff: LEMMA d1 = d2 IFF
      (valid?(d1) AND valid?(d2) AND value(d1) = value(d2)) OR
      (ord(d1) = ord(d2) AND ord(d1) /= 1 )


decl_type: function
theory: ordered_message
library: fault_tolerance
signature: [[message[T], message[T]] -> bool]
location: 20 2 24 9
body:
    <=(d1, d2): bool =
      IF valid?(d1) & valid?(d2)
        THEN leq(value(d1), value(d2))
        ELSE ord(d1) <= ord(d2)
      ENDIF


decl_type: tcc
theory: ordered_message
library: fault_tolerance
signature: nil
location: 37 0 39 999
body:
  % Judgement subtype TCC generated (at line 30, column 33) for  <=
      % expected type  (total_order?[message[T]])
  message_total_order: OBLIGATION total_order?[message[T]](<=);


decl_type: formula
theory: exact_reduce_integration
library: fault_tolerance
signature: nil
location: 37 2 42 70
body:
    lower_validity: THEOREM
        check = conforms(msg_check, common_check) AND
        protocol(sent, check, reduce_choice(tau, cf), status, j, j + k) AND
        quorum_correct?(sent, check, status, tau, j, j + k)
      IMPLIES
        v_min(sent, common_check)(j) <= v_min(sent, common_check)(j + k)


decl_type: formula
theory: exact_reduce_integration
library: fault_tolerance
signature: nil
location: 44 2 49 70
body:
    upper_validity: THEOREM
        check = conforms(msg_check, common_check) AND
        protocol(sent, check, reduce_choice(tau, cf), status, j, j + k) AND
        quorum_correct?(sent, check, status, tau, j, j + k)
      IMPLIES
        v_max(sent, common_check)(j + k) <= v_max(sent, common_check)(j)


decl_type: formula
theory: exact_reduce_integration
library: fault_tolerance
signature: nil
location: 51 2 56 73
body:
    agreement_generation: THEOREM
        check = conforms(msg_check, common_check) AND
        protocol(sent, check, reduce_choice(tau, cf), status, j, j + k) AND
        exists_all_symmetric?(sent, check, status, tau, j, j + k)
      IMPLIES
        v_max(sent, common_check)(j + k) = v_min(sent, common_check)(j + k)


decl_type: formula
theory: majority_properties
library: fault_tolerance
signature: nil
location: 34 2 37 49
body:
    majority_value_subset: LEMMA
        majority_value_set(e, v)(t)
      IFF 
        majority_subset?(uniform_nodes(e, v, t), e)


decl_type: formula
theory: majority_properties
library: fault_tolerance
signature: nil
location: 39 2 43 33
body:
    uniform_majority: LEMMA
        majority_subset?(node_set, e) AND
        uniform?(v, t)(node_set) 
      IMPLIES
        majority_value_set(e, v)(t)


decl_type: formula
theory: majority_properties
library: fault_tolerance
signature: nil
location: 45 2 48 28
body:
    majority_validity: LEMMA
        majority_value_set(e, v)(t) 
      IMPLIES 
        majority(mf)(v, e) = t


decl_type: formula
theory: majority_properties
library: fault_tolerance
signature: nil
location: 50 2 53 47
body:
    agreement_generation: THEOREM
        enabled_symmetric?(e, v1, v2)
      IMPLIES
        majority(mf)(v1, e) = majority(mf)(v2, e)


decl_type: formula
theory: majority_stage
library: fault_tolerance
signature: nil
location: 37 2 42 61
body:
    majority_at_destination: LEMMA
        majority_correct?(sent, rcvd, check) AND
        enabled_within?(rcvd, check)(src_set) AND
        uniform?(sent, v)(src_set)
      IMPLIES
        majority_value_set(enabled(rcvd, check)(d), rcvd(d))(v)


decl_type: formula
theory: majority_stage
library: fault_tolerance
signature: nil
location: 44 2 49 43
body:
    majority_validity: THEOREM
        majority_correct?(sent, rcvd, check) AND
        enabled_within?(rcvd, check)(src_set) AND
        uniform?(sent, v)(src_set)
      IMPLIES
        majority_vote(mf)(rcvd, check)(d) = v


decl_type: formula
theory: majority_stage
library: fault_tolerance
signature: nil
location: 51 2 56 58
body:
    consensus_validity: COROLLARY
        majority_correct?(sent, rcvd, check) AND
        enabled_within?(rcvd, check)(src_set) AND
        uniform?(sent, v)(src_set)
      IMPLIES
        uniform?(majority_vote(mf)(rcvd, check), v)(dst_set)


decl_type: formula
theory: majority_stage
library: fault_tolerance
signature: nil
location: 58 2 61 77
body:
    agreement_generation_alt: THEOREM
        all_symmetric?(rcvd, check)
      IMPLIES
        majority_vote(mf)(rcvd, check)(d1) = majority_vote(mf)(rcvd, check)(d2)


decl_type: formula
theory: majority_stage
library: fault_tolerance
signature: nil
location: 63 2 67 61
body:
    agreement_generation: THEOREM
        all_symmetric?(rcvd, check)
      IMPLIES
        EXISTS v:
           uniform?(majority_vote(mf)(rcvd, check), v)(dst_set)


decl_type: formula
theory: majority_stage
library: fault_tolerance
signature: nil
location: 73 2 79 57
body:
    faulty_source: LEMMA
        enabled_within?(rcvd, check)(src_set) AND
        uniform?(sent, v)(src_set) AND
        enabled(rcvd, check)(d)(s) AND
        NOT majority_vote(mf)(rcvd, check)(d) = rcvd(d)(s)
      IMPLIES
        NOT majority_correct_element?(sent, rcvd, check)(s)


decl_type: formula
theory: majority_stage
library: fault_tolerance
signature: nil
location: 83 2 88 48
body:
    sources_disagree: COROLLARY
        majority_correct?(sent, rcvd, check) AND
        enabled_within?(rcvd, check)(src_set) AND
        NOT majority_exists?(rcvd(d), enabled(rcvd, check)(d))
      IMPLIES
        NOT (EXISTS v: uniform?(sent, v)(src_set))


decl_type: formula
theory: majority_stage
library: fault_tolerance
signature: nil
location: 92 2 96 55
body:
    asymmetric_source: COROLLARY
        (EXISTS v:
          uniform?(majority_vote(mf)(rcvd, check), v)(dst_set))
      OR
        (EXISTS s: NOT symmetric_source?(rcvd, check)(s))


decl_type: function
theory: majority_stage
library: fault_tolerance
location: 34 2 35 50
body:
  majority_vote(mf)(rcvd, check)(d): T =
  majority(mf)(rcvd(d), enabled(rcvd, check)(d))

signature:
  [majority_function[T] ->
          [[[below(D) -> [below(S) -> T]],
            [below(D) -> [below(S) -> [T -> bool]]]] ->
             [below(D) -> T]]]


decl_type: formula
theory: majority
library: fault_tolerance
signature: nil
location: 36 2 42 51
body:
    consensus_validity: THEOREM
        protocol(majority_vote(mf), sent, rcvd, check, j, j + k) AND
        majority_correct?(sent, rcvd, check, j, j + k) AND
        enabled_within?(rcvd, check, j, j + k)(common_check) AND
        uniform?(sent(j), v)(common_check(j)) 
      IMPLIES
        uniform?(sent(j + k), v)(common_check(j + k))


decl_type: formula
theory: majority
library: fault_tolerance
signature: nil
location: 44 2 49 61
body:
    agreement_generation: THEOREM
        protocol(majority_vote(mf), sent, rcvd, check, j, j + k) AND
        exists_all_symmetric?(sent, rcvd, check, j, j + k) AND
        enabled_within?(rcvd, check, j, j + k)(common_check)
      IMPLIES
        EXISTS v: uniform?(sent(j + k), v)(common_check(j + k))


decl_type: formula
theory: majority
library: fault_tolerance
signature: nil
location: 53 2 61 66
body:
    faulty_source: THEOREM % cross-channel compare at any stage
      FORALL (s: below(N(j)), d: below(N(j + 1))):
        protocol(majority_vote(mf), sent, rcvd, check, j, j + 1) AND
        enabled_within?(rcvd, check, j, j + 1)(common_check) AND
        uniform?(sent(j), v)(common_check(j)) AND
        enabled(rcvd(j), check(j))(d)(s) AND
        rcvd(j)(d)(s) /= sent(j + 1)(d)
      IMPLIES
        NOT majority_correct_element?(sent(j), rcvd(j), check(j))(s)


decl_type: formula
theory: majority
library: fault_tolerance
signature: nil
location: 63 2 69 47
body:
    faulty_stage: COROLLARY  % to consensus_validity
        protocol(majority_vote(mf), sent, rcvd, check, j, j + k) AND
        majority_correct?(sent, rcvd, check, j, j + k) AND
        enabled_within?(rcvd, check, j, j+ k)(common_check) AND
        (EXISTS (d: (common_check(j + k))): sent(j + k)(d) /= v)
      IMPLIES
        NOT uniform?(sent(j), v)(common_check(j))


decl_type: formula
theory: majority
library: fault_tolerance
signature: nil
location: 72 2 80 74
body:
    asymmetric_source: THEOREM % 
        protocol(majority_vote(mf), sent, rcvd, check, j, j + 2) AND
        majority_correct?(sent, rcvd, check, j + 1, j + 2) AND
        enabled_within?(rcvd, check, j, j + 2)(common_check) AND
        (EXISTS (d: below(N(j + 2))):
          NOT majority_exists?(rcvd(j + 1)(d), 
                               enabled(rcvd(j + 1), check(j + 1))(d)))
      IMPLIES
        EXISTS (s: below(N(j))): NOT symmetric_source?(rcvd(j), check(j))(s)


decl_type: formula
theory: majority_integration
library: fault_tolerance
signature: nil
location: 32 2 38 51
body:
    consensus_validity: THEOREM
        check = conforms(msg_check, common_check) AND
        protocol(sent, check, majority_vote(mf), status, j, j + k) AND
        majority_correct?(sent, check, status, j, j + k) AND
        uniform?(sent(j), v)(common_check(j))
      IMPLIES
        uniform?(sent(j + k), v)(common_check(j + k))


decl_type: formula
theory: majority_integration
library: fault_tolerance
signature: nil
location: 40 2 46 53
body:
    agreement_generation: THEOREM
        check = conforms(msg_check, common_check) AND
        protocol(sent, check, majority_vote(mf), status, j, j + k) AND
        exists_all_symmetric?(sent, check, status, j, j + k)
      IMPLIES
        EXISTS v:
          uniform?(sent(j + k), v)(common_check(j + k))


decl_type: formula
theory: message_adt
library: fault_tolerance
signature: nil
location: 21 2 23 56
body:
    message_ord_defaxiom: AXIOM
      message_ord(garbled) = 0 AND
       (FORALL (value: T): message_ord(valid(value)) = 1);


decl_type: formula
theory: message_adt
library: fault_tolerance
signature: nil
location: 28 2 30 35
body:
    message_garbled_extensionality: AXIOM
      FORALL (garbled?_var: (garbled?), garbled?_var2: (garbled?)):
        garbled?_var = garbled?_var2;


decl_type: formula
theory: message_adt
library: fault_tolerance
signature: nil
location: 32 2 35 32
body:
    message_valid_extensionality: AXIOM
      FORALL (valid?_var: (valid?), valid?_var2: (valid?)):
        value(valid?_var) = value(valid?_var2) IMPLIES
         valid?_var = valid?_var2;


decl_type: formula
theory: message_adt
library: fault_tolerance
signature: nil
location: 37 2 38 73
body:
    message_valid_eta: AXIOM
      FORALL (valid?_var: (valid?)): valid(value(valid?_var)) = valid?_var;


decl_type: formula
theory: message_adt
library: fault_tolerance
signature: nil
location: 43 2 45 51
body:
    message_inclusive: AXIOM
      FORALL (message_var: message):
        garbled?(message_var) OR valid?(message_var);


decl_type: formula
theory: message_adt
library: fault_tolerance
signature: nil
location: 47 2 50 63
body:
    message_induction: AXIOM
      FORALL (p: [message -> boolean]):
        (p(garbled) AND (FORALL (valid1_var: T): p(valid(valid1_var))))
         IMPLIES (FORALL (message_var: message): p(message_var));


decl_type: function
theory: message_adt
library: fault_tolerance
signature: [message -> upto(1)]
location: 25 2 26 58
body:
    ord(x: message): [message -> upto(1)] =
        CASES x OF garbled: 0, valid(valid1_var): 1 ENDCASES


decl_type: function
theory: message_adt
library: fault_tolerance
signature: [PRED[T] -> [message -> boolean]]
location: 52 2 53 74
body:
    every(p: PRED[T])(a: message):  boolean =
        CASES a OF garbled: TRUE, valid(valid1_var): p(valid1_var) ENDCASES;


decl_type: function
theory: message_adt
library: fault_tolerance
signature: [[PRED[T], message] -> boolean]
location: 55 2 56 74
body:
    every(p: PRED[T], a: message):  boolean =
        CASES a OF garbled: TRUE, valid(valid1_var): p(valid1_var) ENDCASES;


decl_type: function
theory: message_adt
library: fault_tolerance
signature: [PRED[T] -> [message -> boolean]]
location: 58 2 59 75
body:
    some(p: PRED[T])(a: message):  boolean =
        CASES a OF garbled: FALSE, valid(valid1_var): p(valid1_var) ENDCASES;


decl_type: function
theory: message_adt
library: fault_tolerance
signature: [[PRED[T], message] -> boolean]
location: 61 2 62 75
body:
    some(p: PRED[T], a: message):  boolean =
        CASES a OF garbled: FALSE, valid(valid1_var): p(valid1_var) ENDCASES;


decl_type: function
theory: message_adt
library: fault_tolerance
signature: [[nat, [T -> nat]] -> [message -> nat]]
location: 70 2 77 21
body:
    reduce_nat(garbled?_fun: nat, valid?_fun: [T -> nat]):
          [message -> nat] =
        LAMBDA (message_adtvar: message):
          LET red: [message -> nat] = reduce_nat(garbled?_fun, valid?_fun) IN
            CASES message_adtvar
              OF garbled: garbled?_fun,
                 valid(valid1_var): valid?_fun(valid1_var)
              ENDCASES;


decl_type: function
theory: message_adt
library: fault_tolerance
signature: [[[message -> nat], [[T, message] -> nat]] -> [message -> nat]]
location: 79 2 87 21
body:
    REDUCE_nat(garbled?_fun: [message -> nat],
               valid?_fun: [[T, message] -> nat]):
          [message -> nat] =
        LAMBDA (message_adtvar: message):
          LET red: [message -> nat] = REDUCE_nat(garbled?_fun, valid?_fun) IN
            CASES message_adtvar
              OF garbled: garbled?_fun(message_adtvar),
                 valid(valid1_var): valid?_fun(valid1_var, message_adtvar)
              ENDCASES;


decl_type: function
theory: message_adt
library: fault_tolerance
signature: [[ordinal, [T -> ordinal]] -> [message -> ordinal]]
location: 89 2 98 21
body:
    reduce_ordinal(garbled?_fun: ordinal, valid?_fun: [T -> ordinal]):
          [message -> ordinal] =
        LAMBDA (message_adtvar: message):
          LET red: [message -> ordinal] =
                reduce_ordinal(garbled?_fun, valid?_fun)
            IN
            CASES message_adtvar
              OF garbled: garbled?_fun,
                 valid(valid1_var): valid?_fun(valid1_var)
              ENDCASES;


decl_type: function
theory: message_adt
library: fault_tolerance
signature:
  [[[message -> ordinal], [[T, message] -> ordinal]] ->
  [message -> ordinal]]

location: 100 2 110 21
body:
    REDUCE_ordinal(garbled?_fun: [message -> ordinal],
                   valid?_fun: [[T, message] -> ordinal]):
          [message -> ordinal] =
        LAMBDA (message_adtvar: message):
          LET red: [message -> ordinal] =
                REDUCE_ordinal(garbled?_fun, valid?_fun)
            IN
            CASES message_adtvar
              OF garbled: garbled?_fun(message_adtvar),
                 valid(valid1_var): valid?_fun(valid1_var, message_adtvar)
              ENDCASES;


decl_type: function
theory: message_adt_map
library: fault_tolerance
signature: [[T -> T1] -> [message[T] -> message[T1]]]
location: 11 2 13 17
body:
    map(f: [T -> T1])(a: message[T]):  message[T1] =
        CASES a OF garbled: garbled, valid(valid1_var): valid(f(valid1_var))
          ENDCASES;


decl_type: function
theory: message_adt_map
library: fault_tolerance
signature: [[[T -> T1], message[T]] -> message[T1]]
location: 15 2 17 17
body:
    map(f: [T -> T1], a: message[T]):  message[T1] =
        CASES a OF garbled: garbled, valid(valid1_var): valid(f(valid1_var))
          ENDCASES;


decl_type: function
theory: message_adt_map
library: fault_tolerance
signature:
  [[[T, T1] -> boolean] ->
  [[message[T], message[T1]] -> boolean]]

location: 19 2 21 57
body:
    every(R: [[T, T1] -> boolean])(x: message[T], y: message[T1]):  boolean =
        garbled?(x) AND garbled?(y) OR
         valid?(x) AND valid?(y) AND R(value(x), value(y));


decl_type: function
theory: message_adt_reduce
library: fault_tolerance
signature: [[range, [T -> range]] -> [message[T] -> range]]
location: 9 2 17 21
body:
    reduce(garbled?_fun: range, valid?_fun: [T -> range]):
          [message[T] -> range] =
        LAMBDA (message_adtvar: message[T]):
          LET red: [message[T] -> range] = reduce(garbled?_fun, valid?_fun)
            IN
            CASES message_adtvar
              OF garbled: garbled?_fun,
                 valid(valid1_var): valid?_fun(valid1_var)
              ENDCASES;


decl_type: function
theory: message_adt_reduce
library: fault_tolerance
signature:
  [[[message[T] -> range], [[T, message[T]] -> range]] ->
  [message[T] -> range]]

location: 19 2 28 21
body:
    REDUCE(garbled?_fun: [message[T] -> range],
           valid?_fun: [[T, message[T]] -> range]):
          [message[T] -> range] =
        LAMBDA (message_adtvar: message[T]):
          LET red: [message[T] -> range] = REDUCE(garbled?_fun, valid?_fun)
            IN
            CASES message_adtvar
              OF garbled: garbled?_fun(message_adtvar),
                 valid(valid1_var): valid?_fun(valid1_var, message_adtvar)
              ENDCASES;


decl_type: formula
theory: float
library: float
signature: nil
location: 107 0 108 36
body:
  FDivInt_def: LEMMA  FORALL (i:nzint): mod(radix,i)=0 IMPLIES
               FtoR(FDivInt(f,i)) = FtoR(f)/i


decl_type: formula
theory: float
library: float
signature: nil
location: 222 0 222 177
body:
  RND_log_compute: LEMMA FORALL (x:real): x>=radix^(-dExp(b)-1)*vNum(b) IMPLIES floor(ln(x*radix/vNum(b))/ln(radix)) = log_nat(x * radix ^ (1 + dExp(b) - Prec(b)),radix)`1-dExp(b)


decl_type: formula
theory: float
library: float
signature: nil
location: 338 0 339 44
body:
  FDivKexpt_def: LEMMA FORALL (i:nat,(k:nzint | mod(radix,k)=0)):
                 FtoR(FDivKexpt(f,k,i)) = FtoR(f)/k^i


decl_type: formula
theory: float
library: float
signature: nil
location: 389 0 391 26
body:
  Lexico: lemma
     Fcanonic?(b)(p) => Fcanonic?(b)(q) => 0 <= FtoR(p) => FtoR(p) <= FtoR(q)
       => Fexp(p) <= Fexp(q)


decl_type: formula
theory: float
library: float
signature: nil
location: 393 0 395 26
body:
  CanonicLeastExp: lemma
     Fcanonic?(b)(p) => Fbounded?(b)(q) => FtoR(p)=FtoR(q)::real
       => Fexp(p) <= Fexp(q)


decl_type: formula
theory: float
library: float
signature: nil
location: 397 0 399 26
body:
  Fast_canonic: lemma
     Fbounded?(b)(p) => Fexp(p)=-dExp(b) OR vNum(b)<=abs(radix*Fnum(p))
          => Fcanonic?(b)(p)


decl_type: formula
theory: float
library: float
signature: nil
location: 406 0 407 65
body:
  FulpMonotone: lemma Fbounded?(b)(p) => Fbounded?(b)(q) =>
     0 <= FtoR(p) => FtoR(p) <= FtoR(q) => Fulp(b)(p) <= Fulp(b)(q)


decl_type: formula
theory: float
library: float
signature: nil
location: 409 0 410 59
body:
  FulpMonotoneAbs: lemma Fbounded?(b)(p) => Fbounded?(b)(q) =>
     abs(FtoR(p)) <= abs(FtoR(q)) => Fulp(b)(p) <= Fulp(b)(q)


decl_type: formula
theory: float
library: float
signature: nil
location: 412 0 413 77
body:
  FloatPlusUlpBounded: lemma
     Fbounded?(b)(p) => (exists (f:(Fbounded?(b))): FtoR(f)=FtoR(p)+Fulp(b)(p))


decl_type: formula
theory: float
library: float
signature: nil
location: 415 0 416 77
body:
  FloatMinusUlpBounded: lemma
     Fbounded?(b)(p) => (exists (f:(Fbounded?(b))): FtoR(f)=FtoR(p)-Fulp(b)(p))


decl_type: formula
theory: float
library: float
signature: nil
location: 446 0 448 55
body:
  FpredDiff: lemma
     Fcanonic?(b)(f) => 0 < FtoR(f)
        => FtoR(f)-FtoR(Fpred(b)(f))=Fulp(b)(Fpred(b)(f))


decl_type: formula
theory: float
library: float
signature: nil
location: 457 0 459 65
body:
  FpredLe_aux: lemma
     Fcanonic?(b)(p) => Fcanonic?(b)(q) => 0 < FtoR(p) =>
       FtoR(p) <= FtoR(q) => FtoR(Fpred(b)(p)) <= FtoR(Fpred(b)(q))


decl_type: formula
theory: float
library: float
signature: nil
location: 461 0 463 65
body:
  FpredLe_aux2: lemma
     Fcanonic?(b)(p) => Fcanonic?(b)(q) => 0 <= FtoR(p) =>
       FtoR(p) <= FtoR(q) => FtoR(Fsucc(b)(p)) <= FtoR(Fsucc(b)(q))


decl_type: formula
theory: float
library: float
signature: nil
location: 465 0 467 67
body:
  FpredLe: lemma
     Fcanonic?(b)(p) => Fcanonic?(b)(q) =>
      (FtoR(p) <= FtoR(q) IFF FtoR(Fpred(b)(p)) <= FtoR(Fpred(b)(q)))


decl_type: formula
theory: float
library: float
signature: nil
location: 469 0 471 67
body:
  FsuccLe: lemma
     Fcanonic?(b)(p) => Fcanonic?(b)(q) =>
      (FtoR(p) <= FtoR(q) IFF FtoR(Fsucc(b)(p)) <= FtoR(Fsucc(b)(q)))


decl_type: formula
theory: float
library: float
signature: nil
location: 473 0 475 40
body:
  FpredProp_aux: lemma
    Fcanonic?(b)(p) => Fcanonic?(b)(q) => 0 <= FtoR(p) => FtoR(p) < FtoR(q) 
           => FtoR(p) <= FtoR(Fpred(b)(q))


decl_type: formula
theory: float
library: float
signature: nil
location: 477 0 479 37
body:
  FpredProp: lemma
    Fcanonic?(b)(p) => Fcanonic?(b)(q) => FtoR(p) < FtoR(q) 
        => FtoR(p) <= FtoR(Fpred(b)(q))


decl_type: formula
theory: float
library: float
signature: nil
location: 484 0 486 54
body:
  FsuccProp: lemma
    Fcanonic?(b)(p) => Fcanonic?(b)(q) =>
       FtoR(p) < FtoR(q) => FtoR(Fsucc(b)(p)) <= FtoR(q)


decl_type: formula
theory: float
library: float
signature: nil
location: 491 0 492 100
body:
  FsuccZleEq: lemma
      FtoR(p) <= FtoR(q) => FtoR(q) < FtoR(Fsucc(b)(p)) => Fexp(p) <= Fexp(q) => FtoR(p)=FtoR(q)::real


decl_type: formula
theory: float
library: float
signature: nil
location: 515 0 516 59
body:
  RleRoundedLessR0 : lemma Fbounded?(b)(f) => 
    RoundedMode?(b)(P) => P(b)(r,f) => r <= 0 => FtoR(f) <= 0


decl_type: formula
theory: float
library: float
signature: nil
location: 552 0 553 40
body:
  RND_float_Min_ge_canonic: LEMMA Fcanonic?(b)(g) IMPLIES
              (RND_float_Min(b)(f) >= g IFF f>=g)


decl_type: formula
theory: float
library: float
signature: nil
location: 555 0 556 40
body:
  RND_float_Max_le_canonic: LEMMA Fcanonic?(b)(g) IMPLIES
              (RND_float_Max(b)(f) <= g IFF f<=g)


decl_type: formula
theory: float
library: float
signature: nil
location: 576 0 577 38
body:
  RND_float_Min_lt_canonic: LEMMA Fcanonic?(b)(g) IMPLIES
              (RND_float_Min(b)(f) < g IFF f<g)


decl_type: formula
theory: float
library: float
signature: nil
location: 579 0 580 38
body:
  RND_float_Min_gt_canonic: LEMMA Fcanonic?(b)(g) IMPLIES
              (RND_float_Max(b)(f) > g IFF f>g)


decl_type: formula
theory: float
library: float
signature: nil
location: 590 0 590 103
body:
  Fmult_canonic_id_Min: LEMMA Fcanonic?(b)(f) IMPLIES RND_float_Min(b)(f*Fnormalize(b)(float_int(1))) = f


decl_type: formula
theory: float
library: float
signature: nil
location: 592 0 592 103
body:
  Fmult_canonic_id_Max: LEMMA Fcanonic?(b)(f) IMPLIES RND_float_Max(b)(f*Fnormalize(b)(float_int(1))) = f


decl_type: formula
theory: float
library: float
signature: nil
location: 594 0 594 103
body:
  Fplus_canonic_id_Min: LEMMA Fcanonic?(b)(f) IMPLIES RND_float_Min(b)(f+Fnormalize(b)(float_int(0))) = f


decl_type: formula
theory: float
library: float
signature: nil
location: 596 0 596 103
body:
  Fplus_canonic_id_Max: LEMMA Fcanonic?(b)(f) IMPLIES RND_float_Max(b)(f+Fnormalize(b)(float_int(0))) = f


decl_type: formula
theory: float
library: float
signature: nil
location: 598 0 601 20
body:
  MaxSuccMin: lemma 
    Fcanonic?(b)(q) => Fcanonic?(b)(p) =>
    isMin?(b)(r,p) => isMax?(b)(r,q) => NOT FtoR(p)=FtoR(q)::real 
      => q=Fsucc(b)(p)


decl_type: formula
theory: float
library: float
signature: nil
location: 603 0 605 25
body:
  LeMinMaxClosest: lemma Fbounded?(b)(f) =>  Fbounded?(b)(p) =>  Fbounded?(b)(q) => 
       isMin?(b)(r,p) =>  abs(FtoR(f)-r) <= abs(FtoR(p)-r) => isMax?(b)(r,q) =>  abs(FtoR(f)-r) <= abs(FtoR(q)-r)
        => Closest?(b)(r,f)


decl_type: formula
theory: float
library: float
signature: nil
location: 649 0 650 64
body:
  RoundedProjectorEq : lemma Fbounded?(b)(f) => Fbounded?(b)(p) => 
    RoundedMode?(b)(P) => P(b)(FtoR(f),p) => FtoR(p)=FtoR(f)::real


decl_type: formula
theory: float
library: float
signature: nil
location: 655 0 656 73
body:
  isMin_Rep :  lemma Fbounded?(b)(f) => isMin?(b)(FtoR(p),f) 
      => (exists (m:int): FtoR(f)=FtoR((# Fnum:=m, Fexp:=Fexp(p) #))::real) 


decl_type: formula
theory: float
library: float
signature: nil
location: 658 0 659 87
body:
  RoundedModeRep : lemma Fbounded?(b)(f) => RoundedMode?(b)(P) =>  
    P(b)(FtoR(p),f) => (exists (m:int): FtoR(f)=FtoR((# Fnum:=m, Fexp:=Fexp(p) #))::real) 


decl_type: formula
theory: float
library: float
signature: nil
location: 661 0 662 64
body:
  RoundedModeUlp : lemma Fbounded?(b)(p) =>
    RoundedMode?(b)(P) => P(b)(r,p) => abs(FtoR(p)-r) < Fulp(b)(p)


decl_type: formula
theory: float
library: float
signature: nil
location: 667 0 669 69
body:
  RoundedModeNonDecreasing : lemma 
     Fbounded?(b)(p) => Fbounded?(b)(q) =>  RoundedMode?(b)(P) => Unique?(b)(P) 
       => P(b)(z1,p) =>  P(b)(z2,q)  =>  z1 <= z2 => FtoR(p) <= FtoR(q)


decl_type: formula
theory: float
library: float
signature: nil
location: 671 0 673 108
body:
  ClosestUlp2 : lemma 
      Fcanonic?(b)(p) => Closest?(b)(r,p) => 
      abs(r) <= abs(FtoR(p)) + Fulp(b)(Fpred(b)(Fabs(p)))/2  => abs(FtoR(p)-r) <= Fulp(b)(Fpred(b)(Fabs(p)))/2


decl_type: formula
theory: float
library: float
signature: nil
location: 678 0 680 75
body:
  SterbenzAux : lemma
   Fbounded?(b)(p) => Fbounded?(b)(q) => 
     FtoR(p) <= FtoR(q) =>  FtoR(q) <= 2*FtoR(p) => Fbounded?(b)(Fminus(q,p)) 


decl_type: formula
theory: float
library: float
signature: nil
location: 682 0 684 77
body:
  Sterbenz : lemma
   Fbounded?(b)(p) => Fbounded?(b)(q) => 
     FtoR(p)/2 <= FtoR(q) =>  FtoR(q) <= 2*FtoR(p) => Fbounded?(b)(Fminus(q,p)) 


decl_type: formula
theory: float
library: float
signature: nil
location: 686 0 689 96
body:
  errorBoundedPlus : lemma
     Fbounded?(b)(p) => Fbounded?(b)(q) => Fbounded?(b)(f) => 
     Closest?(b)(FtoR(p)+FtoR(q),f) => 
     (exists (e:(Fbounded?(b))): FtoR(e)=FtoR(p)+FtoR(q)-FtoR(f) AND Fexp(e)=min(Fexp(p),Fexp(q)))


decl_type: formula
theory: float
library: float
signature: nil
location: 691 0 695 96
body:
  errorBoundedMult_aux : lemma
     Fbounded?(b)(p) => Fbounded?(b)(q) => Fbounded?(b)(f) => 
        0 <= FtoR(p) => 0 <= FtoR(q) => 0 <= FtoR(f) =>
          isMin?(b)(FtoR(p)*FtoR(q),f) => -dExp(b) <= Fexp(p)+Fexp(q) =>
          (exists (e:(Fbounded?(b))): FtoR(e)=FtoR(p)*FtoR(q)-FtoR(f) AND Fexp(e)=Fexp(p)+Fexp(q))


decl_type: formula
theory: float
library: float
signature: nil
location: 697 0 701 96
body:
  errorBoundedMult_aux2 : lemma
     Fbounded?(b)(p) => Fbounded?(b)(q) => Fbounded?(b)(f) => 
        0 <= FtoR(p) => 0 <= FtoR(q) => 0 <= FtoR(f) =>
          isMax?(b)(FtoR(p)*FtoR(q),f) => -dExp(b) <= Fexp(p)+Fexp(q) =>
          (exists (e:(Fbounded?(b))): FtoR(e)=FtoR(p)*FtoR(q)-FtoR(f) AND Fexp(e)=Fexp(p)+Fexp(q))


decl_type: formula
theory: float
library: float
signature: nil
location: 703 0 706 91
body:
  errorBoundedMult : lemma
     Fbounded?(b)(p) => Fbounded?(b)(q) => Fbounded?(b)(f) => 
     RoundedMode?(b)(P) => P(b)(FtoR(p)*FtoR(q),f) => -dExp(b) <= Fexp(p)+Fexp(q) =>
     (exists (e:(Fbounded?(b))): FtoR(e)=FtoR(p)*FtoR(q)-FtoR(f) AND Fexp(e)=Fexp(p)+Fexp(q))


decl_type: formula
theory: float
library: float
signature: nil
location: 715 0 716 86
body:
  FulpLe  : lemma
    Fbounded?(b)(p) => Fulp(b)(p) <= max(abs(FtoR(p)) * radix/vNum(b), radix^(-dExp(b)))


decl_type: function
theory: float
library: float
signature: [[float, float] -> float]
location: 44 0 45 80
body:
  Fplus(f,g):float= (# Fnum:=Fnum(f)*radix^(Fexp(f)-min(Fexp(f),Fexp(g))) 
     + Fnum(g)*radix^(Fexp(g)-min(Fexp(f),Fexp(g))), Fexp:=min(Fexp(f),Fexp(g)) #)


decl_type: function
theory: float
library: float
signature: [[float, float] -> float]
location: 46 0 47 80
body:
  Fminus(f,g):float= (# Fnum:=Fnum(f)*radix^(Fexp(f)-min(Fexp(f),Fexp(g))) 
     - Fnum(g)*radix^(Fexp(g)-min(Fexp(f),Fexp(g))), Fexp:=min(Fexp(f),Fexp(g)) #)


decl_type: function
theory: float
library: float
signature: [[float, float] -> float]
location: 54 0 58 1
body:
  Fmax(f,g):float = if Fle?(f,g) then g else f endif

  % Real Number Symbols on Floats

  ; +(f,g): float = Fplus(f,g)


decl_type: function
theory: float
library: float
signature: [[float, nat] -> float]
location: 87 0 88 1
body:
  Fexpt(f, (n:nat)): float = (# Fnum:=expt(Fnum(f),n), Fexp:=n*Fexp(f) #)
  ;^(f,(n:nat)): float = Fexpt(f,n)


decl_type: function
theory: float
library: float
signature: [[nat, nat, [nat -> float]] -> float]
location: 94 0 98 18
body:
  sigma(ii:nat,jj:nat,FF:[nat->float]): RECURSIVE float =
    IF ii > jj THEN float_int(0)
    ELSIF jj = 0 THEN FF(0)
    ELSE Fplus(FF(jj),sigma(ii,jj-1,FF))
    ENDIF MEASURE jj


decl_type: function
theory: float
library: float
signature: [Format -> [float -> bool]]
location: 118 0 119 54
body:
  Fsubnormal?(b)(f):bool= Fbounded?(b)(f) AND Fexp(f)=-dExp(b)
                        AND abs(radix*Fnum(f)) < vNum(b)


decl_type: function
theory: float
library: float
signature: [Format -> [float -> float]]
location: 133 0 138 9
body:
  Fsucc(b)(f):float = IF Fnum(f)=vNum(b)-1 
      THEN (# Fnum:=vNum(b)/radix, Fexp:=Fexp(f)+1 #) 
      ELSIF  Fnum(f)=-vNum(b)/radix AND Fexp(f)>-dExp(b)
           THEN  (# Fnum:=-(vNum(b)-1), Fexp:=Fexp(f)-1 #) 
           ELSE  (# Fnum:=Fnum(f)+1, Fexp:=Fexp(f) #) 
      ENDIF


decl_type: function
theory: float
library: float
signature: [Format -> [float -> float]]
location: 140 0 145 9
body:
  Fpred(b)(f):float = IF Fnum(f)=-(vNum(b)-1) 
      THEN (# Fnum:=-vNum(b)/radix, Fexp:=Fexp(f)+1 #) 
      ELSIF  Fnum(f)=vNum(b)/radix AND Fexp(f)>-dExp(b)
           THEN  (# Fnum:=vNum(b)-1, Fexp:=Fexp(f)-1 #) 
           ELSE  (# Fnum:=Fnum(f)-1, Fexp:=Fexp(f) #) 
      ENDIF


decl_type: function
theory: float
library: float
location: 147 0 155 33
signature:
  [b: Format ->
          [f: (Fbounded?(b)) ->
             {x: (Fcanonic?(b)) |
                      FtoR(x) = FtoR(f) AND Fexp(x) <= Fexp(f)}]]

body:
  Fnormalize(b)(f:(Fbounded?(b))): recursive
          {x : (Fcanonic?(b)) | FtoR(x)=FtoR(f)::real AND Fexp(x) <=  Fexp(f)} =
     if Fnum(f) = 0 then 
       (# Fnum:=0, Fexp:= -dExp(b)#)
     elsif Fexp(f) = -dExp(b) or 
                      abs(radix*Fnum(f)) >= vNum(b) then f
     else Fnormalize(b)((# Fnum:=radix*Fnum(f), Fexp:=Fexp(f)-1 #))
     endif
     measure vNum(b) - abs(Fnum(f))


decl_type: function
theory: float
library: float
signature: [b: Format -> [[real, (Fbounded?(b))] -> bool]]
location: 169 0 170 67
body:
  isMin?(b)(r:real,min:(Fbounded?(b))):bool =  (FtoR(min) <= r) AND
    (forall (f:(Fbounded?(b))): FtoR(f) <= r => FtoR(f) <= FtoR(min))


decl_type: function
theory: float
library: float
signature: [b: Format -> [[real, (Fbounded?(b))] -> bool]]
location: 172 0 173 67
body:
  isMax?(b)(r:real,max:(Fbounded?(b))):bool =  (r <= FtoR(max)) AND
    (forall (f:(Fbounded?(b))): r <= FtoR(f) => FtoR(max) <= FtoR(f))


decl_type: function
theory: float
library: float
signature: [b: Format -> [[real, (Fbounded?(b))] -> bool]]
location: 175 0 178 9
body:
  ToZero?(b)(r:real,c:(Fbounded?(b))):bool =  
      if 0 <= r then isMin?(b)(r,c)
                else isMax?(b)(r,c)
      endif


decl_type: function
theory: float
library: float
signature: [b: Format -> [[real, (Fbounded?(b))] -> bool]]
location: 180 0 181 63
body:
  Closest?(b)(r:real,c:(Fbounded?(b))):bool =  
    (forall (f:(Fbounded?(b))): abs(FtoR(c)-r) <= abs(FtoR(f)-r))


decl_type: function
theory: float
library: float
signature: [b: Format -> [[real, (Fbounded?(b))] -> bool]]
location: 183 0 185 77
body:
  EvenClosest?(b)(r:real,c:(Fbounded?(b))):bool =  Closest?(b)(r,c) AND
    (even?(Fnum(Fnormalize(b)(c))) OR 
        (forall (f:(Fbounded?(b))): Closest?(b)(r,f) => FtoR(f)=FtoR(c)::real))


decl_type: function
theory: float
library: float
signature: [b: Format -> [[real, (Fbounded?(b))] -> bool]]
location: 187 0 189 77
body:
  AFZClosest?(b)(r:real,c:(Fbounded?(b))):bool =  Closest?(b)(r,c) AND
    (abs(r) <= abs(FtoR(c)) OR 
        (forall (f:(Fbounded?(b))): Closest?(b)(r,f) => FtoR(f)=FtoR(c)::real))


decl_type: function
theory: float
library: float
signature: [Format -> [RND -> bool]]
location: 195 0 196 66
body:
  Compatible?(b)(P):bool = (forall (r1,r2:real, f1,f2:(Fbounded?(b))): 
     P(b)(r1,f1) => r1=r2 => FtoR(f1)=FtoR(f2)::real => P(b)(r2,f2))


decl_type: function
theory: float
library: float
signature: [Format -> [RND -> bool]]
location: 198 0 199 50
body:
  MinOrMax?(b)(P):bool = (forall (r:real,f:(Fbounded?(b))):
      P(b)(r,f) => isMin?(b)(r,f) OR isMax?(b)(r,f))


decl_type: function
theory: float
library: float
signature: [Format -> [RND -> bool]]
location: 201 0 202 66
body:
  Monotone?(b)(P):bool = (forall (r1,r2:real, f1,f2:(Fbounded?(b))):
     r1 < r2 => P(b)(r1,f1) =>  P(b)(r2,f2) => FtoR(f1) <= FtoR(f2))


decl_type: function
theory: float
library: float
signature: [Format -> [RND -> bool]]
location: 204 0 205 76
body:
  RoundedMode?(b)(P):bool = 
    Total?(b)(P) AND Compatible?(b)(P) AND MinOrMax?(b)(P) AND Monotone?(b)(P)


decl_type: function
theory: float
library: float
signature: [Format -> [RND -> bool]]
location: 207 0 208 59
body:
  Unique?(b)(P):bool = (forall (r:real,f1,f2:(Fbounded?(b))): 
         P(b)(r,f1) => P(b)(r,f2) => FtoR(f1)=FtoR(f2)::real)


decl_type: function
theory: float
library: float
signature: [b: Format -> [nonneg_real -> (Fcanonic?(b))]]
location: 224 0 229 7
body:
  RND_aux(b)(x:nonneg_real): (Fcanonic?(b)) =
    if (x < radix^(-dExp(b)-1)*vNum(b))
       then (# Fnum:=floor(x*radix^(dExp(b))), Fexp:=-dExp(b) #)
       else let e=log_nat(x * radix ^ (1 + dExp(b) - Prec(b)),radix)`1-dExp(b) in
            (# Fnum:=floor(x*radix^(-e)), Fexp:=e #)
    endif


decl_type: function
theory: float
library: float
signature: [b: Format -> [nonneg_real -> (Fcanonic?(b))]]
location: 231 0 236 7
body:
  RND_aux_alt(b)(x:nonneg_real): (Fcanonic?(b)) =
    if (x < radix^(-dExp(b)-1)*vNum(b))
       then (# Fnum:=floor(x*radix^(dExp(b))), Fexp:=-dExp(b) #)
       else let e=floor(ln(x*radix/vNum(b))/ln(radix)) in
            (# Fnum:=floor(x*radix^(-e)), Fexp:=e #)
    endif


decl_type: function
theory: float
library: float
signature: [b: Format -> [real -> (Fcanonic?(b))]]
location: 240 0 245 7
body:
  RND_Min(b)(x:real): (Fcanonic?(b)) =
    if (0 <= x) 
      then RND_aux(b)(x)
      elsif FtoR(Fopp(RND_aux(b)(-x)))=x then Fopp(RND_aux(b)(-x))
      else  Fpred(b)(Fopp(RND_aux(b)(-x)))
    endif


decl_type: function
theory: float
library: float
signature: [b: Format -> [real -> (Fcanonic?(b))]]
location: 254 0 260 6
body:
  RND_EClosest(b)(x:real): (Fcanonic?(b)) =
   if     abs(FtoR(RND_Min(b)(x))-x) < abs(FtoR(RND_Max(b)(x))-x) then RND_Min(b)(x)
    elsif abs(FtoR(RND_Max(b)(x))-x) < abs(FtoR(RND_Min(b)(x))-x) then RND_Max(b)(x)
    elsif FtoR(RND_Min(b)(x))=FtoR(RND_Max(b)(x))::real then RND_Min(b)(x)
    elsif even?(Fnum(RND_Min(b)(x))) then RND_Min(b)(x)
    else  RND_Max(b)(x)
   endif


decl_type: function
theory: float
library: float
signature: [[float, {k: nzint | mod(radix, k) = 0}, nat] -> float]
location: 335 0 336 56
body:
  FDivKexpt(f,(k:nzint | mod(radix,k)=0),(i:nat)): float =
    (# Fnum:=Fnum(f)*((radix^i)/(k^i)), Fexp:=Fexp(f)-i #)


decl_type: function
theory: float
library: float
signature: [b: Format -> [{f | Fnum(f) >= 0} -> (Fcanonic?(b))]]
location: 526 0 532 7
body:
  RND_aux_float(b)((f|Fnum(f)>=0)): (Fcanonic?(b)) =
    IF (Fnum(f) < radix^(Prec(b)-Fexp(f)-dExp(b)-1))
    THEN (# Fnum := floor(Fnum(f)*radix^(dExp(b)+Fexp(f))),Fexp := -dExp(b) #)
    ELSE LET e =log_nat(Fnum(f)*radix^(Fexp(f)+1+dExp(b)-Prec(b)),
                          radix)`1-dExp(b)
         IN (# Fnum := floor(Fnum(f)*radix^(Fexp(f)-e)),Fexp := e #)
    ENDIF


decl_type: function
theory: float
library: float
signature: [b: Format -> [float -> (Fcanonic?(b))]]
location: 537 0 542 7
body:
  RND_float_Min(b)(f): (Fcanonic?(b)) =
    if (0 <= Fnum(f)) 
      then RND_aux_float(b)(f)
      elsif FtoR(Fopp(RND_aux_float(b)(-f)))=FtoR(f) then Fopp(RND_aux_float(b)(-f))
      else  Fpred(b)(Fopp(RND_aux_float(b)(-f)))
    endif


decl_type: tcc
theory: float
library: float
signature: nil
location: 730 0 732 999
body:
  % Subtype TCC generated (at line 21, column 30) for  Prec(b)
      % expected type  {i: int | radix /= 0 OR i >= 0}
  vNum_TCC1: OBLIGATION FORALL (b: Format): radix /= 0 OR Prec(b) >= 0;


decl_type: tcc
theory: float
library: float
signature: nil
location: 734 0 736 999
body:
  % Subtype TCC generated (at line 33, column 28) for  (Fexp(f))
      % expected type  {i: int | radix /= 0 OR i >= 0}
  FtoR_TCC1: OBLIGATION FORALL (f: float): radix /= 0 OR (Fexp(f)) >= 0;


decl_type: tcc
theory: float
library: float
signature: nil
location: 738 0 743 999
body:
  % Subtype TCC generated (at line 44, column 42) for
      % (Fexp(f) - min(Fexp(f), Fexp(g)))
      % expected type  {i: int | radix /= 0 OR i >= 0}
  Fplus_TCC1: OBLIGATION
    FORALL (f: float, g: float):
      radix /= 0 OR (Fexp(f) - min(Fexp(f), Fexp(g))) >= 0;


decl_type: tcc
theory: float
library: float
signature: nil
location: 745 0 750 999
body:
  % Subtype TCC generated (at line 45, column 20) for
      % (Fexp(g) - min(Fexp(f), Fexp(g)))
      % expected type  {i: int | radix /= 0 OR i >= 0}
  Fplus_TCC2: OBLIGATION
    FORALL (f: float, g: float):
      radix /= 0 OR (Fexp(g) - min(Fexp(f), Fexp(g))) >= 0;


decl_type: tcc
theory: float
library: float
signature: nil
location: 752 0 759 999
body:
  % Subtype TCC generated (at line 44, column 27) for
      % Fnum(f) * radix ^ (Fexp(f) - min(Fexp(f), Fexp(g))) +
      %  Fnum(g) * radix ^ (Fexp(g) - min(Fexp(f), Fexp(g)))
      % expected type  int
  Fplus_TCC3: OBLIGATION
    FORALL (f: float, g: float):
      integer_pred(Fnum(f) * radix ^ (Fexp(f) - min(Fexp(f), Fexp(g))) +
                    Fnum(g) * radix ^ (Fexp(g) - min(Fexp(f), Fexp(g))));


decl_type: tcc
theory: float
library: float
signature: nil
location: 761 0 768 999
body:
  % Subtype TCC generated (at line 46, column 28) for
      % Fnum(f) * radix ^ (Fexp(f) - min(Fexp(f), Fexp(g))) -
      %  Fnum(g) * radix ^ (Fexp(g) - min(Fexp(f), Fexp(g)))
      % expected type  int
  Fminus_TCC1: OBLIGATION
    FORALL (f: float, g: float):
      integer_pred(Fnum(f) * radix ^ (Fexp(f) - min(Fexp(f), Fexp(g))) -
                    Fnum(g) * radix ^ (Fexp(g) - min(Fexp(f), Fexp(g))));


decl_type: tcc
theory: float
library: float
signature: nil
location: 770 0 773 999
body:
  % Subtype TCC generated (at line 90, column 56) for  n
      % expected type  {i: int | FtoR(f) /= 0 OR i >= 0}
  FexptCorrect_TCC1: OBLIGATION
    FORALL (f: float, n: nat): FtoR(f) /= 0 OR n >= 0;


decl_type: tcc
theory: float
library: float
signature: nil
location: 775 0 778 999
body:
  % Subtype TCC generated (at line 97, column 29) for  jj - 1
      % expected type  nat
  sigma_TCC1: OBLIGATION
    FORALL (ii, jj: nat): NOT jj = 0 AND NOT ii > jj IMPLIES jj - 1 >= 0;


decl_type: tcc
theory: float
library: float
signature: nil
location: 780 0 783 999
body:
  % Termination TCC generated (at line 97, column 20) for
      % sigma(ii, jj - 1, FF)
  sigma_TCC2: OBLIGATION
    FORALL (ii, jj: nat): NOT jj = 0 AND NOT ii > jj IMPLIES jj - 1 < jj;


decl_type: tcc
theory: float
library: float
signature: nil
location: 785 0 789 999
body:
  % Subtype TCC generated (at line 104, column 11) for  Fnum(f) * (radix / i)
      % expected type  int
  FDivInt_TCC1: OBLIGATION
    FORALL (f: float, (i: nzint | mod(radix, i) = 0)):
      integer_pred(Fnum(f) * (radix / i));


decl_type: tcc
theory: float
library: float
signature: nil
location: 791 0 793 999
body:
  % Subtype TCC generated (at line 126, column 18) for  ln(radix)
      % expected type  nznum
  hathatln_TCC1: OBLIGATION ln(radix) /= 0;


decl_type: tcc
theory: float
library: float
signature: nil
location: 795 0 798 999
body:
  % Subtype TCC generated (at line 126, column 10) for  (-(ln(r) / ln(radix)))
      % expected type  {r: real | radix /= 0 OR r /= 0}
  hathatln_TCC2: OBLIGATION
    FORALL (r: posreal): radix /= 0 OR (-(ln(r) / ln(radix))) /= 0;


decl_type: tcc
theory: float
library: float
signature: nil
location: 800 0 802 999
body:
  % Subtype TCC generated (at line 129, column 9) for  e1
      % expected type  {r: real | radix /= 0 OR r /= 0}
  hathat_int_TCC1: OBLIGATION FORALL (e1: int): radix /= 0 OR e1 /= 0;


decl_type: tcc
theory: float
library: float
signature: nil
location: 804 0 806 999
body:
  % Subtype TCC generated (at line 129, column 18) for  e1
      % expected type  {i: int | radix /= 0 OR i >= 0}
  hathat_int_TCC2: OBLIGATION FORALL (e1: int): radix /= 0 OR e1 >= 0;


decl_type: tcc
theory: float
library: float
signature: nil
location: 808 0 812 999
body:
  % Subtype TCC generated (at line 134, column 18) for  vNum(b) / radix
      % expected type  int
  Fsucc_TCC1: OBLIGATION
    FORALL (b: Format, f: float):
      Fnum(f) = vNum(b) - 1 IMPLIES integer_pred(vNum(b) / radix);


decl_type: tcc
theory: float
library: float
signature: nil
location: 814 0 818 999
body:
  % Subtype TCC generated (at line 141, column 18) for  -vNum(b) / radix
      % expected type  int
  Fpred_TCC1: OBLIGATION
    FORALL (b: Format, f: float):
      Fnum(f) = -(vNum(b) - 1) IMPLIES integer_pred(-vNum(b) / radix);


decl_type: tcc
theory: float
library: float
signature: nil
location: 820 0 823 999
body:
  % Subtype TCC generated (at line 155, column 11) for  vNum(b) - abs(Fnum(f))
      % expected type  naturalnumber
  Fnormalize_TCC1: OBLIGATION
    FORALL (b: Format, f: (Fbounded?(b))): vNum(b) - abs(Fnum(f)) >= 0;


decl_type: tcc
theory: float
library: float
signature: nil
location: 825 0 834 999
body:
  % Subtype TCC generated (at line 150, column 5) for
      % (# Fnum := 0, Fexp := -dExp(b) #)
      % expected type  {x: (Fcanonic?(b)) |
                     %          FtoR(x) = FtoR(f) AND Fexp(x) <= Fexp(f)}
  Fnormalize_TCC2: OBLIGATION
    FORALL (b: Format, f: (Fbounded?(b))):
      Fnum(f) = 0 IMPLIES
       Fcanonic?(b)((# Fnum := 0, Fexp := -dExp(b) #)) AND
        FtoR((# Fnum := 0, Fexp := -dExp(b) #)) = FtoR(f) AND
         -dExp(b) <= Fexp(f);


decl_type: tcc
theory: float
library: float
signature: nil
location: 836 0 843 999
body:
  % Subtype TCC generated (at line 152, column 55) for  f
      % expected type  {x: (Fcanonic?(b)) |
                     %          FtoR(x) = FtoR(f) AND Fexp(x) <= Fexp(f)}
  Fnormalize_TCC3: OBLIGATION
    FORALL (b: Format, f: (Fbounded?(b))):
      (Fexp(f) = -dExp(b) OR abs(radix * Fnum(f)) >= vNum(b)) AND
       NOT Fnum(f) = 0
       IMPLIES Fcanonic?(b)(f) AND Fexp(f) <= Fexp(f);


decl_type: tcc
theory: float
library: float
signature: nil
location: 845 0 853 999
body:
  % Subtype TCC generated (at line 153, column 22) for
      % (# Fnum := radix * Fnum(f), Fexp := Fexp(f) - 1 #)
      % expected type  f: (Fbounded?(b))
  Fnormalize_TCC4: OBLIGATION
    FORALL (b: Format, f: (Fbounded?(b))):
      NOT Fexp(f) = -dExp(b) AND
       NOT abs(radix * Fnum(f)) >= vNum(b) AND NOT Fnum(f) = 0
       IMPLIES
       Fbounded?(b)((# Fnum := radix * Fnum(f), Fexp := Fexp(f) - 1 #));


decl_type: tcc
theory: float
library: float
signature: nil
location: 855 0 861 999
body:
  % Termination TCC generated (at line 153, column 8) for
      % Fnormalize(b)((# Fnum := radix * Fnum(f), Fexp := Fexp(f) - 1 #))
  Fnormalize_TCC5: OBLIGATION
    FORALL (b: Format, f: (Fbounded?(b))):
      NOT Fexp(f) = -dExp(b) AND
       NOT abs(radix * Fnum(f)) >= vNum(b) AND NOT Fnum(f) = 0
       IMPLIES vNum(b) - abs(radix * Fnum(f)) < vNum(b) - abs(Fnum(f));


decl_type: tcc
theory: float
library: float
signature: nil
location: 863 0 884 999
body:
  % Subtype TCC generated (at line 153, column 8) for
      % Fnormalize(b)((# Fnum := radix * Fnum(f), Fexp := Fexp(f) - 1 #))
      % expected type  {x: (Fcanonic?(b)) |
                     %          FtoR(x) = FtoR(f) AND Fexp(x) <= Fexp(f)}
  Fnormalize_TCC6: OBLIGATION
    FORALL (b: Format, f: (Fbounded?(b)),
            v:
              [b1: Format ->
                 [f1:
                    {z: (Fbounded?(b1)) |
                             vNum(b1) - abs(Fnum(z)) <
                              vNum(b) - abs(Fnum(f))} ->
                    {x: (Fcanonic?(b1)) |
                             FtoR(x) = FtoR(f1) AND Fexp(x) <= Fexp(f1)}]]):
      NOT Fexp(f) = -dExp(b) AND
       NOT abs(radix * Fnum(f)) >= vNum(b) AND NOT Fnum(f) = 0
       IMPLIES
       FtoR(v(b)((# Fnum := radix * Fnum(f), Fexp := Fexp(f) - 1 #))) =
        FtoR(f)
        AND
        Fexp(v(b)((# Fnum := radix * Fnum(f), Fexp := Fexp(f) - 1 #))) <=
         Fexp(f);


decl_type: tcc
theory: float
library: float
signature: nil
location: 886 0 891 999
body:
  % Subtype TCC generated (at line 159, column 40) for
      % (Fexp(Fnormalize(b)(f)))
      % expected type  {i: int | radix /= 0 OR i >= 0}
  Fulp_TCC1: OBLIGATION
    FORALL (b: Format, f: (Fbounded?(b))):
      radix /= 0 OR (Fexp(Fnormalize(b)(f))) >= 0;


decl_type: tcc
theory: float
library: float
signature: nil
location: 893 0 896 999
body:
  % Subtype TCC generated (at line 222, column 50) for  (-dExp(b) - 1)
      % expected type  {i: int | radix /= 0 OR i >= 0}
  RND_log_compute_TCC1: OBLIGATION
    FORALL (b: Format): radix /= 0 OR (-dExp(b) - 1) >= 0;


decl_type: tcc
theory: float
library: float
signature: nil
location: 898 0 903 999
body:
  % Subtype TCC generated (at line 222, column 87) for  x * radix / vNum(b)
      % expected type  posreal
  RND_log_compute_TCC2: OBLIGATION
    FORALL (b: Format, x: real):
      x >= radix ^ (-dExp(b) - 1) * vNum(b) IMPLIES
       x * radix / vNum(b) >= 0 AND x * radix / vNum(b) > 0;


decl_type: tcc
theory: float
library: float
signature: nil
location: 905 0 911 999
body:
  % Subtype TCC generated (at line 222, column 138) for
      % (1 + dExp(b) - Prec(b))
      % expected type  {i: int | radix /= 0 OR i >= 0}
  RND_log_compute_TCC3: OBLIGATION
    FORALL (b: Format, x: real):
      x >= radix ^ (-dExp(b) - 1) * vNum(b) IMPLIES
       radix /= 0 OR (1 + dExp(b) - Prec(b)) >= 0;


decl_type: tcc
theory: float
library: float
signature: nil
location: 913 0 919 999
body:
  % Subtype TCC generated (at line 222, column 125) for
      % x * radix ^ (1 + dExp(b) - Prec(b))
      % expected type  {x: real | x >= 1}
  RND_log_compute_TCC4: OBLIGATION
    FORALL (b: Format, x: real):
      x >= radix ^ (-dExp(b) - 1) * vNum(b) IMPLIES
       x * radix ^ (1 + dExp(b) - Prec(b)) >= 1;


decl_type: tcc
theory: float
library: float
signature: nil
location: 921 0 926 999
body:
  % Subtype TCC generated (at line 226, column 34) for  (dExp(b))
      % expected type  {i: int | radix /= 0 OR i >= 0}
  RND_aux_TCC1: OBLIGATION
    FORALL (b: Format, x: nonneg_real):
      (x < radix ^ (-dExp(b) - 1) * vNum(b)) IMPLIES
       radix /= 0 OR (dExp(b)) >= 0;


decl_type: tcc
theory: float
library: float
signature: nil
location: 928 0 936 999
body:
  % Subtype TCC generated (at line 226, column 10) for
      % (# Fnum := floor(x * radix ^ (dExp(b))), Fexp := -dExp(b) #)
      % expected type  (Fcanonic?(b))
  RND_aux_TCC2: OBLIGATION
    FORALL (b: Format, x: nonneg_real):
      (x < radix ^ (-dExp(b) - 1) * vNum(b)) IMPLIES
       Fcanonic?(b)
                ((# Fnum := floor(x * radix ^ (dExp(b))),
                    Fexp := -dExp(b) #));


decl_type: tcc
theory: float
library: float
signature: nil
location: 938 0 944 999
body:
  % Subtype TCC generated (at line 227, column 37) for
      % (1 + dExp(b) - Prec(b))
      % expected type  {i: int | radix /= 0 OR i >= 0}
  RND_aux_TCC3: OBLIGATION
    FORALL (b: Format, x: nonneg_real):
      NOT (x < radix ^ (-dExp(b) - 1) * vNum(b)) IMPLIES
       radix /= 0 OR (1 + dExp(b) - Prec(b)) >= 0;


decl_type: tcc
theory: float
library: float
signature: nil
location: 946 0 952 999
body:
  % Subtype TCC generated (at line 227, column 24) for
      % x * radix ^ (1 + dExp(b) - Prec(b))
      % expected type  {x: real | x >= 1}
  RND_aux_TCC4: OBLIGATION
    FORALL (b: Format, x: nonneg_real):
      NOT (x < radix ^ (-dExp(b) - 1) * vNum(b)) IMPLIES
       x * radix ^ (1 + dExp(b) - Prec(b)) >= 1;


decl_type: tcc
theory: float
library: float
signature: nil
location: 954 0 961 999
body:
  % Subtype TCC generated (at line 228, column 34) for  (-e)
      % expected type  {i: int | radix /= 0 OR i >= 0}
  RND_aux_TCC5: OBLIGATION
    FORALL (b: Format, x: nonneg_real):
      NOT (x < radix ^ (-dExp(b) - 1) * vNum(b)) IMPLIES
       (FORALL (e: int):
          e = log_nat(x * radix ^ (1 + dExp(b) - Prec(b)), radix)`1 - dExp(b)
           IMPLIES radix /= 0 OR (-e) >= 0);


decl_type: tcc
theory: float
library: float
signature: nil
location: 963 0 972 999
body:
  % Subtype TCC generated (at line 228, column 10) for
      % (# Fnum := floor(x * radix ^ (-e)), Fexp := e #)
      % expected type  (Fcanonic?(b))
  RND_aux_TCC6: OBLIGATION
    FORALL (b: Format, x: nonneg_real):
      NOT (x < radix ^ (-dExp(b) - 1) * vNum(b)) IMPLIES
       (FORALL (e: int):
          e = log_nat(x * radix ^ (1 + dExp(b) - Prec(b)), radix)`1 - dExp(b)
           IMPLIES
           Fcanonic?(b)((# Fnum := floor(x * radix ^ (-e)), Fexp := e #)));


decl_type: tcc
theory: float
library: float
signature: nil
location: 974 0 979 999
body:
  % Subtype TCC generated (at line 234, column 25) for  x * radix / vNum(b)
      % expected type  posreal
  RND_aux_alt_TCC1: OBLIGATION
    FORALL (b: Format, x: nonneg_real):
      NOT (x < radix ^ (-dExp(b) - 1) * vNum(b)) IMPLIES
       x * radix / vNum(b) > 0;


decl_type: tcc
theory: float
library: float
signature: nil
location: 981 0 991 999
body:
  % Subtype TCC generated (at line 235, column 34) for  (-e)
      % expected type  {i: int | radix /= 0 OR i >= 0}
  RND_aux_alt_TCC2: OBLIGATION
    FORALL (b: Format, x: nonneg_real):
      NOT (x < radix ^ (-dExp(b) - 1) * vNum(b)) IMPLIES
       (FORALL (e:
                  {i |
                           i <= ln(x * radix / vNum(b)) / ln(radix) &
                            ln(x * radix / vNum(b)) / ln(radix) < 1 + i}):
          e = floor(ln(x * radix / vNum(b)) / ln(radix)) IMPLIES
           radix /= 0 OR (-e) >= 0);


decl_type: tcc
theory: float
library: float
signature: nil
location: 993 0 1004 999
body:
  % Subtype TCC generated (at line 235, column 10) for
      % (# Fnum := floor(x * radix ^ (-e)), Fexp := e #)
      % expected type  (Fcanonic?(b))
  RND_aux_alt_TCC3: OBLIGATION
    FORALL (b: Format, x: nonneg_real):
      NOT (x < radix ^ (-dExp(b) - 1) * vNum(b)) IMPLIES
       (FORALL (e:
                  {i |
                           i <= ln(x * radix / vNum(b)) / ln(radix) &
                            ln(x * radix / vNum(b)) / ln(radix) < 1 + i}):
          e = floor(ln(x * radix / vNum(b)) / ln(radix)) IMPLIES
           Fcanonic?(b)((# Fnum := floor(x * radix ^ (-e)), Fexp := e #)));


decl_type: tcc
theory: float
library: float
signature: nil
location: 1006 0 1008 999
body:
  % Subtype TCC generated (at line 242, column 20) for  x
      % expected type  nonneg_real
  RND_Min_TCC1: OBLIGATION FORALL (x: real): (0 <= x) IMPLIES x >= 0;


decl_type: tcc
theory: float
library: float
signature: nil
location: 1010 0 1012 999
body:
  % Subtype TCC generated (at line 243, column 31) for  -x
      % expected type  nonneg_real
  RND_Min_TCC2: OBLIGATION FORALL (x: real): NOT (0 <= x) IMPLIES -x >= 0;


decl_type: tcc
theory: float
library: float
signature: nil
location: 1014 0 1019 999
body:
  % Subtype TCC generated (at line 243, column 44) for  Fopp(RND_aux(b)(-x))
      % expected type  (Fcanonic?(b))
  RND_Min_TCC3: OBLIGATION
    FORALL (b: Format, x: real):
      FtoR(Fopp(RND_aux(b)(-x))) = x AND NOT (0 <= x) IMPLIES
       Fcanonic?(b)(Fopp(RND_aux(b)(-x)));


decl_type: tcc
theory: float
library: float
signature: nil
location: 1021 0 1027 999
body:
  % Subtype TCC generated (at line 244, column 10) for
      % Fpred(b)(Fopp(RND_aux(b)(-x)))
      % expected type  (Fcanonic?(b))
  RND_Min_TCC4: OBLIGATION
    FORALL (b: Format, x: real):
      NOT FtoR(Fopp(RND_aux(b)(-x))) = x AND NOT (0 <= x) IMPLIES
       Fcanonic?(b)(Fpred(b)(Fopp(RND_aux(b)(-x))));


decl_type: tcc
theory: float
library: float
signature: nil
location: 1029 0 1032 999
body:
  % Subtype TCC generated (at line 247, column 37) for  Fopp(RND_Min(b)(-x))
      % expected type  (Fcanonic?(b))
  RND_Max_TCC1: OBLIGATION
    FORALL (b: Format, x: real): Fcanonic?(b)(Fopp(RND_Min(b)(-x)));


decl_type: tcc
theory: float
library: float
signature: nil
location: 1034 0 1037 999
body:
  % Subtype TCC generated (at line 272, column 30) for  e2
      % expected type  {i: int | radix /= 0 OR i >= 0}
  Exp_incr_1_TCC1: OBLIGATION
    FORALL (e1, e2: int): e1 < e2 IMPLIES radix /= 0 OR e2 >= 0;


decl_type: tcc
theory: float
library: float
signature: nil
location: 1039 0 1042 999
body:
  % Subtype TCC generated (at line 278, column 32) for  e2
      % expected type  {i: int | radix /= 0 OR i >= 0}
  Exp_increq_1_TCC1: OBLIGATION
    FORALL (e1, e2: int): e1 <= e2 IMPLIES radix /= 0 OR e2 >= 0;


decl_type: tcc
theory: float
library: float
signature: nil
location: 1044 0 1046 999
body:
  % Subtype TCC generated (at line 290, column 33) for  (n + 1)
      % expected type  {i: int | radix /= 0 OR i >= 0}
  expt_odd_TCC1: OBLIGATION FORALL (n: nat): radix /= 0 OR (n + 1) >= 0;


decl_type: tcc
theory: float
library: float
signature: nil
location: 1048 0 1051 999
body:
  % Subtype TCC generated (at line 336, column 27) for  i
      % expected type  {i: int | radix /= 0 OR i >= 0}
  FDivKexpt_TCC1: OBLIGATION
    FORALL ((k: nzint | mod(radix, k) = 0), (i: nat)): radix /= 0 OR i >= 0;


decl_type: tcc
theory: float
library: float
signature: nil
location: 1053 0 1056 999
body:
  % Subtype TCC generated (at line 336, column 33) for  i
      % expected type  {i: int | k /= 0 OR i >= 0}
  FDivKexpt_TCC2: OBLIGATION
    FORALL ((k: nzint | mod(radix, k) = 0), (i: nat)): k /= 0 OR i >= 0;


decl_type: tcc
theory: float
library: float
signature: nil
location: 1058 0 1063 999
body:
  % Subtype TCC generated (at line 336, column 11) for
      % Fnum(f) * ((radix ^ i) / (k ^ i))
      % expected type  int
  FDivKexpt_TCC3: OBLIGATION
    FORALL (f: float, (k: nzint | mod(radix, k) = 0), (i: nat)):
      integer_pred(Fnum(f) * ((radix ^ i) / (k ^ i)));


decl_type: tcc
theory: float
library: float
signature: nil
location: 1065 0 1068 999
body:
  % Subtype TCC generated (at line 387, column 30) for  p
      % expected type  (Fbounded?(b))
  FulpCanonic_TCC1: OBLIGATION
    FORALL (b: Format, p: float): Fcanonic?(b)(p) IMPLIES Fbounded?(b)(p);


decl_type: tcc
theory: float
library: float
signature: nil
location: 1070 0 1074 999
body:
  % Subtype TCC generated (at line 402, column 42) for  Fopp(f)
      % expected type  (Fbounded?(b))
  FulpOpp_TCC1: OBLIGATION
    FORALL (b: Format, f: float):
      Fbounded?(b)(f) IMPLIES Fbounded?(b)(Fopp(f));


decl_type: tcc
theory: float
library: float
signature: nil
location: 1076 0 1080 999
body:
  % Subtype TCC generated (at line 404, column 42) for  Fabs(f)
      % expected type  (Fbounded?(b))
  FulpAbs_TCC1: OBLIGATION
    FORALL (b: Format, f: float):
      Fbounded?(b)(f) IMPLIES Fbounded?(b)(Fabs(f));


decl_type: tcc
theory: float
library: float
signature: nil
location: 1082 0 1086 999
body:
  % Subtype TCC generated (at line 448, column 43) for  Fpred(b)(f)
      % expected type  (Fbounded?(b))
  FpredDiff_TCC1: OBLIGATION
    FORALL (b: Format, f: float):
      Fcanonic?(b)(f) AND 0 < FtoR(f) IMPLIES Fbounded?(b)(Fpred(b)(f));


decl_type: tcc
theory: float
library: float
signature: nil
location: 1088 0 1092 999
body:
  % Subtype TCC generated (at line 496, column 27) for  vNum(b) / radix
      % expected type  int
  EvenFsuccOdd_aux_TCC1: OBLIGATION
    FORALL (b: Format):
      even?(vNum(b) - 1) IMPLIES integer_pred(vNum(b) / radix);


decl_type: tcc
theory: float
library: float
signature: nil
location: 1094 0 1098 999
body:
  % Subtype TCC generated (at line 502, column 27) for  vNum(b) / radix
      % expected type  int
  OddFsuccEven_aux_TCC1: OBLIGATION
    FORALL (b: Format):
      odd?(vNum(b) - 1) IMPLIES integer_pred(vNum(b) / radix);


decl_type: tcc
theory: float
library: float
signature: nil
location: 1100 0 1103 999
body:
  % Subtype TCC generated (at line 521, column 33) for  RND_Min(b)(r)
      % expected type  (Fbounded?(b))
  RND_Min_isMin_TCC1: OBLIGATION
    FORALL (b: Format, r: real): Fbounded?(b)(RND_Min(b)(r));


decl_type: tcc
theory: float
library: float
signature: nil
location: 1105 0 1108 999
body:
  % Subtype TCC generated (at line 522, column 33) for  RND_Max(b)(r)
      % expected type  (Fbounded?(b))
  RND_Max_isMax_TCC1: OBLIGATION
    FORALL (b: Format, r: real): Fbounded?(b)(RND_Max(b)(r));


decl_type: tcc
theory: float
library: float
signature: nil
location: 1110 0 1115 999
body:
  % Subtype TCC generated (at line 527, column 23) for
      % (Prec(b) - Fexp(f) - dExp(b) - 1)
      % expected type  {i: int | radix /= 0 OR i >= 0}
  RND_aux_float_TCC1: OBLIGATION
    FORALL (b: Format, (f: float | Fnum(f) >= 0)):
      radix /= 0 OR (Prec(b) - Fexp(f) - dExp(b) - 1) >= 0;


decl_type: tcc
theory: float
library: float
signature: nil
location: 1117 0 1122 999
body:
  % Subtype TCC generated (at line 528, column 39) for  (dExp(b) + Fexp(f))
      % expected type  {i: int | radix /= 0 OR i >= 0}
  RND_aux_float_TCC2: OBLIGATION
    FORALL (b: Format, (f: float | Fnum(f) >= 0)):
      (Fnum(f) < radix ^ (Prec(b) - Fexp(f) - dExp(b) - 1)) IMPLIES
       radix /= 0 OR (dExp(b) + Fexp(f)) >= 0;


decl_type: tcc
theory: float
library: float
signature: nil
location: 1124 0 1133 999
body:
  % Subtype TCC generated (at line 528, column 7) for
      % (# Fnum := floor(Fnum(f) * radix ^ (dExp(b) + Fexp(f))),
      %    Fexp := -dExp(b) #)
      % expected type  (Fcanonic?(b))
  RND_aux_float_TCC3: OBLIGATION
    FORALL (b: Format, (f: float | Fnum(f) >= 0)):
      (Fnum(f) < radix ^ (Prec(b) - Fexp(f) - dExp(b) - 1)) IMPLIES
       Fcanonic?(b)
                ((# Fnum := floor(Fnum(f) * radix ^ (dExp(b) + Fexp(f))),
                    Fexp := -dExp(b) #));


decl_type: tcc
theory: float
library: float
signature: nil
location: 1135 0 1141 999
body:
  % Subtype TCC generated (at line 529, column 37) for
      % (Fexp(f) + 1 + dExp(b) - Prec(b))
      % expected type  {i: int | radix /= 0 OR i >= 0}
  RND_aux_float_TCC4: OBLIGATION
    FORALL (b: Format, (f: float | Fnum(f) >= 0)):
      NOT (Fnum(f) < radix ^ (Prec(b) - Fexp(f) - dExp(b) - 1)) IMPLIES
       radix /= 0 OR (Fexp(f) + 1 + dExp(b) - Prec(b)) >= 0;


decl_type: tcc
theory: float
library: float
signature: nil
location: 1143 0 1149 999
body:
  % Subtype TCC generated (at line 529, column 22) for
      % Fnum(f) * radix ^ (Fexp(f) + 1 + dExp(b) - Prec(b))
      % expected type  {x: real | x >= 1}
  RND_aux_float_TCC5: OBLIGATION
    FORALL (b: Format, (f: float | Fnum(f) >= 0)):
      NOT (Fnum(f) < radix ^ (Prec(b) - Fexp(f) - dExp(b) - 1)) IMPLIES
       Fnum(f) * radix ^ (Fexp(f) + 1 + dExp(b) - Prec(b)) >= 1;


decl_type: tcc
theory: float
library: float
signature: nil
location: 1151 0 1161 999
body:
  % Subtype TCC generated (at line 531, column 42) for  (Fexp(f) - e)
      % expected type  {i: int | radix /= 0 OR i >= 0}
  RND_aux_float_TCC6: OBLIGATION
    FORALL (b: Format, (f: float | Fnum(f) >= 0)):
      NOT (Fnum(f) < radix ^ (Prec(b) - Fexp(f) - dExp(b) - 1)) IMPLIES
       (FORALL (e: int):
          e =
           log_nat(Fnum(f) * radix ^ (Fexp(f) + 1 + dExp(b) - Prec(b)),
                   radix)`1
            - dExp(b)
           IMPLIES radix /= 0 OR (Fexp(f) - e) >= 0);


decl_type: tcc
theory: float
library: float
signature: nil
location: 1163 0 1177 999
body:
  % Subtype TCC generated (at line 531, column 10) for
      % (# Fnum := floor(Fnum(f) * radix ^ (Fexp(f) - e)), Fexp := e #)
      % expected type  (Fcanonic?(b))
  RND_aux_float_TCC7: OBLIGATION
    FORALL (b: Format, (f: float | Fnum(f) >= 0)):
      NOT (Fnum(f) < radix ^ (Prec(b) - Fexp(f) - dExp(b) - 1)) IMPLIES
       (FORALL (e: int):
          e =
           log_nat(Fnum(f) * radix ^ (Fexp(f) + 1 + dExp(b) - Prec(b)),
                   radix)`1
            - dExp(b)
           IMPLIES
           Fcanonic?(b)
                    ((# Fnum := floor(Fnum(f) * radix ^ (Fexp(f) - e)),
                        Fexp := e #)));


decl_type: tcc
theory: float
library: float
signature: nil
location: 1179 0 1182 999
body:
  % Subtype TCC generated (at line 535, column 35) for  FtoR(f)
      % expected type  nonneg_real
  RND_aux_float_def_TCC1: OBLIGATION
    FORALL (f: float): Fnum(f) >= 0 IMPLIES FtoR(f) >= 0;


decl_type: tcc
theory: float
library: float
signature: nil
location: 1184 0 1187 999
body:
  % Subtype TCC generated (at line 539, column 26) for  f
      % expected type  {f | Fnum(f) >= 0}
  RND_float_Min_TCC1: OBLIGATION
    FORALL (f: float): (0 <= Fnum(f)) IMPLIES Fnum(f) >= 0;


decl_type: tcc
theory: float
library: float
signature: nil
location: 1189 0 1192 999
body:
  % Subtype TCC generated (at line 540, column 37) for  -f
      % expected type  {f | Fnum(f) >= 0}
  RND_float_Min_TCC2: OBLIGATION
    FORALL (f: float): NOT (0 <= Fnum(f)) IMPLIES Fnum(-f) >= 0;


decl_type: tcc
theory: float
library: float
signature: nil
location: 1194 0 1200 999
body:
  % Subtype TCC generated (at line 540, column 56) for
      % Fopp(RND_aux_float(b)(-f))
      % expected type  (Fcanonic?(b))
  RND_float_Min_TCC3: OBLIGATION
    FORALL (b: Format, f: float):
      FtoR(Fopp(RND_aux_float(b)(-f))) = FtoR(f) AND NOT (0 <= Fnum(f))
       IMPLIES Fcanonic?(b)(Fopp(RND_aux_float(b)(-f)));


decl_type: tcc
theory: float
library: float
signature: nil
location: 1202 0 1208 999
body:
  % Subtype TCC generated (at line 541, column 10) for
      % Fpred(b)(Fopp(RND_aux_float(b)(-f)))
      % expected type  (Fcanonic?(b))
  RND_float_Min_TCC4: OBLIGATION
    FORALL (b: Format, f: float):
      NOT FtoR(Fopp(RND_aux_float(b)(-f))) = FtoR(f) AND NOT (0 <= Fnum(f))
       IMPLIES Fcanonic?(b)(Fpred(b)(Fopp(RND_aux_float(b)(-f))));


decl_type: tcc
theory: float
library: float
signature: nil
location: 1210 0 1214 999
body:
  % Subtype TCC generated (at line 547, column 38) for
      % Fopp(RND_float_Min(b)(-f))
      % expected type  (Fcanonic?(b))
  RND_float_Max_TCC1: OBLIGATION
    FORALL (b: Format, f: float): Fcanonic?(b)(Fopp(RND_float_Min(b)(-f)));


decl_type: tcc
theory: float
library: float
signature: nil
location: 1216 0 1220 999
body:
  % Subtype TCC generated (at line 590, column 85) for  float_int(1)
      % expected type  f: (Fbounded?(b))
  Fmult_canonic_id_Min_TCC1: OBLIGATION
    FORALL (b: Format, f: float):
      Fcanonic?(b)(f) IMPLIES Fbounded?(b)(float_int(1));


decl_type: tcc
theory: float
library: float
signature: nil
location: 1222 0 1226 999
body:
  % Subtype TCC generated (at line 594, column 85) for  float_int(0)
      % expected type  f: (Fbounded?(b))
  Fplus_canonic_id_Min_TCC1: OBLIGATION
    FORALL (b: Format, f: float):
      Fcanonic?(b)(f) IMPLIES Fbounded?(b)(float_int(0));


decl_type: tcc
theory: float
library: float
signature: nil
location: 1228 0 1233 999
body:
  % Subtype TCC generated (at line 600, column 32) for  q
      % expected type  (Fbounded?(b))
  MaxSuccMin_TCC1: OBLIGATION
    FORALL (b: Format, p, q: float, r: real):
      Fcanonic?(b)(q) AND Fcanonic?(b)(p) AND isMin?(b)(r, p) IMPLIES
       Fbounded?(b)(q);


decl_type: tcc
theory: float
library: float
signature: nil
location: 1235 0 1238 999
body:
  % Subtype TCC generated (at line 632, column 50) for  RND_EClosest(b)(r)
      % expected type  (Fbounded?(b))
  RND_EClosest_isEclosest_TCC1: OBLIGATION
    FORALL (b: Format, r: real): Fbounded?(b)(RND_EClosest(b)(r));


decl_type: tcc
theory: float
library: float
signature: nil
location: 1240 0 1245 999
body:
  % Subtype TCC generated (at line 673, column 37) for  Fpred(b)(Fabs(p))
      % expected type  (Fbounded?(b))
  ClosestUlp2_TCC1: OBLIGATION
    FORALL (b: Format, p: float, r: real):
      Fcanonic?(b)(p) AND Closest?(b)(r, p) IMPLIES
       Fbounded?(b)(Fpred(b)(Fabs(p)));


decl_type: tcc
theory: float
library: float
signature: nil
location: 1247 0 1250 999
body:
  % Subtype TCC generated (at line 710, column 29) for  p
      % expected type  (Fbounded?(b))
  FulpLeN_TCC1: OBLIGATION
    FORALL (b: Format, p: float): Fnormal?(b)(p) IMPLIES Fbounded?(b)(p);


decl_type: tcc
theory: float
library: float
signature: nil
location: 1252 0 1255 999
body:
  % Subtype TCC generated (at line 713, column 35) for  (vNum(b) - 1)
      % expected type  nznum
  FulpGe_TCC1: OBLIGATION
    FORALL (b: Format, p: float): Fbounded?(b)(p) IMPLIES (vNum(b) - 1) /= 0;


decl_type: tcc
theory: float
library: float
signature: nil
location: 1257 0 1261 999
body:
  % Subtype TCC generated (at line 716, column 76) for  (-dExp(b))
      % expected type  {i: int | radix /= 0 OR i >= 0}
  FulpLe_TCC1: OBLIGATION
    FORALL (b: Format, p: float):
      Fbounded?(b)(p) IMPLIES radix /= 0 OR (-dExp(b)) >= 0;


decl_type: tcc
theory: float
library: float
signature: nil
location: 1263 0 1267 999
body:
  % Subtype TCC generated (at line 719, column 45) for  Fpred(b)(p)
      % expected type  (Fbounded?(b))
  FulpFpred1_TCC1: OBLIGATION
    FORALL (b: Format, p: float):
      Fcanonic?(b)(p) AND 0 <= FtoR(p) IMPLIES Fbounded?(b)(Fpred(b)(p));


decl_type: formula
theory: enumerated_type_defs
library: float
signature: nil
location: 37 0 39 999
body:
  NaN_type_inclusive: AXIOM
    FORALL (NaN_type_var: NaN_type):
      signal?(NaN_type_var) OR quiet?(NaN_type_var);


decl_type: formula
theory: enumerated_type_defs
library: float
signature: nil
location: 41 0 44 999
body:
  NaN_type_induction: AXIOM
    FORALL (p: [NaN_type -> boolean]):
      p(signal) AND p(quiet) IMPLIES
       (FORALL (NaN_type_var: NaN_type): p(NaN_type_var));


decl_type: formula
theory: enumerated_type_defs
library: float
signature: nil
location: 50 0 52 999
body:
  fp_ops_ord_defaxiom: AXIOM
    fp_ops_ord(add) = 0 AND
     fp_ops_ord(sub) = 1 AND fp_ops_ord(mult) = 2 AND fp_ops_ord(div) = 3;


decl_type: formula
theory: enumerated_type_defs
library: float
signature: nil
location: 54 0 57 999
body:
  fp_ops_inclusive: AXIOM
    FORALL (fp_ops_var: fp_ops):
      add?(fp_ops_var) OR
       sub?(fp_ops_var) OR mult?(fp_ops_var) OR div?(fp_ops_var);


decl_type: formula
theory: enumerated_type_defs
library: float
signature: nil
location: 59 0 62 999
body:
  fp_ops_induction: AXIOM
    FORALL (p: [fp_ops -> boolean]):
      p(add) AND p(sub) AND p(mult) AND p(div) IMPLIES
       (FORALL (fp_ops_var: fp_ops): p(fp_ops_var));


decl_type: formula
theory: enumerated_type_defs
library: float
signature: nil
location: 66 0 69 999
body:
  rounding_mode_ord_defaxiom: AXIOM
    rounding_mode_ord(to_nearest) = 0 AND
     rounding_mode_ord(to_zero) = 1 AND
      rounding_mode_ord(to_pos) = 2 AND rounding_mode_ord(to_neg) = 3;


decl_type: formula
theory: enumerated_type_defs
library: float
signature: nil
location: 71 0 75 999
body:
  rounding_mode_inclusive: AXIOM
    FORALL (rounding_mode_var: rounding_mode):
      to_nearest?(rounding_mode_var) OR
       to_zero?(rounding_mode_var) OR
        to_pos?(rounding_mode_var) OR to_neg?(rounding_mode_var);


decl_type: formula
theory: enumerated_type_defs
library: float
signature: nil
location: 77 0 80 999
body:
  rounding_mode_induction: AXIOM
    FORALL (p: [rounding_mode -> boolean]):
      p(to_nearest) AND p(to_zero) AND p(to_pos) AND p(to_neg) IMPLIES
       (FORALL (rounding_mode_var: rounding_mode): p(rounding_mode_var));


decl_type: formula
theory: enumerated_type_defs
library: float
signature: nil
location: 84 0 88 999
body:
  exception_ord_defaxiom: AXIOM
         exception_ord(invalid_operation) = 0
     AND exception_ord(division_by_zero) = 1 AND exception_ord(overflow) = 2
     AND (FORALL (exact?: bool): exception_ord(underflow(exact?)) = 3)
     AND exception_ord(inexact) = 4 AND exception_ord(no_exceptions) = 5;


decl_type: formula
theory: enumerated_type_defs
library: float
signature: nil
location: 90 0 92 999
body:
  exception_invalid_operation_extensionality: AXIOM
    FORALL (invalid?_var: (invalid?), invalid?_var2: (invalid?)):
      invalid?_var = invalid?_var2;


decl_type: formula
theory: enumerated_type_defs
library: float
signature: nil
location: 94 0 97 999
body:
  exception_division_by_zero_extensionality: AXIOM
    FORALL (div_by_zero?_var: (div_by_zero?),
            div_by_zero?_var2: (div_by_zero?)):
      div_by_zero?_var = div_by_zero?_var2;


decl_type: formula
theory: enumerated_type_defs
library: float
signature: nil
location: 99 0 101 999
body:
  exception_overflow_extensionality: AXIOM
    FORALL (overflow?_var: (overflow?), overflow?_var2: (overflow?)):
      overflow?_var = overflow?_var2;


decl_type: formula
theory: enumerated_type_defs
library: float
signature: nil
location: 103 0 106 999
body:
  exception_underflow_extensionality: AXIOM
    FORALL (underflow?_var: (underflow?), underflow?_var2: (underflow?)):
      exact?(underflow?_var) = exact?(underflow?_var2) IMPLIES
       underflow?_var = underflow?_var2;


decl_type: formula
theory: enumerated_type_defs
library: float
signature: nil
location: 108 0 110 999
body:
  exception_underflow_eta: AXIOM
    FORALL (underflow?_var: (underflow?)):
      underflow(exact?(underflow?_var)) = underflow?_var;


decl_type: formula
theory: enumerated_type_defs
library: float
signature: nil
location: 112 0 114 999
body:
  exception_inexact_extensionality: AXIOM
    FORALL (inexact?_var: (inexact?), inexact?_var2: (inexact?)):
      inexact?_var = inexact?_var2;


decl_type: formula
theory: enumerated_type_defs
library: float
signature: nil
location: 116 0 119 999
body:
  exception_no_exceptions_extensionality: AXIOM
    FORALL (no_exceptions?_var: (no_exceptions?),
            no_exceptions?_var2: (no_exceptions?)):
      no_exceptions?_var = no_exceptions?_var2;


decl_type: formula
theory: enumerated_type_defs
library: float
signature: nil
location: 121 0 123 999
body:
  exception_exact?_underflow: AXIOM
    FORALL (underflow1_var: bool):
      exact?(underflow(underflow1_var)) = underflow1_var;


decl_type: formula
theory: enumerated_type_defs
library: float
signature: nil
location: 125 0 129 999
body:
  exception_inclusive: AXIOM
    FORALL (exception_var: exception):
          invalid?(exception_var) OR div_by_zero?(exception_var)
       OR overflow?(exception_var) OR underflow?(exception_var)
       OR inexact?(exception_var) OR no_exceptions?(exception_var);


decl_type: formula
theory: enumerated_type_defs
library: float
signature: nil
location: 131 0 136 999
body:
  exception_induction: AXIOM
    FORALL (p: [exception -> boolean]):
           p(invalid_operation) AND p(division_by_zero) AND p(overflow)
       AND FORALL (underflow1_var: bool): p(underflow(underflow1_var))
       AND p(inexact) AND p(no_exceptions)
       IMPLIES (FORALL (exception_var: exception): p(exception_var));


decl_type: function
theory: enumerated_type_defs
library: float
signature: [rounding_mode -> upto(3)]
location: 184 0 185 999
body:
  ord(x: rounding_mode): [rounding_mode -> upto(3)] =
      CASES x OF to_nearest: 0, to_zero: 1, to_pos: 2, to_neg: 3 ENDCASES


decl_type: function
theory: enumerated_type_defs
library: float
signature: [exception -> upto(5)]
location: 207 0 215 999
body:
  ord(x: exception): [exception -> upto(5)] =
      CASES x
        OF invalid_operation: 0,
           division_by_zero: 1,
           overflow: 2,
           underflow(underflow1_var): 3,
           inexact: 4,
           no_exceptions: 5
        ENDCASES


decl_type: function
theory: enumerated_type_defs
library: float
signature:
  [[nat, nat, nat, [boolean -> nat], nat, nat] ->
  [exception -> nat]]

location: 219 0 235 999
body:
  reduce_nat(invalid?_fun: nat, div_by_zero?_fun: nat, overflow?_fun: nat,
             underflow?_fun: [bool -> nat], inexact?_fun: nat,
             no_exceptions?_fun: nat):
        [exception -> nat] =
      LAMBDA (exception_adtvar: exception):
        LET red: [exception -> nat] =
              reduce_nat(invalid?_fun, div_by_zero?_fun, overflow?_fun,
                         underflow?_fun, inexact?_fun, no_exceptions?_fun)
          IN
          CASES exception_adtvar
            OF invalid_operation: invalid?_fun,
               division_by_zero: div_by_zero?_fun,
               overflow: overflow?_fun,
               underflow(underflow1_var): underflow?_fun(underflow1_var),
               inexact: inexact?_fun,
               no_exceptions: no_exceptions?_fun
            ENDCASES;


decl_type: function
theory: enumerated_type_defs
library: float
location: 237 0 257 999
signature:
  [[[exception -> nat], [exception -> nat], [exception -> nat],
         [[boolean, exception] -> nat], [exception -> nat],
         [exception -> nat]] ->
          [exception -> nat]]

body:
  REDUCE_nat(invalid?_fun: [exception -> nat],
             div_by_zero?_fun: [exception -> nat],
             overflow?_fun: [exception -> nat],
             underflow?_fun: [[bool, exception] -> nat],
             inexact?_fun: [exception -> nat],
             no_exceptions?_fun: [exception -> nat]):
        [exception -> nat] =
      LAMBDA (exception_adtvar: exception):
        LET red: [exception -> nat] =
              REDUCE_nat(invalid?_fun, div_by_zero?_fun, overflow?_fun,
                         underflow?_fun, inexact?_fun, no_exceptions?_fun)
          IN
          CASES exception_adtvar
            OF invalid_operation: invalid?_fun(exception_adtvar),
               division_by_zero: div_by_zero?_fun(exception_adtvar),
               overflow: overflow?_fun(exception_adtvar),
               underflow(underflow1_var):
                 underflow?_fun(underflow1_var, exception_adtvar),
               inexact: inexact?_fun(exception_adtvar),
               no_exceptions: no_exceptions?_fun(exception_adtvar)
            ENDCASES;


decl_type: function
theory: enumerated_type_defs
library: float
location: 259 0 276 999
signature:
  [[ordinal, ordinal, ordinal, [boolean -> ordinal], ordinal,
         ordinal] ->
          [exception -> ordinal]]

body:
  reduce_ordinal(invalid?_fun: ordinal, div_by_zero?_fun: ordinal,
                 overflow?_fun: ordinal, underflow?_fun: [bool -> ordinal],
                 inexact?_fun: ordinal, no_exceptions?_fun: ordinal):
        [exception -> ordinal] =
      LAMBDA (exception_adtvar: exception):
        LET red: [exception -> ordinal] =
              reduce_ordinal(invalid?_fun, div_by_zero?_fun, overflow?_fun,
                             underflow?_fun, inexact?_fun,
                             no_exceptions?_fun)
          IN
          CASES exception_adtvar
            OF invalid_operation: invalid?_fun,
               division_by_zero: div_by_zero?_fun,
               overflow: overflow?_fun,
               underflow(underflow1_var): underflow?_fun(underflow1_var),
               inexact: inexact?_fun,
               no_exceptions: no_exceptions?_fun
            ENDCASES;


decl_type: function
theory: enumerated_type_defs
library: float
location: 278 0 299 999
signature:
  [[[exception -> ordinal], [exception -> ordinal],
         [exception -> ordinal], [[boolean, exception] -> ordinal],
         [exception -> ordinal], [exception -> ordinal]] ->
          [exception -> ordinal]]

body:
  REDUCE_ordinal(invalid?_fun: [exception -> ordinal],
                 div_by_zero?_fun: [exception -> ordinal],
                 overflow?_fun: [exception -> ordinal],
                 underflow?_fun: [[bool, exception] -> ordinal],
                 inexact?_fun: [exception -> ordinal],
                 no_exceptions?_fun: [exception -> ordinal]):
        [exception -> ordinal] =
      LAMBDA (exception_adtvar: exception):
        LET red: [exception -> ordinal] =
              REDUCE_ordinal(invalid?_fun, div_by_zero?_fun, overflow?_fun,
                             underflow?_fun, inexact?_fun,
                             no_exceptions?_fun)
          IN
          CASES exception_adtvar
            OF invalid_operation: invalid?_fun(exception_adtvar),
               division_by_zero: div_by_zero?_fun(exception_adtvar),
               overflow: overflow?_fun(exception_adtvar),
               underflow(underflow1_var):
                 underflow?_fun(underflow1_var, exception_adtvar),
               inexact: inexact?_fun(exception_adtvar),
               no_exceptions: no_exceptions?_fun(exception_adtvar)
            ENDCASES;


decl_type: datatype
theory: enumerated_type_defs
library: float
signature: nil
location: 17 14 25 18
body:
     exception: DATATYPE
       BEGIN
         invalid_operation      : invalid?
         division_by_zero       : div_by_zero?
         overflow               : overflow?
         underflow(exact?:bool) : underflow?
         inexact                : inexact?
         no_exceptions          : no_exceptions?
       END exception


decl_type: tcc
theory: sum_hack
library: float
signature: nil
location: 48 0 50 999
body:
  % Subtype TCC generated (at line 17, column 24) for  j - 1
      % expected type  nat
  Sum_TCC1: OBLIGATION FORALL (j: nat): NOT j = 0 IMPLIES j - 1 >= 0;


decl_type: tcc
theory: sum_hack
library: float
signature: nil
location: 52 0 53 999
body:
  % Termination TCC generated (at line 17, column 29) for  Sum(j - 1, F)
  Sum_TCC2: OBLIGATION FORALL (j: nat): NOT j = 0 IMPLIES j - 1 < j;


decl_type: tcc
theory: sum_hack
library: float
signature: nil
location: 55 0 57 999
body:
  % Subtype TCC generated (at line 41, column 30) for  j - i
      % expected type  nat
  Sum_split_TCC1: OBLIGATION FORALL (j: nat, i: upto(j)): j - i >= 0;


decl_type: tcc
theory: sum_lemmas
library: float
signature: nil
location: 26 0 28 999
body:
  % Subtype TCC generated (at line 11, column 56) for  (-i - 1)
      % expected type  {i: int | b /= 0 OR i >= 0}
  mant_digit_fun_TCC1: OBLIGATION FORALL (i): b /= 0 OR (-i - 1) >= 0;


decl_type: tcc
theory: sum_lemmas
library: float
signature: nil
location: 30 0 34 999
body:
  % Subtype TCC generated (at line 16, column 36) for  (-i)
      % expected type  {i: int | b /= 0 OR i >= 0}
  Sum_pos_less_1_TCC1: OBLIGATION
    FORALL (d: mant_digit_fun, i: nat):
      0 <= Sum(i, d) IMPLIES b /= 0 OR (-i) >= 0;


decl_type: formula
theory: IEEE_854_values
library: float
signature: nil
location: 273 0 279 999
body:
  fp_num_ord_defaxiom: AXIOM
    (FORALL (sign: sign_rep, Exp: Exponent, d: digits):
       fp_num_ord(finite(sign, Exp, d)) = 0)
     AND
     (FORALL (i_sign: sign_rep): fp_num_ord(infinite(i_sign)) = 1) AND
      (FORALL (status: NaN_type, data: NaN_data):
         fp_num_ord(NaN(status, data)) = 2);


decl_type: formula
theory: IEEE_854_values
library: float
signature: nil
location: 281 0 286 999
body:
  fp_num_finite_extensionality: AXIOM
    FORALL (finite?_var: (finite?), finite?_var2: (finite?)):
      sign(finite?_var) = sign(finite?_var2) AND
       Exp(finite?_var) = Exp(finite?_var2) AND
        d(finite?_var) = d(finite?_var2)
       IMPLIES finite?_var = finite?_var2;


decl_type: formula
theory: IEEE_854_values
library: float
signature: nil
location: 288 0 291 999
body:
  fp_num_finite_eta: AXIOM
    FORALL (finite?_var: (finite?)):
      finite(sign(finite?_var), Exp(finite?_var), d(finite?_var)) =
       finite?_var;


decl_type: formula
theory: IEEE_854_values
library: float
signature: nil
location: 293 0 296 999
body:
  fp_num_infinite_extensionality: AXIOM
    FORALL (infinite?_var: (infinite?), infinite?_var2: (infinite?)):
      i_sign(infinite?_var) = i_sign(infinite?_var2) IMPLIES
       infinite?_var = infinite?_var2;


decl_type: formula
theory: IEEE_854_values
library: float
signature: nil
location: 298 0 300 999
body:
  fp_num_infinite_eta: AXIOM
    FORALL (infinite?_var: (infinite?)):
      infinite(i_sign(infinite?_var)) = infinite?_var;


decl_type: formula
theory: IEEE_854_values
library: float
signature: nil
location: 302 0 306 999
body:
  fp_num_NaN_extensionality: AXIOM
    FORALL (NaN?_var: (NaN?), NaN?_var2: (NaN?)):
      status(NaN?_var) = status(NaN?_var2) AND
       data(NaN?_var) = data(NaN?_var2)
       IMPLIES NaN?_var = NaN?_var2;


decl_type: formula
theory: IEEE_854_values
library: float
signature: nil
location: 308 0 310 999
body:
  fp_num_NaN_eta: AXIOM
    FORALL (NaN?_var: (NaN?)):
      NaN(status(NaN?_var), data(NaN?_var)) = NaN?_var;


decl_type: formula
theory: IEEE_854_values
library: float
signature: nil
location: 312 0 315 999
body:
  fp_num_sign_finite: AXIOM
    FORALL (finite1_var: sign_rep, finite2_var: Exponent,
            finite3_var: digits):
      sign(finite(finite1_var, finite2_var, finite3_var)) = finite1_var;


decl_type: formula
theory: IEEE_854_values
library: float
signature: nil
location: 317 0 320 999
body:
  fp_num_Exp_finite: AXIOM
    FORALL (finite1_var: sign_rep, finite2_var: Exponent,
            finite3_var: digits):
      Exp(finite(finite1_var, finite2_var, finite3_var)) = finite2_var;


decl_type: formula
theory: IEEE_854_values
library: float
signature: nil
location: 322 0 325 999
body:
  fp_num_d_finite: AXIOM
    FORALL (finite1_var: sign_rep, finite2_var: Exponent,
            finite3_var: digits):
      d(finite(finite1_var, finite2_var, finite3_var)) = finite3_var;


decl_type: formula
theory: IEEE_854_values
library: float
signature: nil
location: 327 0 329 999
body:
  fp_num_i_sign_infinite: AXIOM
    FORALL (infinite1_var: sign_rep):
      i_sign(infinite(infinite1_var)) = infinite1_var;


decl_type: formula
theory: IEEE_854_values
library: float
signature: nil
location: 331 0 333 999
body:
  fp_num_status_NaN: AXIOM
    FORALL (NaN1_var: NaN_type, NaN2_var: NaN_data):
      status(NaN(NaN1_var, NaN2_var)) = NaN1_var;


decl_type: formula
theory: IEEE_854_values
library: float
signature: nil
location: 335 0 337 999
body:
  fp_num_data_NaN: AXIOM
    FORALL (NaN1_var: NaN_type, NaN2_var: NaN_data):
      data(NaN(NaN1_var, NaN2_var)) = NaN2_var;


decl_type: formula
theory: IEEE_854_values
library: float
signature: nil
location: 339 0 341 999
body:
  fp_num_inclusive: AXIOM
    FORALL (fp_num_var: fp_num):
      finite?(fp_num_var) OR infinite?(fp_num_var) OR NaN?(fp_num_var);


decl_type: formula
theory: IEEE_854_values
library: float
signature: nil
location: 343 0 352 999
body:
  fp_num_induction: AXIOM
    FORALL (p: [fp_num -> boolean]):
      ((FORALL (finite1_var: sign_rep, finite2_var: Exponent,
                finite3_var: digits):
          p(finite(finite1_var, finite2_var, finite3_var)))
        AND
        (FORALL (infinite1_var: sign_rep): p(infinite(infinite1_var))) AND
         (FORALL (NaN1_var: NaN_type, NaN2_var: NaN_data):
            p(NaN(NaN1_var, NaN2_var))))
       IMPLIES (FORALL (fp_num_var: fp_num): p(fp_num_var));


decl_type: formula
theory: IEEE_854_values
library: float
signature: nil
location: 67 2 68 75
body:
    normalize_idempotent: FACT
          FORALL (fin: (finite?)): normalize(normalize(fin)) = normalize(fin)


decl_type: formula
theory: IEEE_854_values
library: float
signature: nil
location: 215 2 216 71
body:
    min_significand_min: lemma d/=d_zero => 
              Sum(p,value_digit(min_significand))<= Sum(p,value_digit(d))


decl_type: formula
theory: IEEE_854_values
library: float
signature: nil
location: 220 2 221 67
body:
    value_normal: lemma normal?(fin) => 
              b^E_min <= abs(value(fin)) & abs(value(fin)) <= max_pos


decl_type: formula
theory: IEEE_854_values
library: float
signature: nil
location: 223 2 224 66
body:
    value_subnormal: lemma subnormal?(fin) => 
              min_pos <= abs(value(fin)) & abs(value(fin)) < b^E_min 


decl_type: formula
theory: IEEE_854_values
library: float
signature: nil
location: 226 2 227 67
body:
    value_nonzero: lemma not zero?(fin) =>
              min_pos <= abs(value(fin)) & abs(value(fin)) <= max_pos


decl_type: formula
theory: IEEE_854_values
library: float
signature: nil
location: 235 4 236 62
body:
      scaled_Sum_int: lemma forall d,n:
         forall (m:upto(n+1)): integer?(Sum(m,scale_value(d,n)))


decl_type: formula
theory: IEEE_854_values
library: float
signature: nil
location: 248 4 250 38
body:
      floor_Sum: lemma 
          floor(Sum(p,value_digit(d)) * b^i) = 
               Sum(i+1,scale_value(d,i))


decl_type: function
theory: IEEE_854_values
library: float
signature: [fp_num -> upto(2)]
location: 384 0 389 999
body:
  ord(x: fp_num): [fp_num -> upto(2)] =
      CASES x
        OF finite(finite1_var, finite2_var, finite3_var): 0,
           infinite(infinite1_var): 1,
           NaN(NaN1_var, NaN2_var): 2
        ENDCASES


decl_type: function
theory: IEEE_854_values
library: float
location: 393 0 406 999
signature:
  [[[[sign_rep, Exponent, [below(p) -> below(b)]] -> nat],
         [sign_rep -> nat], [[NaN_type, NaN_data] -> nat]] ->
          [fp_num -> nat]]

body:
  reduce_nat(finite?_fun: [[sign_rep, Exponent, digits] -> nat],
             infinite?_fun: [sign_rep -> nat],
             NaN?_fun: [[NaN_type, NaN_data] -> nat]):
        [fp_num -> nat] =
      LAMBDA (fp_num_adtvar: fp_num):
        LET red: [fp_num -> nat] =
              reduce_nat(finite?_fun, infinite?_fun, NaN?_fun)
          IN
          CASES fp_num_adtvar
            OF finite(finite1_var, finite2_var, finite3_var):
                 finite?_fun(finite1_var, finite2_var, finite3_var),
               infinite(infinite1_var): infinite?_fun(infinite1_var),
               NaN(NaN1_var, NaN2_var): NaN?_fun(NaN1_var, NaN2_var)
            ENDCASES;


decl_type: function
theory: IEEE_854_values
library: float
location: 408 0 424 999
signature:
  [[[[sign_rep, Exponent, [below(p) -> below(b)], fp_num] -> nat],
         [[sign_rep, fp_num] -> nat],
         [[NaN_type, NaN_data, fp_num] -> nat]] ->
          [fp_num -> nat]]

body:
  REDUCE_nat(finite?_fun: [[sign_rep, Exponent, digits, fp_num] -> nat],
             infinite?_fun: [[sign_rep, fp_num] -> nat],
             NaN?_fun: [[NaN_type, NaN_data, fp_num] -> nat]):
        [fp_num -> nat] =
      LAMBDA (fp_num_adtvar: fp_num):
        LET red: [fp_num -> nat] =
              REDUCE_nat(finite?_fun, infinite?_fun, NaN?_fun)
          IN
          CASES fp_num_adtvar
            OF finite(finite1_var, finite2_var, finite3_var):
                 finite?_fun(finite1_var, finite2_var, finite3_var,
                             fp_num_adtvar),
               infinite(infinite1_var):
                 infinite?_fun(infinite1_var, fp_num_adtvar),
               NaN(NaN1_var, NaN2_var):
                 NaN?_fun(NaN1_var, NaN2_var, fp_num_adtvar)
            ENDCASES;


decl_type: function
theory: IEEE_854_values
library: float
location: 426 0 439 999
signature:
  [[[[sign_rep, Exponent, [below(p) -> below(b)]] -> ordinal],
         [sign_rep -> ordinal], [[NaN_type, NaN_data] -> ordinal]] ->
          [fp_num -> ordinal]]

body:
  reduce_ordinal(finite?_fun: [[sign_rep, Exponent, digits] -> ordinal],
                 infinite?_fun: [sign_rep -> ordinal],
                 NaN?_fun: [[NaN_type, NaN_data] -> ordinal]):
        [fp_num -> ordinal] =
      LAMBDA (fp_num_adtvar: fp_num):
        LET red: [fp_num -> ordinal] =
              reduce_ordinal(finite?_fun, infinite?_fun, NaN?_fun)
          IN
          CASES fp_num_adtvar
            OF finite(finite1_var, finite2_var, finite3_var):
                 finite?_fun(finite1_var, finite2_var, finite3_var),
               infinite(infinite1_var): infinite?_fun(infinite1_var),
               NaN(NaN1_var, NaN2_var): NaN?_fun(NaN1_var, NaN2_var)
            ENDCASES;


decl_type: function
theory: IEEE_854_values
library: float
location: 441 0 458 999
signature:
  [[[[sign_rep, Exponent, [below(p) -> below(b)], fp_num] ->
            ordinal],
         [[sign_rep, fp_num] -> ordinal],
         [[NaN_type, NaN_data, fp_num] -> ordinal]] ->
          [fp_num -> ordinal]]

body:
  REDUCE_ordinal(finite?_fun:
                   [[sign_rep, Exponent, digits, fp_num] -> ordinal],
                 infinite?_fun: [[sign_rep, fp_num] -> ordinal],
                 NaN?_fun: [[NaN_type, NaN_data, fp_num] -> ordinal]):
        [fp_num -> ordinal] =
      LAMBDA (fp_num_adtvar: fp_num):
        LET red: [fp_num -> ordinal] =
              REDUCE_ordinal(finite?_fun, infinite?_fun, NaN?_fun)
          IN
          CASES fp_num_adtvar
            OF finite(finite1_var, finite2_var, finite3_var):
                 finite?_fun(finite1_var, finite2_var, finite3_var,
                             fp_num_adtvar),
               infinite(infinite1_var):
                 infinite?_fun(infinite1_var, fp_num_adtvar),
               NaN(NaN1_var, NaN2_var):
                 NaN?_fun(NaN1_var, NaN2_var, fp_num_adtvar)
            ENDCASES;


decl_type: function
theory: IEEE_854_values
library: float
signature: [digits -> digits]
location: 54 2 55 67
body:
    shift_left((d: digits)): digits =
      LAMBDA (i: below(p)): IF (i + 1 = p) THEN 0 ELSE d(i + 1) ENDIF


decl_type: function
theory: IEEE_854_values
library: float
signature: [(finite?) -> (finite?)]
location: 59 2 65 50
body:
    normalize(fin:(finite?)): recursive (finite?) = 
       IF Exp(fin) = E_min or d(fin)(0) /= 0 then
          fin
       ELSE
          normalize(finite(sign(fin),Exp(fin)-1,shift_left(d(fin))))
       ENDIF
    measure lambda (fin:(finite?)): Exp(fin) - E_min


decl_type: function
theory: IEEE_854_values
library: float
signature: [fp_num -> bool]
location: 74 2 80 9
body:
    subnormal?(fp: fp_num): bool =
      IF finite?(fp)  THEN 
          not zero?(fp)
          & Exp(normalize(fp)) = E_min
          & d(normalize(fp))(0) = 0
      ELSE FALSE
      ENDIF


decl_type: function
theory: IEEE_854_values
library: float
signature: [fp_num -> fp_num]
location: 165 2 171 12
body:
    toggle_sign(fp): fp_num
      =
      cases fp of
        finite(s,e,d): finite(1-s,e,d),
        infinite(s): infinite(1-s),
        NaN(sig,data): fp
      endcases


decl_type: datatype
theory: IEEE_854_values
library: float
signature: nil
location: 31 10 36 13
body:
    fp_num: datatype
     begin
      finite(sign:sign_rep,Exp:Exponent,d:digits):finite?
      infinite(i_sign:sign_rep): infinite?
      NaN(status:NaN_type, data:NaN_data): NaN?
     end fp_num


decl_type: tcc
theory: IEEE_854_values
library: float
signature: nil
location: 462 0 465 999
body:
  % Subtype TCC generated (at line 45, column 25) for  (-n)
      % expected type  {i: int | b /= 0 OR i >= 0}
  value_digit_TCC1: OBLIGATION
    FORALL (d: digits, n: nat): n < p IMPLIES b /= 0 OR (-n) >= 0;


decl_type: tcc
theory: IEEE_854_values
library: float
signature: nil
location: 467 0 469 999
body:
  % Subtype TCC generated (at line 48, column 27) for  Exp(fin)
      % expected type  {i: int | b /= 0 OR i >= 0}
  value_TCC1: OBLIGATION FORALL (fin: (finite?)): b /= 0 OR Exp(fin) >= 0;


decl_type: tcc
theory: IEEE_854_values
library: float
signature: nil
location: 471 0 474 999
body:
  % Subtype TCC generated (at line 55, column 46) for  0
      % expected type  below(b)
  shift_left_TCC1: OBLIGATION
    FORALL ((d: digits), i: below(p)): (i + 1 = p) IMPLIES 0 < b;


decl_type: tcc
theory: IEEE_854_values
library: float
signature: nil
location: 476 0 479 999
body:
  % Subtype TCC generated (at line 55, column 55) for  i + 1
      % expected type  below(p)
  shift_left_TCC2: OBLIGATION
    FORALL ((d: digits), i: below(p)): NOT (i + 1 = p) IMPLIES i + 1 < p;


decl_type: tcc
theory: IEEE_854_values
library: float
signature: nil
location: 481 0 483 999
body:
  % Subtype TCC generated (at line 65, column 34) for  Exp(fin) - E_min
      % expected type  naturalnumber
  normalize_TCC1: OBLIGATION FORALL (fin: (finite?)): Exp(fin) - E_min >= 0;


decl_type: tcc
theory: IEEE_854_values
library: float
signature: nil
location: 485 0 488 999
body:
  % Subtype TCC generated (at line 60, column 35) for  0
      % expected type  below(p)
  normalize_TCC2: OBLIGATION
    FORALL (fin: (finite?)): NOT Exp(fin) = E_min IMPLIES 0 < p;


decl_type: tcc
theory: IEEE_854_values
library: float
signature: nil
location: 490 0 495 999
body:
  % Subtype TCC generated (at line 63, column 35) for  Exp(fin) - 1
      % expected type  Exponent
  normalize_TCC3: OBLIGATION
    FORALL (fin: (finite?)):
      NOT Exp(fin) = E_min AND NOT d(fin)(0) /= 0 IMPLIES
       E_min <= Exp(fin) - 1 & Exp(fin) - 1 <= E_max;


decl_type: tcc
theory: IEEE_854_values
library: float
signature: nil
location: 497 0 502 999
body:
  % Termination TCC generated (at line 63, column 8) for
      % normalize(finite(sign(fin), Exp(fin) - 1, shift_left(d(fin))))
  normalize_TCC4: OBLIGATION
    FORALL (fin: (finite?)):
      NOT Exp(fin) = E_min AND NOT d(fin)(0) /= 0 IMPLIES
       Exp(fin) - 1 - E_min < Exp(fin) - E_min;


decl_type: tcc
theory: IEEE_854_values
library: float
signature: nil
location: 504 0 509 999
body:
  % Subtype TCC generated (at line 78, column 27) for  0
      % expected type  below(p)
  subnormal?_TCC1: OBLIGATION
    FORALL (fp: fp_num):
      Exp(normalize(fp)) = E_min AND NOT zero?(fp) AND finite?(fp) IMPLIES
       0 < p;


decl_type: tcc
theory: IEEE_854_values
library: float
signature: nil
location: 511 0 513 999
body:
  % Subtype TCC generated (at line 86, column 41) for  0
      % expected type  below(p)
  normal?_TCC1: OBLIGATION FORALL ((fp: fp_num)): finite?(fp) IMPLIES 0 < p;


decl_type: tcc
theory: IEEE_854_values
library: float
signature: nil
location: 515 0 518 999
body:
  % Subtype TCC generated (at line 94, column 26) for  b - 1
      % expected type  below(b)
  max_significand_TCC1: OBLIGATION
    FORALL (i: below(p)): b - 1 >= 0 AND b - 1 < b;


decl_type: tcc
theory: IEEE_854_values
library: float
signature: nil
location: 520 0 523 999
body:
  % Subtype TCC generated (at line 96, column 45) for  0
      % expected type  below(b)
  min_significand_TCC1: OBLIGATION
    FORALL (i: below(p)): i < p - 1 IMPLIES 0 < b;


decl_type: tcc
theory: IEEE_854_values
library: float
signature: nil
location: 525 0 528 999
body:
  % Subtype TCC generated (at line 96, column 52) for  1
      % expected type  below(b)
  min_significand_TCC2: OBLIGATION
    FORALL (i: below(p)): NOT i < p - 1 IMPLIES 1 < b;


decl_type: tcc
theory: IEEE_854_values
library: float
signature: nil
location: 530 0 532 999
body:
  % Subtype TCC generated (at line 97, column 41) for  0
      % expected type  below(b)
  d_zero_TCC1: OBLIGATION FORALL (i: below(p)): 0 < b;


decl_type: tcc
theory: IEEE_854_values
library: float
signature: nil
location: 534 0 536 999
body:
  % Subtype TCC generated (at line 108, column 35) for  E_max
      % expected type  Exponent
  max_fp_pos_TCC1: OBLIGATION E_min <= E_max & E_max <= E_max;


decl_type: tcc
theory: IEEE_854_values
library: float
signature: nil
location: 538 0 540 999
body:
  % Subtype TCC generated (at line 109, column 35) for  E_min
      % expected type  Exponent
  min_fp_pos_TCC1: OBLIGATION E_min <= E_min & E_min <= E_max;


decl_type: tcc
theory: IEEE_854_values
library: float
signature: nil
location: 542 0 545 999
body:
  % Subtype TCC generated (at line 110, column 33) for
      % finite(pos, E_min, d_zero)
      % expected type  {fin | zero?(fin)}
  pos_zero_TCC1: OBLIGATION zero?(finite(pos, E_min, d_zero));


decl_type: tcc
theory: IEEE_854_values
library: float
signature: nil
location: 547 0 550 999
body:
  % Subtype TCC generated (at line 114, column 34) for
      % finite(neg, E_min, d_zero)
      % expected type  {fin | zero?(fin)}
  neg_zero_TCC1: OBLIGATION zero?(finite(neg, E_min, d_zero));


decl_type: tcc
theory: IEEE_854_values
library: float
signature: nil
location: 552 0 554 999
body:
  % Subtype TCC generated (at line 116, column 27) for  max_fp_pos
      % expected type  (finite?)
  max_pos_TCC1: OBLIGATION finite?(max_fp_pos);


decl_type: tcc
theory: IEEE_854_values
library: float
signature: nil
location: 556 0 558 999
body:
  % Subtype TCC generated (at line 116, column 21) for  value(max_fp_pos)
      % expected type  posreal
  max_pos_TCC2: OBLIGATION value(max_fp_pos) >= 0 AND value(max_fp_pos) > 0;


decl_type: tcc
theory: IEEE_854_values
library: float
signature: nil
location: 560 0 562 999
body:
  % Subtype TCC generated (at line 117, column 27) for  min_fp_pos
      % expected type  (finite?)
  min_pos_TCC1: OBLIGATION finite?(min_fp_pos);


decl_type: tcc
theory: IEEE_854_values
library: float
signature: nil
location: 564 0 566 999
body:
  % Subtype TCC generated (at line 117, column 21) for  value(min_fp_pos)
      % expected type  posreal
  min_pos_TCC2: OBLIGATION value(min_fp_pos) >= 0 AND value(min_fp_pos) > 0;


decl_type: tcc
theory: IEEE_854_values
library: float
signature: nil
location: 568 0 570 999
body:
  % Subtype TCC generated (at line 119, column 27) for  max_fp_neg
      % expected type  (finite?)
  max_neg_TCC1: OBLIGATION finite?(max_fp_neg);


decl_type: tcc
theory: IEEE_854_values
library: float
signature: nil
location: 572 0 574 999
body:
  % Subtype TCC generated (at line 119, column 21) for  value(max_fp_neg)
      % expected type  negreal
  max_neg_TCC2: OBLIGATION value(max_fp_neg) <= 0 AND value(max_fp_neg) < 0;


decl_type: tcc
theory: IEEE_854_values
library: float
signature: nil
location: 576 0 578 999
body:
  % Subtype TCC generated (at line 120, column 27) for  min_fp_neg
      % expected type  (finite?)
  min_neg_TCC1: OBLIGATION finite?(min_fp_neg);


decl_type: tcc
theory: IEEE_854_values
library: float
signature: nil
location: 580 0 582 999
body:
  % Subtype TCC generated (at line 120, column 21) for  value(min_fp_neg)
      % expected type  negreal
  min_neg_TCC2: OBLIGATION value(min_fp_neg) <= 0 AND value(min_fp_neg) < 0;


decl_type: tcc
theory: IEEE_854_values
library: float
signature: nil
location: 584 0 586 999
body:
  % Subtype TCC generated (at line 123, column 20) for  (E_max + 1)
      % expected type  {i: int | b /= 0 OR i >= 0}
  max_fp_correct_TCC1: OBLIGATION b /= 0 OR (E_max + 1) >= 0;


decl_type: tcc
theory: IEEE_854_values
library: float
signature: nil
location: 588 0 590 999
body:
  % Subtype TCC generated (at line 123, column 37) for  (E_max + 1 - p)
      % expected type  {i: int | b /= 0 OR i >= 0}
  max_fp_correct_TCC2: OBLIGATION b /= 0 OR (E_max + 1 - p) >= 0;


decl_type: tcc
theory: IEEE_854_values
library: float
signature: nil
location: 592 0 594 999
body:
  % Subtype TCC generated (at line 126, column 30) for  (E_min + 1 - p)
      % expected type  {i: int | b /= 0 OR i >= 0}
  min_fp_correct_TCC1: OBLIGATION b /= 0 OR (E_min + 1 - p) >= 0;


decl_type: tcc
theory: IEEE_854_values
library: float
signature: nil
location: 596 0 600 999
body:
  % Subtype TCC generated (at line 168, column 28) for  1 - s
      % expected type  sign_rep
  toggle_sign_TCC1: OBLIGATION
    FORALL (fp: fp_num, s: sign_rep, e: Exponent, d: digits):
      fp = finite(s, e, d) IMPLIES 1 - s >= 0 AND (1 - s = 0 OR 1 - s = 1);


decl_type: tcc
theory: IEEE_854_values
library: float
signature: nil
location: 602 0 606 999
body:
  % Subtype TCC generated (at line 169, column 28) for  1 - s
      % expected type  sign_rep
  toggle_sign_TCC2: OBLIGATION
    FORALL (fp: fp_num, s: sign_rep):
      fp = infinite(s) IMPLIES 1 - s >= 0 AND (1 - s = 0 OR 1 - s = 1);


decl_type: tcc
theory: IEEE_854_values
library: float
signature: nil
location: 608 0 611 999
body:
  % Subtype TCC generated (at line 177, column 28) for  toggle_sign(fin)
      % expected type  (finite?)
  value_toggle_TCC1: OBLIGATION
    FORALL (fin: (finite?)): finite?(toggle_sign(fin));


decl_type: tcc
theory: IEEE_854_values
library: float
signature: nil
location: 613 0 615 999
body:
  % Subtype TCC generated (at line 198, column 56) for  (-j)
      % expected type  {i: int | b /= 0 OR i >= 0}
  value_digit_le_TCC1: OBLIGATION FORALL (j: nat): b /= 0 OR (-j) >= 0;


decl_type: tcc
theory: IEEE_854_values
library: float
signature: nil
location: 617 0 619 999
body:
  % Subtype TCC generated (at line 202, column 21) for  0
      % expected type  below(p)
  Sum_d_lt1_TCC1: OBLIGATION 0 < p;


decl_type: tcc
theory: IEEE_854_values
library: float
signature: nil
location: 621 0 624 999
body:
  % Subtype TCC generated (at line 221, column 14) for  E_min
      % expected type  {i: int | b /= 0 OR i >= 0}
  value_normal_TCC1: OBLIGATION
    FORALL (fin: (finite?)): normal?(fin) IMPLIES b /= 0 OR E_min >= 0;


decl_type: tcc
theory: IEEE_854_values
library: float
signature: nil
location: 626 0 631 999
body:
  % Subtype TCC generated (at line 224, column 61) for  E_min
      % expected type  {i: int | b /= 0 OR i >= 0}
  value_subnormal_TCC1: OBLIGATION
    FORALL (fin: (finite?)):
      subnormal?(fin) AND min_pos <= abs(value(fin)) IMPLIES
       b /= 0 OR E_min >= 0;


decl_type: tcc
theory: IEEE_854_values
library: float
signature: nil
location: 633 0 635 999
body:
  % Subtype TCC generated (at line 233, column 61) for  m
      % expected type  {i: int | b /= 0 OR i >= 0}
  scale_value_TCC1: OBLIGATION FORALL (m: nat): b /= 0 OR m >= 0;


decl_type: tcc
theory: IEEE_854_values
library: float
signature: nil
location: 637 0 639 999
body:
  % Subtype TCC generated (at line 238, column 45) for  p - 1
      % expected type  nat
  scale_value_p_TCC1: OBLIGATION p - 1 >= 0;


decl_type: tcc
theory: IEEE_854_values
library: float
signature: nil
location: 641 0 648 999
body:
  % Subtype TCC generated (at line 238, column 31) for
      % scale_value(d, p - 1)(n)
      % expected type  nat
  scale_value_p_TCC2: OBLIGATION
    FORALL (d: digits, n: nat):
      rational_pred(scale_value(d, p - 1)(n)) AND
       integer_pred(scale_value(d, p - 1)(n)) AND
        scale_value(d, p - 1)(n) >= 0;


decl_type: tcc
theory: IEEE_854_values
library: float
signature: nil
location: 650 0 652 999
body:
  % Subtype TCC generated (at line 243, column 33) for  (i)
      % expected type  {i: int | b /= 0 OR i >= 0}
  scaled_Sum_i_TCC1: OBLIGATION FORALL (i: below(p)): b /= 0 OR i >= 0;


decl_type: tcc
theory: IEEE_854_values
library: float
signature: nil
location: 654 0 660 999
body:
  % Subtype TCC generated (at line 252, column 23) for
      % Sum(i + 1, scale_value(d, i))
      % expected type  int
  mod_Sum_TCC1: OBLIGATION
    FORALL (d: digits, i: below(p)):
      rational_pred(Sum(i + 1, scale_value(d, i))) AND
       integer_pred(Sum(i + 1, scale_value(d, i)));


decl_type: formula
theory: NaN_ops
library: float
signature: nil
location: 38 2 40 49
body:
    NaN_ops_correct: LEMMA
          NOT trap_enabled?(invalid_operation) & (NaN?(fp1) OR NaN?(fp2))
            => quiet?(status(fp_nan(op, fp1, fp2)))


decl_type: function
theory: NaN_ops
library: float
location: 26 2 26 74
body: fp_quiet(op,fp1,(fp2| NaN?(fp1) OR NaN?(fp2))):{nan| nan=fp1 or nan=fp2}
signature:
  [d:
          [fp_ops, fp1: fp_num[b, p, E_max, E_min],
           {fp2 | NaN?(fp1) OR NaN?(fp2)}] ->
          {nan | nan = d`2 OR nan = d`3}]


decl_type: function
theory: NaN_ops
library: float
location: 28 2 31 9
signature:
  [[fp_ops, fp1: fp_num[b, p, E_max, E_min],
         {fp2 | NaN?(fp1) OR NaN?(fp2)}] ->
          fp_num[b, p, E_max, E_min]]

body:
    fp_signal(op, fp1,(fp2| NaN?(fp1) OR NaN?(fp2))): fp_num =
      IF trap_enabled?(invalid_operation) THEN invalid
      ELSE fp_quiet(op, mk_quiet(fp1), mk_quiet(fp2))
      ENDIF


decl_type: function
theory: NaN_ops
library: float
location: 33 2 36 9
signature:
  [[fp_ops, fp1: fp_num[b, p, E_max, E_min],
         {fp2 | NaN?(fp1) OR NaN?(fp2)}] ->
          fp_num[b, p, E_max, E_min]]

body:
    fp_nan(op, fp1, (fp2| NaN?(fp1) OR NaN?(fp2))): fp_num =
      IF signal?(fp1) OR signal?(fp2) THEN fp_signal(op, fp1, fp2)
      ELSE fp_quiet(op, fp1, fp2)
      ENDIF


decl_type: function
theory: NaN_ops
library: float
location: 42 2 47 9
signature:
  [[fp_ops, fp1: fp_num[b, p, E_max, E_min],
         {fp2 | NaN?(fp1) OR NaN?(fp2)}] ->
          [fp_num[b, p, E_max, E_min], exception]]

body:
    fp_nan_x(op, fp1, (fp2| NaN?(fp1) OR NaN?(fp2))): [fp_num,exception] =
      IF signal?(fp1) OR signal?(fp2) THEN 
         (fp_signal(op, fp1, fp2),invalid_operation)
      ELSE 
         (fp_quiet(op, fp1, fp2), no_exceptions)
      ENDIF  


decl_type: function
theory: NaN_ops
library: float
signature: [(NaN?) -> fp_num[b, p, E_max, E_min]]
location: 50 2 55 9
body:
    NaN_sqrt(nan): fp_num =
      if signal?(status(nan)) 
          & trap_enabled?(invalid_operation) then
         invalid
      else NaN(quiet,data(nan))
      endif


decl_type: tcc
theory: NaN_ops
library: float
signature: nil
location: 64 0 76 999
body:
  % Existence TCC generated (at line 26, column 2) for
      % fp_quiet(op, fp1,
      %          (fp2: fp_num[b, p, E_max, E_min] | NaN?(fp1) OR NaN?(fp2))):
      %       {nan | nan = fp1 OR nan = fp2}
  fp_quiet_TCC1: OBLIGATION
    EXISTS (x:
              [d:
                 [fp_ops, fp1: fp_num[b, p, E_max, E_min],
                  {fp2 |
                           NaN?[b, p, E_max, E_min](fp1) OR
                            NaN?[b, p, E_max, E_min](fp2)}] ->
                 {nan | nan = d`2 OR nan = d`3}]):
      TRUE;


decl_type: tcc
theory: NaN_ops
library: float
signature: nil
location: 78 0 87 999
body:
  % Subtype TCC generated (at line 30, column 37) for  mk_quiet(fp2)
      % expected type  {fp2 | NaN?(mk_quiet(fp1)) OR NaN?(fp2)}
  fp_signal_TCC1: OBLIGATION
    FORALL (fp1: fp_num[b, p, E_max, E_min],
            (fp2: fp_num[b, p, E_max, E_min]
                 | NaN?[b, p, E_max, E_min](fp1) OR
                    NaN?[b, p, E_max, E_min](fp2))):
      NOT trap_enabled?(invalid_operation) IMPLIES
       NaN?[b, p, E_max, E_min](mk_quiet(fp1)) OR
        NaN?[b, p, E_max, E_min](mk_quiet(fp2));


decl_type: tcc
theory: NaN_ops
library: float
signature: nil
location: 89 0 94 999
body:
  % Subtype TCC generated (at line 40, column 27) for  fp_nan(op, fp1, fp2)
      % expected type  (NaN?)
  NaN_ops_correct_TCC1: OBLIGATION
    FORALL (fp1, fp2: fp_num[b, p, E_max, E_min], op: fp_ops):
      (NaN?(fp1) OR NaN?(fp2)) AND NOT trap_enabled?(invalid_operation)
       IMPLIES NaN?[b, p, E_max, E_min](fp_nan(op, fp1, fp2));


decl_type: formula
theory: infinity_arithmetic
library: float
signature: nil
location: 74 2 76 63
body:
    fp_sub_inf_def: lemma
     forall num1,(num2:{num|infinite?(num1) OR infinite?(num)}):
      fp_sub_inf(num1,num2) = fp_add_inf(num1,toggle_sign(num2));


decl_type: function
theory: infinity_arithmetic
library: float
location: 25 2 33 9
signature:
  [[num1: {fp | finite?(fp) OR infinite?(fp)},
         {num | infinite?(num1) OR infinite?(num)}] ->
          fp_num[b, p, E_max, E_min]]

body:
    fp_add_inf(num1, (num2: {num | infinite?(num1) OR infinite?(num)})): fp_num 
       =
      IF infinite?(num1) & infinite?(num2) THEN 
        IF (i_sign(num1) = i_sign(num2)) THEN num1
        ELSE invalid
        ENDIF
      ELSIF infinite?(num1) THEN num1
      ELSE num2
      ENDIF


decl_type: function
theory: infinity_arithmetic
library: float
location: 37 2 46 9
signature:
  [[num1: {fp | finite?(fp) OR infinite?(fp)},
         {num | infinite?(num1) OR infinite?(num)}] ->
          [fp_num[b, p, E_max, E_min], exception]]

body:
    fp_add_inf_x(num1, (num2: {num | infinite?(num1) OR infinite?(num)})): 
      [fp_num, exception]
       =
      IF infinite?(num1) & infinite?(num2) THEN 
        IF (i_sign(num1) = i_sign(num2)) THEN (num1,no_exceptions)
        ELSE (invalid,invalid_operation)
        ENDIF
      ELSIF infinite?(num1) THEN (num1,no_exceptions)
      ELSE (num2,no_exceptions)
      ENDIF


decl_type: function
theory: infinity_arithmetic
library: float
location: 50 2 58 9
signature:
  [[num1: {fp | finite?(fp) OR infinite?(fp)},
         {num | infinite?(num1) OR infinite?(num)}] ->
          fp_num[b, p, E_max, E_min]]

body:
    fp_sub_inf(num1, (num2: {num | infinite?(num1) OR infinite?(num)})): fp_num 
       =
      IF infinite?(num1) & infinite?(num2) THEN 
        IF (i_sign(num1) /= i_sign(num2)) THEN num1
        ELSE invalid
        ENDIF
      ELSIF infinite?(num1) THEN num1
      ELSE toggle_sign(num2)
      ENDIF


decl_type: function
theory: infinity_arithmetic
library: float
location: 62 2 71 9
signature:
  [[num1: {fp | finite?(fp) OR infinite?(fp)},
         {num | infinite?(num1) OR infinite?(num)}] ->
          [fp_num[b, p, E_max, E_min], exception]]

body:
    fp_sub_inf_x(num1, (num2: {num | infinite?(num1) OR infinite?(num)})): 
     [fp_num , exception]
       =
      IF infinite?(num1) & infinite?(num2) THEN 
        IF (i_sign(num1) /= i_sign(num2)) THEN (num1, no_exceptions)
        ELSE (invalid, invalid_operation)
        ENDIF
      ELSIF infinite?(num1) THEN (num1, no_exceptions)
      ELSE (toggle_sign(num2), no_exceptions)
      ENDIF


decl_type: function
theory: infinity_arithmetic
library: float
location: 85 2 96 9
signature:
  [[{fp | finite?(fp) OR infinite?(fp)},
         {fp | finite?(fp) OR infinite?(fp)}] ->
          sign_rep]

body:
    mult_sign(num1,num2):sign_rep =
      if infinite?(num1) then
         if infinite?(num2) then
            xor(i_sign(num1),i_sign(num2))
         else
            xor(i_sign(num1),sign(num2))
         endif
      elsif infinite?(num2) then
            xor(sign(num1),i_sign(num2))
      else
            xor(sign(num1),sign(num2))
      endif


decl_type: function
theory: infinity_arithmetic
library: float
location: 102 2 106 9
signature:
  [[num1: {fp | finite?(fp) OR infinite?(fp)},
         {num | infinite?(num1) OR infinite?(num)}] ->
          fp_num[b, p, E_max, E_min]]

body:
    fp_mul_inf(num1, (num2: {num | infinite?(num1) OR infinite?(num)})): fp_num 
       =
      If zero?(num1) or zero?(num2) then invalid
      else infinite(mult_sign(num1,num2))
      endif 


decl_type: function
theory: infinity_arithmetic
library: float
location: 110 2 115 9
signature:
[cell repeats an earlier one in this file: 133 characters]

body:
    fp_div_inf(num1, (num2: {num | infinite?(num1) OR infinite?(num)})): fp_num 
       =
      IF infinite?(num1) & infinite?(num2) THEN invalid
      ELSIF infinite?(num1) THEN infinite(mult_sign(num1,num2))
      ELSE finite(mult_sign(num1,num2),E_min,d_zero)
      ENDIF   


decl_type: tcc
theory: infinity_arithmetic
library: float
signature: nil
location: 127 0 140 999
body:
  % Subtype TCC generated (at line 76, column 44) for  toggle_sign(num2)
      % expected type  {num | infinite?(num1) OR infinite?(num)}
  fp_sub_inf_def_TCC1: OBLIGATION
    FORALL (num1,
            num2:
              {num |
                       infinite?[b, p, E_max, E_min](num1) OR
                        infinite?[b, p, E_max, E_min](num)}):
      (finite?[b, p, E_max, E_min](toggle_sign[b, p, E_max, E_min](num2)) OR
        infinite?[b, p, E_max, E_min](toggle_sign[b, p, E_max, E_min](num2)))
       AND
       (infinite?[b, p, E_max, E_min](num1) OR
         infinite?[b, p, E_max, E_min]
             (toggle_sign[b, p, E_max, E_min](num2)));


decl_type: tcc
theory: infinity_arithmetic
library: float
signature: nil
location: 142 0 154 999
body:
  % Subtype TCC generated (at line 90, column 32) for  num2
      % expected type  (finite?[b, p, E_max, E_min])
  mult_sign_TCC1: OBLIGATION
    FORALL (num1:
              {fp |
                       finite?[b, p, E_max, E_min](fp) OR
                        infinite?[b, p, E_max, E_min](fp)},
            num2:
              {fp |
                       finite?[b, p, E_max, E_min](fp) OR
                        infinite?[b, p, E_max, E_min](fp)}):
      NOT infinite?(num2) AND infinite?(num1) IMPLIES
       finite?[b, p, E_max, E_min](num2);


decl_type: tcc
theory: infinity_arithmetic
library: float
signature: nil
location: 156 0 168 999
body:
  % Subtype TCC generated (at line 93, column 19) for  num1
      % expected type  (finite?[b, p, E_max, E_min])
  mult_sign_TCC2: OBLIGATION
    FORALL (num1:
              {fp |
                       finite?[b, p, E_max, E_min](fp) OR
                        infinite?[b, p, E_max, E_min](fp)},
            num2:
              {fp |
                       finite?[b, p, E_max, E_min](fp) OR
                        infinite?[b, p, E_max, E_min](fp)}):
      infinite?(num2) AND NOT infinite?(num1) IMPLIES
       finite?[b, p, E_max, E_min](num1);


decl_type: tcc
theory: infinity_arithmetic
library: float
signature: nil
location: 170 0 182 999
body:
  % Subtype TCC generated (at line 95, column 19) for  num1
      % expected type  (finite?[b, p, E_max, E_min])
  mult_sign_TCC3: OBLIGATION
    FORALL (num1:
              {fp |
                       finite?[b, p, E_max, E_min](fp) OR
                        infinite?[b, p, E_max, E_min](fp)},
            num2:
              {fp |
                       finite?[b, p, E_max, E_min](fp) OR
                        infinite?[b, p, E_max, E_min](fp)}):
      NOT infinite?(num2) AND NOT infinite?(num1) IMPLIES
       finite?[b, p, E_max, E_min](num1);


decl_type: tcc
theory: infinity_arithmetic
library: float
signature: nil
location: 184 0 196 999
body:
  % Subtype TCC generated (at line 95, column 30) for  num2
      % expected type  (finite?[b, p, E_max, E_min])
  mult_sign_TCC4: OBLIGATION
    FORALL (num1:
              {fp |
                       finite?[b, p, E_max, E_min](fp) OR
                        infinite?[b, p, E_max, E_min](fp)},
            num2:
              {fp |
                       finite?[b, p, E_max, E_min](fp) OR
                        infinite?[b, p, E_max, E_min](fp)}):
      NOT infinite?(num2) AND NOT infinite?(num1) IMPLIES
       finite?[b, p, E_max, E_min](num2);


decl_type: tcc
theory: infinity_arithmetic
library: float
signature: nil
location: 198 0 210 999
body:
  % Subtype TCC generated (at line 114, column 37) for  E_min
      % expected type  Exponent[b, p, E_max, E_min]
  fp_div_inf_TCC1: OBLIGATION
    FORALL (num1:
              {fp |
                       finite?[b, p, E_max, E_min](fp) OR
                        infinite?[b, p, E_max, E_min](fp)},
            (num2:
               {num |
                        infinite?[b, p, E_max, E_min](num1) OR
                         infinite?[b, p, E_max, E_min](num)})):
      NOT infinite?(num1) AND NOT (infinite?(num1) & infinite?(num2)) IMPLIES
       E_min <= E_min & E_min <= E_max;


decl_type: formula
theory: comparison1
library: float
signature: nil
location: 97 0 100 999
body:
  comparison_code_ord_defaxiom: AXIOM
    comparison_code_ord(gt) = 0 AND
     comparison_code_ord(lt) = 1 AND
      comparison_code_ord(eq) = 2 AND comparison_code_ord(un) = 3;


decl_type: formula
theory: comparison1
library: float
signature: nil
location: 102 0 106 999
body:
  comparison_code_inclusive: AXIOM
    FORALL (comparison_code_var: comparison_code):
      gt?(comparison_code_var) OR
       lt?(comparison_code_var) OR
        eq?(comparison_code_var) OR un?(comparison_code_var);


decl_type: formula
theory: comparison1
library: float
signature: nil
location: 108 0 112 999
body:
  comparison_code_induction: AXIOM
    FORALL (p: [comparison_code -> boolean]):
      p(gt) AND p(lt) AND p(eq) AND p(un) IMPLIES
       (FORALL (comparison_code_var: comparison_code):
          p(comparison_code_var));


decl_type: formula
theory: comparison1
library: float
signature: nil
location: 43 2 45 48
body:
    posinf_ge: LEMMA
          gt?(fp_compare(infinite(pos), num))
            OR eq?(fp_compare(infinite(pos), num))


decl_type: function
theory: comparison1
library: float
signature: [{fp: fp_num | finite?(fp) OR infinite?(fp)} -> real]
location: 14 2 17 9
body:
    n_value(num): real =
      IF infinite?(num) THEN (-1) ^ i_sign(num) * b ^ (E_max + 1)
      ELSE value(num)
      ENDIF


decl_type: function
theory: comparison1
library: float
signature: [comparison_code -> upto(3)]
location: 129 0 130 999
body:
  ord(x: comparison_code): [comparison_code -> upto(3)] =
      CASES x OF gt: 0, lt: 1, eq: 2, un: 3 ENDCASES


decl_type: function
theory: comparison1
library: float
signature:
  [[fp_num[b, p, E_max, E_min], fp_num[b, p, E_max, E_min]] ->
  comparison_code]

location: 34 2 39 9
body:
    fp_compare((fp1, fp2: fp_num)): comparison_code =
      IF NaN?(fp1) OR NaN?(fp2) THEN un
      ELSIF n_value(fp1) > n_value(fp2) THEN gt
      ELSIF n_value(fp1) < n_value(fp2) THEN lt
      ELSE eq
      ENDIF


decl_type: tcc
theory: comparison1
library: float
signature: nil
location: 145 0 152 999
body:
  % Subtype TCC generated (at line 15, column 53) for  (E_max + 1)
      % expected type  {i: int | b /= 0 OR i >= 0}
  n_value_TCC1: OBLIGATION
    FORALL (num:
              {fp: fp_num[b, p, E_max, E_min] |
                       finite?[b, p, E_max, E_min](fp) OR
                        infinite?[b, p, E_max, E_min](fp)}):
      infinite?(num) IMPLIES b /= 0 OR (E_max + 1) >= 0;


decl_type: tcc
theory: comparison1
library: float
signature: nil
location: 154 0 161 999
body:
  % Subtype TCC generated (at line 16, column 15) for  num
      % expected type  (finite?[b, p, E_max, E_min])
  n_value_TCC2: OBLIGATION
    FORALL (num:
              {fp: fp_num[b, p, E_max, E_min] |
                       finite?[b, p, E_max, E_min](fp) OR
                        infinite?[b, p, E_max, E_min](fp)}):
      NOT infinite?(num) IMPLIES finite?[b, p, E_max, E_min](num);


decl_type: tcc
theory: comparison1
library: float
signature: nil
location: 163 0 168 999
body:
  % Subtype TCC generated (at line 36, column 18) for  fp1
      % expected type  {fp: fp_num | finite?(fp) OR infinite?(fp)}
  fp_compare_TCC1: OBLIGATION
    FORALL ((fp1, fp2: fp_num[b, p, E_max, E_min])):
      NOT NaN?(fp1) AND NOT NaN?(fp2) IMPLIES
       finite?[b, p, E_max, E_min](fp1) OR infinite?[b, p, E_max, E_min](fp1);


decl_type: tcc
theory: comparison1
library: float
signature: nil
location: 170 0 175 999
body:
  % Subtype TCC generated (at line 36, column 33) for  fp2
      % expected type  {fp: fp_num | finite?(fp) OR infinite?(fp)}
  fp_compare_TCC2: OBLIGATION
    FORALL ((fp1, fp2: fp_num[b, p, E_max, E_min])):
      NOT NaN?(fp1) AND NOT NaN?(fp2) IMPLIES
       finite?[b, p, E_max, E_min](fp2) OR infinite?[b, p, E_max, E_min](fp2);


decl_type: function
theory: round
library: float
signature: [real -> integer]
location: 51 2 56 9
body:
    round_to_even(r): integer =
      IF r - floor(r) < ceiling(r) - r THEN floor(r)
      ELSIF ceiling(r) - r < r - floor(r) THEN ceiling(r)
      ELSIF floor(r) = ceiling(r) THEN floor(r)
      ELSE 2 * floor(ceiling(r) / 2)
      ENDIF


decl_type: function
theory: round
library: float
signature: [[real, rounding_mode] -> integer]
location: 65 2 71 12
body:
    round(r,mode): integer =
      CASES mode of
        to_nearest: round_to_even(r),
        to_zero:    sgn(r) * floor(abs(r)),
        to_pos:     ceiling(r),
        to_neg:     floor(r)
      ENDCASES


decl_type: function
theory: fp_round_aux
library: float
signature: [[nzreal, rounding_mode] -> real]
location: 52 2 53 55
body:
    round_scaled(r:nzreal,mode:rounding_mode): real =
      b^(scale(abs(r)))*round( b^(-scale(abs(r)))*r,mode)


decl_type: tcc
theory: fp_round_aux
library: float
signature: nil
location: 76 0 78 999
body:
  % Subtype TCC generated (at line 16, column 31) for  i
      % expected type  {i: int | b /= 0 OR i >= 0}
  Exp_of_TCC1: OBLIGATION FORALL (i: int): b /= 0 OR i >= 0;


decl_type: tcc
theory: fp_round_aux
library: float
signature: nil
location: 80 0 83 999
body:
  % Subtype TCC generated (at line 16, column 46) for  (i + 1)
      % expected type  {i: int | b /= 0 OR i >= 0}
  Exp_of_TCC2: OBLIGATION
    FORALL (x: posreal, i: int): b ^ i <= x IMPLIES b /= 0 OR (i + 1) >= 0;


decl_type: tcc
theory: fp_round_aux
library: float
signature: nil
location: 85 0 89 999
body:
  % Existence TCC generated (at line 16, column 2) for
      % Exp_of(x: posreal): {i: int | b ^ i <= x & x < b ^ (i + 1)}
  Exp_of_TCC3: OBLIGATION
    EXISTS (x1: [x: posreal -> {i: int | b ^ i <= x & x < b ^ (1 + i)}]):
      TRUE;


decl_type: tcc
theory: fp_round_aux
library: float
signature: nil
location: 91 0 94 999
body:
  % Subtype TCC generated (at line 19, column 16) for  (-Exp_of(x))
      % expected type  {i: int | b /= 0 OR i >= 0}
  Exp_of_correct_TCC1: OBLIGATION
    FORALL (x: posreal): b /= 0 OR (-Exp_of(x)) >= 0;


decl_type: tcc
theory: fp_round_aux
library: float
signature: nil
location: 96 0 99 999
body:
  % Subtype TCC generated (at line 29, column 43) for  (-Exp_of(abs(z)))
      % expected type  {i: int | b /= 0 OR i >= 0}
  significand_TCC1: OBLIGATION
    FORALL (z: nzreal): b /= 0 OR (-Exp_of(abs(z))) >= 0;


decl_type: tcc
theory: fp_round_aux
library: float
signature: nil
location: 101 0 107 999
body:
  % Subtype TCC generated (at line 29, column 33) for
      % abs(z) * b ^ (-Exp_of(abs(z)))
      % expected type  norm_fp_range
  significand_TCC2: OBLIGATION
    FORALL (z: nzreal):
      1 <= abs(z) * b ^ (-Exp_of(abs(z))) &
       abs(z) * b ^ (-Exp_of(abs(z))) < b;


decl_type: tcc
theory: fp_round_aux
library: float
signature: nil
location: 109 0 111 999
body:
  % Subtype TCC generated (at line 32, column 18) for  E(z)
      % expected type  {i: int | b /= 0 OR i >= 0}
  real_components_TCC1: OBLIGATION FORALL (z: nzreal): b /= 0 OR E(z) >= 0;


decl_type: tcc
theory: fp_round_aux
library: float
signature: nil
location: 113 0 117 999
body:
  % Subtype TCC generated (at line 40, column 31) for  j
      % expected type  {i: int | b /= 0 OR i >= 0}
  Exp_of_unique_TCC1: OBLIGATION
    FORALL (i, j: integer, x: posreal):
      b ^ i <= x AND x < b ^ (i + 1) IMPLIES b /= 0 OR j >= 0;


decl_type: tcc
theory: fp_round_aux
library: float
signature: nil
location: 119 0 124 999
body:
  % Subtype TCC generated (at line 40, column 43) for  (j + 1)
      % expected type  {i: int | b /= 0 OR i >= 0}
  Exp_of_unique_TCC2: OBLIGATION
    FORALL (i, j: integer, x: posreal):
      b ^ i <= x AND x < b ^ (i + 1) AND b ^ j <= x IMPLIES
       b /= 0 OR (j + 1) >= 0;


decl_type: tcc
theory: fp_round_aux
library: float
signature: nil
location: 126 0 128 999
body:
  % Subtype TCC generated (at line 48, column 29) for  (i + p - 1)
      % expected type  {i: int | b /= 0 OR i >= 0}
  scale_TCC1: OBLIGATION FORALL (i: int): b /= 0 OR (i + p - 1) >= 0;


decl_type: tcc
theory: fp_round_aux
library: float
signature: nil
location: 130 0 134 999
body:
  % Subtype TCC generated (at line 48, column 48) for  (i + p)
      % expected type  {i: int | b /= 0 OR i >= 0}
  scale_TCC2: OBLIGATION
    FORALL (x: posreal, i: int):
      b ^ (i + p - 1) <= x IMPLIES b /= 0 OR (i + p) >= 0;


decl_type: tcc
theory: fp_round_aux
library: float
signature: nil
location: 136 0 141 999
body:
  % Subtype TCC generated (at line 48, column 56) for  Exp_of(x) - (p - 1)
      % expected type  {i: int | b ^ (i - 1 + p) <= x & x < b ^ (i + p)}
  scale_TCC3: OBLIGATION
    FORALL (x: posreal):
      b ^ (Exp_of(x) - (p - 1) - 1 + p) <= x &
       x < b ^ (Exp_of(x) - (p - 1) + p);


decl_type: tcc
theory: fp_round_aux
library: float
signature: nil
location: 143 0 145 999
body:
  % Subtype TCC generated (at line 50, column 26) for  (p - 1)
      % expected type  {i: int | b /= 0 OR i >= 0}
  scale_correct_TCC1: OBLIGATION b /= 0 OR (p - 1) >= 0;


decl_type: tcc
theory: fp_round_aux
library: float
signature: nil
location: 147 0 149 999
body:
  % Subtype TCC generated (at line 50, column 36) for  scale(x)
      % expected type  {i: int | b /= 0 OR i >= 0}
  scale_correct_TCC2: OBLIGATION FORALL (x: posreal): b /= 0 OR scale(x) >= 0;


decl_type: tcc
theory: fp_round_aux
library: float
signature: nil
location: 151 0 155 999
body:
  % Subtype TCC generated (at line 50, column 63) for  p
      % expected type  {i: int | b /= 0 OR i >= 0}
  scale_correct_TCC3: OBLIGATION
    FORALL (x: posreal):
      b ^ (p - 1) <= x / b ^ scale(x) IMPLIES b /= 0 OR p >= 0;


decl_type: tcc
theory: fp_round_aux
library: float
signature: nil
location: 157 0 160 999
body:
  % Subtype TCC generated (at line 53, column 7) for  (scale(abs(r)))
      % expected type  {i: int | b /= 0 OR i >= 0}
  round_scaled_TCC1: OBLIGATION
    FORALL (r: nzreal): b /= 0 OR (scale(abs(r))) >= 0;


decl_type: tcc
theory: fp_round_aux
library: float
signature: nil
location: 162 0 165 999
body:
  % Subtype TCC generated (at line 53, column 32) for  (-scale(abs(r)))
      % expected type  {i: int | b /= 0 OR i >= 0}
  round_scaled_TCC2: OBLIGATION
    FORALL (r: nzreal): b /= 0 OR (-scale(abs(r))) >= 0;


decl_type: tcc
theory: fp_round_aux
library: float
signature: nil
location: 167 0 170 999
body:
  % Subtype TCC generated (at line 60, column 41) for  (i - E1)
      % expected type  {i: int | b /= 0 OR i >= 0}
  truncate_TCC1: OBLIGATION
    FORALL (E1: integer, i: below(p)): b /= 0 OR (i - E1) >= 0;


decl_type: formula
theory: over_under
library: float
signature: nil
location: 74 2 75 58
body:
    round_under_value: lemma subnormal?(fin) =>
                   round_under(value(fin),mode) = value(fin)


decl_type: formula
theory: over_under
library: float
signature: nil
location: 79 2 81 66
body:
    round_under_error: LEMMA
          abs(r) < b ^ E_min
            => abs(r - round_under(r, mode)) < b ^ (E_min - (p - 1))


decl_type: formula
theory: over_under
library: float
signature: nil
location: 83 2 85 77
body:
    round_under_near: LEMMA
          abs(r) < b ^ E_min
            => abs(r - round_under(r, to_nearest)) <= b ^ (E_min - (p - 1)) / 2


decl_type: function
theory: over_under
library: float
signature: [[nzreal, real, rounding_mode] -> real]
location: 19 2 22 9
body:
    trap_over((r1:nzreal), (r2: real), (mode: rounding_mode)): real =
      IF trap_enabled?(overflow) THEN round_scaled(r1 * b ^ (-alpha), mode)
      ELSE r2
      ENDIF


decl_type: function
theory: over_under
library: float
signature:
  [[{r: nzreal | abs(r) > max_pos}, rounding_mode] ->
  [real, exception]]

location: 24 2 51 14
body:
    overflow((r: nzreal | abs(r) > max_pos), (mode: rounding_mode)):
        [real, exception] =
      CASES mode OF
        to_nearest:
            IF abs(r)
                  >= b ^ (E_max + 1)
                       - (1 / 2) * b ^ (E_max + 1 - p)
              THEN (trap_over(r, (sgn(r) * infinity), mode),overflow)
            ELSE (sgn(r) * max_pos, inexact)
            ENDIF,
        to_zero:
            IF abs(r) >= b ^ (E_max + 1)
              THEN (trap_over(r, (sgn(r) * max_pos), mode),overflow)
            ELSE (sgn(r) * max_pos, inexact)
            ENDIF,
        to_pos:
            IF r > max_pos THEN (trap_over(r, infinity, mode),overflow)
            ELSIF r <= -b ^ (E_max + 1)
              THEN (trap_over(r, max_neg, mode),overflow)
            ELSE (max_neg, inexact)
            ENDIF,
        to_neg:
            IF r < max_neg THEN (trap_over(r, -infinity, mode),overflow)
            ELSIF r >= b ^ (E_max + 1)
              THEN (trap_over(r, max_pos, mode),overflow)
            ELSE (max_pos, inexact)
            ENDIF
        ENDCASES


decl_type: function
theory: over_under
library: float
signature: [[{r: nzreal | abs(r) < b ^ E_min}, rounding_mode] -> bool]
location: 57 2 58 47
body:
    exact_underflow((r:nzreal|abs(r)<b^E_min),mode:rounding_mode):bool =
         (r*b^alpha=round_scaled(r*b^alpha,mode))


decl_type: function
theory: over_under
library: float
signature: [[{r: nzreal | abs(r) < b ^ E_min}, rounding_mode] -> bool]
location: 61 2 62 76
body:
    tiny?((r: nzreal | abs(r) < b ^ E_min), (mode: rounding_mode)): bool =
      IF tiny_flag THEN abs(round_scaled(r, mode)) < b ^ E_min ELSE TRUE ENDIF


decl_type: function
theory: over_under
library: float
signature: [[{r: nzreal | abs(r) < b ^ E_min}, rounding_mode] -> real]
location: 64 2 65 62
body:
    round_under((r: nzreal | abs(r) < b ^ E_min), (mode: rounding_mode)): real
      = b^(E_min - (p - 1))*round(b^(-(E_min - (p - 1)))*r,mode)


decl_type: function
theory: over_under
library: float
signature: [[{r: nzreal | abs(r) < b ^ E_min}, rounding_mode] -> bool]
location: 94 2 97 9
body:
    inaccurate?((r: nzreal | abs(r) < b ^ E_min), (mode: rounding_mode)): bool =
      IF inaccurate_flag THEN (round_scaled(r,mode)/=round_under(r,mode))
      ELSE (r/=round_under(r,mode))
      ENDIF


decl_type: function
theory: over_under
library: float
signature:
  [[{r: nzreal | abs(r) < b ^ E_min}, rounding_mode] ->
  [real, exception]]

location: 99 2 112 9
body:
    underflow((r: nzreal | abs(r) < b ^ E_min), (mode: rounding_mode)):
        [real, exception] =
      IF tiny?(r, mode)
        THEN IF trap_enabled?(underflow(FALSE))
          THEN (round_scaled(r * b ^ alpha, mode),
                underflow(exact_underflow(r, mode)))
        ELSIF inaccurate?(r, mode) THEN (round_under(r, mode), underflow(TRUE))
        ELSE (round_under(r, mode),
              IF r = round_under(r, mode) THEN no_exceptions
              ELSE inexact
              ENDIF)
        ENDIF
      ELSE (round_under(r, mode), inexact)
      ENDIF


decl_type: tcc
theory: over_under
library: float
signature: nil
location: 120 0 124 999
body:
  % Subtype TCC generated (at line 14, column 66) for  E_min
      % expected type  {i: int | b /= 0 OR i >= 0}
  over_under?_TCC1: OBLIGATION
    FORALL (r: real):
      NOT abs(r) > max_pos AND r /= 0 IMPLIES b /= 0 OR E_min >= 0;


decl_type: tcc
theory: over_under
library: float
signature: nil
location: 126 0 128 999
body:
  % Subtype TCC generated (at line 17, column 22) for  (E_max + 1)
      % expected type  {i: int | b /= 0 OR i >= 0}
  infinity_TCC1: OBLIGATION b /= 0 OR (E_max + 1) >= 0;


decl_type: tcc
theory: over_under
library: float
signature: nil
location: 130 0 133 999
body:
  % Subtype TCC generated (at line 20, column 59) for  (-alpha)
      % expected type  {i: int | b /= 0 OR i >= 0}
  trap_over_TCC1: OBLIGATION
    trap_enabled?(overflow) IMPLIES b /= 0 OR (-alpha) >= 0;


decl_type: tcc
theory: over_under
library: float
signature: nil
location: 135 0 140 999
body:
  % Subtype TCC generated (at line 30, column 38) for  (E_max + 1 - p)
      % expected type  {i: int | b /= 0 OR i >= 0}
  overflow_TCC1: OBLIGATION
    FORALL ((r: nzreal | abs(r) > max_pos[b, p, E_max, E_min]),
            (mode: rounding_mode)):
      mode = to_nearest IMPLIES b /= 0 OR (E_max + 1 - p) >= 0;


decl_type: tcc
theory: over_under
library: float
signature: nil
location: 142 0 144 999
body:
  % Subtype TCC generated (at line 57, column 37) for  E_min
      % expected type  {i: int | b /= 0 OR i >= 0}
  exact_underflow_TCC1: OBLIGATION b /= 0 OR E_min >= 0;


decl_type: tcc
theory: over_under
library: float
signature: nil
location: 146 0 149 999
body:
  % Subtype TCC generated (at line 58, column 12) for  alpha
      % expected type  {i: int | b /= 0 OR i >= 0}
  exact_underflow_TCC2: OBLIGATION
    FORALL ((r: nzreal | abs(r) < b ^ E_min)): b /= 0 OR alpha >= 0;


decl_type: tcc
theory: over_under
library: float
signature: nil
location: 151 0 155 999
body:
  % Subtype TCC generated (at line 65, column 9) for  (E_min - (p - 1))
      % expected type  {i: int | b /= 0 OR i >= 0}
  round_under_TCC1: OBLIGATION
    FORALL ((r: nzreal | abs(r) < b ^ E_min)):
      b /= 0 OR (E_min - (p - 1)) >= 0;


decl_type: tcc
theory: over_under
library: float
signature: nil
location: 157 0 161 999
body:
  % Subtype TCC generated (at line 65, column 35) for  (-(E_min - (p - 1)))
      % expected type  {i: int | b /= 0 OR i >= 0}
  round_under_TCC2: OBLIGATION
    FORALL ((r: nzreal | abs(r) < b ^ E_min)):
      b /= 0 OR (-(E_min - (p - 1))) >= 0;


decl_type: tcc
theory: over_under
library: float
signature: nil
location: 163 0 166 999
body:
  % Subtype TCC generated (at line 70, column 20) for  min_pos
      % expected type  {r: nzreal | abs(r) < b ^ E_min}
  round_under_correct_TCC1: OBLIGATION
    abs(min_pos[b, p, E_max, E_min]) < b ^ E_min;


decl_type: tcc
theory: over_under
library: float
signature: nil
location: 168 0 174 999
body:
  % Subtype TCC generated (at line 75, column 29) for  value(fin)
      % expected type  {r: nzreal | abs(r) < b ^ E_min}
  round_under_value_TCC1: OBLIGATION
    FORALL (fin: (finite?)):
      subnormal?(fin) IMPLIES
       value[b, p, E_max, E_min](fin) /= 0 AND
        abs(value[b, p, E_max, E_min](fin)) < b ^ E_min;


decl_type: tcc
theory: over_under
library: float
signature: nil
location: 176 0 180 999
body:
  % Subtype TCC generated (at line 81, column 50) for  (E_min - (p - 1))
      % expected type  {i: int | b /= 0 OR i >= 0}
  round_under_error_TCC1: OBLIGATION
    FORALL (r: nzreal):
      abs(r) < b ^ E_min IMPLIES b /= 0 OR (E_min - (p - 1)) >= 0;


decl_type: formula
theory: real_to_fp
library: float
signature: nil
location: 42 2 44 58
body:
    Exp_of_value_normal: LEMMA
           normal?(fin)
            => Exp_of(abs(value(fin))) = Exp(normalize(fin))


decl_type: formula
theory: real_to_fp
library: float
signature: nil
location: 46 2 48 52
body:
    real_to_fp_normal: LEMMA 
                  normal?(fin) 
            => real_to_fp(value(fin)) = normalize(fin)


decl_type: formula
theory: real_to_fp
library: float
signature: nil
location: 50 2 52 52
body:
    real_to_fp_subnormal: LEMMA 
          subnormal?(fin) 
            => real_to_fp(value(fin)) = normalize(fin)


decl_type: formula
theory: real_to_fp
library: float
signature: nil
location: 83 2 84 55
body:
    round_value: lemma not over_under?(value(fin)) =>
                   fp_round(value(fin),mode) = value(fin)


decl_type: formula
theory: real_to_fp
library: float
signature: nil
location: 86 2 87 55
body:
    round_value2: lemma not trap_enabled?(underflow(FALSE)) =>
                   fp_round(value(fin),mode) = value(fin)


decl_type: formula
theory: real_to_fp
library: float
signature: nil
location: 91 2 93 71
body:
    round_value3: lemma not trap_enabled?(underflow(FALSE)) =>
                   not zero?(fin) =>
                   real_to_fp(fp_round(value(fin),mode)) = normalize(fin)


decl_type: formula
theory: real_to_fp
library: float
signature: nil
location: 95 2 96 63
body:
    round_error: lemma r/=0 & not over_under?(r)
              => abs(r-fp_round(r,mode))<b^(Exp_of(abs(r))-(p-1))


decl_type: formula
theory: real_to_fp
library: float
signature: nil
location: 98 2 101 52
body:
    round_near: LEMMA
          r /= 0 & not over_under?(r)
            => abs(r - fp_round(r, to_nearest))
                 <= b ^ (Exp_of(abs(r)) - (p - 1)) / 2


decl_type: function
theory: real_to_fp
library: float
signature: [real -> fp_num[b, p, E_max, E_min]]
location: 27 2 34 9
body:
    real_to_fp(r): fp_num =
      IF abs(r) >= b^(E_max+1) THEN 
         infinite(sign_of(r))
      ELSIF abs(r) < b^E_min THEN 
         finite(sign_of(r), E_min, truncate(E_min, abs(r)))
      ELSE 
         finite(sign_of(r), Exp_of(abs(r)), truncate(Exp_of(abs(r)), abs(r)))
      ENDIF    


decl_type: function
theory: real_to_fp
library: float
signature: [[(over_under?), rounding_mode] -> [real, exception]]
location: 57 2 61 12
body:
    round_exceptions_x(x:(over_under?),mode:rounding_mode): [real,exception] =
      IF abs(x)>max_pos THEN 
              overflow(x,mode)
         ELSE underflow(x,mode)
         ENDIF


decl_type: function
theory: real_to_fp
library: float
signature: [[real, rounding_mode] -> real]
location: 66 2 71 9
body:
    fp_round(r, mode): real =
      IF r = 0 THEN 0
      ELSIF over_under?(r) then
        round_exceptions(r,mode)
      ELSE round_scaled(r,mode)
      ENDIF


decl_type: function
theory: real_to_fp
library: float
signature: [[nzreal, rounding_mode] -> exception]
location: 73 2 74 69
body:
    is_exact?(r:nzreal,mode):exception =
      IF round_scaled(r,mode) = r then no_exceptions ELSE inexact ENDIF


decl_type: function
theory: real_to_fp
library: float
signature: [[real, rounding_mode] -> [real, exception]]
location: 76 2 81 9
body:
    fp_round_x(r, mode): [real,exception] =
      IF r = 0 THEN (0,no_exceptions)
      ELSIF over_under?(r) then
        round_exceptions_x(r,mode)
      ELSE (round_scaled(r,mode),is_exact?(r,mode))
      ENDIF


decl_type: tcc
theory: real_to_fp
library: float
signature: nil
location: 116 0 118 999
body:
  % Subtype TCC generated (at line 28, column 20) for  (E_max + 1)
      % expected type  {i: int | b /= 0 OR i >= 0}
  real_to_fp_TCC1: OBLIGATION b /= 0 OR (E_max + 1) >= 0;


decl_type: tcc
theory: real_to_fp
library: float
signature: nil
location: 120 0 124 999
body:
  % Subtype TCC generated (at line 30, column 21) for  E_min
      % expected type  {i: int | b /= 0 OR i >= 0}
  real_to_fp_TCC2: OBLIGATION
    FORALL (r: real):
      NOT abs(r) >= b ^ (E_max + 1) IMPLIES b /= 0 OR E_min >= 0;


decl_type: tcc
theory: real_to_fp
library: float
signature: nil
location: 126 0 131 999
body:
  % Subtype TCC generated (at line 31, column 26) for  E_min
      % expected type  Exponent[b, p, E_max, E_min]
  real_to_fp_TCC3: OBLIGATION
    FORALL (r: real):
      abs(r) < b ^ E_min AND NOT abs(r) >= b ^ (E_max + 1) IMPLIES
       E_min <= E_min & E_min <= E_max;


decl_type: tcc
theory: real_to_fp
library: float
signature: nil
location: 133 0 138 999
body:
  % Subtype TCC generated (at line 33, column 33) for  abs(r)
      % expected type  x: posreal
  real_to_fp_TCC4: OBLIGATION
    FORALL (r: real):
      NOT abs(r) < b ^ E_min AND NOT abs(r) >= b ^ (E_max + 1) IMPLIES
       abs(r) > 0;


decl_type: tcc
theory: real_to_fp
library: float
signature: nil
location: 140 0 145 999
body:
  % Subtype TCC generated (at line 33, column 26) for  Exp_of(abs(r))
      % expected type  Exponent[b, p, E_max, E_min]
  real_to_fp_TCC5: OBLIGATION
    FORALL (r: real):
      NOT abs(r) < b ^ E_min AND NOT abs(r) >= b ^ (E_max + 1) IMPLIES
       E_min <= Exp_of[b, p](abs(r)) & Exp_of[b, p](abs(r)) <= E_max;


decl_type: tcc
theory: real_to_fp
library: float
signature: nil
location: 147 0 151 999
body:
  % Subtype TCC generated (at line 44, column 20) for  abs(value(fin))
      % expected type  x: posreal
  Exp_of_value_normal_TCC1: OBLIGATION
    FORALL (fin: (finite?)):
      normal?(fin) IMPLIES abs(value[b, p, E_max, E_min](fin)) > 0;


decl_type: tcc
theory: real_to_fp
library: float
signature: nil
location: 153 0 157 999
body:
  % Subtype TCC generated (at line 59, column 21) for  x
      % expected type  {r: nzreal | abs(r) > max_pos}
  round_exceptions_x_TCC1: OBLIGATION
    FORALL (x: (over_under?[b, p, alpha, E_max, E_min])):
      abs(x) > max_pos IMPLIES x /= 0;


decl_type: tcc
theory: real_to_fp
library: float
signature: nil
location: 159 0 163 999
body:
  % Subtype TCC generated (at line 60, column 22) for  x
      % expected type  {r: nzreal | abs(r) < b ^ E_min}
  round_exceptions_x_TCC2: OBLIGATION
    FORALL (x: (over_under?[b, p, alpha, E_max, E_min])):
      NOT abs(x) > max_pos IMPLIES x /= 0 AND abs(x) < b ^ E_min;


decl_type: tcc
theory: real_to_fp
library: float
signature: nil
location: 165 0 168 999
body:
  % Subtype TCC generated (at line 70, column 22) for  r
      % expected type  nzreal
  fp_round_TCC1: OBLIGATION
    FORALL (r: real): NOT over_under?(r) AND NOT r = 0 IMPLIES r /= 0;


decl_type: tcc
theory: real_to_fp
library: float
signature: nil
location: 170 0 173 999
body:
  % Subtype TCC generated (at line 96, column 49) for  abs(r)
      % expected type  x: posreal
  round_error_TCC1: OBLIGATION
    FORALL (r: real): NOT over_under?(r) AND r /= 0 IMPLIES abs(r) > 0;


decl_type: tcc
theory: real_to_fp
library: float
signature: nil
location: 175 0 181 999
body:
  % Subtype TCC generated (at line 96, column 42) for
      % (Exp_of(abs(r)) - (p - 1))
      % expected type  {i: int | b /= 0 OR i >= 0}
  round_error_TCC2: OBLIGATION
    FORALL (r: real):
      NOT over_under?(r) AND r /= 0 IMPLIES
       b /= 0 OR (Exp_of[b, p](abs(r)) - (p - 1)) >= 0;


decl_type: function
theory: arithmetic_ops
library: float
signature:
  [[op: fp_ops, (finite?), {fin | div?(op) => NOT zero?(fin)}] ->
  real]

location: 20 2 26 12
body:
    apply(op,fin1,(fin2:{fin| div?(op) => not zero?(fin)})): real =
      cases op of
        add:  value(fin1) + value(fin2),
        sub:  value(fin1) - value(fin2),
        mult: value(fin1) * value(fin2),
        div:  value(fin1) / value(fin2)
      endcases


decl_type: function
theory: arithmetic_ops
library: float
signature:
  [[fp_ops, (finite?), (finite?), rounding_mode] ->
  {fin | zero?(fin)}]

location: 28 2 50 14
body:
    signed_zero(op, fin1, fin2, mode): {fin | zero?(fin)} =
      CASES op OF
        add:
            IF zero?(fin1)
                  & zero?(fin2) & sign(fin1) = sign(fin2) THEN fin1
            ELSIF to_neg?(mode) THEN neg_zero
            ELSE pos_zero
            ENDIF,
        sub:
            IF zero?(fin1)
                  & zero?(fin2) & sign(fin1) /= sign(fin2) THEN fin1
            ELSIF to_neg?(mode) THEN neg_zero
            ELSE pos_zero
            ENDIF,
        mult:
            IF sign(fin1) = sign(fin2) THEN pos_zero
            ELSE neg_zero
            ENDIF,
        div:
            IF sign(fin1) = sign(fin2) THEN pos_zero
            ELSE neg_zero
            ENDIF
        ENDCASES  


decl_type: function
theory: arithmetic_ops
library: float
location: 52 2 56 13
signature:
  [[op: fp_ops, (finite?), {fin | div?(op) => NOT zero?(fin)},
         rounding_mode] ->
          fp_num[b, p, E_max, E_min]]

body:
    fp_op(op, fin1, (fin2: {fin | div?(op) => NOT zero?(fin)}), mode): fp_num =
      LET r = fp_round(apply(op, fin1, fin2), mode)
        IN IF r = 0 THEN signed_zero(op, fin1, fin2, mode)
          ELSE real_to_fp(r)
          ENDIF


decl_type: function
theory: arithmetic_ops
library: float
location: 58 2 64 13
signature:
  [[op: fp_ops, (finite?), {fin | div?(op) => NOT zero?(fin)},
         rounding_mode] ->
          [fp_num[b, p, E_max, E_min], exception]]

body:
    fp_op_x(op,fin1,(fin2:{fin| div?(op) => not zero?(fin)}),mode): 
      [fp_num, exception]
             = 
      LET rp = fp_round_x(apply(op, fin1, fin2), mode)
        IN IF proj_1(rp) = 0 THEN (signed_zero(op, fin1, fin2, mode),proj_2(rp))
          ELSE real_to_fp_x(rp)
          ENDIF


decl_type: tcc
theory: arithmetic_ops
library: float
signature: nil
location: 75 0 80 999
body:
  % Subtype TCC generated (at line 25, column 26) for  value(fin2)
      % expected type  nznum
  apply_TCC1: OBLIGATION
    FORALL (op: fp_ops, fin1: (finite?[b, p, E_max, E_min]),
            (fin2: {fin | div?(op) => NOT zero?[b, p, E_max, E_min](fin)})):
      op = div IMPLIES value[b, p, E_max, E_min](fin2) /= 0;


decl_type: function
theory: IEEE_854_remainder
library: float
signature:
  [[(finite?), {fin | NOT zero?(fin)}] ->
  fp_num[b, p, E_max, E_min]]

location: 14 2 20 10
body:
    REM(fin1, (fin2:{fin|not zero?(fin)})): fp_num =
       let x = value(fin1),
           y = value(fin2) in
       if (x - y * round_to_even(x/y)) = 0
          then finite(sign(fin1),E_min,d_zero)
          else real_to_fp(x - y * round_to_even(x/y))
       endif


decl_type: tcc
theory: IEEE_854_remainder
library: float
signature: nil
location: 27 0 33 999
body:
  % Subtype TCC generated (at line 17, column 33) for  y
      % expected type  nznum
  REM_TCC1: OBLIGATION
    FORALL (fin1: (finite?[b, p, E_max, E_min]),
            (fin2: {fin | NOT zero?[b, p, E_max, E_min](fin)}), x: real):
      x = value(fin1) IMPLIES
       (FORALL (y: real): y = value(fin2) IMPLIES y /= 0);


decl_type: tcc
theory: IEEE_854_remainder
library: float
signature: nil
location: 35 0 43 999
body:
  % Subtype TCC generated (at line 18, column 31) for  E_min
      % expected type  Exponent[b, p, E_max, E_min]
  REM_TCC2: OBLIGATION
    FORALL (fin1: (finite?[b, p, E_max, E_min]),
            (fin2: {fin | NOT zero?[b, p, E_max, E_min](fin)}), x: real):
      x = value(fin1) IMPLIES
       (FORALL (y: real):
          (x - y * round_to_even(x / y)) = 0 AND y = value(fin2) IMPLIES
           E_min <= E_min & E_min <= E_max);


decl_type: formula
theory: IEEE_854_defs
library: float
signature: nil
location: 62 2 64 73
body:
    fsub_alt_def: LEMMA
          NOT (NaN?(fp1) OR NaN?(fp2))
            => fp_sub(fp1, fp2, mode) = fp_add(fp1, toggle_sign(fp2), mode)


decl_type: function
theory: IEEE_854_defs
library: float
location: 27 2 32 9
signature:
  [[fp_num[b, p, E_max, E_min], fp_num[b, p, E_max, E_min],
         rounding_mode] ->
          fp_num[b, p, E_max, E_min]]

body:
    fp_add(fp1, fp2, mode): fp_num =
      IF finite?(fp1) & finite?(fp2)
        THEN fp_op(add, fp1, fp2, mode)
      ELSIF NaN?(fp1) OR NaN?(fp2) THEN fp_nan(add, fp1, fp2)
      ELSE fp_add_inf(fp1, fp2)
      ENDIF


decl_type: function
theory: IEEE_854_defs
library: float
location: 35 2 40 9
signature:
  [[fp_num[b, p, E_max, E_min], fp_num[b, p, E_max, E_min],
         rounding_mode] ->
          [fp_num[b, p, E_max, E_min], exception]]

body:
    fp_add_x(fp1, fp2, mode): [fp_num, exception] =
      IF finite?(fp1) & finite?(fp2)
        THEN fp_op_x(add, fp1, fp2, mode)
      ELSIF NaN?(fp1) OR NaN?(fp2) THEN fp_nan_x(add, fp1, fp2)
      ELSE fp_add_inf_x(fp1, fp2)
      ENDIF


decl_type: function
theory: IEEE_854_defs
library: float
location: 45 2 50 9
signature:
  [[fp_num[b, p, E_max, E_min], fp_num[b, p, E_max, E_min],
         rounding_mode] ->
          fp_num[b, p, E_max, E_min]]

body:
    fp_sub(fp1, fp2, mode): fp_num =
      IF finite?(fp1) & finite?(fp2)
        THEN fp_op(sub, fp1, fp2, mode)
      ELSIF NaN?(fp1) OR NaN?(fp2) THEN fp_nan(sub, fp1, fp2)
      ELSE fp_sub_inf(fp1, fp2)
      ENDIF


decl_type: function
theory: IEEE_854_defs
library: float
location: 53 2 58 9
signature:
  [[fp_num[b, p, E_max, E_min], fp_num[b, p, E_max, E_min],
         rounding_mode] ->
          [fp_num[b, p, E_max, E_min], exception]]

body:
    fp_sub_x(fp1, fp2, mode): [fp_num, exception] =
      IF finite?(fp1) & finite?(fp2)
        THEN fp_op_x(sub, fp1, fp2, mode)
      ELSIF NaN?(fp1) OR NaN?(fp2) THEN fp_nan_x(sub, fp1, fp2)
      ELSE fp_sub_inf_x(fp1, fp2)
      ENDIF


decl_type: function
theory: IEEE_854_defs
library: float
location: 67 2 72 9
signature:
  [[fp_num[b, p, E_max, E_min], fp_num[b, p, E_max, E_min],
         rounding_mode] ->
          fp_num[b, p, E_max, E_min]]

body:
    fp_mul(fp1, fp2, mode): fp_num =
      IF finite?(fp1) & finite?(fp2)
        THEN fp_op(mult, fp1, fp2, mode)
      ELSIF NaN?(fp1) OR NaN?(fp2) THEN fp_nan(mult, fp1, fp2)
      ELSE fp_mul_inf(fp1, fp2)
      ENDIF


decl_type: function
theory: IEEE_854_defs
library: float
location: 75 2 86 9
signature:
[cell repeats an earlier one in this file: 118 characters]

body:
    fp_div(fp1, fp2, mode): fp_num =
      IF finite?(fp1) & finite?(fp2)
        THEN IF zero?(fp2)
          THEN IF zero?(fp1)
            THEN invalid
          ELSE infinite(mult_sign(fp1, fp2))
          ENDIF
        ELSE fp_op(div, fp1, fp2, mode)
        ENDIF
      ELSIF NaN?(fp1) OR NaN?(fp2) THEN fp_nan(div, fp1, fp2)
      ELSE fp_div_inf(fp1, fp2)
      ENDIF


decl_type: function
theory: IEEE_854_defs
library: float
signature:
  [[fp_num[b, p, E_max, E_min], fp_num[b, p, E_max, E_min]] ->
  fp_num[b, p, E_max, E_min]]

location: 89 2 98 9
body:
    fp_rem(fp1, fp2): fp_num =
      IF finite?(fp1) & finite?(fp2)
        THEN IF zero?(fp2)
          THEN invalid
        ELSE REM(fp1, fp2)
        ENDIF
      ELSIF NaN?(fp1) OR NaN?(fp2) THEN fp_nan(div, fp1, fp2)
      ELSIF infinite?(fp1) THEN invalid
      ELSE fp1
      ENDIF


decl_type: function
theory: IEEE_854_defs
library: float
signature:
  [[fp_num[b, p, E_max, E_min], rounding_mode] ->
  fp_num[b, p, E_max, E_min]]

location: 102 2 112 9
body:
    fp_sqrt(fp, mode): fp_num =
      IF NaN?(fp) THEN NaN_sqrt(fp)
      ELSIF zero?(fp) THEN fp
      ELSIF finite?(fp)
        THEN IF sign(fp) = pos
          THEN real_to_fp(fp_round(sqrt(value(fp)), mode))
        ELSE invalid
        ENDIF
      ELSIF i_sign(fp) = pos THEN fp
      ELSE invalid
      ENDIF


decl_type: tcc
theory: IEEE_854_defs
library: float
signature: nil
location: 130 0 137 999
body:
  % Subtype TCC generated (at line 31, column 20) for  fp1
      % expected type  {fp | finite?(fp) OR infinite?(fp)}
  fp_add_TCC1: OBLIGATION
    FORALL (fp1: fp_num[b, p, E_max, E_min],
            fp2: fp_num[b, p, E_max, E_min]):
      NOT NaN?(fp1) AND NOT NaN?(fp2) AND NOT (finite?(fp1) & finite?(fp2))
       IMPLIES
       finite?[b, p, E_max, E_min](fp1) OR infinite?[b, p, E_max, E_min](fp1);


decl_type: tcc
theory: IEEE_854_defs
library: float
signature: nil
location: 139 0 150 999
body:
  % Subtype TCC generated (at line 31, column 25) for  fp2
      % expected type  {num | infinite?(fp1) OR infinite?(num)}
  fp_add_TCC2: OBLIGATION
    FORALL (fp1: fp_num[b, p, E_max, E_min],
            fp2: fp_num[b, p, E_max, E_min]):
      NOT NaN?(fp1) AND NOT NaN?(fp2) AND NOT (finite?(fp1) & finite?(fp2))
       IMPLIES
       (finite?[b, p, E_max, E_min](fp2) OR
         infinite?[b, p, E_max, E_min](fp2))
        AND
        (infinite?[b, p, E_max, E_min](fp1) OR
          infinite?[b, p, E_max, E_min](fp2));


decl_type: tcc
theory: IEEE_854_defs
library: float
signature: nil
location: 152 0 158 999
body:
  % Subtype TCC generated (at line 80, column 32) for  fp1
      % expected type  {fp | finite?(fp) OR infinite?(fp)}
  fp_div_TCC1: OBLIGATION
    FORALL (fp1: fp_num[b, p, E_max, E_min],
            fp2: fp_num[b, p, E_max, E_min]):
      NOT zero?(fp1) AND zero?(fp2) AND finite?(fp1) AND finite?(fp2) IMPLIES
       finite?[b, p, E_max, E_min](fp1) OR infinite?[b, p, E_max, E_min](fp1);


decl_type: tcc
theory: IEEE_854_defs
library: float
signature: nil
location: 160 0 166 999
body:
  % Subtype TCC generated (at line 80, column 37) for  fp2
      % expected type  {fp | finite?(fp) OR infinite?(fp)}
  fp_div_TCC2: OBLIGATION
    FORALL (fp1: fp_num[b, p, E_max, E_min],
            fp2: fp_num[b, p, E_max, E_min]):
      NOT zero?(fp1) AND zero?(fp2) AND finite?(fp1) AND finite?(fp2) IMPLIES
       finite?[b, p, E_max, E_min](fp2) OR infinite?[b, p, E_max, E_min](fp2);


decl_type: tcc
theory: IEEE_854_defs
library: float
signature: nil
location: 168 0 173 999
body:
  % Subtype TCC generated (at line 107, column 38) for  value(fp)
      % expected type  nnx: nonneg_real
  fp_sqrt_TCC1: OBLIGATION
    FORALL (fp: fp_num[b, p, E_max, E_min]):
      sign(fp) = pos AND finite?(fp) AND NOT zero?(fp) AND NOT NaN?(fp)
       IMPLIES value[b, p, E_max, E_min](fp) >= 0;


decl_type: tcc
theory: IEEE_854_defs
library: float
signature: nil
location: 175 0 180 999
body:
  % Subtype TCC generated (at line 110, column 17) for  fp
      % expected type  (infinite?[b, p, E_max, E_min])
  fp_sqrt_TCC2: OBLIGATION
    FORALL (fp: fp_num[b, p, E_max, E_min]):
      NOT finite?(fp) AND NOT zero?(fp) AND NOT NaN?(fp) IMPLIES
       infinite?[b, p, E_max, E_min](fp);


decl_type: tcc
theory: IEEE_854
library: float
signature: nil
location: 96 0 98 999
body:
  % Subtype TCC generated (at line 60, column 29) for  (E_max + E_min)
      % expected type  {i: int | b /= 0 OR i >= 0}
  Exponent_balance_TCC1: OBLIGATION b /= 0 OR (E_max + E_min) >= 0;


decl_type: tcc
theory: IEEE_854
library: float
signature: nil
location: 100 0 103 999
body:
  % Subtype TCC generated (at line 60, column 53) for  (E_max + E_min + 1)
      % expected type  {i: int | b /= 0 OR i >= 0}
  Exponent_balance_TCC2: OBLIGATION
    b ^ (E_max + E_min) < 4 IMPLIES b /= 0 OR (E_max + E_min + 1) >= 0;


decl_type: tcc
theory: IEEE_854
library: float
signature: nil
location: 105 0 107 999
body:
  % Subtype TCC generated (at line 87, column 42) for  E_min
      % expected type  {i: integer | E_max > i}
  IMP_IEEE_854_defs_TCC1: OBLIGATION E_max > E_min;


decl_type: formula
theory: IEEE_link
library: float
signature: nil
location: 43 0 44 72
body:
  value_nonzero_bis: lemma Fbounded?(b)(f) => abs(FtoR(f)) < radix^(E_max+1)
     => not FtoR(f)=0 => min_pos <= abs(FtoR(f)) & abs(FtoR(f)) <= max_pos


decl_type: formula
theory: IEEE_link
library: float
signature: nil
location: 46 0 48 66
body:
  Sterbenz_bis : lemma
     value(ieee)/2 <= value(ieee2) =>  value(ieee2) <= 2*value(ieee) 
       =>  (exists (s:(finite?)): value(s)=value(ieee2)-value(ieee))


decl_type: formula
theory: IEEE_link
library: float
signature: nil
location: 51 0 55 53
body:
  Roundings_eq_pos: lemma
    NOT trap_enabled?(underflow(FALSE)) =>
     0 <= r =>
      abs(r) < radix ^ (E_max + 1) =>
       fp_round(r, to_neg) = FtoR[radix](RND_Min(b)(r))


decl_type: formula
theory: IEEE_link
library: float
signature: nil
location: 57 0 61 53
body:
  Roundings_eq_neg: lemma
    NOT trap_enabled?(underflow(FALSE)) =>
      0 < r =>
      abs(r) <= max_pos =>
       fp_round(r, to_pos) = FtoR[radix](RND_Max(b)(r))


decl_type: formula
theory: IEEE_link
library: float
signature: nil
location: 68 0 74 13
body:
  RND_EClosest2: lemma FtoR(RND_EClosest(b)(r))= 
    FtoR(if    r-FtoR(RND_Min(b)(r)) < FtoR(RND_Max(b)(r))-r then RND_Min(b)(r)
    elsif FtoR(RND_Max(b)(r))-r < r-FtoR(RND_Min(b)(r)) then RND_Max(b)(r)
    elsif FtoR(RND_Min(b)(r))=FtoR(RND_Max(b)(r))::real then RND_Min(b)(r)
    else  (# Fnum:= 2 * floor(ceiling(r*radix^(-Fexp(RND_aux(b)(abs(r))))) / 2), 
             Fexp:= Fexp(RND_aux(b)(abs(r))) #)
   endif)::real


decl_type: formula
theory: IEEE_link
library: float
signature: nil
location: 76 0 79 53
body:
  Roundings_eq_1: lemma
    NOT trap_enabled?(underflow(FALSE)) =>
       max_neg <= r => r < radix ^ (E_max + 1) =>
       fp_round(r, to_neg) = FtoR[radix](RND_Min(b)(r))


decl_type: formula
theory: IEEE_link
library: float
signature: nil
location: 81 0 84 53
body:
  Roundings_eq_2: lemma
    NOT trap_enabled?(underflow(FALSE)) =>
      - radix ^ (E_max + 1) < r => r <= max_pos =>
       fp_round(r, to_pos) = FtoR[radix](RND_Max(b)(r))


decl_type: formula
theory: IEEE_link
library: float
signature: nil
location: 86 0 89 63
body:
  Roundings_eq_3: lemma
    NOT trap_enabled?(underflow(FALSE)) =>
      abs(r) < radix ^ (E_max + 1) - (1 / 2) * radix ^ (E_max + 1 - p) => 
        fp_round(r, to_nearest) = FtoR[radix](RND_EClosest(b)(r))


decl_type: formula
theory: IEEE_link
library: float
signature: nil
location: 91 0 96 44
body:
  Roundings_eq_4: lemma
    NOT trap_enabled?(underflow(FALSE)) =>
      abs(r) < radix ^ (E_max + 1) =>
        fp_round(r, to_zero) = if 0 <= r then FtoR[radix](RND_Min(b)(r))
                                         else FtoR[radix](RND_Max(b)(r))
                                         endif


decl_type: formula
theory: IEEE_link
library: float
signature: nil
location: 98 0 101 47
body:
  RoundedModeNonDecreasing_bis : lemma
     NOT trap_enabled?(underflow(FALSE)) =>
     z1 <= z2 => abs(z1) <= max_pos => abs(z2) <= max_pos =>
         fp_round(z1, mode) <= fp_round(z2, mode)


decl_type: function
theory: IEEE_link
library: float
location: 29 2 34 37
signature:
  [ieee: (finite?) ->
          {x: (Fbounded?(b)) |
                   value(ieee) = FtoR(x) AND
                    abs(FtoR(x)) < radix ^ (1 + E_max)}]

body:
    IEEE_to_float(ieee): {x: (Fbounded?(b)) | 
      value(ieee) = FtoR(x):: real AND abs(FtoR(x)) < radix^(E_max+1)} =
        (# Fnum
             := (-1) ^ sign(ieee) * radix ^ (p - 1) *
                 Sum(p, value_digit(d(ieee))),
           Fexp := Exp(ieee) + 1 - p #)


decl_type: function
theory: IEEE_link
library: float
location: 36 2 40 67
signature:
  [f: {f: (Fcanonic?(b)) | abs(FtoR(f)) < radix ^ (E_max + 1)} ->
          {x: (finite?) | FtoR(f) = value(x)}]

body:
    float_to_IEEE(f: (Fcanonic?(b)) | abs(FtoR(f)) < radix^(E_max+1)):
          {x: (finite?) | FtoR(f) = value(x)} =
        finite(sign_of(Fnum(f)), Fexp(f) + p - 1,
               (LAMBDA (i: below(p)):
                  mod(floor(radix ^ (i+1-p) * abs(Fnum(f))), radix)))


decl_type: tcc
theory: IEEE_link
library: float
signature: nil
location: 110 0 113 999
body:
  % Assuming TCC generated (at line 20, column 12) for
      % IEEE_854[radix, p, alpha, E_max, E_min]
      % generated from assumption IEEE_854.Base_values
  IMP_IEEE_854_TCC1: OBLIGATION radix = 2 OR radix = 10;


decl_type: tcc
theory: IEEE_link
library: float
signature: nil
location: 115 0 118 999
body:
  % Assuming TCC generated (at line 20, column 12) for
      % IEEE_854[radix, p, alpha, E_max, E_min]
      % generated from assumption IEEE_854.Exponent_range
  IMP_IEEE_854_TCC2: OBLIGATION (E_max - E_min) / p > 5;


decl_type: tcc
theory: IEEE_link
library: float
signature: nil
location: 120 0 123 999
body:
  % Assuming TCC generated (at line 20, column 12) for
      % IEEE_854[radix, p, alpha, E_max, E_min]
      % generated from assumption IEEE_854.Significand_size
  IMP_IEEE_854_TCC3: OBLIGATION radix ^ (p - 1) >= 10 ^ 5;


decl_type: tcc
theory: IEEE_link
library: float
signature: nil
location: 125 0 129 999
body:
  % Assuming TCC generated (at line 20, column 12) for
      % IEEE_854[radix, p, alpha, E_max, E_min]
      % generated from assumption IEEE_854.E_balance
  IMP_IEEE_854_TCC4: OBLIGATION
    IF radix < 4 THEN E_max + E_min = 1 ELSE E_max + E_min = 0 ENDIF;


decl_type: tcc
theory: IEEE_link
library: float
signature: nil
location: 131 0 135 999
body:
  % Assuming TCC generated (at line 20, column 12) for
      % IEEE_854[radix, p, alpha, E_max, E_min]
      % generated from assumption IEEE_854.Exponent_Adjustment
  IMP_IEEE_854_TCC5: OBLIGATION
    abs(alpha - (3 * (E_max - E_min) / 4)) <= 6 & integer?(alpha / 12);


decl_type: tcc
theory: IEEE_link
library: float
signature: nil
location: 137 0 139 999
body:
  % Subtype TCC generated (at line 27, column 36) for  -E_min + p - 1
      % expected type  nat
  b_TCC1: OBLIGATION -E_min + p - 1 >= 0;


decl_type: tcc
theory: IEEE_link
library: float
signature: nil
location: 141 0 144 999
body:
  % Subtype TCC generated (at line 20, column 45) for  E_min
      % expected type  {i: integer | E_max > i}
  IEEE_to_float_TCC1: OBLIGATION
    FORALL (x: (Fbounded?[radix](b))): E_max > E_min;


decl_type: tcc
theory: IEEE_link
library: float
signature: nil
location: 146 0 150 999
body:
  % Subtype TCC generated (at line 30, column 59) for  (E_max + 1)
      % expected type  {i: int | radix /= 0 OR i >= 0}
  IEEE_to_float_TCC2: OBLIGATION
    FORALL (ieee, x: (Fbounded?[radix](b))):
      value(ieee) = FtoR(x) IMPLIES radix /= 0 OR (E_max + 1) >= 0;


decl_type: tcc
theory: IEEE_link
library: float
signature: nil
location: 152 0 155 999
body:
  % Subtype TCC generated (at line 20, column 45) for  E_min
      % expected type  {i: integer | E_max > i}
  IEEE_to_float_TCC3: OBLIGATION
    FORALL (ieee: (finite?[radix, p, E_max, E_min])): E_max > E_min;


decl_type: tcc
theory: IEEE_link
library: float
signature: nil
location: 157 0 174 999
body:
  % Subtype TCC generated (at line 32, column 14) for
      % (-1) ^ sign(ieee) * radix ^ (p - 1) * Sum(p, value_digit(d(ieee)))
      % expected type  int
  IEEE_to_float_TCC4: OBLIGATION
    FORALL (ieee: (finite?[radix, p, E_max, E_min])):
      rational_pred((-1) ^ sign[radix, p, E_max, E_min](ieee) *
                     radix ^ (p - 1)
                     *
                     Sum(p,
                         value_digit[radix, p, E_max, E_min]
                             (d[radix, p, E_max, E_min](ieee))))
       AND
       integer_pred((-1) ^ sign[radix, p, E_max, E_min](ieee) *
                     radix ^ (p - 1)
                     *
                     Sum(p,
                         value_digit[radix, p, E_max, E_min]
                             (d[radix, p, E_max, E_min](ieee))));


decl_type: tcc
theory: IEEE_link
library: float
signature: nil
location: 176 0 217 999
body:
  % Subtype TCC generated (at line 31, column 6) for
      % (# Fnum
      %      := (-1) ^ sign(ieee) * radix ^ (p - 1) *
      %          Sum(p, value_digit(d(ieee))),
      %    Fexp := Exp(ieee) + 1 - p #)
      % expected type  {x: (Fbounded?(b)) |
                     %          value(ieee) = FtoR(x) AND
                     %           abs(FtoR(x)) < radix ^ (1 + E_max)}
  IEEE_to_float_TCC5: OBLIGATION
    FORALL (ieee: (finite?[radix, p, E_max, E_min])):
      Fbounded?[radix]
          (b)
          ((# Fnum
                := (-1) ^ sign[radix, p, E_max, E_min](ieee) *
                    radix ^ (p - 1)
                    *
                    Sum(p,
                        value_digit[radix, p, E_max, E_min]
                            (d[radix, p, E_max, E_min](ieee))),
              Fexp := Exp[radix, p, E_max, E_min](ieee) + 1 - p #))
       AND
       value[radix, p, E_max, E_min](ieee) =
        FtoR[radix]
            ((# Fnum
                  := (-1) ^ sign[radix, p, E_max, E_min](ieee) *
                      radix ^ (p - 1)
                      *
                      Sum(p,
                          value_digit[radix, p, E_max, E_min]
                              (d[radix, p, E_max, E_min](ieee))),
                Fexp := Exp[radix, p, E_max, E_min](ieee) + 1 - p #))
        AND
        abs(FtoR[radix]
                ((# Fnum
                      := (-1) ^ sign[radix, p, E_max, E_min](ieee) *
                          radix ^ (p - 1)
                          *
                          Sum(p,
                              value_digit[radix, p, E_max, E_min]
                                  (d[radix, p, E_max, E_min](ieee))),
                    Fexp := Exp[radix, p, E_max, E_min](ieee) + 1 - p #)))
         < radix ^ (1 + E_max);


decl_type: tcc
theory: IEEE_link
library: float
signature: nil
location: 219 0 222 999
body:
  % Subtype TCC generated (at line 36, column 58) for  (E_max + 1)
      % expected type  {i: int | radix /= 0 OR i >= 0}
  float_to_IEEE_TCC1: OBLIGATION
    FORALL (f: (Fcanonic?[radix](b))): radix /= 0 OR (E_max + 1) >= 0;


decl_type: tcc
theory: IEEE_link
library: float
signature: nil
location: 224 0 229 999
body:
  % Subtype TCC generated (at line 38, column 31) for  Fexp(f) + p - 1
      % expected type  Exponent[radix, p, E_max, E_min]
  float_to_IEEE_TCC2: OBLIGATION
    FORALL (f: (Fcanonic?[radix](b))
                | abs(FtoR[radix](f)) < radix ^ (E_max + 1)):
      E_min <= Fexp(f) + p - 1 & Fexp(f) + p - 1 <= E_max;


decl_type: tcc
theory: IEEE_link
library: float
signature: nil
location: 231 0 237 999
body:
  % Subtype TCC generated (at line 40, column 35) for  (i + 1 - p)
      % expected type  {i: int | radix /= 0 OR i >= 0}
  float_to_IEEE_TCC3: OBLIGATION
    FORALL (f: (Fcanonic?[radix](b))
                | abs(FtoR[radix](f)) < radix ^ (E_max + 1),
            i: below(p)):
      radix /= 0 OR (i + 1 - p) >= 0;


decl_type: tcc
theory: IEEE_link
library: float
signature: nil
location: 239 0 244 999
body:
  % Subtype TCC generated (at line 20, column 45) for  E_min
      % expected type  {i: integer | E_max > i}
  float_to_IEEE_TCC4: OBLIGATION
    FORALL (f: (Fcanonic?[radix](b))
                | abs(FtoR[radix](f)) < radix ^ (E_max + 1)):
      E_max > E_min;


decl_type: tcc
theory: IEEE_link
library: float
signature: nil
location: 246 0 259 999
body:
  % Subtype TCC generated (at line 38, column 6) for
      % finite(sign_of(Fnum(f)), Fexp(f) + p - 1,
      %        (LAMBDA (i: below(p)):
      %           mod(floor(radix ^ (i + 1 - p) * abs(Fnum(f))), radix)))
      % expected type  {x: (finite?) | FtoR(f) = value(x)}
  float_to_IEEE_TCC5: OBLIGATION
    FORALL (f: (Fcanonic?[radix](b))
                | abs(FtoR[radix](f)) < radix ^ (E_max + 1)):
      FtoR[radix](f) =
       value[radix, p, E_max, E_min]
           (finite[radix, p, E_max, E_min]
                (sign_of[radix, p](Fnum(f)), Fexp(f) + p - 1,
                 LAMBDA (i: below(p)):
                   mod(floor(radix ^ (i + 1 - p) * abs(Fnum(f))), radix)));


decl_type: tcc
theory: IEEE_link
library: float
signature: nil
location: 261 0 265 999
body:
  % Subtype TCC generated (at line 43, column 66) for  (E_max + 1)
      % expected type  {i: int | radix /= 0 OR i >= 0}
  value_nonzero_bis_TCC1: OBLIGATION
    FORALL (f: float[radix]):
      Fbounded?(b)(f) IMPLIES radix /= 0 OR (E_max + 1) >= 0;


decl_type: tcc
theory: IEEE_link
library: float
signature: nil
location: 267 0 273 999
body:
  % Subtype TCC generated (at line 20, column 45) for  E_min
      % expected type  {i: integer | E_max > i}
  value_nonzero_bis_TCC2: OBLIGATION
    FORALL (f: float[radix]):
      Fbounded?(b)(f) AND
       abs(FtoR(f)) < radix ^ (E_max + 1) AND NOT FtoR(f) = 0
       IMPLIES E_max > E_min;


decl_type: tcc
theory: IEEE_link
library: float
signature: nil
location: 275 0 280 999
body:
  % Subtype TCC generated (at line 54, column 22) for  (E_max + 1)
      % expected type  {i: int | radix /= 0 OR i >= 0}
  Roundings_eq_pos_TCC1: OBLIGATION
    FORALL (r: real):
      NOT trap_enabled?(underflow(FALSE)) AND 0 <= r IMPLIES
       radix /= 0 OR (E_max + 1) >= 0;


decl_type: tcc
theory: IEEE_link
library: float
signature: nil
location: 282 0 288 999
body:
  % Subtype TCC generated (at line 20, column 45) for  E_min
      % expected type  {i: integer | E_max > i}
  Roundings_eq_pos_TCC2: OBLIGATION
    FORALL (r: real):
      NOT trap_enabled?(underflow(FALSE)) AND
       0 <= r AND abs(r) < radix ^ (E_max + 1)
       IMPLIES E_max > E_min;


decl_type: tcc
theory: IEEE_link
library: float
signature: nil
location: 290 0 294 999
body:
  % Subtype TCC generated (at line 20, column 45) for  E_min
      % expected type  {i: integer | E_max > i}
  Roundings_eq_neg_TCC1: OBLIGATION
    FORALL (r: real):
      NOT trap_enabled?(underflow(FALSE)) AND 0 < r IMPLIES E_max > E_min;


decl_type: tcc
theory: IEEE_link
library: float
signature: nil
location: 296 0 299 999
body:
  % Subtype TCC generated (at line 63, column 48) for  r
      % expected type  nzreal
  fp_round_opp_aux_TCC1: OBLIGATION
    FORALL (r: real): NOT r = 0 IMPLIES r /= 0;


decl_type: tcc
theory: IEEE_link
library: float
signature: nil
location: 301 0 304 999
body:
  % Subtype TCC generated (at line 63, column 73) for  -r
      % expected type  nzreal
  fp_round_opp_aux_TCC2: OBLIGATION
    FORALL (r: real): NOT r = 0 IMPLIES -r /= 0;


decl_type: tcc
theory: IEEE_link
library: float
signature: nil
location: 306 0 309 999
body:
  % Subtype TCC generated (at line 20, column 45) for  E_min
      % expected type  {i: integer | E_max > i}
  fp_round_opp_TCC1: OBLIGATION
    FORALL (r: real): NOT r = 0 IMPLIES E_max > E_min;


decl_type: tcc
theory: IEEE_link
library: float
signature: nil
location: 311 0 319 999
body:
  % Subtype TCC generated (at line 72, column 45) for
      % (-Fexp(RND_aux(b)(abs(r))))
      % expected type  {i: int | radix /= 0 OR i >= 0}
  RND_EClosest2_TCC1: OBLIGATION
    FORALL (r: real):
      NOT r - FtoR(RND_Min(b)(r)) < FtoR(RND_Max(b)(r)) - r AND
       NOT FtoR(RND_Max(b)(r)) - r < r - FtoR(RND_Min(b)(r)) AND
        NOT FtoR(RND_Min(b)(r)) = FtoR(RND_Max(b)(r)):: real
       IMPLIES radix /= 0 OR (-Fexp(RND_aux[radix](b)(abs(r)))) >= 0;


decl_type: tcc
theory: IEEE_link
library: float
signature: nil
location: 321 0 326 999
body:
  % Subtype TCC generated (at line 78, column 34) for  (E_max + 1)
      % expected type  {i: int | radix /= 0 OR i >= 0}
  Roundings_eq_1_TCC1: OBLIGATION
    FORALL (r: real):
      NOT trap_enabled?(underflow(FALSE)) AND max_neg <= r IMPLIES
       radix /= 0 OR (E_max + 1) >= 0;


decl_type: tcc
theory: IEEE_link
library: float
signature: nil
location: 328 0 334 999
body:
  % Subtype TCC generated (at line 20, column 45) for  E_min
      % expected type  {i: integer | E_max > i}
  Roundings_eq_1_TCC2: OBLIGATION
    FORALL (r: real):
      NOT trap_enabled?(underflow(FALSE)) AND
       max_neg <= r AND r < radix ^ (E_max + 1)
       IMPLIES E_max > E_min;


decl_type: tcc
theory: IEEE_link
library: float
signature: nil
location: 336 0 341 999
body:
  % Subtype TCC generated (at line 20, column 45) for  E_min
      % expected type  {i: integer | E_max > i}
  Roundings_eq_2_TCC1: OBLIGATION
    FORALL (r: real):
      NOT trap_enabled?(underflow(FALSE)) AND -radix ^ (E_max + 1) < r
       IMPLIES E_max > E_min;


decl_type: tcc
theory: IEEE_link
library: float
signature: nil
location: 343 0 347 999
body:
  % Subtype TCC generated (at line 88, column 54) for  (E_max + 1 - p)
      % expected type  {i: int | radix /= 0 OR i >= 0}
  Roundings_eq_3_TCC1: OBLIGATION
    NOT trap_enabled?(underflow(FALSE)) IMPLIES
     radix /= 0 OR (E_max + 1 - p) >= 0;


decl_type: tcc
theory: IEEE_link
library: float
signature: nil
location: 349 0 355 999
body:
  % Subtype TCC generated (at line 20, column 45) for  E_min
      % expected type  {i: integer | E_max > i}
  Roundings_eq_3_TCC2: OBLIGATION
    FORALL (r: real):
      NOT trap_enabled?(underflow(FALSE)) AND
       abs(r) < radix ^ (E_max + 1) - (1 / 2) * radix ^ (E_max + 1 - p)
       IMPLIES E_max > E_min;


decl_type: tcc
theory: IEEE_link
library: float
signature: nil
location: 357 0 362 999
body:
  % Subtype TCC generated (at line 20, column 45) for  E_min
      % expected type  {i: integer | E_max > i}
  Roundings_eq_4_TCC1: OBLIGATION
    FORALL (r: real):
      NOT trap_enabled?(underflow(FALSE)) AND abs(r) < radix ^ (E_max + 1)
       IMPLIES E_max > E_min;


decl_type: tcc
theory: IEEE_link
library: float
signature: nil
location: 364 0 368 999
body:
  % Subtype TCC generated (at line 20, column 45) for  E_min
      % expected type  {i: integer | E_max > i}
  RoundedModeNonDecreasing_bis_TCC1: OBLIGATION
    FORALL (z1, z2: real):
      NOT trap_enabled?(underflow(FALSE)) AND z1 <= z2 IMPLIES E_max > E_min;


decl_type: formula
theory: axpy
library: float
signature: nil
location: 31 0 32 63
body:
  MinOrMax1 : lemma Fcanonic?(b)(f) => 0 < FtoR(f) 
       => abs(FtoR(f)-z) < Fulp(b)(Fpred(b)(f)) => MinOrMax?(z,f)


decl_type: formula
theory: axpy
library: float
signature: nil
location: 34 0 35 69
body:
  MinOrMax2 : lemma Fcanonic?(b)(f) => 0 < FtoR(f) 
       => abs(FtoR(f)-z) < Fulp(b)(f) => FtoR(f) <= z => MinOrMax?(z,f)


decl_type: formula
theory: axpy
library: float
signature: nil
location: 37 0 38 53
body:
  MinOrMax3 : lemma Fcanonic?(b)(f) => 0 = FtoR(f) 
       => abs(FtoR(f)-z) < Fulp(b)(f) => MinOrMax?(z,f)


decl_type: formula
theory: axpy
library: float
signature: nil
location: 41 0 42 53
body:
  RoundLe : lemma Fcanonic?(b)(f) => NOT FtoR(f)=0 => Closest?(b)(z,f)
       => abs(FtoR(f)) <= abs(z)/(1-1/(2*abs(Fnum(f))))


decl_type: formula
theory: axpy
library: float
signature: nil
location: 44 0 45 54
body:
  RoundGe : lemma Fcanonic?(b)(f) => NOT FtoR(f)=0 => Closest?(b)(z,f)
       =>  abs(z)/(1+1/(2*abs(Fnum(f)))) <= abs(FtoR(f))


decl_type: formula
theory: axpy
library: float
signature: nil
location: 48 0 50 83
body:
  ExactSum_Near : lemma
    Fbounded?(b)(p) => Fbounded?(b)(q) => Fbounded?(b)(f) => Closest?(b)(FtoR(p)+FtoR(q),f)
      => abs(FtoR(f)-(FtoR(p)+FtoR(q))) < radix^(-dExp(b)) => FtoR(f)=FtoR(p)+FtoR(q)


decl_type: formula
theory: axpy
library: float
signature: nil
location: 52 0 54 66
body:
  Normal_iff : lemma
    Fcanonic?(b)(f) =>
      (Fnormal?(b)(f) IFF radix^(Prec(b)-1-dExp(b)) <= abs(FtoR(f)))


decl_type: formula
theory: axpy
library: float
signature: nil
location: 58 0 61 27
body:
  Axpy_aux1 : lemma Closest?(b)(FtoR(a)*FtoR(x),t) => Closest?(b)(FtoR(t)+FtoR(y),u) => 0 < FtoR(u)
     => abs(FtoR(t)-FtoR(a)*FtoR(x))          <=  Fulp(b)(Fpred(b)(u))/4 
     => abs(y1-FtoR(y)+a1*x1-FtoR(a)*FtoR(x)) <   Fulp(b)(Fpred(b)(u))/4
     => MinOrMax?(y1+a1*x1,u)


decl_type: formula
theory: axpy
library: float
signature: nil
location: 64 0 66 61
body:
  Axpy_aux1_aux1 : lemma Closest?(b)(FtoR(a)*FtoR(x),t) => Closest?(b)(FtoR(t)+FtoR(y),u) => 0 < FtoR(u)
    => Fnormal?(b)(t) => radix*abs(FtoR(t)) <= FtoR(Fpred(b)(u))
    => abs(FtoR(t)-FtoR(a)*FtoR(x))  <=  Fulp(b)(Fpred(b)(u))/4 


decl_type: formula
theory: axpy
library: float
signature: nil
location: 68 0 70 60
body:
  Axpy_aux1_aux2 : lemma Closest?(b)(FtoR(a)*FtoR(x),t) => Closest?(b)(FtoR(t)+FtoR(y),u) => 0 < FtoR(u)
    => Fsubnormal?(b)(t) => 1-dExp(b) <= Fexp(Fpred(b)(u))
    => abs(FtoR(t)-FtoR(a)*FtoR(x)) <=  Fulp(b)(Fpred(b)(u))/4 


decl_type: formula
theory: axpy
library: float
signature: nil
location: 72 0 75 26
body:
  Axpy_aux2 : lemma Closest?(b)(FtoR(a)*FtoR(x),t) => Closest?(b)(FtoR(t)+FtoR(y),u) => 0 < FtoR(u)
    => Fsubnormal?(b)(t) => FtoR(u)=FtoR(t)+FtoR(y)
    => abs(y1-FtoR(y)+a1*x1-FtoR(a)*FtoR(x)) < Fulp(b)(Fpred(b)(u))/4
    => MinOrMax?(y1+a1*x1,u)


decl_type: formula
theory: axpy
library: float
signature: nil
location: 78 0 82 26
body:
  Axpy_aux3 : lemma Closest?(b)(FtoR(a)*FtoR(x),t) => Closest?(b)(FtoR(t)+FtoR(y),u) => 0 < FtoR(u)
    => Fsubnormal?(b)(t) 
    => -dExp(b) = Fexp(Fpred(b)(u)) =>  1-dExp(b) <= Fexp(u)
    => abs(y1-FtoR(y)+a1*x1-FtoR(a)*FtoR(x)) < Fulp(b)(Fpred(b)(u))/4
    => MinOrMax?(y1+a1*x1,u)


decl_type: formula
theory: axpy
library: float
signature: nil
location: 85 0 88 26
body:
  AxpyPos : lemma Closest?(b)(FtoR(a)*FtoR(x),t) => Closest?(b)(FtoR(t)+FtoR(y),u) => 0 < FtoR(u)
    => (Fnormal?(b)(t) => radix*abs(FtoR(t)) <= FtoR(Fpred(b)(u)))
    => abs(y1-FtoR(y)+a1*x1-FtoR(a)*FtoR(x)) < Fulp(b)(Fpred(b)(u))/4
    => MinOrMax?(y1+a1*x1,u)


decl_type: formula
theory: axpy
library: float
signature: nil
location: 91 0 94 34
body:
  Axpy_opt_aux1_aux1 : lemma Fnormal?(b)(t) => Fnormal?(b)(u) => 0 < FtoR(u) 
      => Prec(b) >= 3 => 
     (1+radix*(1+1/(2*abs(Fnum(u))))*(1+1/abs(Fnum(Fpred(b)(u)))))/(1-1/(2*abs(Fnum(t))))
        <= 1+radix+radix^(4-Prec(b))


decl_type: formula
theory: axpy
library: float
signature: nil
location: 96 0 99 45
body:
  Axpy_opt_aux1 : lemma Closest?(b)(FtoR(a)*FtoR(x),t) => Closest?(b)(FtoR(t)+FtoR(y),u) => 0 < FtoR(u)
    =>  Prec(b) >= 3 => Fnormal?(b)(t) 
    => (radix+1+radix^(4-Prec(b)))*abs(FtoR(a)*FtoR(x)) <= abs(FtoR(y))
    =>  radix*abs(FtoR(t)) <= FtoR(Fpred(b)(u))


decl_type: formula
theory: axpy
library: float
signature: nil
location: 101 0 104 69
body:
  Axpy_opt_aux2 : lemma  Closest?(b)(FtoR(a)*FtoR(x),t) => Closest?(b)(FtoR(t)+FtoR(y),u) => 0 < FtoR(u)
    =>  Prec(b) >= 6 =>  Fnormal?(b)(t) 
    => (radix+1+radix^(4-Prec(b)))*abs(FtoR(a)*FtoR(x)) <= abs(FtoR(y))
    =>  abs(FtoR(y))*radix^(1-Prec(b))/(radix+1) < Fulp(b)(Fpred(b)(u))


decl_type: formula
theory: axpy
library: float
signature: nil
location: 106 0 109 76
body:
  Axpy_opt_aux3 : lemma  Closest?(b)(FtoR(a)*FtoR(x),t) => Closest?(b)(FtoR(t)+FtoR(y),u) => 0 < FtoR(u)
    =>  Prec(b) >= 3  =>  Fsubnormal?(b)(t) 
    => (radix+1+radix^(4-Prec(b)))*abs(FtoR(a)*FtoR(x)) <= abs(FtoR(y))
    =>  abs(FtoR(y))*radix^(1-Prec(b))/(radix+radix/2) <= Fulp(b)(Fpred(b)(u))


decl_type: formula
theory: axpy
library: float
signature: nil
location: 112 0 116 26
body:
  Axpy_optPos : lemma Closest?(b)(FtoR(a)*FtoR(x),t) => Closest?(b)(FtoR(t)+FtoR(y),u) => 0 < FtoR(u)
    => Prec(b) >= 6 
    => (radix+1+radix^(4-Prec(b)))*abs(FtoR(a)*FtoR(x)) <= abs(FtoR(y))
    => abs(y1-FtoR(y)+a1*x1-FtoR(a)*FtoR(x)) < abs(FtoR(y))*radix^(1-Prec(b))/(6*radix)
    => MinOrMax?(y1+a1*x1,u)


decl_type: formula
theory: axpy
library: float
signature: nil
location: 119 0 122 26
body:
  Axpy_optZero : lemma Closest?(b)(FtoR(a)*FtoR(x),t) => Closest?(b)(FtoR(t)+FtoR(y),u) => 0 = FtoR(u)
    => (radix+1+radix^(4-Prec(b)))*abs(FtoR(a)*FtoR(x)) <= abs(FtoR(y))
    => abs(y1-FtoR(y)+a1*x1-FtoR(a)*FtoR(x)) < abs(FtoR(y))*radix^(1-Prec(b))/(6*radix)
    => MinOrMax?(y1+a1*x1,u)


decl_type: formula
theory: axpy
library: float
signature: nil
location: 124 0 128 26
body:
  Axpy_opt : lemma Closest?(b)(FtoR(a)*FtoR(x),t) => Closest?(b)(FtoR(t)+FtoR(y),u)
    => Prec(b) >= 6
    => (radix+1+radix^(4-Prec(b)))*abs(FtoR(a)*FtoR(x)) <= abs(FtoR(y))
    => abs(y1-FtoR(y)+a1*x1-FtoR(a)*FtoR(x)) < abs(FtoR(y))*radix^(1-Prec(b))/(6*radix)
    => MinOrMax?(y1+a1*x1,u)


decl_type: formula
theory: axpy
library: float
signature: nil
location: 130 0 134 26
body:
  Axpy_simpl : lemma Closest?(b)(FtoR(a)*FtoR(x),t) => Closest?(b)(FtoR(t)+FtoR(y),u)
    => Prec(b) >= 24 => radix=2 
    => (3+1/100000)*abs(FtoR(a)*FtoR(x)) <= abs(FtoR(y))
    => abs(y1-FtoR(y)+a1*x1-FtoR(a)*FtoR(x)) < abs(FtoR(y))*2^(1-Prec(b))/12
    => MinOrMax?(y1+a1*x1,u)


decl_type: function
theory: axpy
library: float
signature: [float[radix] -> float[radix]]
location: 15 0 17 35
body:
  Fless(f:float):float= if    0 < FtoR(f) then Fpred(b)(f) 
                        elsif FtoR(f) < 0 then Fsucc(b)(f)
                        else  f endif


decl_type: tcc
theory: axpy
library: float
signature: nil
location: 141 0 144 999
body:
  % Judgement subtype TCC generated (at line 11, column 28) for  x1
      % expected type  {x: float | Fbounded?(b)(x)}
  FcanonicBounded2: OBLIGATION
    FORALL (x1: {x: float | Fcanonic?(b)(x)}): Fbounded?[radix](b)(x1);


decl_type: tcc
theory: axpy
library: float
signature: nil
location: 146 0 151 999
body:
  % Subtype TCC generated (at line 29, column 71) for  Fopp(f)
      % expected type  (Fbounded?(b))
  MinOrMax_Fopp_TCC1: OBLIGATION
    FORALL (f: float[radix], z: real):
      Fbounded?(b)(f) AND MinOrMax?(z, f) IMPLIES
       Fbounded?[radix](b)(Fopp[radix](f));


decl_type: tcc
theory: axpy
library: float
signature: nil
location: 153 0 158 999
body:
  % Subtype TCC generated (at line 32, column 33) for  Fpred(b)(f)
      % expected type  (Fbounded?(b))
  MinOrMax1_TCC1: OBLIGATION
    FORALL (f: float[radix]):
      Fcanonic?(b)(f) AND 0 < FtoR(f) IMPLIES
       Fbounded?[radix](b)(Fpred[radix](b)(f));


decl_type: tcc
theory: axpy
library: float
signature: nil
location: 160 0 166 999
body:
  % Subtype TCC generated (at line 32, column 61) for  f
      % expected type  (Fbounded?(b))
  MinOrMax1_TCC2: OBLIGATION
    FORALL (f: float[radix], z: real):
      Fcanonic?(b)(f) AND
       0 < FtoR(f) AND abs(FtoR(f) - z) < Fulp(b)(Fpred(b)(f))
       IMPLIES Fbounded?[radix](b)(f);


decl_type: tcc
theory: axpy
library: float
signature: nil
location: 168 0 172 999
body:
  % Subtype TCC generated (at line 35, column 33) for  f
      % expected type  (Fbounded?(b))
  MinOrMax2_TCC1: OBLIGATION
    FORALL (f: float[radix]):
      Fcanonic?(b)(f) AND 0 < FtoR(f) IMPLIES Fbounded?[radix](b)(f);


decl_type: tcc
theory: axpy
library: float
signature: nil
location: 174 0 178 999
body:
  % Subtype TCC generated (at line 38, column 33) for  f
      % expected type  (Fbounded?(b))
  MinOrMax3_TCC1: OBLIGATION
    FORALL (f: float[radix]):
      Fcanonic?(b)(f) AND 0 = FtoR(f) IMPLIES Fbounded?[radix](b)(f);


decl_type: tcc
theory: axpy
library: float
signature: nil
location: 180 0 184 999
body:
  % Subtype TCC generated (at line 41, column 66) for  f
      % expected type  (Fbounded?(b))
  RoundLe_TCC1: OBLIGATION
    FORALL (f: float[radix]):
      Fcanonic?(b)(f) AND NOT FtoR(f) = 0 IMPLIES Fbounded?[radix](b)(f);


decl_type: tcc
theory: axpy
library: float
signature: nil
location: 186 0 191 999
body:
  % Subtype TCC generated (at line 42, column 37) for  (2 * abs(Fnum(f)))
      % expected type  nznum
  RoundLe_TCC2: OBLIGATION
    FORALL (f: float[radix], z: real):
      Fcanonic?(b)(f) AND NOT FtoR(f) = 0 AND Closest?(b)(z, f) IMPLIES
       (2 * abs(Fnum(f))) /= 0;


decl_type: tcc
theory: axpy
library: float
signature: nil
location: 193 0 199 999
body:
  % Subtype TCC generated (at line 42, column 32) for
      % (1 - 1 / (2 * abs(Fnum(f))))
      % expected type  nznum
  RoundLe_TCC3: OBLIGATION
    FORALL (f: float[radix], z: real):
      Fcanonic?(b)(f) AND NOT FtoR(f) = 0 AND Closest?(b)(z, f) IMPLIES
       (1 - 1 / (2 * abs(Fnum(f)))) /= 0;


decl_type: tcc
theory: axpy
library: float
signature: nil
location: 201 0 207 999
body:
  % Subtype TCC generated (at line 45, column 17) for
      % (1 + 1 / (2 * abs(Fnum(f))))
      % expected type  nznum
  RoundGe_TCC1: OBLIGATION
    FORALL (f: float[radix], z: real):
      Fcanonic?(b)(f) AND NOT FtoR(f) = 0 AND Closest?(b)(z, f) IMPLIES
       (1 + 1 / (2 * abs(Fnum(f)))) /= 0;


decl_type: tcc
theory: axpy
library: float
signature: nil
location: 209 0 216 999
body:
  % Subtype TCC generated (at line 50, column 47) for  (-dExp(b))
      % expected type  {i: int | radix /= 0 OR i >= 0}
  ExactSum_Near_TCC1: OBLIGATION
    FORALL (f, p, q: float[radix]):
      Fbounded?(b)(p) AND
       Fbounded?(b)(q) AND
        Fbounded?(b)(f) AND Closest?(b)(FtoR(p) + FtoR(q), f)
       IMPLIES radix /= 0 OR (-dExp(b)) >= 0;


decl_type: tcc
theory: axpy
library: float
signature: nil
location: 218 0 222 999
body:
  % Subtype TCC generated (at line 54, column 31) for  (Prec(b) - 1 - dExp(b))
      % expected type  {i: int | radix /= 0 OR i >= 0}
  Normal_iff_TCC1: OBLIGATION
    FORALL (f: float[radix]):
      Fcanonic?(b)(f) IMPLIES radix /= 0 OR (Prec(b) - 1 - dExp(b)) >= 0;


decl_type: tcc
theory: axpy
library: float
signature: nil
location: 224 0 230 999
body:
  % Subtype TCC generated (at line 59, column 56) for  Fpred(b)(u)
      % expected type  (Fbounded?(b))
  Axpy_aux1_TCC1: OBLIGATION
    FORALL (a, t, u, x, y: {x: float | Fcanonic?(b)(x)}):
      Closest?(b)(FtoR(a) * FtoR(x), t) AND
       Closest?(b)(FtoR(t) + FtoR(y), u) AND 0 < FtoR(u)
       IMPLIES Fbounded?[radix](b)(Fpred[radix](b)(u));


decl_type: tcc
theory: axpy
library: float
signature: nil
location: 232 0 237 999
body:
  % Subtype TCC generated (at line 93, column 18) for  (2 * abs(Fnum(u)))
      % expected type  nznum
  Axpy_opt_aux1_aux1_TCC1: OBLIGATION
    FORALL (t, u: {x: float | Fcanonic?(b)(x)}):
      Fnormal?(b)(t) AND Fnormal?(b)(u) AND 0 < FtoR(u) AND Prec(b) >= 3
       IMPLIES (2 * abs(Fnum(u))) /= 0;


decl_type: tcc
theory: axpy
library: float
signature: nil
location: 239 0 244 999
body:
  % Subtype TCC generated (at line 93, column 40) for  abs(Fnum(Fpred(b)(u)))
      % expected type  nznum
  Axpy_opt_aux1_aux1_TCC2: OBLIGATION
    FORALL (t, u: {x: float | Fcanonic?(b)(x)}):
      Fnormal?(b)(t) AND Fnormal?(b)(u) AND 0 < FtoR(u) AND Prec(b) >= 3
       IMPLIES abs(Fnum(Fpred[radix](b)(u))) /= 0;


decl_type: tcc
theory: axpy
library: float
signature: nil
location: 246 0 251 999
body:
  % Subtype TCC generated (at line 93, column 71) for  (2 * abs(Fnum(t)))
      % expected type  nznum
  Axpy_opt_aux1_aux1_TCC3: OBLIGATION
    FORALL (t, u: {x: float | Fcanonic?(b)(x)}):
      Fnormal?(b)(t) AND Fnormal?(b)(u) AND 0 < FtoR(u) AND Prec(b) >= 3
       IMPLIES (2 * abs(Fnum(t))) /= 0;


decl_type: tcc
theory: axpy
library: float
signature: nil
location: 253 0 259 999
body:
  % Subtype TCC generated (at line 93, column 66) for
      % (1 - 1 / (2 * abs(Fnum(t))))
      % expected type  nznum
  Axpy_opt_aux1_aux1_TCC4: OBLIGATION
    FORALL (t, u: {x: float | Fcanonic?(b)(x)}):
      Fnormal?(b)(t) AND Fnormal?(b)(u) AND 0 < FtoR(u) AND Prec(b) >= 3
       IMPLIES (1 - 1 / (2 * abs(Fnum(t)))) /= 0;


decl_type: tcc
theory: axpy
library: float
signature: nil
location: 261 0 266 999
body:
  % Subtype TCC generated (at line 94, column 24) for  (4 - Prec(b))
      % expected type  {i: int | radix /= 0 OR i >= 0}
  Axpy_opt_aux1_aux1_TCC5: OBLIGATION
    FORALL (t, u: {x: float | Fcanonic?(b)(x)}):
      Fnormal?(b)(t) AND Fnormal?(b)(u) AND 0 < FtoR(u) AND Prec(b) >= 3
       IMPLIES radix /= 0 OR (4 - Prec(b)) >= 0;


decl_type: tcc
theory: axpy
library: float
signature: nil
location: 268 0 275 999
body:
  % Subtype TCC generated (at line 98, column 21) for  (4 - Prec(b))
      % expected type  {i: int | radix /= 0 OR i >= 0}
  Axpy_opt_aux1_TCC1: OBLIGATION
    FORALL (a, t, u, x, y: {x: float | Fcanonic?(b)(x)}):
           Closest?(b)(FtoR(a) * FtoR(x), t)
       AND Closest?(b)(FtoR(t) + FtoR(y), u) AND 0 < FtoR(u) AND Prec(b) >= 3
       AND Fnormal?(b)(t)
       IMPLIES radix /= 0 OR (4 - Prec(b)) >= 0;


decl_type: tcc
theory: axpy
library: float
signature: nil
location: 277 0 284 999
body:
  % Subtype TCC generated (at line 103, column 21) for  (4 - Prec(b))
      % expected type  {i: int | radix /= 0 OR i >= 0}
  Axpy_opt_aux2_TCC1: OBLIGATION
    FORALL (a, t, u, x, y: {x: float | Fcanonic?(b)(x)}):
           Closest?(b)(FtoR(a) * FtoR(x), t)
       AND Closest?(b)(FtoR(t) + FtoR(y), u) AND 0 < FtoR(u) AND Prec(b) >= 6
       AND Fnormal?(b)(t)
       IMPLIES radix /= 0 OR (4 - Prec(b)) >= 0;


decl_type: tcc
theory: axpy
library: float
signature: nil
location: 286 0 295 999
body:
  % Subtype TCC generated (at line 104, column 26) for  (1 - Prec(b))
      % expected type  {i: int | radix /= 0 OR i >= 0}
  Axpy_opt_aux2_TCC2: OBLIGATION
    FORALL (a, t, u, x, y: {x: float | Fcanonic?(b)(x)}):
           Closest?(b)(FtoR(a) * FtoR(x), t)
       AND Closest?(b)(FtoR(t) + FtoR(y), u) AND 0 < FtoR(u) AND Prec(b) >= 6
       AND Fnormal?(b)(t)
       AND (radix + 1 + radix ^ (4 - Prec(b))) * abs(FtoR(a) * FtoR(x)) <=
            abs(FtoR(y))
       IMPLIES radix /= 0 OR (1 - Prec(b)) >= 0;


decl_type: tcc
theory: axpy
library: float
signature: nil
location: 297 0 304 999
body:
  % Subtype TCC generated (at line 108, column 21) for  (4 - Prec(b))
      % expected type  {i: int | radix /= 0 OR i >= 0}
  Axpy_opt_aux3_TCC1: OBLIGATION
    FORALL (a, t, u, x, y: {x: float | Fcanonic?(b)(x)}):
           Closest?(b)(FtoR(a) * FtoR(x), t)
       AND Closest?(b)(FtoR(t) + FtoR(y), u) AND 0 < FtoR(u) AND Prec(b) >= 3
       AND Fsubnormal?(b)(t)
       IMPLIES radix /= 0 OR (4 - Prec(b)) >= 0;


decl_type: tcc
theory: axpy
library: float
signature: nil
location: 306 0 315 999
body:
  % Subtype TCC generated (at line 109, column 26) for  (1 - Prec(b))
      % expected type  {i: int | radix /= 0 OR i >= 0}
  Axpy_opt_aux3_TCC2: OBLIGATION
    FORALL (a, t, u, x, y: {x: float | Fcanonic?(b)(x)}):
           Closest?(b)(FtoR(a) * FtoR(x), t)
       AND Closest?(b)(FtoR(t) + FtoR(y), u) AND 0 < FtoR(u) AND Prec(b) >= 3
       AND Fsubnormal?(b)(t)
       AND (radix + 1 + radix ^ (4 - Prec(b))) * abs(FtoR(a) * FtoR(x)) <=
            abs(FtoR(y))
       IMPLIES radix /= 0 OR (1 - Prec(b)) >= 0;


decl_type: tcc
theory: axpy
library: float
signature: nil
location: 317 0 323 999
body:
  % Subtype TCC generated (at line 114, column 21) for  (4 - Prec(b))
      % expected type  {i: int | radix /= 0 OR i >= 0}
  Axpy_optPos_TCC1: OBLIGATION
    FORALL (a, t, u, x, y: {x: float | Fcanonic?(b)(x)}):
      Closest?(b)(FtoR(a) * FtoR(x), t) AND
       Closest?(b)(FtoR(t) + FtoR(y), u) AND 0 < FtoR(u) AND Prec(b) >= 6
       IMPLIES radix /= 0 OR (4 - Prec(b)) >= 0;


decl_type: tcc
theory: axpy
library: float
signature: nil
location: 325 0 333 999
body:
  % Subtype TCC generated (at line 115, column 65) for  (1 - Prec(b))
      % expected type  {i: int | radix /= 0 OR i >= 0}
  Axpy_optPos_TCC2: OBLIGATION
    FORALL (a, t, u, x, y: {x: float | Fcanonic?(b)(x)}):
           Closest?(b)(FtoR(a) * FtoR(x), t)
       AND Closest?(b)(FtoR(t) + FtoR(y), u) AND 0 < FtoR(u) AND Prec(b) >= 6
       AND (radix + 1 + radix ^ (4 - Prec(b))) * abs(FtoR(a) * FtoR(x)) <=
            abs(FtoR(y))
       IMPLIES radix /= 0 OR (1 - Prec(b)) >= 0;


decl_type: tcc
theory: axpy
library: float
signature: nil
location: 335 0 341 999
body:
  % Subtype TCC generated (at line 120, column 21) for  (4 - Prec(b))
      % expected type  {i: int | radix /= 0 OR i >= 0}
  Axpy_optZero_TCC1: OBLIGATION
    FORALL (a, t, u, x, y: {x: float | Fcanonic?(b)(x)}):
      Closest?(b)(FtoR(a) * FtoR(x), t) AND
       Closest?(b)(FtoR(t) + FtoR(y), u) AND 0 = FtoR(u)
       IMPLIES radix /= 0 OR (4 - Prec(b)) >= 0;


decl_type: tcc
theory: axpy
library: float
signature: nil
location: 343 0 352 999
body:
  % Subtype TCC generated (at line 121, column 65) for  (1 - Prec(b))
      % expected type  {i: int | radix /= 0 OR i >= 0}
  Axpy_optZero_TCC2: OBLIGATION
    FORALL (a, t, u, x, y: {x: float | Fcanonic?(b)(x)}):
      Closest?(b)(FtoR(a) * FtoR(x), t) AND
       Closest?(b)(FtoR(t) + FtoR(y), u) AND
        0 = FtoR(u) AND
         (radix + 1 + radix ^ (4 - Prec(b))) * abs(FtoR(a) * FtoR(x)) <=
          abs(FtoR(y))
       IMPLIES radix /= 0 OR (1 - Prec(b)) >= 0;


decl_type: tcc
theory: axpy
library: float
signature: nil
location: 354 0 360 999
body:
  % Subtype TCC generated (at line 126, column 21) for  (4 - Prec(b))
      % expected type  {i: int | radix /= 0 OR i >= 0}
  Axpy_opt_TCC1: OBLIGATION
    FORALL (a, t, u, x, y: {x: float | Fcanonic?(b)(x)}):
      Closest?(b)(FtoR(a) * FtoR(x), t) AND
       Closest?(b)(FtoR(t) + FtoR(y), u) AND Prec(b) >= 6
       IMPLIES radix /= 0 OR (4 - Prec(b)) >= 0;


decl_type: tcc
theory: axpy
library: float
signature: nil
location: 362 0 371 999
body:
  % Subtype TCC generated (at line 127, column 65) for  (1 - Prec(b))
      % expected type  {i: int | radix /= 0 OR i >= 0}
  Axpy_opt_TCC2: OBLIGATION
    FORALL (a, t, u, x, y: {x: float | Fcanonic?(b)(x)}):
      Closest?(b)(FtoR(a) * FtoR(x), t) AND
       Closest?(b)(FtoR(t) + FtoR(y), u) AND
        Prec(b) >= 6 AND
         (radix + 1 + radix ^ (4 - Prec(b))) * abs(FtoR(a) * FtoR(x)) <=
          abs(FtoR(y))
       IMPLIES radix /= 0 OR (1 - Prec(b)) >= 0;


decl_type: formula
theory: matroids
library: graphs
signature: nil
location: 70 2 72 39
body:
    circuit_test: LEMMA circuit?(M,A) IMPLIES (subset?(A,elem(M)) AND
                        NOT indep(M)(A) AND (subset?(B,A) and B /= A 
                    IMPLIES indep(M)(B)))


decl_type: formula
theory: matroids
library: graphs
signature: nil
location: 74 0 77 46
body:
  circuit_test2: LEMMA  (subset?(A,elem(M)) AND
                        NOT indep(M)(A) AND 
                        FORALL B: (subset?(B,A) AND B /= A IMPLIES indep(M)(B))) 
                           IMPLIES circuit?(M,A)


decl_type: type
theory: matroids
library: graphs
signature: nil
location: 14 2 15 59
body:
    pre_matroid: TYPE = [# elem: finite_set[T],
                           indep: [finite_set[T] -> bool]  #]


decl_type: type
theory: matroids
library: graphs
signature: nil
location: 28 2 30 50
body:
    Matroid: TYPE = {M: pre_matroid | indep_in_elem(M) AND
                                      indep_subset(M) AND 
                                      indep_card(M)}


decl_type: type
theory: matroids
library: graphs
signature: nil
location: 54 2 57 77
body:
    isomorph(M1,M2): TYPE = {f: [(elem(M1)) -> (elem(M2))] | 
                           bijective?(f) AND
                           (FORALL (A: Subsets(elem(M1))): indep(M1)(A) IFF
                                                indep(M2)(extend(M1,M2,f)(A)))}


decl_type: function
theory: matroids
library: graphs
signature: [pre_matroid -> bool]
location: 17 2 18 80
body:
    indep_in_elem(M: pre_matroid): bool = (FORALL (A:finite_set[T]): 
                                           indep(M)(A) IMPLIES subset?(A,elem(M)))


decl_type: function
theory: matroids
library: graphs
signature: [pre_matroid -> bool]
location: 20 2 21 69
body:
    indep_subset(M: pre_matroid): bool = (FORALL (A,B:finite_set[T]): 
                      indep(M)(A) and subset?(B,A) IMPLIES indep(M)(B))


decl_type: function
theory: matroids
library: graphs
signature: [pre_matroid -> bool]
location: 23 2 26 65
body:
    indep_card(M: pre_matroid): bool = (FORALL (A,B:finite_set[T]):
               indep(M)(A) AND indep(M)(B) AND card(A) < card(B)
                   IMPLIES (Exists (x: T): elem(M)(x) AND A(x) AND NOT B(x)
                                           AND indep(M)(add(x,B))))


decl_type: function
theory: matroids
library: graphs
signature: [Matroid -> bool]
location: 38 2 41 74
body:
    simple?(M: Matroid): bool = (FORALL x: elem(M)(x) IMPLIES
                                           (indep(M)(single(x)) AND 
                                            (FORALL y: x /=y IMPLIES 
                                                    indep(M)(double(x,y)))))


decl_type: function
theory: matroids
library: graphs
location: 50 2 52 80
signature:
  [d: [M1: Matroid, M2: Matroid, [(elem(M1)) -> (elem(M2))]] ->
          [Subsets(elem(d`1)) -> finite_set[T]]]

body:
    extend(M1,M2,(f:[(elem(M1)) -> (elem(M2))])):
                            [Subsets(elem(M1)) -> finite_set[T]] =
             (LAMBDA (A: Subsets(elem(M1))): {t: T | (EXISTS (a: (A)): f(a) = t)})


decl_type: function
theory: matroids
library: graphs
signature: [[Matroid, finite_set[T]] -> bool]
location: 63 2 66 82
body:
    circuit?(M: Matroid, A: finite_set[T]): bool = subset?(A,elem(M))
                                                   AND NOT indep(M)(A) AND 
                                                   (FORALL (x: (elem(M))): A(x) 
                                                      IMPLIES indep(M)(remove(x,A)))


decl_type: tcc
theory: matroids
library: graphs
signature: nil
location: 87 0 89 999
body:
  % Subtype TCC generated (at line 34, column 29) for  {t: T | t = x}
      % expected type  finite_set[T]
  single_TCC1: OBLIGATION FORALL (x: T): is_finite[T]({t: T | t = x});


decl_type: tcc
theory: matroids
library: graphs
signature: nil
location: 91 0 94 999
body:
  % Subtype TCC generated (at line 36, column 31) for  {t: T | t = x OR t = y}
      % expected type  finite_set[T]
  double_TCC1: OBLIGATION
    FORALL (x: T, y: T): is_finite[T]({t: T | t = x OR t = y});


decl_type: tcc
theory: matroids
library: graphs
signature: nil
location: 96 0 101 999
body:
  % Subtype TCC generated (at line 52, column 71) for  a
      % expected type  (elem(M1))
  extend_TCC1: OBLIGATION
    FORALL (M1: Matroid, M2: Matroid, (f: [(elem(M1)) -> (elem(M2))]),
            A: Subsets(elem(M1)), t: T, a: (A)):
      elem(M1)(a);


decl_type: tcc
theory: matroids
library: graphs
signature: nil
location: 103 0 109 999
body:
  % Subtype TCC generated (at line 52, column 43) for
      % {t: T | (EXISTS (a: (A)): f(a) = t)}
      % expected type  finite_set[T]
  extend_TCC2: OBLIGATION
    FORALL (M1: Matroid, M2: Matroid, (f: [(elem(M1)) -> (elem(M2))]),
            A: Subsets(elem(M1))):
      is_finite[T]({t: T | EXISTS (a: (A)): f(a) = t});


decl_type: formula
theory: doubletons
library: graphs
signature: nil
location: 29 3 32 68
body:
     dbl_rest_choose        : LEMMA x /= y IMPLIES
                                    (choose(dbl(x,y)) /= choose(rest(dbl(x,y)))) AND 
                                    (choose(rest(dbl(x,y))) = x 
                                        OR choose(rest(dbl(x,y))) = y)


decl_type: formula
theory: doubletons
library: graphs
signature: nil
location: 42 3 44 64
body:
     dbl_to_pair_lem        : LEMMA x /= y IMPLIES
                                     dbl_to_pair(dbl(x,y)) = (x,y) OR
                                     dbl_to_pair(dbl(x,y)) = (y,x) 


decl_type: formula
theory: doubletons
library: graphs
signature: nil
location: 48 3 49 59
body:
     dbl_proj               : LEMMA D(PROJ_1(dbl_to_pair(D))) AND
                                    D(PROJ_2(dbl_to_pair(D)))


decl_type: formula
theory: doubletons
library: graphs
signature: nil
location: 51 3 52 32
body:
     proj_dbl: LEMMA (PROJ_1(dbl_to_pair(D)) = v OR PROJ_2(dbl_to_pair(D)) = v)
                      IMPLIES D(v)


decl_type: formula
theory: doubletons
library: graphs
signature: nil
location: 54 3 55 62
body:
     dbl_eq: LEMMA dbl(x,y) = dbl(v,z) IMPLIES
                          (x = v AND y = z) OR (x = z AND y = v)


decl_type: function
theory: doubletons
library: graphs
signature: [finseq[T] -> finseq[T]]
location: 88 2 90 31
body:
    rev(fs: finseq[T]): finseq[T] = (# length := length(fs),
                                    seq := (LAMBDA (i: below(length(fs))): seq(fs)(length(fs)-1-i))
                               #)


decl_type: tcc
theory: doubletons
library: graphs
signature: nil
location: 120 0 123 999
body:
  % Subtype TCC generated (at line 62, column 39) for  dbl(x, y)
      % expected type  S: finite_set[T]
  card_dbl_TCC1: OBLIGATION
    FORALL (x, y: T): x /= y IMPLIES is_finite[T](dbl(x, y));


