# TheoryBodies

body:
  continuous_functions_props[ T : TYPE FROM real] : THEORY
  %--------------------------------------------------------
  %  More properties of continuous functions [T1 -> T2]  %
  %  Applications of continuity_interval                 %
  %--------------------------------------------------------
  BEGIN

     ASSUMING

     connected_domain : ASSUMPTION
   	FORALL (x, y : T), (z : real) :
   	    x <= z AND z <= y IMPLIES T_pred(z)

     ENDASSUMING

    IMPORTING continuity_interval

    f : VAR [T -> real]

    a, b, c, d : VAR T

    sub_interval : LEMMA
  	FORALL (c : T), (d : {x : T | c <= x}), (u : J[c, d]) : T_pred(u)
  	

    %----------------------------------------
    %  Restriction to a sub-interval of T1
    %----------------------------------------

    R(f, (c : T), (d : {x : T | c <= x})) : [J[c,d] -> real] =
  	LAMBDA (u : J[c, d]) : f(u)


    %-----------------------------------------------------
    %  If f is continuous, its restriction is continuous
    %-----------------------------------------------------

    g : VAR { f | continuous?(f) } 

    continuous_in_subintervals : LEMMA
  	a <= b IMPLIES continuous?(R(g, a, b))


    %------------------------------
    %  Intermediate value theorem
    %------------------------------

    x, y, z : VAR real

    intermediate1 : LEMMA a <= b AND g(a) <= x AND x <= g(b) IMPLIES
  	                  EXISTS c : a <= c AND c <= b AND g(c) = x

    intermediate2 : LEMMA a <= b AND g(b) <= x AND x <= g(a) IMPLIES
  	                  EXISTS c : a <= c AND c <= b AND g(c) = x


    %----------------------------------
    %  Max and minimum in an interval
    %----------------------------------

    max_in_interval : LEMMA a <= b IMPLIES
  	                   EXISTS c : a <= c AND c <= b AND 
  		            (FORALL d : a <= d AND d <= b IMPLIES g(d) <= g(c))

    min_in_interval : LEMMA a <= b IMPLIES
  	                   EXISTS c : a <= c AND c <= b AND 
  		            (FORALL d : a <= d AND d <= b IMPLIES g(c) <= g(d))


    %---------------------------------------------------------
    %  Injective, continuous functions are strictly monotone
    %---------------------------------------------------------

    inj_continuous : LEMMA injective?(g) AND a <= b AND b <= c IMPLIES
  	                    (g(a) <= g(b) AND g(b) <= g(c))
  	                    OR (g(c) <= g(b) AND g(b) <= g(a))

    inj_monotone   : LEMMA injective?(g) IFF
  	                    strict_increasing?(g) OR strict_decreasing?(g)

  END continuous_functions_props

addendum:
  %%% ================ Addendum: generated declarations ================

  % Subtype TCC generated (at line 31, column 26) for  u
      % expected type  T
  R_TCC1: OBLIGATION
    FORALL ((c: T), (d: {x: T | c <= x}), u: J[c, d]): T_pred(u);


body:
  deriv_domain_def[T : TYPE FROM real]: THEORY
  BEGIN

     deriv_domain?: bool = FORALL (e: posreal, x:T):
                                    EXISTS (y: {u: nzreal | T_pred(u + x)}): abs(y) < e

     not_one_element?: bool = (FORALL (x: T): EXISTS (y: T): x /= y)

     connected?: bool =   FORALL (x, y : T), (z : real): x <= z AND z <= y IMPLIES T_pred[T](z)


     connected_deriv_domain: LEMMA connected? AND not_one_element?
                              IMPLIES deriv_domain?

     del_neigh_all?: bool = FORALL (a: T): EXISTS (del: posreal): FORALL (xx:real):
                              abs(xx-a) < del IMPLIES T_pred[T](xx)


  %  The following lemma shows that our derivative domain is more general than just
  %  having a delta neighborhood around every point.

     del_neigh_all_lem : LEMMA del_neigh_all? IMPLIES deriv_domain?


  END deriv_domain_def


body:
  derivatives_def  [ T : TYPE FROM real ] : THEORY
  %-----------------------------------------------------------------------------------------
  %
  %    The derivatives library has been generalized to handle a larger class of domains.
  %    Previously the domain had to be a connected domain defined by the following
  %    predicate:
  %
  %       connected_domain : ASSUMPTION
  %           FORALL (x, y : T), (z : real) :
  %               x <= z AND z <= y IMPLIES T_pred(z)
  %
  %    The following more general domain definition is now used
  %
  %        deriv_domain    : ASSUMPTION FORALL (e: posreal, x:T):
  %                                        EXISTS (y: {u: nzreal | T_pred(u + x)}): abs(y) < e
  %
  %    This definition allows unions of closed and open intervals.
  %    See deriv_domains for more information.
  %
  %-----------------------------------------------------------------------------------------
  BEGIN

    ASSUMING
      IMPORTING deriv_domain_def

      deriv_domain     : ASSUMPTION deriv_domain?[T]

      not_one_element  : ASSUMPTION not_one_element?[T]

    ENDASSUMING

    IMPORTING lim_of_functions, continuous_functions

    f, f1, f2, fp : VAR [T -> real]
    g : VAR [T -> nzreal]
    x : VAR T
    u : VAR nzreal
    b : VAR real
    l, l1, l2 : VAR real


    %-------------------
    %  Newton Quotient 
    %-------------------

    A(x) : setof[nzreal] = { u: nzreal | T_pred(x + u) }

    NQ(f, x)(h : (A(x))) : real = (f(x + h) - f(x)) / h

    deriv_TCC : LEMMA FORALL x : adh[(A(x))](fullset[real])(0)
    adh_A_lem : LEMMA adh[(A(x))](fullset[real])(0)   %% Butler

  %   play: LEMMA (FORALL (x:T): EXISTS (e: posreal):  
  %      FORALL (y: real): abs(x-y) < e IMPLIES T_pred(y))
  %               IMPLIES
  %                  adh[(A(x))](fullset[real])(0)

    %----------------------------
    %  Differentiable functions
    %----------------------------

    derivable?(f, x) : bool = convergent?(NQ(f, x), 0)

  %% +++  derivable?(f) : bool = FORALL x : derivable?(f, x)


    %--------------------------------------
    %  Derivable functions are continuous
    %--------------------------------------

    continuous_lim  : LEMMA convergence(LAMBDA (h : (A(x))) : f(x + h), 0, f(x))
                              IFF continuous?(f, x)

    deriv_continuous      : LEMMA convergence(NQ(f, x), 0, l) 
                                    IMPLIES continuous?(f, x)   

    derivable_continuous  : LEMMA derivable?(f, x) IMPLIES continuous?(f, x)


  %% +++  derivable_cont_fun : LEMMA derivable?(f) IMPLIES continuous?(f)


    %---------------------
    %  Properties of NQ
    %---------------------

    sum_NQ      : LEMMA NQ(f1 + f2, x) = NQ(f1, x) + NQ(f2, x)

    neg_NQ      : LEMMA NQ(- f, x) = - NQ(f, x)

    diff_NQ     : LEMMA NQ(f1 - f2, x) = NQ(f1, x) - NQ(f2, x)

    scal_NQ     : LEMMA NQ(b * f, x) = b * NQ(f, x)

    const_NQ    : LEMMA NQ(const_fun(b), x) = const_fun(0)

    identity_NQ : LEMMA NQ(I[T], x) = const_fun(1)


    prod_NQ     : LEMMA FORALL (h : (A(x))): NQ(f1 * f2, x)(h) 
                              = NQ(f1, x)(h) * f2(x) + NQ(f2, x)(h) * f1(x + h)

    cnv_seq_prod_NQ: LEMMA convergence(NQ(f1, x), 0, l1)
                            AND convergence(NQ(f2, x), 0, l2)
                IMPLIES convergence(NQ(f1 * f2, x), 0, f2(x) * l1 + f1(x) * l2)


    inv_NQ         : LEMMA FORALL (h : (A(x))) : NQ(1/g, x)(h) 
                                     = - NQ(g, x)(h) / (g(x) * g(x + h))
    
    cnv_seq_inv_NQ : LEMMA convergence(NQ(g, x), 0, l1)
                         IMPLIES convergence(NQ(1/g, x), 0, - l1 / (g(x) * g(x)))


    %---------------------------------------
    %  Operations preserving derivability
    %---------------------------------------
   
    sum_derivable     : LEMMA derivable?(f1, x) AND derivable?(f2, x)
                                 IMPLIES derivable?(f1 + f2, x)

    neg_derivable     : LEMMA derivable?(f, x) IMPLIES derivable?(- f, x)

    diff_derivable    : LEMMA derivable?(f1, x) AND derivable?(f2, x)
                                 IMPLIES derivable?(f1 - f2, x)

    prod_derivable    : LEMMA derivable?(f1, x) AND derivable?(f2, x)
                                 IMPLIES derivable?(f1 * f2, x)

    scal_derivable    : LEMMA derivable?(f, x) IMPLIES derivable?(b * f, x)

    const_derivable   : LEMMA derivable?(const_fun(b), x)

    inv_derivable     : LEMMA derivable?(g, x) IMPLIES derivable?(1/g, x)

    div_derivable     : LEMMA derivable?(f, x) AND derivable?(g, x)
                                 IMPLIES derivable?(f / g, x)

    identity_derivable: LEMMA derivable?(I, x)


    %--------------
    %  Derivative
    %--------------

    deriv(f, (x0 : { x | derivable?(f, x) })) : real = lim(NQ(f, x0), 0)

    deriv_def   : LEMMA convergence(NQ(f, x), 0, l) IMPLIES
                     derivable?(f,x) AND deriv(f,x) = l

    deriv_sum   : LEMMA derivable?(f1, x) AND derivable?(f2, x) IMPLIES
                        deriv(f1 + f2, x) = deriv(f1, x) + deriv(f2, x)

    deriv_neg   : LEMMA derivable?(f, x) IMPLIES 
                        deriv(- f, x) = - deriv(f, x)

    deriv_diff  : LEMMA derivable?(f1, x) AND derivable?(f2, x) IMPLIES
                           deriv(f1 - f2, x) = deriv(f1, x) - deriv(f2, x)

    deriv_prod  : LEMMA derivable?(f1, x) AND derivable?(f2, x) IMPLIES
                           deriv(f1 * f2, x) = deriv(f1, x) * f2(x) 
                                               + deriv(f2, x) * f1(x)

    deriv_const : LEMMA deriv(const_fun(b), x) = 0

    deriv_scal  : LEMMA derivable?(f, x) IMPLIES deriv(b * f, x) = b * deriv(f, x)

    deriv_inv   : LEMMA derivable?(g, x) IMPLIES
                           deriv(1/g, x) = - deriv(g, x) / (g(x) * g(x))

    deriv_div   : LEMMA derivable?(f, x) AND derivable?(g, x) IMPLIES 
                           deriv(f / g, x) = 
                                 (deriv(f,x)*g(x) - deriv(g,x)*f(x))/(g(x)*g(x))

    deriv_identity : LEMMA deriv(I[T], x) = 1


  END derivatives_def

addendum:
  %%% ================ Addendum: generated declarations ================

  % Subtype TCC generated (at line 48, column 35) for  x + h
      % expected type  T
  NQ_TCC1: OBLIGATION FORALL (x: T, h: (A(x))): T_pred(x + h);

  % Subtype TCC generated (at line 146, column 68) for  0
      % expected type  {a | convergent?[(A(x0))](NQ(f, x0), a)}
  deriv_TCC1: OBLIGATION
    FORALL (f: [T -> real], (x0: {x | derivable?(f, x)})):
      convergent?[(A(x0))](NQ(f, x0), 0);

  % Subtype TCC generated (at line 152, column 37) for  x
      % expected type  {x | derivable?(f1 + f2, x)}
  deriv_sum_TCC1: OBLIGATION
    FORALL (f1, f2: [T -> real], x: T):
      derivable?(f2, x) AND derivable?(f1, x) IMPLIES
       derivable?((+[T])(f1, f2), x);

  % Subtype TCC generated (at line 155, column 33) for  x
      % expected type  {x | derivable?(-f, x)}
  deriv_neg_TCC1: OBLIGATION
    FORALL (f: [T -> real], x: T): derivable?(f, x) IMPLIES derivable?(-f, x);

  % Subtype TCC generated (at line 158, column 40) for  x
      % expected type  {x | derivable?(f1 - f2, x)}
  deriv_diff_TCC1: OBLIGATION
    FORALL (f1, f2: [T -> real], x: T):
      derivable?(f2, x) AND derivable?(f1, x) IMPLIES
       derivable?((-[T])(f1, f2), x);

  % Subtype TCC generated (at line 161, column 40) for  x
      % expected type  {x | derivable?(f1 * f2, x)}
  deriv_prod_TCC1: OBLIGATION
    FORALL (f1, f2: [T -> real], x: T):
      derivable?(f2, x) AND derivable?(f1, x) IMPLIES
       derivable?(*[T](f1, f2), x);

  % Subtype TCC generated (at line 164, column 42) for  x
      % expected type  {x | derivable?(const_fun(b), x)}
  deriv_const_TCC1: OBLIGATION
    FORALL (b: real, x: T): derivable?(const_fun[T](b), x);

  % Subtype TCC generated (at line 166, column 60) for  x
      % expected type  {x | derivable?(b * f, x)}
  deriv_scal_TCC1: OBLIGATION
    FORALL (b: real, f: [T -> real], x: T):
      derivable?(f, x) IMPLIES derivable?(*[T](b, f), x);

  % Subtype TCC generated (at line 169, column 36) for  x
      % expected type  {x | derivable?(1 / g, x)}
  deriv_inv_TCC1: OBLIGATION
    FORALL (g: [T -> nzreal], x: T):
      derivable?(g, x) IMPLIES derivable?(/[T](1, g), x);

  % Subtype TCC generated (at line 172, column 38) for  x
      % expected type  {x | derivable?(f / g, x)}
  deriv_div_TCC1: OBLIGATION
    FORALL (f: [T -> real], g: [T -> nzreal], x: T):
      derivable?(g, x) AND derivable?(f, x) IMPLIES derivable?(/[T](f, g), x);

  % Subtype TCC generated (at line 175, column 37) for  x
      % expected type  {x | derivable?(I[T], x)}
  deriv_identity_TCC1: OBLIGATION FORALL (x: T): derivable?(I[T], x);


body:
  derivatives [T: TYPE FROM real ] : THEORY
  %-----------------------------------------------------------------------------------------
  %
  %    The derivatives library has been generalized to handle a larger class of domains.
  %    The following more general domain definition is now used
  %
  %        deriv_domain    : ASSUMPTION FORALL (e: posreal, x:T):
  %                                        EXISTS (y: {u: nzreal | T_pred(u + x)}): abs(y) < e
  %
  %    This definition allows unions of closed and open intervals.
  %    See deriv_domain and deriv_domains for more information and useful lemmas.
  %    
  %    See "derivatives_lam" for lambda-expression versions of the lemmas that are especially
  %    suited to rewriting.  Note that when you expand a function, the PVS system does not
  %    expand the definition using the real_fun_ops.  Instead it exapnds them using
  %    lambda expressions.
  %
  %-----------------------------------------------------------------------------------------
  BEGIN

    ASSUMING
      IMPORTING deriv_domain_def

      deriv_domain     : ASSUMPTION deriv_domain?[T]

      not_one_element  : ASSUMPTION not_one_element?[T]

    ENDASSUMING

    IMPORTING derivatives_def[T]

    f, f1, f2, fp : VAR [T -> real]
    g : VAR [T -> nzreal]
    x : VAR T
    u : VAR nzreal
    b : VAR real
    l, l1, l2 : VAR real


    derivable?(f) : bool = FORALL x : derivable?(f, x)
    
    differentiable?(f): MACRO bool = derivable?(f)

    deriv_fun    : TYPE = { f:[T -> real] | derivable?(f) }

    nz_deriv_fun : TYPE = { g:[T -> nzreal] | derivable?(g) }

    deriv(ff: deriv_fun)    : [T -> real] = LAMBDA x : deriv(ff, x)


    derivable_cont_fun     : LEMMA derivable?(f) IMPLIES continuous?(f)


    sum_derivable_fun      : LEMMA derivable?(f1) AND derivable?(f2)
                                 IMPLIES derivable?(f1 + f2)

    neg_derivable_fun      : LEMMA derivable?(f) IMPLIES derivable?(- f)

    diff_derivable_fun     : LEMMA derivable?(f1) AND derivable?(f2)
                                 IMPLIES derivable?(f1 - f2)

    prod_derivable_fun     : LEMMA derivable?(f1) AND derivable?(f2)
                                 IMPLIES derivable?(f1 * f2)

    scal_derivable_fun     : LEMMA derivable?(f) IMPLIES derivable?(b * f)

    const_derivable_fun    : LEMMA derivable?(LAMBDA x: b)

    inv_derivable_fun      : LEMMA derivable?(g) IMPLIES derivable?(1/g)

    div_derivable_fun      : LEMMA derivable?(f) AND derivable?(g)
                               IMPLIES derivable?(f / g)

    identity_derivable_fun : LEMMA derivable?(I)

    id_derivable_fun       : LEMMA derivable?(LAMBDA x: x)
          

    ff, ff1, ff2 : VAR deriv_fun
    gg : VAR nz_deriv_fun

    derivable_cont   : JUDGEMENT deriv_fun SUBTYPE_OF continuous_fun[T]

    nz_derivable_cont: JUDGEMENT nz_deriv_fun SUBTYPE_OF nz_continuous_fun[T]

    derivable_sum    : JUDGEMENT +(ff1, ff2) HAS_TYPE deriv_fun

    derivable_diff   : JUDGEMENT -(ff1, ff2) HAS_TYPE deriv_fun

    derivable_prod   : JUDGEMENT *(ff1, ff2) HAS_TYPE deriv_fun

    derivable_scal   : JUDGEMENT *(b, ff) HAS_TYPE deriv_fun

    derivable_neg    : JUDGEMENT -(ff) HAS_TYPE deriv_fun

    derivable_div    : JUDGEMENT /(ff, gg) HAS_TYPE deriv_fun

    derivable_inv    : JUDGEMENT /(b, gg) HAS_TYPE deriv_fun

    derivable_const  : JUDGEMENT const_fun(b) HAS_TYPE deriv_fun

    derivable_id     : JUDGEMENT I[T] HAS_TYPE deriv_fun


    %------------------------
    %  Derivative function
    %------------------------

    deriv_fun_def: LEMMA (FORALL x: convergence(NQ(f, x), 0, fp(x))) IMPLIES
                          derivable?(f) AND deriv(f) = fp

    deriv_sum_fun  : LEMMA deriv(ff1 + ff2) = deriv(ff1) + deriv(ff2)

    deriv_neg_fun  : LEMMA deriv(- ff) = - deriv(ff)

    deriv_diff_fun : LEMMA deriv(ff1 - ff2) = deriv(ff1) - deriv(ff2)

    deriv_prod_fun : LEMMA deriv(ff1 * ff2) = deriv(ff1) * ff2 + deriv(ff2) * ff1

    deriv_scal_fun : LEMMA deriv(b * ff) = b * deriv(ff)

    deriv_inv_fun  : LEMMA deriv(1 / gg) = - deriv(gg) / (gg * gg)

    deriv_scaldiv_fun : LEMMA deriv(b / gg) = - (b * deriv(gg)) / (gg * gg)

    deriv_div_fun  : LEMMA deriv(ff / gg) = (deriv(ff)*gg - deriv(gg)*ff)/(gg*gg)

    deriv_const_fun: LEMMA deriv(LAMBDA x: b) = (LAMBDA x: 0)

    deriv_const_func: LEMMA deriv(const_fun(b)) = const_fun(0)

    deriv_id_fun    : LEMMA deriv(LAMBDA x: x) = (LAMBDA x: 1)

    deriv_I_fun     : LEMMA deriv(I) = (LAMBDA x: 1)

  % ------------------ following added by Rick Butler ---------------------

    n: VAR nat
  %  ^(f,n): [T -> real] =  (LAMBDA (t:T): f(t)^n)

    deriv_linear_fun: LEMMA FORALL (m,b: real):
                              LET f = (LAMBDA x: m*x + b) IN
                                 derivable?(f) AND deriv(f) = (LAMBDA x: m)

    deriv_exp_fun: LEMMA derivable?(f) AND n > 0 IMPLIES
                         derivable?(f^n) AND
                         deriv(f^n) = n*f^(n-1)*deriv(f)

    
    deriv_x_n    : LEMMA n > 0 AND f = (LAMBDA x: x^n) IMPLIES
                            derivable?(f) AND deriv(f) = (LAMBDA x: n*x^(n-1))

    deriv_x_to_n : LEMMA FORALL (n: posnat, a: real):
                           LET f = (LAMBDA x: a*x^n) IN
                              derivable?(f) AND deriv(f) = (LAMBDA x: a*n*x^(n-1))

  END derivatives

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 30, column 12) for  derivatives_def[T]
      % generated from assumption derivatives_def.deriv_domain
  IMP_derivatives_def_TCC1: OBLIGATION deriv_domain?[T];

  % Assuming TCC generated (at line 30, column 12) for  derivatives_def[T]
      % generated from assumption derivatives_def.not_one_element
  IMP_derivatives_def_TCC2: OBLIGATION not_one_element?[T];

  % Subtype TCC generated (at line 48, column 63) for  x
      % expected type  {x | derivable?(ff, x)}
  deriv_TCC1: OBLIGATION FORALL (ff: deriv_fun, x): derivable?[T](ff, x);

  % Judgement subtype TCC generated (at line 82, column 31) for  x
      % expected type  continuous_fun[T]
  derivable_cont: OBLIGATION FORALL (x: deriv_fun): continuous?[T](x);

  % Judgement subtype TCC generated (at line 84, column 31) for  x
      % expected type  nz_continuous_fun[T]
  nz_derivable_cont: OBLIGATION FORALL (x: nz_deriv_fun): continuous?[T](x);

  % Judgement subtype TCC generated (at line 86, column 31) for  ff1 + ff2
      % expected type  deriv_fun
  derivable_sum: OBLIGATION FORALL (ff1, ff2): derivable?((+[T])(ff1, ff2));

  % Judgement subtype TCC generated (at line 88, column 31) for  ff1 - ff2
      % expected type  deriv_fun
  derivable_diff: OBLIGATION FORALL (ff1, ff2): derivable?((-[T])(ff1, ff2));

  % Judgement subtype TCC generated (at line 90, column 31) for  ff1 * ff2
      % expected type  deriv_fun
  derivable_prod: OBLIGATION FORALL (ff1, ff2): derivable?(*[T](ff1, ff2));

  % Judgement subtype TCC generated (at line 92, column 31) for  b * ff
      % expected type  deriv_fun
  derivable_scal: OBLIGATION FORALL (b, ff): derivable?(*[T](b, ff));

  % Judgement subtype TCC generated (at line 94, column 31) for  -ff
      % expected type  deriv_fun
  derivable_neg: OBLIGATION FORALL (ff): derivable?(-ff);

  % Judgement subtype TCC generated (at line 96, column 31) for  ff / gg
      % expected type  deriv_fun
  derivable_div: OBLIGATION FORALL (ff, gg): derivable?(/[T](ff, gg));

  % Judgement subtype TCC generated (at line 98, column 31) for  b / gg
      % expected type  deriv_fun
  derivable_inv: OBLIGATION FORALL (b, gg): derivable?(/[T](b, gg));

  % Judgement subtype TCC generated (at line 100, column 31) for  const_fun(b)
      % expected type  deriv_fun
  derivable_const: OBLIGATION FORALL (b): derivable?(const_fun[T](b));

  % Judgement subtype TCC generated (at line 102, column 31) for  I[T]
      % expected type  deriv_fun
  derivable_id: OBLIGATION derivable?(I[T]);

  % Subtype TCC generated (at line 122, column 56) for  (gg * gg)
      % expected type  [T -> nzreal]
  deriv_inv_fun_TCC1: OBLIGATION
    FORALL (gg: nz_deriv_fun, x1: T): (*[T](gg, gg))(x1) /= 0;

  % Subtype TCC generated (at line 128, column 31) for  LAMBDA x: b
      % expected type  deriv_fun
  deriv_const_fun_TCC1: OBLIGATION FORALL (b: real): derivable?(LAMBDA x: b);

  % Subtype TCC generated (at line 132, column 32) for  LAMBDA x: x
      % expected type  deriv_fun
  deriv_id_fun_TCC1: OBLIGATION derivable?(LAMBDA x: x);

  % Subtype TCC generated (at line 147, column 41) for  (n - 1)
      % expected type  nat
  deriv_exp_fun_TCC1: OBLIGATION
    FORALL (f: [T -> real], n: nat):
      n > 0 AND derivable?(f) AND derivable?(f ^ n) IMPLIES (n - 1) >= 0;

  % Subtype TCC generated (at line 150, column 50) for  n
      % expected type  {i: int | x /= 0 OR i >= 0}
  deriv_x_n_TCC1: OBLIGATION
    FORALL (n: nat): n > 0 IMPLIES (FORALL (x): x /= 0 OR n >= 0);

  % Subtype TCC generated (at line 151, column 71) for  (n - 1)
      % expected type  {i: int | x /= 0 OR i >= 0}
  deriv_x_n_TCC2: OBLIGATION
    FORALL (f: [T -> real], n: nat):
      (f = (LAMBDA x: x ^ n)) AND n > 0 AND derivable?(f) IMPLIES
       (FORALL (x1): x1 /= 0 OR (n - 1) >= 0);

  % Subtype TCC generated (at line 154, column 48) for  n
      % expected type  {i: int | x /= 0 OR i >= 0}
  deriv_x_to_n_TCC1: OBLIGATION FORALL (n: posnat, x): x /= 0 OR n >= 0;

  % Subtype TCC generated (at line 155, column 75) for  (n - 1)
      % expected type  {i: int | x /= 0 OR i >= 0}
  deriv_x_to_n_TCC2: OBLIGATION
    FORALL (n: posnat, a: real, f: [T -> real]):
      derivable?(f) AND f = (LAMBDA x: a * x ^ n) IMPLIES
       (FORALL (x1): x1 /= 0 OR (n - 1) >= 0);


body:
  derivatives_alt [ T : TYPE FROM real ] : THEORY
  BEGIN

    ASSUMING

      IMPORTING deriv_domain_def

      deriv_domain     : ASSUMPTION deriv_domain?[T]

      not_one_element : ASSUMPTION not_one_element?[T]

    ENDASSUMING

    IMPORTING derivatives, continuous_functions_props

    AUTO_REWRITE-  abs_neg




    f, fp : VAR [T -> real]
    x, y, a, b, c : VAR T
    D : VAR real


    %--------------------------------------------
    %  Equivalent definitions of differentiation
    %--------------------------------------------

    derivative_equivalence1 : LEMMA (derivable?(f, x) AND deriv(f, x) = D) 
                                      IFF convergence(NQ(f, x), 0, D)

    derivative_equivalence2 : LEMMA convergence(NQ(f, x), 0, D)
                       IFF (EXISTS (phi : [T -> real]) : convergence(phi, x, 0)
                           AND FORALL y : f(y) - f(x) = (y - x) * (D + phi(y)))


    derivative_equivalence3 : LEMMA (derivable?(f,x) AND deriv(f,x) = D) %% Lester
                        IFF (EXISTS (psi : [T -> real]) : convergence(psi, x, D)
                               AND FORALL y : f(y) - f(x) = (y - x) * psi(y))

    epsi_eq_0: LEMMA (FORALL (epsi: posreal): abs(x) < epsi) IFF x = 0

    derivative_squeeze      : LEMMA convergence(NQ(f, x), 0, fp(x))    %% Butler
                                    IFF  (EXISTS (HH: [(A(x)) -> real]): 
                                          convergence(HH,0,0) AND
                                 HH = (LAMBDA (h: (A(x))): (NQ(f,x)(h) - fp(x))))


    derivative_squeeze_delta: LEMMA convergence(NQ(f, x), 0, fp(x))    %% Butler
                                    IFF (EXISTS (HH: [(A(x)) -> real]): 
                                        convergence(HH,0,0) AND 
                                        (EXISTS (delta: posreal):
                                    (FORALL (h: (A(x))): (abs(h) < delta) IMPLIES
                                             abs(NQ(f,x)(h) - fp(x)) <= HH(h))))
            

    %------------------------------------
    %  f constant on [a, b]
    %------------------------------------

    deriv_constant1 : LEMMA a < c AND c < b AND 
                            (FORALL x : a < x AND x < b IMPLIES f(x) = f(c))
                                IMPLIES convergence(NQ(f, c), 0, 0)

    deriv_constant2 : LEMMA a < c AND c < b AND 
                            (FORALL x : a < x AND x < b IMPLIES f(x) = f(c))
                                IMPLIES derivable?(f, c) AND deriv(f, c) = 0


  END derivatives_alt

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 30, column 12) for  derivatives_def[T]
      % generated from assumption derivatives_def.deriv_domain
  derivative_equivalence1_TCC1: OBLIGATION deriv_domain?[T];

  % Assuming TCC generated (at line 30, column 12) for  derivatives_def[T]
      % generated from assumption derivatives_def.not_one_element
  derivative_equivalence1_TCC2: OBLIGATION not_one_element?[T];


body:
  derivative_props [ T : TYPE FROM real ] : THEORY
  BEGIN

    ASSUMING
       IMPORTING deriv_domain_def

       connected_domain : ASSUMPTION connected?[T]

       not_one_element : ASSUMPTION not_one_element?[T]

    ENDASSUMING

    IMPORTING derivatives_alt[T], continuous_functions_props

  %  AUTO_REWRITE-  abs_0
    AUTO_REWRITE-  abs_neg

    deriv_domain: LEMMA deriv_domain?[T]


    f, fp : VAR [T -> real]
    x, y, a, b, c : VAR T
    D : VAR real

    %--------------------------------------

    deriv_maximum : LEMMA
          a < c AND c < b AND derivable?(f, c) AND
          (FORALL x : a < x AND x < b IMPLIES f(x) <= f(c))
      IMPLIES deriv(f, c) = 0


    deriv_minimum : LEMMA
          a < c AND c < b AND derivable?(f, c) AND
          (FORALL x : a < x AND x < b  IMPLIES f(c) <= f(x))
      IMPLIES deriv(f, c) = 0


    %-----------------------
    %  Mean value theorem
    %-----------------------

    mean_value_aux : LEMMA derivable?(f) AND a < b AND f(a) = f(b) IMPLIES
                             EXISTS c : a < c AND c < b AND deriv(f, c) = 0

    mean_value : THEOREM derivable?(f) AND a < b IMPLIES
                             EXISTS c : a < c AND c < b AND 
                                        deriv(f, c) * (b - a) = f(b) - f(a)


    mean_value_abs : THEOREM derivable?(f) AND a /= b IMPLIES  % BUTLER
                             EXISTS c: min(a,b) < c AND c < max(a,b) AND 
                                abs(deriv(f, c)) * abs(b - a) = abs(f(b) - f(a))


    %------------------------------------------
    %  Applications of the mean value theorem
    %------------------------------------------

    g : VAR deriv_fun[T]

    nonneg_derivative : LEMMA increasing?(g) IFF (FORALL x : deriv(g, x) >= 0)

    nonpos_derivative : LEMMA decreasing?(g) IFF (FORALL x : deriv(g, x) <= 0)

    positive_derivative : LEMMA (FORALL x: deriv(g, x) > 0) 
                                    IMPLIES strict_increasing?(g)

    negative_derivative : LEMMA (FORALL x : deriv(g, x) < 0) 
                                    IMPLIES strict_decreasing?(g)

    null_derivative : LEMMA constant?(g) IFF (FORALL x : deriv(g, x) = 0)

  %% --- David Lester Additions ---

    minimum_derivative: LEMMA deriv(g)(x) = 0 AND x /= y AND
                            (FORALL (y:T): y /= x IMPLIES deriv(g)(y)*(y-x) > 0) 
                               IMPLIES g(x) < g(y)

    maximum_derivative: LEMMA deriv(g)(x) = 0 AND x /= y AND
                            (FORALL (y:T): y /= x IMPLIES deriv(g)(y)*(y-x) < 0) 
                               IMPLIES g(y) < g(x)

    strict_minimum_derivative: LEMMA strict_increasing?(deriv(g)) AND 
                                     deriv(g)(x) = 0 AND x /= y
                                        IMPLIES g(x) < g(y)

    strict_maximum_derivative: LEMMA strict_decreasing?(deriv(g)) AND 
                                     deriv(g)(x) = 0 AND x /= y
                                        IMPLIES g(y) < g(x)



    monotonic_antideriv: LEMMA FORALL (a, b: T, f, g: deriv_fun[T]):
      (FORALL (x:T): deriv(f)(x) >= deriv(g)(x)) AND
      a <= b =>
      f(b) - f(a) >= g(b) - g(a)

    derivative_alt : LEMMA FORALL (D: real, ff: [T -> real], x: T):
  	convergence(NQ(ff, x), 0, D)
      IFF convergence(LAMBDA  (y: {yy:T|yy/=x}): (ff(y) - ff(x))/(y - x), x, D)

    derivative_fun_alt : LEMMA FORALL (ff, gg: [T -> real]):
  	derivable?(ff) AND deriv(ff) = gg
      IFF (FORALL x: convergence(LAMBDA  (y: {yy:T|yy/=x}):
                         (ff(y) - ff(x))/(y - x), x, gg(x)))

    epsi_lt_le: LEMMA (FORALL (epsilon: posreal): x < epsilon) IFF
                 (FORALL (epsilon: posreal): x <= epsilon) 


  END derivative_props

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 13, column 12) for  derivatives_alt[T]
      % generated from assumption derivatives_alt.deriv_domain
  IMP_derivatives_alt_TCC1: OBLIGATION deriv_domain?[T];

  % Assuming TCC generated (at line 13, column 12) for  derivatives_alt[T]
      % generated from assumption derivatives_alt.not_one_element
  IMP_derivatives_alt_TCC2: OBLIGATION not_one_element?[T];

  % Subtype TCC generated (at line 44, column 67) for  c
      % expected type  {x | derivable?[T](f, x)}
  mean_value_aux_TCC1: OBLIGATION
    FORALL (a, b: T, f: [T -> real]):
      f(a) = f(b) AND a < b AND derivable?(f) IMPLIES
       (FORALL (c): c < b AND a < c IMPLIES derivable?[T](f, c));

  % Subtype TCC generated (at line 48, column 47) for  c
      % expected type  {x | derivable?[T](f, x)}
  mean_value_TCC1: OBLIGATION
    FORALL (a, b: T, f: [T -> real]):
      a < b AND derivable?(f) IMPLIES
       (FORALL (c): c < b AND a < c IMPLIES derivable?[T](f, c));

  % Subtype TCC generated (at line 53, column 43) for  c
      % expected type  {x | derivable?[T](f, x)}
  mean_value_abs_TCC1: OBLIGATION
    FORALL (a, b: T, f: [T -> real]):
      a /= b AND derivable?(f) IMPLIES
       (FORALL (c):
          c < max(a, b) AND min(a, b) < c IMPLIES derivable?[T](f, c));

  % Subtype TCC generated (at line 62, column 68) for  x
      % expected type  {x | derivable?[T](g, x)}
  nonneg_derivative_TCC1: OBLIGATION
    FORALL (g: deriv_fun[T], x): derivable?[T](g, x);

  % Subtype TCC generated (at line 101, column 64) for  (y - x)
      % expected type  nznum
  derivative_alt_TCC1: OBLIGATION
    FORALL (x: T, y: {yy: T | yy /= x}): (y - x) /= 0;


body:
  unif_cont_fun [ T : TYPE FROM real ] : THEORY
  %----------------------------------------------------------------------------
  %
  %  Additions made by Ricky W. Butler    NASA Langley
  %
  %----------------------------------------------------------------------------
  BEGIN

     ASSUMING
       IMPORTING deriv_domain_def

       connected_domain : ASSUMPTION connected?[T]

       not_one_element : ASSUMPTION not_one_element?[T]

     ENDASSUMING


    IMPORTING continuous_functions[T], convergence_sequences


    f, f1, f2 : VAR [T -> real]
    g : VAR [T -> nzreal]
    u : VAR real
    x, x0 : VAR T
    epsi, delta : VAR posreal

  %%%  E : VAR { S : setof[real] | subset?(S, T_pred) }

    E : VAR setof[T] 

    uniformly_continuous?(f, E) : bool =
          FORALL (epsi: posreal): EXISTS (delta: posreal):
  	   FORALL (x,y: (E)): abs(x-y) < delta IMPLIES
                                     abs(f(x) - f(y)) < epsi

    P3: VAR [real,real,posnat -> bool]

    getem_scaf4: LEMMA (FORALL (n: posnat): EXISTS (x,y: real): P3(x,y,n))
             IMPLIES (EXISTS (XX,YY: [posnat -> real]): 
                      FORALL (k: posnat):  P3(XX(k),YY(k),k))

    a,b,c: VAR T
    unif_cont_interval: LEMMA a < b IMPLIES   
                          LET D = {xx:T | a <= xx AND xx <= b} IN
                             continuous_on?(f,D) IMPLIES
                                uniformly_continuous?(f,D)

  END unif_cont_fun


body:
  continuous_functions_more [ T : TYPE FROM real ] : THEORY
  %----------------------------------------------------------------------------
  %
  %  Additions made by Ricky W. Butler    NASA Langley
  %
  %----------------------------------------------------------------------------
  BEGIN

     ASSUMING

       connected_domain : ASSUMPTION
  	FORALL (x, y : T), (z : real) :
  	    x <= z AND z <= y IMPLIES T_pred(z)

       not_one_element : ASSUMPTION
  	 FORALL (x : T) : EXISTS (y : T) : x /= y

     ENDASSUMING


    IMPORTING continuous_functions[T], convergence_sequences


    f: VAR [T -> real]
    a,b,c: VAR T
    cn: VAR sequence[T]
    n: VAR nat


    convergence_fun_of  : LEMMA convergence(cn,c) AND
                                 continuous?(f,c) IMPLIES  % move to analysis
                                   convergence(LAMBDA n: f(cn(n)),f(c))
    

    IMPORTING unif_cont_fun   %% to maintain upward compatibility

  END continuous_functions_more


body:
  integral_def[T: TYPE FROM real]: THEORY
  %----------------------------------------------------------------------------
  %
  %    Definition of Riemann Integral
  %    Author: Rick Butler
  %    Major Revision:  12/1/03
  %
  %----------------------------------------------------------------------------
  BEGIN

     ASSUMING
        IMPORTING deriv_domain_def[T]

        connected_domain : ASSUMPTION connected?[T]


        not_one_element : ASSUMPTION not_one_element?[T]

     ENDASSUMING


     IMPORTING finite_sets@finite_sets_minmax[real,<=] %, finite_sets_more

     AUTO_REWRITE+ finseq_appl

     a,b,x: VAR T
     f,g: VAR [T -> real]

  %   open_interval  (a:T,b:{x:T|a<x}): TYPE = { x | a <  x AND x <  b}
  %   closed_interval(a:T,b:{x:T|a<x}): TYPE = { x | a <= x AND x <= b}

     IMPORTING reals@intervals_real[T]

  % Unlike Rosenlicht index runs from 0 to N-1:

     partition(a:T,b:{x:T|a<x}): TYPE = 
                {fs: finite_sequence[closed_interval(a,b)] | 
                      Let N = length(fs), xx = seq(fs) IN
                      N > 1 AND xx(0) = a AND xx(N-1) = b AND
                      (FORALL (ii: below(N-1)): xx(ii) < xx(ii+1))}

     width(a:T, b:{x:T|a<x}, P: partition(a,b)): posreal =
               LET xx = seq(P), N = length(P) IN
                        max({ l: real | EXISTS (ii: below(N-1)):
                                           l = xx(ii+1) - xx(ii)}) 

     width_lem     : LEMMA (FORALL (a:T), (b:{x:T|a<x}),
                              (P: partition(a,b)),(ii: below(length(P)-1)):
                           width(a,b,P) >= P(ii+1) - P(ii))

     parts_order   : LEMMA  FORALL (P: partition(a,b), ii,jj: below(length(P))):
                                ii < jj IMPLIES seq(P)(ii) < seq(P)(jj)


     parts_order_le: LEMMA FORALL (P: partition(a,b),ii,jj: below(length(P))):
                               ii <= jj IMPLIES seq(P)(ii) <= seq(P)(jj)


     
     parts_disjoint: LEMMA FORALL (P: partition(a,b), ii,jj: below(length(P)-1)):
                               seq(P)(ii) < x AND x < seq(P)(1 + ii) AND
                               seq(P)(jj) < x AND x < seq(P)(1 + jj)
                               IMPLIES
                                  jj = ii

     in_part?(a:T, b:{x:T|a<x},P: partition(a,b),xx:T): MACRO bool = 
                          EXISTS (ii: below(length(P)-1)): xx = seq(P)(ii)

     in_sect?(a:T, b:{x:T|a<x},P: partition(a,b),
              ii: below(length(P)-1),xx:T): MACRO bool = 
                        seq(P)(ii) < xx AND xx < seq(P)(ii+1)


     part_in       : LEMMA FORALL (P: partition(a,b)):    
                               a < b AND a <= x AND x <= b IMPLIES
                                   (EXISTS (ii: below(length(P)-1)): 
                                         seq(P)(ii) <= x AND x <= seq(P)(ii+1))

     part_not_in       : LEMMA a < b IMPLIES FORALL (P: partition(a,b)):    
                                  FORALL (ii,jj: below(length(P)-1)): 
                                    seq(P)(ii) < x AND x < seq(P)(ii+1) 
                                  IMPLIES x /= seq(P)(jj)

     Prop: VAR [T -> bool]
     part_induction: LEMMA  (FORALL (P: partition(a,b)): 
                                (FORALL ( x: closed_interval(a,b)):
                             LET xx = seq(P), N = length(P) IN 
                     (FORALL (ii : below(N-1)):
                             xx(ii) <= x AND x <= xx(ii+1) IMPLIES
                                  Prop(x))
                    IMPLIES Prop(x) ) )


     IMPORTING reals@sigma_below, reals@sigma_upto

     eq_partition(a:T,b:{x:T|a<x},N: above(1)): partition(a,b) =
                    (# length := N,
                       seq := (LAMBDA (ii: below(N)): a + ii*(b-a)/(N-1)) #)


     xis?(a:T,b:{x:T|a<x},P:partition(a,b))
           (fs: [below(length(P)-1) -> closed_interval(a,b)]): bool = 
                (FORALL (ii: below(length(P)-1)): 
                       P(ii) <= fs(ii) AND fs(ii) <= P(ii+1))


  %   AUTO_REWRITE+ xis?


     xis_lem: LEMMA FORALL (P: partition(a,b), (xis: (xis?(a,b,P))),
                           (ii: below(length(P)-1))):
                           P(ii) <= xis(ii) AND xis(ii) <= P(ii+1)


  %   AUTO_REWRITE+ xis_lem



     Rie_sum(a:T,b:{x:T|a<x},P:partition(a,b),
                    xis: (xis?(a,b,P)),f:[T->real]): real =
                    LET N = length(P)-1 IN
            sigma[below(N)](0,N-1,(LAMBDA (n: below(N)):
                                         (P(n+1) - P(n)) * f(xis(n))))


     Rie_sec(a:T,b:{x:T|a<x},P:partition(a,b), xis: (xis?(a,b,P)), f:[T->real], 
             n: upto(length(P)-1)): real = 
                             IF n = 0 THEN 0
                             ELSE (seq(P)(n) - seq(P)(n - 1)) * f(xis(n-1)) 
                             ENDIF

     Rie_sum_alt(a:T,b:{x:T|a<x},P:partition(a,b),
                    xis: (xis?(a,b,P)),f:[T->real]): real =
                    LET N = length(P)-1 IN
                       sigma[upto(N)](1,N,(LAMBDA (n: upto(N)): 
                              Rie_sec(a,b,P,xis,f,n)))

     Rie_sum_alt_lem: LEMMA a < b IMPLIES
                              FORALL (P: partition(a,b), (xis: (xis?(a,b,P)))):
                                 Rie_sum(a,b,P,xis,f) = Rie_sum_alt(a,b,P,xis,f) 



     Riemann_sum?(a:T,b:{x:T|a<x},P:partition(a,b),f:[T->real])(S:real): bool =
       (EXISTS (xis: (xis?(a,b,P))): LET N = length(P)-1 IN
             S = Rie_sum(a,b,P,xis,f))
                             

     integral?(a:T,b:{x:T|a<x},f:[T->real],S:real): bool  = 
                  (FORALL (epsi: posreal): (EXISTS (delta: posreal):
                      (FORALL (P: partition(a,b)):
                          width(a,b,P) < delta IMPLIES
                             (FORALL (R: (Riemann_sum?(a,b,P,f))):
                                  abs(S - R) < epsi))))


     x_in(aa:T,bb:{x:T|aa<x}): {t: T | aa <= t AND t <= bb}

     pick_one(a:T,b:{x:T|a<x},P: partition(a,b))(ii: below(length(P)-1)): real =
                                 x_in(P(ii), P(ii+1)) 


     gen_xis(a:T,b:{x:T|a<x},P: partition(a,b)): (xis?(a,b,P)) = 
                                       (# length := length(P) - 1,
                                          seq :=  pick_one(a,b,P)
                                        #)


     N: VAR above(1)

     len_eq_part  : LEMMA a < b IMPLIES length(eq_partition(a,b,N)) = N 
     eq_part_lem_a: LEMMA a < b IMPLIES seq(eq_partition(a,b,N))(0) = a 
     eq_part_lem_b: LEMMA a < b IMPLIES seq(eq_partition(a,b,N))(N-1) = b

     width_eq_part: LEMMA a < b IMPLIES 
                              width(a,b,eq_partition(a,b,N)) = (b-a)/(N-1)


     delta: VAR posreal
     N_from_delta: LEMMA a < b IMPLIES
                            LET N = 2 + floor((b - a) / delta),
                                EP = eq_partition(a, b, N) IN
                            width(a, b, EP) < delta


     Riemann?_Rie: LEMMA a < b IMPLIES FORALL (P: partition(a,b),
                                               xis: (xis?(a,b,P))): 
                                 Riemann_sum?(a,b,P,f)(Rie_sum(a,b,P,xis,f)) 


  %   AUTO_REWRITE+ Riemann?_Rie

     A1, A2: VAR real
     integral_unique: LEMMA a < b AND integral?(a,b,f,A1) AND
                               integral?(a,b,f,A2) IMPLIES A1 = A2


     integrable?(a:T,b:{x:T|a<x},f:[T->real]): bool = 
                       (EXISTS (S: real): integral?(a,b,f,S))

     integral(a:T,b:{x:T|a<x}, ff: { f | integrable?(a,b,f)} ):
                      {S: real | integral?(a,b,ff,S)}


     s: VAR real
     integral_def: LEMMA a < b IMPLIES  
                     ( (integrable?(a,b,f) AND integral(a,b,f) = s)
                            IFF integral?(a,b,f,s) )


     % see integral_prep.integral_restr_eq for a stronger version (i.e. open interval)
     integral_restrict_eq: LEMMA a < b AND
                                  (FORALL x: a <= x AND x <= b IMPLIES
                                            f(x) = g(x)) AND
                                 integrable?(a,b,f)
                            IMPLIES integrable?(a,b,g) AND
                                     integral(a,b,g) = integral(a,b,f)


     Integrable?(a:T,b:T,f:[T->real]): bool = (a = b) OR
                                   (a < b AND integrable?(a,b,f)) OR
                                   (b < a  AND integrable?(b,a,f))


     Integrable_funs(a,b): TYPE = { f | Integrable?(a,b,f)} 
   
     Integral?(a:T,b:T,f:[T->real],S:real): bool = (a = b AND S = 0) OR
                                 (a < b AND integral?(a,b,f,S))
                                
    
     Integral(a:T,b:T,f:Integrable_funs(a,b)): real =
                       			  IF a = b THEN 0
                       			  ELSIF a < b THEN integral(a,b,f)
                       			  ELSE -integral(b,a,f)
                       			  ENDIF                


     Integrable?_rew   : LEMMA a < b AND Integrable?(a,b,f) IMPLIES integrable?(a,b,f)
     Integral_rew      : LEMMA a < b AND Integrable?(a,b,f) IMPLIES Integral(a,b,f) = integral(a,b,f)


  END integral_def

addendum:
  %%% ================ Addendum: generated declarations ================

  % Subtype TCC generated (at line 39, column 33) for  0
      % expected type  below[fs`length]
  partition_TCC1: OBLIGATION
    FORALL (a: T, b: {x: T | a < x},
            fs: finite_sequence[closed_interval(a, b)], N: nat):
      N = length(fs) IMPLIES
       (FORALL (xx: [below[fs`length] -> closed_interval[T](a, b)]):
          N > 1 AND xx = seq(fs) IMPLIES 0 < fs`length);

  % Subtype TCC generated (at line 39, column 47) for  N - 1
      % expected type  below[fs`length]
  partition_TCC2: OBLIGATION
    FORALL (a: T, b: {x: T | a < x},
            fs: finite_sequence[closed_interval(a, b)], N: nat):
      N = length(fs) IMPLIES
       (FORALL (xx: [below[fs`length] -> closed_interval[T](a, b)]):
          xx(0) = a AND N > 1 AND xx = seq(fs) IMPLIES
           N - 1 >= 0 AND N - 1 < fs`length);

  % Subtype TCC generated (at line 40, column 49) for  ii
      % expected type  below[fs`length]
  partition_TCC3: OBLIGATION
    FORALL (a: T, b: {x: T | a < x},
            fs: finite_sequence[closed_interval(a, b)], N: nat):
      N = length(fs) IMPLIES
       (FORALL (xx: [below[fs`length] -> closed_interval[T](a, b)]):
          xx(N - 1) = b AND xx(0) = a AND N > 1 AND xx = seq(fs) IMPLIES
           (FORALL (ii: below(N - 1)): ii < fs`length));

  % Subtype TCC generated (at line 40, column 58) for  ii + 1
      % expected type  below[fs`length]
  partition_TCC4: OBLIGATION
    FORALL (a: T, b: {x: T | a < x},
            fs: finite_sequence[closed_interval(a, b)], N: nat):
      N = length(fs) IMPLIES
       (FORALL (xx: [below[fs`length] -> closed_interval[T](a, b)]):
          xx(N - 1) = b AND xx(0) = a AND N > 1 AND xx = seq(fs) IMPLIES
           (FORALL (ii: below(N - 1)): ii + 1 < fs`length));

  % Subtype TCC generated (at line 45, column 48) for  ii + 1
      % expected type  below[P`length]
  width_TCC1: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition(a, b),
            xx: [below[P`length] -> closed_interval[T](a, b)]):
      xx = seq(P) IMPLIES
       (FORALL (N: nat):
          N = length(P) IMPLIES
           (FORALL (ii: below(N - 1)): ii + 1 < P`length));

  % Subtype TCC generated (at line 45, column 59) for  ii
      % expected type  below[P`length]
  width_TCC2: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition(a, b),
            xx: [below[P`length] -> closed_interval[T](a, b)]):
      xx = seq(P) IMPLIES
       (FORALL (N: nat):
          N = length(P) IMPLIES (FORALL (ii: below(N - 1)): ii < P`length));

  % Subtype TCC generated (at line 44, column 26) for
      % {l: real | EXISTS (ii: below(N - 1)): l = xx(ii + 1) - xx(ii)}
      % expected type  SS: non_empty_finite_set[real]
  width_TCC3: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition(a, b),
            xx: [below[P`length] -> closed_interval[T](a, b)]):
      xx = seq(P) IMPLIES
       (FORALL (N: nat):
          N = length(P) IMPLIES
           is_finite[real]
               ({l: real |
                   EXISTS (ii: below(N - 1)): l = xx(ii + 1) - xx(ii)})
            AND
            NOT empty?[real]
                    ({l: real |
                        EXISTS (ii: below(N - 1)): l = xx(ii + 1) - xx(ii)}));

  % Subtype TCC generated (at line 44, column 22) for
      % max({l: real | EXISTS (ii: below(N - 1)): l = xx(ii + 1) - xx(ii)})
      % expected type  posreal
  width_TCC4: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition(a, b),
            xx: [below[P`length] -> closed_interval[T](a, b)]):
      xx = seq(P) IMPLIES
       (FORALL (N: nat):
          N = length(P) IMPLIES
           max[real, <=]
               ({l: real |
                   EXISTS (ii: below(N - 1)): l = xx(ii + 1) - xx(ii)})
            >= 0
            AND
            max[real, <=]
                ({l: real |
                    EXISTS (ii: below(N - 1)): l = xx(ii + 1) - xx(ii)})
             > 0);

  % Subtype TCC generated (at line 49, column 43) for  ii + 1
      % expected type  below[length(P)]
  width_lem_TCC1: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition(a, b),
            ii: below(length(P) - 1)):
      ii + 1 < length(P);

  % Subtype TCC generated (at line 49, column 53) for  ii
      % expected type  below[length(P)]
  width_lem_TCC2: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition(a, b),
            ii: below(length(P) - 1)):
      ii < length(P);

  % Subtype TCC generated (at line 61, column 36) for  ii
      % expected type  below[P`length]
  parts_disjoint_TCC1: OBLIGATION
    FORALL (a, b: T, P: partition(a, b), ii, jj: below(length(P) - 1)):
      ii < P`length;

  % Subtype TCC generated (at line 61, column 59) for  1 + ii
      % expected type  below[P`length]
  parts_disjoint_TCC2: OBLIGATION
    FORALL (a, b, x: T, P: partition(a, b), ii, jj: below(length(P) - 1)):
      seq(P)(ii) < x IMPLIES 1 + ii < P`length;

  % Subtype TCC generated (at line 62, column 36) for  jj
      % expected type  below[P`length]
  parts_disjoint_TCC3: OBLIGATION
    FORALL (a, b, x: T, P: partition(a, b), ii, jj: below(length(P) - 1)):
      x < seq(P)(1 + ii) AND seq(P)(ii) < x IMPLIES jj < P`length;

  % Subtype TCC generated (at line 62, column 59) for  1 + jj
      % expected type  below[P`length]
  parts_disjoint_TCC4: OBLIGATION
    FORALL (a, b, x: T, P: partition(a, b), ii, jj: below(length(P) - 1)):
      seq(P)(jj) < x AND x < seq(P)(1 + ii) AND seq(P)(ii) < x IMPLIES
       1 + jj < P`length;

  % Subtype TCC generated (at line 70, column 22) for  length(P) - 1
      % expected type  nat
  in_sect?_TCC1: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition(a, b)): length(P) - 1 >= 0;

  % Subtype TCC generated (at line 77, column 46) for  ii
      % expected type  below[P`length]
  part_in_TCC1: OBLIGATION
    FORALL (a, b, x: T, P: partition(a, b)):
      a < b AND a <= x AND x <= b IMPLIES
       (FORALL (ii: below(length(P) - 1)): ii < P`length);

  % Subtype TCC generated (at line 77, column 71) for  ii + 1
      % expected type  below[P`length]
  part_in_TCC2: OBLIGATION
    FORALL (a, b, x: T, P: partition(a, b)):
      a < b AND a <= x AND x <= b IMPLIES
       (FORALL (ii: below(length(P) - 1)):
          seq(P)(ii) <= x IMPLIES ii + 1 < P`length);

  % Subtype TCC generated (at line 81, column 64) for  ii + 1
      % expected type  below[P`length]
  part_not_in_TCC1: OBLIGATION
    FORALL (a, b, x: T):
      a < b IMPLIES
       (FORALL (P: partition(a, b), ii, jj: below(length(P) - 1)):
          seq(P)(ii) < x IMPLIES ii + 1 < P`length);

  % Subtype TCC generated (at line 82, column 52) for  jj
      % expected type  below[P`length]
  part_not_in_TCC2: OBLIGATION
    FORALL (a, b, x: T):
      a < b IMPLIES
       (FORALL (P: partition(a, b), ii, jj: below(length(P) - 1)):
          seq(P)(ii) < x AND x < seq(P)(ii + 1) IMPLIES jj < P`length);

  % Subtype TCC generated (at line 89, column 30) for  ii
      % expected type  below[P`length]
  part_induction_TCC1: OBLIGATION
    FORALL (a, b: T, P: partition(a, b), x: closed_interval[T](a, b),
            xx: [below[P`length] -> closed_interval[T](a, b)]):
      xx = seq(P) IMPLIES
       (FORALL (N: nat):
          N = length(P) IMPLIES (FORALL (ii: below(N - 1)): ii < P`length));

  % Subtype TCC generated (at line 89, column 51) for  ii + 1
      % expected type  below[P`length]
  part_induction_TCC2: OBLIGATION
    FORALL (a, b: T, P: partition(a, b), x: closed_interval[T](a, b),
            xx: [below[P`length] -> closed_interval[T](a, b)]):
      xx = seq(P) IMPLIES
       (FORALL (N: nat):
          N = length(P) IMPLIES
           (FORALL (ii: below(N - 1)):
              xx(ii) <= x IMPLIES ii + 1 < P`length));

  % Subtype TCC generated (at line 98, column 66) for  (N - 1)
      % expected type  nznum
  eq_partition_TCC1: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, N: above(1), ii: below(N)): (N - 1) /= 0;

  % Subtype TCC generated (at line 98, column 52) for
      % a + ii * (b - a) / (N - 1)
      % expected type  closed_interval[T](a, b)
  eq_partition_TCC2: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, N: above(1), ii: below(N)):
      T_pred(a + ii * (b - a) / (N - 1)) AND
       a <= a + ii * (b - a) / (N - 1) AND a + ii * (b - a) / (N - 1) <= b;

  % Subtype TCC generated (at line 97, column 18) for
      % (# length := N,
      %    seq := (LAMBDA (ii: below(N)): a + ii * (b - a) / (N - 1)) #)
      % expected type  partition(a, b)
  eq_partition_TCC3: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, N: above(1)):
      N > 1 AND
       a + 0 * (b - a) / (N - 1) = a AND
        a + (N - 1) * (b - a) / (N - 1) = b AND
         (FORALL (ii_1: below(N - 1)):
            a + ii_1 * (b - a) / (N - 1) <
             a + (1 + ii_1) * (b - a) / (N - 1));

  % Subtype TCC generated (at line 102, column 55) for  b
      % expected type  {x: T | a <= x}
  xis?_TCC1: OBLIGATION FORALL (a: T, b: {x: T | a < x}): a <= b;

  % Subtype TCC generated (at line 112, column 27) for  ii
      % expected type  below[length(P)]
  xis_lem_TCC1: OBLIGATION
    FORALL (a, b: T, P: partition(a, b), (xis: (xis?(a, b, P))),
            (ii: below(length(P) - 1))):
      ii < length(P);

  % Subtype TCC generated (at line 112, column 59) for  ii + 1
      % expected type  below[length(P)]
  xis_lem_TCC2: OBLIGATION
    FORALL (a, b: T, P: partition(a, b), (xis: (xis?(a, b, P))),
            (ii: below(length(P) - 1))):
      finseq_appl[closed_interval[T](a, b)](P)(ii) <= xis(ii) IMPLIES
       ii + 1 < length(P);

  % Subtype TCC generated (at line 122, column 26) for  0
      % expected type  T_low[below(N)]
  Rie_sum_TCC1: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition(a, b),
            xis: (xis?(a, b, P)), N: int):
      N = length(P) - 1 IMPLIES
       0 >= 0 AND 0 < N OR (EXISTS (j: below(N)): j <= 0);

  % Subtype TCC generated (at line 122, column 28) for  N - 1
      % expected type  T_high[below(N)]
  Rie_sum_TCC2: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition(a, b),
            xis: (xis?(a, b, P)), N: int):
      N = length(P) - 1 IMPLIES
       N - 1 >= 0 AND N - 1 < N OR (EXISTS (j: below(N)): N - 1 <= j);

  % Subtype TCC generated (at line 123, column 42) for  n + 1
      % expected type  below[length(P)]
  Rie_sum_TCC3: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition(a, b),
            xis: (xis?(a, b, P)), N: int):
      N = length(P) - 1 IMPLIES (FORALL (n: below(N)): n + 1 < length(P));

  % Subtype TCC generated (at line 123, column 51) for  n
      % expected type  below[length(P)]
  Rie_sum_TCC4: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition(a, b),
            xis: (xis?(a, b, P)), N: int):
      N = length(P) - 1 IMPLIES (FORALL (n: below(N)): n < length(P));

  % Subtype TCC generated (at line 123, column 63) for  n
      % expected type  below(length(P) - 1)
  Rie_sum_TCC5: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition(a, b),
            xis: (xis?(a, b, P)), N: int):
      N = length(P) - 1 IMPLIES (FORALL (n: below(N)): n < length(P) - 1);

  % Assuming TCC generated (at line 41, column 5) for  reals@sigma[below(N)]
      % generated from assumption sigma.connected_domain
  Rie_sum_TCC6: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition(a, b),
            xis: (xis?(a, b, P)), N: int):
      N = length(P) - 1 IMPLIES
       (FORALL (x, y: below(N)), (z: integer):
          x <= z AND z <= y IMPLIES z >= 0 AND z < N);

  % Subtype TCC generated (at line 129, column 40) for  n
      % expected type  below[P`length]
  Rie_sec_TCC1: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition(a, b),
            xis: (xis?(a, b, P)), n: upto(length(P) - 1)):
      NOT n = 0 IMPLIES n < P`length;

  % Subtype TCC generated (at line 129, column 52) for  n - 1
      % expected type  below[P`length]
  Rie_sec_TCC2: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition(a, b),
            xis: (xis?(a, b, P)), n: upto(length(P) - 1)):
      NOT n = 0 IMPLIES n - 1 >= 0 AND n - 1 < P`length;

  % Subtype TCC generated (at line 129, column 68) for  n - 1
      % expected type  below(length(P) - 1)
  Rie_sec_TCC3: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition(a, b),
            xis: (xis?(a, b, P)), n: upto(length(P) - 1)):
      NOT n = 0 IMPLIES n - 1 >= 0 AND n - 1 < length(P) - 1;

  % Subtype TCC generated (at line 135, column 36) for  1
      % expected type  T_low[upto(N)]
  Rie_sum_alt_TCC1: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition(a, b),
            xis: (xis?(a, b, P)), N: int):
      N = length(P) - 1 IMPLIES
       1 >= 0 AND 1 <= N OR (EXISTS (j: upto(N)): j <= 1);

  % Subtype TCC generated (at line 135, column 38) for  N
      % expected type  T_high[upto(N)]
  Rie_sum_alt_TCC2: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition(a, b),
            xis: (xis?(a, b, P)), N: int):
      N = length(P) - 1 IMPLIES
       N >= 0 AND N <= N OR (EXISTS (j: upto(N)): N <= j);

  % Subtype TCC generated (at line 136, column 48) for  n
      % expected type  upto(length(P) - 1)
  Rie_sum_alt_TCC3: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition(a, b),
            xis: (xis?(a, b, P)), N: int):
      N = length(P) - 1 IMPLIES (FORALL (n: upto(N)): n <= length(P) - 1);

  % Assuming TCC generated (at line 41, column 5) for  reals@sigma[upto(N)]
      % generated from assumption sigma.connected_domain
  Rie_sum_alt_TCC4: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition(a, b),
            xis: (xis?(a, b, P)), N: int):
      N = length(P) - 1 IMPLIES
       (FORALL (x, y: upto(N)), (z: integer):
          x <= z AND z <= y IMPLIES z >= 0 AND z <= N);

  % Existence TCC generated (at line 157, column 3) for
      % x_in(aa: T, bb: {x: T | aa < x}): {t: T | aa <= t AND t <= bb}
  x_in_TCC1: OBLIGATION
    EXISTS (x1:
              [d: [aa: T, {x: T | aa < x}] ->
                 {t: T | d`1 <= t AND t <= d`2}]):
      TRUE;

  % Subtype TCC generated (at line 160, column 43) for
      % finseq_appl[closed_interval[T](a, b)](P)(ii + 1)
      % expected type  {x: T |
                     %          finseq_appl[closed_interval[T](a, b)](P)(ii)
                     %           < x}
  pick_one_TCC1: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition(a, b),
            ii: below(length(P) - 1)):
      finseq_appl[closed_interval[T](a, b)](P)(ii) <
       finseq_appl[closed_interval[T](a, b)](P)(ii + 1);

  % Subtype TCC generated (at line 164, column 37) for
      % finseq_appl[real]
      %     ((# length := length(P) - 1, seq := pick_one(a, b, P) #))
      % expected type  (xis?(a, b, P))
  gen_xis_TCC1: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition(a, b)):
      (FORALL (x1: below[length(P) - 1]):
         T_pred(finseq_appl[real]
                    ((# length := length(P) - 1, seq := pick_one(a, b, P) #))
                    (x1))
          AND
          a <=
           finseq_appl[real]
               ((# length := length(P) - 1, seq := pick_one(a, b, P) #))(x1)
           AND
           finseq_appl[real]
               ((# length := length(P) - 1, seq := pick_one(a, b, P) #))(x1)
            <= b)
       AND
       xis?(a, b, P)
           (finseq_appl[real]
                ((# length := length(P) - 1, seq := pick_one(a, b, P) #)));

  % Subtype TCC generated (at line 172, column 63) for  0
      % expected type  below[eq_partition(a, b, N)`length]
  eq_part_lem_a_TCC1: OBLIGATION
    FORALL (N: above(1), a, b: T):
      a < b IMPLIES 0 < eq_partition(a, b, N)`length;

  % Subtype TCC generated (at line 173, column 63) for  N - 1
      % expected type  below[eq_partition(a, b, N)`length]
  eq_part_lem_b_TCC1: OBLIGATION
    FORALL (N: above(1), a, b: T):
      a < b IMPLIES N - 1 >= 0 AND N - 1 < eq_partition(a, b, N)`length;

  % Subtype TCC generated (at line 176, column 68) for  (N - 1)
      % expected type  nznum
  width_eq_part_TCC1: OBLIGATION
    FORALL (N: above(1), a, b: T): a < b IMPLIES (N - 1) /= 0;

  % Subtype TCC generated (at line 182, column 54) for  N
      % expected type  above(1)
  N_from_delta_TCC1: OBLIGATION
    FORALL (a, b: T, delta: posreal):
      a < b IMPLIES
       (FORALL (N: int): N = 2 + floor((b - a) / delta) IMPLIES N > 1);

  % Existence TCC generated (at line 201, column 3) for
      % integral(a: T, b: {x: T | a < x}, ff: {f | integrable?(a, b, f)}):
      %       {S: real | integral?(a, b, ff, S)}
  integral_TCC1: OBLIGATION
    EXISTS (x1:
              [d: [a: T, b: {x: T | a < x}, {f | integrable?(a, b, f)}] ->
                 {S: real | integral?(d`1, d`2, d`3, S)}]):
      TRUE;

  % Subtype TCC generated (at line 233, column 56) for  f
      % expected type  {f | integrable?(a, b, f)}
  Integral_TCC1: OBLIGATION
    FORALL (a, b: T, f: Integrable_funs(a, b)):
      a < b AND NOT a = b IMPLIES integrable?(a, b, f);

  % Subtype TCC generated (at line 234, column 43) for  a
      % expected type  {x: T | b < x}
  Integral_TCC2: OBLIGATION
    FORALL (a, b: T, f: Integrable_funs(a, b)):
      NOT a < b AND NOT a = b IMPLIES b < a;

  % Subtype TCC generated (at line 234, column 45) for  f
      % expected type  {f | integrable?(b, a, f)}
  Integral_TCC3: OBLIGATION
    FORALL (a, b: T, f: Integrable_funs(a, b)):
      NOT a < b AND NOT a = b IMPLIES integrable?(b, a, f);

  % Subtype TCC generated (at line 239, column 97) for  f
      % expected type  {f | integrable?(a, b, f)}
  Integral_rew_TCC1: OBLIGATION
    FORALL (a, b: T, f: [T -> real]):
      Integrable?(a, b, f) AND a < b IMPLIES integrable?(a, b, f);


body:
  partitions_scaf[T: TYPE+ FROM real]: THEORY
  BEGIN

     ASSUMING
        IMPORTING deriv_domain_def[T]

        connected_domain : ASSUMPTION connected?[T]


        not_one_element  : ASSUMPTION not_one_element?[T]

     ENDASSUMING


  %   <=(x,y:T): bool = x <= y   %% hide ugly restrictions

  %   AUTO_REWRITE+ <=

     IMPORTING integral_def, 
               structures@sort_seq_lems[T,<=],
               finite_sets@finite_sets_minmax[T,<=],
               ints@max_below

     a,b,c,d,x,y,z: VAR T

     f,f1,f2,g: VAR [T -> real]

     eps, delta: VAR posreal

     xv,yv: VAR real


     #(t:T): finite_sequence[T] =  (# length := 1,
                                      seq := (LAMBDA (x: below[1]): t) #)

     gen_seq_lem: LEMMA #(x)(0) = x;

     part2set_prep: LEMMA FORALL (a:T, b: {x:T|a<x}, P: partition[T](a, b)):
        is_finite[T]({s: T | EXISTS (kk: below(length(P))): seq(P)(kk) = s})

     part2set(a:T,b:{x:T|a<x}, P: partition[T](a,b)): finite_set[T] 
        = {s: T | (EXISTS (kk: below(length(P))): seq(P)(kk) = s)}


     part2set_lem: LEMMA FORALL (a:T, b: {x:T|a<x}, P: partition[T](a, b)):
                          part2set(a,b,P)(a) AND part2set(a,b,P)(b) AND
                          (FORALL (ii: below(length(P))): part2set(a,b,P)(P(ii)))
                      AND (FORALL (x: (part2set(a,b,P))): a <= x AND x <= b)

     card_part2set: LEMMA FORALL (a:T, b: {x:T|a<x}, P: partition[T](a, b)):
                           card[T](part2set(a,b,P)) > 1 

     minmax_part2set: LEMMA FORALL (a:T, b: {x:T|a<x}, P: partition[T](a, b)):
                   min[T,<=](part2set(a,b,P)) = a AND
                   max[T,<=](part2set(a,b,P)) = b

     JUDGEMENT part2set(a:T,b:{x:T|a<x},P: partition[T](a,b)) 
                      HAS_TYPE {s: finite_set[T] | card(s) > 1}

     set2seq(S: finite_set[T]):  RECURSIVE finite_sequence[T] =
         IF empty?[T](S) THEN empty_seq
         ELSE #(choose[T](S)) o set2seq(rest[T](S)) 
         ENDIF 
       MEASURE card[T](S) 

     S: VAR finite_set[T]

     set2seq_length: LEMMA length(set2seq(S)) = card(S)

     set2seq_lem: LEMMA LET SP = set2seq(S) IN
                            FORALL (ii: below(length(SP))): S(SP`seq(ii))

     set2seq_exists: LEMMA LET SP = set2seq(S) IN
                          S(x) IMPLIES
                            EXISTS (ii: below(length(SP))): SP`seq(ii) = x


     AUTO_REWRITE+ set2seq_length

     minmax_set2seq: LEMMA card(S) > 0 IMPLIES
                             min(set2seq(S)) =  min[T,<=](S) AND
                             max(set2seq(S)) =  max[T,<=](S)

     set2seq_neq   : LEMMA LET SP = set2seq(S) IN
                       FORALL (ii,jj: below(length(sort(SP)))): 
                                 ii /= jj IMPLIES SP`seq(ii) /= SP`seq(jj)

     sort_set2seq_lem: LEMMA LET SP = set2seq(S) IN
                      FORALL (ii: below(length(sort(SP)))): S(sort(SP)`seq(ii))

     set2part_prep: LEMMA FORALL (S: {s: finite_set[T] | card[T](s) > 1}):
                                min[T,<=](S) < max[T,<=](S)


     sort_set2seq_neq   : LEMMA LET SP = sort(set2seq(S)) IN
                       FORALL (ii,jj: below(length(sort(SP)))): 
                                 ii /= jj IMPLIES SP`seq(ii) /= SP`seq(jj)

     set2part(S: {s: finite_set[T] | card[T](s) > 1}):  
            partition[T](min[T,<=](S),max[T,<=](S)) = sort(set2seq(S))


     set2part_length: LEMMA card(S) > 1 IMPLIES
                               length(set2part(S)) = card(S)

     AUTO_REWRITE+ set2part_length


     set2part_lem: LEMMA FORALL (ii: below(length(set2part(S)))): 
                           card(S) > 1 IMPLIES S(set2part(S)`seq(ii))


     set2part_ix: LEMMA S(x) and card(S) > 1 IMPLIES 
                    EXISTS (ii: below(length(set2part(S)))): 
                       x = set2part(S)`seq(ii)

     insert(a:T,b:{x:T|a<x},P: partition[T](a,b),
            xx: open_interval[T](a,b)): partition[T](a,b) = 
              set2part(add(xx,part2set(a,b,P)))


     
  END partitions_scaf

addendum:
  %%% ================ Addendum: generated declarations ================

  % Subtype TCC generated (at line 36, column 27) for  0
      % expected type  below[length( #(x))]
  gen_seq_lem_TCC1: OBLIGATION FORALL (x: T): 0 < length( #(x));

  % Assuming TCC generated (at line 14, column 6) for  integral_def[T]
      % generated from assumption integral_def.connected_domain
  part2set_prep_TCC1: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}): connected?[T];

  % Assuming TCC generated (at line 17, column 6) for  integral_def[T]
      % generated from assumption integral_def.not_one_element
  part2set_prep_TCC2: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}): not_one_element?[T];

  % Subtype TCC generated (at line 42, column 8) for
      % {s: T | (EXISTS (kk: below(length(P))): seq(P)(kk) = s)}
      % expected type  finite_set[T]
  part2set_TCC1: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition[T](a, b)):
      is_finite[T]({s: T | (EXISTS (kk: below(length(P))): seq(P)(kk) = s)});

  % Subtype TCC generated (at line 54, column 27) for  part2set(a, b, P)
      % expected type  SS: non_empty_finite_set[T]
  minmax_part2set_TCC1: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition[T](a, b)):
      NOT empty?[T](part2set(a, b, P));

  % Judgement subtype TCC generated (at line 57, column 13) for
      % part2set(a, b, P)
      % expected type  {s: finite_set[T] | card(s) > 1}
  part2set_TCC2: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition[T](a, b)):
      card[T](part2set(a, b, P)) > 1;

  % Subtype TCC generated (at line 62, column 24) for  S
      % expected type  p: (nonempty?)
  set2seq_TCC1: OBLIGATION
    FORALL (S: finite_set[T]): NOT empty?[T](S) IMPLIES nonempty?[T](S);

  % Termination TCC generated (at line 62, column 30) for  set2seq(rest[T](S))
  set2seq_TCC2: OBLIGATION
    FORALL (S: finite_set[T]):
      NOT empty?[T](S) IMPLIES card[T](rest[T](S)) < card[T](S);

  % Subtype TCC generated (at line 81, column 31) for  set2seq(S)
      % expected type  s: ne_seqs[T]
  minmax_set2seq_TCC1: OBLIGATION
    FORALL (S: finite_set[T]): card(S) > 0 IMPLIES length(set2seq(S)) > 0;

  % Subtype TCC generated (at line 81, column 56) for  S
      % expected type  SS: non_empty_finite_set[T]
  minmax_set2seq_TCC2: OBLIGATION
    FORALL (S: finite_set[T]): card(S) > 0 IMPLIES NOT empty?[T](S);

  % Subtype TCC generated (at line 86, column 55) for  ii
      % expected type  below[SP`length]
  set2seq_neq_TCC1: OBLIGATION
    FORALL (S: finite_set[T], SP: finite_sequence[T]):
      SP = set2seq(S) IMPLIES
       (FORALL (ii,
                jj:
                  below(length
                          (sort
                               [T,
                                restrict[[real, real], [T, T], boolean](<=)]
                               (SP)))):
          ii /= jj IMPLIES ii < SP`length);

  % Subtype TCC generated (at line 86, column 69) for  jj
      % expected type  below[SP`length]
  set2seq_neq_TCC2: OBLIGATION
    FORALL (S: finite_set[T], SP: finite_sequence[T]):
      SP = set2seq(S) IMPLIES
       (FORALL (ii,
                jj:
                  below(length
                          (sort
                               [T,
                                restrict[[real, real], [T, T], boolean](<=)]
                               (SP)))):
          ii /= jj IMPLIES jj < SP`length);

  % Subtype TCC generated (at line 92, column 40) for  S
      % expected type  SS: non_empty_finite_set[T]
  set2part_prep_TCC1: OBLIGATION
    FORALL (S: {s: finite_set[T] | card[T](s) > 1}): NOT empty?[T](S);

  % Subtype TCC generated (at line 97, column 55) for  ii
      % expected type  below[SP`length]
  sort_set2seq_neq_TCC1: OBLIGATION
    FORALL (S: finite_set[T],
            SP:
              {ss: seqs[T, restrict[[real, real], [T, T], boolean](<=)] |
                       permutation?
                           [T, restrict[[real, real], [T, T], boolean](<=)]
                           (set2seq(S), ss)
                        AND
                        increasing?
                            [T, restrict[[real, real], [T, T], boolean](<=)]
                            (ss)}):
      SP = sort(set2seq(S)) IMPLIES
       (FORALL (ii,
                jj:
                  below(length
                          (sort
                               [T,
                                restrict[[real, real], [T, T], boolean](<=)]
                               (SP)))):
          ii /= jj IMPLIES ii < SP`length);

  % Subtype TCC generated (at line 97, column 69) for  jj
      % expected type  below[SP`length]
  sort_set2seq_neq_TCC2: OBLIGATION
    FORALL (S: finite_set[T],
            SP:
              {ss: seqs[T, restrict[[real, real], [T, T], boolean](<=)] |
                       permutation?
                           [T, restrict[[real, real], [T, T], boolean](<=)]
                           (set2seq(S), ss)
                        AND
                        increasing?
                            [T, restrict[[real, real], [T, T], boolean](<=)]
                            (ss)}):
      SP = sort(set2seq(S)) IMPLIES
       (FORALL (ii,
                jj:
                  below(length
                          (sort
                               [T,
                                restrict[[real, real], [T, T], boolean](<=)]
                               (SP)))):
          ii /= jj IMPLIES jj < SP`length);

  % Subtype TCC generated (at line 100, column 36) for
      % max[T, restrict[[real, real], [T, T], boolean](<=)](S)
      % expected type  {x: T |
                     %          min
                     %              [T,
                     %               restrict[[real, real], [T, T], boolean]
                     %                   (<=)]
                     %              (S)
                     %           < x}
  set2part_TCC1: OBLIGATION
    FORALL (S: {s: finite_set[T] | card[T](s) > 1}):
      min[T, restrict[[real, real], [T, T], boolean](<=)](S) <
       max[T, restrict[[real, real], [T, T], boolean](<=)](S);

  % Subtype TCC generated (at line 100, column 52) for  sort(set2seq(S))
      % expected type  partition
                     %     [T](min
                     %             [T,
                     %              restrict[[real, real], [T, T], boolean]
                     %                  (<=)]
                     %             (S),
                     %         max
                     %             [T,
                     %              restrict[[real, real], [T, T], boolean]
                     %                  (<=)]
                     %             (S))
  set2part_TCC2: OBLIGATION
    FORALL (S: {s: finite_set[T] | card[T](s) > 1}):
           FORALL (x1:
                     below
                         [sort[T, restrict[[real, real], [T, T], boolean](<=)]
                              (set2seq(S))`length]):
             min[T, restrict[[real, real], [T, T], boolean](<=)](S) <=
              sort[T, restrict[[real, real], [T, T], boolean](<=)]
                  (set2seq(S))`seq
                  (x1)
              AND
              sort[T, restrict[[real, real], [T, T], boolean](<=)]
                  (set2seq(S))`seq
                  (x1)
               <= max[T, restrict[[real, real], [T, T], boolean](<=)](S)
       AND length
             (sort[T, restrict[[real, real], [T, T], boolean](<=)]
                  (set2seq(S)))
            > 1
       AND seq
             (sort[T, restrict[[real, real], [T, T], boolean](<=)]
                  (set2seq(S)))
               (0)
            = min[T, restrict[[real, real], [T, T], boolean](<=)](S)
       AND seq
             (sort[T, restrict[[real, real], [T, T], boolean](<=)]
                  (set2seq(S)))
               (length
                  (sort[T, restrict[[real, real], [T, T], boolean](<=)]
                       (set2seq(S)))
                 - 1)
            = max[T, restrict[[real, real], [T, T], boolean](<=)](S)
       AND FORALL (ii:
                     below(length
                             (sort
                                  [T,
                                   restrict[[real, real], [T, T], boolean]
                                       (<=)]
                                  (set2seq(S)))
                            - 1)):
             seq
               (sort[T, restrict[[real, real], [T, T], boolean](<=)]
                    (set2seq(S)))
                 (ii)
              <
              seq
                (sort[T, restrict[[real, real], [T, T], boolean](<=)]
                     (set2seq(S)))
                  (1 + ii);

  % Subtype TCC generated (at line 119, column 21) for
      % add(xx, part2set(a, b, P))
      % expected type  S: {s: finite_set[T] | card[T](s) > 1}
  insert_TCC1: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition[T](a, b),
            xx: open_interval[T](a, b)):
      card[T](add[T](xx, part2set(a, b, P))) > 1;

  % Subtype TCC generated (at line 119, column 12) for
      % set2part(add(xx, part2set(a, b, P)))
      % expected type  partition[T](a, b)
  insert_TCC2: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition[T](a, b),
            xx: open_interval[T](a, b)):
           FORALL (x1:
                     below[set2part(add[T](xx, part2set(a, b, P)))`length]):
             a <= set2part(add[T](xx, part2set(a, b, P)))`seq(x1) AND
              set2part(add[T](xx, part2set(a, b, P)))`seq(x1) <= b
       AND length(set2part(add[T](xx, part2set(a, b, P)))) > 1
       AND seq(set2part(add[T](xx, part2set(a, b, P))))(0) = a
       AND seq(set2part(add[T](xx, part2set(a, b, P))))
               (length(set2part(add[T](xx, part2set(a, b, P)))) - 1)
            = b
       AND FORALL (ii:
                     below(length(set2part(add[T](xx, part2set(a, b, P)))) -
                            1)):
             seq(set2part(add[T](xx, part2set(a, b, P))))(ii) <
              seq(set2part(add[T](xx, part2set(a, b, P))))(1 + ii);


body:
  integral_prep[T: TYPE FROM real]: THEORY
  %------------------------------------------------------------------------------
  %
  %  Basic Properties of Integral (Introduction to Analysis (Maxwell Rosenlicht))
  %
  %  Author: Rick Butler   NASA Langley Research Center
  %------------------------------------------------------------------------------

  BEGIN

     ASSUMING
        IMPORTING deriv_domain_def[T]

        connected_domain : ASSUMPTION connected?[T]


        not_one_element : ASSUMPTION not_one_element?[T]

     ENDASSUMING


     IMPORTING integral_def[T], reals@real_fun_ops



     a,b,c,x,y,z: VAR T
     D,m,M,v1,v2,cc,RS1,RS2: VAR real

     f,g,G: VAR [T -> real]

     integral_const_fun: LEMMA a < b IMPLIES integrable?(a,b,const_fun(D))
                                 AND integral(a, b, const_fun[T](D)) = D*(b-a)



     integral_const_restrict: LEMMA a < b AND 
                 (FORALL (x: closed_interval(a,b)): f(x) = D) IMPLIES
                                    integral?(a,b,f,D*(b-a))
     

     IMPORTING continuous_functions[T], convergence_sequences



  %  ------------ Linearity Properties of Integral

     integral_scal: LEMMA a < b AND integrable?(a,b,f) IMPLIES
                              integrable?(a,b,D*f) AND
                                 integral(a,b,D*f) = D*integral(a,b,f)


     integral_sum: LEMMA a < b AND integrable?(a,b,f) AND integrable?(a,b,g) 
                        IMPLIES
                           integrable?(a,b,(LAMBDA x: f(x) + g(x)))  AND
                               integral(a,b,(LAMBDA x: f(x) + g(x))) =
                                    integral(a,b,f) + integral(a,b,g)


     integral?_sum: LEMMA a < b AND integral?(a,b,f,v1) AND 
                                      integral?(a,b,g,v2) 
                        IMPLIES
                           integral?(a,b,(LAMBDA x: f(x) + g(x)),v1+v2)

     integral_diff: LEMMA a < b AND integrable?(a,b,f) AND integrable?(a,b,g) 
                        IMPLIES
                           integrable?(a,b,(LAMBDA x: f(x) - g(x)))  AND
                               integral(a,b,(LAMBDA x: f(x) - g(x))) =
                                    integral(a,b,f) - integral(a,b,g)


     integral_ge_0: LEMMA a < b AND integrable?(a,b,f) AND 
                      (FORALL (x: closed_interval(a,b)): f(x) >= 0) IMPLIES
                             integral(a,b,f) >= 0


     integral_jmp: LEMMA a < b AND a <= z AND z <= b AND f(z) = cc AND % Example2
                     (FORALL x: x /= z IMPLIES f(x) = 0) IMPLIES
                         integrable?(a,b,f) AND integral(a,b,f) = 0


     yv: VAR real
     integral_chg_one_pt: LEMMA a < b IMPLIES       
                                FORALL y: a <= y AND y <= b AND
                                integrable?(a,b,f) 
                      IMPLIES integrable?(a,b,f WITH [(y) := yv]) AND
                         integral(a,b,f) = integral(a,b,f WITH [(y) := yv])

     integral_restr_eq: LEMMA a < b AND          
                                  (FORALL x: a < x AND x < b IMPLIES
                                            f(x) = g(x)) AND
                                 integrable?(a,b,f)
                            IMPLIES integrable?(a,b,g) AND
                                     integral(a,b,g) = integral(a,b,f)


     integral_bound: LEMMA a < b AND integrable?(a,b,f) AND 
                             (FORALL (x: closed_interval(a,b)): 
                                      m <= f(x) AND f(x) <= M )
             IMPLIES m*(b-a) <= integral(a,b,f) AND integral(a,b,f) <= M*(b-a)


     integral_bound_abs: LEMMA a < b AND integrable?(a,b,f) AND 
                             (FORALL (x: closed_interval(a,b)): 
                                      abs(f(x)) <= M )
                                  IMPLIES abs(integral(a,b,f)) <= M*(b-a)


     integral_le : LEMMA a < b AND integrable?(a,b,f) AND integrable?(a,b,g) 
                         AND (FORALL (x: closed_interval(a,b)): f(x) <= g(x)) 
                      IMPLIES 
                         integral(a,b,f) <= integral(a,b,g) 


  %  One direction of Rosenlicht Lemma 1 on page 118 

     eps, delta: VAR posreal

     Lemma_1: LEMMA a < b IMPLIES                 
                 (integrable?(a,b,f) IMPLIES
                    (FORALL eps: EXISTS delta:
                        (FORALL (P1,P2: partition[T](a,b),
                                 xis1:(xis?(a,b,P1)),
                                 xis2:(xis?(a,b,P2))):
                          LET S1 = Rie_sum(a,b,P1,xis1,f), 
                              S2 = Rie_sum(a,b,P2,xis2,f) IN
                          (width(a,b,P1) < delta AND
                           width(a,b,P2) < delta)
                             IMPLIES
                                abs(S1 - S2) < eps )))

     integrable_lem: THEOREM  a < b IMPLIES      %% Lemma 1 page 118         
                       (integrable?(a,b,f) IFF
                          (FORALL (epsi: posreal): (EXISTS (delta: posreal):
                               (FORALL (P1,P2: partition(a,b)):
                                 width(a,b,P1) < delta AND
                                 width(a,b,P2) < delta IMPLIES
                                 (FORALL (RS1: (Riemann_sum?(a,b,P1,f)),
                                          RS2: (Riemann_sum?(a,b,P2,f))):
                                     abs(RS1 - RS2) < epsi )))))

     gxis(a:T, b:{x:T|a<x}, P: partition[T](a,b), j: below(length(P)-1), 
                  flag: bool,xx: closed_interval(P(j),P(j+1))):
            (xis?(a,b,P)) = (LAMBDA (ii: below(length(P)-1)): P(ii))
                                 WITH [(j) := IF flag then P(j)
                                              ELSE xx
                                              ENDIF ]


  END integral_prep

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 22, column 13) for  integral_def[T]
      % generated from assumption integral_def.connected_domain
  IMP_integral_def_TCC1: OBLIGATION connected?[T];

  % Assuming TCC generated (at line 22, column 13) for  integral_def[T]
      % generated from assumption integral_def.not_one_element
  IMP_integral_def_TCC2: OBLIGATION not_one_element?[T];

  % Subtype TCC generated (at line 141, column 57) for  length(P) - 1
      % expected type  nat
  gxis_TCC1: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition[T](a, b)):
      length(P) - 1 >= 0;

  % Subtype TCC generated (at line 142, column 49) for  j
      % expected type  below[length(P)]
  gxis_TCC2: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition[T](a, b),
            j: below(length(P) - 1)):
      j < length(P);

  % Subtype TCC generated (at line 142, column 54) for  j + 1
      % expected type  below[length(P)]
  gxis_TCC3: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition[T](a, b),
            j: below(length(P) - 1)):
      j + 1 < length(P);

  % Subtype TCC generated (at line 142, column 52) for
      % finseq_appl[closed_interval[T](a, b)](P)(j + 1)
      % expected type  {x: T |
                     %          finseq_appl[closed_interval[T](a, b)](P)(j)
                     %           <= x}
  gxis_TCC4: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition[T](a, b),
            j: below(length(P) - 1)):
      finseq_appl[closed_interval[T](a, b)](P)(j) <=
       finseq_appl[closed_interval[T](a, b)](P)(j + 1);

  % Subtype TCC generated (at line 143, column 62) for  ii
      % expected type  below[length(P)]
  gxis_TCC5: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition[T](a, b),
            j: below(length(P) - 1),
            xx:
              closed_interval[T](finseq_appl[closed_interval[T](a, b)](P)(j),
                                 finseq_appl[closed_interval[T](a, b)]
                                     (P)(j + 1)),
            ii: below(length(P) - 1)):
      ii < length(P);

  % Subtype TCC generated (at line 145, column 49) for  xx
      % expected type  {x | a <= x AND x <= b}
  gxis_TCC6: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition[T](a, b),
            j: below(length(P) - 1), flag: bool,
            xx:
              closed_interval[T](finseq_appl[closed_interval[T](a, b)](P)(j),
                                 finseq_appl[closed_interval[T](a, b)]
                                     (P)(j + 1))):
      NOT flag IMPLIES a <= xx AND xx <= b;

  % Subtype TCC generated (at line 143, column 26) for
      % (LAMBDA (ii: below(length(P) - 1)):
      %    finseq_appl[closed_interval[T](a, b)](P)(ii))
      %   WITH [(j)
      %           := IF flag THEN finseq_appl[closed_interval[T](a, b)](P)(j)
      %              ELSE xx
      %              ENDIF]
      % expected type  (xis?(a, b, P))
  gxis_TCC7: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition[T](a, b),
            j: below(length(P) - 1), flag: bool,
            xx:
              closed_interval[T](finseq_appl[closed_interval[T](a, b)](P)(j),
                                 finseq_appl[closed_interval[T](a, b)]
                                     (P)(j + 1))):
      xis?[T]
          (a, b, P)
          (((LAMBDA (ii: below(length(P) - 1)):
               finseq_appl[closed_interval[T](a, b)](P)(ii))
              WITH [(j)
                      := IF flag
                           THEN finseq_appl[closed_interval[T](a, b)](P)(j)
                         ELSE xx
                         ENDIF]));


body:
  integral_pulse[T: TYPE FROM real]: THEORY
  %----------------------------------------------------------------------------
  %
  %  Integral of:
  %
  %                    |-------------------|    c
  %                    |                   |
  %                    |                   |
  %     ---------------|                   |-----------------
  %                   xl                   xh
  %
  %
  %  Author:  Rick Butler               NASA Langley
  %----------------------------------------------------------------------------

  BEGIN

     ASSUMING
        IMPORTING deriv_domain_def[T]

        connected_domain : ASSUMPTION connected?[T]


        not_one_element : ASSUMPTION not_one_element?[T]

     ENDASSUMING



     IMPORTING integral_prep[T], reals@sigma_upto



     a,b,x,y,z: VAR T
     c:         VAR real
     f,g:       VAR [T -> real]
     xl,xh:     VAR T


     EX3p: LEMMA  a < b IMPLIES (FORALL (P: partition(a,b),p,q:nat):
                    0 < p AND p <= q AND q <= length(P) - 1 IMPLIES
                    sigma(p, q, (LAMBDA (n: upto(length(P) - 1)):
                    IF n = 0 THEN 0 ELSE seq(P)(n) - seq(P)(n - 1) ENDIF)) = 
                           seq(P)(q) - seq(P)(p-1))


     ii: VAR nat
     EE: VAR posreal
     EXse: LEMMA a < b IMPLIES FORALL (P: partition(a,b),
                                       xis: (xis?(a,b,P))):
                 0 < ii AND ii < length(P) 
                 AND (FORALL z:
                     (IF xl < z AND z < xh THEN f(z) = 1 ELSE f(z) = 0 ENDIF))
                 AND width(a, b, P) < EE
                 IMPLIES abs(Rie_sec(a, b, P, xis, f, ii)) < EE

  %  Rosenlicht page 114

     Example_3: LEMMA a <= xl AND xl < xh AND xh <= b AND
                    (FORALL z: (IF xl < z AND z < xh THEN f(z) = 1 
                                  ELSE f(z) = 0 ENDIF))
                             IMPLIES integrable?(a,b,f) AND
                                     integral(a,b,f) = xh-xl


  %
  %  only one point where function is nonzero: Rosenlicht Ex 2 pg 114
  %

     zero_except?(a,b,f): bool = a < b AND 
                            (EXISTS z,c: a <= z AND z <= b AND f(z) = c AND
                                   (FORALL x: x /= z IMPLIES f(x) = 0)) 

     zero_except?_integrable: LEMMA a < b AND zero_except?(a,b,f) IMPLIES
                                 integrable?(a,b,f) AND integral(a,b,f) = 0




     zero_not_intv?(xl,xh,f,c): bool = 
                           (FORALL z: 
                               IF xl < z AND z < xh THEN f(z) = c 
                               ELSE  f(z) = 0
                               ENDIF) 


     zero_not_intv?_integrable: LEMMA a <= xl AND xl < xh AND xh <= b AND
                 zero_not_intv?(xl,xh,f,c) IMPLIES integrable?(a,b,f) 
                 AND integral(a,b,f) = c*(xh-xl)


  %  ---------- doesn't matter what the value is at xl and xh -------------

     zero_except_intv?(xl,xh,c,f): bool = 
                           (FORALL z: 
                               (xl < z AND z < xh IMPLIES f(z) = c) AND
                               (z < xl IMPLIES f(z) = 0) AND
                               (z > xh IMPLIES f(z) = 0)  )


  %  generalization of Example 3 

     zero_except_intv?_integrable: LEMMA a <= xl AND xl < xh AND xh <= b AND
                 zero_except_intv?(xl,xh,c,f) IMPLIES 
                       integrable?(a,b,f) AND
                       integral(a,b,f) = c*(xh-xl)

  END integral_pulse

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 30, column 13) for  integral_prep[T]
      % generated from assumption integral_prep.connected_domain
  IMP_integral_prep_TCC1: OBLIGATION connected?[T];

  % Assuming TCC generated (at line 30, column 13) for  integral_prep[T]
      % generated from assumption integral_prep.not_one_element
  IMP_integral_prep_TCC2: OBLIGATION not_one_element?[T];

  % Subtype TCC generated (at line 42, column 24) for  p
      % expected type  T_low[upto(length(P) - 1)]
  EX3p_TCC1: OBLIGATION
    FORALL (a, b: T):
      a < b IMPLIES
       (FORALL (P: partition[T](a, b), p, q: nat):
          0 < p AND p <= q AND q <= length(P) - 1 IMPLIES
           p >= 0 AND p <= length(P) - 1 OR
            (EXISTS (j: upto(length(P) - 1)): j <= p));

  % Subtype TCC generated (at line 42, column 27) for  q
      % expected type  T_high[upto(length(P) - 1)]
  EX3p_TCC2: OBLIGATION
    FORALL (a, b: T):
      a < b IMPLIES
       (FORALL (P: partition[T](a, b), p, q: nat):
          0 < p AND p <= q AND q <= length(P) - 1 IMPLIES
           q >= 0 AND q <= length(P) - 1 OR
            (EXISTS (j: upto(length(P) - 1)): q <= j));

  % Subtype TCC generated (at line 43, column 46) for  n
      % expected type  below[P`length]
  EX3p_TCC3: OBLIGATION
    FORALL (a, b: T):
      a < b IMPLIES
       (FORALL (P: partition[T](a, b), p, q: nat):
          0 < p AND p <= q AND q <= length(P) - 1 IMPLIES
           (FORALL (n: upto(length(P) - 1)): NOT n = 0 IMPLIES n < P`length));

  % Subtype TCC generated (at line 43, column 58) for  n - 1
      % expected type  below[P`length]
  EX3p_TCC4: OBLIGATION
    FORALL (a, b: T):
      a < b IMPLIES
       (FORALL (P: partition[T](a, b), p, q: nat):
          0 < p AND p <= q AND q <= length(P) - 1 IMPLIES
           (FORALL (n: upto(length(P) - 1)):
              NOT n = 0 IMPLIES n - 1 >= 0 AND n - 1 < P`length));

  % Assuming TCC generated (at line 21, column 12) for
      % reals@sigma[upto(length(P) - 1)]
      % generated from assumption sigma.connected_domain
  EX3p_TCC5: OBLIGATION
    FORALL (a, b: T):
      a < b IMPLIES
       (FORALL (P: partition[T](a, b), p, q: nat):
          0 < p AND p <= q AND q <= length(P) - 1 IMPLIES
           (FORALL (x, y: upto(length(P) - 1)), (z: integer):
              x <= z AND z <= y IMPLIES z >= 0 AND z <= length(P) - 1));

  % Subtype TCC generated (at line 44, column 32) for  q
      % expected type  below[P`length]
  EX3p_TCC6: OBLIGATION
    FORALL (a, b: T):
      a < b IMPLIES
       (FORALL (P: partition[T](a, b), p, q: nat):
          0 < p AND p <= q AND q <= length(P) - 1 IMPLIES q < P`length);

  % Subtype TCC generated (at line 44, column 44) for  p - 1
      % expected type  below[P`length]
  EX3p_TCC7: OBLIGATION
    FORALL (a, b: T):
      a < b IMPLIES
       (FORALL (P: partition[T](a, b), p, q: nat):
          0 < p AND p <= q AND q <= length(P) - 1 IMPLIES
           p - 1 >= 0 AND p - 1 < P`length);

  % Subtype TCC generated (at line 55, column 52) for  ii
      % expected type  upto(length(P) - 1)
  EXse_TCC1: OBLIGATION
    FORALL (EE: posreal, a, b: T, f: [T -> real], ii: nat, xh, xl: T):
      a < b IMPLIES
       (FORALL (P: partition[T](a, b), xis: (xis?[T](a, b, P))):
          0 < ii AND
           ii < length(P) AND
            (FORALL z:
               (IF xl < z AND z < xh THEN f(z) = 1 ELSE f(z) = 0 ENDIF))
             AND width(a, b, P) < EE
           IMPLIES ii <= length(P) - 1);

  % Subtype TCC generated (at line 62, column 49) for  b
      % expected type  {x: T | a < x}
  Example_3_TCC1: OBLIGATION
    FORALL (a, b: T, f: [T -> real], xh, xl: T):
      (FORALL z: (IF xl < z AND z < xh THEN f(z) = 1 ELSE f(z) = 0 ENDIF))
       AND xh <= b AND xl < xh AND a <= xl
       IMPLIES a < b;

  % Subtype TCC generated (at line 88, column 63) for  b
      % expected type  {x: T | a < x}
  zero_not_intv?_integrable_TCC1: OBLIGATION
    FORALL (a, b: T, c: real, f: [T -> real], xh, xl: T):
      zero_not_intv?(xl, xh, f, c) AND xh <= b AND xl < xh AND a <= xl
       IMPLIES a < b;

  % Subtype TCC generated (at line 105, column 35) for  b
      % expected type  {x: T | a < x}
  zero_except_intv?_integrable_TCC1: OBLIGATION
    FORALL (a, b: T, c: real, f: [T -> real], xh, xl: T):
      zero_except_intv?(xl, xh, c, f) AND xh <= b AND xl < xh AND a <= xl
       IMPLIES a < b;


body:
  step_fun_def[T: TYPE FROM real]: THEORY
  %------------------------------------------------------------------------------
  %
  %  Integration over Step Functions: 
  %
  %  Author: Rick Butler   NASA Langley Research Center
  %
  %------------------------------------------------------------------------------

  BEGIN

     ASSUMING
        IMPORTING deriv_domain_def[T]

        connected_domain : ASSUMPTION connected?[T]

        not_one_element  : ASSUMPTION not_one_element?[T]

     ENDASSUMING

     a,b,x,y,z,xx: VAR T
     c:      VAR real
     f,g:    VAR [T -> real]
     xl,xh:     VAR T

     IMPORTING integral_def[T]


     step_function_on?(a:T,b:{x:T|a<x},f:[T->real], P: partition[T](a,b)): bool =
                              Let N = length(P), xx = seq(P) IN
                      (FORALL (ii: below(N-1)): (EXISTS (fv: real):
                             (FORALL (x: open_interval[T](xx(ii),xx(ii+1))):
                                        f(x) = fv)))


  %   step_function?(a:T,b:{x:T|a<x},f:[T -> real]): bool 
  %                   = (EXISTS (P: partition(a,b)):
  %                    Let N = length(P), xx = seq(P) IN
  %                    (FORALL (ii: below(N-1)): (EXISTS (fv: real):
  %                           (FORALL (x: open_interval(xx(ii),xx(ii+1))):
  %                                      f(x) = fv))))


     step_function?(a:T,b:{x:T|a<x},f:[T -> real]): bool 
                     = (EXISTS (P: partition(a,b)): step_function_on?(a,b,f,P))

  %  ALternate formulation without "fv":

     step_fun?(a:T,b:{x:T|a<x},f:[T -> real]): bool =
                      (EXISTS (P: partition(a,b)):
                      Let N = length(P), xx = seq(P) IN
                      (FORALL (ii: below(N-1)): 
                             (FORALL (x,y: open_interval(xx(ii),xx(ii+1))):
                                        f(x) = f(y))))


     step_fun?_lem: LEMMA a < b IMPLIES
                            (step_function?(a,b,f) IFF step_fun?(a,b,f))  




  END step_fun_def

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 26, column 13) for  integral_def[T]
      % generated from assumption integral_def.connected_domain
  IMP_integral_def_TCC1: OBLIGATION connected?[T];

  % Assuming TCC generated (at line 26, column 13) for  integral_def[T]
      % generated from assumption integral_def.not_one_element
  IMP_integral_def_TCC2: OBLIGATION not_one_element?[T];


body:
  integral_step[T: TYPE FROM real]: THEORY
  %------------------------------------------------------------------------------
  %
  %  Integration over Step Functions: 
  %
  %  Author: Rick Butler   NASA Langley Research Center
  %
  %------------------------------------------------------------------------------

  BEGIN

     ASSUMING
        IMPORTING deriv_domain_def[T]

        connected_domain : ASSUMPTION connected?[T]


        not_one_element : ASSUMPTION not_one_element?[T]

     ENDASSUMING

     IMPORTING step_fun_def[T], integral_pulse[T]

     a,b,x,y,z,xx: VAR T
     c:      VAR real
     f,g:    VAR [T -> real]
     xl,xh:     VAR T

     fn: VAR [nat -> real]

     sigma_0_m1: LEMMA sigma(0,-1,fn) = 0

  %   AUTO_REWRITE+ sigma_0_m1

     pick(a:T,b:{x:T|a<x},(P: partition[T](a,b)),j: below(length(P)-1)): 
         {t:T | seq(P)(j) < t AND t < seq(P)(j + 1)} =
               choose({t:T | seq(P)(j) < t AND t < seq(P)(j + 1)})

     val_in(a:T,b:{x:T|a<x},(P: partition[T](a,b)),j: below(length(P)-1),f): real
       = f(pick(a,b,P,j))

     stp_sect(a:T, b:{x:T|a<x},(P: partition(a,b)), 
             jj: nat,f)(x): real = 
                  IF jj >= length(P)-1 THEN 0
                  ELSIF x = seq(P)(jj) THEN f(x)
                  ELSIF seq(P)(jj) < x AND x < seq(P)(jj + 1)
                       THEN val_in(a,b,P,jj,f)
                  ELSE 0  ENDIF



     stp_sect_lem: LEMMA a < b IMPLIES FORALL (P: partition(a,b)):
                        FORALL (ii,jj: upto(length(P)-1)):
                         x > seq(P)(jj) AND ii < jj IMPLIES
                         stp_sect(a, b, P, ii , f)(x) = 0


     sigma_stp_sect: LEMMA a < b IMPLIES FORALL (P: partition(a,b)):
                           FORALL (j: nat): j <= length(P) - 2 AND
                           x > seq(P)(1 + j) IMPLIES
                           sigma(0, j, LAMBDA (ii: nat):
                                         IF ii >= 1 + j THEN 0
                                         ELSE stp_sect(a, b, P, ii, f)(x)
                                         ENDIF) = 0

     integral_stp_sect: LEMMA FORALL (a:T, b: {x:T|a<x}, P: partition[T](a,b),
                                      j: below(length(P)-1)):
                  integral?(a, b, stp_sect(a, b, P, j, f),
                     val_in(a, b, P, j, f)*(seq(P)(j+1) - seq(P)(j)))


     n: VAR nat
     list_of_funs(n): TYPE = [upto(n) -> [T -> real]]

     sumof(n: nat,ff: list_of_funs(n))(x): real = 
          sigma[nat](0,n,(LAMBDA (ii: nat): IF ii > n THEN 0
                                            ELSE ff(ii)(x)
                                            ENDIF))


     sigma_sumof: LEMMA FORALL (a:T, b: {x:T|a<x}, P: partition[T](a,b)):
                     step_function_on?(a,b,f,P) 
                     IMPLIES 
                        (FORALL (n: nat):
                         n <= length(P) - 2 IMPLIES
                (FORALL (x: closed_interval[T](a,b)): x <= seq(P)(n+1) IMPLIES
            sumof(n, (LAMBDA (jj: upto(n)): stp_sect(a,b,P,jj,f)))(x)
            + IF x = seq(P)(n+1) THEN f(x) ELSE 0 ENDIF
             = f(x)))


     integrable_sumof: LEMMA FORALL (n: nat, a:T, b: {x:T|a<x}, 
                                   P: partition[T](a,b)):
            n <= length(P) - 2 IMPLIES
            integrable?(a,b,
                     sumof(n, (LAMBDA (jj: upto(n)): stp_sect(a,b,P,jj,f))))


     integral_sumof: LEMMA FORALL (n: nat, a:T, b: {x:T|a<x}, 
                                   P: partition[T](a,b)):
            n <= length(P) - 2 IMPLIES
            integral(a,b,
                     sumof(n, (LAMBDA (jj: upto(n)): stp_sect(a,b,P,jj,f)))) = 
               sigma(0,n,(LAMBDA (ii: below(length(P)-1)):
                            val_in(a,b,P,ii,f)*(P(ii+1) - P(ii))))


     step_fun_is_sumof_n: LEMMA FORALL (n: nat, a:T, b: {x:T|a<x}, 
                                        P: partition[T](a,b)):
            n <= length(P) - 2 AND
            step_function_on?(a,b,f,P) IMPLIES 
               LET endx = seq(P)(n+1) IN
               (FORALL (x: closed_interval[T](a,endx)):
                  sumof(n, (LAMBDA (jj: upto(n)): stp_sect(a,b,P,jj,f))) 
                       WITH [endx := f(endx)](x)
                                   = f(x))


     step_fun_is_sumof: LEMMA FORALL (a:T, b: {x:T|a<x}, P: partition[T](a,b)):
          step_function_on?(a,b,f,P) IMPLIES   
               (FORALL (x: closed_interval[T](a,b)):
                    LET N = length(P)-2 IN
                  sumof(N, (LAMBDA (jj: upto(N)): stp_sect(a,b,P,jj,f))) 
                       WITH [b := f(b)](x)
                                   = f(x))


     step_function_integrable?: LEMMA a < b AND step_function?(a,b,f) IMPLIES
                                                  integrable?(a,b,f)



     step_function_on_integral: LEMMA a < b IMPLIES     
                                FORALL (P: partition[T](a,b)):
                                step_function_on?(a,b,f,P) IMPLIES
                             integral(a,b,f) = 
                       LET N = length(P) IN
                 sigma(0,N-2,(LAMBDA (ii: below(N-1)):
                            val_in(a,b,P,ii,f)*(P(ii+1) - P(ii)))) ;
                                 

     step_to_integrable: LEMMA a < b AND    % Rosenlict pg 120 forward direction
                           (FORALL (eps: posreal): 
                             (EXISTS (f1,f2: [T -> real]):
                                step_function?(a,b,f1) AND step_function?(a,b,f2)
                                AND (FORALL (xx: closed_interval(a,b)):
                                             f1(xx) <= f(xx) AND f(xx) <= f2(xx))
                                AND integrable?(a,b,f2-f1) 
                                AND integral(a,b,f2-f1) < eps))
                         IMPLIES integrable?(a,b,f) 




  END integral_step

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 22, column 13) for  step_fun_def[T]
      % generated from assumption step_fun_def.connected_domain
  IMP_step_fun_def_TCC1: OBLIGATION connected?[T];

  % Assuming TCC generated (at line 22, column 13) for  step_fun_def[T]
      % generated from assumption step_fun_def.not_one_element
  IMP_step_fun_def_TCC2: OBLIGATION not_one_element?[T];

  % Subtype TCC generated (at line 31, column 27) for  0
      % expected type  T_low[nat]
  sigma_0_m1_TCC1: OBLIGATION 0 >= 0 OR (EXISTS (j: nat): j <= 0);

  % Subtype TCC generated (at line 31, column 29) for  -1
      % expected type  T_high[nat]
  sigma_0_m1_TCC2: OBLIGATION -1 >= 0 OR (EXISTS (j: nat): -1 <= j);

  % Assuming TCC generated (at line 21, column 12) for  reals@sigma[nat]
      % generated from assumption sigma.connected_domain
  sigma_0_m1_TCC3: OBLIGATION
    (FORALL (x, y: nat), (z: integer): x <= z AND z <= y IMPLIES z >= 0);

  % Subtype TCC generated (at line 35, column 56) for  length(P) - 1
      % expected type  nat
  pick_TCC1: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, (P: partition[T](a, b))):
      length(P) - 1 >= 0;

  % Subtype TCC generated (at line 36, column 21) for  j
      % expected type  below[P`length]
  pick_TCC2: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, (P: partition[T](a, b)),
            j: below(length(P) - 1), t: T):
      j < P`length;

  % Subtype TCC generated (at line 36, column 43) for  j + 1
      % expected type  below[P`length]
  pick_TCC3: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, (P: partition[T](a, b)),
            j: below(length(P) - 1), t: T):
      seq(P)(j) < t IMPLIES j + 1 < P`length;

  % Subtype TCC generated (at line 37, column 20) for
      % {t: T | seq(P)(j) < t AND t < seq(P)(j + 1)}
      % expected type  p: (nonempty?[T])
  pick_TCC4: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, (P: partition[T](a, b)),
            j: below(length(P) - 1)):
      nonempty?[T]({t: T | seq(P)(j) < t AND t < seq(P)(j + 1)});

  % Subtype TCC generated (at line 45, column 33) for  jj
      % expected type  below[P`length]
  stp_sect_TCC1: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, (P: partition[T](a, b)), jj: nat, x: T):
      NOT jj >= length(P) - 1 IMPLIES jj < P`length;

  % Subtype TCC generated (at line 46, column 52) for  jj + 1
      % expected type  below[P`length]
  stp_sect_TCC2: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, (P: partition[T](a, b)), jj: nat, x: T):
      seq(P)(jj) < x AND NOT x = seq(P)(jj) AND NOT jj >= length(P) - 1
       IMPLIES jj + 1 < P`length;

  % Subtype TCC generated (at line 47, column 39) for  jj
      % expected type  below(length(P) - 1)
  stp_sect_TCC3: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, (P: partition[T](a, b)), jj: nat, x: T):
      seq(P)(jj) < x AND
       x < seq(P)(jj + 1) AND NOT x = seq(P)(jj) AND NOT jj >= length(P) - 1
       IMPLIES jj < length(P) - 1;

  % Subtype TCC generated (at line 54, column 34) for  jj
      % expected type  below[P`length]
  stp_sect_lem_TCC1: OBLIGATION
    FORALL (a, b: T):
      a < b IMPLIES
       (FORALL (P: partition[T](a, b), jj: upto(length(P) - 1)):
          jj < P`length);

  % Subtype TCC generated (at line 60, column 36) for  1 + j
      % expected type  below[P`length]
  sigma_stp_sect_TCC1: OBLIGATION
    FORALL (a, b: T):
      a < b IMPLIES
       (FORALL (P: partition[T](a, b), j: nat):
          j <= length(P) - 2 IMPLIES 1 + j < P`length);

  % Subtype TCC generated (at line 61, column 34) for  j
      % expected type  T_high[nat]
  sigma_stp_sect_TCC2: OBLIGATION
    FORALL (a, b, x: T):
      a < b IMPLIES
       (FORALL (P: partition[T](a, b), j: nat):
          j <= length(P) - 2 AND x > seq(P)(1 + j) IMPLIES
           j >= 0 OR (EXISTS (j_1: nat): j <= j_1));

  % Subtype TCC generated (at line 69, column 49) for  j + 1
      % expected type  below[P`length]
  integral_stp_sect_TCC1: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition[T](a, b),
            j: below(length(P) - 1)):
      j + 1 < P`length;

  % Subtype TCC generated (at line 69, column 63) for  j
      % expected type  below[P`length]
  integral_stp_sect_TCC2: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition[T](a, b),
            j: below(length(P) - 1)):
      j < P`length;

  % Subtype TCC generated (at line 76, column 21) for  n
      % expected type  T_high[nat]
  sumof_TCC1: OBLIGATION
    FORALL (n: nat, x: T): n >= 0 OR (EXISTS (j: nat): n <= j);

  % Subtype TCC generated (at line 77, column 50) for  ii
      % expected type  upto(n)
  sumof_TCC2: OBLIGATION
    FORALL (n: nat, x: T, ii: nat): NOT ii > n IMPLIES ii <= n;

  % Subtype TCC generated (at line 86, column 64) for  n + 1
      % expected type  below[P`length]
  sigma_sumof_TCC1: OBLIGATION
    FORALL (f: [T -> real], a: T, b: {x: T | a < x}, P: partition[T](a, b)):
      step_function_on?(a, b, f, P) IMPLIES
       (FORALL (n: nat):
          n <= length(P) - 2 IMPLIES
           (FORALL (x: closed_interval[T](a, b)): n + 1 < P`length));

  % Subtype TCC generated (at line 103, column 19) for
      % sumof(n, (LAMBDA (jj: upto(n)): stp_sect(a, b, P, jj, f)))
      % expected type  {f | integrable?(a, b, f)}
  integral_sumof_TCC1: OBLIGATION
    FORALL (f: [T -> real], n: nat, a: T, b: {x: T | a < x},
            P: partition[T](a, b)):
      n <= length(P) - 2 IMPLIES
       integrable?[T]
           (a, b, sumof(n, LAMBDA (jj: upto(n)): stp_sect(a, b, P, jj, f)));

  % Subtype TCC generated (at line 104, column 19) for  0
      % expected type  T_low[below(length(P) - 1)]
  integral_sumof_TCC2: OBLIGATION
    FORALL (n: nat, a: T, b: {x: T | a < x}, P: partition[T](a, b)):
      n <= length(P) - 2 IMPLIES
       0 >= 0 AND 0 < length(P) - 1 OR
        (EXISTS (j: below(length(P) - 1)): j <= 0);

  % Subtype TCC generated (at line 104, column 21) for  n
      % expected type  T_high[below(length(P) - 1)]
  integral_sumof_TCC3: OBLIGATION
    FORALL (n: nat, a: T, b: {x: T | a < x}, P: partition[T](a, b)):
      n <= length(P) - 2 IMPLIES
       n >= 0 AND n < length(P) - 1 OR
        (EXISTS (j: below(length(P) - 1)): n <= j);

  % Assuming TCC generated (at line 21, column 12) for
      % reals@sigma[below(length(P) - 1)]
      % generated from assumption sigma.connected_domain
  integral_sumof_TCC4: OBLIGATION
    FORALL (n: nat, a: T, b: {x: T | a < x}, P: partition[T](a, b)):
      n <= length(P) - 2 IMPLIES
       (FORALL (x, y: below(length(P) - 1)), (z: integer):
          x <= z AND z <= y IMPLIES z >= 0 AND z < length(P) - 1);

  % Subtype TCC generated (at line 112, column 31) for  n + 1
      % expected type  below[P`length]
  step_fun_is_sumof_n_TCC1: OBLIGATION
    FORALL (f: [T -> real], n: nat, a: T, b: {x: T | a < x},
            P: partition[T](a, b)):
      n <= length(P) - 2 AND step_function_on?(a, b, f, P) IMPLIES
       n + 1 < P`length;

  % Subtype TCC generated (at line 123, column 22) for  N
      % expected type  nat
  step_fun_is_sumof_TCC1: OBLIGATION
    FORALL (f: [T -> real], a: T, b: {x: T | a < x}, P: partition[T](a, b)):
      step_function_on?(a, b, f, P) IMPLIES
       (FORALL (x: closed_interval[T](a, b), N: int):
          N = length(P) - 2 IMPLIES N >= 0);

  % Subtype TCC generated (at line 136, column 40) for  f
      % expected type  {f | integrable?(a, b, f)}
  step_function_on_integral_TCC1: OBLIGATION
    FORALL (a, b: T, f: [T -> real]):
      a < b IMPLIES
       (FORALL (P: partition[T](a, b)):
          step_function_on?(a, b, f, P) IMPLIES integrable?[T](a, b, f));

  % Subtype TCC generated (at line 138, column 21) for  0
      % expected type  T_low[below(N - 1)]
  step_function_on_integral_TCC2: OBLIGATION
    FORALL (a, b: T, f: [T -> real]):
      a < b IMPLIES
       (FORALL (P: partition[T](a, b)):
          step_function_on?(a, b, f, P) IMPLIES
           (FORALL (N: nat):
              N = length(P) IMPLIES
               0 >= 0 AND 0 < N - 1 OR (EXISTS (j: below(N - 1)): j <= 0)));

  % Subtype TCC generated (at line 138, column 23) for  N - 2
      % expected type  T_high[below(N - 1)]
  step_function_on_integral_TCC3: OBLIGATION
    FORALL (a, b: T, f: [T -> real]):
      a < b IMPLIES
       (FORALL (P: partition[T](a, b)):
          step_function_on?(a, b, f, P) IMPLIES
           (FORALL (N: nat):
              N = length(P) IMPLIES
               N - 2 >= 0 AND N - 2 < N - 1 OR
                (EXISTS (j: below(N - 1)): N - 2 <= j)));

  % Subtype TCC generated (at line 139, column 39) for  ii
      % expected type  below(length(P) - 1)
  step_function_on_integral_TCC4: OBLIGATION
    FORALL (a, b: T, f: [T -> real]):
      a < b IMPLIES
       (FORALL (P: partition[T](a, b)):
          step_function_on?(a, b, f, P) IMPLIES
           (FORALL (N: nat):
              N = length(P) IMPLIES
               (FORALL (ii: below(N - 1)): ii < length(P) - 1)));

  % Subtype TCC generated (at line 139, column 48) for  ii + 1
      % expected type  below[length(P)]
  step_function_on_integral_TCC5: OBLIGATION
    FORALL (a, b: T, f: [T -> real]):
      a < b IMPLIES
       (FORALL (P: partition[T](a, b)):
          step_function_on?(a, b, f, P) IMPLIES
           (FORALL (N: nat):
              N = length(P) IMPLIES
               (FORALL (ii: below(N - 1)): ii + 1 < length(P))));

  % Subtype TCC generated (at line 139, column 58) for  ii
      % expected type  below[length(P)]
  step_function_on_integral_TCC6: OBLIGATION
    FORALL (a, b: T, f: [T -> real]):
      a < b IMPLIES
       (FORALL (P: partition[T](a, b)):
          step_function_on?(a, b, f, P) IMPLIES
           (FORALL (N: nat):
              N = length(P) IMPLIES
               (FORALL (ii: below(N - 1)): ii < length(P))));

  % Assuming TCC generated (at line 21, column 12) for
      % reals@sigma[below(N - 1)]
      % generated from assumption sigma.connected_domain
  step_function_on_integral_TCC7: OBLIGATION
    FORALL (a, b: T, f: [T -> real]):
      a < b IMPLIES
       (FORALL (P: partition[T](a, b)):
          step_function_on?(a, b, f, P) IMPLIES
           (FORALL (N: nat):
              N = length(P) IMPLIES
               (FORALL (x, y: below(N - 1)), (z: integer):
                  x <= z AND z <= y IMPLIES z >= 0 AND z < N - 1)));


body:
  step_fun_scaf[T: TYPE+ FROM real]: THEORY
  BEGIN
     ASSUMING
        IMPORTING deriv_domain_def[T]

        connected_domain : ASSUMPTION connected?[T]


        not_one_element : ASSUMPTION not_one_element?[T]

     ENDASSUMING

  %   AUTO_REWRITE+ not_one_element


     IMPORTING integral_step, partitions_scaf[T]

     a,b,c,d,x,y,z: VAR T

     f,f1,f2,g: VAR [T -> real]

     eps, delta: VAR posreal

     xv,yv: VAR real


     UP_prep: LEMMA FORALL (a:T, b: {x:T|a<x}, P1,P2: partition[T](a, b)): 
                         LET UP = union[T](part2set(a,b,P1), part2set(a,b,P2)) IN
                        card(UP) > 1
                  AND UP(a) AND UP(b)

     UnionPart(a:T,b:{x:T|a<x},P1,P2: partition[T](a,b)): partition[T](a,b) =
               set2part(union(part2set(a, b, P1), part2set(a, b, P2)))


     UnionPart_lem: LEMMA FORALL (a:T, b: {x:T|a<x}, P1,P2: partition[T](a, b),
                                  kk: below(length(P1)-1)): 
                         EXISTS (nn: below(length(UnionPart(a,b,P1,P2)))):
                                UnionPart(a,b,P1,P2)`seq(nn) = P1`seq(kk)

     Union_sym: LEMMA FORALL (a:T, b: {x:T|a<x}, P1,P2: partition[T](a, b)):
                            UnionPart(a,b,P1,P2) = UnionPart(a,b,P2,P1)

     Union_lem: LEMMA FORALL (a:T, b: {x:T|a<x}, P1,P2: partition[T](a, b),
                                 nn: below(length(UnionPart(a,b,P1,P2))-1)):
                            in_sect?(a,b,UnionPart(a,b,P1,P2),nn,x)
                         IMPLIES 
                   (EXISTS (kk: below(length(P1)-1)): 
                           seq(P1)(kk) <= UnionPart(a,b,P1,P2)(nn) AND
                            UnionPart(a,b,P1,P2)(nn+1) <= seq(P1)(kk+1) )
     
  END step_fun_scaf

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 16, column 28) for  partitions_scaf[T]
      % generated from assumption partitions_scaf.connected_domain
  IMP_partitions_scaf_TCC1: OBLIGATION connected?[T];

  % Assuming TCC generated (at line 16, column 28) for  partitions_scaf[T]
      % generated from assumption partitions_scaf.not_one_element
  IMP_partitions_scaf_TCC2: OBLIGATION not_one_element?[T];

  % Subtype TCC generated (at line 33, column 22) for
      % union(part2set(a, b, P1), part2set(a, b, P2))
      % expected type  S: {s: finite_set[T] | card[T](s) > 1}
  UnionPart_TCC1: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P1, P2: partition[T](a, b)):
      card[T](union[T](part2set[T](a, b, P1), part2set[T](a, b, P2))) > 1;

  % Subtype TCC generated (at line 33, column 13) for
      % set2part(union(part2set(a, b, P1), part2set(a, b, P2)))
      % expected type  partition[T](a, b)
  UnionPart_TCC2: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P1, P2: partition[T](a, b)):
           FORALL (x1:
                     below
                         [set2part[T]
                              (union[T]
                                   (part2set[T](a, b, P1),
                                    part2set[T](a, b, P2)))`length]):
             a <=
              set2part[T]
                  (union[T](part2set[T](a, b, P1), part2set[T](a, b, P2)))`seq
                  (x1)
              AND
              set2part[T]
                  (union[T](part2set[T](a, b, P1), part2set[T](a, b, P2)))`seq
                  (x1)
               <= b
       AND length
             (set2part[T]
                  (union[T](part2set[T](a, b, P1), part2set[T](a, b, P2))))
            > 1
       AND seq
             (set2part[T]
                  (union[T](part2set[T](a, b, P1), part2set[T](a, b, P2))))
               (0)
            = a
       AND seq
             (set2part[T]
                  (union[T](part2set[T](a, b, P1), part2set[T](a, b, P2))))
               (length
                  (set2part[T]
                       (union[T]
                            (part2set[T](a, b, P1), part2set[T](a, b, P2))))
                 - 1)
            = b
       AND FORALL (ii:
                     below(length
                             (set2part[T]
                                  (union[T]
                                       (part2set[T](a, b, P1),
                                        part2set[T](a, b, P2))))
                            - 1)):
             seq
               (set2part[T]
                    (union[T](part2set[T](a, b, P1), part2set[T](a, b, P2))))
                 (ii)
              <
              seq
                (set2part[T]
                     (union[T](part2set[T](a, b, P1), part2set[T](a, b, P2))))
                  (1 + ii);

  % Subtype TCC generated (at line 39, column 68) for  kk
      % expected type  below[P1`length]
  UnionPart_lem_TCC1: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P1, P2: partition[T](a, b),
            kk: below(length(P1) - 1),
            nn: below(length(UnionPart(a, b, P1, P2)))):
      kk < P1`length;

  % Subtype TCC generated (at line 49, column 33) for  kk
      % expected type  below[P1`length]
  Union_lem_TCC1: OBLIGATION
    FORALL (x, a: T, b: {x_1: T | a < x_1}, P1, P2: partition[T](a, b),
            nn: below(length(UnionPart(a, b, P1, P2)) - 1)):
      seq(UnionPart(a, b, P1, P2))(nn) < x AND
       x < seq(UnionPart(a, b, P1, P2))(nn + 1)
       IMPLIES (FORALL (kk: below(length(P1) - 1)): kk < P1`length);

  % Subtype TCC generated (at line 49, column 61) for  nn
      % expected type  below[length(UnionPart(a, b, P1, P2))]
  Union_lem_TCC2: OBLIGATION
    FORALL (x, a: T, b: {x_1: T | a < x_1}, P1, P2: partition[T](a, b),
            nn: below(length(UnionPart(a, b, P1, P2)) - 1)):
      seq(UnionPart(a, b, P1, P2))(nn) < x AND
       x < seq(UnionPart(a, b, P1, P2))(nn + 1)
       IMPLIES
       (FORALL (kk: below(length(P1) - 1)):
          nn < length(UnionPart(a, b, P1, P2)));

  % Subtype TCC generated (at line 50, column 47) for  nn + 1
      % expected type  below[length(UnionPart(a, b, P1, P2))]
  Union_lem_TCC3: OBLIGATION
    FORALL (x, a: T, b: {x_1: T | a < x_1}, P1, P2: partition[T](a, b),
            nn: below(length(UnionPart(a, b, P1, P2)) - 1)):
      seq(UnionPart(a, b, P1, P2))(nn) < x AND
       x < seq(UnionPart(a, b, P1, P2))(nn + 1)
       IMPLIES
       (FORALL (kk: below(length(P1) - 1)):
          seq(P1)(kk) <= finseq_appl(UnionPart(a, b, P1, P2))(nn) IMPLIES
           nn + 1 < length(UnionPart(a, b, P1, P2)));

  % Subtype TCC generated (at line 50, column 64) for  kk + 1
      % expected type  below[P1`length]
  Union_lem_TCC4: OBLIGATION
    FORALL (x, a: T, b: {x_1: T | a < x_1}, P1, P2: partition[T](a, b),
            nn: below(length(UnionPart(a, b, P1, P2)) - 1)):
      seq(UnionPart(a, b, P1, P2))(nn) < x AND
       x < seq(UnionPart(a, b, P1, P2))(nn + 1)
       IMPLIES
       (FORALL (kk: below(length(P1) - 1)):
          seq(P1)(kk) <= finseq_appl(UnionPart(a, b, P1, P2))(nn) IMPLIES
           kk + 1 < P1`length);


body:
  step_fun_props[T: TYPE+ FROM real]: THEORY
  %------------------------------------------------------------------------------
  %
  %  Theory and proofs taken from Introduction to Analysis (Maxwell Rosenlicht)
  %
  %  Author:  Rick Butler               NASA Langley
  %------------------------------------------------------------------------------
  BEGIN

     ASSUMING
        IMPORTING deriv_domain_def[T]

        connected_domain : ASSUMPTION connected?[T]


        not_one_element : ASSUMPTION not_one_element?[T]

     ENDASSUMING

  %   AUTO_REWRITE+ not_one_element


  %   <=(x,y:T): bool = x <= y   %% hide ugly restrictions

  %   AUTO_REWRITE+ <=

     IMPORTING step_fun_def[T],  % integral_step, 
               reals@sigma_below, 
               structures@sort_seq_lems[T,<=],
               step_fun_scaf[T]

     a,b,c,d,x,y,z,xl,xh: VAR T

     f,f1,f2,g: VAR [T -> real]

     eps, delta: VAR posreal

     xv,yv,cc: VAR real



     is_step: LEMMA a < b AND
                    (EXISTS (P: partition[T](a,b)):     %% PROVED %%
                      Let N = length(P), xx = seq(P) IN
                      (FORALL (ii: below(N-1)): (EXISTS (fv: real):
                             (FORALL x: xx(ii) < x AND x < xx(ii+1) IMPLIES
                                        f(x) = fv))))
                IMPLIES
                  step_function?(a,b,f) 


     UUPart(a:T, b:{x:T|a<x}, c: {x:T|b<x}, P1: partition[T](a,b), 
               P2: partition[T](b, c)):  partition[T](a,c) =
                 LET  N1 = length(P1), 
                      NUU = length(P1) + length(P2) - 1 IN
                 (# length := NUU,
                    seq :=  (LAMBDA (kk: below(NUU)):
                              IF kk < N1 THEN P1`seq(kk)
                              ELSE P2`seq(kk-N1+1) 
                              ENDIF)
                 #)

     split_step_is_step: LEMMA a < b AND b < c AND       %% PROVED %%
                              step_function?(a, b, f) AND
                              step_function?(b, c, g)
                           IMPLIES
                             step_function?(a, c,
                               (LAMBDA (x: T):
                                  IF x < a OR x > c THEN 0
                                  ELSIF x <= b THEN f(x)
                                  ELSE g(x)
                                  ENDIF))

  %    UnionPart(a:T,b:{x:T|a<x},P1,P2: partition[T](a,b)): partition[T](a,b) =
  %             set2part(union(part2set(a, b, P1), part2set(a, b, P2)))



     ssis_prep: LEMMA FORALL (a:T, b: {x:T|a<x}, P1,P2: partition[T](a, b),
                              nn: below(length(UnionPart(a,b,P1,P2))-1), x,y: T):
                       (in_sect?(a,b,UnionPart(a,b,P1,P2),nn,x) AND
                        in_sect?(a,b,UnionPart(a,b,P1,P2),nn,y)     )
                          IMPLIES
        (EXISTS (ii: below(length(P1)-1)): in_sect?(a,b,P1,ii,x) AND 
                                           in_sect?(a,b,P1,ii,y))
    AND (EXISTS (jj: below(length(P2)-1)): in_sect?(a,b,P2,jj,x) AND 
                                           in_sect?(a,b,P2,jj,y))


     sum_step_is_step: LEMMA a < b AND                   %% PROVED %%
                             step_function?(a, b, f) AND
                             step_function?(a, b, g)
                           IMPLIES
                             step_function?(a, b, f + g)


     diff_step_is_step: LEMMA a < b AND
                              step_function?(a, b, f) AND    %% PROVED %%
                              step_function?(a, b, g)
                           IMPLIES
                             step_function?(a, b, f - g)


     step_function_subrng: LEMMA a <= b AND b < c AND c <= d AND 
                                 step_function?(a, d, f)
                                 IMPLIES step_function?(b, c, f)


  END step_fun_props

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 27, column 13) for  step_fun_def[T]
      % generated from assumption step_fun_def.connected_domain
  IMP_step_fun_def_TCC1: OBLIGATION connected?[T];

  % Assuming TCC generated (at line 27, column 13) for  step_fun_def[T]
      % generated from assumption step_fun_def.not_one_element
  IMP_step_fun_def_TCC2: OBLIGATION not_one_element?[T];

  % Subtype TCC generated (at line 46, column 41) for  ii
      % expected type  below[P`length]
  is_step_TCC1: OBLIGATION
    FORALL (a, b: T):
      a < b IMPLIES
       (FORALL (P: partition[T](a, b), N: nat):
          N = length(P) IMPLIES
           (FORALL (xx: [below[P`length] -> closed_interval[T](a, b)]):
              xx = seq(P) IMPLIES
               (FORALL (ii: below(N - 1)): ii < P`length)));

  % Subtype TCC generated (at line 46, column 60) for  ii + 1
      % expected type  below[P`length]
  is_step_TCC2: OBLIGATION
    FORALL (a, b: T):
      a < b IMPLIES
       (FORALL (P: partition[T](a, b), N: nat):
          N = length(P) IMPLIES
           (FORALL (xx: [below[P`length] -> closed_interval[T](a, b)]):
              xx = seq(P) IMPLIES
               (FORALL (ii: below(N - 1), x):
                  xx(ii) < x IMPLIES ii + 1 < P`length)));

  % Subtype TCC generated (at line 53, column 54) for  c
      % expected type  {x: T | a < x}
  UUPart_TCC1: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, c: {x: T | b < x}): a < c;

  % Subtype TCC generated (at line 56, column 28) for  NUU
      % expected type  nat
  UUPart_TCC2: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, c: {x: T | b < x},
            P1: partition[T](a, b), P2: partition[T](b, c), N1: nat):
      N1 = length(P1) IMPLIES
       (FORALL (NUU: int):
          NUU = length(P1) + length(P2) - 1 IMPLIES NUU >= 0);

  % Subtype TCC generated (at line 58, column 51) for  kk
      % expected type  below[P1`length]
  UUPart_TCC3: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, c: {x: T | b < x},
            P1: partition[T](a, b), P2: partition[T](b, c), N1: nat):
      N1 = length(P1) IMPLIES
       (FORALL (NUU: int):
          NUU = length(P1) + length(P2) - 1 IMPLIES
           (FORALL (kk: below(NUU)): kk < N1 IMPLIES kk < P1`length));

  % Subtype TCC generated (at line 58, column 44) for  P1`seq(kk)
      % expected type  closed_interval[T](a, c)
  UUPart_TCC4: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, c: {x: T | b < x},
            P1: partition[T](a, b), P2: partition[T](b, c), N1: nat):
      N1 = length(P1) IMPLIES
       (FORALL (NUU: int):
          NUU = length(P1) + length(P2) - 1 IMPLIES
           (FORALL (kk: below(NUU)):
              kk < N1 IMPLIES a <= P1`seq(kk) AND P1`seq(kk) <= c));

  % Subtype TCC generated (at line 59, column 40) for  kk - N1 + 1
      % expected type  below[P2`length]
  UUPart_TCC5: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, c: {x: T | b < x},
            P1: partition[T](a, b), P2: partition[T](b, c), N1: nat):
      N1 = length(P1) IMPLIES
       (FORALL (NUU: int):
          NUU = length(P1) + length(P2) - 1 IMPLIES
           (FORALL (kk: below(NUU)):
              NOT kk < N1 IMPLIES
               kk - N1 + 1 >= 0 AND kk - N1 + 1 < P2`length));

  % Subtype TCC generated (at line 59, column 33) for  P2`seq(kk - N1 + 1)
      % expected type  closed_interval[T](a, c)
  UUPart_TCC6: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, c: {x: T | b < x},
            P1: partition[T](a, b), P2: partition[T](b, c), N1: nat):
      N1 = length(P1) IMPLIES
       (FORALL (NUU: int):
          NUU = length(P1) + length(P2) - 1 IMPLIES
           (FORALL (kk: below(NUU)):
              NOT kk < N1 IMPLIES
               a <= P2`seq(kk - N1 + 1) AND P2`seq(kk - N1 + 1) <= c));

  % Subtype TCC generated (at line 56, column 15) for
      % (# length := NUU,
      %    seq
      %      := (LAMBDA (kk: below(NUU)):
      %            IF kk < N1 THEN P1`seq(kk)
      %            ELSE P2`seq(kk - N1 + 1)
      %            ENDIF) #)
      % expected type  partition[T](a, c)
  UUPart_TCC7: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, c: {x: T | b < x},
            P1: partition[T](a, b), P2: partition[T](b, c), N1: nat):
      N1 = length(P1) IMPLIES
       (FORALL (NUU: int):
          NUU = length(P1) + length(P2) - 1 IMPLIES
           NUU > 1 AND
            IF 0 < N1 THEN P1`seq(0) ELSE P2`seq(0 - N1 + 1) ENDIF = a AND
             IF NUU - 1 < N1 THEN P1`seq(NUU - 1)
             ELSE P2`seq(NUU - 1 - N1 + 1)
             ENDIF
              = c
              AND
              (FORALL (ii: below(NUU - 1)):
                 IF ii < N1 THEN P1`seq(ii) ELSE P2`seq(ii - N1 + 1) ENDIF <
                  IF 1 + ii < N1 THEN P1`seq(1 + ii)
                  ELSE P2`seq(1 + ii - N1 + 1)
                  ENDIF));

  % Subtype TCC generated (at line 67, column 45) for  c
      % expected type  {x: T | a < x}
  split_step_is_step_TCC1: OBLIGATION
    FORALL (a, b, c: T, f, g: [T -> real]):
      step_function?(b, c, g) AND step_function?(a, b, f) AND b < c AND a < b
       IMPLIES a < c;

  % Subtype TCC generated (at line 105, column 49) for  d
      % expected type  {x: T | a < x}
  step_function_subrng_TCC1: OBLIGATION
    FORALL (a, b, c, d: T): a <= b AND b < c AND c <= d IMPLIES a < d;


body:
  integral_bounded[T: TYPE FROM real]: THEORY
  %------------------------------------------------------------------------------
  %
  %  An Integrable Function is bounded
  %
  %  Author:  Rick Butler               NASA Langley
  %
  %------------------------------------------------------------------------------
  BEGIN

     ASSUMING
        IMPORTING deriv_domain_def[T]

        connected_domain : ASSUMPTION connected?[T]


        not_one_element : ASSUMPTION not_one_element?[T]

     ENDASSUMING

     AUTO_REWRITE+ not_one_element

     IMPORTING reals@sigma_below,
               integral_prep[T]

     a,b,c,d,x,y,z: VAR T

     f,f1,f2,g: VAR [T -> real]

     eps, delta: VAR posreal

     xv,yv: VAR real


     
  %    integrable?(a:T,b:{x:T|a<x})(f:[T->real]): bool = 
  %                     integrable?(a,b,f)


     bounded_on?(a,b,f): bool = (EXISTS (B: real): 
                     (FORALL (x: closed_interval(a,b)): abs(f(x)) <= B))

     int_to_bnd: LEMMA  % Rosenlicht pg 122 
                      a < b IMPLIES
                 (integrable?(a,b,f) IMPLIES 
                     (EXISTS (EP: partition[T](a,b)):
                             FORALL (j: below(length(EP) - 1)):
                                bounded_on?(EP(j), EP(1 + j), f)))



     bounded_on_all?(a:T,b:{x:T|a<x},P: partition[T](a,b))(f:[T->real]): bool = 
               (FORALL (j: below(P`length - 1)): bounded_on?((P(j),P(j+1),f)))
  		   

     bounded_on_all_lem: LEMMA  % Rosenlicht pg 122 
                      a < b IMPLIES
                 integrable?(a,b,f) IMPLIES 
                     (EXISTS (P: partition[T](a,b)): bounded_on_all?(a,b,P)(f))


     MINj_prep: LEMMA FORALL (a: T, b: {x: T | a < x}, 
                              P: partition[T](a, b), 
                              f: (bounded_on_all?(a, b, P)),
                              j: below(P`length - 1)):
  		   nonempty?[real] ({fx: real | EXISTS (xx: T):
  		         P`seq(j) <= xx AND xx <= P`seq(1 + j) AND fx = f(xx)})
  		    AND
  		    bounded?({fx: real | EXISTS (xx: T):
  			P`seq(j) <= xx AND xx <= P`seq(1 + j) AND fx = f(xx)})


     MINj(a:T,b:{x:T|a<x},P: partition[T](a,b),j: below(length(P)-1), 
               f: (bounded_on_all?(a,b,P))): real =
                    glb({fx: real | EXISTS (xx: T):
                                    P`seq(j) <= xx AND xx <= P`seq(1 + j) AND
                                    fx = f(xx)})

     MINj_lem: LEMMA a < b IMPLIES
                       FORALL (P: partition[T](a, b),
                               f: (bounded_on_all?(a, b, P)),
                               j: below(length(P)-1),
                               x: closed_interval[T](seq(P)(j), seq(P)(1+j))):
                           MINj(a,b,P,j,f) <= f(x)

     MAXj(a:T,b:{x:T|a<x},P: partition[T](a,b),j: below(length(P)-1),
              f: (bounded_on_all?(a,b,P))): real =
                    lub({fx: real | EXISTS (xx: T):
                                    P`seq(j) <= xx AND xx <= P`seq(1 + j) AND
                                    fx = f(xx)})

     MAXj_lem: LEMMA a < b IMPLIES
                       FORALL (P: partition[T](a, b),
                               f: (bounded_on_all?(a, b, P)),
                               j: below(length(P)-1),
                               x: closed_interval[T](seq(P)(j), seq(P)(1+j))):
                           MAXj(a,b,P,j,f) >= f(x)



      MIN_ALL(a:T,b:{x:T|a<x},P: partition[T](a,b),
              f: (bounded_on_all?(a,b,P))): real =
           min({mm: real | EXISTS (jj: below(length(P) - 1)): 
                                mm = MINj(a,b,P,jj,f)})

      MAX_ALL(a:T,b:{x:T|a<x},P: partition[T](a,b), 
             f: (bounded_on_all?(a,b,P))): real =
             max({mm: real | EXISTS (jj: below(length(P) - 1)): 
                               mm = MAXj(a,b,P,jj,f)})

      MIN_ALL_lem: LEMMA  a < b IMPLIES
                      FORALL (P: partition[T](a, b),
                              f: (bounded_on_all?(a, b, P)),
                              x: closed_interval(a,b)):
                           MIN_ALL(a, b, P, f) <= f(x)

      MAX_ALL_lem: LEMMA  a < b IMPLIES
                      FORALL (P: partition[T](a, b),
                              f: (bounded_on_all?(a, b, P)),
                              x: closed_interval(a,b)):
                           MAX_ALL(a, b, P, f) >= f(x)


     bounded_on_all_is: LEMMA a < b AND 
                             (EXISTS (P: partition[T](a,b)): 
                                     bounded_on_all?(a,b,P)(f))
                             IMPLIES bounded_on?(a, b, f)


     integrable_bounded: LEMMA a < b AND % Rosenlicht pg 122 
                               integrable?(a,b,f) 
                            IMPLIES bounded_on?(a, b, f)


     bnded_on?(a:T,b:{x:T|a<x})(f:[T->real]): bool = bounded_on?(a, b, f)


     bnd_on_lem: LEMMA a < b IMPLIES FORALL (P: partition[T](a,b)): 
                       bounded_on?(a, b, f)
                    IMPLIES  bounded_on_all?(a, b, P)(f)

     integrable_bounded_on_all: LEMMA a < b IMPLIES 
                    FORALL (P: partition[T](a,b)): 
                    integrable?(a, b, f) IMPLIES 
                           bounded_on_all?(a, b, P)(f)



  END integral_bounded

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 24, column 13) for  integral_prep[T]
      % generated from assumption integral_prep.connected_domain
  IMP_integral_prep_TCC1: OBLIGATION connected?[T];

  % Assuming TCC generated (at line 24, column 13) for  integral_prep[T]
      % generated from assumption integral_prep.not_one_element
  IMP_integral_prep_TCC2: OBLIGATION not_one_element?[T];

  % Subtype TCC generated (at line 48, column 45) for  j
      % expected type  below[length(EP)]
  int_to_bnd_TCC1: OBLIGATION
    FORALL (a, b: T, f: [T -> real]):
      a < b AND integrable?(a, b, f) IMPLIES
       (FORALL (EP: partition[T](a, b), j: below(length(EP) - 1)):
          j < length(EP));

  % Subtype TCC generated (at line 48, column 52) for  1 + j
      % expected type  below[length(EP)]
  int_to_bnd_TCC2: OBLIGATION
    FORALL (a, b: T, f: [T -> real]):
      a < b AND integrable?(a, b, f) IMPLIES
       (FORALL (EP: partition[T](a, b), j: below(length(EP) - 1)):
          1 + j < length(EP));

  % Subtype TCC generated (at line 53, column 62) for  j
      % expected type  below[length(P)]
  bounded_on_all?_TCC1: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition[T](a, b),
            j: below(P`length - 1)):
      j < length(P);

  % Subtype TCC generated (at line 53, column 67) for  j + 1
      % expected type  below[length(P)]
  bounded_on_all?_TCC2: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition[T](a, b),
            j: below(P`length - 1)):
      j + 1 < length(P);

  % Subtype TCC generated (at line 67, column 42) for  1 + j
      % expected type  below[P`length]
  MINj_prep_TCC1: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition[T](a, b),
            f: (bounded_on_all?(a, b, P)), j: below(P`length - 1), xx: T):
      P`seq(j) <= xx IMPLIES 1 + j < P`length;

  % Subtype TCC generated (at line 73, column 54) for  length(P) - 1
      % expected type  nat
  MINj_TCC1: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition[T](a, b)):
      length(P) - 1 >= 0;

  % Subtype TCC generated (at line 75, column 22) for
      % {fx: real |
      %    EXISTS (xx: T):
      %      P`seq(j) <= xx AND xx <= P`seq(1 + j) AND fx = f(xx)}
      % expected type  SB: (bounded_below?)
  MINj_TCC2: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition[T](a, b),
            j: below(length(P) - 1), f: (bounded_on_all?(a, b, P))):
      nonempty?[real]
          ({fx: real |
              EXISTS (xx: T):
                P`seq(j) <= xx AND xx <= P`seq(1 + j) AND fx = f(xx)})
       AND
       bounded_below?({fx: real |
                         EXISTS (xx: T):
                           P`seq(j) <= xx AND
                            xx <= P`seq(1 + j) AND fx = f(xx)});

  % Subtype TCC generated (at line 88, column 22) for
      % {fx: real |
      %    EXISTS (xx: T):
      %      P`seq(j) <= xx AND xx <= P`seq(1 + j) AND fx = f(xx)}
      % expected type  SA: (bounded_above?)
  MAXj_TCC1: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition[T](a, b),
            j: below(length(P) - 1), f: (bounded_on_all?(a, b, P))):
      nonempty?[real]
          ({fx: real |
              EXISTS (xx: T):
                P`seq(j) <= xx AND xx <= P`seq(1 + j) AND fx = f(xx)})
       AND
       bounded_above?({fx: real |
                         EXISTS (xx: T):
                           P`seq(j) <= xx AND
                            xx <= P`seq(1 + j) AND fx = f(xx)});

  % Subtype TCC generated (at line 103, column 13) for
      % {mm: real |
      %    EXISTS (jj: below(length(P) - 1)): mm = MINj(a, b, P, jj, f)}
      % expected type  SS: non_empty_finite_set[real]
  MIN_ALL_TCC1: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition[T](a, b),
            f: (bounded_on_all?(a, b, P))):
      is_finite[real]
          ({mm: real |
              EXISTS (jj: below(length(P) - 1)): mm = MINj(a, b, P, jj, f)})
       AND
       NOT empty?[real]
               ({mm: real |
                   EXISTS (jj: below(length(P) - 1)):
                     mm = MINj(a, b, P, jj, f)});

  % Subtype TCC generated (at line 108, column 15) for
      % {mm: real |
      %    EXISTS (jj: below(length(P) - 1)): mm = MAXj(a, b, P, jj, f)}
      % expected type  SS: non_empty_finite_set[real]
  MAX_ALL_TCC1: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition[T](a, b),
            f: (bounded_on_all?(a, b, P))):
      is_finite[real]
          ({mm: real |
              EXISTS (jj: below(length(P) - 1)): mm = MAXj(a, b, P, jj, f)})
       AND
       NOT empty?[real]
               ({mm: real |
                   EXISTS (jj: below(length(P) - 1)):
                     mm = MAXj(a, b, P, jj, f)});


body:
  integral_split_scaf[T: TYPE FROM real]: THEORY
  %------------------------------------------------------------------------------
  %
  %  Scaffolding :  Rick Butler
  %
  %------------------------------------------------------------------------------
  BEGIN

     ASSUMING
        IMPORTING deriv_domain_def[T]

        connected_domain : ASSUMPTION connected?[T]


        not_one_element : ASSUMPTION not_one_element?[T]

     ENDASSUMING


     IMPORTING reals@sigma_below, 
               step_fun_def[T], 
               integral_step[T],
               %% step_fun_props[T],
               integral_bounded[T]

     a,b,c,d,x,y,z: VAR T

     f,f1,f2,g: VAR [T -> real]

     eps, delta: VAR posreal

     xv,yv: VAR real


     diff_step_is_step_on: LEMMA a < b IMPLIES FORALL (P: partition[T](a,b)): 
                              step_function_on?(a, b, f, P) AND    
                              step_function_on?(a, b, g, P)
                           IMPLIES
                             step_function_on?(a, b, f - g, P)

     se_not_on: LEMMA FORALL (P: partition[T](a,b)):  
                      FORALL (ii,jj: below(length(P) - 1)):
                      FORALL (x: open_interval[T](seq(P)(ii), seq(P)(1 + ii))):
                            x /= seq(P)(jj)


     find_P_sec(a:T, b:{x:T|a<x}, P: partition[T](a,b), xx: closed_interval(a,b)):
                {ii: below(length(P)-1) |
                                         seq(P)(ii) <= xx AND xx <= seq(P)(ii+1)}

     find_P_sec_lem: LEMMA a < b IMPLIES (FORALL (xx: closed_interval(a,b)):
                                 FORALL (P: partition[T](a,b)):  
                                 LET JJ = find_P_sec(a,b,P,xx) IN
                                     seq(P)(JJ) <= xx AND xx <= seq(P)(JJ+1) )

     find_P_sec_in: LEMMA a < b IMPLIES
                        FORALL (P: partition[T](a,b)):  
                        FORALL (ii: below(length(P) - 1)):
                        FORALL (x: open_interval[T](seq(P)(ii),seq(P)(1 + ii))):
                            find_P_sec(a, b, P, x) = ii



      gen3P(a,b,c): finite_sequence[T] = 
                    (# length := 3,
                       seq := (LAMBDA (ii: below(3)):
                                  IF ii = 0 THEN a
                                  ELSIF ii = 1 then b
                                  ELSE c ENDIF)   #) 



      F1(a:T,b:{x:T|a<x}, P: partition[T](a,b), 
          f: (bnded_on?(a,b)))(x:T): real = 
                       IF x < a OR x > b THEN 0 
                       ELSE 
                        LET JJ = find_P_sec(a,b,P,x) IN
                           IF x = P(JJ) OR x = P(JJ+1) THEN MIN_ALL(a,b,P,f)
                           ELSE MINj(a,b,P,JJ,f)
                           ENDIF
                        ENDIF

      F2(a:T,b:{x:T|a<x}, P: partition[T](a,b), 
          f: (bnded_on?(a,b)))(x:T): real =                       
                       IF x < a OR x > b THEN 0
   		      ELSE
   		         LET JJ = find_P_sec(a,b,P,x)IN
   		           IF x = P(JJ) OR x = P(JJ+1) THEN MAX_ALL(a,b,P,f)
   		           ELSE MAXj(a,b,P,JJ,f)
   		           ENDIF              
                        ENDIF


     F1_F2_lem: LEMMA a < b AND integrable?(a,b,f) IMPLIES
                      FORALL (P: partition[T](a, b)):
                        step_function_on?(a,b,F1(a,b,P,f),P) AND 
                        step_function_on?(a,b,F2(a,b,P,f),P) AND
                        (FORALL (x: closed_interval(a,b)):
                          F1(a,b,P,f)(x) <= f(x) AND f(x) <= F2(a,b,P,f)(x))


     epsilon_is_0: LEMMA (FORALL eps: abs(xv) < eps) IMPLIES xv = 0


     F2_F1_step_function_on: LEMMA a < b AND integrable?(a,b,f) IMPLIES
                      FORALL (P: partition[T](a, b)):
                        LET N = length(P) - 1 IN
           step_function_on?[T](a, b, F2(a, b, P, f) - F1(a, b, P, f),P)

    integrable_F2_F1: LEMMA a < b AND integrable?(a,b,f) IMPLIES
                      FORALL (P: partition[T](a, b)):
                        LET N = length(P) - 1 IN
           integrable?[T](a, b, F2(a, b, P, f) - F1(a, b, P, f))



    integral_F2_F1: LEMMA a < b AND integrable?(a,b,f) IMPLIES
                      FORALL (P: partition[T](a, b)):
                        LET N = length(P) - 1 IN
                        integral(a,b,F2(a,b,P,f)-F1(a,b,P,f)) =
                          sigma(0,N-1, (LAMBDA (j: below(N)):
                            Let DP = P(j+1)-P(j), 
                                DELj = MAXj(a,b,P,j,f) - MINj(a,b,P,j,f) IN
                            DELj* DP))
                                     
     se_prep: LEMMA a < b IMPLIES
                       FORALL (P: partition[T](a, b),
                               f: (bounded_on_all?(a, b, P)),
                               j: below(length(P) - 1),
                               nu: posreal):
        (EXISTS  (xp: closed_interval[T](P`seq(j),P`seq(j+1))):
                   f(xp) < MINj(a,b,P,j,f) + nu) AND
        (EXISTS  (xpp: closed_interval[T](P`seq(j),P`seq(j+1))):
                   f(xpp) > MAXj(a,b,P,j,f) - nu)

     get_xp(a:T,b:{x:T|a<x}, P: partition[T](a,b), f: (bounded_on_all?(a,b,P)),
            j: below(length(P) - 1), nu: posreal):
            {xp: closed_interval[T](P`seq(j),P`seq(j+1)) |   
                        f(xp) < MINj(a,b,P,j,f) + nu}

     get_xpp(a:T,b:{x:T|a<x}, P: partition[T](a,b), f: (bounded_on_all?(a,b,P)),
            j: below(length(P) - 1), nu: posreal):
            {xpp: closed_interval[T](P`seq(j),P`seq(j+1)) |   
                        f(xpp) > MAXj(a,b,P,j,f) - nu}

     
     lt_via_epsi: LEMMA FORALL (x,a: real):
                          (FORALL (epsi: posreal): x < a + epsi)
                              IMPLIES x <= a

     sigma_all_parts: LEMMA  a < b IMPLIES
                        FORALL (P: partition[T](a, b)):
          sigma(0,length(P)-2,(LAMBDA (j: below(length(P) - 1)): P(j+1) - P(j)))
                         =   b - a


     steps_exist: LEMMA  % Proposition of Rosenlicht on pg 120 (reverse dir.)
                         % See step_to_integrable in integral_prep for other
                      a < b IMPLIES
                 (integrable?(a,b,f) IMPLIES
                     (FORALL eps: EXISTS (f1,f2):
                          step_function?(a,b,f1) AND 
                          step_function?(a,b,f2) AND
                        (FORALL (x: closed_interval(a,b)):
                             f1(x) <= f(x) AND f(x) <= f2(x)) AND
                        integrable?(a,b,f2-f1) AND
                        integral(a,b,f2-f1) < eps))


     partition_exists: LEMMA a < b IMPLIES     
                          (EXISTS (P: partition[T](a,b)): width(a,b,P) < delta)


     
  END integral_split_scaf

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 21, column 13) for  step_fun_def[T]
      % generated from assumption step_fun_def.connected_domain
  IMP_step_fun_def_TCC1: OBLIGATION connected?[T];

  % Assuming TCC generated (at line 21, column 13) for  step_fun_def[T]
      % generated from assumption step_fun_def.not_one_element
  IMP_step_fun_def_TCC2: OBLIGATION not_one_element?[T];

  % Subtype TCC generated (at line 44, column 38) for  jj
      % expected type  below[P`length]
  se_not_on_TCC1: OBLIGATION
    FORALL (a, b: T, P: partition[T](a, b), ii, jj: below(length(P) - 1),
            x: open_interval[T](seq(P)(ii), seq(P)(1 + ii))):
      jj < P`length;

  % Subtype TCC generated (at line 47, column 76) for  b
      % expected type  {x: T | a <= x}
  find_P_sec_TCC1: OBLIGATION FORALL (a: T, b: {x: T | a < x}): a <= b;

  % Subtype TCC generated (at line 49, column 46) for  ii
      % expected type  below[P`length]
  find_P_sec_TCC2: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition[T](a, b),
            ii: below(length(P) - 1)):
      ii < P`length;

  % Subtype TCC generated (at line 49, column 73) for  ii + 1
      % expected type  below[P`length]
  find_P_sec_TCC3: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition[T](a, b),
            xx: closed_interval(a, b), ii: below(length(P) - 1)):
      seq(P)(ii) <= xx IMPLIES ii + 1 < P`length;

  % Existence TCC generated (at line 47, column 3) for
      % find_P_sec(a: T, b: {x: T | a < x}, P: partition[T](a, b),
      %            xx: closed_interval(a, b)):
      %       {ii: below(length(P) - 1) |
      %                seq(P)(ii) <= xx AND xx <= seq(P)(ii + 1)}
  find_P_sec_TCC4: OBLIGATION
    EXISTS (x1:
              [d:
                 [a: T, b: {x: T | a < x}, partition[T](a, b),
                  closed_interval[T](a, b)] ->
                 {ii: below(length(d`3) - 1) |
                          seq(d`3)(ii) <= d`4 AND d`4 <= seq(d`3)(1 + ii)}]):
      TRUE;

  % Subtype TCC generated (at line 54, column 42) for  JJ
      % expected type  below[P`length]
  find_P_sec_lem_TCC1: OBLIGATION
    FORALL (a, b: T):
      a < b IMPLIES
       (FORALL (xx: closed_interval[T](a, b), P: partition[T](a, b),
                JJ:
                  {ii: below(length(P) - 1) |
                           seq(P)(ii) <= xx AND xx <= seq(P)(1 + ii)}):
          JJ = find_P_sec(a, b, P, xx) IMPLIES JJ < P`length);

  % Subtype TCC generated (at line 54, column 69) for  JJ + 1
      % expected type  below[P`length]
  find_P_sec_lem_TCC2: OBLIGATION
    FORALL (a, b: T):
      a < b IMPLIES
       (FORALL (xx: closed_interval[T](a, b), P: partition[T](a, b),
                JJ:
                  {ii: below(length(P) - 1) |
                           seq(P)(ii) <= xx AND xx <= seq(P)(1 + ii)}):
          seq(P)(JJ) <= xx AND JJ = find_P_sec(a, b, P, xx) IMPLIES
           JJ + 1 < P`length);

  % Subtype TCC generated (at line 60, column 46) for  x
      % expected type  closed_interval[T](a, b)
  find_P_sec_in_TCC1: OBLIGATION
    FORALL (a, b: T):
      a < b IMPLIES
       (FORALL (P: partition[T](a, b), ii: below(length(P) - 1),
                x: open_interval[T](seq(P)(ii), seq(P)(1 + ii))):
          a <= x AND x <= b);

  % Subtype TCC generated (at line 77, column 48) for  x
      % expected type  closed_interval[T](a, b)
  F1_TCC1: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition[T](a, b),
            f: (bnded_on?[T](a, b)), x: T):
      NOT x < a AND NOT x > b IMPLIES a <= x AND x <= b;

  % Subtype TCC generated (at line 78, column 34) for  JJ
      % expected type  below[length(P)]
  F1_TCC2: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition[T](a, b),
            f: (bnded_on?[T](a, b)), x: T):
      NOT x < a AND NOT x > b IMPLIES
       (FORALL (JJ:
                  {ii: below(length(P) - 1) |
                           seq(P)(ii) <= x AND x <= seq(P)(1 + ii)}):
          JJ = find_P_sec(a, b, P, x) IMPLIES JJ < length(P));

  % Subtype TCC generated (at line 78, column 47) for  JJ + 1
      % expected type  below[length(P)]
  F1_TCC3: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition[T](a, b),
            f: (bnded_on?[T](a, b)), x: T):
      NOT x < a AND NOT x > b IMPLIES
       (FORALL (JJ:
                  {ii: below(length(P) - 1) |
                           seq(P)(ii) <= x AND x <= seq(P)(1 + ii)}):
          NOT x = finseq_appl[closed_interval[T](a, b)](P)(JJ) AND
           JJ = find_P_sec(a, b, P, x)
           IMPLIES JJ + 1 < length(P));

  % Subtype TCC generated (at line 78, column 72) for  f
      % expected type  (bounded_on_all?(a, b, P))
  F1_TCC4: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition[T](a, b),
            f: (bnded_on?[T](a, b)), x: T):
      NOT x < a AND NOT x > b IMPLIES
       (FORALL (JJ:
                  {ii: below(length(P) - 1) |
                           seq(P)(ii) <= x AND x <= seq(P)(1 + ii)}):
          (x = finseq_appl[closed_interval[T](a, b)](P)(JJ) OR
            x = finseq_appl[closed_interval[T](a, b)](P)(JJ + 1))
           AND JJ = find_P_sec(a, b, P, x)
           IMPLIES bounded_on_all?[T](a, b, P)(f));

  % Subtype TCC generated (at line 79, column 44) for  f
      % expected type  (bounded_on_all?(a, b, P))
  F1_TCC5: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition[T](a, b),
            f: (bnded_on?[T](a, b)), x: T):
      NOT x < a AND NOT x > b IMPLIES
       (FORALL (JJ:
                  {ii: below(length(P) - 1) |
                           seq(P)(ii) <= x AND x <= seq(P)(1 + ii)}):
          NOT x = finseq_appl[closed_interval[T](a, b)](P)(JJ) AND
           NOT x = finseq_appl[closed_interval[T](a, b)](P)(JJ + 1) AND
            JJ = find_P_sec(a, b, P, x)
           IMPLIES bounded_on_all?[T](a, b, P)(f));

  % Subtype TCC generated (at line 96, column 53) for  f
      % expected type  (bnded_on?(a, b))
  F1_F2_lem_TCC1: OBLIGATION
    FORALL (a, b: T, f: [T -> real]):
      integrable?(a, b, f) AND a < b IMPLIES
       (FORALL (P: partition[T](a, b)): bnded_on?[T](a, b)(f));

  % Subtype TCC generated (at line 120, column 35) for
      % F2(a, b, P, f) - F1(a, b, P, f)
      % expected type  {f | integrable?(a, b, f)}
  integral_F2_F1_TCC1: OBLIGATION
    FORALL (a, b: T, f: [T -> real]):
      integrable?(a, b, f) AND a < b IMPLIES
       (FORALL (P: partition[T](a, b), N: int):
          N = length(P) - 1 IMPLIES
           integrable?[T](a, b, (-[T])(F2(a, b, P, f), F1(a, b, P, f))));

  % Subtype TCC generated (at line 121, column 30) for  0
      % expected type  T_low[below(N)]
  integral_F2_F1_TCC2: OBLIGATION
    FORALL (a, b: T, f: [T -> real]):
      integrable?(a, b, f) AND a < b IMPLIES
       (FORALL (P: partition[T](a, b), N: int):
          N = length(P) - 1 IMPLIES
           0 >= 0 AND 0 < N OR (EXISTS (j: below(N)): j <= 0));

  % Subtype TCC generated (at line 121, column 32) for  N - 1
      % expected type  T_high[below(N)]
  integral_F2_F1_TCC3: OBLIGATION
    FORALL (a, b: T, f: [T -> real]):
      integrable?(a, b, f) AND a < b IMPLIES
       (FORALL (P: partition[T](a, b), N: int):
          N = length(P) - 1 IMPLIES
           N - 1 >= 0 AND N - 1 < N OR (EXISTS (j: below(N)): N - 1 <= j));

  % Subtype TCC generated (at line 122, column 37) for  j + 1
      % expected type  below[length(P)]
  integral_F2_F1_TCC4: OBLIGATION
    FORALL (a, b: T, f: [T -> real]):
      integrable?(a, b, f) AND a < b IMPLIES
       (FORALL (P: partition[T](a, b), N: int):
          N = length(P) - 1 IMPLIES
           (FORALL (j: below(N)): j + 1 < length(P)));

  % Subtype TCC generated (at line 122, column 44) for  j
      % expected type  below[length(P)]
  integral_F2_F1_TCC5: OBLIGATION
    FORALL (a, b: T, f: [T -> real]):
      integrable?(a, b, f) AND a < b IMPLIES
       (FORALL (P: partition[T](a, b), N: int):
          N = length(P) - 1 IMPLIES (FORALL (j: below(N)): j < length(P)));

  % Subtype TCC generated (at line 123, column 48) for  j
      % expected type  below(length(P) - 1)
  integral_F2_F1_TCC6: OBLIGATION
    FORALL (a, b: T, f: [T -> real]):
      integrable?(a, b, f) AND a < b IMPLIES
       (FORALL (P: partition[T](a, b), N: int):
          N = length(P) - 1 IMPLIES
           (FORALL (j: below(N), DP: real):
              DP =
               finseq_appl[closed_interval[T](a, b)](P)(j + 1) -
                finseq_appl[closed_interval[T](a, b)](P)(j)
               IMPLIES j < length(P) - 1));

  % Subtype TCC generated (at line 123, column 50) for  f
      % expected type  (bounded_on_all?(a, b, P))
  integral_F2_F1_TCC7: OBLIGATION
    FORALL (a, b: T, f: [T -> real]):
      integrable?(a, b, f) AND a < b IMPLIES
       (FORALL (P: partition[T](a, b), N: int):
          N = length(P) - 1 IMPLIES
           (FORALL (j: below(N), DP: real):
              DP =
               finseq_appl[closed_interval[T](a, b)](P)(j + 1) -
                finseq_appl[closed_interval[T](a, b)](P)(j)
               IMPLIES bounded_on_all?[T](a, b, P)(f)));

  % Assuming TCC generated (at line 21, column 12) for  reals@sigma[below(N)]
      % generated from assumption sigma.connected_domain
  integral_F2_F1_TCC8: OBLIGATION
    FORALL (a, b: T, f: [T -> real]):
      integrable?(a, b, f) AND a < b IMPLIES
       (FORALL (P: partition[T](a, b), N: int):
          N = length(P) - 1 IMPLIES
           (FORALL (x, y: below(N)), (z: integer):
              x <= z AND z <= y IMPLIES z >= 0 AND z < N));

  % Subtype TCC generated (at line 137, column 19) for  length(P) - 1
      % expected type  nat
  get_xp_TCC1: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition[T](a, b)):
      length(P) - 1 >= 0;

  % Subtype TCC generated (at line 138, column 51) for  1 + j
      % expected type  below[P`length]
  get_xp_TCC2: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition[T](a, b),
            j: below(length(P) - 1), x: T):
      P`seq(j) <= x IMPLIES 1 + j < P`length;

  % Existence TCC generated (at line 136, column 3) for
      % get_xp(a: T, b: {x: T | a < x}, P: partition[T](a, b),
      %        f: (bounded_on_all?(a, b, P)), j: below(length(P) - 1),
      %        nu: posreal):
      %       {xp: closed_interval[T](P`seq(j), P`seq(j + 1)) |
      %                f(xp) < MINj(a, b, P, j, f) + nu}
  get_xp_TCC3: OBLIGATION
    EXISTS (x1:
              [d:
                 [a: T, b: {x: T | a < x}, P: partition[T](a, b),
                  (bounded_on_all?[T](a, b, P)), below(length(P) - 1),
                  posreal] ->
                 {xp: closed_interval[T](d`3`seq(d`5), d`3`seq(1 + d`5)) |
                          d`4(xp) <
                           MINj[T](d`1, d`2, d`3, d`5, d`4) + d`6}]):
      TRUE;

  % Existence TCC generated (at line 141, column 3) for
      % get_xpp(a: T, b: {x: T | a < x}, P: partition[T](a, b),
      %         f: (bounded_on_all?(a, b, P)), j: below(length(P) - 1),
      %         nu: posreal):
      %       {xpp: closed_interval[T](P`seq(j), P`seq(j + 1)) |
      %                f(xpp) > MAXj(a, b, P, j, f) - nu}
  get_xpp_TCC1: OBLIGATION
    EXISTS (x1:
              [d:
                 [a: T, b: {x: T | a < x}, P: partition[T](a, b),
                  (bounded_on_all?[T](a, b, P)), below(length(P) - 1),
                  posreal] ->
                 {xpp: closed_interval[T](d`3`seq(d`5), d`3`seq(1 + d`5)) |
                          d`4(xpp) >
                           MAXj[T](d`1, d`2, d`3, d`5, d`4) - d`6}]):
      TRUE;

  % Subtype TCC generated (at line 153, column 14) for  0
      % expected type  T_low[below(length(P) - 1)]
  sigma_all_parts_TCC1: OBLIGATION
    FORALL (a, b: T):
      a < b IMPLIES
       (FORALL (P: partition[T](a, b)):
          0 >= 0 AND 0 < length(P) - 1 OR
           (EXISTS (j: below(length(P) - 1)): j <= 0));

  % Subtype TCC generated (at line 153, column 16) for  length(P) - 2
      % expected type  T_high[below(length(P) - 1)]
  sigma_all_parts_TCC2: OBLIGATION
    FORALL (a, b: T):
      a < b IMPLIES
       (FORALL (P: partition[T](a, b)):
          length(P) - 2 >= 0 AND length(P) - 2 < length(P) - 1 OR
           (EXISTS (j: below(length(P) - 1)): length(P) - 2 <= j));

  % Subtype TCC generated (at line 153, column 65) for  j + 1
      % expected type  below[length(P)]
  sigma_all_parts_TCC3: OBLIGATION
    FORALL (a, b: T):
      a < b IMPLIES
       (FORALL (P: partition[T](a, b), j: below(length(P) - 1)):
          j + 1 < length(P));

  % Subtype TCC generated (at line 153, column 74) for  j
      % expected type  below[length(P)]
  sigma_all_parts_TCC4: OBLIGATION
    FORALL (a, b: T):
      a < b IMPLIES
       (FORALL (P: partition[T](a, b), j: below(length(P) - 1)):
          j < length(P));

  % Assuming TCC generated (at line 21, column 12) for
      % reals@sigma[below(length(P) - 1)]
      % generated from assumption sigma.connected_domain
  sigma_all_parts_TCC5: OBLIGATION
    FORALL (a, b: T):
      a < b IMPLIES
       (FORALL (P: partition[T](a, b)):
          FORALL (x, y: below(length(P) - 1)), (z: integer):
            x <= z AND z <= y IMPLIES z >= 0 AND z < length(P) - 1);


body:
  integral_split[T: TYPE+ FROM real]: THEORY
  %------------------------------------------------------------------------------
  %  Integral Split: integral(a,b,f) + integral(b,c,f) = integral(a,c,f) 
  %
  %  Theory and proofs taken from Introduction to Analysis (Maxwell Rosenlicht)
  %
  %  Author:  Rick Butler               NASA Langley
  %------------------------------------------------------------------------------
  BEGIN

     ASSUMING
        IMPORTING deriv_domain_def[T]

        connected_domain : ASSUMPTION connected?[T]


        not_one_element  : ASSUMPTION not_one_element?[T]

     ENDASSUMING

     AUTO_REWRITE+ not_one_element


     IMPORTING integral_split_scaf, 
               step_fun_props,
               reals@sigma_below, 
               structures@concat_arrays, reals@sigma_below_sub

     a,b,c,d,x,y,z: VAR T
     f,f1,f2,g: VAR [T -> real]
     eps, delta: VAR posreal
     xv,yv: VAR real


  %    step_function_subrng: LEMMA a <= b AND b < c AND c <= d AND 
  %                                step_function?(a, d, f)
  %                                IMPLIES step_function?(b, c, f)


     partition_join: LEMMA a < b AND b < c IMPLIES  
                        (FORALL (Pa: partition[T](a,b), xisa:(xis?(a,b,Pa)),
                                 Pb: partition[T](b,c), xisb:(xis?(b,c,Pb))):
                     width(a,b,Pa) < delta AND
                     width(b,c,Pb) < delta
                        IMPLIES
                           (EXISTS (PP: partition[T](a,c), xisp:(xis?(a,c,PP))):
                               width(a,c,PP) < delta
                               AND Rie_sum(a, c, PP, xisp, f) =
                                   Rie_sum(a, b, Pa, xisa, f) + 
                                        Rie_sum(b, c, Pb, xisb, f)))


     iss_prep: LEMMA a < b AND b < c IMPLIES  
                                FORALL (P: partition[T](a,c)):
                                 step_function_on?(a, c, f, P)
                    IMPLIES 
                       EXISTS (PP: partition[T](a,c)): 
                   step_function_on?(a, c, f, PP) AND
                   (EXISTS (ib: below(length(PP))): seq(PP)(ib) = b)


     integrable_split_step: LEMMA a < b AND b < c AND   %% Rosenlight: clearly T
                                    integrable?(a,b,f) AND 
                                    integrable?(b,c,f) AND
                                    step_function?(a,c,f)
                               IMPLIES integrable?(a,c,f) AND
                                       integral(a,b,f) + integral(b,c,f) 
                                            = integral(a,c,f) 


     integrable_split: LEMMA a < b AND b < c AND   
                             integrable?(a,b,f) AND 
                             integrable?(b,c,f) 
                          IMPLIES integrable?(a,c,f)         


     integral_split: THEOREM a < b AND b < c AND  
                           integrable?(a,b,f) AND 
                           integrable?(b,c,f) 
                               IMPLIES integrable?(a,c,f) AND
                             integral(a,b,f) + integral(b,c,f) = integral(a,c,f) 


     integrable?_split: LEMMA a < b AND b < c AND     
                              integrable?(a, c, f) IMPLIES
                              integrable?(a, b, f) AND integrable?(b, c, f)  


     integrable?_inside: LEMMA a <= x AND x < y AND y <= b AND
                               integrable?(a,b,f)
                            IMPLIES integrable?(x,y,f)




  %   step_function_on_subrng: LEMMA a <= b AND b < c AND c <= d IMPLIES 
  %                              FORALL (P: partition[T](a,d)):
  %          LET N  = length(P),
  %              ib = min_nat.min({ii: below(N) | seq(P)(ii) > b}),
  %              ic = max_below[N].max({ii: below(N) | seq(P)(ii) < c}) IN
  %                               step_function_on?(a, d, f, P)
  %                  IMPLIES step_function_on?(b, c, f, #(b) o P^(ib,ic) o #(c))
     
  END integral_split

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 14, column 6) for  integral_def[T]
      % generated from assumption integral_def.connected_domain
  partition_join_TCC1: OBLIGATION
    FORALL (a, b, c: T): b < c AND a < b IMPLIES connected?[T];

  % Assuming TCC generated (at line 17, column 6) for  integral_def[T]
      % generated from assumption integral_def.not_one_element
  partition_join_TCC2: OBLIGATION
    FORALL (a, b, c: T): b < c AND a < b IMPLIES not_one_element?[T];

  % Subtype TCC generated (at line 47, column 37) for  c
      % expected type  {x: T | a < x}
  partition_join_TCC3: OBLIGATION
    FORALL (a, b, c: T, delta: posreal):
      b < c AND a < b IMPLIES
       (FORALL (Pa: partition[T](a, b), xisa: (xis?[T](a, b, Pa)),
                Pb: partition[T](b, c), xisb: (xis?[T](b, c, Pb))):
          width(a, b, Pa) < delta AND width(b, c, Pb) < delta IMPLIES
           (FORALL (PP: partition[T](a, c), xisp: (xis?[T](a, c, PP))):
              a < c));

  % Subtype TCC generated (at line 55, column 52) for  c
      % expected type  {x: T | a < x}
  iss_prep_TCC1: OBLIGATION
    FORALL (a, b, c: T):
      b < c AND a < b IMPLIES (FORALL (P: partition[T](a, c)): a < c);

  % Subtype TCC generated (at line 65, column 51) for  c
      % expected type  {x: T | a < x}
  integrable_split_step_TCC1: OBLIGATION
    FORALL (a, b, c: T, f: [T -> real]):
      a < b AND b < c AND integrable?(a, b, f) AND integrable?(b, c, f)
       IMPLIES a < c;

  % Subtype TCC generated (at line 85, column 43) for  c
      % expected type  {x: T | a < x}
  integrable?_split_TCC1: OBLIGATION
    FORALL (a, b, c: T): a < b AND b < c IMPLIES a < c;

  % Subtype TCC generated (at line 90, column 43) for  b
      % expected type  {x: T | a < x}
  integrable?_inside_TCC1: OBLIGATION
    FORALL (a, b, x, y: T): a <= x AND x < y AND y <= b IMPLIES a < b;

  % Assuming TCC generated (at line 26, column 13) for  integral_def[T]
      % generated from assumption integral_def.connected_domain
  integrable?_inside_TCC2: OBLIGATION
    FORALL (a, b, x, y: T): a <= x AND x < y AND y <= b IMPLIES connected?[T];

  % Assuming TCC generated (at line 26, column 13) for  integral_def[T]
      % generated from assumption integral_def.not_one_element
  integrable?_inside_TCC3: OBLIGATION
    FORALL (a, b, x, y: T):
      a <= x AND x < y AND y <= b IMPLIES not_one_element?[T];


body:
  interval_minmax[T: TYPE FROM real]: THEORY
  %----------------------------------------------------------------------------
  % 
  %----------------------------------------------------------------------------
  BEGIN

     ASSUMING
       IMPORTING deriv_domain_def

       connected_domain : ASSUMPTION connected?[T]

       not_one_element : ASSUMPTION not_one_element?[T]

     ENDASSUMING

     IMPORTING continuity_interval, reals@intervals_real

     f: VAR [T -> real]
     x,y,a,b: VAR T


     fun_cont_on(a:T,b:{x:T|a<x}): TYPE = {f | 
            (FORALL (x: closed_interval(a,b)):  
                     continuous?(restrict[T,closed_interval(a,b),real](f),x))}


     min_x(a:T,b:{x:T|a<x}, f: fun_cont_on(a,b)):
              {mx: T |  a <= mx AND mx <= b AND 
                        (FORALL (x: T): a <= x AND x <= b IMPLIES
                                        f(mx) <= f(x))}


     max_x(a:T,b:{x:T|a<x}, f: fun_cont_on(a,b)):
              {mx: T |  a <= mx AND mx <= b AND 
                        (FORALL (x: T): a <= x AND x <= b IMPLIES
                                        f(mx) >= f(x))}

  END interval_minmax

addendum:
  %%% ================ Addendum: generated declarations ================

  % Existence TCC generated (at line 27, column 3) for
      % min_x(a: T, b: {x: T | a < x}, f: fun_cont_on(a, b)):
      %       {mx: T |
      %                a <= mx AND
      %                 mx <= b AND
      %                  (FORALL (x: T):
      %                     a <= x AND x <= b IMPLIES f(mx) <= f(x))}
  min_x_TCC1: OBLIGATION
    EXISTS (x1:
              [d: [a: T, b: {x: T | a < x}, fun_cont_on(a, b)] ->
                 {mx: T |
                          d`1 <= mx AND
                           mx <= d`2 AND
                            (FORALL (x: T):
                               d`1 <= x AND x <= d`2 IMPLIES
                                d`3(mx) <= d`3(x))}]):
      TRUE;

  % Existence TCC generated (at line 33, column 3) for
      % max_x(a: T, b: {x: T | a < x}, f: fun_cont_on(a, b)):
      %       {mx: T |
      %                a <= mx AND
      %                 mx <= b AND
      %                  (FORALL (x: T):
      %                     a <= x AND x <= b IMPLIES f(mx) >= f(x))}
  max_x_TCC1: OBLIGATION
    EXISTS (x1:
              [d: [a: T, b: {x: T | a < x}, fun_cont_on(a, b)] ->
                 {mx: T |
                          d`1 <= mx AND
                           mx <= d`2 AND
                            (FORALL (x: T):
                               d`1 <= x AND x <= d`2 IMPLIES
                                d`3(mx) >= d`3(x))}]):
      TRUE;


body:
  integral_cont_scaf[T: TYPE FROM real]: THEORY
  %----------------------------------------------------------------------------
  % scaffolding: not intended for users
  %----------------------------------------------------------------------------
  BEGIN

     ASSUMING
        IMPORTING deriv_domain_def[T]

        connected_domain : ASSUMPTION connected?[T]


        not_one_element : ASSUMPTION not_one_element?[T]

     ENDASSUMING


     IMPORTING integral_prep[T], integral_step[T], interval_minmax[T],
               unif_cont_fun, continuity_interval

     f: VAR [T -> real]
     x,y,a,b: VAR T

     adh_lem: LEMMA a <= x AND x <= b
                       IMPLIES  adh[closed_interval(a, b)](fullset[real])(x)


     fun_cont_on(a:T,b:{x:T|a<x}): TYPE = {f | 
            (FORALL (x: closed_interval(a,b)):  
                     continuous?(restrict[T,closed_interval(a,b),real](f),x))}

     cont_restrict: LEMMA FORALL (x: closed_interval(a, b) ): 
                                 continuous?(f, x)
                           IMPLIES
                      continuous?(restrict[T, closed_interval(a, b), real](f), x)
     
     cont_interv: LEMMA (FORALL (P: partition(a,b), xx: [below(length(P)) -> T]):
                         continuous?(restrict[T, closed_interval(a, b), real](f)) 
                           AND xx = seq(P) IMPLIES
                      (FORALL (ii : below(length(P)-1)): 
                         continuous?[closed_interval(xx(ii), xx(1 + ii))]
                    (restrict[T, closed_interval(xx(ii), xx(1 + ii)), real](f))))

  %    The following is now in interval_minmax
  %
  %    min_x(a:T,b:{x:T|a<x}, f: fun_cont_on(a,b)):
  %             {mx: T |  a <= mx AND mx <= b AND 
  %                       (FORALL (x: T): a <= x AND x <= b IMPLIES
  %                                       f(mx) <= f(x))}
  %
  %
  %    max_x(a:T,b:{x:T|a<x}, f: fun_cont_on(a,b)):
  %             {mx: T |  a <= mx AND mx <= b AND 
  %                       (FORALL (x: T): a <= x AND x <= b IMPLIES
  %                                       f(mx) >= f(x))}

     fmin_nonempty: LEMMA FORALL (P: partition(a,b), f: fun_cont_on(a,b)): 
                             nonempty?({fv: real |
                                FORALL (ii: below(length(P) - 1)):
                          (seq(P)(ii) < x AND x < seq(P)(1 + ii) IMPLIES
                          fv = f(min_x(seq(P)(ii), seq(P)(1 + ii), f)))
                          AND
                           ((seq(P)(ii) = x OR x = seq(P)(1 + ii)) IMPLIES
                              fv = f(x))})

     fmax_nonempty: LEMMA FORALL (P: partition(a,b), f: fun_cont_on(a,b)): 
                             nonempty?({fv: real |
                                FORALL (ii: below(length(P) - 1)):
                          (seq(P)(ii) < x AND x < seq(P)(1 + ii) IMPLIES
                          fv = f(max_x(seq(P)(ii), seq(P)(1 + ii), f)))
                          AND
                           ((seq(P)(ii) = x OR x = seq(P)(1 + ii)) IMPLIES
                              fv = f(x))})

     fmin(a:T,b:{x:T|a<x},P: partition(a,b), f: fun_cont_on(a,b)): 
           {ff: [T -> real] | LET xx = seq(P) IN
                    FORALL (ii : below(length(P)-1)): 
               FORALL (x: T):  (xx(ii) < x AND x < xx(ii+1) IMPLIES
                                  ff(x) = f(min_x(xx(ii),xx(ii+1),f))) AND
                               ((xx(ii) = x OR x = xx(ii+1)) IMPLIES
                                  ff(x) = f(x))} 

     fmax(a:T,b:{x:T|a<x},P: partition(a,b), f: fun_cont_on(a,b)): 
           {ff: [T -> real] | LET xx = seq(P) IN
                    FORALL (ii : below(length(P)-1)): 
                 FORALL (x: T): (xx(ii) < x AND x < xx(ii+1) IMPLIES
                                   ff(x) = f(max_x(xx(ii),xx(ii+1),f))) AND
                                ((xx(ii) = x OR x = xx(ii+1)) IMPLIES
                                   ff(x) = f(x))} 



    fmax_step: LEMMA FORALL (PP: partition(a,b), f: fun_cont_on(a,b)): 
                        a < b IMPLIES step_function?(a, b, fmax(a, b, PP, f))

    fmin_step: LEMMA FORALL (PP: partition(a,b), f: fun_cont_on(a,b)): 
                        a < b IMPLIES step_function?(a, b, fmin(a, b, PP, f))

    fmax_ge  : LEMMA FORALL (PP: partition(a,b), f: fun_cont_on(a,b),
                             x: closed_interval(a,b)):
                            a < b IMPLIES 
                               fmax(a, b, PP, f)(x) - fmin(a, b, PP, f)(x) >= 0

  END integral_cont_scaf

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 18, column 13) for  integral_prep[T]
      % generated from assumption integral_prep.connected_domain
  IMP_integral_prep_TCC1: OBLIGATION connected?[T];

  % Assuming TCC generated (at line 18, column 13) for  integral_prep[T]
      % generated from assumption integral_prep.not_one_element
  IMP_integral_prep_TCC2: OBLIGATION not_one_element?[T];

  % Subtype TCC generated (at line 42, column 50) for  ii
      % expected type  below(length(P))
  cont_interv_TCC1: OBLIGATION
    FORALL (a, b: T, f: [T -> real], P: partition[T](a, b),
            xx: [below(length(P)) -> T]):
      continuous?(restrict[T, closed_interval[T](a, b), real](f)) AND
       xx = seq(P)
       IMPLIES (FORALL (ii: below(length(P) - 1), x: T): ii < length(P));

  % Subtype TCC generated (at line 42, column 58) for  1 + ii
      % expected type  below(length(P))
  cont_interv_TCC2: OBLIGATION
    FORALL (a, b: T, f: [T -> real], P: partition[T](a, b),
            xx: [below(length(P)) -> T]):
      continuous?(restrict[T, closed_interval[T](a, b), real](f)) AND
       xx = seq(P)
       IMPLIES
       (FORALL (ii: below(length(P) - 1), x: T):
          xx(ii) <= x IMPLIES 1 + ii < length(P));

  % Subtype TCC generated (at line 60, column 32) for  ii
      % expected type  below[P`length]
  fmin_nonempty_TCC1: OBLIGATION
    FORALL (a, b: T, P: partition[T](a, b), f: fun_cont_on(a, b),
            ii: below(length(P) - 1)):
      ii < P`length;

  % Subtype TCC generated (at line 60, column 55) for  1 + ii
      % expected type  below[P`length]
  fmin_nonempty_TCC2: OBLIGATION
    FORALL (a, b, x: T, P: partition[T](a, b), f: fun_cont_on(a, b),
            ii: below(length(P) - 1)):
      seq(P)(ii) < x IMPLIES 1 + ii < P`length;

  % Subtype TCC generated (at line 61, column 49) for  seq(P)(1 + ii)
      % expected type  {x: T | seq(P)(ii) < x}
  fmin_nonempty_TCC3: OBLIGATION
    FORALL (a, b, x: T, P: partition[T](a, b), f: fun_cont_on(a, b),
            ii: below(length(P) - 1)):
      seq(P)(ii) < x AND x < seq(P)(1 + ii) IMPLIES
       seq(P)(ii) < seq(P)(1 + ii);

  % Subtype TCC generated (at line 61, column 65) for  f
      % expected type  fun_cont_on[T](seq(P)(ii), seq(P)(1 + ii))
  fmin_nonempty_TCC4: OBLIGATION
    FORALL (a, b, x1: T, P: partition[T](a, b), f: fun_cont_on(a, b),
            ii: below(length(P) - 1)):
      seq(P)(ii) < x1 AND x1 < seq(P)(1 + ii) IMPLIES
       (FORALL (x: closed_interval[T](seq(P)(ii), seq(P)(1 + ii))):
          continuous?[{x_1 | seq(P)(ii) <= x_1 AND x_1 <= seq(P)(1 + ii)}]
              (restrict
                   [T, {x_1 | seq(P)(ii) <= x_1 AND x_1 <= seq(P)(1 + ii)},
                    real]
                   (f),
               x));

  % Subtype TCC generated (at line 63, column 56) for  1 + ii
      % expected type  below[P`length]
  fmin_nonempty_TCC5: OBLIGATION
    FORALL (a, b, x: T, P: partition[T](a, b), f: fun_cont_on(a, b),
            fv: real, ii: below(length(P) - 1)):
      NOT seq(P)(ii) = x AND
       (seq(P)(ii) < x AND x < seq(P)(1 + ii) IMPLIES
         fv = f(min_x(seq(P)(ii), seq(P)(1 + ii), f)))
       IMPLIES 1 + ii < P`length;

  % Subtype TCC generated (at line 72, column 56) for  1 + ii
      % expected type  below[P`length]
  fmax_nonempty_TCC1: OBLIGATION
    FORALL (a, b, x: T, P: partition[T](a, b), f: fun_cont_on(a, b),
            fv: real, ii: below(length(P) - 1)):
      NOT seq(P)(ii) = x AND
       (seq(P)(ii) < x AND x < seq(P)(1 + ii) IMPLIES
         fv = f(max_x(seq(P)(ii), seq(P)(1 + ii), f)))
       IMPLIES 1 + ii < P`length;

  % Subtype TCC generated (at line 78, column 33) for  ii
      % expected type  below[P`length]
  fmin_TCC1: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition(a, b),
            xx: [below[P`length] -> closed_interval[T](a, b)]):
      xx = seq(P) IMPLIES
       (FORALL (ii: below(length(P) - 1), x: T): ii < P`length);

  % Subtype TCC generated (at line 78, column 52) for  ii + 1
      % expected type  below[P`length]
  fmin_TCC2: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition(a, b),
            xx: [below[P`length] -> closed_interval[T](a, b)]):
      xx = seq(P) IMPLIES
       (FORALL (ii: below(length(P) - 1), x: T):
          xx(ii) < x IMPLIES ii + 1 < P`length);

  % Subtype TCC generated (at line 79, column 55) for  xx(ii + 1)
      % expected type  {x: T | xx(ii) < x}
  fmin_TCC3: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition(a, b),
            xx: [below[P`length] -> closed_interval[T](a, b)]):
      xx = seq(P) IMPLIES
       (FORALL (ii: below(length(P) - 1), x: T):
          xx(ii) < x AND x < xx(ii + 1) IMPLIES xx(ii) < xx(ii + 1));

  % Subtype TCC generated (at line 79, column 64) for  f
      % expected type  fun_cont_on[T](xx(ii), xx(1 + ii))
  fmin_TCC4: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition(a, b),
            f: fun_cont_on(a, b),
            xx: [below[P`length] -> closed_interval[T](a, b)]):
      xx = seq(P) IMPLIES
       (FORALL (ii: below(length(P) - 1), x: T):
          xx(ii) < x AND x < xx(ii + 1) IMPLIES
           (FORALL (x: closed_interval[T](xx(ii), xx(1 + ii))):
              continuous?[{x | xx(ii) <= x AND x <= xx(1 + ii)}]
                  (restrict[T, {x | xx(ii) <= x AND x <= xx(1 + ii)}, real]
                       (f),
                   x)));

  % Subtype TCC generated (at line 80, column 52) for  ii + 1
      % expected type  below[P`length]
  fmin_TCC5: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition(a, b),
            f: fun_cont_on(a, b), ff: [T -> real],
            xx: [below[P`length] -> closed_interval[T](a, b)]):
      xx = seq(P) IMPLIES
       (FORALL (ii: below(length(P) - 1), x: T):
          NOT xx(ii) = x AND
           (xx(ii) < x AND x < xx(ii + 1) IMPLIES
             ff(x) = f(min_x(xx(ii), xx(ii + 1), f)))
           IMPLIES ii + 1 < P`length);

  % Existence TCC generated (at line 75, column 3) for
      % fmin(a: T, b: {x: T | a < x}, P: partition(a, b),
      %      f: fun_cont_on(a, b)):
      %       {ff: [T -> real] |
      %                LET xx = seq(P) IN
      %                  FORALL (ii: below(length(P) - 1)):
      %                    FORALL (x: T):
      %                      (xx(ii) < x AND x < xx(ii + 1) IMPLIES
      %                        ff(x) = f(min_x(xx(ii), xx(ii + 1), f)))
      %                       AND
      %                       ((xx(ii) = x OR x = xx(ii + 1)) IMPLIES
      %                         ff(x) = f(x))}
  fmin_TCC6: OBLIGATION
    EXISTS (x1:
              [d:
                 [a: T, b: {x: T | a < x}, partition[T](a, b),
                  fun_cont_on(a, b)] ->
                 {ff: [T -> real] |
                          FORALL (ii: below(length(d`3) - 1)):
                            FORALL (x: T):
                              (seq(d`3)(ii) < x AND x < seq(d`3)(1 + ii)
                                IMPLIES
                                ff(x) =
                                 d`4
                                     (min_x[T]
                                      (seq(d`3)(ii), seq(d`3)(1 + ii), d`4)))
                               AND
                               ((seq(d`3)(ii) = x OR x = seq(d`3)(1 + ii))
                                 IMPLIES ff(x) = d`4(x))}]):
      TRUE;

  % Subtype TCC generated (at line 88, column 53) for  ii + 1
      % expected type  below[P`length]
  fmax_TCC1: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition(a, b),
            f: fun_cont_on(a, b), ff: [T -> real],
            xx: [below[P`length] -> closed_interval[T](a, b)]):
      xx = seq(P) IMPLIES
       (FORALL (ii: below(length(P) - 1), x: T):
          NOT xx(ii) = x AND
           (xx(ii) < x AND x < xx(ii + 1) IMPLIES
             ff(x) = f(max_x(xx(ii), xx(ii + 1), f)))
           IMPLIES ii + 1 < P`length);

  % Existence TCC generated (at line 83, column 3) for
      % fmax(a: T, b: {x: T | a < x}, P: partition(a, b),
      %      f: fun_cont_on(a, b)):
      %       {ff: [T -> real] |
      %                LET xx = seq(P) IN
      %                  FORALL (ii: below(length(P) - 1)):
      %                    FORALL (x: T):
      %                      (xx(ii) < x AND x < xx(ii + 1) IMPLIES
      %                        ff(x) = f(max_x(xx(ii), xx(ii + 1), f)))
      %                       AND
      %                       ((xx(ii) = x OR x = xx(ii + 1)) IMPLIES
      %                         ff(x) = f(x))}
  fmax_TCC2: OBLIGATION
    EXISTS (x1:
              [d:
                 [a: T, b: {x: T | a < x}, partition[T](a, b),
                  fun_cont_on(a, b)] ->
                 {ff: [T -> real] |
                          FORALL (ii: below(length(d`3) - 1)):
                            FORALL (x: T):
                              (seq(d`3)(ii) < x AND x < seq(d`3)(1 + ii)
                                IMPLIES
                                ff(x) =
                                 d`4
                                     (max_x[T]
                                      (seq(d`3)(ii), seq(d`3)(1 + ii), d`4)))
                               AND
                               ((seq(d`3)(ii) = x OR x = seq(d`3)(1 + ii))
                                 IMPLIES ff(x) = d`4(x))}]):
      TRUE;


body:
  integral_cont[T: TYPE FROM real]: THEORY
  %------------------------------------------------------------------------------
  %  Continuous functions are integrable
  %
  %  Author:  Rick Butler               NASA Langley
  %
  %------------------------------------------------------------------------------
  BEGIN

     ASSUMING
        IMPORTING deriv_domain_def[T]

        connected_domain : ASSUMPTION connected?[T]


        not_one_element : ASSUMPTION not_one_element?[T]

     ENDASSUMING


    IMPORTING integral_cont_scaf[T],
              continuous_functions

    f: VAR [T -> real]
    x,y,a,b: VAR T

    in_interval  : LEMMA FORALL (PP: partition(a,b)):  
                        FORALL (ii : below(length(PP)-1)):
          (FORALL (x, y: closed_interval(seq(PP)(ii), seq(PP)(ii + 1))):
                            abs(x - y) <= seq(PP)(1 + ii) - seq(PP)(ii))

    continuous_integrable: LEMMA a < b AND    
                           (FORALL (x: closed_interval(a,b)): continuous?(f,x))
                              IMPLIES integrable?(a,b,f)


    cont_fun_integrable: COROLLARY a < b AND continuous?(f)
                                      IMPLIES integrable?(a,b,f)


  END integral_cont

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 21, column 12) for  integral_cont_scaf[T]
      % generated from assumption integral_cont_scaf.connected_domain
  IMP_integral_cont_scaf_TCC1: OBLIGATION connected?[T];

  % Assuming TCC generated (at line 21, column 12) for  integral_cont_scaf[T]
      % generated from assumption integral_cont_scaf.not_one_element
  IMP_integral_cont_scaf_TCC2: OBLIGATION not_one_element?[T];

  % Subtype TCC generated (at line 30, column 48) for  1 + ii
      % expected type  below[PP`length]
  in_interval_TCC1: OBLIGATION
    FORALL (a, b: T, PP: partition[T](a, b), ii: below(length(PP) - 1),
            x, y: closed_interval[T](seq(PP)(ii), seq(PP)(1 + ii))):
      1 + ii < PP`length;

  % Subtype TCC generated (at line 30, column 66) for  ii
      % expected type  below[PP`length]
  in_interval_TCC2: OBLIGATION
    FORALL (a, b: T, PP: partition[T](a, b), ii: below(length(PP) - 1),
            x, y: closed_interval[T](seq(PP)(ii), seq(PP)(1 + ii))):
      ii < PP`length;


body:
  integral[T: TYPE+ FROM real]: THEORY
  %------------------------------------------------------------------------------
  %
  %  Theory and proofs taken from Introduction to Analysis (Maxwell Rosenlight)
  %
  %  This theory provides the basic properties of the Riemann Integral
  %
  %  Author:  Rick Butler               NASA Langley
  %
  %------------------------------------------------------------------------------

  BEGIN

     ASSUMING
        IMPORTING deriv_domain_def[T]

        connected_domain : ASSUMPTION connected?[T]


        not_one_element : ASSUMPTION not_one_element?[T]

     ENDASSUMING

     IMPORTING integral_def[T], integral_cont[T], 
               integral_split[T], 
               reals@real_fun_ops,
               continuous_functions_more[T]



     a,b,c,x,y: VAR T
     D,m,M,yv: VAR real

     f,g: VAR [T -> real]


  %    Closed_interval(a:T,b:{x:T | x /= a}): TYPE = {x: T | (a < b IMPLIES 
  %                                                  (a <= x AND x <= b)) AND
  %                                                  (b < a IMPLIES 
  %                                                  (b <= x AND x <= a))}

  %    Closed_interval(a,b:T): TYPE = {x: T | (a <= b IMPLIES 
  %                                                  (a <= x AND x <= b)) AND
  %                                                  (b < a IMPLIES 
  %                                                  (b <= x AND x <= a))}

     Integrable?_a_to_a: LEMMA Integrable?(a,a,f) 

     Integrable?_inside : LEMMA a <= x AND x <= y AND y <= b AND
         Integrable?(a,b,f) IMPLIES Integrable?(x,y,f)


     Integral_a_to_a   : LEMMA Integral(a,a,f) = 0

     Integral_const_fun: LEMMA Integrable?(a, b, const_fun[T](D)) AND
                               Integral(a,b,const_fun(D)) = D*(b-a)


     Integral_const_restrict: LEMMA 
                 (FORALL (x: Closed_interval(a,b)): f(x) = D) IMPLIES
                                    Integrable?(a,b,f) AND
                                    Integral(a,b,f) = D*(b-a)


     Integral_rev: LEMMA Integrable?(a, b, f) IMPLIES
                         Integrable?(b, a, f) AND
                         Integral(b, a, f) = - Integral(a, b, f)


     continuous_Integrable?: LEMMA 
                              (FORALL (x: Closed_interval(a,b)):
                                         continuous?(f,x))
                            IMPLIES Integrable?(a,b,f)


     cont_Integrable?: LEMMA continuous?(f) IMPLIES Integrable?(a,b,f)

     cont_fun_Integrable?: COROLLARY continuous?(f)
                                      IMPLIES Integrable?(a,b,f)


  %  -------------- Linearity Properties of Integral ---------------------

     Integral_scal: LEMMA Integrable?(a,b,f) IMPLIES
                              Integrable?(a,b,D*f) AND
                  Integral(a,b,D*f) = D*Integral(a,b,f)

     Integral_sum: LEMMA Integrable?(a,b,f) AND Integrable?(a,b,g) IMPLIES
                                 Integrable?(a,b,(LAMBDA x: f(x) + g(x)))
                            AND
                Integral(a,b,(LAMBDA x: f(x) + g(x))) =
                   Integral(a,b,f) + Integral(a,b,g)


     Integral_diff: LEMMA Integrable?(a,b,f) AND Integrable?(a,b,g) IMPLIES
                                 Integrable?(a,b,(LAMBDA x: f(x) - g(x)))
                            AND
                Integral(a,b,(LAMBDA x: f(x) - g(x))) =
                   Integral(a,b,f) - Integral(a,b,g)

     Integral_split: LEMMA Integrable?(a,b,f) AND Integrable?(b,c,f) 
                               IMPLIES Integrable?(a,c,f) AND
                             Integral(a,b,f) + Integral(b,c,f) = Integral(a,c,f) 

     Integral_chg_one_pt: LEMMA FORALL (y: Closed_interval(a,b)):
                                Integrable?(a,b,f) 
                      IMPLIES Integrable?(a,b,f WITH [(y) := yv]) AND
                         Integral(a,b,f WITH [(y) := yv]) = Integral(a,b,f) 

  %  ---------------- Boundedness of Integral -----------------------------


     Integral_ge_0: LEMMA a < b AND Integrable?(a,b,f) AND 
                      (FORALL (x: Closed_interval(a,b)): f(x) >= 0) IMPLIES
                             Integral(a,b,f) >= 0


     Integral_ge_0_open: LEMMA a <= b AND Integrable?(a,b,f) AND 
                      (FORALL (x: Open_interval(a,b)): f(x) >= 0) IMPLIES
                             Integral(a,b,f) >= 0


     Integral_bound: LEMMA a < b AND Integrable?(a,b,f) AND 
                             (FORALL (x: Closed_interval(a,b)): 
                                      m <= f(x) AND f(x) <= M )
             IMPLIES m*(b-a) <= Integral(a,b,f) AND Integral(a,b,f) <= M*(b-a)


     Integral_bounded: LEMMA Integrable?(a,b,f) AND
                 (FORALL (x: Closed_interval(a,b)): abs(f(x)) <= M) IMPLIES
                    abs(Integral(a,b,f)) <= M*abs(b-a)


     Integral_le : LEMMA a < b AND Integrable?(a,b,f) AND Integrable?(a,b,g)
                         AND (FORALL (x: closed_interval(a,b)): f(x) <= g(x)) 
                      IMPLIES 
                         Integral(a,b,f) <= Integral(a,b,g) 

  %   bounded_on?(a,b,f): bool = (EXISTS (B: real): 
  %                   (FORALL (x: closed_interval(a,b)): abs(f(x)) <= B))


     Integrable_bounded: LEMMA Integrable?(a,b,f) 
                            IMPLIES 
                                 LET l = real_defs.min(a,b), 
                                     u = real_defs.max(a,b) IN
                               bounded_on?(l, u, f)


     Integral_neg: LEMMA Integrable?(a,b,f) IMPLIES 
                              Integrable?(a,b,-f) AND
                              Integral(a,b,-f) = -Integral(a,b,f)

     Integral_restr_eq: LEMMA (FORALL (x: Open_interval(a,b)): f(x) = g(x))
                              AND Integrable?(a,b,f)
                            IMPLIES Integrable?(a,b,g) AND
                                     Integral(a,b,g) = Integral(a,b,f)



  END integral

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 24, column 13) for  integral_def[T]
      % generated from assumption integral_def.connected_domain
  IMP_integral_def_TCC1: OBLIGATION connected?[T];

  % Assuming TCC generated (at line 24, column 13) for  integral_def[T]
      % generated from assumption integral_def.not_one_element
  IMP_integral_def_TCC2: OBLIGATION not_one_element?[T];

  % Assuming TCC generated (at line 27, column 13) for
      % continuous_functions_more[T]
      % generated from assumption continuous_functions_more.connected_domain
  IMP_continuous_functions_more_TCC1: OBLIGATION
    FORALL (x, y: T), (z: real): x <= z AND z <= y IMPLIES T_pred(z);

  % Assuming TCC generated (at line 27, column 13) for
      % continuous_functions_more[T]
      % generated from assumption continuous_functions_more.not_one_element
  IMP_continuous_functions_more_TCC2: OBLIGATION
    FORALL (x: T): EXISTS (y: T): x /= y;

  % Subtype TCC generated (at line 53, column 42) for  f
      % expected type  Integrable_funs[T](a, a)
  Integral_a_to_a_TCC1: OBLIGATION
    FORALL (a: T, f: [T -> real]): Integrable?[T](a, a, f);

  % Subtype TCC generated (at line 147, column 41) for  l
      % expected type  T
  Integrable_bounded_TCC1: OBLIGATION
    FORALL (a, b: T, f: [T -> real]):
      Integrable?(a, b, f) IMPLIES
       (FORALL (l: {p: real | p <= a AND p <= b}):
          l = real_defs.min(a, b) IMPLIES
           (FORALL (u: {p: real | p >= a AND p >= b}):
              u = real_defs.max(a, b) IMPLIES T_pred(l)));

  % Subtype TCC generated (at line 147, column 44) for  u
      % expected type  T
  Integrable_bounded_TCC2: OBLIGATION
    FORALL (a, b: T, f: [T -> real]):
      Integrable?(a, b, f) IMPLIES
       (FORALL (l: {p: real | p <= a AND p <= b}):
          l = real_defs.min(a, b) IMPLIES
           (FORALL (u: {p: real | p >= a AND p >= b}):
              u = real_defs.max(a, b) IMPLIES T_pred(u)));


body:
  fundamental_theorem[T: TYPE+ FROM real]: THEORY
  %------------------------------------------------------------------------------
  %
  %  Theory and proofs taken from Introduction to Analysis (Maxwell Rosenlight)
  %
  %  Author:  Rick Butler               NASA Langley
  %
  %  Note: some material moved to theory indefinite_integral on 7/20/07
  %
  %------------------------------------------------------------------------------

  BEGIN

     ASSUMING
        IMPORTING deriv_domain_def[T]

        connected_domain : ASSUMPTION connected?[T]


        not_one_element : ASSUMPTION not_one_element?[T]

     ENDASSUMING

     IMPORTING deriv_domain_def
     deriv_domain: LEMMA deriv_domain?[T]
     IMPORTING integral, derivative_props[T] %, derivatives_more[T]

     a,b,c,x: VAR T
     f,F,G: VAR [T -> real]

  %  NOTE: LEMMA "continuous_Integrable?[T]" implicitly used throughout

     fundamental: THEOREM continuous?(f) AND
                          (FORALL x: F(x) = Integral(a,x,f)) 
                     IMPLIES derivable?(F) AND deriv(F) = f

     fundamental2: THEOREM continuous?(f) 
                                IMPLIES (EXISTS F: derivable?(F) AND deriv(F) = f)

     fundamental3: THEOREM derivable?(F) AND deriv(F) = f AND continuous?(f) 
                              IMPLIES Integrable?(a,b,f) AND
                                      Integral(a,b,f) = F(b) - F(a)
                                        
     derivable_Integrable?: COROLLARY derivable?(f)
                                      IMPLIES Integrable?(a,b,f)

     fundamental3b: COROLLARY derivable?(F) AND continuous?(deriv(F))
                              IMPLIES Integrable?(a,b,deriv(F)) AND
                                      Integral(a,b,deriv(F)) = F(b) - F(a)

  END fundamental_theorem

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 26, column 23) for  derivative_props[T]
      % generated from assumption derivative_props.connected_domain
  IMP_derivative_props_TCC1: OBLIGATION connected?[T];

  % Assuming TCC generated (at line 26, column 23) for  derivative_props[T]
      % generated from assumption derivative_props.not_one_element
  IMP_derivative_props_TCC2: OBLIGATION not_one_element?[T];

  % Subtype TCC generated (at line 34, column 55) for  f
      % expected type  Integrable_funs[T](a, x)
  fundamental_TCC1: OBLIGATION
    FORALL (a: T, f: [T -> real]):
      continuous?(f) IMPLIES (FORALL (x): Integrable?[T](a, x, f));

  % Assuming TCC generated (at line 14, column 12) for  derivatives[T]
      % generated from assumption derivatives.deriv_domain
  fundamental_TCC2: OBLIGATION
    FORALL (F: [T -> real], a: T, f: [T -> real]):
      (FORALL x: F(x) = Integral(a, x, f)) AND continuous?(f) IMPLIES
       deriv_domain?[T];

  % Assuming TCC generated (at line 14, column 12) for  derivatives[T]
      % generated from assumption derivatives.deriv_domain
  fundamental2_TCC1: OBLIGATION
    FORALL (f: [T -> real]): continuous?(f) IMPLIES deriv_domain?[T];

  % Assuming TCC generated (at line 14, column 12) for  derivatives[T]
      % generated from assumption derivatives.deriv_domain
  fundamental3_TCC1: OBLIGATION deriv_domain?[T];


body:
  indefinite_integral[T: TYPE+ FROM real]: THEORY
  %------------------------------------------------------------------------------
  %
  %  Author:  Rick Butler               NASA Langley
  %
  %  convention:
  %       Definite integral  :  Integral(a,b,f)
  %       Indefinite integral:  integral(f)
  %
  %------------------------------------------------------------------------------

  BEGIN

     ASSUMING
        IMPORTING deriv_domain_def[T]

        connected_domain : ASSUMPTION connected?[T]


        not_one_element : ASSUMPTION not_one_element?[T]

     ENDASSUMING

     deriv_domain: LEMMA deriv_domain?[T]
     IMPORTING integral[T], derivative_props[T]

     a,b,c,x: VAR T
     f,g,F,G,H: VAR [T -> real]

     antiderivative?(F,f): bool = derivable?(F) AND deriv(F) = f


     antiderivative_lem: LEMMA antiderivative?(F,f) AND derivable?(G) AND
                               deriv(G) = f
                               IMPLIES (EXISTS (c: real): F = G + const_fun(c))

     derivs_eq:     THEOREM derivable?(F) AND derivable?(G) AND deriv(F) = deriv(G)
                           IMPLIES (EXISTS (c: real): F = G + const_fun(c))


     % ------ indefinite integral defined over continuous functions ------

     integrable?(f): bool = (EXISTS F: antiderivative?(F,f))

     integrable_fun: TYPE = { f | integrable?(f)}

     IMPORTING fundamental_theorem[T]


     cont_fun_integrable?: LEMMA continuous?(f) IMPLIES integrable?(f)


     integral(f: integrable_fun): { F: [T -> real] | 
                                         derivable?(F) AND deriv(F) = f }


     integral_lem: LEMMA integrable?(f) AND integral(f) = F AND 
                         derivable?(G) AND deriv(G) = f
                               IMPLIES (EXISTS (c: real): F = G + const_fun(c))


     deriv_integ: LEMMA derivable?(F) IMPLIES integrable?[T](deriv(F))



     indef_integral_thm : THEOREM derivable?(F) IMPLIES
                                  (EXISTS (c: real): 
                                      integral(deriv(F)) = F + const_fun(c))


     fundamental_indef  : THEOREM continuous?(f) IMPLIES 
                                    Integrable?(a,b,f) AND
                                    Integral(a,b,f) = integral(f)(b) - integral(f)(a)




  END indefinite_integral

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 25, column 13) for  integral[T]
      % generated from assumption integral.connected_domain
  IMP_integral_TCC1: OBLIGATION connected?[T];

  % Assuming TCC generated (at line 25, column 13) for  integral[T]
      % generated from assumption integral.not_one_element
  IMP_integral_TCC2: OBLIGATION not_one_element?[T];

  % Assuming TCC generated (at line 14, column 12) for  derivatives[T]
      % generated from assumption derivatives.deriv_domain
  antiderivative?_TCC1: OBLIGATION deriv_domain?[T];

  % Existence TCC generated (at line 53, column 3) for
      % integral(f: integrable_fun):
      %       {F: [T -> real] | derivable?(F) AND deriv(F) = f}
  integral_TCC1: OBLIGATION
    EXISTS (x:
              [f: integrable_fun ->
                 {F: [T -> real] | derivable?[T](F) AND deriv[T](F) = f}]):
      TRUE;

  % Subtype TCC generated (at line 68, column 45) for  deriv(F)
      % expected type  f: integrable_fun
  indef_integral_thm_TCC1: OBLIGATION
    FORALL (F: [T -> real]): derivable?(F) IMPLIES integrable?(deriv[T](F));

  % Subtype TCC generated (at line 73, column 61) for  f
      % expected type  f: integrable_fun
  fundamental_indef_TCC1: OBLIGATION
    FORALL (a, b: T, f: [T -> real]):
      continuous?(f) AND Integrable?(a, b, f) IMPLIES integrable?(f);


body:
  integration_by_parts[T: TYPE+ FROM real]: THEORY
  %------------------------------------------------------------------------------
  %
  %  Author:  Rick Butler               NASA Langley
  %
  %------------------------------------------------------------------------------

  BEGIN


     ASSUMING
        IMPORTING deriv_domain_def[T]

        connected_domain : ASSUMPTION connected?[T]


        not_one_element : ASSUMPTION not_one_element?[T]

     ENDASSUMING

     IMPORTING fundamental_theorem[T]

     a,b: VAR T
     u,v: VAR [T -> real]

    integ_parts_prep: LEMMA  FORALL (a, b: T, u, v: [T -> real]):
                          derivable?(u) AND derivable?(v) AND continuous?(deriv(u))
       IMPLIES Integrable?[T](a, b, LAMBDA (x: T): v(x) * deriv[T](u)(x));


     integ_parts: THEOREM derivable?(u) AND continuous?(deriv(u)) AND
                          derivable?(v) AND continuous?(deriv(v))
                       IMPLIES
                          Integral(a,b,(LAMBDA (x:T): u(x)*deriv(v)(x))) = 
                          u(b)*v(b) - u(a)*v(a) - Integral(a,b,(LAMBDA (x:T): v(x)*deriv(u)(x))) 

   
  END integration_by_parts

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 21, column 13) for  fundamental_theorem[T]
      % generated from assumption fundamental_theorem.connected_domain
  IMP_fundamental_theorem_TCC1: OBLIGATION connected?[T];

  % Assuming TCC generated (at line 21, column 13) for  fundamental_theorem[T]
      % generated from assumption fundamental_theorem.not_one_element
  IMP_fundamental_theorem_TCC2: OBLIGATION not_one_element?[T];

  % Assuming TCC generated (at line 14, column 12) for  derivatives[T]
      % generated from assumption derivatives.deriv_domain
  integ_parts_prep_TCC1: OBLIGATION deriv_domain?[T];

  % Subtype TCC generated (at line 34, column 38) for
      % (LAMBDA (x: T): u(x) * deriv(v)(x))
      % expected type  Integrable_funs[T](a, b)
  integ_parts_TCC1: OBLIGATION
    FORALL (a, b: T, u, v: [T -> real]):
      continuous?(deriv(v)) AND
       derivable?(v) AND continuous?(deriv(u)) AND derivable?(u)
       IMPLIES Integrable?[T](a, b, LAMBDA (x: T): u(x) * deriv[T](v)(x));

  % Subtype TCC generated (at line 35, column 62) for
      % (LAMBDA (x: T): v(x) * deriv(u)(x))
      % expected type  Integrable_funs[T](a, b)
  integ_parts_TCC2: OBLIGATION
    FORALL (a, b: T, u, v: [T -> real]):
      continuous?(deriv(v)) AND
       derivable?(v) AND continuous?(deriv(u)) AND derivable?(u)
       IMPLIES Integrable?[T](a, b, LAMBDA (x: T): v(x) * deriv[T](u)(x));


body:
  integral_mean_value[T: TYPE+ FROM real]: THEORY
  BEGIN
     ASSUMING
        IMPORTING deriv_domain_def[T]

        connected_domain : ASSUMPTION connected?[T]


        not_one_element : ASSUMPTION not_one_element?[T]

     ENDASSUMING

     deriv_domain: LEMMA deriv_domain?[T]
     IMPORTING fundamental_theorem[T]

     f: VAR [T -> real]

     a,b: VAR T


     mean_value_integral: LEMMA  a < b AND
                                 continuous?(f)
                           IMPLIES
                               (EXISTS (c: Open_interval[T](a,b)):
                                    Integral(a,b,f) = f(c)*(b-a) )   
                             



     mvi_cor1: LEMMA  a < b AND
               (FORALL (x: Closed_interval[T](a,b)): f(x) > 0) AND
               continuous?(f) AND
               Integral(a,b,f) = 0 
             IMPLIES a = b



   
  END integral_mean_value

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 14, column 13) for  fundamental_theorem[T]
      % generated from assumption fundamental_theorem.connected_domain
  IMP_fundamental_theorem_TCC1: OBLIGATION connected?[T];

  % Assuming TCC generated (at line 14, column 13) for  fundamental_theorem[T]
      % generated from assumption fundamental_theorem.not_one_element
  IMP_fundamental_theorem_TCC2: OBLIGATION not_one_element?[T];

  % Subtype TCC generated (at line 25, column 47) for  f
      % expected type  Integrable_funs[T](a, b)
  mean_value_integral_TCC1: OBLIGATION
    FORALL (a, b: T, f: [T -> real]):
      continuous?(f) AND a < b IMPLIES
       (FORALL (c: Open_interval[T](a, b)): Integrable?[T](a, b, f));

  % Subtype TCC generated (at line 33, column 26) for  f
      % expected type  Integrable_funs[T](a, b)
  mvi_cor1_TCC1: OBLIGATION
    FORALL (a, b: T, f: [T -> real]):
      a < b AND
       (FORALL (x: Closed_interval[T](a, b)): f(x) > 0) AND continuous?(f)
       IMPLIES Integrable?[T](a, b, f);


body:
  integral_diff_doms[T: TYPE+ FROM real, U: TYPE+ FROM real]: THEORY
  %----------------------------------------------------------------------------
  %
  %  Integral of two functions that are identical over the integration
  %  range and have different domains are shown to be equal.
  %
  %  Author:  Rick Butler     NASA Langley Research Center
  %
  %----------------------------------------------------------------------------
  BEGIN

     ASSUMING
        IMPORTING deriv_domain_def

        connected_domain : ASSUMPTION connected?[T]

        not_one_element  : ASSUMPTION not_one_element?[T]

        con_dom_U        : ASSUMPTION  connected?[U]

        not_one_U        : ASSUMPTION not_one_element?[U]

     ENDASSUMING

     IMPORTING integral


     f: VAR [T -> real]
     g: VAR [U -> real]

     a,b: VAR real

     int_diff_dom: LEMMA T_pred(a) AND T_pred(b) AND
                         U_pred(a) AND U_pred(b) AND a < b AND
                         integrable?[T](a,b,f) AND integrable?[U](a, b, g) AND
                     (FORALL (x: real): x >= a AND x <= b IMPLIES f(x) = g(x)) 
                 IMPLIES
                      integral(a,b,f) = integral(a,b,g)


     Int_diff_dom: LEMMA T_pred(a) AND T_pred(b) AND
                         U_pred(a) AND U_pred(b) AND
                         Integrable?[T](a,b,f) AND Integrable?[U](a, b, g) AND
                     (FORALL (x: Closed_interval[real](a,b)): f(x) = g(x)) 
                 IMPLIES
                      Integral(a,b,f) = Integral(a,b,g)
                     

  END integral_diff_doms

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 14, column 6) for  integral_def[T]
      % generated from assumption integral_def.connected_domain
  int_diff_dom_TCC1: OBLIGATION
    FORALL (a, b: real):
           T_pred(a) AND T_pred(b) AND U_pred(a) AND U_pred(b) AND a < b
       IMPLIES connected?[T];

  % Assuming TCC generated (at line 17, column 6) for  integral_def[T]
      % generated from assumption integral_def.not_one_element
  int_diff_dom_TCC2: OBLIGATION
    FORALL (a, b: real):
           T_pred(a) AND T_pred(b) AND U_pred(a) AND U_pred(b) AND a < b
       IMPLIES not_one_element?[T];

  % Assuming TCC generated (at line 14, column 6) for  integral_def[U]
      % generated from assumption integral_def.connected_domain
  int_diff_dom_TCC3: OBLIGATION
    FORALL (a, b: real, f: [T -> real]):
           T_pred(a) AND T_pred(b) AND U_pred(a) AND U_pred(b) AND a < b
       AND integrable?[T](a, b, f)
       IMPLIES connected?[U];

  % Assuming TCC generated (at line 17, column 6) for  integral_def[U]
      % generated from assumption integral_def.not_one_element
  int_diff_dom_TCC4: OBLIGATION
    FORALL (a, b: real, f: [T -> real]):
           T_pred(a) AND T_pred(b) AND U_pred(a) AND U_pred(b) AND a < b
       AND integrable?[T](a, b, f)
       IMPLIES not_one_element?[U];

  % Subtype TCC generated (at line 36, column 66) for  x
      % expected type  T
  int_diff_dom_TCC5: OBLIGATION
    FORALL (a, b: real, f: [T -> real], g: [U -> real]):
           T_pred(a) AND T_pred(b) AND U_pred(a) AND U_pred(b) AND a < b
       AND integrable?[T](a, b, f) AND integrable?[U](a, b, g)
       IMPLIES (FORALL (x: real): x >= a AND x <= b IMPLIES T_pred(x));

  % Subtype TCC generated (at line 36, column 73) for  x
      % expected type  U
  int_diff_dom_TCC6: OBLIGATION
    FORALL (a, b: real, f: [T -> real], g: [U -> real]):
           T_pred(a) AND T_pred(b) AND U_pred(a) AND U_pred(b) AND a < b
       AND integrable?[T](a, b, f) AND integrable?[U](a, b, g)
       IMPLIES (FORALL (x: real): x >= a AND x <= b IMPLIES U_pred(x));

  % Assuming TCC generated (at line 14, column 6) for  integral_def[T]
      % generated from assumption integral_def.connected_domain
  Int_diff_dom_TCC1: OBLIGATION
    FORALL (a, b: real):
      T_pred(a) AND T_pred(b) AND U_pred(a) AND U_pred(b) IMPLIES
       connected?[T];

  % Assuming TCC generated (at line 17, column 6) for  integral_def[T]
      % generated from assumption integral_def.not_one_element
  Int_diff_dom_TCC2: OBLIGATION
    FORALL (a, b: real):
      T_pred(a) AND T_pred(b) AND U_pred(a) AND U_pred(b) IMPLIES
       not_one_element?[T];

  % Assuming TCC generated (at line 14, column 6) for  integral_def[U]
      % generated from assumption integral_def.connected_domain
  Int_diff_dom_TCC3: OBLIGATION
    FORALL (a, b: real, f: [T -> real]):
           T_pred(a) AND T_pred(b) AND U_pred(a) AND U_pred(b)
       AND Integrable?[T](a, b, f)
       IMPLIES connected?[U];

  % Assuming TCC generated (at line 17, column 6) for  integral_def[U]
      % generated from assumption integral_def.not_one_element
  Int_diff_dom_TCC4: OBLIGATION
    FORALL (a, b: real, f: [T -> real]):
           T_pred(a) AND T_pred(b) AND U_pred(a) AND U_pred(b)
       AND Integrable?[T](a, b, f)
       IMPLIES not_one_element?[U];

  % Subtype TCC generated (at line 44, column 62) for  x
      % expected type  T
  Int_diff_dom_TCC5: OBLIGATION
    FORALL (a, b: real, f: [T -> real], g: [U -> real]):
           T_pred(a) AND T_pred(b) AND U_pred(a) AND U_pred(b)
       AND Integrable?[T](a, b, f) AND Integrable?[U](a, b, g)
       IMPLIES (FORALL (x: Closed_interval[real](a, b)): T_pred(x));

  % Subtype TCC generated (at line 44, column 69) for  x
      % expected type  U
  Int_diff_dom_TCC6: OBLIGATION
    FORALL (a, b: real, f: [T -> real], g: [U -> real]):
           T_pred(a) AND T_pred(b) AND U_pred(a) AND U_pred(b)
       AND Integrable?[T](a, b, f) AND Integrable?[U](a, b, g)
       IMPLIES (FORALL (x: Closed_interval[real](a, b)): U_pred(x));


body:
  lim_of_composition [ T1, T2 : TYPE FROM real ] : THEORY
  %----------------------------------------------------------------------------
  %  Author:  Bruno Dutertre    Royal Holloway & Bedford New College
  %----------------------------------------------------------------------------
  BEGIN

    IMPORTING lim_of_functions, continuous_functions[T2]

    f : VAR [T1 -> T2]
    g : VAR [T2 -> real]

    x, y : VAR real
    z : VAR T2

    l : VAR real


    adherence_lemma  : LEMMA convergence(f, x, y) 
                               IMPLIES adh[T2](fullset[real])(y)
          
    adherence_lemma2 : LEMMA convergent?(f, x) 
                               IMPLIES adh[T2](fullset[real])(lim(f, x))


    convergence_composition : LEMMA convergence(f, x, y) AND convergence(g, y, l)
          	                    IMPLIES convergence(g o f, x, l)

    convergent_composition  : LEMMA convergent?(f, x) AND convergent?(g, lim(f, x))
          	                    IMPLIES convergent?(g o f, x)

    lim_composition         : LEMMA convergent?(f, x) AND convergent?(g, lim(f, x))
  	                            IMPLIES lim(g o f, x) = lim(g, lim(f, x))


    convergence_comp_continuous: LEMMA convergence(f, x, z) AND continuous?(g, z) 
  	                                IMPLIES convergence(g o f, x, g(z))

    convergent_comp_continuous : LEMMA convergent?(f, x) AND T2_pred(lim(f, x))
  	                             AND continuous?(g, lim(f, x))
  	                                IMPLIES convergent?(g o f, x)

    lim_comp_continuous        : LEMMA convergent?(f, x) AND T2_pred(lim(f, x))
  	                             AND continuous?(g, lim(f, x))
  	                             IMPLIES
  	                                  lim(g o f, x) = g(lim(f, x))

  END lim_of_composition

addendum:
  %%% ================ Addendum: generated declarations ================

  % Subtype TCC generated (at line 32, column 48) for  x
      % expected type  {a | convergent?[T1](g o f, a)}
  lim_composition_TCC1: OBLIGATION
    FORALL (f: [T1 -> T2], g: [T2 -> real], x: real):
      convergent?(g, lim(f, x)) AND convergent?(f, x) IMPLIES
       convergent?[T1](o[T1, T2, real](g, f), x);

  % Subtype TCC generated (at line 45, column 46) for  x
      % expected type  {a | convergent?[T1](g o f, a)}
  lim_comp_continuous_TCC1: OBLIGATION
    FORALL (f: [T1 -> T2], g: [T2 -> real], x: real):
      continuous?(g, lim(f, x)) AND T2_pred(lim(f, x)) AND convergent?(f, x)
       IMPLIES convergent?[T1](o[T1, T2, real](g, f), x);


body:
  chain_rule [ T1, T2 : TYPE FROM real ] : THEORY
  %----------------------------------------------------------------------------
  %  Author:  Bruno Dutertre    Royal Holloway & Bedford New College
  %----------------------------------------------------------------------------
  BEGIN

    ASSUMING

      IMPORTING deriv_domain_def

       deriv_domain1     : ASSUMPTION deriv_domain?[T1]

       not_one_element1  : ASSUMPTION not_one_element?[T1]

       deriv_domain2     : ASSUMPTION deriv_domain?[T2]

       not_one_element2  : ASSUMPTION not_one_element?[T2]

    ENDASSUMING

    IMPORTING derivative_props, lim_of_composition

    f : VAR [T1 -> T2]
    g : VAR [T2 -> real]
    x : VAR T1
    DF, DG : VAR real

    chain_rule_cnvg        : LEMMA convergence(NQ(f, x), 0, DF) AND 
                                convergence(NQ(g, f(x)), 0, DG)
  	                         IMPLIES convergence(NQ(g o f, x), 0, DG * DF)

    composition_derivable : LEMMA derivable?(f, x) AND derivable?(g, f(x))
  	                           IMPLIES derivable?(g o f, x)

    composition_derivable_fun : LEMMA derivable?(f) AND derivable?(g) 
                                         IMPLIES derivable?(g o f)

    deriv_composition : LEMMA derivable?(f, x) AND derivable?(g, f(x))
  	                 IMPLIES deriv(g o f, x) = deriv(g, f(x)) * deriv(f, x)


    ff : VAR { f | derivable?(f) }
    gg : VAR { g | derivable?(g) }

    deriv_comp_fun     : LEMMA deriv(gg o ff) = (deriv(gg) o ff) * deriv(ff)


    comp_derivable_fun : LEMMA derivable?(f) AND derivable?(g) 
                                         IMPLIES derivable?(LAMBDA (x: T1): g(f(x)))

    chain_rule         : LEMMA deriv(LAMBDA (x: T1): gg(ff(x))) =
                                 (LAMBDA (x: T1): deriv(gg)(ff(x))) * deriv(ff)

  END chain_rule

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 30, column 12) for  derivatives_def[T1]
      % generated from assumption derivatives_def.deriv_domain
  chain_rule_cnvg_TCC1: OBLIGATION deriv_domain?[T1];

  % Assuming TCC generated (at line 30, column 12) for  derivatives_def[T1]
      % generated from assumption derivatives_def.not_one_element
  chain_rule_cnvg_TCC2: OBLIGATION not_one_element?[T1];

  % Assuming TCC generated (at line 30, column 12) for  derivatives_def[T2]
      % generated from assumption derivatives_def.deriv_domain
  chain_rule_cnvg_TCC3: OBLIGATION
    FORALL (DF: real, f: [T1 -> T2], x: T1):
      convergence(NQ(f, x), 0, DF) IMPLIES deriv_domain?[T2];

  % Assuming TCC generated (at line 30, column 12) for  derivatives_def[T2]
      % generated from assumption derivatives_def.not_one_element
  chain_rule_cnvg_TCC4: OBLIGATION
    FORALL (DF: real, f: [T1 -> T2], x: T1):
      convergence(NQ(f, x), 0, DF) IMPLIES not_one_element?[T2];

  % Assuming TCC generated (at line 30, column 12) for  derivatives_def[T2]
      % generated from assumption derivatives_def.deriv_domain
  composition_derivable_TCC1: OBLIGATION
    FORALL (f: [T1 -> T2], x: T1): derivable?(f, x) IMPLIES deriv_domain?[T2];

  % Assuming TCC generated (at line 30, column 12) for  derivatives_def[T2]
      % generated from assumption derivatives_def.not_one_element
  composition_derivable_TCC2: OBLIGATION
    FORALL (f: [T1 -> T2], x: T1):
      derivable?(f, x) IMPLIES not_one_element?[T2];

  % Assuming TCC generated (at line 14, column 12) for  derivatives[T2]
      % generated from assumption derivatives.deriv_domain
  composition_derivable_fun_TCC1: OBLIGATION
    FORALL (f: [T1 -> T2]): derivable?(f) IMPLIES deriv_domain?[T2];

  % Assuming TCC generated (at line 14, column 12) for  derivatives[T2]
      % generated from assumption derivatives.not_one_element
  composition_derivable_fun_TCC2: OBLIGATION
    FORALL (f: [T1 -> T2]): derivable?(f) IMPLIES not_one_element?[T2];

  % Subtype TCC generated (at line 39, column 39) for  x
      % expected type  {x | derivable?[T1](g o f, x)}
  deriv_composition_TCC1: OBLIGATION
    FORALL (f: [T1 -> T2], g: [T2 -> real], x: T1):
      derivable?(g, f(x)) AND derivable?(f, x) IMPLIES
       derivable?[T1](o[T1, T2, real](g, f), x);

  % Assuming TCC generated (at line 14, column 12) for  derivatives[T2]
      % generated from assumption derivatives.deriv_domain
  gg_TCC1: OBLIGATION deriv_domain?[T2];

  % Assuming TCC generated (at line 14, column 12) for  derivatives[T2]
      % generated from assumption derivatives.not_one_element
  gg_TCC2: OBLIGATION not_one_element?[T2];

  % Subtype TCC generated (at line 45, column 35) for  gg o ff
      % expected type  deriv_fun[T1]
  deriv_comp_fun_TCC1: OBLIGATION
    FORALL (ff: {f | derivable?(f)}, gg: {g | derivable?(g)}):
      derivable?[T1](o[T1, T2, real](gg, ff));

  % Subtype TCC generated (at line 51, column 35) for
      % LAMBDA (x: T1): gg(ff(x))
      % expected type  deriv_fun[T1]
  chain_rule_TCC1: OBLIGATION
    FORALL (ff: {f | derivable?(f)}, gg: {g | derivable?(g)}):
      derivable?[T1](LAMBDA (x: T1): gg(ff(x)));


body:
  composition_continuous [ T1, T2 : TYPE FROM real ] : THEORY
  %----------------------------------------------------------------------------
  %  Composition of continuous functions   
  %
  %  Author:  Bruno Dutertre    Royal Holloway & Bedford New College
  %----------------------------------------------------------------------------
  BEGIN

    IMPORTING continuous_functions, reals@real_fun_props

    f : VAR [T1 -> T2]
    g : VAR [T2 -> real]
    x0 : VAR T1

    F : VAR { E : setof[real] | subset?(E, T1_pred) }  

    composition_cont     : LEMMA continuous?(f, x0) AND continuous?(g, f(x0))
  	                          IMPLIES continuous?(g o f, x0)

    composition_cont_set : LEMMA continuous_on?(f, F) AND continuous_on?(g, Im(f, F))
  	                          IMPLIES continuous_on?(g o f, F)

    composition_cont_fun : LEMMA continuous?(f) AND continuous?(g) 
                                    IMPLIES continuous?(g o f)

  END composition_continuous


body:
  integral_chg_var[T: TYPE+ FROM real, U: TYPE+ FROM real]: THEORY
  %----------------------------------------------------------------------------
  %
  %  Integral change of variable theorem
  %
  %  Rosenlicht page 128
  % 
  %  Author:  Rick Butler               NASA Langley
  %----------------------------------------------------------------------------
  BEGIN

     ASSUMING
        IMPORTING deriv_domain_def

        connected_domain : ASSUMPTION connected?[T]

        not_one_element  : ASSUMPTION not_one_element?[T]

        con_dom_U        : ASSUMPTION  connected?[U]

        not_one_U        : ASSUMPTION not_one_element?[U]

     ENDASSUMING

     deriv_domain_T: LEMMA deriv_domain?[T]
     deriv_domain_U: LEMMA deriv_domain?[U]


     IMPORTING composition_continuous,
               fundamental_theorem,
               chain_rule


     f: VAR [T -> real]
     phi: VAR [U -> T]
     a,b: VAR U
     t:   VAR T

     int_chg_var_prep: LEMMA continuous?(f) AND derivable?(phi)  
                             AND continuous?(deriv(phi)) IMPLIES
              continuous?((f o phi) * deriv(phi)) AND
              Integrable?[U](a, b, LAMBDA (u: U): f(phi(u)) * deriv[U](phi)(u));


     Int_chg_var: THEOREM derivable?(phi) AND continuous?(deriv(phi)) AND
                          continuous?(f) 
                          IMPLIES
                               Integral(phi(a),phi(b),f) =
                     Integral(a,b,(LAMBDA (u:U): f(phi(u))*deriv(phi)(u)))


     int_chg_var: THEOREM derivable?(phi) AND continuous?(deriv(phi)) AND
                          continuous?(f) AND a < b AND phi(a) < phi(b)
                          IMPLIES
                               integral(phi(a),phi(b),f) =
                     integral(a,b,(LAMBDA (u:U): f(phi(u))*deriv(phi)(u)))
                     

   
  END integral_chg_var

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 14, column 12) for  derivatives[U]
      % generated from assumption derivatives.deriv_domain
  int_chg_var_prep_TCC1: OBLIGATION
    FORALL (f: [T -> real]): continuous?(f) IMPLIES deriv_domain?[U];

  % Assuming TCC generated (at line 14, column 12) for  derivatives[U]
      % generated from assumption derivatives.not_one_element
  int_chg_var_prep_TCC2: OBLIGATION
    FORALL (f: [T -> real]): continuous?(f) IMPLIES not_one_element?[U];

  % Assuming TCC generated (at line 14, column 6) for  integral_def[U]
      % generated from assumption integral_def.connected_domain
  int_chg_var_prep_TCC3: OBLIGATION
    FORALL (f: [T -> real], phi: [U -> T]):
      continuous?(deriv(phi)) AND
       derivable?(phi) AND
        continuous?(f) AND continuous?((f o phi) * deriv(phi))
       IMPLIES connected?[U];

  % Assuming TCC generated (at line 14, column 12) for  derivatives[U]
      % generated from assumption derivatives.deriv_domain
  Int_chg_var_TCC1: OBLIGATION deriv_domain?[U];

  % Assuming TCC generated (at line 14, column 12) for  derivatives[U]
      % generated from assumption derivatives.not_one_element
  Int_chg_var_TCC2: OBLIGATION not_one_element?[U];

  % Subtype TCC generated (at line 48, column 52) for  f
      % expected type  Integrable_funs[T](phi(a), phi(b))
  Int_chg_var_TCC3: OBLIGATION
    FORALL (a, b: U, f: [T -> real], phi: [U -> T]):
      continuous?(f) AND continuous?(deriv(phi)) AND derivable?(phi) IMPLIES
       Integrable?[T](phi(a), phi(b), f);

  % Assuming TCC generated (at line 26, column 13) for  integral_def[T]
      % generated from assumption integral_def.connected_domain
  Int_chg_var_TCC4: OBLIGATION
    FORALL (f: [T -> real], phi: [U -> T]):
      continuous?(f) AND continuous?(deriv(phi)) AND derivable?(phi) IMPLIES
       connected?[T];

  % Assuming TCC generated (at line 26, column 13) for  integral_def[T]
      % generated from assumption integral_def.not_one_element
  Int_chg_var_TCC5: OBLIGATION
    FORALL (f: [T -> real], phi: [U -> T]):
      continuous?(f) AND continuous?(deriv(phi)) AND derivable?(phi) IMPLIES
       not_one_element?[T];

  % Subtype TCC generated (at line 49, column 33) for
      % (LAMBDA (u: U): f(phi(u)) * deriv(phi)(u))
      % expected type  Integrable_funs[U](a, b)
  Int_chg_var_TCC6: OBLIGATION
    FORALL (a, b: U, f: [T -> real], phi: [U -> T]):
      continuous?(f) AND continuous?(deriv(phi)) AND derivable?(phi) IMPLIES
       Integrable?[U](a, b, LAMBDA (u: U): f(phi(u)) * deriv[U](phi)(u));

  % Assuming TCC generated (at line 26, column 13) for  integral_def[U]
      % generated from assumption integral_def.connected_domain
  Int_chg_var_TCC7: OBLIGATION
    FORALL (f: [T -> real], phi: [U -> T]):
      continuous?(f) AND continuous?(deriv(phi)) AND derivable?(phi) IMPLIES
       connected?[U];

  % Subtype TCC generated (at line 55, column 52) for  f
      % expected type  {f | integrable?[T](phi(a), phi(b), f)}
  int_chg_var_TCC1: OBLIGATION
    FORALL (a, b: U, f: [T -> real], phi: [U -> T]):
           phi(a) < phi(b) AND a < b AND continuous?(f)
       AND continuous?(deriv(phi)) AND derivable?(phi)
       IMPLIES integrable?[T](phi(a), phi(b), f);

  % Subtype TCC generated (at line 56, column 33) for
      % (LAMBDA (u: U): f(phi(u)) * deriv(phi)(u))
      % expected type  {f | integrable?[U](a, b, f)}
  int_chg_var_TCC2: OBLIGATION
    FORALL (a, b: U, f: [T -> real], phi: [U -> T]):
           phi(a) < phi(b) AND a < b AND continuous?(f)
       AND continuous?(deriv(phi)) AND derivable?(phi)
       IMPLIES
       integrable?[U](a, b, LAMBDA (u: U): f(phi(u)) * deriv[U](phi)(u));


body:
  table_of_integrals[T: TYPE+ FROM real]: THEORY
  %------------------------------------------------------------------------------
  %
  %  New experimental:  Theorems will be added as they are needed
  %
  %  Author:  Rick Butler               NASA Langley
  %------------------------------------------------------------------------------

  BEGIN

     ASSUMING
        IMPORTING deriv_domain_def[T]

        connected_domain : ASSUMPTION connected?[T]

        not_one_element : ASSUMPTION not_one_element?[T]

     ENDASSUMING

     IMPORTING fundamental_theorem[T], indefinite_integral[T]

     a,b,x: VAR T

  %  ------ Integral c x^n  = (c/(n+1))*x^(n+1) -----

     antideriv_x_to_n: LEMMA FORALL (n: posnat, c: real):
                              LET f = (LAMBDA x: c*x^n),
                                  F = (LAMBDA x: (c/(n+1))*x^(n+1)) IN
                              antiderivative?(F,f)


     integral_x_to_n: LEMMA FORALL (n: posnat, c: real):
                              LET f = (LAMBDA x: c*x^n) IN
                              Integrable?(a,b,f) AND 
                           LET F = (LAMBDA x: (c/(n+1))*x^(n+1)) IN
                       Integral(a,b,f) = F(b) - F(a)

     integral_linear: LEMMA FORALL (mm: real, bb: real):
                              LET f = (LAMBDA x: mm*x+bb) IN
                              Integrable?(a,b,f) AND 
                           LET F = (LAMBDA x: (mm/2)*x^2 +bb*x) IN
                       Integral(a,b,f) = F(b) - F(a)

     integral_quadratic: LEMMA FORALL (A,B,C: real):
                         Integrable?(a,b, LAMBDA x: A*x^2+B*x+C) AND 
                         LET F =(LAMBDA x: (A/3)*x^3 +(B/2)*x^2 +C*x) IN
                         Integral(a,b, LAMBDA x: A*x^2+B*x+C) = F(b)-F(a)

  %  -------

  %   IMPORTING sqrt_derivative

  %   integral_a_to_x: LEMMA LET f = (LAMBDA x: a^^x) IN
  %                              Integrable?(a,b,f) AND 
  %                              Integral(a,b,f) = F(b) - F(a)

  %   integral_1_div_sqrt: LEMMA LET f = (LAMBDA (t: nnreal): 1/sqrt(t)) IN
  %                           a > 0 AND b > 0 IMPLIES  
  %                         Integrable?(a,b,f) AND
  %                         Integral(a, b, f)  = 2*sqrt(b) - 2*sqrt(a)



  END table_of_integrals

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 20, column 13) for  fundamental_theorem[T]
      % generated from assumption fundamental_theorem.connected_domain
  IMP_fundamental_theorem_TCC1: OBLIGATION connected?[T];

  % Assuming TCC generated (at line 20, column 13) for  fundamental_theorem[T]
      % generated from assumption fundamental_theorem.not_one_element
  IMP_fundamental_theorem_TCC2: OBLIGATION not_one_element?[T];

  % Subtype TCC generated (at line 27, column 51) for  n
      % expected type  {i: int | x /= 0 OR i >= 0}
  antideriv_x_to_n_TCC1: OBLIGATION FORALL (n: posnat, x): x /= 0 OR n >= 0;

  % Subtype TCC generated (at line 28, column 60) for  (n + 1)
      % expected type  {i: int | x /= 0 OR i >= 0}
  antideriv_x_to_n_TCC2: OBLIGATION
    FORALL (n: posnat, c: real, f: [T -> real]):
      f = (LAMBDA x: c * x ^ n) IMPLIES
       (FORALL (x1): x1 /= 0 OR (n + 1) >= 0);

  % Subtype TCC generated (at line 41, column 53) for  2
      % expected type  {i: int | x /= 0 OR i >= 0}
  integral_linear_TCC1: OBLIGATION
    FORALL (a, b: T, mm: real, bb: real, f: [T -> real]):
      Integrable?(a, b, f) AND f = (LAMBDA x: mm * x + bb) IMPLIES
       (FORALL (x1): x1 /= 0 OR 2 >= 0);

  % Subtype TCC generated (at line 45, column 54) for  2
      % expected type  {i: int | x /= 0 OR i >= 0}
  integral_quadratic_TCC1: OBLIGATION FORALL (x): x /= 0 OR 2 >= 0;

  % Subtype TCC generated (at line 46, column 49) for  3
      % expected type  {i: int | x /= 0 OR i >= 0}
  integral_quadratic_TCC2: OBLIGATION
    FORALL (a, b: T, A, B, C: real):
      Integrable?(a, b, LAMBDA x: A * x ^ 2 + B * x + C) IMPLIES
       (FORALL (x1): x1 /= 0 OR 3 >= 0);

  % Subtype TCC generated (at line 46, column 60) for  2
      % expected type  {i: int | x /= 0 OR i >= 0}
  integral_quadratic_TCC3: OBLIGATION
    FORALL (a, b: T, A, B, C: real):
      Integrable?(a, b, LAMBDA x: A * x ^ 2 + B * x + C) IMPLIES
       (FORALL (x1): x1 /= 0 OR 2 >= 0);


body:
  top_integral : THEORY
  %------------------------------------------------------------------------------
  %
  %  Theory and proofs taken from Introduction to Analysis (Maxwell Rosenlicht)
  %
  %  Author:  Rick Butler               NASA Langley
  %
  %  Added integral_mean_value  12/27/06
  %
  %------------------------------------------------------------------------------
  BEGIN

    IMPORTING integral, 
              fundamental_theorem,
              table_of_integrals, 
              integral_chg_var,     
              integral_diff_doms,
              integral_mean_value,  
              integration_by_parts, 
              indefinite_integral

  END top_integral


body:
  rs_partition[T:TYPE+ from real]: THEORY
  %----------------------------------------------------------------------------
  %    Partitions for Riemann-Stieltjes Integration
  %----------------------------------------------------------------------------
  BEGIN

     ASSUMING
        IMPORTING deriv_domain_def[T]

        connected_domain : ASSUMPTION connected?[T]


        not_one_element : ASSUMPTION not_one_element?[T]

     ENDASSUMING


     IMPORTING finite_sets@finite_sets_minmax[real,<=],
     	     structures@sort_fseq[T,<=],
  	     structures@fseqs_ops[T]

     AUTO_REWRITE+ finseq_appl


     a,b,c,x:VAR T
     f,g,h: VAR [T -> real]
     n: VAR nat


     IMPORTING reals@intervals_real[T]


     bounded_on?(a,b,f): bool = (EXISTS (B: real): 
                     (FORALL (x: closed_interval(a,b)): abs(f(x)) <= B))

  % When the riemann integral was orginally defined, a partition was striclty increasing. Here, it is defined
  % only as increasing.

     partition_pred?(a:T,b:{x:T|a<x})(fs:fseq): MACRO bool = 
     		      (Let N = fs`length, xx = fs`seq IN
                        N > 1 AND xx(0) = a AND xx(N-1) = b AND 
  		      increasing?(fs) AND
  		      (FORALL (i:below(N)): a <= xx(i) AND xx(i) <= b))

     partition(a:T,b:{x:T|a<x}): TYPE = (partition_pred?(a,b))

     partition_strictly_sort: LEMMA a<b IMPLIES FORALL (P:partition(a,b)): partition_pred?(a,b)(strictly_sort(P))

     width(a:T, b:{x:T|a<x}, P: partition(a,b)): posreal =
               LET xx = P`seq, N = P`length IN
                        max({ l: real | EXISTS (ii: below(N-1)):
                                           l = xx(ii+1) - xx(ii)}) 

     width_lem     : LEMMA (FORALL (a:T), (b:{x:T|a<x}),
                              (P: partition(a,b)),(ii: below(P`length-1)):
                           width(a,b,P) >= P(ii+1) - P(ii))

     width_lem_exists: LEMMA a<b IMPLIES FORALL (P:partition(a,b)):
     		     EXISTS (ii:below(P`length-1)): width(a,b,P) = P(ii+1)-P(ii)

     parts_order   : LEMMA  FORALL (P: partition(a,b), ii,jj: below(P`length)):
                                ii <= jj IMPLIES P`seq(ii) <= P`seq(jj)
     
     parts_disjoint: LEMMA FORALL (P: partition(a,b), ii,jj: below(P`length-1)):
                               P`seq(ii) < x AND x < P`seq(1 + ii) AND
                               P`seq(jj) < x AND x < P`seq(1 + jj)
                               IMPLIES
                                  jj = ii

     in_part?(a:T, b:{x:T|a<x},P: partition(a,b),xx:T): MACRO bool = 
                          EXISTS (ii: below(P`length-1)): xx = P`seq(ii)

     in_sect?(a:T, b:{x:T|a<x},P: partition(a,b),
              ii: below(P`length-1),xx:T): MACRO bool = 
                        P`seq(ii) < xx AND xx < P`seq(ii+1)


     part_in       : LEMMA FORALL (P: partition(a,b)):    
                               a < b AND a <= x AND x <= b IMPLIES
                                   (EXISTS (ii: below(P`length-1)): 
                                         P`seq(ii) <= x AND x <= P`seq(ii+1))

     part_in_strict_left       : LEMMA FORALL (P: partition(a,b)):    
                               a < b AND a < x AND x <= b IMPLIES
                                   (EXISTS (ii: below(P`length-1)): 
                                         P`seq(ii) < x AND x <= P`seq(ii+1))

     part_not_in       : LEMMA a < b IMPLIES FORALL (P: partition(a,b)):    
                                  FORALL (ii,jj: below(P`length-1)): 
                                    P`seq(ii) < x AND x < P`seq(ii+1) 
                                  IMPLIES x /= P`seq(jj)

     Prop: VAR [T -> bool]
     part_induction: LEMMA  (FORALL (P: partition(a,b)): 
                                (FORALL ( x: closed_interval(a,b)):
                             LET xx = P`seq, N = P`length IN 
                     (FORALL (ii : below(N-1)):
                             xx(ii) <= x AND x <= xx(ii+1) IMPLIES
                                  Prop(x))
                    IMPLIES Prop(x) ) )


     IMPORTING reals@sigma_below, reals@sigma_upto

     eq_partition(a:T,b:{x:T|a<x},N: above(1)): partition(a,b) =
                    (# length := N,
                       seq := (LAMBDA (ii: nat): IF ii<N THEN a + ii*(b-a)/(N-1) ELSE default ENDIF) #)




     N: VAR above(1)

     len_eq_part  : LEMMA a < b IMPLIES length(eq_partition(a,b,N)) = N 
     eq_part_lem_a: LEMMA a < b IMPLIES seq(eq_partition(a,b,N))(0) = a 
     eq_part_lem_b: LEMMA a < b IMPLIES seq(eq_partition(a,b,N))(N-1) = b

     width_eq_part: LEMMA a < b IMPLIES 
                              width(a,b,eq_partition(a,b,N)) = (b-a)/(N-1)


     delta: VAR posreal
     N_from_delta: LEMMA a < b IMPLIES
                            LET N = 2 + floor((b - a) / delta),
                                EP = eq_partition(a, b, N) IN
                            width(a, b, EP) < delta

     partition_exists: LEMMA a < b IMPLIES
                          (EXISTS (P: partition(a,b)): width(a,b,P) < delta)

     % Joining Partitions


     partjoin(a:T,b: {bb:T | a<bb}, c: {cc:T | b<cc})(Pab: partition(a,b),Pbc: partition(b,c)): partition(a,c) =
       concat(Pab,delete(0,Pbc))

     partjoin_def: LEMMA a<b AND b<c IMPLIES FORALL (Pab: partition(a,b),Pbc: partition(b,c)):
     		 LET Pac = partjoin(a,b,c)(Pab,Pbc) IN
  		 (n < Pab`length IMPLIES Pac`seq(n) = Pab`seq(n)) AND
  		 (Pab`length-1 <= n AND n<Pac`length IMPLIES Pac`seq(n) = Pbc`seq(n-Pab`length+1))

     partjoin_width: LEMMA a<b AND b<c IMPLIES FORALL (Pab: partition(a,b),Pbc: partition(b,c)):
     		   width(a,c,partjoin(a,b,c)(Pab,Pbc)) = max(width(a,b,Pab),width(b,c,Pbc))

     partition_union(a,(b|a<b))(P,Q: partition(a,b)): {PQ: partition(a,b) |
     			(FORALL (x:T): member(x,PQ) IFF (member(x,P) OR member(x,Q))) AND
  			strictly_increasing?(PQ)}

     partition_union_sym: LEMMA a<b IMPLIES FORALL (P,Q:partition(a,b)):
     			partition_union(a,b)(P,Q) = partition_union(a,b)(Q,P)

     partition_union_unique: LEMMA a<b IMPLIES FORALL (P,Q,PQ:partition(a,b)):
     			   ((FORALL (x:T): member(x,PQ) IFF (member(x,P) OR member(x,Q))) AND
  			strictly_increasing?(PQ))
  			   IFF
  			   PQ = partition_union(a,b)(P,Q)

     partition_union_width: LEMMA a<b IMPLIES FORALL (P,Q:partition(a,b)):
     			  width(a,b,partition_union(a,b)(P,Q)) <= min(width(a,b,P),width(a,b,Q))

     partition_strictly_sort_union: LEMMA a<b IMPLIES FORALL (P,Q:partition(a,b)):
     				  partition_union(a,b)(P,Q) = partition_union(a,b)(strictly_sort(P),Q)

     partition_union_is_strictly_sort: LEMMA a<b IMPLIES FORALL (P:partition(a,b)):
     				     partition_union(a,b)(P,P) = strictly_sort(P)

     partition_union_map(a,(b|a<b),P,Q:partition(a,b)): {pm:[below(P`length)->below(partition_union(a,b)(P,Q)`length)] | 
     						      FORALL (ii:below(P`length)): P`seq(ii) = partition_union(a,b)(P,Q)`seq(pm(ii))}

     partition_union_map_unique: LEMMA a<b IMPLIES FORALL (P,Q:partition(a,b),pm:[below(P`length)->below(partition_union(a,b)(P,Q)`length)]):
  			       (FORALL (ii:below(P`length)): P`seq(ii) = partition_union(a,b)(P,Q)`seq(pm(ii)))
  			       IMPLIES
  			       pm = partition_union_map(a,b,P,Q)

     partition_union_map_increasing: LEMMA a<b IMPLIES FORALL (P,Q:partition(a,b),ii,jj:below(P`length)):
     				   strictly_increasing?(P) AND ii<jj IMPLIES partition_union_map(a,b,P,Q)(ii) < partition_union_map(a,b,P,Q)(jj)

     partition_union_strictly_sort_map_inv: LEMMA a<b IMPLIES FORALL (P:partition(a,b),ii:below(strictly_sort(P)`length)):
     				      partition_union_map(a,b,P,P)(strictly_sort_map(P)(ii)) = ii

     partition_union_map_inv(a,(b|a<b),P,Q:partition(a,b)): {pm:[below(partition_union(a,b)(P,Q)`length)->below(P`length)] | 
     			FORALL (jj:below(partition_union(a,b)(P,Q)`length)): 
  			P`seq(pm(jj)) <= partition_union(a,b)(P,Q)`seq(jj) AND (pm(jj) < P`length-1 IMPLIES partition_union(a,b)(P,Q)`seq(jj) < P`seq(pm(jj)+1))}

     partition_union_map_inv_def: LEMMA a<b IMPLIES FORALL (P,Q:partition(a,b)): 
     			    LET PQ = partition_union(a,b)(P,Q),
  			    	pum = partition_union_map(a,b,P,Q),	
  				puminv = partition_union_map_inv(a,b,P,Q)
  			    IN
     				FORALL (ii:below(PQ`length),jj:below(P`length)):
  				(pum(jj) <= ii AND (jj<P`length-1 IMPLIES ii < pum(jj+1)))
  				IMPLIES
  				puminv(ii) = jj


     partition_sort_inv_map: LEMMA a<b IMPLIES FORALL (P:partition(a,b)):
     			   LET SSP = partition_union(a,b)(P,P),
  			       sig = partition_union_map_inv(a,b,P,P)
  			   IN
  			       FORALL (ii:below(SSP`length)): SSP`seq(ii) = P`seq(sig(ii))







  END rs_partition

addendum:
  %%% ================ Addendum: generated declarations ================

  % Subtype TCC generated (at line 41, column 49) for  N - 1
      % expected type  nat
  partition_pred?_TCC1: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, fs: fseq[T], N: nat):
      N = fs`length IMPLIES
       (FORALL (xx: barray[T](fs`length)):
          xx(0) = a AND N > 1 AND xx = fs`seq IMPLIES N - 1 >= 0);

  % Subtype TCC generated (at line 51, column 26) for
      % {l: real | EXISTS (ii: below(N - 1)): l = xx(ii + 1) - xx(ii)}
      % expected type  SS: non_empty_finite_set[real]
  width_TCC1: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition(a, b),
            xx: barray[T](P`length)):
      xx = P`seq IMPLIES
       (FORALL (N: nat):
          N = P`length IMPLIES
           is_finite[real]
               ({l: real |
                   EXISTS (ii: below(N - 1)): l = xx(ii + 1) - xx(ii)})
            AND
            NOT empty?[real]
                    ({l: real |
                        EXISTS (ii: below(N - 1)): l = xx(ii + 1) - xx(ii)}));

  % Subtype TCC generated (at line 51, column 22) for
      % max({l: real | EXISTS (ii: below(N - 1)): l = xx(ii + 1) - xx(ii)})
      % expected type  posreal
  width_TCC2: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition(a, b),
            xx: barray[T](P`length)):
      xx = P`seq IMPLIES
       (FORALL (N: nat):
          N = P`length IMPLIES
           max[real, <=]
               ({l: real |
                   EXISTS (ii: below(N - 1)): l = xx(ii + 1) - xx(ii)})
            >= 0
            AND
            max[real, <=]
                ({l: real |
                    EXISTS (ii: below(N - 1)): l = xx(ii + 1) - xx(ii)})
             > 0);

  % Subtype TCC generated (at line 74, column 22) for  P`length - 1
      % expected type  nat
  in_sect?_TCC1: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition(a, b)): P`length - 1 >= 0;

  % Subtype TCC generated (at line 107, column 74) for  (N - 1)
      % expected type  nznum
  eq_partition_TCC1: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, N: above(1), ii: nat):
      ii < N IMPLIES (N - 1) /= 0;

  % Subtype TCC generated (at line 107, column 60) for
      % a + ii * (b - a) / (N - 1)
      % expected type  T
  eq_partition_TCC2: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, N: above(1), ii: nat):
      ii < N IMPLIES T_pred(a + ii * (b - a) / (N - 1));

  % Subtype TCC generated (at line 107, column 29) for
      % (LAMBDA (ii: nat):
      %    IF ii < N THEN a + ii * (b - a) / (N - 1) ELSE default ENDIF)
      % expected type  barray[T](N)
  eq_partition_TCC3: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, N: above(1)):
      (FORALL (ii: nat):
         T_pred(IF ii < N THEN a + ii * (b - a) / (N - 1)
                ELSE default[T]
                ENDIF))
       AND
       (FORALL (i: nat):
          i >= N IMPLIES
           IF i < N THEN a + i * (b - a) / (N - 1) ELSE default[T] ENDIF =
            default[T]);

  % Subtype TCC generated (at line 106, column 18) for
      % (# length := N,
      %    seq
      %      := (LAMBDA (ii: nat):
      %            IF ii < N THEN a + ii * (b - a) / (N - 1)
      %            ELSE default
      %            ENDIF) #)
      % expected type  partition(a, b)
  eq_partition_TCC4: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, N: above(1)):
           N > 1
       AND IF 0 < N THEN a + 0 * (b - a) / (N - 1) ELSE default[T] ENDIF = a
       AND IF N - 1 < N THEN a + (N - 1) * (b - a) / (N - 1)
           ELSE default[T]
           ENDIF
            = b
       AND increasing?[T, restrict[[real, real], [T, T], boolean](<=)]
               ((# length := N,
                   seq
                     := (LAMBDA (ii: nat):
                           IF ii < N THEN a + ii * (b - a) / (N - 1)
                           ELSE default[T]
                           ENDIF) #))
       AND FORALL (i: below(N)):
             a <=
              IF i < N THEN a + i * (b - a) / (N - 1) ELSE default[T] ENDIF
              AND
              IF i < N THEN a + i * (b - a) / (N - 1) ELSE default[T] ENDIF
               <= b;

  % Subtype TCC generated (at line 116, column 63) for  N - 1
      % expected type  nat
  eq_part_lem_b_TCC1: OBLIGATION
    FORALL (N: above(1), a, b: T): a < b IMPLIES N - 1 >= 0;

  % Subtype TCC generated (at line 119, column 68) for  (N - 1)
      % expected type  nznum
  width_eq_part_TCC1: OBLIGATION
    FORALL (N: above(1), a, b: T): a < b IMPLIES (N - 1) /= 0;

  % Subtype TCC generated (at line 125, column 54) for  N
      % expected type  above(1)
  N_from_delta_TCC1: OBLIGATION
    FORALL (a, b: T, delta: posreal):
      a < b IMPLIES
       (FORALL (N: int): N = 2 + floor((b - a) / delta) IMPLIES N > 1);

  % Subtype TCC generated (at line 134, column 106) for  c
      % expected type  {x: T | a < x}
  partjoin_TCC1: OBLIGATION
    FORALL (a: T, b: {bb: T | a < bb}, c: {cc: T | b < cc}): a < c;

  % Subtype TCC generated (at line 135, column 25) for  Pbc
      % expected type  ne_fseq[T]
  partjoin_TCC2: OBLIGATION
    FORALL (a: T, b: {bb: T | a < bb}, c: {cc: T | b < cc},
            Pab: partition(a, b), Pbc: partition(b, c)):
      length(Pbc) > 0;

  % Subtype TCC generated (at line 135, column 5) for
      % concat(Pab, delete(0, Pbc))
      % expected type  partition(a, c)
  partjoin_TCC3: OBLIGATION
    FORALL (a: T, b: {bb: T | a < bb}, c: {cc: T | b < cc},
            Pab: partition(a, b), Pbc: partition(b, c)):
           concat[T](Pab, delete[T](0, Pbc))`length > 1
       AND concat[T](Pab, delete[T](0, Pbc))`seq(0) = a
       AND concat[T](Pab, delete[T](0, Pbc))`seq
               (concat[T](Pab, delete[T](0, Pbc))`length - 1)
            = c
       AND increasing?[T, restrict[[real, real], [T, T], boolean](<=)]
               (concat[T](Pab, delete[T](0, Pbc)))
       AND FORALL (i: below(concat[T](Pab, delete[T](0, Pbc))`length)):
             a <= concat[T](Pab, delete[T](0, Pbc))`seq(i) AND
              concat[T](Pab, delete[T](0, Pbc))`seq(i) <= c;

  % Subtype TCC generated (at line 140, column 68) for  n - Pab`length + 1
      % expected type  nat
  partjoin_def_TCC1: OBLIGATION
    FORALL (a, b, c: T, n: nat):
      b < c AND a < b IMPLIES
       (FORALL (Pab: partition(a, b), Pbc: partition(b, c),
                Pac: partition(a, c)):
          Pab`length - 1 <= n AND
           n < Pac`length AND
            (n < Pab`length IMPLIES Pac`seq(n) = Pab`seq(n)) AND
             Pac = partjoin(a, b, c)(Pab, Pbc)
           IMPLIES n - Pab`length + 1 >= 0);

  % Subtype TCC generated (at line 143, column 16) for  c
      % expected type  {x: T | a < x}
  partjoin_width_TCC1: OBLIGATION
    FORALL (a, b, c: T):
      b < c AND a < b IMPLIES
       (FORALL (Pab: partition(a, b), Pbc: partition(b, c)): a < c);

  % Subtype TCC generated (at line 41, column 49) for  fs`length - 1
      % expected type  nat
  partition_union_TCC1: OBLIGATION
    FORALL (a, fs: fseq[T]):
      fs`seq(0) = a AND fs`length > 1 IMPLIES fs`length - 1 >= 0;

  % Existence TCC generated (at line 145, column 3) for
      % partition_union(a, (b: T | a < b))(P, Q: partition(a, b)):
      %       {PQ: partition(a, b) |
      %                (FORALL (x: T):
      %                   member(x, PQ) IFF (member(x, P) OR member(x, Q)))
      %                 AND strictly_increasing?(PQ)}
  partition_union_TCC2: OBLIGATION
    EXISTS (x1:
              [d1: [a: T, {b | a < b}] ->
                 [d: [partition(d1`1, d1`2), partition(d1`1, d1`2)] ->
                    {PQ: partition(d1`1, d1`2) |
                             (FORALL (x: T):
                                member[T](x, PQ) IFF
                                 (member[T](x, d`1) OR member[T](x, d`2)))
                              AND
                              strictly_increasing?
                                  [T,
                                   restrict[[real, real], [T, T], boolean]
                                       (<=)]
                                  (PQ)}]]):
      TRUE;

  % Subtype TCC generated (at line 162, column 58) for  strictly_sort(P)
      % expected type  partition(a, b)
  partition_strictly_sort_union_TCC1: OBLIGATION
    FORALL (a, b: T):
      a < b IMPLIES
       (FORALL (P, Q: partition(a, b)):
               strictly_sort[T, restrict[[real, real], [T, T], boolean](<=)]
                   (P)`length
                > 1
           AND strictly_sort[T, restrict[[real, real], [T, T], boolean](<=)]
                   (P)`seq
                   (0)
                = a
           AND strictly_sort[T, restrict[[real, real], [T, T], boolean](<=)]
                   (P)`seq
                   (strictly_sort
                        [T, restrict[[real, real], [T, T], boolean](<=)]
                        (P)`length
                     - 1)
                = b
           AND increasing?[T, restrict[[real, real], [T, T], boolean](<=)]
                   (strictly_sort
                        [T, restrict[[real, real], [T, T], boolean](<=)]
                        (P))
           AND FORALL (i:
                         below(strictly_sort
                                   [T,
                                    restrict[[real, real], [T, T], boolean]
                                        (<=)]
                                   (P)`length)):
                 a <=
                  strictly_sort
                      [T, restrict[[real, real], [T, T], boolean](<=)]
                      (P)`seq
                      (i)
                  AND
                  strictly_sort
                      [T, restrict[[real, real], [T, T], boolean](<=)]
                      (P)`seq
                      (i)
                   <= b);

  % Existence TCC generated (at line 167, column 3) for
      % partition_union_map(a, (b: T | a < b), P, Q: partition(a, b)):
      %       {pm:
      %          [below(P`length) ->
      %             below(partition_union(a, b)(P, Q)`length)] |
      %                FORALL (ii: below(P`length)):
      %                  P`seq(ii) = partition_union(a, b)(P, Q)`seq(pm(ii))}
  partition_union_map_TCC1: OBLIGATION
    EXISTS (x:
              [d: [a: T, b: {b | a < b}, partition(a, b), partition(a, b)] ->
                 {pm:
                    [below(d`3`length) ->
                       below(partition_union(d`1, d`2)(d`3, d`4)`length)] |
                          FORALL (ii: below(d`3`length)):
                            d`3`seq(ii) =
                             partition_union(d`1, d`2)(d`3, d`4)`seq
                                 (pm(ii))}]):
      TRUE;

  % Existence TCC generated (at line 181, column 3) for
      % partition_union_map_inv(a, (b: T | a < b), P, Q: partition(a, b)):
      %       {pm:
      %          [below(partition_union(a, b)(P, Q)`length) ->
      %             below(P`length)] |
      %                FORALL (jj:
      %                          below(partition_union(a, b)(P, Q)`length)):
      %                  P`seq(pm(jj)) <= partition_union(a, b)(P, Q)`seq(jj)
      %                   AND
      %                   (pm(jj) < P`length - 1 IMPLIES
      %                     partition_union(a, b)(P, Q)`seq(jj) <
      %                      P`seq(pm(jj) + 1))}
  partition_union_map_inv_TCC1: OBLIGATION
    EXISTS (x:
              [d: [a: T, b: {b | a < b}, partition(a, b), partition(a, b)] ->
                 {pm:
                    [below(partition_union(d`1, d`2)(d`3, d`4)`length) ->
                       below(d`3`length)] |
                          FORALL (jj:
                                    below(partition_union
                                          (d`1, d`2)(d`3, d`4)`length)):
                            d`3`seq(pm(jj)) <=
                             partition_union(d`1, d`2)(d`3, d`4)`seq(jj)
                             AND
                             (pm(jj) < d`3`length - 1 IMPLIES
                               partition_union(d`1, d`2)(d`3, d`4)`seq(jj) <
                                d`3`seq(1 + pm(jj)))}]):
      TRUE;

  % Subtype TCC generated (at line 191, column 55) for  jj + 1
      % expected type  below(P`length)
  partition_union_map_inv_def_TCC1: OBLIGATION
    FORALL (a, b: T):
      a < b IMPLIES
       (FORALL (P, Q: partition(a, b),
                PQ:
                  {PQ: partition(a, b) |
                           (FORALL (x: T):
                              member[T](x, PQ) IFF
                               (member[T](x, P) OR member[T](x, Q)))
                            AND
                            strictly_increasing?
                                [T,
                                 restrict[[real, real], [T, T], boolean](<=)]
                                (PQ)}):
          PQ = partition_union(a, b)(P, Q) IMPLIES
           (FORALL (pum:
                      {pm:
                         [below(P`length) ->
                            below(partition_union(a, b)(P, Q)`length)] |
                               FORALL (ii: below(P`length)):
                                 P`seq(ii) =
                                  partition_union(a, b)(P, Q)`seq(pm(ii))}):
              pum = partition_union_map(a, b, P, Q) IMPLIES
               (FORALL (puminv:
                          {pm:
                             [below(partition_union(a, b)(P, Q)`length) ->
                                below(P`length)] |
                                   FORALL (jj:
                                           below(partition_union
                                                 (a, b)(P, Q)`length)):
                                     P`seq(pm(jj)) <=
                                      partition_union(a, b)(P, Q)`seq(jj)
                                      AND
                                      (pm(jj) < P`length - 1
                                       IMPLIES
                                       partition_union(a, b)(P, Q)`seq(jj)
                                       <
                                       P`seq(1 + pm(jj)))}):
                  puminv = partition_union_map_inv(a, b, P, Q) IMPLIES
                   (FORALL (ii: below(PQ`length), jj: below(P`length)):
                      jj < P`length - 1 AND pum(jj) <= ii IMPLIES
                       jj + 1 < P`length))));

  % Subtype TCC generated (at line 193, column 11) for  ii
      % expected type  below(partition_union(a, b)(P, Q)`length)
  partition_union_map_inv_def_TCC2: OBLIGATION
    FORALL (a, b: T):
      a < b IMPLIES
       (FORALL (P, Q: partition(a, b),
                PQ:
                  {PQ: partition(a, b) |
                           (FORALL (x: T):
                              member[T](x, PQ) IFF
                               (member[T](x, P) OR member[T](x, Q)))
                            AND
                            strictly_increasing?
                                [T,
                                 restrict[[real, real], [T, T], boolean](<=)]
                                (PQ)}):
          PQ = partition_union(a, b)(P, Q) IMPLIES
           (FORALL (pum:
                      {pm:
                         [below(P`length) ->
                            below(partition_union(a, b)(P, Q)`length)] |
                               FORALL (ii: below(P`length)):
                                 P`seq(ii) =
                                  partition_union(a, b)(P, Q)`seq(pm(ii))}):
              pum = partition_union_map(a, b, P, Q) IMPLIES
               (FORALL (puminv:
                          {pm:
                             [below(partition_union(a, b)(P, Q)`length) ->
                                below(P`length)] |
                                   FORALL (jj:
                                           below(partition_union
                                                 (a, b)(P, Q)`length)):
                                     P`seq(pm(jj)) <=
                                      partition_union(a, b)(P, Q)`seq(jj)
                                      AND
                                      (pm(jj) < P`length - 1
                                       IMPLIES
                                       partition_union(a, b)(P, Q)`seq(jj)
                                       <
                                       P`seq(1 + pm(jj)))}):
                  puminv = partition_union_map_inv(a, b, P, Q) IMPLIES
                   (FORALL (ii: below(PQ`length), jj: below(P`length)):
                      pum(jj) <= ii AND
                       (jj < P`length - 1 IMPLIES ii < pum(jj + 1))
                       IMPLIES ii < partition_union(a, b)(P, Q)`length))));

  % Subtype TCC generated (at line 200, column 65) for  ii
      % expected type  below(partition_union(a, b)(P, P)`length)
  partition_sort_inv_map_TCC1: OBLIGATION
    FORALL (a, b: T):
      a < b IMPLIES
       (FORALL (P: partition(a, b),
                SSP:
                  {PQ: partition(a, b) |
                           (FORALL (x: T):
                              member[T](x, PQ) IFF
                               (member[T](x, P) OR member[T](x, P)))
                            AND
                            strictly_increasing?
                                [T,
                                 restrict[[real, real], [T, T], boolean](<=)]
                                (PQ)}):
          SSP = partition_union(a, b)(P, P) IMPLIES
           (FORALL (sig:
                      {pm:
                         [below(partition_union(a, b)(P, P)`length) ->
                            below(P`length)] |
                               FORALL (jj:
                                       below(partition_union
                                             (a, b)(P, P)`length)):
                                 P`seq(pm(jj)) <=
                                  partition_union(a, b)(P, P)`seq(jj)
                                  AND
                                  (pm(jj) < P`length - 1 IMPLIES
                                    partition_union(a, b)(P, P)`seq(jj) <
                                     P`seq(1 + pm(jj)))}):
              sig = partition_union_map_inv(a, b, P, P) IMPLIES
               (FORALL (ii: below(SSP`length)):
                  ii < partition_union(a, b)(P, P)`length)));


body:
  rs_integral_def[T:TYPE+ from real]: THEORY
  %----------------------------------------------------------------------------
  %    Definition of Riemann-Stieltjes Integral
  %----------------------------------------------------------------------------
  BEGIN

     ASSUMING
        IMPORTING deriv_domain_def[T]

        connected_domain : ASSUMPTION connected?[T]


        not_one_element : ASSUMPTION not_one_element?[T]

     ENDASSUMING


     IMPORTING rs_partition[T],
  	     reals@real_fun_preds

  %    AUTO_REWRITE+ finseq_appl

     a,b,c,x: VAR T
     S: VAR real
     f,g,h: VAR [T -> real]


     IMPORTING reals@intervals_real[T]

     xis_pred?(a:T,(b|a<b),P:partition(a,b))(fs:fseq): MACRO bool = (fs`length = P`length-1 AND (FORALL (ii: below(P`length-1)):
                       P`seq(ii) <= fs`seq(ii) AND fs`seq(ii) <= P`seq(ii+1)))

     xis?(a:T,(b|a<b),P:partition(a,b)): TYPE = (xis_pred?(a,b,P))

     xis_join(a:T,(b | a<b), (c| b<c))(Pab: partition(a,b),Pbc: partition(b,c))(xab: xis?(a,b,Pab),xbc:xis?(b,c,Pbc)):
       xis?(a,c,partjoin(a,b,c)(Pab,Pbc)) =
       xab o xbc

     xis_lem: LEMMA FORALL (P: partition(a,b), (xis: xis?(a,b,P)),
                           (ii: below(P`length-1))):
                           P(ii) <= xis(ii) AND xis(ii) <= P(ii+1)

     xis_bounded: LEMMA FORALL (P: partition(a,b), (xis: xis?(a,b,P)),
                           (ii: below(P`length-1))):
                           a <= xis(ii) AND xis(ii) <= b

  %   AUTO_REWRITE+ xis_lem

     Rie_sum(a:T,b:{x:T|a<x},g:[T->real],P:partition(a,b),
                    xis: xis?(a,b,P),f:[T->real]): real =
                    LET N = P`length-1 IN
            sigma[below(N)](0,N-1,(LAMBDA (n: below(N)):
                                         (g(P`seq(n+1)) - g(P`seq(n))) * f(xis(n))))

     Rie_sec(a:T,b:{x:T|a<x},g:[T->real],P:partition(a,b), xis: xis?(a,b,P), f:[T->real], 
             n: upto(P`length-1)): real = 
                             IF n = 0 THEN 0
                             ELSE (g(P`seq(n)) - g(P`seq(n - 1))) * f(xis(n-1)) 
                             ENDIF

     Rie_sum_alt(a:T,b:{x:T|a<x},g:[T->real],P:partition(a,b),
                    xis: xis?(a,b,P),f:[T->real]): real =
                    LET N = P`length-1 IN
                       sigma[upto(N)](1,N,(LAMBDA (n: upto(N)): 
                              Rie_sec(a,b,g,P,xis,f,n)))

     Rie_sum_alt_lem: LEMMA a < b IMPLIES
                              FORALL (P: partition(a,b), (xis: xis?(a,b,P))):
                                 Rie_sum(a,b,g,P,xis,f) = Rie_sum_alt(a,b,g,P,xis,f) 

     Riemann_sum?(a:T,b:{x:T|a<x},P:partition(a,b),g,f:[T->real])(S:real): bool =
       (EXISTS (xis: xis?(a,b,P)): LET N = P`length-1 IN
             S = Rie_sum(a,b,g,P,xis,f))


     Riemann_sum_strictly_sort: LEMMA a<b IMPLIES FORALL (P:partition(a,b),RS:real):
     			       (EXISTS (xis:xis?(a,b,P)): RS = Rie_sum(a,b,g,P,xis,f))
  			       IFF
  			       (EXISTS (xis:xis?(a,b,strictly_sort(P))): RS = Rie_sum(a,b,g,strictly_sort(P),xis,f))


     integral?(a:T,b:{x:T|a<x},g,f:[T->real],S:real): bool  = 
                  (FORALL (epsi: posreal): (EXISTS (delta: posreal):
                      (FORALL (P: partition(a,b)):
                          width(a,b,P) < delta IMPLIES
                             (FORALL (R: (Riemann_sum?(a,b,P,g,f))):
                                  abs(S - R) < epsi))))

     x_in(aa:T,bb:{x:T|aa<=x}): {t:T | aa <= t AND t <= bb}

     pick_one(a:T,b:{x:T|a<x},P: partition(a,b))(ii: nat): T =
     			IF ii>= P`length-1 THEN default
                          ELSE x_in(P(ii), P(ii+1)) ENDIF

     gen_xis(a:T,b:{x:T|a<x},P: partition(a,b)): xis?(a,b,P) = 
                                       (# length := P`length - 1,
                                          seq :=  pick_one(a,b,P)
                                        #)

     Riemann?_Rie: LEMMA a < b IMPLIES FORALL (P: partition(a,b),
                                               xis: xis?(a,b,P)): 
                                 Riemann_sum?(a,b,P,g,f)(Rie_sum(a,b,g,P,xis,f)) 

  %   AUTO_REWRITE+ Riemann?_Rie

     A1, A2: VAR real
     integral_unique: LEMMA a < b AND integral?(a,b,g,f,A1) AND
                               integral?(a,b,g,f,A2) IMPLIES A1 = A2


     integrable?(a:T,b:{x:T|a<x},g,f:[T->real]): bool = 
                       (EXISTS (S:real): integral?(a,b,g,f,S))

     integral(a:T,b:{x:T|a<x}, gg:[T->real],ff: { f | integrable?(a,b,gg,f)} ):
                      {S:real | integral?(a,b,gg,ff,S)}


     s: VAR real
     integral_def: LEMMA a < b IMPLIES
                     ( (integrable?(a,b,g,f) AND integral(a,b,g,f) = s)
                            IFF integral?(a,b,g,f,s) )

     integral_restrict_eq: LEMMA a < b AND
                                  (FORALL x: a <= x AND x <= b IMPLIES
                                            f(x) = h(x)) AND
                                 integrable?(a,b,g,f)
                            IMPLIES integrable?(a,b,g,h) AND
                                     integral(a,b,g,h) = integral(a,b,g,f)

     Integrable?(a:T,b:T,g,f:[T->real]): bool = (a = b) OR
                                   (a < b AND integrable?(a,b,g,f)) OR
                                   (b < a  AND integrable?(b,a,g,f))

     Integrable_funs(a,b,g): TYPE = {f | Integrable?(a,b,g,f)}

     Integral?(a:T,b:T,g,f:[T->real],S:real): bool = (a = b AND S = 0) OR
                                 (a < b AND integral?(a,b,g,f,S))


     Integral(a:T,b:T,g:[T->real],f:Integrable_funs(a,b,g)): real =
                       			  IF a = b THEN 0
                       			  ELSIF a < b THEN integral(a,b,g,f)
                       			  ELSE -integral(b,a,g,f)
                       			  ENDIF
     % -----------------------------%

     %  Extending a riemann sum from a partition to a refinement and vice-versa

    Rie_sum_extend_union : LEMMA a<b IMPLIES
                                 FORALL (P,Q: partition(a,b)): LET PQ = partition_union(a,b)(P,Q) IN
  			       strictly_increasing?(P) IMPLIES FORALL (xis:xis?(a,b,P)): Rie_sum(a,b,g,P,xis,f) = 
  			       sigma[below(PQ`length-1)](0,PQ`length-2,LAMBDA (n:below(PQ`length-1)):
  			       				f(xis`seq(partition_union_map_inv(a,b,P,Q)(n)))*(g(PQ`seq(1+n))-g(PQ`seq(n))))

    Rie_sum_restrict_union: LEMMA a<b IMPLIES FORALL (P,Q: partition(a,b)): 
    			  LET
  				PQ = partition_union(a,b)(P,Q),
  				pum = partition_union_map(a,b,P,Q)
  			  IN    FORALL (xispq:xis?(a,b,PQ)):
  				strictly_increasing?(P) AND
  				(FORALL (ii:below(P`length),jj,kk:below(PQ`length)):
  				pum(ii)<=jj AND pum(ii)<=kk AND (ii<P`length-1 IMPLIES jj<pum(ii+1) AND kk<pum(ii+1))
  				IMPLIES xispq`seq(jj) = xispq`seq(kk))
  				IMPLIES
  				EXISTS (xis:xis?(a,b,P)):
  				Rie_sum(a,b,g,PQ,xispq,f) = Rie_sum(a,b,g,P,xis,f)

    Rie_sum_diff_extend_union : LEMMA a<b IMPLIES LET CI = closed_intv(a,b) IN
     				 (increasing?[(CI)](g) IMPLIES
                                 FORALL (P,Q: partition(a,b)): LET PQ = partition_union(a,b)(P,Q) IN
  			       FORALL (xispq:xis?(a,b,PQ),xis:xis?(a,b,P)): EXISTS (xis2:xis?(a,b,P)):
  			       abs(Rie_sum(a,b,g,P,xis,f) - Rie_sum(a,b,g,PQ,xispq,f)) <=
  			       abs(Rie_sum(a,b,g,P,xis,f)-Rie_sum(a,b,g,P,xis2,f)))

  			       


  END rs_integral_def

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 18, column 13) for  rs_partition[T]
      % generated from assumption rs_partition.connected_domain
  IMP_rs_partition_TCC1: OBLIGATION connected?[T];

  % Assuming TCC generated (at line 18, column 13) for  rs_partition[T]
      % generated from assumption rs_partition.not_one_element
  IMP_rs_partition_TCC2: OBLIGATION not_one_element?[T];

  % Subtype TCC generated (at line 36, column 12) for  c
      % expected type  b: {b | a < b}
  xis_join_TCC1: OBLIGATION
    FORALL (a: T, (b: T | a < b), (c: T | b < c)): a < c;

  % Subtype TCC generated (at line 37, column 5) for  xab o xbc
      % expected type  xis?(a, c, partjoin(a, b, c)(Pab, Pbc))
  xis_join_TCC2: OBLIGATION
    FORALL (a: T, (b: T | a < b), (c: T | b < c), Pab: partition[T](a, b),
            Pbc: partition[T](b, c), xab: xis?(a, b, Pab),
            xbc: xis?(b, c, Pbc)):
      ((o[T](xab, xbc))`length = partjoin[T](a, b, c)(Pab, Pbc)`length - 1
        AND
        (FORALL (ii: below(partjoin[T](a, b, c)(Pab, Pbc)`length - 1)):
           partjoin[T](a, b, c)(Pab, Pbc)`seq(ii) <= (o[T](xab, xbc))`seq(ii)
            AND
            (o[T](xab, xbc))`seq(ii) <=
             partjoin[T](a, b, c)(Pab, Pbc)`seq(1 + ii)));

  % Subtype TCC generated (at line 52, column 26) for  0
      % expected type  T_low[below(N)]
  Rie_sum_TCC1: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition[T](a, b),
            xis: xis?(a, b, P), N: int):
      N = P`length - 1 IMPLIES
       0 >= 0 AND 0 < N OR (EXISTS (j: below(N)): j <= 0);

  % Subtype TCC generated (at line 52, column 28) for  N - 1
      % expected type  T_high[below(N)]
  Rie_sum_TCC2: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition[T](a, b),
            xis: xis?(a, b, P), N: int):
      N = P`length - 1 IMPLIES
       N - 1 >= 0 AND N - 1 < N OR (EXISTS (j: below(N)): N - 1 <= j);

  % Assuming TCC generated (at line 41, column 5) for  reals@sigma[below(N)]
      % generated from assumption sigma.connected_domain
  Rie_sum_TCC3: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition[T](a, b),
            xis: xis?(a, b, P), N: int):
      N = P`length - 1 IMPLIES
       (FORALL (x, y: below(N)), (z: integer):
          x <= z AND z <= y IMPLIES z >= 0 AND z < N);

  % Subtype TCC generated (at line 56, column 19) for  P`length - 1
      % expected type  nat
  Rie_sec_TCC1: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition(a, b)): P`length - 1 >= 0;

  % Subtype TCC generated (at line 58, column 55) for  n - 1
      % expected type  nat
  Rie_sec_TCC2: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition[T](a, b),
            xis: xis?(a, b, P), n: upto(P`length - 1)):
      NOT n = 0 IMPLIES n - 1 >= 0;

  % Subtype TCC generated (at line 64, column 36) for  1
      % expected type  T_low[upto(N)]
  Rie_sum_alt_TCC1: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition[T](a, b),
            xis: xis?(a, b, P), N: int):
      N = P`length - 1 IMPLIES
       1 >= 0 AND 1 <= N OR (EXISTS (j: upto(N)): j <= 1);

  % Subtype TCC generated (at line 64, column 38) for  N
      % expected type  T_high[upto(N)]
  Rie_sum_alt_TCC2: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition[T](a, b),
            xis: xis?(a, b, P), N: int):
      N = P`length - 1 IMPLIES
       N >= 0 AND N <= N OR (EXISTS (j: upto(N)): N <= j);

  % Subtype TCC generated (at line 65, column 50) for  n
      % expected type  upto(P`length - 1)
  Rie_sum_alt_TCC3: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition[T](a, b),
            xis: xis?(a, b, P), N: int):
      N = P`length - 1 IMPLIES (FORALL (n: upto(N)): n <= P`length - 1);

  % Assuming TCC generated (at line 41, column 5) for  reals@sigma[upto(N)]
      % generated from assumption sigma.connected_domain
  Rie_sum_alt_TCC4: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition[T](a, b),
            xis: xis?(a, b, P), N: int):
      N = P`length - 1 IMPLIES
       (FORALL (x, y: upto(N)), (z: integer):
          x <= z AND z <= y IMPLIES z >= 0 AND z <= N);

  % Subtype TCC generated (at line 79, column 71) for  strictly_sort(P)
      % expected type  partition[T](a, b)
  Riemann_sum_strictly_sort_TCC1: OBLIGATION
    FORALL (a, b: T):
      a < b IMPLIES
       (FORALL (P: partition[T](a, b),
                xis:
                  xis?(a, b,
                       strictly_sort
                           [T, restrict[[real, real], [T, T], boolean](<=)]
                           (P))):
               strictly_sort[T, restrict[[real, real], [T, T], boolean](<=)]
                   (P)`length
                > 1
           AND strictly_sort[T, restrict[[real, real], [T, T], boolean](<=)]
                   (P)`seq
                   (0)
                = a
           AND strictly_sort[T, restrict[[real, real], [T, T], boolean](<=)]
                   (P)`seq
                   (strictly_sort
                        [T, restrict[[real, real], [T, T], boolean](<=)]
                        (P)`length
                     - 1)
                = b
           AND increasing?[T, restrict[[real, real], [T, T], boolean](<=)]
                   (strictly_sort
                        [T, restrict[[real, real], [T, T], boolean](<=)]
                        (P))
           AND FORALL (i:
                         below(strictly_sort
                                   [T,
                                    restrict[[real, real], [T, T], boolean]
                                        (<=)]
                                   (P)`length)):
                 a <=
                  strictly_sort
                      [T, restrict[[real, real], [T, T], boolean](<=)]
                      (P)`seq
                      (i)
                  AND
                  strictly_sort
                      [T, restrict[[real, real], [T, T], boolean](<=)]
                      (P)`seq
                      (i)
                   <= b);

  % Existence TCC generated (at line 89, column 3) for
      % x_in(aa: T, bb: {x: T | aa <= x}): {t: T | aa <= t AND t <= bb}
  x_in_TCC1: OBLIGATION
    EXISTS (x1:
              [d: [aa: T, {x: T | aa <= x}] ->
                 {t: T | d`1 <= t AND t <= d`2}]):
      TRUE;

  % Subtype TCC generated (at line 93, column 41) for  P`seq(ii + 1)
      % expected type  {x: T | P`seq(ii) <= x}
  pick_one_TCC1: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition[T](a, b), ii: nat):
      NOT ii >= P`length - 1 IMPLIES P`seq(ii) <= P`seq(ii + 1);

  % Subtype TCC generated (at line 97, column 48) for  pick_one(a, b, P)
      % expected type  barray[T](P`length - 1)
  gen_xis_TCC1: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition[T](a, b)):
      FORALL (i: nat):
        i >= P`length - 1 IMPLIES pick_one(a, b, P)(i) = default[T];

  % Subtype TCC generated (at line 96, column 37) for
      % (# length := P`length - 1, seq := pick_one(a, b, P) #)
      % expected type  xis?(a, b, P)
  gen_xis_TCC2: OBLIGATION
    FORALL (a: T, b: {x: T | a < x}, P: partition[T](a, b)):
      FORALL (ii: below(P`length - 1)):
        P`seq(ii) <= pick_one(a, b, P)(ii) AND
         pick_one(a, b, P)(ii) <= P`seq(1 + ii);

  % Existence TCC generated (at line 114, column 3) for
      % integral(a: T, b: {x: T | a < x}, gg: [T -> real],
      %          ff: {f | integrable?(a, b, gg, f)}):
      %       {S: real | integral?(a, b, gg, ff, S)}
  integral_TCC1: OBLIGATION
    EXISTS (x1:
              [d:
                 [a: T, b: {x: T | a < x}, gg: [T -> real],
                  {f | integrable?(a, b, gg, f)}] ->
                 {S: real | integral?(d`1, d`2, d`3, d`4, S)}]):
      TRUE;

  % Subtype TCC generated (at line 142, column 58) for  f
      % expected type  {f | integrable?(a, b, g, f)}
  Integral_TCC1: OBLIGATION
    FORALL (a, b: T, g: [T -> real], f: Integrable_funs(a, b, g)):
      a < b AND NOT a = b IMPLIES integrable?(a, b, g, f);

  % Subtype TCC generated (at line 143, column 43) for  a
      % expected type  {x: T | b < x}
  Integral_TCC2: OBLIGATION
    FORALL (a, b: T, g: [T -> real], f: Integrable_funs(a, b, g)):
      NOT a < b AND NOT a = b IMPLIES b < a;

  % Subtype TCC generated (at line 143, column 47) for  f
      % expected type  {f | integrable?(b, a, g, f)}
  Integral_TCC3: OBLIGATION
    FORALL (a, b: T, g: [T -> real], f: Integrable_funs(a, b, g)):
      NOT a < b AND NOT a = b IMPLIES integrable?(b, a, g, f);

  % Subtype TCC generated (at line 152, column 36) for  0
      % expected type  T_low[below(PQ`length - 1)]
  Rie_sum_extend_union_TCC1: OBLIGATION
    FORALL (a, b: T):
      a < b IMPLIES
       (FORALL (P, Q: partition[T](a, b),
                PQ:
                  {PQ: partition[T](a, b) |
                           (FORALL (x: T):
                              member[T](x, PQ) IFF
                               (member[T](x, P) OR member[T](x, Q)))
                            AND
                            strictly_increasing?
                                [T,
                                 restrict[[real, real], [T, T], boolean](<=)]
                                (PQ)}):
          strictly_increasing?(P) AND PQ = partition_union(a, b)(P, Q)
           IMPLIES
           (FORALL (xis: xis?(a, b, P)):
              0 >= 0 AND 0 < PQ`length - 1 OR
               (EXISTS (j: below(PQ`length - 1)): j <= 0)));

  % Subtype TCC generated (at line 152, column 38) for  PQ`length - 2
      % expected type  T_high[below(PQ`length - 1)]
  Rie_sum_extend_union_TCC2: OBLIGATION
    FORALL (a, b: T):
      a < b IMPLIES
       (FORALL (P, Q: partition[T](a, b),
                PQ:
                  {PQ: partition[T](a, b) |
                           (FORALL (x: T):
                              member[T](x, PQ) IFF
                               (member[T](x, P) OR member[T](x, Q)))
                            AND
                            strictly_increasing?
                                [T,
                                 restrict[[real, real], [T, T], boolean](<=)]
                                (PQ)}):
          strictly_increasing?(P) AND PQ = partition_union(a, b)(P, Q)
           IMPLIES
           (FORALL (xis: xis?(a, b, P)):
              PQ`length - 2 >= 0 AND PQ`length - 2 < PQ`length - 1 OR
               (EXISTS (j: below(PQ`length - 1)): PQ`length - 2 <= j)));

  % Subtype TCC generated (at line 153, column 57) for  n
      % expected type  below(partition_union(a, b)(P, Q)`length)
  Rie_sum_extend_union_TCC3: OBLIGATION
    FORALL (a, b: T):
      a < b IMPLIES
       (FORALL (P, Q: partition[T](a, b),
                PQ:
                  {PQ: partition[T](a, b) |
                           (FORALL (x: T):
                              member[T](x, PQ) IFF
                               (member[T](x, P) OR member[T](x, Q)))
                            AND
                            strictly_increasing?
                                [T,
                                 restrict[[real, real], [T, T], boolean](<=)]
                                (PQ)}):
          strictly_increasing?(P) AND PQ = partition_union(a, b)(P, Q)
           IMPLIES
           (FORALL (xis: xis?(a, b, P), n: below(PQ`length - 1)):
              n < partition_union[T](a, b)(P, Q)`length));

  % Subtype TCC generated (at line 162, column 66) for  ii + 1
      % expected type  below(P`length)
  Rie_sum_restrict_union_TCC1: OBLIGATION
    FORALL (a, b: T):
      a < b IMPLIES
       (FORALL (P, Q: partition[T](a, b),
                PQ:
                  {PQ: partition[T](a, b) |
                           (FORALL (x: T):
                              member[T](x, PQ) IFF
                               (member[T](x, P) OR member[T](x, Q)))
                            AND
                            strictly_increasing?
                                [T,
                                 restrict[[real, real], [T, T], boolean](<=)]
                                (PQ)}):
          PQ = partition_union(a, b)(P, Q) IMPLIES
           (FORALL (pum:
                      {pm:
                         [below(P`length) ->
                            below(partition_union[T](a, b)(P, Q)`length)] |
                               FORALL (ii: below(P`length)):
                                 P`seq(ii) =
                                  partition_union[T](a, b)(P, Q)`seq
                                      (pm(ii))}):
              pum = partition_union_map(a, b, P, Q) IMPLIES
               (FORALL (xispq: xis?(a, b, PQ)):
                  strictly_increasing?(P) IMPLIES
                   (FORALL (ii: below(P`length), jj, kk: below(PQ`length)):
                      ii < P`length - 1 AND pum(ii) <= kk AND pum(ii) <= jj
                       IMPLIES ii + 1 < P`length))));


body:
  rs_integral_prep[T:TYPE+ from real]: THEORY
  %------------------------------------------------------------------------------
  %  Basic Properties of the Riemann-Stieltjes Integral
  %------------------------------------------------------------------------------

  BEGIN

     ASSUMING
        IMPORTING deriv_domain_def[T]

        connected_domain : ASSUMPTION connected?[T]


        not_one_element : ASSUMPTION not_one_element?[T]

     ENDASSUMING


     IMPORTING rs_integral_def[T], reals@real_fun_ops[T]



     a,b,x,y,z: VAR T
     c,S: VAR real
     D,m,M,v1,v2,cc,RS1,RS2,K: VAR real
     delta : VAR posreal

     f,g,h,G: VAR [T -> real]

    %--------------------------------%

     integral_const_fun: LEMMA a < b IMPLIES integrable?(a,b,g,const_fun(D))
                                 AND integral(a,b,g, const_fun(D)) = D*(g(b)-g(a))

     integral_const_restrict: LEMMA a < b AND 
                 (FORALL (x: closed_interval(a,b)): f(x) = D) IMPLIES
                                    integral?(a,b,g,f,D*(g(b)-g(a)))
     

     IMPORTING continuous_functions, convergence_sequences



  %  ------------ Linearity Properties of Integral

     integral_scal: LEMMA a < b AND integrable?(a,b,g,f) IMPLIES
                              integrable?(a,b,g,D*f) AND
                                 integral(a,b,g,D*f) = D*integral(a,b,g,f)

     integral_scal_g: LEMMA a < b AND integrable?(a,b,g,f) IMPLIES
                              integrable?(a,b,D*g,f) AND
                                 integral(a,b,D*g,f) = D*integral(a,b,g,f)


     integral_sum: LEMMA a < b AND integrable?(a,b,g,f) AND integrable?(a,b,g,h) 
                        IMPLIES
                           integrable?(a,b,g,(LAMBDA x: f(x) + h(x)))  AND
                               integral(a,b,g,(LAMBDA x: f(x) + h(x))) =
                                    integral(a,b,g,f) + integral(a,b,g,h)

     integral_sum_g: LEMMA a < b AND integrable?(a,b,g,f) AND integrable?(a,b,h,f) 
                        IMPLIES
                           integrable?(a,b,(LAMBDA x: g(x) + h(x)),f)  AND
                               integral(a,b,(LAMBDA x: g(x) + h(x)),f) =
                                    integral(a,b,g,f) + integral(a,b,h,f)


     integral?_sum: LEMMA a < b AND integral?(a,b,g,f,v1) AND 
                                      integral?(a,b,g,h,v2) 
                        IMPLIES
                           integral?(a,b,g,(LAMBDA x: f(x) + h(x)),v1+v2)

     integral?_sum_g: LEMMA a < b AND integral?(a,b,g,f,v1) AND 
                                      integral?(a,b,h,f,v2) 
                        IMPLIES
                           integral?(a,b,(LAMBDA x:g(x)+h(x)),f,v1+v2)

     integral_diff: LEMMA a < b AND integrable?(a,b,g,f) AND integrable?(a,b,g,h) 
                        IMPLIES
                           integrable?(a,b,g,(LAMBDA x: f(x) - h(x)))  AND
                               integral(a,b,g,(LAMBDA x: f(x) - h(x))) =
                                    integral(a,b,g,f) - integral(a,b,g,h)

     integral_diff_g: LEMMA a < b AND integrable?(a,b,g,f) AND integrable?(a,b,h,f) 
                        IMPLIES
                           integrable?(a,b,(LAMBDA x:g(x)-h(x)),f)  AND
                               integral(a,b,(LAMBDA x:g(x)-h(x)),f) =
                                    integral(a,b,g,f) - integral(a,b,h,f)

     integral_ge_0: LEMMA a < b AND increasing?(g) AND
     		  	integrable?(a,b,g,f) AND 
                      	(FORALL (x: closed_interval(a,b)): f(x) >= 0) IMPLIES
                             integral(a,b,g,f) >= 0


     integral_restr_eq: LEMMA a < b AND          
                                  (FORALL x: a <= x AND x <= b IMPLIES
                                            f(x) = h(x)) AND
                                 integrable?(a,b,g,f)
                            IMPLIES integrable?(a,b,g,h) AND
                                     integral(a,b,g,h) = integral(a,b,g,f)

     integral_bound_above: LEMMA a < b AND increasing?(g) AND
     		   	   integrable?(a,b,g,f) AND 
                             (FORALL (x: closed_interval(a,b)):f(x)<=M)
             IMPLIES integral(a,b,g,f) <= M*(g(b)-g(a))

     integral_bound_below: LEMMA a < b AND increasing?(g) AND
     		   	   integrable?(a,b,g,f) AND
                             (FORALL (x: closed_interval(a,b)): m<=f(x))
             IMPLIES m*(g(b)-g(a)) <= integral(a,b,g,f)



     integral_le : LEMMA a < b AND increasing?(g) AND
     	       	       integrable?(a,b,g,f) AND integrable?(a,b,g,h)
                         AND (FORALL (x: closed_interval(a,b)): f(x) <= h(x))
                      IMPLIES
                         integral(a,b,g,f) <= integral(a,b,g,h)

     eps: VAR posreal

     Lemma_1: LEMMA a < b IMPLIES
                 (integrable?(a,b,g,f) IMPLIES
                    (FORALL eps: EXISTS delta:
                        (FORALL (P1,P2: partition(a,b),
                                 xis1:xis?(a,b,P1),
                                 xis2:xis?(a,b,P2)):
                          LET S1 = Rie_sum(a,b,g,P1,xis1,f),
                              S2 = Rie_sum(a,b,g,P2,xis2,f) IN
                          (width(a,b,P1) < delta AND
                           width(a,b,P2) < delta)
                             IMPLIES
                                abs(S1 - S2) < eps )))

     integrable_lem: THEOREM  a < b IMPLIES      
                       (integrable?(a,b,g,f) IFF
                          (FORALL (epsi: posreal): (EXISTS (delta: posreal):
                               (FORALL (P1,P2: partition(a,b)):
                                 width(a,b,P1) < delta AND
                                 width(a,b,P2) < delta IMPLIES
                                 (FORALL (RS1: (Riemann_sum?(a,b,P1,g,f)),
                                          RS2: (Riemann_sum?(a,b,P2,g,f))):
                                     abs(RS1 - RS2) < epsi )))))

     %-------------------------------------------------------------------------%

     integrable_lem2_alt: LEMMA a<b IMPLIES LET CI = closed_intv(a,b) IN
     		(monotonic?[(CI)](g) IMPLIES   % Added 8/2010 for RS integral
     		      (integrable?(a,b,g,f) IFF
                          (FORALL (epsi: posreal): (EXISTS (delta: posreal):
                               (FORALL (P: partition(a,b)):
                                 width(a,b,P) < delta IMPLIES
                                 (FORALL (RS1: (Riemann_sum?(a,b,P,g,f)),
                                          RS2: (Riemann_sum?(a,b,P,g,f))):
                                     abs(RS1 - RS2) < epsi ))))))

     integrable_lem2: LEMMA a<b IMPLIES LET CI = closed_intv(a,b) IN
     		(monotonic?[(CI)](g) IMPLIES   % Added 8/2010 for RS integral
     		      (integrable?(a,b,g,f) IFF
                          (FORALL (epsi: posreal): (EXISTS (delta: posreal):
                               (FORALL (P: partition(a,b)):
                                 width(a,b,P) < delta IMPLIES
                                 (FORALL (RS1: (Riemann_sum?(a,b,P,g,f)),
                                          RS2: (Riemann_sum?(a,b,P,g,f))):
                                     abs(RS1 - RS2) < epsi ))))))





  END rs_integral_prep

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 19, column 13) for  rs_integral_def[T]
      % generated from assumption rs_integral_def.connected_domain
  IMP_rs_integral_def_TCC1: OBLIGATION connected?[T];

  % Assuming TCC generated (at line 19, column 13) for  rs_integral_def[T]
      % generated from assumption rs_integral_def.not_one_element
  IMP_rs_integral_def_TCC2: OBLIGATION not_one_element?[T];


body:
  bounded_variation[T:TYPE+ from real]: THEORY
  %------------------------------------------------------------------------------
  %  Functions of Bounded Variation on an interval [a,b]
  %------------------------------------------------------------------------------

  BEGIN

     ASSUMING
        IMPORTING deriv_domain_def[T]

        connected_domain : ASSUMPTION connected?[T]


        not_one_element : ASSUMPTION not_one_element?[T]

     ENDASSUMING

     IMPORTING rs_partition[T], reals@real_fun_preds

     a,b,c,d,x,y,z: VAR T

     D,m,M,v1,v2,cc,RS1,RS2,K: VAR real
     delta : VAR posreal

     f,g,h,G: VAR [T -> real]

     % The variation of a function on a partition = Sum( |f(x_{k+1}) - f(x_k)| )

     variation_on(a,(b | a<b),P:partition(a,b))(f) : nnreal =
        sigma[below(P`length-1)](0,P`length-2,LAMBDA (n:below(P`length-1)):
        						 abs(f(P`seq(n+1))-f(P`seq(n))))

     variation_on_strictly_sort: LEMMA a<b IMPLIES FORALL (P:partition(a,b)):
     			       variation_on(a,b,P) = variation_on(a,b,strictly_sort(P))

     bounded_variation?(a,(b | a<b))(f): bool = (EXISTS (M: nnreal): 
                     (FORALL (P:partition(a,b)): variation_on(a,b,P)(f) <= M))

     monotonic_BV: LEMMA FORALL (bb:T | a<bb): monotonic?[(closed_intv(a,bb))](f) IMPLIES bounded_variation?(a,bb)(f)

     BV_bounded: LEMMA a<b AND bounded_variation?(a,b)(f) IMPLIES bounded_on?(a,b,f)

     BV_bound: LEMMA a<b AND (FORALL (P:partition(a,b)): variation_on(a,b,P)(f) <= M) IMPLIES
     	     (FORALL (x:(closed_intv(a,b))): abs(f(x)) <= abs(f(a))+M)

     BV_add: LEMMA a<b AND bounded_variation?(a,b)(f) AND bounded_variation?(a,b)(g) 
     	   IMPLIES bounded_variation?(a,b)((LAMBDA (x:T): f(x)+g(x)))

     BV_scal: LEMMA a<b and bounded_variation?(a,b)(f) IMPLIES bounded_variation?(a,b)(LAMBDA (x:T): D*f(x))

     BV_sub: LEMMA a<b AND bounded_variation?(a,b)(f) AND bounded_variation?(a,b)(g)
     	   IMPLIES bounded_variation?(a,b)((LAMBDA (x:T): f(x)-g(x)))

     BV_mult: LEMMA a<b AND bounded_variation?(a,b)(f) AND bounded_variation?(a,b)(g)
     	   IMPLIES bounded_variation?(a,b)(LAMBDA (x:T): f(x)*g(x))

     %----------------%

     variation_on_subset: LEMMA a<=c AND c<d AND d<=b IMPLIES FORALL (Pcd:partition(c,d)):
     			EXISTS (Pab:partition(a,b)):
  			variation_on(c,d,Pcd)(f) <= variation_on(a,b,Pab)(f)

     BV_subset: LEMMA a<=c AND c<d AND d<=b AND bounded_variation?(a,b)(f) IMPLIES bounded_variation?(c,d)(f)

     % ----- The total variation of a function over a subinterval [a,x] of [a,b] ------ %

     total_variation(a,(b|a<b),f:(bounded_variation?(a,b)))(x : (closed_intv(a,b))) : {M : nnreal |
     				(x = a IMPLIES M = 0) AND
  				(x>a IMPLIES FORALL (P:partition(a,x)): variation_on(a,x,P)(f)<=M) AND
  				(FORALL (M1: nnreal): M1 < M IMPLIES EXISTS (P:partition(a,x)):
  					variation_on(a,x,P)(f) > M1)}

     % The total variation can be approximated

     total_variation_approx: LEMMA a<b AND bounded_variation?(a,b)(f) IMPLIES FORALL (x:(closed_intv(a,b))):
           a /= x IMPLIES FORALL (epsi:posreal): EXISTS (P:partition(a,x)):
           variation_on(a,x,P)(f) > total_variation(a,b,f)(x)-epsi
     			   

     BV_decomposition: LEMMA a<b IMPLIES (bounded_variation?(a,b)(f) IFF
     		     LET CI = closed_intv(a,b) IN
     		     EXISTS (g,h): f = (LAMBDA (x:T): g(x)-h(x)) AND
  		     increasing?[(CI)](g) AND increasing?[(CI)](h))

  END bounded_variation

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 18, column 13) for  rs_partition[T]
      % generated from assumption rs_partition.connected_domain
  IMP_rs_partition_TCC1: OBLIGATION connected?[T];

  % Assuming TCC generated (at line 18, column 13) for  rs_partition[T]
      % generated from assumption rs_partition.not_one_element
  IMP_rs_partition_TCC2: OBLIGATION not_one_element?[T];

  % Subtype TCC generated (at line 30, column 31) for  0
      % expected type  T_low[below(P`length - 1)]
  variation_on_TCC1: OBLIGATION
    FORALL (a: T, (b: T | a < b), P: partition[T](a, b)):
      0 >= 0 AND 0 < P`length - 1 OR
       (EXISTS (j: below(P`length - 1)): j <= 0);

  % Subtype TCC generated (at line 30, column 33) for  P`length - 2
      % expected type  T_high[below(P`length - 1)]
  variation_on_TCC2: OBLIGATION
    FORALL (a: T, (b: T | a < b), P: partition[T](a, b)):
      P`length - 2 >= 0 AND P`length - 2 < P`length - 1 OR
       (EXISTS (j: below(P`length - 1)): P`length - 2 <= j);

  % Assuming TCC generated (at line 41, column 5) for
      % reals@sigma[below(P`length - 1)]
      % generated from assumption sigma.connected_domain
  variation_on_TCC3: OBLIGATION
    FORALL (a: T, (b: T | a < b), P: partition[T](a, b)):
      FORALL (x, y: below(P`length - 1)), (z: integer):
        x <= z AND z <= y IMPLIES z >= 0 AND z < P`length - 1;

  % Subtype TCC generated (at line 34, column 52) for  strictly_sort(P)
      % expected type  partition[T](a, b)
  variation_on_strictly_sort_TCC1: OBLIGATION
    FORALL (a, b: T):
      a < b IMPLIES
       (FORALL (P: partition[T](a, b)):
               strictly_sort[T, restrict[[real, real], [T, T], boolean](<=)]
                   (P)`length
                > 1
           AND strictly_sort[T, restrict[[real, real], [T, T], boolean](<=)]
                   (P)`seq
                   (0)
                = a
           AND strictly_sort[T, restrict[[real, real], [T, T], boolean](<=)]
                   (P)`seq
                   (strictly_sort
                        [T, restrict[[real, real], [T, T], boolean](<=)]
                        (P)`length
                     - 1)
                = b
           AND increasing?[T, restrict[[real, real], [T, T], boolean](<=)]
                   (strictly_sort
                        [T, restrict[[real, real], [T, T], boolean](<=)]
                        (P))
           AND FORALL (i:
                         below(strictly_sort
                                   [T,
                                    restrict[[real, real], [T, T], boolean]
                                        (<=)]
                                   (P)`length)):
                 a <=
                  strictly_sort
                      [T, restrict[[real, real], [T, T], boolean](<=)]
                      (P)`seq
                      (i)
                  AND
                  strictly_sort
                      [T, restrict[[real, real], [T, T], boolean](<=)]
                      (P)`seq
                      (i)
                   <= b);

  % Subtype TCC generated (at line 39, column 71) for  bb
      % expected type  {x: T | a <= x}
  monotonic_BV_TCC1: OBLIGATION FORALL (a: T, bb: T | a < bb): a <= bb;

  % Subtype TCC generated (at line 61, column 46) for  b
      % expected type  {b | a < b}
  variation_on_subset_TCC1: OBLIGATION
    FORALL (a, b, c, d: T):
      d <= b AND c < d AND a <= c IMPLIES
       (FORALL (Pcd: partition[T](c, d), Pab: partition[T](a, b)): a < b);

  % Subtype TCC generated (at line 63, column 67) for  b
      % expected type  {b | a < b}
  BV_subset_TCC1: OBLIGATION
    FORALL (a, b, c, d: T): a <= c AND c < d AND d <= b IMPLIES a < b;

  % Subtype TCC generated (at line 69, column 59) for  x
      % expected type  {b | a < b}
  total_variation_TCC1: OBLIGATION
    FORALL (a, (b: T | a < b), x: (LAMBDA (x: T): a <= x AND x <= b),
            M: nnreal):
      x > a AND (x = a IMPLIES M = 0) IMPLIES
       (FORALL (P: partition[T](a, x)): a < x);

  % Subtype TCC generated (at line 71, column 20) for  x
      % expected type  {b | a < b}
  total_variation_TCC2: OBLIGATION
    FORALL (a, (b: T | a < b), f: (bounded_variation?(a, b)),
            x: (LAMBDA (x: T): a <= x AND x <= b), M: nnreal):
      (x > a IMPLIES
        (FORALL (P: partition(a, x)): variation_on(a, x, P)(f) <= M))
       AND (x = a IMPLIES M = 0)
       IMPLIES
       (FORALL (M1: nnreal):
          M1 < M IMPLIES (FORALL (P1: partition[T](a, x)): a < x));

  % Existence TCC generated (at line 67, column 3) for
      % total_variation(a, (b: T | a < b), f: (bounded_variation?(a, b)))
      %                (x: (LAMBDA (x: T): a <= x AND x <= b)):
      %       {M: nnreal |
      %                (x = a IMPLIES M = 0) AND
      %                 (x > a IMPLIES
      %                   (FORALL (P: partition(a, x)):
      %                      variation_on(a, x, P)(f) <= M))
      %                  AND
      %                  (FORALL (M1: nnreal):
      %                     M1 < M IMPLIES
      %                      (EXISTS (P: partition(a, x)):
      %                         variation_on(a, x, P)(f) > M1))}
  total_variation_TCC3: OBLIGATION
    EXISTS (x1:
              [d: [a: T, b: {b | a < b}, (bounded_variation?(a, b))] ->
                 [x: (LAMBDA (x: T): d`1 <= x AND x <= d`2) ->
                    {M: nnreal |
                             (x = d`1 IMPLIES M = 0) AND
                              (x > d`1 IMPLIES
                                (FORALL (P: partition[T](d`1, x)):
                                   variation_on(d`1, x, P)(d`3) <= M))
                               AND
                               (FORALL (M1: nnreal):
                                  M1 < M IMPLIES
                                   (EXISTS (P: partition[T](d`1, x)):
                                      variation_on(d`1, x, P)(d`3)
                                      >
                                      M1))}]]):
      TRUE;

  % Subtype TCC generated (at line 77, column 24) for  x
      % expected type  {b | a < b}
  total_variation_approx_TCC1: OBLIGATION
    FORALL (a, b: T, f: [T -> real]):
      bounded_variation?(a, b)(f) AND a < b IMPLIES
       (FORALL (x: (LAMBDA (x: T): a <= x AND x <= b)):
          a /= x IMPLIES (FORALL (P: partition[T](a, x)): a < x));


body:
  prelude_sets_aux[T:TYPE]: THEORY
  BEGIN

    x: VAR T
    A: VAR setofsets[T]
    a,b: VAR set[T]
    F: VAR finite_set[set[T]]
    P: VAR [set[T]->bool]

    complement_difference: LEMMA
      complement(difference(a,b)) = union(complement(a),b)

    Intersection_member:
               LEMMA member(x,Intersection(A)) IFF (FORALL (a:(A)): member(x,a))

    Intersection_split: LEMMA nonempty?(A) IMPLIES
               (Intersection(A) = intersection(choose(A),Intersection(rest(A))))

    Intersection_finite: LEMMA
          P(fullset[T]) AND is_finite(A) AND (FORALL (a:(A)): P(a)) AND
          (FORALL (a,b:set[T]): P(a) AND P(b) IMPLIES P(intersection(a,b)))
                                  IMPLIES P(Intersection(A))

    Union_member: LEMMA member(x,Union(A)) IFF (EXISTS (a:(A)): member(x,a)) 

    Union_split: LEMMA nonempty?(A) IMPLIES
               (Union(A) = union(choose(A),Union(rest(A))))

    Union_finite: LEMMA
          P(emptyset[T]) AND is_finite(A) AND (FORALL (a:(A)): P(a)) AND
          (FORALL (a,b:set[T]): P(a) AND P(b) IMPLIES P(union(a,b)))
                                  IMPLIES P(Union(A))

    finite_Complement: LEMMA is_finite(Complement(F))


  %------------------------------------------------------------------------
  %  A Transition From An Epsilon Delta Property To The Existence
  %  Of A Particular (Helpful Sequence). This May Be Helpful In Proving
  %  Certain Properties Related To Continuity And/Or Metric Space.
  %
  %      Anthony Narkawicz
  % 
  %------------------------------------------------------------------------

    S: VAR set[T]
    f: VAR [T -> posreal]

    epsilon_to_sequence: LEMMA 
       (FORALL (epsilon: posreal): EXISTS (s: (S)):
           f(s) < epsilon)IMPLIES
              (EXISTS (seq: [posint -> (S)]): FORALL (n: posint): f(seq(n)) < 1/n)


  END prelude_sets_aux


body:
  finite_sets_aux[T: TYPE+]: THEORY
  BEGIN
   
     N: VAR nat

     is_finite_exists_N: LEMMA FORALL (g: [below[N] -> T]):
              is_finite({r: T | EXISTS (n: below[N]): r = g(n)})
                           
  END finite_sets_aux


body:
  metric_spaces_def[T:TYPE+,d:[T,T->nnreal]]: THEORY
  BEGIN

    S:     VAR set[T]

    space_zero?(S)     :bool = FORALL (x,y:(S)):   d(x,y)  = 0 IFF x = y
    space_symmetric?(S):bool = FORALL (x,y:(S)):   d(x,y)  = d(y,x)
    space_triangle?(S) :bool = FORALL (x,y,z:(S)): d(x,z) <= d(x,y) + d(y,z)

    metric_space?(S):bool
      = space_zero?(S) AND space_symmetric?(S) AND space_triangle?(S)

  END metric_spaces_def


body:
  %------------------------------------------------------------------------------
  % Metric spaces definition file
  %
  %     Authors: David Lester, Manchester University & NIA
  %              Anthony Narkawicz,  NASA Langley
  %              Ricky Butler,       NASA Langley
  %
  %     Version 1.0            5/12/04  Initial Version
  %     Version 1.1            8/18/09
  %------------------------------------------------------------------------------

  metric_spaces[T:TYPE+,d:[T,T->nnreal]]: THEORY
  BEGIN

    ASSUMING IMPORTING metric_spaces_def[T,d]

  %     metric_zero     : ASSUMPTION FORALL (x,y: T):   d(x,y)  = 0 IFF x = y
  %     metric_symmetric: ASSUMPTION FORALL (x,y: T):   d(x,y)  = d(y,x)
  %     metric_triangle : ASSUMPTION FORALL (x,y,z: T): d(x,z) <= d(x,y) + d(y,z)

        fullset_metric_space: ASSUMPTION metric_space?[T,d](fullset[T])

    ENDASSUMING

    IMPORTING prelude_sets_aux

    AUTO_REWRITE+  member
    AUTO_REWRITE+  complement_complement
    AUTO_REWRITE+  Complement_Complement

    metric_space: TYPE+ = set[T]      

    r:     VAR posreal
    x,y,z: VAR T
    S,U:     VAR set[T]

    ball(x,r): set[T]          = {y | d(x,y) < r}

    interior_point?(x,S): bool = EXISTS r: subset?(ball(x,r),S)

    interior(S): set[T]        = {x:T | interior_point?(x,S) and S(x)}

    open?(S): bool             = interior(S) = S

    open_in?(S,U): bool	     = (FORALL (s: (S)): EXISTS r: subset?(intersection(ball(s,r),U),S)) 
                                 AND subset?(S,U)

    closed_in?(S,U): bool	     = open_in?(intersection(complement(S),U),U) AND subset?(S,U)

    closed?(S): bool           = open?(complement(S))

    adherent_point?(x,S): bool = FORALL r: nonempty?(intersection(S,ball(x,r)))

    limit_point?(S)(x): bool    = adherent_point?(x,S) AND NOT member(x,S)

    metric_closure(S): set[T]  = {x:T | adherent_point?(x,S)}

   
    open_set:     TYPE  = (open?)
    closed_set:   TYPE  = (closed?)

    open_set_is_set:   JUDGEMENT open_set   SUBTYPE_OF set[T]
    closed_set_is_set: JUDGEMENT closed_set SUBTYPE_OF set[T]

    X:   VAR metric_space
    A,B: VAR set[T]

    % Mundane properties of open and closed sets


    open_emptyset:     LEMMA open?(emptyset)
    closed_emptyset:   LEMMA closed?(emptyset)
    complement_open:   LEMMA open?(A)   IFF closed?(complement(A))
    complement_closed: LEMMA closed?(A) IFF open?(complement(A))
    open_fullset:      LEMMA open?(fullset)
    closed_fullset:    LEMMA closed?(fullset)
    open_in_fullset:   LEMMA open?(A) IFF open_in?(A,fullset[T])
    closed_in_fullset: LEMMA closed?(A) IFF closed_in?(A,fullset[T])

    ball_open:         LEMMA open?(ball(x, r))

    Complement_open:   LEMMA FORALL (XS:set[open_set]):
                                                  every(closed?)(Complement(XS))
    Complement_closed: LEMMA FORALL (XS:set[closed_set]):
                                                  every(open?)(Complement(XS))

    subset_is_metric_space: LEMMA subset?(S,X) IMPLIES metric_space?(S)

    % Apostol 3.35a (1) (equivalent to Apostol 3.7 (generalized))
    % The union of any _collection_ of open sets is open

    open_Union_open: THEOREM FORALL (XS:set[open_set]): open?(Union(XS))

    % Apostol 3.35a (2) (equivalent to Apostol 3.8 (generalized))
    % The intersection of any _finite_set_ of open sets is open

    open_Intersection_open: THEOREM 
                 FORALL (FS:finite_set[open_set]): open?(Intersection(FS))

    % Apostol 3.35b (1) (equivalent to Apostol 3.7 (generalized))
    % The union of any _finite_set_ of closed sets is closed

    closed_Union_closed: THEOREM
                 FORALL (FS:finite_set[closed_set]): closed?(Union(FS))

    % Apostol 3.35b (2) (equivalent to Apostol 3.8 (generalized))
    % The union of any _collection_ of closed sets is closed

    closed_Intersection_closed: THEOREM 
                 FORALL (XS:set[closed_set]): closed?(Intersection(XS))

    % Apostol 3.36a

    open_closed_difference: LEMMA FORALL (A:open_set,B:closed_set):
                                                         open?(difference(A,B))
    % Apostol 3.36b

    closed_open_difference: LEMMA FORALL (A:open_set,B:closed_set):
                                                         closed?(difference(B,A))


    % Apostol Theorem 3.33

    open_def: THEOREM subset?(S,X) AND subset?(A,S) IMPLIES
                    (open?(A) IFF (EXISTS B: subset?(B,S) AND open?(B) AND A = intersection(B,S)))


    END metric_spaces


body:
  compactness[T:TYPE+,d:[T,T->nnreal]]: THEORY
  %------------------------------------------------------------------------------
  % Compactness
  %
  %     Authors: Anthony Narkawicz,  NASA Langley
  %              Ricky Butler,       NASA Langley
  %
  %     Version 1.0         8/25/2009  Initial Version
  %
  %  Compactness proofs can be detailed and tricky.  It is highly recommended that
  %  users of this library exploit the IdxCover mechanism developed here
  %
  %       Given a set H = { (a,r) } where a = center of a ball and
  %                                       r = radius of a ball
  %       for which
  %             
  %            ball_covering(H) = { balls(a,r) | H(a,r) }
  %
  %       idxCover returns
  %             N:  size of a finite covering
  %             seq: below[N] -> (H)
  %
  %       which provides a finite sub-cover, i.e.
  %
  %           open_cover?(ball_covering({h: [T,posreal] | H(h) 
  %                       AND (EXISTS (n: below[N]): h = seq(n))}),S)
  %            
  %------------------------------------------------------------------------------
  BEGIN

     ASSUMING IMPORTING metric_spaces_def[T,d]
         fullset_metric_space: ASSUMPTION metric_space?[T,d](fullset[T])
     ENDASSUMING

    CONVERSION+ singleton

    S,W:     VAR set[T]
    r:     VAR posreal
    x,y,z: VAR T


    IMPORTING metric_spaces[T,d]

    XS,YS: VAR set[set[T]]

    open_cover?(XS,S): bool = subset?(S,Union(XS)) AND
                              (FORALL (C: set[T]): XS(C) IMPLIES open?(C))
       

    finite_cover?(XS,S): bool  = is_finite(XS) AND open_cover?(XS,S)

    compact?(S): bool          = FORALL XS: open_cover?(XS,S) IMPLIES
                                 EXISTS YS: subset?(YS,XS) & finite_cover?(YS,S)

    bounded?(S): bool          = EXISTS r: FORALL x,y: S(x) AND S(y) IMPLIES ball(x,r)(y)

    precompact?(S): bool       = FORALL r: EXISTS (X:set[T]):
                                 finite_cover?({z:set[T] | EXISTS (x:(X)): ball(x,r) = z},S)

    nBalls(p:T): set[(open?)] = {s: set[T] | EXISTS (n: posnat): s = ball(p,n)}

    p: VAR T
    nBalls_open_cover: LEMMA open_cover?(nBalls(p),S)

   

    % Helpful Property Of Compact Sets

    H: VAR set[[T,posreal]]

    ball_covering(H): set[set[T]] = {s: set[T] | EXISTS (h: (H)): s = ball(h`1,h`2)}

    %exists_sequence: LEMMA

    reverse_ball(H: set[[T,posreal]],A: {s: (nonempty?[T]) | ball_covering(H)(s)}): 
        {h: (H) | ball(h`1,h`2)  = A}

    set_compact: LEMMA 
       (compact?(S) AND open_cover?(ball_covering(H),S)) 
       IMPLIES (EXISTS (N: nat, seq: [below[N] -> (H)]): 
    	 open_cover?(ball_covering({h: [T,posreal] | H(h) AND 
                                              (EXISTS (n: below[N]): h = seq(n))}),S))



  % ----- Here is a mechanism to explicitly contruct a indexed finite subcover of any ---------------------
  % ----- ball covering of a compact set

    Htype(S): TYPE = {H: set[[T,posreal]] | compact?(S) AND open_cover?(ball_covering(H),S)}

    idxCover(S: (compact?), H: Htype(S)): 
        {pair: [N: nat,seq: [below[N]->(H)]] | 
    	 open_cover?(ball_covering({h: [T,posreal] | H(h)
                   AND (EXISTS (n: below[pair`1]): h = pair`2(n))}),S)} 
         = choose({ pair: [N: nat,seq: [below[N]->(H)]] | 
                open_cover?(ball_covering({h: [T,posreal] | H(h) 
                   AND (EXISTS (n: below[pair`1]): h = pair`2(n))}),S)})

    idxCover_def: LEMMA
        compact?(S) AND open_cover?(ball_covering(H),S) AND
        S(x) IMPLIES
              LET (N,seq) = idxCover(S,H) IN
                (EXISTS (n: below[N]): LET (a,r) = seq(n) IN
                     ball(a,r)(x) AND ball_covering(H)(ball(a,r)))


    set_compact_alt: LEMMA 
        compact?(S) AND open_cover?(ball_covering(H),S)
        IMPLIES LET (N,seq) = idxCover(S,H) IN
           open_cover?(ball_covering({h: [T,posreal] | H(h) AND (EXISTS (n: below[N]): h = seq(n))}),S)

    N: var posint
    M:   var nat

    IMPORTING finite_sets@finite_sets_minmax[nat,<=]

    max_min_finite_scaf: LEMMA
        FORALL (P: [nat,below(N) -> bool]): (FORALL (n: below(N)): 
           EXISTS (M: nat): FORALL (m: above(M)): 
               P(m,n)) IMPLIES (EXISTS (TOTAL_M: nat): FORALL (m:above(TOTAL_M),n: below(N)): P(m,n))

    compact_sequence_limit: LEMMA 
       (nonempty?(S) AND compact?(S)) 
        IMPLIES (FORALL (seq: [nat -> (S)]): EXISTS (p: (S)): 
            FORALL (epsilon: posreal, N: posint): EXISTS (n: above(N)): d(seq(n),p) < epsilon)

    % Apostle Theorem 3.38 
  %%  compact_closed : LEMMA compact?(S) IMPLIES closed?(S) 
  %%  compact_bounded: LEMMA compact?(S) IMPLIES bounded?(S) 

    compact_open_increasing_seq: LEMMA compact?(S) IMPLIES (FORALL (seq: [nat -> (open?)]): (FORALL (j: nat):
      subset?(seq(j),seq(j+1))) AND open_cover?({AZ: set[T] | EXISTS (k: nat): AZ = seq(k)},S) IMPLIES
      EXISTS (i: nat): subset?(S,seq(i)))

    closed_subset_of_compact: LEMMA compact?(S) AND subset?(W,S) AND closed?(W) IMPLIES compact?(W)

    compact_closed: LEMMA compact?(S) IMPLIES closed?(S)

    compact_bounded: LEMMA compact?(S) IMPLIES bounded?(S) % Added 09/2010



  END compactness

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 42, column 12) for  metric_spaces[T, d]
      % generated from assumption metric_spaces.fullset_metric_space
  IMP_metric_spaces_TCC1: OBLIGATION metric_space?[T, d](fullset[T]);

  % Existence TCC generated (at line 75, column 2) for
      % reverse_ball(H: set[[T, posreal]],
      %              A: {s: (nonempty?[T]) | ball_covering(H)(s)}):
      %       {h: (H) | ball(h`1, h`2) = A}
  reverse_ball_TCC1: OBLIGATION
    EXISTS (x:
              [d:
                 [H: set[[T, posreal]],
                  {s: (nonempty?[T]) | ball_covering(H)(s)}] ->
                 {h: (d`1) | ball[T, d](h`1, h`2) = d`2}]):
      TRUE;

  % Subtype TCC generated (at line 95, column 16) for
      % {pair: [N: nat, seq: [below[N] -> (H)]] |
      %    open_cover?(ball_covering({h: [T, posreal]
      %                               |
      %                               H(h)
      %                               AND
      %                               (EXISTS
      %                                (n: below[pair`1]):
      %                                h = pair`2(n))}),
      %                S)}
      % expected type  p: (nonempty?[[N: nat, seq: [below[N] -> (H)]]])
  idxCover_TCC1: OBLIGATION
    FORALL (S: (compact?), H: Htype(S)):
      nonempty?[[N: nat, seq: [below[N] -> (H)]]]
          ({pair: [N: nat, seq: [below[N] -> (H)]] |
              open_cover?(ball_covering({h: [T, posreal]
                                         |
                                         H(h)
                                         AND
                                         (EXISTS
                                          (n: below[pair`1]):
                                          h = pair`2(n))}),
                          S)});


body:
  %------------------------------------------------------------------------------
  % Continuity definition file
  %
  %     Author: David Lester, Manchester University & NIA
  %             Rick Butler,  NASA Langley
  %
  %     Version 1.0            5/12/04  Initial Version
  %------------------------------------------------------------------------------

  continuity_ms_def[T1:Type+,d1:[T1,T1->nnreal],
                    T2:Type+,d2:[T2,T2->nnreal]]: THEORY

  BEGIN

      ASSUMING IMPORTING metric_spaces_def

          fullset_metric_space1: ASSUMPTION metric_space?[T1,d1](fullset[T1])
          fullset_metric_space2: ASSUMPTION metric_space?[T2,d2](fullset[T2])

      ENDASSUMING

    IMPORTING metric_spaces

    E:              VAR set[T1]
    epsilon, delta: VAR posreal

    continuous_at?(f:[T1->T2], E: set[T1],x: (E)):bool
      = FORALL epsilon: EXISTS delta: FORALL (y:(E)):
              member(y, ball[T1,d1](x,delta)) IMPLIES
                                 member(f(y), ball[T2,d2](f(x),epsilon))

    continuous_at?(f:[T1->T2],x:T1):bool = continuous_at?(f,fullset[T1],x)

    continuous?(f:[T1->T2], E: set[T1]): bool =
          FORALL (x:(E)): continuous_at?(f,E,x)

    continuous?(f:[T1->T2]): bool = continuous?(f,fullset[T1])

  END continuity_ms_def

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 21, column 6) for  metric_spaces[T1, d1]
      % generated from assumption metric_spaces.fullset_metric_space
  continuous_at?_TCC1: OBLIGATION
    FORALL (E: set[T1], x: (E), y: (E)): metric_space?[T1, d1](fullset[T1]);

  % Assuming TCC generated (at line 21, column 6) for  metric_spaces[T2, d2]
      % generated from assumption metric_spaces.fullset_metric_space
  continuous_at?_TCC2: OBLIGATION
    FORALL (E: set[T1], x: (E), delta, y: (E)):
      member(y, ball[T1, d1](x, delta)) IMPLIES
       metric_space?[T2, d2](fullset[T2]);

  % Subtype TCC generated (at line 32, column 70) for  x
      % expected type  (fullset[T1])
  continuous_at?_TCC3: OBLIGATION FORALL (x: T1): fullset[T1](x);


body:
  %------------------------------------------------------------------------------
  % Continuity over Metric Spaces
  %
  %     Author: David Lester, Manchester University & NIA
  %              Anthony Narkawicz,  NASA Langley
  %              Ricky Butler,       NASA Langley
  %
  %
  %     Version 1.0            5/12/04  Initial Version
  %------------------------------------------------------------------------------

  continuity_ms[T1:Type+,d1:[T1,T1->nnreal],
             T2:Type+,d2:[T2,T2->nnreal]]: THEORY

  BEGIN
      ASSUMING IMPORTING metric_spaces

          fullset_metric_space1: ASSUMPTION metric_space?[T1,d1](fullset[T1])
          fullset_metric_space2: ASSUMPTION metric_space?[T2,d2](fullset[T2])

      ENDASSUMING

    IMPORTING continuity_ms_def[T1,d1,T2,d2], compactness[T1,d1]

    X,S: VAR set[T1]
    Y,T: VAR set[T2]

    % Theorem 4.22a

    image_inverse_image: THEOREM FORALL (f:[(S)->(T)]): 
              subset?(X,S) AND subset?(Y,T) AND
                             X = inverse_image(f,Y) IMPLIES subset?(image(f,X),Y)

    % Theorem 4.22b

    inverse_image_image: THEOREM FORALL (f:[(S)->(T)]): 
            subset?(X,S) AND subset?(Y,T) AND
                             Y = image(f,X) IMPLIES subset?(X,inverse_image(f,Y))

    % Theorem 4.23

    continuous_open_sets: THEOREM FORALL (f:[T1->T2]):
      continuous?(f,(S)) IFF
      (Forall Y: open?[T2,d2](Y) IMPLIES open_in?[T1,d1](intersection(inverse_image(f,Y),S),S))

    % Theorem 4.24

    continuous_closed_sets: THEOREM FORALL (f:[T1->T2]):
      continuous?(f,(S)) IFF
      (FORALL Y: closed?[T2,d2](Y) IMPLIES closed_in?[T1,d1](intersection(inverse_image(f,Y),S),S))


  END continuity_ms

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 23, column 12) for
      % continuity_ms_def[T1, d1, T2, d2]
      % generated from assumption continuity_ms_def.fullset_metric_space1
  IMP_continuity_ms_def_TCC1: OBLIGATION metric_space?[T1, d1](fullset[T1]);

  % Assuming TCC generated (at line 23, column 12) for
      % continuity_ms_def[T1, d1, T2, d2]
      % generated from assumption continuity_ms_def.fullset_metric_space2
  IMP_continuity_ms_def_TCC2: OBLIGATION metric_space?[T2, d2](fullset[T2]);


body:
  uniform_continuity[S:Type+,ds:[S,S->nnreal],
                     T:Type+,dt:[T,T->nnreal]]: THEORY
  %------------------------------------------------------------------------------
  % Compactness
  %
  %     Authors: Ricky Butler,       NASA Langley
  %              Anthony Narkawicz,  NASA Langley
  %
  %     Version 1.0         8/25/2009  Initial Version
  %
  %------------------------------------------------------------------------------
  BEGIN

     ASSUMING IMPORTING metric_spaces_def

         fullset_S_metric_space: ASSUMPTION metric_space?[S,ds](fullset[S])
         fullset_T_metric_space: ASSUMPTION metric_space?[T,dt](fullset[T])

     ENDASSUMING


     ds_eq_0    : LEMMA FORALL (x,y: S)  : x = y IFF ds(x,y) = 0
     ds_sym     : LEMMA FORALL (x,y: S)  : ds(x,y)  = ds(y,x)
     ds_triangle: LEMMA FORALL (x,y,z: S): ds(x,z) <= ds(x,y) + ds(y,z)
     dt_eq_0    : LEMMA FORALL (x,y: T)  : dt(x,y)  = 0 IFF x = y
     dt_sym     : LEMMA FORALL (x,y: T)  : dt(x,y)  = dt(y,x)
     dt_triangle: LEMMA FORALL (x,y,z: T): dt(x,z) <= dt(x,y) + dt(y,z)

     epsilon, delta: VAR posreal

     uniformly_continuous?(f: [S -> T], A: set[S]):bool = 
       FORALL epsilon: EXISTS delta: 
             (FORALL (x,p: (A)): 
                 ds(x,p) < delta IMPLIES dt(f(x),f(p)) < epsilon)


      IMPORTING continuity_ms[S,ds,T,dt],
                 compactness[S,ds],
  	       compactness[T,dt]


     f: VAR [S -> T]
     A: VAR set[S]


     % Uniform continuity is a stronger concept than continuity

     unif_cont_implies_cont: LEMMA uniformly_continuous?(f,A) IMPLIES
     			   	 continuous?(f,A)






     Hset(A: set[S], epsilon: posreal, f): set[[S,posreal]] = 
              { p: [a: S, r: posreal] | 
                          LET (a,r) = p IN A(a) AND 
                               FORALL (x: S): intersection(ball(a,2*r),A)(x)
                                              IMPLIES dt(f(x),f(a)) < epsilon}

     Hset_def: LEMMA continuous?(f,A) IMPLIES
                 FORALL (x:(A)): EXISTS (p: [a: (A), r: posreal]): 
                    LET B = ball[S,ds](p) IN
             Hset(A,epsilon,f)(p) AND B(x)

     ball_cover(A: set[S], epsilon: posreal,f): set[set[S]] =
                ball_covering(Hset(A,epsilon,f))

     ball_cover_lem: LEMMA continuous?(f,A) IMPLIES
                           open_cover?(ball_cover(A,epsilon,f),A)


     Y: VAR set[set[S]]
     K: VAR set[S]

     compact_ball_all: LEMMA continuous?(f,A) AND compact?(A) 
        IMPLIES 
            (FORALL (epsilon: posreal): 
                FORALL (a: (A)):
                   EXISTS (r: posreal) : 
                      FORALL (x: S): intersection(ball(a,r),A)(x)
                                    IMPLIES dt(f(x),f(a)) < epsilon)

     rset_prep: LEMMA  continuous?(f,A) AND compact?(A) IMPLIES
        open_cover?[S, ds](ball_covering[S, ds](Hset(A, epsilon, f)), A);


     continuous_funs(A): TYPE = {f: [S->T] | continuous?(f,A)}

     rset(A: (compact?[S,ds]), epsilon: posreal, f: continuous_funs(A)): set[posreal] =
                LET (N,seq) = idxCover(A, Hset(A,epsilon,f)) IN
                   {r: posreal | EXISTS (i: below[N]): 
                       LET (a,R) = seq(i) IN r = R}

     r: VAR posreal
     rset_lem: LEMMA continuous?(f,A) AND compact?(A) AND
                     rset(A,epsilon,f)(r) IMPLIES
                        LET (N,seq) = idxCover(A,Hset(A,epsilon,f)) IN
                             EXISTS (i: below[N]): r = seq(i)`2               
                     
    
     IMPORTING finite_sets_aux[posreal]

     rset_finite: LEMMA continuous?(f,A) AND compact?(A) IMPLIES
                         is_finite[posreal](rset(A, epsilon, f))


     rset_not_empty: LEMMA continuous?(f,A) AND compact?(A) AND NOT empty?(A) AND
                            open_cover?(ball_cover(A, epsilon, f), A)
                IMPLIES
                        NOT empty?[posreal](rset(A, epsilon, f))



     % Apostol 4.47 (pg 91)

     IMPORTING finite_sets@finite_sets_minmax[posreal,<=]

     Heine: THEOREM 
        continuous?(f,A) AND compact?(A) AND NOT empty?(A)
        IMPLIES uniformly_continuous?(f,A)

     % An equivalent, sequence definition of uniform

     IMPORTING prelude_sets_aux

     uniform_continuity_sequence: LEMMA NOT uniformly_continuous?[S,ds,T,dt](f,A)
       		    IFF (EXISTS (epsilon: posreal): EXISTS (seq: [posint -> [S,S]]):
  		        FORALL (n: posint): (A(seq(n)`1) AND A(seq(n)`2) AND
  			       	   	    ds(seq(n)`1,seq(n)`2) < 1/n AND
  			       	   	    dt(f(seq(n)`1),f(seq(n)`2)) > epsilon))


    continuous_image_of_compact: THEOREM compact?(A) AND continuous?(f)
     IMPLIES compact?(image(f,A))


  END uniform_continuity

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 37, column 14) for
      % continuity_ms[S, ds, T, dt]
      % generated from assumption continuity_ms.fullset_metric_space1
  IMP_continuity_ms_TCC1: OBLIGATION metric_space?[S, ds](fullset[S]);

  % Assuming TCC generated (at line 37, column 14) for
      % continuity_ms[S, ds, T, dt]
      % generated from assumption continuity_ms.fullset_metric_space2
  IMP_continuity_ms_TCC2: OBLIGATION metric_space?[T, dt](fullset[T]);

  % Subtype TCC generated (at line 92, column 40) for  Hset(A, epsilon, f)
      % expected type  Htype[S, ds](A)
  rset_TCC1: OBLIGATION
    FORALL (A: (compact?[S, ds]), epsilon: posreal, f: continuous_funs(A)):
      open_cover?[S, ds](ball_covering[S, ds](Hset(A, epsilon, f)), A);

  % Subtype TCC generated (at line 99, column 47) for  Hset(A, epsilon, f)
      % expected type  Htype[S, ds](A)
  rset_lem_TCC1: OBLIGATION
    FORALL (A: set[S], epsilon: posreal, f: [S -> T], r: posreal):
      rset(A, epsilon, f)(r) AND compact?(A) AND continuous?(f, A) IMPLIES
       open_cover?[S, ds](ball_covering[S, ds](Hset(A, epsilon, f)), A);


body:
  open_sets[T: TYPE FROM real]: THEORY
  BEGIN

     AUTO_REWRITE+ member

     x,y: VAR T
     S,S1,S2: VAR set[T]
     open_ball?(x,S): bool = (EXISTS (delta: posreal): 
                                  (FORALL y: abs(x-y) < delta IMPLIES S(y)))
     
     r: VAR posreal
     open_ball(x,r): set[T] = {y: T | abs(x-y) < r}
     
     open_ball?_lem: LEMMA open_ball?(x,S) IFF
                             EXISTS r: subset?(open_ball(x,r),S) 
     
     open?(S): bool = FORALL (x: (S)): open_ball?(x,S)
     
     open?_lem: LEMMA open?(S) AND S(x) IMPLIES open_ball?(x,S)
     
     closed?(S): bool = open?(complement(S))

     Open  : TYPE = (open?)      %% = {S: set[T] | open?(S)}
     Closed: TYPE = (closed?)    %% = {S: set[T] | closed?(S)}

     IMPORTING reals@intervals_real[T]

     above_intv(a:T)(x) : MACRO bool = x > a
     below_intv(a:T)(x) : MACRO bool = x < a

     a,b: VAR T

  %   Open_empty        : LEMMA {x: Open_interval(a,a) | TRUE} = emptyset[T]

     open_intv_open     : LEMMA a < b IMPLIES open?(open_intv(a,b))

     above_intv_open    : LEMMA open?(above_intv(a))  
     below_intv_open    : LEMMA open?(below_intv(a))  

     union_open         : LEMMA open?(S1) AND open?(S2) IMPLIES
                                   open?(union(S1,S2))

     closed_intv_closed : LEMMA a < b IMPLIES closed?(closed_intv(a,b))


  END open_sets


body:
  real_metric_space: THEORY
  %------------------------------------------------------------------------------
  % The metric space structure on the reals
  %
  %     Authors: Anthony Narkawicz,  NASA Langley
  %
  %     Version 1.0         8/28/2009  Initial Version
  %------------------------------------------------------------------------------

  BEGIN

    x,y: VAR real

    real_dist(x,y): nnreal = abs(x-y)

    IMPORTING metric_spaces_def

    S: VAR set[real]

    real_metric_space: LEMMA metric_space?[real,real_dist](S)


    IMPORTING open_sets[real], compactness[real,real_dist], convergence_sequences


    compact_induction: LEMMA FORALL (c: real, d: {x: real | c < x}): 
       (compact?[real,real_dist](closed_intv(c,(c+d)/2))
       AND compact?[real,real_dist](closed_intv((c+d)/2,d))) 
          IMPLIES compact?[real,real_dist](closed_intv(c,d))


    seq_intv_scaf(c: real, d: {x: real | c < x}, 
                  YS: {XST: set[set[real]] | open_cover?(XST,closed_intv(c,d))})(n: nat): 
    RECURSIVE [real,real] = 
          IF n = 0 THEN (c,d) 
          ELSIF
             NOT EXISTS (XS: set[set[real]]): subset?(XS,YS) 
             AND finite_cover?(XS,closed_intv(seq_intv_scaf(c,d,YS)(n-1)`1,
                               (seq_intv_scaf(c,d,YS)(n-1)`1+seq_intv_scaf(c,d,YS)(n-1)`2)/2))
          THEN
             (seq_intv_scaf(c,d,YS)(n-1)`1,(seq_intv_scaf(c,d,YS)(n-1)`1+seq_intv_scaf(c,d,YS)(n-1)`2)/2)
          ELSE
             ((seq_intv_scaf(c,d,YS)(n-1)`1+seq_intv_scaf(c,d,YS)(n-1)`2)/2,seq_intv_scaf(c,d,YS)(n-1)`2)
          ENDIF MEASURE n


    seq_inv_scaf_decreasing: LEMMA 
       FORALL (c: real, d: {x: real | c < x},YS: {XST: set[set[real]] | 
               open_cover?(XST,closed_intv(c,d))}): 
       FORALL (n:nat): seq_intv_scaf(c,d,YS)(n)`1 < seq_intv_scaf(c,d,YS)(n)`2
          AND subset?(closed_intv(seq_intv_scaf(c,d,YS)(n+1)`1,seq_intv_scaf(c,d,YS)(n+1)`2),
                      closed_intv(seq_intv_scaf(c,d,YS)(n)`1,seq_intv_scaf(c,d,YS)(n)`2))
          AND seq_intv_scaf(c,d,YS)(n)`2 - seq_intv_scaf(c,d,YS)(n)`1 = (d-c)/(2^n)


    compact_seq_induction: LEMMA FORALL (c: real, d: {x: real | c < x}):
        (NOT compact?[real,real_dist](closed_intv(c,d))) 
        IMPLIES
             EXISTS (YS: set[set[real]]): open_cover?(YS,closed_intv(c,d)) AND
                 FORALL (n:nat): LET W = seq_intv_scaf(c,d,YS)(n) IN  
                       (NOT EXISTS (XS: set[set[real]]): subset?(XS,YS) AND
                                    finite_cover?(XS,closed_intv(W`1,W`2)))

    % ---------------- Closed intervals over the reals are compact ----------------------

    closed_intervals_compact: THEOREM FORALL (a: real, b: {x: real | a < x}): 
       compact?[real,real_dist](closed_intv(a,b))

  END real_metric_space

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 23, column 29) for
      % compactness[real, real_dist]
      % generated from assumption compactness.fullset_metric_space
  IMP_compactness_TCC1: OBLIGATION
    metric_space?[real, real_dist](fullset[real]);

  % Subtype TCC generated (at line 38, column 66) for  n - 1
      % expected type  nat
  seq_intv_scaf_TCC1: OBLIGATION
    FORALL (c: real, d: {x: real | c < x},
            YS:
              {XST: set[set[real]] |
                       open_cover?[real, real_dist]
                           (XST, LAMBDA (x: real): c <= x AND x <= d)},
            n: nat):
      NOT n = 0 IMPLIES
       (FORALL (XS: set[set[real]]): subset?(XS, YS) IMPLIES n - 1 >= 0);

  % Termination TCC generated (at line 38, column 44) for
      % seq_intv_scaf(c, d, YS)(n - 1)
  seq_intv_scaf_TCC2: OBLIGATION
    FORALL (c: real, d: {x: real | c < x},
            YS:
              {XST: set[set[real]] |
                       open_cover?[real, real_dist]
                           (XST, LAMBDA (x: real): c <= x AND x <= d)},
            n: nat):
      NOT n = 0 IMPLIES
       (FORALL (XS: set[set[real]]): subset?(XS, YS) IMPLIES n - 1 < n);

  % Subtype TCC generated (at line 41, column 34) for  n - 1
      % expected type  nat
  seq_intv_scaf_TCC3: OBLIGATION
    FORALL (c: real, d: {x: real | c < x},
            YS:
              {XST: set[set[real]] |
                       open_cover?[real, real_dist]
                           (XST, LAMBDA (x: real): c <= x AND x <= d)},
            n: nat,
            v:
              [[c: real, d: {x: real | c < x},
                {XST: set[set[real]] |
                         open_cover?(XST,
                                     LAMBDA (x: real):
                                       c <= x AND x <= d)}] ->
                 [{z1: nat | z1 < n} -> [real, real]]]):
      NOT (EXISTS (XS: set[set[real]]):
             subset?(XS, YS) AND
              finite_cover?(XS,
                            LAMBDA (x: real):
                              v(c, d, YS)(n - 1)`1 <= x AND
                               x <=
                                (v(c, d, YS)(n - 1)`1 + v(c, d, YS)(n - 1)`2)
                                 / 2))
       AND NOT n = 0
       IMPLIES n - 1 >= 0;

  % Termination TCC generated (at line 41, column 12) for
      % seq_intv_scaf(c, d, YS)(n - 1)
  seq_intv_scaf_TCC4: OBLIGATION
    FORALL (c: real, d: {x: real | c < x},
            YS:
              {XST: set[set[real]] |
                       open_cover?[real, real_dist]
                           (XST, LAMBDA (x: real): c <= x AND x <= d)},
            n: nat,
            v:
              [[c: real, d: {x: real | c < x},
                {XST: set[set[real]] |
                         open_cover?(XST,
                                     LAMBDA (x: real):
                                       c <= x AND x <= d)}] ->
                 [{z1: nat | z1 < n} -> [real, real]]]):
      NOT (EXISTS (XS: set[set[real]]):
             subset?(XS, YS) AND
              finite_cover?(XS,
                            LAMBDA (x: real):
                              v(c, d, YS)(n - 1)`1 <= x AND
                               x <=
                                (v(c, d, YS)(n - 1)`1 + v(c, d, YS)(n - 1)`2)
                                 / 2))
       AND NOT n = 0
       IMPLIES n - 1 < n;

  % Subtype TCC generated (at line 43, column 35) for  n - 1
      % expected type  nat
  seq_intv_scaf_TCC5: OBLIGATION
    FORALL (c: real, d: {x: real | c < x},
            YS:
              {XST: set[set[real]] |
                       open_cover?[real, real_dist]
                           (XST, LAMBDA (x: real): c <= x AND x <= d)},
            n: nat,
            v:
              [[c: real, d: {x: real | c < x},
                {XST: set[set[real]] |
                         open_cover?(XST,
                                     LAMBDA (x: real):
                                       c <= x AND x <= d)}] ->
                 [{z1: nat | z1 < n} -> [real, real]]]):
      (EXISTS (XS: set[set[real]]):
         subset?(XS, YS) AND
          finite_cover?(XS,
                        LAMBDA (x: real):
                          v(c, d, YS)(n - 1)`1 <= x AND
                           x <=
                            (v(c, d, YS)(n - 1)`1 + v(c, d, YS)(n - 1)`2) /
                             2))
       AND NOT n = 0
       IMPLIES n - 1 >= 0;

  % Termination TCC generated (at line 43, column 13) for
      % seq_intv_scaf(c, d, YS)(n - 1)
  seq_intv_scaf_TCC6: OBLIGATION
    FORALL (c: real, d: {x: real | c < x},
            YS:
              {XST: set[set[real]] |
                       open_cover?[real, real_dist]
                           (XST, LAMBDA (x: real): c <= x AND x <= d)},
            n: nat,
            v:
              [[c: real, d: {x: real | c < x},
                {XST: set[set[real]] |
                         open_cover?(XST,
                                     LAMBDA (x: real):
                                       c <= x AND x <= d)}] ->
                 [{z1: nat | z1 < n} -> [real, real]]]):
      (EXISTS (XS: set[set[real]]):
         subset?(XS, YS) AND
          finite_cover?(XS,
                        LAMBDA (x: real):
                          v(c, d, YS)(n - 1)`1 <= x AND
                           x <=
                            (v(c, d, YS)(n - 1)`1 + v(c, d, YS)(n - 1)`2) /
                             2))
       AND NOT n = 0
       IMPLIES n - 1 < n;


body:
  rs_integral_cont[T:TYPE+ from real]: THEORY
  %------------------------------------------------------------------------------
  %  Continuous functions are Riemann-Stieltjes integrable
  %------------------------------------------------------------------------------
  BEGIN

     ASSUMING
        IMPORTING deriv_domain_def[T]

        connected_domain : ASSUMPTION connected?[T]


        not_one_element : ASSUMPTION not_one_element?[T]

     ENDASSUMING


    IMPORTING real_metric_space,
  	    uniform_continuity,
  	    rs_integral_prep[T],
  	    bounded_variation[T]

     a,b,x,y,z: VAR T
     c,S: VAR real
     D,m,M,v1,v2,cc,RS1,RS2,K: VAR real
     delta : VAR posreal

     f,g,h,G: VAR [T -> real]


    RS_integrable_cont_inc: LEMMA a < b IMPLIES
    			 LET CI = closed_intv[T](a,b) IN
                           (continuous?[T,real_dist,real,real_dist](f,closed_intv[T](a,b)) AND
  			 increasing?[(CI)](g)
                           IMPLIES integrable?(a,b,g,f))

    RS_integrable_cont_BV: LEMMA a < b IMPLIES
    			 LET CI = closed_intv[T](a,b) IN
                           (continuous?[T,real_dist,real,real_dist](f,closed_intv[T](a,b)) AND
  			 bounded_variation?(a,b)(g)
                           IMPLIES integrable?(a,b,g,f)) 





  END rs_integral_cont

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 20, column 5) for  rs_integral_prep[T]
      % generated from assumption rs_integral_prep.connected_domain
  IMP_rs_integral_prep_TCC1: OBLIGATION connected?[T];

  % Assuming TCC generated (at line 20, column 5) for  rs_integral_prep[T]
      % generated from assumption rs_integral_prep.not_one_element
  IMP_rs_integral_prep_TCC2: OBLIGATION not_one_element?[T];

  % Assuming TCC generated (at line 17, column 8) for
      % continuity_ms_def
      %     [T, restrict[[real, real], [T, T], nnreal](real_dist), real,
      %      real_dist]
      % generated from assumption continuity_ms_def.fullset_metric_space1
  RS_integrable_cont_inc_TCC1: OBLIGATION
    FORALL (a, b: T):
      a < b IMPLIES
       (FORALL (CI: [T -> bool]):
          (CI = (LAMBDA (x: T): a <= x AND x <= b)) IMPLIES
           metric_space?[T, restrict[[real, real], [T, T], nnreal](real_dist)]
               (fullset[T]));

  % Assuming TCC generated (at line 18, column 8) for
      % continuity_ms_def
      %     [T, restrict[[real, real], [T, T], nnreal](real_dist), real,
      %      real_dist]
      % generated from assumption continuity_ms_def.fullset_metric_space2
  RS_integrable_cont_inc_TCC2: OBLIGATION
    FORALL (a, b: T):
      a < b IMPLIES
       (FORALL (CI: [T -> bool]):
          (CI = (LAMBDA (x: T): a <= x AND x <= b)) IMPLIES
           metric_space?[real, real_dist](fullset[real]));


body:
  metric_space_real_fun[T:TYPE+,d:[T,T->nnreal]]: THEORY
  %------------------------------------------------------------------------------
  % This Theory Contains Standard Lemmas About Real-Valued Continuous Functions
  %      	      On An Arbitrary Metric Space
  %
  %     Authors: Anthony Narkawicz,  NASA Langley
  %
  %     Version 1.0         8/31/2009  Initial Version
  %------------------------------------------------------------------------------
  BEGIN

     ASSUMING IMPORTING metric_spaces_def[T,d]
         fullset_metric_space: ASSUMPTION metric_space?[T,d](fullset[T])
     ENDASSUMING

     S: VAR set[T]


     IMPORTING real_metric_space, continuity_ms_def[T,d,real,real_dist], reals@abs_lems

     f,g: VAR [T -> real]
     c: VAR real

     scal_continuous: LEMMA continuous?(f,S) IMPLIES continuous?(c* f, S)
     neg_continuous:  LEMMA continuous?(f,S) IMPLIES continuous?( -f,S)
     sum_continuous:  LEMMA continuous?(f,S) AND continuous?(g,S) IMPLIES
     		    	  continuous?(f+g,S)
     diff_continuous: LEMMA continuous?(f,S) AND continuous?(g,S) IMPLIES
     		    	  continuous?(f-g,S)
     prod_continuous: LEMMA continuous?(f,S) AND continuous?(g,S) IMPLIES
     		    	  continuous?(f*g,S)
     abs_comp_cont:  LEMMA continuous?(f,S) IMPLIES continuous?(abs(f),S)
     

  END metric_space_real_fun

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 19, column 32) for
      % continuity_ms_def[T, d, real, real_dist]
      % generated from assumption continuity_ms_def.fullset_metric_space1
  IMP_continuity_ms_def_TCC1: OBLIGATION metric_space?[T, d](fullset[T]);

  % Assuming TCC generated (at line 19, column 32) for
      % continuity_ms_def[T, d, real, real_dist]
      % generated from assumption continuity_ms_def.fullset_metric_space2
  IMP_continuity_ms_def_TCC2: OBLIGATION
    metric_space?[real, real_dist](fullset[real]);


body:
  real_fun_on_compact_sets[T:TYPE+,d:[T,T->nnreal]]: THEORY
  %------------------------------------------------------------------------------
  % In This Theory, We Prove That A Continuous Real-Valued Function On A
  % Compact Subset Of A Metric Space Attains A Maximum
  %
  %     Authors: Anthony Narkawicz,  NASA Langley
  %
  %     Version 1.0         8/31/2009  Initial Version
  %------------------------------------------------------------------------------
  BEGIN

     ASSUMING IMPORTING metric_spaces_def[T,d]
         fullset_metric_space: ASSUMPTION metric_space?[T,d](fullset[T])
     ENDASSUMING

     S: VAR set[T]

     % A continuous function on a compact set realizes a maximum and a minimum


     IMPORTING real_metric_space, continuity_ms_def[T,d,real,real_dist], reals@abs_lems, 
               compactness[T,d]

     f: VAR [T -> real]

     cont_on_compact_max: THEOREM 
        (continuous?(f,S) and compact?(S)) 
        IMPLIES empty?(S) or (EXISTS (s: (S)): FORALL (t: (S)): f(t) <= f(s))

     cont_on_compact_min: THEOREM 
        (continuous?(f,S) and compact?(S)) 
        IMPLIES empty?(S) or (EXISTS (s: (S)): FORALL (t: (S)): f(t) >= f(s))

  END real_fun_on_compact_sets

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 21, column 32) for
      % continuity_ms_def[T, d, real, real_dist]
      % generated from assumption continuity_ms_def.fullset_metric_space1
  IMP_continuity_ms_def_TCC1: OBLIGATION metric_space?[T, d](fullset[T]);

  % Assuming TCC generated (at line 21, column 32) for
      % continuity_ms_def[T, d, real, real_dist]
      % generated from assumption continuity_ms_def.fullset_metric_space2
  IMP_continuity_ms_def_TCC2: OBLIGATION
    metric_space?[real, real_dist](fullset[real]);


body:
  riesz_interval_funs[a:real,b: {bb:real | a < bb}]: THEORY
  %------------------------------------------------------------------------------
  %  Real valued functions on a closed interval
  %------------------------------------------------------------------------------

  BEGIN

     IMPORTING real_metric_space,real_fun_on_compact_sets,
     	     metric_space_real_fun


     c: VAR real
     M: VAR nnreal

     Intab : set[real] = closed_intv(a,b)
     INTab : TYPE = (closed_intv(a,b))

     h,f,g: VAR [INTab -> real]

     x :VAR INTab

     IMPORTING metric_space_real_fun[INTab,real_dist]

     bounded_on_int?(h): bool = EXISTS (M:nnreal): FORALL (x): abs(h(x))<=M

     bounded_on_int_sum_closed: LEMMA bounded_on_int?(f) AND bounded_on_int?(h) IMPLIES bounded_on_int?(f+h)

     bounded_on_int_const_closed: LEMMA bounded_on_int?(f) IMPLIES bounded_on_int?(c*f)

     fun_norm(f: (bounded_on_int?)): {M:nnreal | (FORALL (x): abs(f(x))<=M) AND (FORALL (M1:real): M1 < M IMPLIES 
  			    	   EXISTS (x): abs(f(x)) > M1)}

     fun_norm_dist(f,g:(bounded_on_int?)): {k:nnreal|k=0 IFF f=g} = fun_norm(f-g)

     fun_norm_bound: LEMMA FORALL (f:(bounded_on_int?),x): abs(f(x)) <= fun_norm(f)

     fun_norm_zero: LEMMA bounded_on_int?(f) IMPLIES (fun_norm(f) = 0 IFF f = (LAMBDA (y:INTab): 0))

     fun_norm_scal: LEMMA FORALL (f:(bounded_on_int?),c): fun_norm(c*f) = abs(c)*fun_norm(f)

     fun_norm_triangle: LEMMA FORALL (f,g:(bounded_on_int?)): fun_norm(f+g) <= fun_norm(f)+fun_norm(g)

     bounded_funs_metric_space: LEMMA metric_space?[(bounded_on_int?),fun_norm_dist](bounded_on_int?)



     int_compact: LEMMA compact?(Intab)

     Bounded_Function : TYPE = (bounded_on_int?)

     continuous_on_int?(h): bool = continuous?(h,Intab)

     Continuous_Function: TYPE = (continuous_on_int?)

     fc,gc : VAR Continuous_Function
     fb,gb: VAR Bounded_Function

     continuous_implies_bounded: LEMMA FORALL (h:Continuous_Function): bounded_on_int?(h)

     continuous_function_bounded: JUDGEMENT Continuous_Function Subtype_of Bounded_Function




  END riesz_interval_funs

addendum:
  %%% ================ Addendum: generated declarations ================

  % Subtype TCC generated (at line 15, column 37) for  b
      % expected type  {x: real | a <= x}
  Intab_TCC1: OBLIGATION a <= b;

  % Assuming TCC generated (at line 22, column 13) for
      % metric_space_real_fun
      %     [INTab, restrict[[real, real], [INTab, INTab], nnreal](real_dist)]
      % generated from assumption metric_space_real_fun.fullset_metric_space
  IMP_metric_space_real_fun_TCC1: OBLIGATION
    metric_space?
        [INTab, restrict[[real, real], [INTab, INTab], nnreal](real_dist)]
        (fullset[INTab]);

  % Existence TCC generated (at line 22, column 13) for
      % metric_space_real_fun
      %     [INTab, restrict[[real, real], [INTab, INTab], nnreal](real_dist)]
  IMP_metric_space_real_fun_TCC2: OBLIGATION EXISTS (x: INTab): TRUE;

  % Existence TCC generated (at line 30, column 3) for
      % fun_norm(f: (bounded_on_int?)):
      %       {M: nnreal |
      %                (FORALL (x): abs(f(x)) <= M) AND
      %                 (FORALL (M1: real):
      %                    M1 < M IMPLIES (EXISTS (x): abs(f(x)) > M1))}
  fun_norm_TCC1: OBLIGATION
    EXISTS (x1:
              [f: (bounded_on_int?) ->
                 {M: nnreal |
                          (FORALL (x): abs(f(x)) <= M) AND
                           (FORALL (M1: real):
                              M1 < M IMPLIES
                               (EXISTS (x): abs(f(x)) > M1))}]):
      TRUE;

  % Subtype TCC generated (at line 33, column 75) for  f - g
      % expected type  f: (bounded_on_int?)
  fun_norm_dist_TCC1: OBLIGATION
    FORALL (f, g: (bounded_on_int?)): bounded_on_int?((-[INTab])(f, g));

  % Subtype TCC generated (at line 33, column 66) for  fun_norm(f - g)
      % expected type  {k: nnreal | k = 0 IFF f = g}
  fun_norm_dist_TCC2: OBLIGATION
    FORALL (f, g: (bounded_on_int?)):
      fun_norm((-[INTab])(f, g)) = 0 IFF f = g;

  % Subtype TCC generated (at line 39, column 65) for  c * f
      % expected type  f: (bounded_on_int?)
  fun_norm_scal_TCC1: OBLIGATION
    FORALL (f: (bounded_on_int?), c: real): bounded_on_int?(*[INTab](c, f));

  % Subtype TCC generated (at line 41, column 69) for  f + g
      % expected type  f: (bounded_on_int?)
  fun_norm_triangle_TCC1: OBLIGATION
    FORALL (f, g: (bounded_on_int?)): bounded_on_int?((+[INTab])(f, g));

  % Existence TCC generated (at line 43, column 36) for
      % metric_space?[(bounded_on_int?), fun_norm_dist]
  bounded_funs_metric_space_TCC1: OBLIGATION
    EXISTS (x: (bounded_on_int?)): TRUE;

  % Judgement subtype TCC generated (at line 60, column 42) for  x
      % expected type  Bounded_Function
  continuous_function_bounded: OBLIGATION
    FORALL (x: Continuous_Function): bounded_on_int?(x);


body:
  riesz_function_sets[a:real,b: {bb:real | a < bb}]: THEORY
  %------------------------------------------------------------------------------
  %  Bounded linear functionals on a subtype of [real->real]. This is in direct
  %  support of the Riesz representation theorem.
  %------------------------------------------------------------------------------

  BEGIN

  IMPORTING riesz_interval_funs[a,b]


  Fnz: VAR set[[INTab->real]]


     funs_sum_closed?(Fnz) : bool   =   FORALL (f,g:(Fnz)): Fnz(f+g)
     funs_const_closed?(Fnz): bool   =   FORALL (f:(Fnz),c:real): Fnz(c*f)
     funs_bounded?(Fnz): bool   =   FORALL (f:(Fnz)): bounded_on_int?(f)
     funs_contain_constants?(Fnz): bool   =   FORALL (c:real): Fnz(LAMBDA (y:INTab):c)
     funs_contain_continuous?(Fnz): bool  =   FORALL (f:[INTab->real]): continuous_on_int?(f) IMPLIES Fnz(f)

     bounded_linear_subspace?(Fnz): bool = 
     				  funs_sum_closed?(Fnz) AND
  				  funs_const_closed?(Fnz) AND
  				  funs_bounded?(Fnz) AND
  				  funs_contain_constants?(Fnz) AND
  				  funs_contain_continuous?(Fnz)




  END riesz_function_sets


body:
  riesz_linear_functionals[a:real,b: {bb:real | a < bb},
  	(importing riesz_function_sets[a,b]) Funs:TYPE FROM [INTab->real]]: THEORY
  %------------------------------------------------------------------------------
  %  Linear functionals on a subtype of [[a,b]->real]. This is in direct support
  %  of the Riesz representation theorem.
  %------------------------------------------------------------------------------

  BEGIN

  ASSUMING IMPORTING real_metric_space

     funs_sum_closed : ASSUMPTION FORALL (f,g:Funs): Funs_pred(f+g)
     funs_const_closed: ASSUMPTION FORALL (f:Funs,c:real): Funs_pred(c*f)
     funs_contain_zero: ASSUMPTION Funs_pred(LAMBDA (y:INTab): 0)

  ENDASSUMING



     h,f,g: VAR Funs
     c,y: VAR real
     M: VAR nnreal

     Operator: TYPE = [Funs->real]

     L : VAR Operator

     additive_op?(L) : bool = (FORALL (f,g): L(f+g) = L(f)+L(g))
     const_inv_op?(L) : bool = (FORALL (f:Funs,c:real): L(c*f) = c*L(f))
     linear_op?(L) : bool = additive_op?(L) AND const_inv_op?(L)

     linear_op_zero: LEMMA linear_op?(L) IMPLIES L(LAMBDA (y:INTab): 0) = 0

  END riesz_linear_functionals

addendum:
  %%% ================ Addendum: generated declarations ================

  % Subtype TCC generated (at line 28, column 45) for  f + g
      % expected type  Funs
  additive_op?_TCC1: OBLIGATION
    FORALL (f: Funs, g: Funs): Funs_pred((+[INTab[a, b]])(f, g));

  % Subtype TCC generated (at line 29, column 56) for  c * f
      % expected type  Funs
  const_inv_op?_TCC1: OBLIGATION
    FORALL (f: Funs, c: real): Funs_pred(*[INTab[a, b]](c, f));

  % Subtype TCC generated (at line 32, column 49) for  LAMBDA (y: INTab): 0
      % expected type  Funs
  linear_op_zero_TCC1: OBLIGATION
    FORALL (L: Operator):
      linear_op?(L) IMPLIES Funs_pred(LAMBDA (y: INTab[a, b]): 0);


body:
  riesz_bounded_functionals[a:real,b: {bb:real | a < bb},
     (importing riesz_function_sets[a,b])Funs:TYPE FROM [INTab->real]]: THEORY
  %------------------------------------------------------------------------------
  %  Bounded linear functionals on a subtype of [real->real]. This is in direct
  %  support of the Riesz representation theorem.
  %------------------------------------------------------------------------------

  BEGIN

  ASSUMING IMPORTING riesz_function_sets[a,b]

     funs_subspace: ASSUMPTION bounded_linear_subspace?(fullset[Funs])

  ENDASSUMING

     IMPORTING riesz_linear_functionals[a,b,Funs], riesz_function_sets[a,b]

     h,f,g: VAR Funs
     c,y: VAR real
     M: VAR nnreal

     L: VAR Operator

     bounded_op?(L) : bool = (EXISTS (M:nnreal): FORALL (f): abs(L(f)) <= M*fun_norm(f))

     op_norm(L: (bounded_op?)): {M:nnreal | (FORALL (f:Funs): abs(L(f))<=M*fun_norm(f)) AND (FORALL (M1:real): M1 < M IMPLIES 
  			    	    EXISTS (f:Funs): abs(L(f)) > M1*fun_norm(f))}

     op_norm_bound: LEMMA FORALL (L:(bounded_op?),f): abs(L(f)) <= op_norm(L)*fun_norm(f)

     bounded_linear_operator?(L): bool = bounded_op?(L) AND linear_op?(L)


  END riesz_bounded_functionals

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 16, column 13) for
      % riesz_linear_functionals[a, b, Funs]
      % generated from assumption riesz_linear_functionals.funs_sum_closed
  IMP_riesz_linear_functionals_TCC1: OBLIGATION
    FORALL (f, g: Funs): Funs_pred((+[INTab[a, b]])(f, g));

  % Assuming TCC generated (at line 16, column 13) for
      % riesz_linear_functionals[a, b, Funs]
      % generated from assumption riesz_linear_functionals.funs_const_closed
  IMP_riesz_linear_functionals_TCC2: OBLIGATION
    FORALL (f: Funs, c: real): Funs_pred(*[INTab[a, b]](c, f));

  % Assuming TCC generated (at line 16, column 13) for
      % riesz_linear_functionals[a, b, Funs]
      % generated from assumption riesz_linear_functionals.funs_contain_zero
  IMP_riesz_linear_functionals_TCC3: OBLIGATION
    Funs_pred(LAMBDA (y: INTab[a, b]): 0);

  % Subtype TCC generated (at line 24, column 83) for  f
      % expected type  f: (bounded_on_int?)
  bounded_op?_TCC1: OBLIGATION FORALL (f: Funs): bounded_on_int?[a, b](f);

  % Existence TCC generated (at line 26, column 3) for
      % op_norm(L: (bounded_op?)):
      %       {M: nnreal |
      %                (FORALL (f: Funs): abs(L(f)) <= M * fun_norm(f)) AND
      %                 (FORALL (M1: real):
      %                    M1 < M IMPLIES
      %                     (EXISTS (f: Funs): abs(L(f)) > M1 * fun_norm(f)))}
  op_norm_TCC1: OBLIGATION
    EXISTS (x:
              [L: (bounded_op?) ->
                 {M: nnreal |
                          (FORALL (f: Funs):
                             abs(L(f)) <= M * fun_norm[a, b](f))
                           AND
                           (FORALL (M1: real):
                              M1 < M IMPLIES
                               (EXISTS (f: Funs):
                                  abs(L(f)) > M1 * fun_norm[a, b](f)))}]):
      TRUE;


body:
  riesz_hahn_banach[a:real,b: {bb:real | a < bb}]: THEORY
  %------------------------------------------------------------------------------
  %  The Hahn Banach theorem for the special case of extensions from C[a,b] to
  %  B[a,b].
  %------------------------------------------------------------------------------

  BEGIN



     IMPORTING riesz_interval_funs[a,b],riesz_bounded_functionals

     h: VAR [INTab -> real]
     c,y: VAR real
     M: VAR nnreal


     %--------------%

     C_Bounded_Linear_Operator : TYPE = (bounded_linear_operator?[a,b,(continuous_on_int?[a,b])])

     B_Bounded_Linear_Operator : TYPE = (bounded_linear_operator?[a,b,(bounded_on_int?[a,b])])

     LC : VAR C_Bounded_Linear_Operator
     LB : VAR B_Bounded_Linear_Operator

     Op_Pair: TYPE = [# space: (bounded_linear_subspace?[a,b]), Lop: (bounded_linear_operator?[a,b,(space)]) #]

     OE,Ext : VAR Op_Pair

     <=(OE,Ext) : bool = subset?(OE`space,Ext`space) AND (FORALL (ff:[INTab->real]): OE`space(ff) IMPLIES OE`Lop(ff) = Ext`Lop(ff))
     	      	       AND op_norm[a,b,(OE`space)](OE`Lop) = op_norm[a,b,(Ext`space)](Ext`Lop)

     Hahn_Banach_partial_order: LEMMA partial_order?[Op_Pair](<=)

     IMPORTING orders@zorn

     Op_Extension(OE) : TYPE = {Ext | OE <= Ext}

     le(OE)(OEext1,OEext2:Op_Extension(OE)): bool = OEext1<=OEext2

     Hahn_Banach_partial_order_sub: LEMMA partial_order?[Op_Extension(OE)](le(OE))

     Op_Extension_exists: LEMMA FORALL (ff:Bounded_Function[a,b]): (NOT member(ff,OE`space) IMPLIES
     			EXISTS (Ext:Op_Extension(OE)): member(ff,Ext`space))

     Hahn_Banach: THEOREM EXISTS (LB): op_norm[a,b,(bounded_on_int?[a,b])](LB) = op_norm[a,b,(continuous_on_int?[a,b])](LC)
     			       	     AND (FORALL (f:Continuous_Function[a,b]): LB(f) = LC(f))


  END riesz_hahn_banach

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 20, column 39) for
      % bounded_linear_operator?[a, b, (continuous_on_int?[a, b])]
      % generated from assumption riesz_bounded_functionals.funs_subspace
  C_Bounded_Linear_Operator_TCC1: OBLIGATION
    bounded_linear_subspace?[a, b]
        (extend
             [[INTab[a, b] -> real], (continuous_on_int?[a, b]), bool, FALSE]
             (fullset[(continuous_on_int?[a, b])]));

  % Assuming TCC generated (at line 22, column 39) for
      % bounded_linear_operator?[a, b, (bounded_on_int?[a, b])]
      % generated from assumption riesz_bounded_functionals.funs_subspace
  B_Bounded_Linear_Operator_TCC1: OBLIGATION
    bounded_linear_subspace?[a, b]
        (extend[[INTab[a, b] -> real], (bounded_on_int?[a, b]), bool, FALSE]
             (fullset[(bounded_on_int?[a, b])]));

  % Subtype TCC generated (at line 31, column 125) for  ff
      % expected type  (Ext`space)
  lesseqp_TCC1: OBLIGATION
    FORALL (OE: Op_Pair, Ext: Op_Pair):
      subset?(OE`space, Ext`space) IMPLIES
       (FORALL (ff: [INTab[a, b] -> real]):
          OE`space(ff) IMPLIES Ext`space(ff));

  % Subtype TCC generated (at line 32, column 46) for  OE`Lop
      % expected type  L: (bounded_op?[a, b, (OE`space)])
  lesseqp_TCC2: OBLIGATION
    FORALL (OE: Op_Pair, Ext: Op_Pair):
      (FORALL (ff: [INTab -> real]):
         OE`space(ff) IMPLIES OE`Lop(ff) = Ext`Lop(ff))
       AND subset?(OE`space, Ext`space)
       IMPLIES bounded_op?[a, b, (OE`space)](OE`Lop);

  % Assuming TCC generated (at line 12, column 3) for
      % riesz_bounded_functionals[a, b, (OE`space)]
      % generated from assumption riesz_bounded_functionals.funs_subspace
  lesseqp_TCC3: OBLIGATION
    FORALL (OE: Op_Pair, Ext: Op_Pair):
      (FORALL (ff: [INTab -> real]):
         OE`space(ff) IMPLIES OE`Lop(ff) = Ext`Lop(ff))
       AND subset?(OE`space, Ext`space)
       IMPLIES
       bounded_linear_subspace?[a, b]
           (extend[[INTab[a, b] -> real], (OE`space), bool, FALSE]
                (fullset[(OE`space)]));

  % Subtype TCC generated (at line 32, column 81) for  Ext`Lop
      % expected type  L: (bounded_op?[a, b, (Ext`space)])
  lesseqp_TCC4: OBLIGATION
    FORALL (OE: Op_Pair, Ext: Op_Pair):
      (FORALL (ff: [INTab -> real]):
         OE`space(ff) IMPLIES OE`Lop(ff) = Ext`Lop(ff))
       AND subset?(OE`space, Ext`space)
       IMPLIES bounded_op?[a, b, (Ext`space)](Ext`Lop);

  % Assuming TCC generated (at line 12, column 3) for
      % riesz_bounded_functionals[a, b, (Ext`space)]
      % generated from assumption riesz_bounded_functionals.funs_subspace
  lesseqp_TCC5: OBLIGATION
    FORALL (OE: Op_Pair, Ext: Op_Pair):
      (FORALL (ff: [INTab -> real]):
         OE`space(ff) IMPLIES OE`Lop(ff) = Ext`Lop(ff))
       AND subset?(OE`space, Ext`space)
       IMPLIES
       bounded_linear_subspace?[a, b]
           (extend[[INTab[a, b] -> real], (Ext`space), bool, FALSE]
                (fullset[(Ext`space)]));

  % Subtype TCC generated (at line 47, column 73) for  LB
      % expected type  L: (bounded_op?)
  Hahn_Banach_TCC1: OBLIGATION
    FORALL (LB: B_Bounded_Linear_Operator):
      bounded_op?[a, b, (bounded_on_int?[a, b])](LB);

  % Subtype TCC generated (at line 47, column 118) for  LC
      % expected type  L: (bounded_op?)
  Hahn_Banach_TCC2: OBLIGATION
    FORALL (LC: C_Bounded_Linear_Operator, LB: B_Bounded_Linear_Operator):
      bounded_op?[a, b, (continuous_on_int?[a, b])](LC);


body:
  riesz_representation[a:real,b: {bb:real | a < bb}]: THEORY
  %------------------------------------------------------------------------------
  %  The Riesz Representation Theorem
  %  [This is a fundamental theorem in functional analysis. It says that every
  %  bounded linear functional on the Banach space C[a,b] of continuous functions
  %  on [a,b] is given by integration (Riemann-Stieltjes) with respect to some
  %  integrator of bounded variation]
  %------------------------------------------------------------------------------

  BEGIN



     IMPORTING riesz_interval_funs[a,b],rs_integral_cont[INTab], riesz_hahn_banach[a,b], bounded_variation[INTab], reals@sign

     h: VAR [INTab -> real]
     x: VAR INTab
     M: VAR nnreal
     r1,r2,r3: VAR INTab

  % x :VAR INTab

     LC : VAR C_Bounded_Linear_Operator
     LB : VAR B_Bounded_Linear_Operator


     g  : VAR (bounded_variation?(a,b))
     f  : VAR Continuous_Function[a,b]

     integral_norm_bounded: LEMMA integrable?(a,b,g,f) AND
     			  abs(integral(a,b,g,f)) <= total_variation(a,b,g)(b)*fun_norm(f)

     fun_to_op(g): C_Bounded_Linear_Operator = (LAMBDA (f):
     		 			   integral(a,b,g,f))

     fun_to_op_bound: LEMMA abs(fun_to_op(g)(f)) <= total_variation(a,b,g)(b)*fun_norm(f)

     char_fun(r1,r2)(x): nnreal = IF r1<=x AND x<r2 AND r2<b THEN 1 ELSIF r1<=x AND x<=r2 AND r2=b THEN 1 ELSE 0 ENDIF

     char_fun_minus: LEMMA r1<=r2 AND (r2<r3 OR (r2<=r3 AND r3<b)) IMPLIES char_fun(r1,r3)-char_fun(r1,r2) = char_fun(r2,r3)

     % ----- Approximating a continuous f by a step function -------- %

     step_approx(P:partition(a,b),xis:xis?(a,b,P))(fr:(bounded_on_int?[a,b])): (bounded_on_int?[a,b]) =
     	(LAMBDA (x:INTab): sigma[below(P`length-1)](0,P`length-2,LAMBDA (n:below(P`length-1)):
  		fr(xis`seq(n))*char_fun(P`seq(n),P`seq(n+1))(x)))

     step_approx_def: LEMMA FORALL (eps:posreal): EXISTS (delta:posreal): FORALL (P:partition(a,b),xis:xis?(a,b,P)):
        strictly_increasing?(P) AND width(a,b,P)<delta IMPLIES (FORALL (x:INTab): abs(f(x)-step_approx(P,xis)(f)(x)) < eps)

     IMPORTING riesz_bounded_functionals[a,b,Continuous_Function[a,b]],riesz_bounded_functionals[a,b,Bounded_Function[a,b]]

     riesz_representation: LEMMA EXISTS g:
  	op_norm[a,b,Continuous_Function[a,b]](LC) = total_variation(a,b,g)(b) AND
  	LC = fun_to_op(g)


  END riesz_representation

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 14, column 38) for
      % rs_integral_cont[INTab]
      % generated from assumption rs_integral_cont.connected_domain
  IMP_rs_integral_cont_TCC1: OBLIGATION connected?[INTab[a, b]];

  % Assuming TCC generated (at line 14, column 38) for
      % rs_integral_cont[INTab]
      % generated from assumption rs_integral_cont.not_one_element
  IMP_rs_integral_cont_TCC2: OBLIGATION not_one_element?[INTab[a, b]];

  % Subtype TCC generated (at line 30, column 44) for  a
      % expected type  INTab[a, b]
  integral_norm_bounded_TCC1: OBLIGATION a <= a AND a <= b;

  % Subtype TCC generated (at line 30, column 46) for  b
      % expected type  {x: INTab[a, b] | a < x}
  integral_norm_bounded_TCC2: OBLIGATION (a <= b AND b <= b) AND a < b;

  % Subtype TCC generated (at line 31, column 57) for  b
      % expected type  x: {x | TRUE}
  integral_norm_bounded_TCC3: OBLIGATION
    FORALL (f: Continuous_Function[a, b], g: (bounded_variation?(a, b))):
      integrable?(a, b, g, f) IMPLIES a <= b AND b <= b;

  % Subtype TCC generated (at line 34, column 27) for  f
      % expected type  {f | integrable?(a, b, g, f)}
  fun_to_op_TCC1: OBLIGATION
    FORALL (g: (bounded_variation?[INTab](a, b)),
            f: Continuous_Function[a, b]):
      integrable?[INTab](a, b, g, f);

  % Subtype TCC generated (at line 33, column 46) for
      % (LAMBDA (f): integral(a, b, g, f))
      % expected type  C_Bounded_Linear_Operator[a, b]
  fun_to_op_TCC2: OBLIGATION
    FORALL (g: (bounded_variation?[INTab](a, b))):
      bounded_linear_operator?[a, b, (continuous_on_int?[a, b])]
          (LAMBDA (f): integral[INTab](a, b, g, f));

  % Subtype TCC generated (at line 36, column 73) for  b
      % expected type  x: {x | TRUE}
  fun_to_op_bound_TCC1: OBLIGATION a <= b AND b <= b;

  % Subtype TCC generated (at line 45, column 48) for  0
      % expected type  T_low[below(P`length - 1)]
  step_approx_TCC1: OBLIGATION
    FORALL (P: partition[INTab](a, b), xis: xis?[INTab](a, b, P),
            fr: (bounded_on_int?[a, b])):
      0 >= 0 AND 0 < P`length - 1 OR
       (EXISTS (j: below(P`length - 1)): j <= 0);

  % Subtype TCC generated (at line 45, column 50) for  P`length - 2
      % expected type  T_high[below(P`length - 1)]
  step_approx_TCC2: OBLIGATION
    FORALL (P: partition[INTab](a, b), xis: xis?[INTab](a, b, P),
            fr: (bounded_on_int?[a, b])):
      P`length - 2 >= 0 AND P`length - 2 < P`length - 1 OR
       (EXISTS (j: below(P`length - 1)): P`length - 2 <= j);

  % Assuming TCC generated (at line 41, column 5) for
      % reals@sigma[below(P`length - 1)]
      % generated from assumption sigma.connected_domain
  step_approx_TCC3: OBLIGATION
    FORALL (P: partition[INTab](a, b), xis: xis?[INTab](a, b, P),
            fr: (bounded_on_int?[a, b])):
      FORALL (x, y: below(P`length - 1)), (z: integer):
        x <= z AND z <= y IMPLIES z >= 0 AND z < P`length - 1;

  % Subtype TCC generated (at line 45, column 5) for
      % (LAMBDA (x: INTab):
      %    sigma[below(P`length - 1)]
      %        (0, P`length - 2,
      %         LAMBDA (n: below(P`length - 1)):
      %           fr(xis`seq(n)) * char_fun(P`seq(n), P`seq(n + 1))(x)))
      % expected type  (bounded_on_int?[a, b])
  step_approx_TCC4: OBLIGATION
    FORALL (P: partition[INTab](a, b), xis: xis?[INTab](a, b, P),
            fr: (bounded_on_int?[a, b])):
      bounded_on_int?[a, b]
          (LAMBDA (x: INTab[a, b]):
             sigma[below(P`length - 1)]
                 (0, P`length - 2,
                  LAMBDA (n: below(P`length - 1)):
                    fr(xis`seq(n)) * char_fun(P`seq(n), P`seq(n + 1))(x)));

  % Assuming TCC generated (at line 51, column 13) for
      % riesz_bounded_functionals[a, b, Continuous_Function[a, b]]
      % generated from assumption riesz_bounded_functionals.funs_subspace
  IMP_riesz_bounded_functionals_TCC1: OBLIGATION
    bounded_linear_subspace?[a, b]
        (extend[[INTab[a, b] -> real], Continuous_Function[a, b], bool, FALSE]
             (fullset[Continuous_Function[a, b]]));

  % Assuming TCC generated (at line 51, column 69) for
      % riesz_bounded_functionals[a, b, Bounded_Function[a, b]]
      % generated from assumption riesz_bounded_functionals.funs_subspace
  IMP_riesz_bounded_functionals_TCC2: OBLIGATION
    bounded_linear_subspace?[a, b]
        (extend[[INTab[a, b] -> real], Bounded_Function[a, b], bool, FALSE]
             (fullset[Bounded_Function[a, b]]));

  % Subtype TCC generated (at line 54, column 39) for  LC
      % expected type  L: (bounded_op?)
  riesz_representation_TCC1: OBLIGATION
    FORALL (LC: C_Bounded_Linear_Operator[a, b], g):
      bounded_op?[a, b, Continuous_Function[a, b]](LC);


body:
  top_riesz_representation: THEORY
  %------------------------------------------------------------------------------
  %  All Theories from the Development of the Riesz Representation Theorem
  %------------------------------------------------------------------------------

  BEGIN

  IMPORTING bounded_variation,
  	  riesz_bounded_functionals,
  	  riesz_function_sets,
  	  riesz_hahn_banach,
  	  riesz_interval_funs,
  	  riesz_linear_functionals,
  	  riesz_representation,
  	  rs_integral_cont,
  	  rs_integral_def,
  	  rs_integral_prep,
  	  rs_partition

  END top_riesz_representation


body:
  polynomial_deriv: THEORY
  %------------------------------------------------------------------------------
  %
  %  
  %
  %          David Lester                    Manchester University
  % 
  %------------------------------------------------------------------------------
  BEGIN

    IMPORTING reals@sigma
    IMPORTING derivatives, chain_rule
    IMPORTING derivative_props, convergence_ops
    IMPORTING ints@factorial, nth_derivatives, reals@binomial
    IMPORTING reals@polynomials

    x,y: VAR real
    n,m: VAR nat
    pn:  VAR posnat
    a,b: VAR sequence[real]

    derivable_polynomial: LEMMA derivable?(polynomial(a,n))

    deriv_polynomial    : LEMMA deriv(polynomial(a,n))
                          = IF n = 0 THEN (LAMBDA (x:real): 0)
                            ELSE polynomial((LAMBDA (i:nat): (i+1)*a(i+1)),n-1) 
                            ENDIF

    derivable_n_times_polynomial: LEMMA derivable_n_times?(polynomial(b,m),n)

    nderiv_polynomial  : LEMMA nderiv(n,polynomial(b,m))
              = IF n > m THEN (LAMBDA (x:real): 0)
                ELSE polynomial(LAMBDA (i:nat): C(i+n,n)*factorial(n)*b(i+n),m-n)
                ENDIF


  END polynomial_deriv

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 12, column 12) for  derivatives[real]
      % generated from assumption derivatives.deriv_domain
  derivable_polynomial_TCC1: OBLIGATION deriv_domain?[real];

  % Assuming TCC generated (at line 12, column 12) for  derivatives[real]
      % generated from assumption derivatives.not_one_element
  derivable_polynomial_TCC2: OBLIGATION not_one_element?[real];

  % Subtype TCC generated (at line 24, column 36) for  polynomial(a, n)
      % expected type  deriv_fun[real]
  deriv_polynomial_TCC1: OBLIGATION
    FORALL (a: sequence[real], n: nat): derivable?[real](polynomial(a, n));

  % Subtype TCC generated (at line 26, column 73) for  n - 1
      % expected type  nat
  deriv_polynomial_TCC2: OBLIGATION
    FORALL (n: nat): NOT n = 0 IMPLIES n - 1 >= 0;

  % Subtype TCC generated (at line 31, column 38) for  polynomial(b, m)
      % expected type  nderiv_fun[real](n)
  nderiv_polynomial_TCC1: OBLIGATION
    FORALL (b: sequence[real], m, n: nat):
      derivable_n_times?[real](polynomial(b, m), n);

  % Subtype TCC generated (at line 33, column 52) for  n
      % expected type  {i_1: nat | i_1 <= i + n}
  nderiv_polynomial_TCC2: OBLIGATION
    FORALL (m, n: nat): NOT n > m IMPLIES (FORALL (i: nat): n <= i + n);

  % Subtype TCC generated (at line 33, column 75) for  m - n
      % expected type  nat
  nderiv_polynomial_TCC3: OBLIGATION
    FORALL (m, n: nat): NOT n > m IMPLIES m - n >= 0;


body:
  inverse_continuous_functions [ T1, T2 : NONEMPTY_TYPE FROM real ] : THEORY
  %----------------------------------------------------------------------------
  %  More properties of continuous functions [T1 -> T2]  
  %  Applications of continuity_interval                 
  %----------------------------------------------------------------------------
  BEGIN

    ASSUMING

      connected_domain : ASSUMPTION FORALL (x, y : T1), (z : real) :
    	                             x <= z AND z <= y IMPLIES T1_pred(z)

      % old bug workaround: T1_pred is not correctly expanded
      %  connected_domain : ASSUMPTION
      % 	FORALL (x, y : T1), (z : real) :
      % 	    x <= z AND z <= y IMPLIES (EXISTS (u : T1) : z = u)

    ENDASSUMING

    IMPORTING continuous_functions_props
    

    g : VAR { f : [T1 -> T2] | continuous?(f) }

    %-------------------------------------------------------------
    %  inverse of a continuous, bijective function is continuous
    %-------------------------------------------------------------

    inverse_incr : LEMMA	bijective?[T1, T2](g) AND strict_increasing?(g) 
                             IMPLIES continuous?(inverse(g))

    inverse_decr : LEMMA bijective?[T1, T2](g) AND strict_decreasing?(g) 
                             IMPLIES continuous?(inverse(g))

    inverse_continuous : LEMMA bijective?[T1, T2](g) 
                                  IMPLIES continuous?(inverse(g))
  	
  END inverse_continuous_functions


body:
  derivative_inverse [ T1, T2: TYPE FROM real ]: THEORY
  %------------------------------------------------------------------------------
  %
  % Derivative of Inverse
  %
  % Author: David Lester (Manchester University)
  %
  %------------------------------------------------------------------------------
  BEGIN

    ASSUMING

       IMPORTING  deriv_domain_def

       connected_domain1 : ASSUMPTION connected?[T1]
   
       not_one_element1  : ASSUMPTION not_one_element?[T1]
   
       connected_domain2 : ASSUMPTION connected?[T2]
   
       not_one_element2  : ASSUMPTION not_one_element?[T2]

    ENDASSUMING

    deriv_domain1: LEMMA deriv_domain?[T1]
    deriv_domain2: LEMMA deriv_domain?[T2]


    IMPORTING derivatives, derivative_props, % derivatives_more,
              chain_rule, inverse_continuous_functions,
              lim_of_functions, composition_continuous


    F: VAR [T1 -> T2]
    G: VAR [T2 -> T1]
    f: VAR [T1 -> nzreal] % WAS: {nzx:nzreal| T2_pred(1/nzx)}]
    x: VAR T2


    inverse_derivable: LEMMA
       derivable?[T1](F) AND bijective?[T1,T2](F) AND deriv[T1](F) = f
       AND inverse?[T1,T2](G,F) IMPLIES derivable?[T2](G,x)

    inverse_derivable_fun: LEMMA
       derivable?[T1](F) AND bijective?[T1,T2](F) AND deriv[T1](F) = f
       AND inverse?[T1,T2](G,F) IMPLIES derivable?[T2](G)

    deriv_inverse_fun: LEMMA derivable?[T1](F) AND deriv[T1](F) = f
       AND bijective?[T1,T2](F) AND inverse?[T1,T2](G,F)
     IMPLIES deriv[T2](G) = (LAMBDA (x:T2): 1/f(G(x)))


    deriv_inverse: LEMMA derivable?[T1](F) AND deriv[T1](F) = f
                         AND bijective?[T1,T2](F) AND inverse?[T1,T2](G,F)
                     IMPLIES derivable?[T1](F) AND 
                             deriv[T2](G) = (LAMBDA (x:T2): 1/f(G(x)))

  END derivative_inverse

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 24, column 4) for  derivatives[T1]
      % generated from assumption derivatives.deriv_domain
  inverse_derivable_TCC1: OBLIGATION deriv_domain?[T1];

  % Assuming TCC generated (at line 26, column 4) for  derivatives[T1]
      % generated from assumption derivatives.not_one_element
  inverse_derivable_TCC2: OBLIGATION not_one_element?[T1];

  % Assuming TCC generated (at line 26, column 4) for  derivatives_def[T2]
      % generated from assumption derivatives_def.deriv_domain
  inverse_derivable_TCC3: OBLIGATION
    FORALL (F: [T1 -> T2], G: [T2 -> T1], f: [T1 -> nzreal]):
      inverse?[T1, T2](G, F) AND
       deriv[T1](F) = f AND bijective?[T1, T2](F) AND derivable?[T1](F)
       IMPLIES deriv_domain?[T2];

  % Assuming TCC generated (at line 28, column 4) for  derivatives_def[T2]
      % generated from assumption derivatives_def.not_one_element
  inverse_derivable_TCC4: OBLIGATION
    FORALL (F: [T1 -> T2], G: [T2 -> T1], f: [T1 -> nzreal]):
      inverse?[T1, T2](G, F) AND
       deriv[T1](F) = f AND bijective?[T1, T2](F) AND derivable?[T1](F)
       IMPLIES not_one_element?[T2];

  % Subtype TCC generated (at line 50, column 21) for  G
      % expected type  deriv_fun[T2]
  deriv_inverse_fun_TCC1: OBLIGATION
    FORALL (F: [T1 -> T2], G: [T2 -> T1], f: [T1 -> nzreal]):
      inverse?[T1, T2](G, F) AND
       bijective?[T1, T2](F) AND deriv[T1](F) = f AND derivable?[T1](F)
       IMPLIES derivable?[T2](G);


body:
  sqrt_derivative: THEORY
  %------------------------------------------------------------------------------
  %
  % Derivative of sqrt function
  %
  % Author: David Lester (Manchester University)
  %
  %------------------------------------------------------------------------------

  BEGIN

    IMPORTING reals@sq, reals@sqrt
    IMPORTING derivative_inverse

    sqrt_derivable_fun: LEMMA derivable?[posreal](sqrt)

    deriv_sqrt_fun :  LEMMA deriv[posreal](sqrt)
                               = (LAMBDA (x:posreal): 1/(2*sqrt(x)))

    deriv_sqrt     : LEMMA derivable?[posreal](sqrt) AND
                             deriv[posreal](sqrt)
                                  = (LAMBDA (x:posreal): 1/(2*sqrt(x)))

    sqrt_continuous: LEMMA continuous?[posreal](sqrt)

  END sqrt_derivative

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 24, column 4) for  derivatives[posreal]
      % generated from assumption derivatives.deriv_domain
  sqrt_derivable_fun_TCC1: OBLIGATION deriv_domain?[posreal];

  % Assuming TCC generated (at line 26, column 4) for  derivatives[posreal]
      % generated from assumption derivatives.not_one_element
  sqrt_derivable_fun_TCC2: OBLIGATION not_one_element?[posreal];

  % Subtype TCC generated (at line 17, column 41) for
      % restrict[nonneg_real, posreal, real](sqrt)
      % expected type  deriv_fun[posreal]
  deriv_sqrt_fun_TCC1: OBLIGATION
    derivable?[posreal](restrict[nonneg_real, posreal, real](sqrt));


body:
  restrict2_deriv[T1, T2 : TYPE FROM real] : THEORY

    BEGIN

    ASSUMING

       IMPORTING deriv_domain_def

       deriv_domain_T1: ASSUMPTION deriv_domain?[T1]
       deriv_domain_T2: ASSUMPTION deriv_domain?[T2]

      not_one_element_T1 : ASSUMPTION not_one_element?[T1]

      not_one_element_T2 : ASSUMPTION not_one_element?[T2]

      sub_domain : ASSUMPTION
  	FORALL (x : T1) : EXISTS (y : T2) : x = y

    ENDASSUMING

    IMPORTING derivatives, chain_rule

    f : VAR deriv_fun[T2]
    a : VAR T1
   
    sub_dom : JUDGEMENT T1 SUBTYPE_OF T2  %  FORALL (u : T1) : T2_pred(u)

    restrict2(f) : [T1 -> real] = LAMBDA (u : T1) : f(u)

    CONVERSION restrict2

    restrict2_derivable : LEMMA derivable?[T1](f) 

    restrict2_deriv     : LEMMA deriv(f)(a) = deriv[T1](f)(a)
          

  END restrict2_deriv

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 23, column 10) for  deriv_fun[T2]
      % generated from assumption derivatives.deriv_domain
  f_TCC1: OBLIGATION deriv_domain?[T2];

  % Assuming TCC generated (at line 23, column 10) for  deriv_fun[T2]
      % generated from assumption derivatives.not_one_element
  f_TCC2: OBLIGATION not_one_element?[T2];

  % Judgement subtype TCC generated (at line 26, column 22) for  x
      % expected type  T2
  sub_dom: OBLIGATION FORALL (x: T1): T2_pred(x);

  % Assuming TCC generated (at line 24, column 4) for  derivatives[T1]
      % generated from assumption derivatives.deriv_domain
  restrict2_derivable_TCC1: OBLIGATION deriv_domain?[T1];

  % Assuming TCC generated (at line 26, column 4) for  derivatives[T1]
      % generated from assumption derivatives.not_one_element
  restrict2_derivable_TCC2: OBLIGATION not_one_element?[T1];

  % Subtype TCC generated (at line 34, column 54) for  restrict2(f)
      % expected type  deriv_fun[T1]
  restrict2_deriv_TCC1: OBLIGATION
    FORALL (f: deriv_fun[T2]): derivable?[T1](restrict2(f));


body:
  derivatives_subtype [T: TYPE FROM real, S: TYPE FROM T ] : THEORY
  BEGIN

    ASSUMING
      IMPORTING deriv_domain_def

      deriv_domain     : ASSUMPTION deriv_domain?[T]

      not_one_element  : ASSUMPTION not_one_element?[T]

    ENDASSUMING

    IMPORTING derivatives

    f: VAR [T -> real]

    derivable_subtype: LEMMA derivable?[T](f) AND deriv_domain?[S] AND not_one_element?[S] 
             IMPLIES derivable?[S](f)


    deriv_subtype: LEMMA derivable?[T](f) AND del_neigh_all?[S] AND not_one_element?[S] 
             IMPLIES deriv[S](f) = (LAMBDA (s:S): deriv[T](f)(s))


  END derivatives_subtype

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 24, column 4) for  derivatives[T]
      % generated from assumption derivatives.deriv_domain
  derivable_subtype_TCC1: OBLIGATION deriv_domain?[T];

  % Assuming TCC generated (at line 26, column 4) for  derivatives[T]
      % generated from assumption derivatives.not_one_element
  derivable_subtype_TCC2: OBLIGATION not_one_element?[T];

  % Assuming TCC generated (at line 24, column 4) for  derivatives[S]
      % generated from assumption derivatives.deriv_domain
  derivable_subtype_TCC3: OBLIGATION
    FORALL (f: [T -> real]):
      not_one_element?[S] AND deriv_domain?[S] AND derivable?[T](f) IMPLIES
       deriv_domain?[S];

  % Assuming TCC generated (at line 26, column 4) for  derivatives[S]
      % generated from assumption derivatives.not_one_element
  derivable_subtype_TCC4: OBLIGATION
    FORALL (f: [T -> real]):
      not_one_element?[S] AND deriv_domain?[S] AND derivable?[T](f) IMPLIES
       not_one_element?[S];

  % Subtype TCC generated (at line 22, column 28) for  restrict[T, S, real](f)
      % expected type  deriv_fun[S]
  deriv_subtype_TCC1: OBLIGATION
    FORALL (f: [T -> real]):
      not_one_element?[S] AND del_neigh_all?[S] AND derivable?[T](f) IMPLIES
       derivable?[S](restrict[T, S, real](f));

  % Assuming TCC generated (at line 24, column 4) for  derivatives[S]
      % generated from assumption derivatives.deriv_domain
  deriv_subtype_TCC2: OBLIGATION
    FORALL (f: [T -> real]):
      not_one_element?[S] AND del_neigh_all?[S] AND derivable?[T](f) IMPLIES
       deriv_domain?[S];

  % Assuming TCC generated (at line 26, column 4) for  derivatives[S]
      % generated from assumption derivatives.not_one_element
  deriv_subtype_TCC3: OBLIGATION
    FORALL (f: [T -> real]):
      not_one_element?[S] AND del_neigh_all?[S] AND derivable?[T](f) IMPLIES
       not_one_element?[S];


body:
  deriv_sign: THEORY
  BEGIN

      IMPORTING deriv_domain, derivatives[nzreal], reals@sign

      sign_derivable: LEMMA FORALL (x: nzreal): derivable?[nzreal](sign,x)

      sign_derivable_fun: LEMMA derivable?[nzreal](sign)
      
      deriv_sign: LEMMA deriv[nzreal](sign) = const_fun(0)

   
  END deriv_sign

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 4, column 28) for  derivatives[nzreal]
      % generated from assumption derivatives.deriv_domain
  IMP_derivatives_TCC1: OBLIGATION deriv_domain?[nzreal];

  % Assuming TCC generated (at line 4, column 28) for  derivatives[nzreal]
      % generated from assumption derivatives.not_one_element
  IMP_derivatives_TCC2: OBLIGATION not_one_element?[nzreal];

  % Subtype TCC generated (at line 10, column 36) for
      % restrict[real, nzreal, Sign](sign)
      % expected type  deriv_fun[nzreal]
  deriv_sign_TCC1: OBLIGATION
    derivable?[nzreal](restrict[real, nzreal, Sign](sign));


body:
  derivatives_lam[T: TYPE FROM real ]: THEORY
  %------------------------------------------------------------------------------ 
  % This theory has been created to support auto-rewriting, e.g.
  %
  %    auto-rewrite-theory "derivatives_lam[T]"
  %
  % or via special strategies
  %------------------------------------------------------------------------------ 
  BEGIN

    ASSUMING

      IMPORTING deriv_domain_def

      deriv_domain     : ASSUMPTION deriv_domain?[T]

      not_one_element  : ASSUMPTION not_one_element?[T]

    ENDASSUMING

    IMPORTING derivatives[T]


    t   : VAR T
    a   : VAR real
    b   : VAR nzreal
    n   : VAR nat
    m   : VAR posnat
    f,g : VAR deriv_fun
    k   : VAR nz_deriv_fun

    derivable_id_lam     : LEMMA derivable?(LAMBDA(t):t)
    derivable_const_lam  : LEMMA derivable?(LAMBDA(t):a)
    derivable_add_lam    : LEMMA derivable?(LAMBDA(t):f(t)+g(t))
    derivable_mult_lam   : LEMMA derivable?(LAMBDA(t):f(t)*g(t))
    derivable_pow_lam    : LEMMA derivable?(LAMBDA(t):t^n)
    derivable_scal1_lam  : LEMMA derivable?(LAMBDA(t): a*f(t))
    derivable_scal2_lam  : LEMMA derivable?(LAMBDA(t): f(t)*a)
    derivable_neg_lam    : LEMMA derivable?(LAMBDA(t):-g(t))
    derivable_sub_lam    : LEMMA derivable?(LAMBDA(t):f(t)-g(t))
    derivable_sq_lam     : LEMMA derivable?(LAMBDA(t):sq(t))
    derivable_div_lam    : LEMMA derivable?(LAMBDA(t):f(t)/k(t))
    derivable_scald1_lam : LEMMA derivable?(LAMBDA(t): a/k(t))
    derivable_scald2_lam : LEMMA derivable?(LAMBDA(t): f(t)/b)

    deriv_id_lam         : LEMMA deriv(LAMBDA(t):t) = LAMBDA(t):1
        
    deriv_const_lam      : LEMMA deriv(LAMBDA(t):a) = LAMBDA(t):0
         
    deriv_add_lam        : LEMMA deriv(LAMBDA(t):f(t)+g(t)) = LAMBDA(t): deriv(f)(t) + deriv(g)(t)
        
    deriv_mult_lam       : LEMMA deriv(LAMBDA(t):f(t)*g(t)) 
                                   = LAMBDA(t):deriv(f)(t)*g(t) + deriv(g)(t)*f(t)

    deriv_pow_lam        : LEMMA deriv(LAMBDA(t):t^m) = LAMBDA(t):(m*t^(m-1))

    deriv_scal1_lam      : LEMMA deriv(LAMBDA(t): a*f(t)) = LAMBDA(t):a*deriv(f)(t)

    deriv_scal2_lam      : LEMMA deriv(LAMBDA(t): f(t)*a) = LAMBDA(t):a*deriv(f)(t)

    deriv_neg_lam        : LEMMA deriv(LAMBDA(t):-g(t)) = LAMBDA(t):-deriv(g)(t)

    deriv_sub_lam        : LEMMA deriv(LAMBDA(t):f(t)-g(t)) = LAMBDA(t):deriv(f)(t)-deriv(g)(t)

    deriv_sq_lam         : LEMMA deriv(LAMBDA(t):sq(t)) = LAMBDA(t):2*t

    deriv_div_lam        : LEMMA deriv(LAMBDA(t):f(t)/k(t)) 
                                    = LAMBDA(t):(deriv(f)(t)*k(t) - deriv(k)(t)*f(t)) / sq(k(t))

    deriv_scald1_lam     : LEMMA deriv(LAMBDA(t): a/k(t)) 
                                    = LAMBDA(t):-a*deriv(k)(t)/sq(k(t))

    deriv_scald2_lam     : LEMMA deriv(LAMBDA(t): f(t)/b) = LAMBDA(t):(deriv(f)(t))/b

  END derivatives_lam

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 21, column 12) for  derivatives[T]
      % generated from assumption derivatives.deriv_domain
  IMP_derivatives_TCC1: OBLIGATION deriv_domain?[T];

  % Assuming TCC generated (at line 21, column 12) for  derivatives[T]
      % generated from assumption derivatives.not_one_element
  IMP_derivatives_TCC2: OBLIGATION not_one_element?[T];

  % Subtype TCC generated (at line 36, column 54) for  n
      % expected type  {i: int | t /= 0 OR i >= 0}
  derivable_pow_lam_TCC1: OBLIGATION FORALL (n: nat, t: T): t /= 0 OR n >= 0;

  % Subtype TCC generated (at line 46, column 37) for  LAMBDA (t): t
      % expected type  deriv_fun[T]
  deriv_id_lam_TCC1: OBLIGATION derivable?[T](LAMBDA (t): t);

  % Subtype TCC generated (at line 48, column 37) for  LAMBDA (t): a
      % expected type  deriv_fun[T]
  deriv_const_lam_TCC1: OBLIGATION
    FORALL (a: real): derivable?[T](LAMBDA (t): a);

  % Subtype TCC generated (at line 50, column 37) for  LAMBDA (t): f(t) + g(t)
      % expected type  deriv_fun[T]
  deriv_add_lam_TCC1: OBLIGATION
    FORALL (f, g: deriv_fun[T]): derivable?[T](LAMBDA (t): f(t) + g(t));

  % Subtype TCC generated (at line 52, column 37) for  LAMBDA (t): f(t) * g(t)
      % expected type  deriv_fun[T]
  deriv_mult_lam_TCC1: OBLIGATION
    FORALL (f, g: deriv_fun[T]): derivable?[T](LAMBDA (t): f(t) * g(t));

  % Subtype TCC generated (at line 55, column 49) for  m
      % expected type  {i: int | t /= 0 OR i >= 0}
  deriv_pow_lam_TCC1: OBLIGATION FORALL (m: posnat, t: T): t /= 0 OR m >= 0;

  % Subtype TCC generated (at line 55, column 37) for  LAMBDA (t): t ^ m
      % expected type  deriv_fun[T]
  deriv_pow_lam_TCC2: OBLIGATION
    FORALL (m: posnat): derivable?[T](LAMBDA (t): t ^ m);

  % Subtype TCC generated (at line 55, column 70) for  (m - 1)
      % expected type  {i: int | t /= 0 OR i >= 0}
  deriv_pow_lam_TCC3: OBLIGATION
    FORALL (m: posnat, t: T): t /= 0 OR (m - 1) >= 0;

  % Subtype TCC generated (at line 57, column 37) for  LAMBDA (t): a * f(t)
      % expected type  deriv_fun[T]
  deriv_scal1_lam_TCC1: OBLIGATION
    FORALL (a: real, f: deriv_fun[T]): derivable?[T](LAMBDA (t): a * f(t));

  % Subtype TCC generated (at line 59, column 37) for  LAMBDA (t): f(t) * a
      % expected type  deriv_fun[T]
  deriv_scal2_lam_TCC1: OBLIGATION
    FORALL (a: real, f: deriv_fun[T]): derivable?[T](LAMBDA (t): f(t) * a);

  % Subtype TCC generated (at line 61, column 37) for  LAMBDA (t): -g(t)
      % expected type  deriv_fun[T]
  deriv_neg_lam_TCC1: OBLIGATION
    FORALL (g: deriv_fun[T]): derivable?[T](LAMBDA (t): -g(t));

  % Subtype TCC generated (at line 63, column 37) for  LAMBDA (t): f(t) - g(t)
      % expected type  deriv_fun[T]
  deriv_sub_lam_TCC1: OBLIGATION
    FORALL (f, g: deriv_fun[T]): derivable?[T](LAMBDA (t): f(t) - g(t));

  % Subtype TCC generated (at line 65, column 37) for  LAMBDA (t): sq(t)
      % expected type  deriv_fun[T]
  deriv_sq_lam_TCC1: OBLIGATION derivable?[T](LAMBDA (t): sq(t));

  % Subtype TCC generated (at line 67, column 37) for  LAMBDA (t): f(t) / k(t)
      % expected type  deriv_fun[T]
  deriv_div_lam_TCC1: OBLIGATION
    FORALL (f: deriv_fun[T], k: nz_deriv_fun[T]):
      derivable?[T](LAMBDA (t): f(t) / k(t));

  % Subtype TCC generated (at line 70, column 37) for  LAMBDA (t): a / k(t)
      % expected type  deriv_fun[T]
  deriv_scald1_lam_TCC1: OBLIGATION
    FORALL (a: real, k: nz_deriv_fun[T]): derivable?[T](LAMBDA (t): a / k(t));

  % Subtype TCC generated (at line 73, column 37) for  LAMBDA (t): f(t) / b
      % expected type  deriv_fun[T]
  deriv_scald2_lam_TCC1: OBLIGATION
    FORALL (b: nzreal, f: deriv_fun[T]): derivable?[T](LAMBDA (t): f(t) / b);


body:
  top_derivative : THEORY
  %----------------------------------------------------------------------------
  %  Author:  Bruno Dutertre    Royal Holloway & Bedford New College
  %----------------------------------------------------------------------------
  BEGIN

    IMPORTING derivatives, derivative_props, derivatives_lam, chain_rule,  
  %            derivatives_more,      % added at NASA Langley moved to derivative_props
              deriv_domain,          % domain generalized: 1-4-2010
              deriv_domains,
              deriv_sign,
              derivatives_subtype,

              restrict2_deriv,       % David Lester
              sqrt_derivative,       % David Lester
              derivative_inverse,     % David Lester
              
              polynomial_deriv,
              nth_derivatives,
              taylors


  END top_derivative


body:
  convex_function_props: THEORY
  %------------------------------------------------------------------------------
  % In this theory, we prove basic analytic properties of convex functions. In
  % particular, they are continuous.
  %
  %     Authors: Anthony Narkawicz,  NASA Langley
  %
  %     Version 1.0         10/23/2009  Initial Version
  %------------------------------------------------------------------------------

  BEGIN

    IMPORTING real_metric_space, continuity_ms_def, reals@convex_functions

    f: VAR [real -> real]
    A,B,C,X,Y: VAR real



    convex_functions_locally_bounded: LEMMA convex?(f) IMPLIES FORALL (A, B: real):
      A<=B IMPLIES EXISTS (M: nat): FORALL (x: real): A<=x AND x<=B IMPLIES abs(f(x)) < M

    convex_diff_quot_left_lt: LEMMA convex?(f) IMPLIES FORALL(A,B,C):
      A<B AND B<C IMPLIES (f(C)-f(B))/(C-B) >= (f(C)-f(A))/(C-A)

    convex_diff_quot_right_lt: LEMMA convex?(f) IMPLIES FORALL(A,B,C):
      A<B AND B<C IMPLIES (f(B)-f(A))/(B-A) <= (f(C)-f(A))/(C-A)

    convex_diff_quot_increasing: LEMMA convex?(f) IMPLIES FORALL(A,B,C):
      A<B AND B<C IMPLIES (f(B)-f(A))/(B-A) <= (f(C)-f(B))/(C-B)

    convex_diff_quot_bounded: LEMMA convex?(f) IMPLIES
      FORALL (x: real): FORALL (epsil: posreal): EXISTS (M: nat):
      FORALL (delta: nzreal):
      abs(delta)<=epsil IMPLIES abs(f(x+delta)-f(x))/abs(delta) < M


    convex_functions_continuous: LEMMA convex?(f) IMPLIES
      continuous?[real,real_dist,real,real_dist](f)


  END convex_function_props

addendum:
  %%% ================ Addendum: generated declarations ================

  % Subtype TCC generated (at line 24, column 37) for  (C - B)
      % expected type  nznum
  convex_diff_quot_left_lt_TCC1: OBLIGATION
    FORALL (f: [real -> real]):
      convex?(f) IMPLIES
       (FORALL (A: real, B: real, C: real):
          A < B AND B < C IMPLIES (C - B) /= 0);

  % Subtype TCC generated (at line 24, column 58) for  (C - A)
      % expected type  nznum
  convex_diff_quot_left_lt_TCC2: OBLIGATION
    FORALL (f: [real -> real]):
      convex?(f) IMPLIES
       (FORALL (A: real, B: real, C: real):
          A < B AND B < C IMPLIES (C - A) /= 0);

  % Subtype TCC generated (at line 27, column 37) for  (B - A)
      % expected type  nznum
  convex_diff_quot_right_lt_TCC1: OBLIGATION
    FORALL (f: [real -> real]):
      convex?(f) IMPLIES
       (FORALL (A: real, B: real, C: real):
          A < B AND B < C IMPLIES (B - A) /= 0);

  % Assuming TCC generated (at line 17, column 8) for
      % continuity_ms_def[real, real_dist, real, real_dist]
      % generated from assumption continuity_ms_def.fullset_metric_space1
  convex_functions_continuous_TCC1: OBLIGATION
    FORALL (f: [real -> real]):
      convex?(f) IMPLIES metric_space?[real, real_dist](fullset[real]);


body:
  %------------------------------------------------------------------------------
  % The Inverse Of A Continuous Function (on a metric space) is Continuous
  %
  %     Author: Anthony Narkawicz,  NASA Langley
  %
  %     Version 1.0            10/27/09  Initial Version
  %------------------------------------------------------------------------------

  inverse_fun_ms_continuous[T1:Type+,d1:[T1,T1->nnreal],
             T2:Type+,d2:[T2,T2->nnreal]]: THEORY

  BEGIN
      ASSUMING IMPORTING metric_spaces

          fullset_metric_space1: ASSUMPTION metric_space?[T1,d1](fullset[T1])
          fullset_metric_space2: ASSUMPTION metric_space?[T2,d2](fullset[T2])

      ENDASSUMING

    IMPORTING uniform_continuity[T1,d1,T2,d2], continuity_ms[T2,d2,T1,d1]


    image_function_continuous: THEOREM FORALL (f:[T1->T2]): 
    	    continuous?(f) AND compact?(fullset[T1]) AND bijective?(f) 
  	    IMPLIES 
  	    continuous?(inverse(f))


  END inverse_fun_ms_continuous

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 20, column 12) for
      % uniform_continuity[T1, d1, T2, d2]
      % generated from assumption uniform_continuity.fullset_S_metric_space
  IMP_uniform_continuity_TCC1: OBLIGATION metric_space?[T1, d1](fullset[T1]);

  % Assuming TCC generated (at line 20, column 12) for
      % uniform_continuity[T1, d1, T2, d2]
      % generated from assumption uniform_continuity.fullset_T_metric_space
  IMP_uniform_continuity_TCC2: OBLIGATION metric_space?[T2, d2](fullset[T2]);


body:
  %---------------------------------------------------------------------------------------------------
  %
  %       On Metric Spaces, The Composition Of Two Continuous Functions Is Continuous
  %
  %       Author: Anthony Narkawicz, NASA Langley
  %
  %       
  %       Version 1.0                     August 25, 2009
  %
  %---------------------------------------------------------------------------------------------------


  ms_composition_cont[T1:Type+,d1:[T1,T1->nnreal],
                    T2:Type+,d2:[T2,T2->nnreal],T3:TYPE+,d3:[T3,T3->nnreal]]: THEORY

  BEGIN

      ASSUMING IMPORTING metric_spaces

          fullset_metric_space1: ASSUMPTION metric_space?[T1,d1](fullset[T1])
          fullset_metric_space2: ASSUMPTION metric_space?[T2,d2](fullset[T2])
          fullset_metric_space3: ASSUMPTION metric_space?[T3,d3](fullset[T3])

      ENDASSUMING

    IMPORTING continuity_ms[T1,d1,T2,d2], continuity_ms[T2,d2,T3,d3],continuity_ms[T1,d1,T3,d3]

    S: VAR set[T1]
    f: VAR [T1 -> T2]
    g: VAR [T2 -> T3]

    
    composition_continuous: LEMMA continuous?(f,S) AND continuous?(g,image[T1,T2](f,S))
    			  IMPLIES continuous?(g o f,S)
    

  END ms_composition_cont

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 26, column 12) for
      % continuity_ms[T1, d1, T2, d2]
      % generated from assumption continuity_ms.fullset_metric_space1
  IMP_continuity_ms_TCC1: OBLIGATION metric_space?[T1, d1](fullset[T1]);

  % Assuming TCC generated (at line 26, column 12) for
      % continuity_ms[T1, d1, T2, d2]
      % generated from assumption continuity_ms.fullset_metric_space2
  IMP_continuity_ms_TCC2: OBLIGATION metric_space?[T2, d2](fullset[T2]);

  % Assuming TCC generated (at line 26, column 40) for
      % continuity_ms[T2, d2, T3, d3]
      % generated from assumption continuity_ms.fullset_metric_space2
  IMP_continuity_ms_TCC3: OBLIGATION metric_space?[T3, d3](fullset[T3]);


body:
  continuity_of_max_min[T:TYPE+,d:[T,T->nnreal]]: THEORY
  %------------------------------------------------------------------------------
  % In This Theory, We Prove That For Continuous Real-Valued Functions
  % f And g On A Metric Space, The Functions max(f,g) And min(f,g)
  % Are Also Continuous
  %
  %     Authors: Anthony Narkawicz,  NASA Langley
  %
  %     Version 1.0         9/16/2009  Initial Version
  %------------------------------------------------------------------------------
  BEGIN

     ASSUMING IMPORTING metric_spaces_def[T,d]
         fullset_metric_space: ASSUMPTION metric_space?[T,d](fullset[T])
     ENDASSUMING

     S: VAR set[T]

     % A continuous function on a compact set realizes a maximum and a minimum


     IMPORTING real_metric_space, continuity_ms_def[T,d,real,real_dist], reals@abs_lems, 
               compactness[T,d]

     f,g: VAR [T -> real]
     x: VAR T

     max_fun(f,g)(x): real = max(f(x),g(x))
     min_fun(f,g)(x): real = min(f(x),g(x))

     max_min_fun_convert: LEMMA max_fun(-f,-g) = -min_fun(f,g) AND min_fun(-f,-g) = -max_fun(f,g)
     			      AND min_fun(f,g) = -max_fun(-f,-g) AND max_fun(f,g) = -min_fun(-f,-g)

     max_fun_continuous: LEMMA continuous?(f,S) AND continuous?(g,S) IMPLIES
     		       	     continuous?(max_fun(f,g),S)

     min_fun_continuous: LEMMA continuous?(f,S) AND continuous?(g,S) IMPLIES
     		       	     continuous?(min_fun(f,g),S)


  END continuity_of_max_min

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 22, column 32) for
      % continuity_ms_def[T, d, real, real_dist]
      % generated from assumption continuity_ms_def.fullset_metric_space1
  IMP_continuity_ms_def_TCC1: OBLIGATION metric_space?[T, d](fullset[T]);

  % Assuming TCC generated (at line 22, column 32) for
      % continuity_ms_def[T, d, real, real_dist]
      % generated from assumption continuity_ms_def.fullset_metric_space2
  IMP_continuity_ms_def_TCC2: OBLIGATION
    metric_space?[real, real_dist](fullset[real]);


body:
  %--------------------------------------------------------------------------------------------------
  %
  %	Product (Metric) Spaces
  %
  %	Author: Anthony Narkawicz, NASA Langley
  %
  %	
  %	Version 1.0			August 19, 2009
  %
  %--------------------------------------------------------------------------------------------------


  cross_metric_spaces[T1:Type+,d1:[T1,T1->nnreal],T2:Type+,d2:[T2,T2->nnreal]]: THEORY

  BEGIN

      ASSUMING IMPORTING metric_spaces

          fullset_metric_space1: ASSUMPTION metric_space?[T1,d1](fullset[T1])
          fullset_metric_space2: ASSUMPTION metric_space?[T2,d2](fullset[T2])

      ENDASSUMING

    IMPORTING metric_spaces, reals@sqrt,reals@sq

    X,S: VAR set[T1]
    Y,T: VAR set[T2]
    x,y: VAR [T1,T2]
    z,w: VAR T2

   
    d(x,y): nnreal = d1(x`1,y`1) + d2(x`2,y`2)

    product_is_metric:  LEMMA metric_space?[[T1,T2],d](fullset[[T1,T2]])

    d_square(x,y): nnreal = sqrt(sq(d1(x`1,y`1)) + sq(d2(x`2,y`2)))

    product_is_metric_square: LEMMA metric_space?[[T1,T2],d_square](fullset[[T1,T2]])


    %% These to metrics produce equivalent topologies %%

    V,U: VAR set[[T1,T2]]

    % a quick lemma that will be used in the proof of the metric equivalence...

    euclic_linear_lemma: LEMMA   
       FORALL (a,b,r: nnreal): sqrt(sq(a) + sq(b)) < r/2 implies a+b<r

    metric_equivalence:  LEMMA   
       open_in?[[T1,T2],d](V,U) IFF open_in?[[T1,T2],d_square](V,U)

    metric_equivalence2: COROLLARY 
       open?[[T1,T2],d](V) IFF open?[[T1,T2],d_square](V)

  END cross_metric_spaces

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 21, column 6) for
      % metric_spaces[[T1, T2], d]
      % generated from assumption metric_spaces.fullset_metric_space
  metric_equivalence_TCC1: OBLIGATION
    metric_space?[[T1, T2], d](fullset[[T1, T2]]);

  % Assuming TCC generated (at line 21, column 6) for
      % metric_spaces[[T1, T2], d_square]
      % generated from assumption metric_spaces.fullset_metric_space
  metric_equivalence_TCC2: OBLIGATION
    metric_space?[[T1, T2], d_square](fullset[[T1, T2]]);


body:
  %---------------------------------------------------------------------------------------------------------
  %
  %       Continuity of functions on product (metric) spaces
  %
  %       Author: Anthony Narkawicz, NASA Langley
  %
  %       
  %       Version 1.0                     August 19, 2009
  %
  %---------------------------------------------------------------------------------------------------------


  cross_metric_cont[T1:Type+,d1:[T1,T1->nnreal],
                    T2:Type+,d2:[T2,T2->nnreal],T3:TYPE+,d3:[T3,T3->nnreal]]: THEORY

  BEGIN

      ASSUMING IMPORTING metric_spaces

          fullset_metric_space1: ASSUMPTION metric_space?[T1,d1](fullset[T1])
          fullset_metric_space2: ASSUMPTION metric_space?[T2,d2](fullset[T2])
          fullset_metric_space3: ASSUMPTION metric_space?[T3,d3](fullset[T3])

      ENDASSUMING

    IMPORTING cross_metric_spaces[T1,d1,T2,d2], continuity_ms_def[[T1,T2],d[T1,d1,T2,d2],T3,d3],
    	    uniform_continuity[T1,d1,T3,d3]

    S: VAR set[[T1,T2]]
    X: VAR set[T1]
    Y: VAR set[T2]
    f: VAR [[T1,T2] -> T3]

    product_cont_equiv: LEMMA 
      continuous?(f,S) IFF 
         (FORALL (x: (S), epsilon: posreal):  EXISTS (delta: posreal): 
              FORALL (y: (S)): (d1(x`1,y`1) <= delta AND d2(x`2,y`2) <= delta) 
                 IMPLIES d3(f(x),f(y))<epsilon)

    product_cont_product_subset: COROLLARY 
       continuous?(f,fullset[[(X),(Y)]]) IFF 
          (FORALL (x: (X), y: (Y), epsilon: posreal): EXISTS (delta: posreal): 
              FORALL (z: (X), w: (Y)): (d1(x,z) <= delta AND d2(y,w) <= delta) 
                  IMPLIES d3(f(x,y),f(z,w))<epsilon)



    % -----------    Uniform Continuity In One Variable  ---------------

    
    uniformly_continuous_in_first?(f,X,Y): bool = 
       FORALL (y1: (Y), epsilon: posreal): EXISTS (delta: posreal):
          FORALL (x1,x2: (X), y2: (Y)): (d1(x1,x2) <= delta AND d2(y1,y2) <= delta) 
              IMPLIES d3(f(x1,y1),f(x2,y2))<epsilon

    uniformly_continuous_in_second?(f,X,Y): bool = 
       FORALL (x1: (X), epsilon: posreal): EXISTS (delta: posreal):
          FORALL (x2: (X), y1,y2: (Y)): (d1(x1,x2) <= delta AND d2(y1,y2) <= delta) 
              IMPLIES d3(f(x1,y1),f(x2,y2))<epsilon


    % ---------     An Equivalent, Sequence Definition Of Uniform Continuity In One Variable ----

    one_variable_unif_cont_sequence: LEMMA NOT uniformly_continuous_in_first?(f,X,Y) IFF
    		EXISTS (epsilon: posreal): EXISTS (y: (Y)): EXISTS (seq: [posint -> [T1,T1,T2]]):
  		FORALL (n: posint): 
  		       (X(seq(n)`1) AND X(seq(n)`2) AND Y(seq(n)`3) 
  		       AND d1(seq(n)`1,seq(n)`2) < 1/n AND d2(y,seq(n)`3) < 1/n
  		       AND d3(f(seq(n)`1,y),f(seq(n)`2,seq(n)`3)) > epsilon)

    %---------     This implies that the associated curried function is uniformly continuous ----

    curried_is_uniform: LEMMA uniformly_continuous_in_first?(f,X,Y) IMPLIES (FORALL (y: (Y)):
    		      	    uniformly_continuous?((LAMBDA (t: T1): f(t,y)),X))
    	        


    

  END cross_metric_cont

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 26, column 12) for
      % cross_metric_spaces[T1, d1, T2, d2]
      % generated from assumption cross_metric_spaces.fullset_metric_space1
  IMP_cross_metric_spaces_TCC1: OBLIGATION metric_space?[T1, d1](fullset[T1]);

  % Assuming TCC generated (at line 26, column 12) for
      % cross_metric_spaces[T1, d1, T2, d2]
      % generated from assumption cross_metric_spaces.fullset_metric_space2
  IMP_cross_metric_spaces_TCC2: OBLIGATION metric_space?[T2, d2](fullset[T2]);

  % Assuming TCC generated (at line 26, column 46) for
      % continuity_ms_def[[T1, T2], d[T1, d1, T2, d2], T3, d3]
      % generated from assumption continuity_ms_def.fullset_metric_space1
  IMP_continuity_ms_def_TCC1: OBLIGATION
    metric_space?[[T1, T2], d[T1, d1, T2, d2]](fullset[[T1, T2]]);

  % Assuming TCC generated (at line 26, column 46) for
      % continuity_ms_def[[T1, T2], d[T1, d1, T2, d2], T3, d3]
      % generated from assumption continuity_ms_def.fullset_metric_space2
  IMP_continuity_ms_def_TCC2: OBLIGATION metric_space?[T3, d3](fullset[T3]);


body:
  %---------------------------------------------------------------------------------------------------
  %
  %       One-Variable Uniform Continuity of Functions on Product (Metric) Spaces
  %
  %       Author: Anthony Narkawicz, NASA Langley
  %
  %       
  %       Version 1.0                     August 25, 2009
  %
  %---------------------------------------------------------------------------------------------------


  cross_metric_uniform_continuity[T1:Type+,d1:[T1,T1->nnreal],
                    T2:Type+,d2:[T2,T2->nnreal],T3:TYPE+,d3:[T3,T3->nnreal]]: THEORY

  BEGIN

      ASSUMING IMPORTING metric_spaces

          fullset_metric_space1: ASSUMPTION metric_space?[T1,d1](fullset[T1])
          fullset_metric_space2: ASSUMPTION metric_space?[T2,d2](fullset[T2])
          fullset_metric_space3: ASSUMPTION metric_space?[T3,d3](fullset[T3])

      ENDASSUMING

    IMPORTING cross_metric_spaces[T1,d1,T2,d2], continuity_ms_def[[T1,T2],d[T1,d1,T2,d2],T3,d3], 
              cross_metric_cont[T1,d1,T2,d2,T3,d3], compactness[T1,d1]

    S: VAR set[[T1,T2]]
    X: VAR set[T1]
    Y: VAR set[T2]
    f: VAR [[T1,T2] -> T3]

    multiary_Heine: THEOREM 
       compact?(X) AND continuous?(f,fullset[[(X),(Y)]]) 
       IMPLIES uniformly_continuous_in_first?(f,X,Y)

    multi_Heine_Corollary1: COROLLARY 
       compact?(X) AND continuous?(f,fullset[[(X),(Y)]]) 
       IMPLIES 
            FORALL (y1: (Y), epsilon: posreal): EXISTS (delta: posreal):
               FORALL (y2: (Y)): (d2(y1,y2) <= delta) 
                  IMPLIES (FORALL (x: (X)): d3(f(x,y1),f(x,y2)) < epsilon)


    % A Type Consisting Of All Functions That Are Uniformly Continuous In The First Variable

    first_var_unif(X,Y): TYPE = {g: [[T1,T2] -> T3] | uniformly_continuous_in_first?(g,X,Y)}
    

  END cross_metric_uniform_continuity

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 26, column 12) for
      % cross_metric_spaces[T1, d1, T2, d2]
      % generated from assumption cross_metric_spaces.fullset_metric_space1
  IMP_cross_metric_spaces_TCC1: OBLIGATION metric_space?[T1, d1](fullset[T1]);

  % Assuming TCC generated (at line 26, column 12) for
      % cross_metric_spaces[T1, d1, T2, d2]
      % generated from assumption cross_metric_spaces.fullset_metric_space2
  IMP_cross_metric_spaces_TCC2: OBLIGATION metric_space?[T2, d2](fullset[T2]);

  % Assuming TCC generated (at line 26, column 46) for
      % continuity_ms_def[[T1, T2], d[T1, d1, T2, d2], T3, d3]
      % generated from assumption continuity_ms_def.fullset_metric_space1
  IMP_continuity_ms_def_TCC1: OBLIGATION
    metric_space?[[T1, T2], d[T1, d1, T2, d2]](fullset[[T1, T2]]);

  % Assuming TCC generated (at line 26, column 46) for
      % continuity_ms_def[[T1, T2], d[T1, d1, T2, d2], T3, d3]
      % generated from assumption continuity_ms_def.fullset_metric_space2
  IMP_continuity_ms_def_TCC2: OBLIGATION metric_space?[T3, d3](fullset[T3]);


body:
  %---------------------------------------------------------------------------------------------------------
  %
  %       One-Variable Uniform Continuity of Real Valued Functions on Product Metric Spaces
  %
  %       Author: Anthony Narkawicz, NASA Langley
  %
  %       
  %       Version 1.0                     August 27, 2009
  %
  %---------------------------------------------------------------------------------------------------------


  cross_metric_real_fun[T1:Type+,d1:[T1,T1->nnreal],
                    T2:Type+,d2:[T2,T2->nnreal]]: THEORY

  BEGIN

      ASSUMING IMPORTING metric_spaces

          fullset_metric_space1: ASSUMPTION metric_space?[T1,d1](fullset[T1])
          fullset_metric_space2: ASSUMPTION metric_space?[T2,d2](fullset[T2])

      ENDASSUMING

    IMPORTING real_metric_space,cross_metric_uniform_continuity[T1,d1,T2,d2,real,real_dist], continuity_ms[T2,d2,real,real_dist], real_fun_on_compact_sets[T1,d1]

    X: VAR set[T1]
    Y: VAR set[T2]
    f: VAR [[T1,T2] -> real]




    % If X is compact, then the function unif_min_first(f,X) = (LAMBDA (t: T2) = min({r: real | EXISTS (x: (X)): r = f(x,t)}))
    % is continuous.

    IMPORTING reals@bounded_reals[real]

    % The main TCC:

    curried_min_exists: LEMMA nonempty?(X) AND continuous?(f,fullset[[(X),(Y)]]) AND compact?(X)
       IMPLIES (FORALL (t: T2): Y(t) IMPLIES
           nonempty?[real]({r: real | EXISTS (x: (X)): r = f(x, t)}) AND
            below_bounded[real]({r: real | EXISTS (x: (X)): r = f(x, t)}) AND
             ext[real]({r: real | EXISTS (x: (X)): r = f(x, t)})(inf[real]({r: real | EXISTS (x: (X)): r = f(x, t)}))
  	   AND (EXISTS (x: (X)): FORALL (y: (X)): f(x,t) <= f(y,t)))

    curried_min_is_cont: THEOREM (compact?(X) AND continuous?(f,fullset[[(X),(Y)]]) AND nonempty?(X)) IMPLIES
    		       LET unif_min_first(t: T2): real = IF Y(t) THEN min({r: real | EXISTS (x: (X)): r = f(x,t)}) ELSE 0 ENDIF
  		       IN  continuous?(unif_min_first,Y)

    

  END cross_metric_real_fun

addendum:
  %%% ================ Addendum: generated declarations ================

  % Assuming TCC generated (at line 25, column 30) for
      % cross_metric_uniform_continuity[T1, d1, T2, d2, real, real_dist]
      % generated from assumption cross_metric_uniform_continuity.fullset_metric_space1
  IMP_cross_metric_uniform_continuity_TCC1: OBLIGATION
    metric_space?[T1, d1](fullset[T1]);

  % Assuming TCC generated (at line 25, column 30) for
      % cross_metric_uniform_continuity[T1, d1, T2, d2, real, real_dist]
      % generated from assumption cross_metric_uniform_continuity.fullset_metric_space2
  IMP_cross_metric_uniform_continuity_TCC2: OBLIGATION
    metric_space?[T2, d2](fullset[T2]);

  % Assuming TCC generated (at line 25, column 30) for
      % cross_metric_uniform_continuity[T1, d1, T2, d2, real, real_dist]
      % generated from assumption cross_metric_uniform_continuity.fullset_metric_space3
  IMP_cross_metric_uniform_continuity_TCC3: OBLIGATION
    metric_space?[real, real_dist](fullset[real]);

  % Subtype TCC generated (at line 49, column 62) for
      % {r: real | EXISTS (x: (X)): r = f(x, t)}
      % expected type  min_set[real]
  curried_min_is_cont_TCC1: OBLIGATION
    FORALL (X: set[T1], Y: set[T2], f: [[T1, T2] -> real]):
      nonempty?(X) AND
       continuous?(f,
                   extend[[T1, T2], [(X), (Y)], bool, FALSE]
                       (fullset[[(X), (Y)]]))
        AND compact?(X)
       IMPLIES
       (FORALL (t: T2):
          Y(t) IMPLIES
           nonempty?[real]({r: real | EXISTS (x: (X)): r = f(x, t)}) AND
            below_bounded[real]({r: real | EXISTS (x: (X)): r = f(x, t)}) AND
             ext[real]
                 ({r: real | EXISTS (x: (X)): r = f(x, t)})
                 (inf[real]({r: real | EXISTS (x: (X)): r = f(x, t)})));


body:
  top_metric_spaces: THEORY
  BEGIN

    IMPORTING metric_spaces, continuity_ms, %% composition,

              uniform_continuity,
              compactness,
              cross_metric_spaces,
              cross_metric_cont,
  	    continuity_ms_def,
  	    continuity_ms,
  	    cross_metric_uniform_continuity,
  	    metric_spaces,
  	    cross_metric_real_fun,
  	    real_fun_on_compact_sets,
  	    real_metric_space,
              continuity_of_max_min,
              ms_composition_cont,
              metric_space_real_fun,
  	    inverse_fun_ms_continuous,
              
              convex_function_props


  END top_metric_spaces


